v0.1.0-dev.1 — trial preview

Preview, source only. A cooperating single-user trial that runs end to end on any Git repository. It is not a sandbox, not an alpha and not installable; build from source on Linux x86_64.

What runs

• writfold trial prepare / approve / apply / recover / show: one edit through a durable, validated ledger, in Writfold's own sparse worktree. Your checkout is never written. apply claims before writing; recover settles an interrupted apply from the file's exact bytes.
• writfold trial approve --require CHECK: approval refuses unless the bound Weft report's named checks are entailed. Weft's results are recorded as hypothetical, never as grounded.
• writfold trial retain and writfold tuft run (Tuft v0): find exact text or a bounded regex over one pinned commit, retain hits as writfold-citation/1 bindings, and emit a compact view under a token budget with explicit omissions. A report citing anything not retained is refused.
• writfold serve with writfold.trial/1: trial/show, trial/retain and trial/prepare over JSON-RPC stdio. Approve, apply and recover stay CLI-only.

How we know

• Proved over the shipped Rust (Charon/Aeneas → Lean 4):
  • the ledger append and history checks;
  • grant install, current grant, coverage and revocation;
  • the recovery outcome and the required-check gate.
• Mutation testing: 20/20 semantic mutants are rejected.
• Adversarial campaign: preimage race, refuted check, unretained or tampered evidence, replay and 60 random SIGKILLs during apply. Every case ended as expected.
• Latency: every trial operation is under 0.5 s p95 on a 100,000-file repository.

Not yet

• Search scope: no semantic, fuzzy or ranked search, and no live corpus service. Omnigraph is the target backend; Dolt is the interim one, and its writer is not built yet.
• Containment: no strict or sandboxed profile.
• Measured token savings: none. Both earlier pilots used more tokens than the baseline; a projection pilot is next.

Details: docs/writfold/status.md, qualification/status.json.