v2.0.0

GuideCheck 2.0.0 release notes

Release version: 2.0.0

GuideCheck 2.0.0 adds the opt-in corrected-content-1 policy for guides that
explicitly declare profile 2.0.0. It retains the 1.0.0-strict anchor policy:
repository-file evidence remains corroborating and cannot qualify a guide for
Level 4. An unresolved execution target blocks Level 3 under this policy.

The release preserves the isolated 0.7.1 legacy engine, the prior 1.0.0
profile, the 0.7.1 self-guide, and all frozen reports. Existing guides are not
migrated or reinterpreted automatically.

The experimental POSIX JSON CLI contract, selected with
--contract posix-json-v1, is independent of the guide-declared profile
selector. See the CLI contract.

The normative requirements are in the
2.0.0 specification and
verifier conformance profile.

Verified delivery

Released commit: 0991c18ec6dd8b966d67bab9802f6559e7e74b91, identified by the signed v2.0.0 tag and production deployment manifest.

• Release metadata PR #4 merged after Python 3.10/3.12 CI; main CI and the release workflow passed on the released commit.
• All 24 published contract files matched exact source hashes. Live legacy/strict/corrected dispatch, unresolved-execution blocking, required-profile rejection, and the 404 route passed. Existing GuideCheck and A11y legacy consumer results were preserved.
• All 12 downloaded asset digests and SHA256SUMS matched. Source tar/ZIP contents matched all 395 tagged source files; the conformance kit matched 279 tagged files.
• All four Cosign signatures verified the release-workflow identity, exact source SHA, and transparency-log inclusion. Installation from the downloaded source passed legacy, strict, corrected, experimental-contract, and scanner consumer checks.

Successful hosted Level 4 fixture behavior remains covered by controlled tests. The live fixture checks exercised declared profile selection and unavailable-manifest handling. No adopter guide or anchor was migrated.