DatumGuard v0.2.1 — Verified Deployment Evidence

DatumGuard v0.2.1 is the self-consistent public Engineering Design Assurance patch release. It corrects the displayed evidence and proves the deployed API revision after Render finishes, without moving the existing v0.2.0 tag.

What changed

• Corrected the Product Case Study from the historical 19-test value to the verified 256 pytest + 24 Playwright baseline.
• Removed the duplicate Privacy title and aligned every public route's canonical, Open Graph, and Twitter metadata.
• Bumped the API and web packages to 0.2.1.
• Added a validated release_sha to API health/readiness; only a 40-character hexadecimal revision is exposed.
• Split deployment verification into a Vercel compatibility smoke and a Render-success strict smoke, avoiding the checksPass circular dependency.
• Corrected the security evidence: push runs cover pip-audit and both CodeQL languages; dependency review is evidenced by the pull-request run.
• Kept the planned 100 golden-contract + 50 language-input benchmark explicitly incomplete.

Assurance model

Contract → serialized DXF/STEP → independent reopen → remeasurement → verified-only export

Writer memory is not approval evidence. Required verification failures keep the official bundle unavailable.

Immutable release evidence

• Source: v0.2.1 → 0e871c4a93872415f7151a99050b102f273986dd
• PR #14 — Prepare the self-consistent v0.2.1 release
• Main CI — 256 pytest, 24 Playwright, type/lint/build, both container builds, SBOM, fixed-critical scans
• Push security — pip-audit and CodeQL for Python and JavaScript/TypeScript
• PR security — dependency review plus the same audit/CodeQL gates
• Vercel compatibility smoke
• Render-success strict smoke: version=0.2.1, release_sha=0e871c4a93872415f7151a99050b102f273986dd, Architecture and Artifact canaries pass, Solid fails closed, CORS passes
• Vercel Production deployment: 5410294611
• Render API deployment: 5410321107

Attached SBOMs

• datumguard-api.cdx.json — CycloneDX 1.6, SHA-256 ed49a6515d5fd4c4ab8bd324e66701d05b24cf6df7295c1f24ae3bef656e9c06
• datumguard-web.cdx.json — CycloneDX 1.6, SHA-256 8bc6f7c0cdb05dd79ad5fa0fe5d4d3386bf1c0cbca689cb418e55132ac2dd9c4

Explicit limits

• The public Render Free API keeps Solid execution disabled and returns 503 DG_CAPABILITY_DISABLED; verified local/CI STEP evidence remains available.
• Artifact Lab findings are informational and never create a fabrication approval.
• DatumGuard does not certify structural safety, code compliance, fluid/thermal/fatigue behavior, materials, welding, or manufacturability.
• The planned 100+50 benchmark is not complete.
• release_sha attests the Render Git revision; signed OCI/SLSA provenance remains future supply-chain hardening.

The immutable v0.2.0 tag remains the documented fallback; v0.2.1 supersedes its public Case Study and deployment-evidence claims.