EffectWitness v0.4.0

EffectWitness 0.4.0 is a prerelease that adds a separate, bounded
coding-agent reconciliation evidence lane.

What changed:

• Added schema-v5 artifacts for a deterministic mini-swe-agent 2.4.6 fixture.
  The lane uses the upstream DefaultAgent, DeterministicModel, and
  LocalEnvironment against one synthetic Git patch in a disposable local
  workspace.
• Added four registered scenarios across three rounds: clean,
  save-fault/blind-restart, save-fault/reconcile, and
  save-fault/reconcile-with-tampering.
• Added an application-level trajectory-save fault, a durable
  prepare/execute/effect/commit journal, and reconciliation checks that bind
  the registered pre-state, post-state, patch, command result, and effect.
• Added a fail-closed offline verifier that independently recomputes the
  schema-v5 relationships without importing or running mini-swe-agent.
• Added exact dependency provenance for the public
  mini_swe_agent-2.4.6-py3-none-any.whl:
  115,037 bytes, SHA-256
  a35463c553ac825c7773b03cfa69cd44958e3af20155dcc5711fdf9e4c67cd54.
  The accompanying 93-package version snapshot is a compatibility constraint,
  not a hash lock.
• Added fresh Windows and Ubuntu CI lanes that download the exact wheel,
  install only binary dependencies, run the matrix, verify the artifact
  offline, and run the privacy scanner.
• Bundled a Windows CPython 3.12.10 x86-64 reference artifact with 8 files,
  81,392 bytes, 21 completed worker records, and 15 registered command
  executions. Its manifest-file SHA-256 is
  ce2de79f1c4b19b16cb052adb1b5a47175d4988973f4bef52a8effed4167561c.

Verification:

• The exact tagged commit passed all 13 GitHub Actions jobs across Ubuntu and
  Windows, CPython 3.11-3.13, the real-filesystem lane, the LangGraph replay
  lane, and the new coding-agent lane.
• Local full suite: 236 passed and 2 skipped because this Windows host did not
  allow the two symlink-creation cases.
• Ruff check, Ruff formatting, package build, and the distribution-boundary
  verifier passed.
• The bundled reference verifies with zero reported errors.
• The committed tree, bundled artifact, wheel, and sdist passed the repository
  privacy scanner and a private publication denylist before release.

Boundaries:

The fault is injected at the application-level trajectory-save boundary. This
does not demonstrate native mini-swe-agent process resume, recovery from a hard
machine crash, exactly-once execution, arbitrary patch correctness, model
quality, benchmark performance, production readiness, security, external
review, adoption, deployment, or recruiting outcomes. The fixture is local and
synthetic. It used zero model API calls and zero paid services.

EffectWitness v0.3.3

EffectWitness 0.3.3 is a patch prerelease for the bounded MCP effect-evidence
harness.

What changed:

• The eight-call concurrent controls now use a dedicated 30-second response
  budget. This is strictly above two independent five-second SQLite busy
  windows plus scheduling headroom. Normal single-call controls remain at ten
  seconds, and the explicit 150 ms registered transport fault is unchanged.
• The SQLite WAL transition now occurs once when each effect-store instance is
  initialized, before concurrent requests. Later connections verify WAL
  read-only and retain FULL synchronous commits and five-second busy handling.
• A failed registered scenario still produces no artifact. Its exception now
  contains only registered scenario/check names, normalized exception types,
  and bounded witness/concurrency counts; raw messages and paths remain absent.
• Artifact-verifier tests copy one session-scoped sealed baseline instead of
  repeatedly running the ten-scenario integration matrix. A separate producer
  test continues to run and verify a fresh matrix.
• Schema-v3 and schema-v4 verifiers accept registered 0.3.3 producers while
  retaining compatibility with the registered 0.3.0, 0.3.1, and 0.3.2
  producers.
• The current bundled Windows schema-v4 reference is bound to source revision
  b99fa745cc98dd543dcd637d3523eabba864552e: 4 scenarios x 10 rounds,
  80 completed worker records, and 60 normalized mutating-call observations.

Why this is 0.3.3:

The public v0.3.0 tag was not released after its tag-triggered CI exposed a
low-probability client response-timeout path in one Windows/Python 3.12
schema-v2 test. The server-side witness still showed the registered two
attempts and one effect; the client had not confirmed the clean retry response.
The v0.3.1 tag was also not released: its tag CI found a separate low-level
transport regression that still used a five-second normal-call budget. The
v0.3.2 tag was not released after its Windows/Python 3.11 tag job exposed a
different eight-way misleading-control timeout late in repeated artifact
generation. This patch addresses that concurrency topology without retrying
calls, accepting errors, weakening evidence checks, or sealing partial output.

