v0.39.0: vendor Spec v0.3.0 and the retained-column leaf at its release identity; audit line-format fingerprints (#327); tool taxonomy closure (#329)

.github/workflows/ci.yml

@@ -54,6 +54,8 @@ jobs:
         run: go build -trimpath ./cmd/jpack
         env:
           CGO_ENABLED: "0"
+      - name: Check audit line formats
+        run: go run ./tools/audit-formats
 
   check:
     name: check
@@ -66,7 +68,6 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      # First, so that a manifest that does not parse fails before the long steps start.
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:

CHANGELOG.md

@@ -10,7 +10,7 @@ All notable changes to tagged releases are documented here.
   and supports document validation/declared inventory coverage for Base/Extended.
   Generated retained values now admit up to 524288 UTF-8 bytes; asserted values
   remain bounded at 16000 in both profiles. Historical Draft fixtures remain pinned.
-  See the [RC2 reader](docs/dialect-retained-column-rc2.md) and
+  See the [RC2 reader](https://github.com/Judgment-Pack/judgment-pack-runtime/blob/v0.39.0-alpha.2/docs/dialect-retained-column-rc2.md) and
   [release notes](docs/releases/v0.39.0-alpha.2.md).
 
 Runtime's conformance claim is stated, in full and only, in

CONFORMANCE.md

@@ -179,9 +179,10 @@ above — for every input admitted under that exact contract, not merely for the
 
 ## Core 0.3.0 preparation evidence and outstanding review
 
-The implementation bundles exact Spec commit
-`65c7cf5598a0f0fc532c80a9e2215090951104ce`, with per-file hashes and an immutable
-commit provenance lock. No published Core `0.3.0` tag is represented by that pin.
+The implementation bundles the published Spec tag `v0.3.0`, commit
+`27cb29bf13e4a2d58d69fe19c7ebfeb762b014fc`, with per-file hashes and an immutable
+provenance lock. Its bytes equal those of the earlier commit pin
+`65c7cf5598a0f0fc532c80a9e2215090951104ce`; the bundle digest is unchanged.
 The implemented Core `0.3.0` reader/evaluator supports only `base`; the optional
 `extended` profile is refused as `profile-unsupported` before schema interpretation.
 

README.md

@@ -17,9 +17,8 @@ it names are required evidence for such a claim and are not exhaustive evidence
 The runtime **validates documents**. It does not fetch a source, authorize an action, or establish
 truth, organizational authority, safety, or operational fitness. It bundles `0.1.0-draft`,
 `0.2.0-draft`, and Core `0.3.0`, and validates a document against its exact declaration.
-Core `0.3.0` resources are pinned to Spec commit
-`65c7cf5598a0f0fc532c80a9e2215090951104ce`; this is an immutable source pin, not a
-published Core release tag. Core `0.3.0` support is base-only. Runtime discovery reports
+Core `0.3.0` resources are imported from the published Spec tag `v0.3.0`, commit
+`27cb29bf13e4a2d58d69fe19c7ebfeb762b014fc`. Core `0.3.0` support is base-only. Runtime discovery reports
 `evaluatorCapabilities` separately from document `supportedSpecVersions`, with
 `supportedProfiles: ["base"]` scoped to the Core `0.3.0` evaluator entry. This says
 nothing about Policy or Dialect profile support.

VERSIONING.md

@@ -61,18 +61,19 @@ Matrix carrier versions `1`–`3` are unchanged: the explicit contract selects t
 portable disposition grammar, rather than adding a closed matrix member. Additive
 skip metadata is omitted from old suite reports when no case is skipped.
 
-The Core `0.3.0` bundle uses full Spec commit
-`65c7cf5598a0f0fc532c80a9e2215090951104ce`, not a published Core release tag.
+The Core `0.3.0` bundle is imported from the published Spec tag `v0.3.0` at
+commit `27cb29bf13e4a2d58d69fe19c7ebfeb762b014fc`; its bytes are those of the
+earlier commit pin `65c7cf5598a0f0fc532c80a9e2215090951104ce`, unchanged.
 This source provenance does not by itself establish a conformance claim; see
 [CONFORMANCE.md](CONFORMANCE.md).
 
