bidlint v1.1.0

bidlint v1.1.0

BidLint 1.1.0 completes the production-adoption milestone while preserving the frozen BidLint 1.x compliance semantics.

Production-adoption controls

• offline BidLint 1.x report conformance validation and compatibility manifest
• private-first external-pilot workspace and evidence-retention protocol
• non-leaking pilot sanitization scanner for contact, commercial, metadata, hidden-content and XLSX leakage signals
• manifest-driven repeated pilot execution with deterministic output and corpus SHA-256 evidence
• immutable approved-baseline replay verification with bidlint-pilot-verify
• explicit bidlint-pilot-gate requiring clean sanitization, deliberate human/domain approval, reviewed non-PASS findings, manual specification-scope disposition when required, zero unresolved limitations and exact baseline replay
• conservative XLSX specification requirement blocks with independent worksheet selection and explicit unscoped-row coverage evidence
• production-shaped conflict-path CPU and peak-memory profiling gate
• validated wheel artifact retention for isolated private-pilot replay
• fail-closed stable-release workflow that refuses stale or premature tags pointing at a different release commit

Correctness hardening derived from the external pilot

• empty external pilots cannot pass with zero evaluated requirements
• Grade/designation values such as Grade 304 and A15 stay qualitative rather than becoming accidental numeric thresholds
• composite dimensions remain qualitative until deterministic multidimensional comparison is supported
• standard OOXML schema URLs no longer create sanitization URL false positives
• unrelated fuzzy parameter names without lexical overlap require stronger evidence before matching
• commercial XLSX values hidden behind currency number formats are detected by the sanitization scanner
• structured XLSX rows outside the supported contiguous requirement block are surfaced as explicit manual-scope evidence rather than silently treated as covered

External sanitized pilot gate

Issue #39 completed the release-evidence gate using a real external drainage-schedule-derived private sanitized corpus.

Final approved replay evidence:

• reviewer: yigitcan-ozturk
• review date: 2026-08-22
• decision: APPROVE_BASELINE
• sanitization: automated_clear=true, 0 blockers, 0 review findings
• evaluated requirements: 6
• findings: 5 REVIEW, 1 MISSING, 0 PASS, 0 DEVIATION
• deterministic: true
• conformant: true
• manual XLSX scope: 35 unscoped populated rows (header + 34 item rows), explicitly human-reviewed
• false positives: 0
• false negatives: 0
• unresolved limitations: 0
• known product defects: 0
• approved baseline replay: exact match, 0 mismatches
• final gate: release_ready=true, failure_count=0

Final reconstructed private evidence digests:

• manifest SHA-256: 68f165a2f2a27df5ba927e52f098c743b2687f8321d8fda252569ebd195dc97f
• corpus SHA-256: 93d5738fb2f5b660e940c5a2843bf40416e09c2f5480a735b048455152541e18
• baseline/replay output SHA-256: 759e2b510a2dd6629f23874f656fd301fafb0201b30f15cdd1cd85ae7b6f2084

Raw external/customer documents and the private approval/evidence workspace are not committed to the public repository.

Compatibility boundary

This release does not change the frozen BidLint 1.x PASS / DEVIATION / MISSING / REVIEW semantics or deterministic scoring contract. BidLint does not perform commercial scoring, contractual acceptance or inferred knockout acceptance. External-pilot approval is software baseline/release evidence, not supplier compliance acceptance.

Validation required before merge

The release PR must pass:

• Ruff and pytest on Python 3.11, 3.12 and 3.13
• wheel/sdist build, twine check, installed CLI smoke and pip check
• runtime dependency audit
• deterministic 20k-fact benchmark
• production-shaped conflict-path CPU and peak-memory profile

The stable v1.1.0 tag and GitHub Release must only be created from the final merged release commit. The stale/premature v1.1.0 release and tag from the invalidated earlier release sequence were removed before this release branch was prepared.