Verification:

• The exact tagged commit passed all 11 GitHub Actions jobs across Ubuntu and
  Windows, CPython 3.11-3.13, the exact real-filesystem lane, and the LangGraph
  replay lane.
• Local full suite: 202 passed and 2 skipped because this Windows host did not
  allow the two symlink-creation cases.
• The exact misleading eight-call concurrent control passed 30 consecutive
  local stress runs with no missing observation, attempt, or effect.
• The current bundled reference has 8 files (7 manifest-covered), 190,761
  total bytes, and manifest-file SHA-256
  0ab2e816ea484054f6d878f8132486c46a49cf4b828bb3ba4c3b173260aec7f7.
• The committed tree and extracted wheel/sdist passed the repository privacy
  scanner plus a private publication denylist before release.

Boundaries:

The evidence is local, synthetic, version/input/OS-bounded engineering
evidence. It makes no claim about exactly-once execution, arbitrary workflow or
MCP correctness, official conformance, production recovery, security,
performance, external review, adoption, deployment, or recruiting outcomes.
No model API or paid service was used by the evidence lanes.

EffectWitness v0.2.1

EffectWitness v0.2.1 is an evidence-bound prerelease of the agent/tool effect
workbench at source revision
e0e9ce9c8fc14ea15534905afd2b1e1b08cc5ac9.

This version carries the exact, version-pinned stdio integration introduced in
v0.2.0 for the official MCP filesystem server. Five registered inputs are each
called twice and bracketed by fail-closed S0/S1/S2 relative byte-tree
observations. The committed Windows reference includes normalized hashes,
bounded facts, JUnit, provenance, and a closed manifest. Tag CI independently
generates and verifies fresh Windows and Ubuntu observations.

v0.2.0's tag CI had one timing-sensitive Windows Python 3.12 transport
readiness failure, so no v0.2.0 Release was created and its tag remains
unchanged. v0.2.1 replaces the fixed wait in that test with a successful
transport-ready barrier while preserving the blind-retry and durable-effect
assertions.

The attached assets are only the Python wheel and source distribution. The
wheel contains no integration metadata or Node/npm payload. The source
distribution contains the exact lock and provenance metadata used to prepare
and verify the external dependency, but does not redistribute that dependency
or its runtime.

The observations are source-, version-, input-, and OS-bound. They do not
establish exactly-once execution, package-wide correctness, official MCP
conformance, security, performance, production reliability, independent
review, external use, or adoption.

Public tag CI:
https://github.com/tiramitree/effect-witness/actions/runs/30257552654

EffectWitness v0.1.0

EffectWitness v0.1.0 is the first public pre-alpha release of a controlled
dual-view workbench for declared MCP tool effect hints.

Included:

• separate declaration, client-observation, and durable synthetic-effect facts;
• ten registered loopback scenarios covering clean repeats, response loss,
  process exit, restart/reconciliation, concurrent repetition, and payload
  conflict;
• a schema-v2 offline verifier with strict JSON, registered-field,
  cross-file, JUnit, bounded-snapshot, and manifest checks;
• a fail-closed repository privacy scanner;
• a source-bound reference artifact with 3 MATCH, 4 MISMATCH, and
  3 NOT_APPLICABLE expected results.

Evidence:

• release commit: 72474eae59931cfe0be6501cd340d07c34a100ca
• evidence source revision:
  f4575f88cf6a17f6c32bd2c7462063142d37c56a
• evidence manifest SHA-256:
  abf887a809460020aed24819b5d2bebf8ec68e12dc64ad8a9e760595b6837abc
• the main-branch and tag-triggered GitHub Actions runs both completed
  successfully on the release commit; each included the quality/evidence/build
  job and the Ubuntu/Windows test matrix for Python 3.11-3.13.

Release assets include the wheel, source distribution, reference-evidence ZIP,
machine-readable provenance, and SHA256SUMS.txt.

This release uses synthetic local SQLite effects over loopback MCP Streamable
HTTP. It does not establish exactly-once execution, security, production
reliability, distributed consistency, official MCP certification, arbitrary
third-party tool correctness, performance, external adoption, or recruiting
outcomes.