 Selected retained-column leaf support has a separate exact distribution/source/schema/corpus
-identity. Core `specVersion: "0.3.0"` does not select or imply this support. The explicit CLI/MCP reader selects the installed official `v0.3.0-rc.2`
-leaf, source `bcac15b7537ce21879201b5e5dfe795496225121`, with maturity `draft`
+identity. Core `specVersion: "0.3.0"` does not select or imply this support. The explicit CLI/MCP reader selects the installed official `v0.3.0`
+leaf, source `27cb29bf13e4a2d58d69fe19c7ebfeb762b014fc`, with maturity `draft`
 and document-validation role for Base/Extended. Compatibility flag names
-`--draft-contract`/`draftContract` require the exact installed RC2 selector;
-historical Draft selectors refuse. Historical Draft test resources retain their
-original labels. See [the RC2 reader](docs/dialect-retained-column-rc2.md).
+`--draft-contract`/`draftContract` require the exact installed release selector;
+historical Draft selectors and the `v0.3.0-rc.2` candidate selector refuse. Historical Draft test resources retain their
+original labels. See [the selected reader](docs/dialect-retained-column.md).
 
 ## Compatibility dimensions
 

dev.json

@@ -17,6 +17,8 @@
      "summary": "^(ok|FAIL|---) ", "timeout": 3000},
     {"name": "conformance", "run": "go run ./cmd/jpack spec test-conformance --quiet", "toolchain": "go", "timeout": 1200},
     {"name": "build", "run": "CGO_ENABLED=0 go build -trimpath -o /dev/null ./cmd/jpack", "toolchain": "go", "timeout": 1200},
+    {"name": "audit-formats", "run": "go run ./tools/audit-formats", "toolchain": "go",
+     "summary": "^audit-formats:", "timeout": 600},
     {"name": "registry-template", "run": "python3 scripts/check-registry-template.py", "toolchain": "python",
      "summary": "^registry template:", "timeout": 300}
   ],

docs/architecture.md

@@ -216,8 +216,8 @@ client rather than in a runtime store -- is walked end to end in
 
 ## Core contract boundaries
 
-The `0.3.0` resources are an exact immutable Spec commit pin,
-`65c7cf5598a0f0fc532c80a9e2215090951104ce`, rather than a published Core tag.
+The `0.3.0` resources are imported from the published Spec tag `v0.3.0`, commit
+`27cb29bf13e4a2d58d69fe19c7ebfeb762b014fc`.
 The conformance runner registers the exact Core schema as an explicit in-memory
 resource for manifest references. Local suites must match the bundled manifest
 schema; they cannot retrieve remote schemas or traverse to sibling resources.

docs/dialect-retained-column-draft.md

@@ -1,7 +1,7 @@
 # Historical retained-column Draft reader
 
 This page records the historical Draft experiment and its original pins. Current
-selected support is documented in [the RC2 reader](dialect-retained-column-rc2.md).
+selected support is documented in [the selected reader](dialect-retained-column.md).
 The historical selector below is no longer accepted as a selected identity.
 
 That historical Runtime had an explicit experimental entry for RFC 0029 at Spec revision

docs/dialect-retained-column-rc2.md → docs/dialect-retained-column.md

@@ -1,17 +1,18 @@
-# Selected retained-column RC2 reader
+# Selected retained-column reader
 
 Runtime installs the retained-column/1 leaf from the official immutable Spec
-`v0.3.0-rc.2` distribution at source revision
-`bcac15b7537ce21879201b5e5dfe795496225121`. Its maturity is `draft`; selected
+`v0.3.0` release at source revision
+`27cb29bf13e4a2d58d69fe19c7ebfeb762b014fc`. Its maturity is `draft`; selected
 support is limited to document validation and declared inventory coverage.
 Validation makes no preparation, source authenticity or execution claim.
 The existing dialect operations retain their default contract and limits.
 
 Select exactly
-`--draft-contract retained-column/1@bcac15b7537ce21879201b5e5dfe795496225121`
+`--draft-contract retained-column/1@27cb29bf13e4a2d58d69fe19c7ebfeb762b014fc`
 and `--draft-profile base` or `--draft-profile extended` on `dialect contract`,
 `canonicalize`, `digest`, `validate` or `check`. Both flags are required. The `draft` flag names are compatibility adapter
-spellings; their exact accepted value selects only this installed RC2 identity. Unsupported selection refuses before opening input files. A document
+spellings; their exact accepted value selects only this installed release identity. Unsupported selection, including the
+`v0.3.0-rc.2` candidate selector, refuses before opening input files. A document
 must declare the selected profile; omission means base. Extended requires explicit
 `"profile":"extended"` in a validated document. No selection is inferred from leaves,
 carrier versions or caller-supplied specification hashes.
@@ -43,8 +44,8 @@ response bounded without reducing accepted input or changing ordinary reports.
 The selected contract response reports only role `document-validation` in
 `capabilities.conversionContracts`, with fixed trusted identity:
 
-- Version label: `0.3.0-rc.2`.
-- Revision: `bcac15b7537ce21879201b5e5dfe795496225121`.
+- Version label: `0.3.0`.
+- Revision: `27cb29bf13e4a2d58d69fe19c7ebfeb762b014fc`.
 - Schema: `sha256:0cb49f238c78391cb163a65474cc9af962df2bb1024a55c5310c2b784b2f0557`.
 - Corpus: `sha256:17b16ff7a9b74fe4cc81eb6f6129a6aabdd9834621d9e756aa2d4c1a3f245863`.
 
@@ -95,7 +96,12 @@ Preview arithmetic, producer/history, preparation/export/verification and capabi
 consumer cases remain their owners' work. Synthetic published fixture identities
 remain preparation-only and are never promoted into signed full-input proof.
 Historical Draft test resources remain byte-exact under their original pins.
+The schema, corpus and capability table are byte-identical to the `v0.3.0-rc.2`
+candidate's, so the published tables keep the distribution label they were
+published with; the installed release identity and the `v0.3.0` inventory carry
+the release. The installed reader refuses the candidate's release identity.
 
-Existing Runtime releases, including 0.39.0-alpha.1, gain no support from this
-source change. Stable integrated checks, CI, review and distribution gates remain
+Runtime 0.39.0-alpha.2 installed the `v0.3.0-rc.2` candidate; earlier releases,
+including 0.39.0-alpha.1, installed none. No existing release gains support from
+this source change. Stable integrated checks, CI, review and distribution gates remain
 required before a new Runtime release. No final Core conformance claim follows.

docs/releasing.md

@@ -56,33 +56,45 @@ the retained prototype or historical candidate trees or the Core locks. Policy
 source schema IDs stay distinct from derived Runtime editing schema IDs. See
 [ADR-0061](adr/0061-adopt-official-policy-draft-resources.md) for compatibility.
 
-## Refresh the selected retained-column RC2 leaf import
+## Refresh the selected retained-column leaf import
 
-The current opt-in CLI/MCP reader selects the installed official `v0.3.0-rc.2`
+The current opt-in CLI/MCP reader selects the installed official `v0.3.0`
 leaf with draft maturity and document-validation role. Its exact source/schema/corpus
 and independent provenance pin are compiled in `retained_column_artifacts.go`.
 Core locks, Policy resources and the general Core registry remain independent.
-Historical Draft fixtures retain their original labels; they are not RC2 evidence.
+Historical Draft fixtures retain their original labels; they are not release evidence.
+Runtime 0.39.0-alpha.2 installed the `v0.3.0-rc.2` candidate of this leaf; the
+installed reader now refuses that candidate's identity.
+
+A Spec pre-release takes one of two forms: `-rc.N` is a candidate of the complete
+milestone, and `-alpha.N` is a scoped cut for a named consumer that never graduates;
+the development kit's release policy defines both.
 
 After the maintainer confirms adoption and immutable publication of the official
-Spec `v0.3.0-rc.2`, verify its exact tag/source commit, immutable release state,
+Spec release, verify its exact tag/source commit, immutable release state,
 asset checksums and attestations using the Spec release process. Record those
 observations separately: the offline importer cannot establish publication,
 immutability or source authenticity from local bytes or a Git remote URL.
 Review the release inventory digest independently. Use a clean official checkout
-at that exact tag and the verified tar.gz asset, then run:
+at that exact tag and the verified tar.gz asset. A reviewed artifact update never
+overwrites a nonempty set: remove the previous `official/` import in the same
+change, then run:
 
 ```bash
 env GO111MODULE=on go run ./tools/sync-retained-column \
   --source ../judgment-pack-spec \
-  --source-ref v0.3.0-rc.2 \
-  --source-commit "$RC2_SOURCE_COMMIT" \
-  --archive "$RC2_VERIFIED_ARCHIVE" \
-  --archive-sha256 "$RC2_VERIFIED_ARCHIVE_DIGEST" \
-  --inventory-sha256 "$RC2_REVIEWED_INVENTORY_DIGEST" \
+  --source-ref v0.3.0 \
+  --source-commit "$SOURCE_COMMIT" \
+  --archive "$VERIFIED_ARCHIVE" \
+  --archive-sha256 "$VERIFIED_ARCHIVE_DIGEST" \
+  --inventory-sha256 "$REVIEWED_INVENTORY_DIGEST" \
   --destination ./internal/dialect/retained-column/official
 ```
 
+The importer admits only the release named by `internal/retainedcolumn`
+(`Release`, `Version`, `InventoryPath`); adopting another release changes those
+constants, the reader identity and its tests in the same reviewed change.
+
 Digest arguments include `sha256:`. The destination must be new and exclusively
 owned during import. The helper follows the existing staged import pattern; the
 portable directory rename can replace an empty directory created concurrently,
@@ -108,6 +120,41 @@ refuses unpinned resources, changed or missing installed bytes, extra inventory,
 unsupported identities and disagreement with the selected reader. No final Core,
 producer or preparation-verifier claim follows from this document-validation role.
 
+## Audit line formats
+
+The audit trail's persisted lines (`evaluations.jsonl` records and discontinuities,
+`signatures.jsonl` record signatures and key rotations, `stamps.jsonl` stamps) are
+fingerprinted in `internal/auditformat/`. `catalog.json` is generated: each line
+type's normalized JSON shape and its SHA-256 digest. A member the runtime builds
+itself as raw JSON, the record's canonical `disposition`, is fingerprinted through
+the type declaring its members (`result.CanonicalDispositionShape`), and a string
+member may declare a grammar (the stamp `token` is standard padded `base64`).
+Exemplar lines produced by the writers' own encoders are held to those declared
+shapes and grammars: a member the builder writes but the shape does not declare,
+a declared member no exemplar writes, or a token in another encoding fails.
+The fingerprint covers shape and those declared grammars, not other value
+encodings or spellings, such as a timestamp's.
+
+`changes.json` is written by hand and only appended to: every digest a line type
+has had, with the decision that admitted it (`baseline`, `compatible-addition` at
+the same format version, or `new-format-version` at the next integer with its
+`readingRule`) and a reason. `status.json` is kept apart: per trail file, the
+format the code `writes` (checked against the writer constant), the last accepted
+compatibility `baseline`, and the last format `released`. A format that shipped in
+any release, a pre-release included, carries compatibility obligations, so
+`baseline <= released <= writes`. Its `releasedChanges` pins the count and digest
+of the change records already released; they must stay unchanged and in order, so
+a released record cannot be rewritten in place.
+
+`go run ./tools/audit-formats` (the `audit-formats` check) regenerates the catalog
+in memory and fails on a stale catalog, on a digest no change record names, on a
+rewritten released record, on a status the writer constants contradict, and on an
+exemplar that does not conform. After changing a persisted line, run it with
+`-write`, append the change record, and update `status.json` when the format
+version moves. When a release ships, set `released` to the format it carries and
+move `releasedChanges` to cover every record then present (the count and the
+digest the check reports for that prefix).
+
 ## Validate locally
 
 Install the exact GoReleaser version used by the workflow, then run:
@@ -120,6 +167,7 @@ env GO111MODULE=on go test ./...
 env GO111MODULE=on go run ./cmd/jpack spec test-conformance --quiet
 env GO111MODULE=on go run ./cmd/jpack spec test-conformance --spec-version 0.2.0-draft --quiet
 env GO111MODULE=on go run ./cmd/jpack experimental evaluate-corpus
+env GO111MODULE=on go run ./tools/audit-formats
 env GO111MODULE=on go run ./tools/check-release --tag <cli-tag>
 goreleaser check
 goreleaser release --snapshot --clean

internal/artifacts/artifacts_test.go

@@ -249,11 +249,11 @@ func TestCore030ExactProvenanceAndCompleteIndexedFixtures(t *testing.T) {
 		t.Fatal(err)
 	}
 	lock := set.Lock()
-	const pin = "65c7cf5598a0f0fc532c80a9e2215090951104ce"
+	const tag, pin = "v0.3.0", "27cb29bf13e4a2d58d69fe19c7ebfeb762b014fc"
 	if len(lock.Files) != 165 {
 		t.Fatalf("Core 0.3 lock files: %d", len(lock.Files))
 	}
-	if lock.Source.Repository != "https://github.com/Judgment-Pack/judgment-pack-spec" || lock.Source.Ref != pin || lock.Source.BaseCommit != pin || lock.Source.Kind != "immutable-git-ref" || lock.Source.WorktreeDirty {
+	if lock.Source.Repository != "https://github.com/Judgment-Pack/judgment-pack-spec" || lock.Source.Ref != tag || lock.Source.BaseCommit != pin || lock.Source.Kind != "immutable-git-ref" || lock.Source.WorktreeDirty {
 		t.Fatalf("unexpected source: %+v", lock.Source)
 	}
 	if lock.BundleDigest.Value != "018b8221c424fa530d7482b160f4d7faa59cd9d2e80d3f6e2f8748dfb0d7e743" {

internal/artifacts/jps/0.3.0/lock.json

@@ -4,8 +4,8 @@
   "source": {
     "repository": "https://github.com/Judgment-Pack/judgment-pack-spec",
     "kind": "immutable-git-ref",
-    "baseCommit": "65c7cf5598a0f0fc532c80a9e2215090951104ce",
-    "ref": "65c7cf5598a0f0fc532c80a9e2215090951104ce",
+    "baseCommit": "27cb29bf13e4a2d58d69fe19c7ebfeb762b014fc",
+    "ref": "v0.3.0",
     "worktreeDirty": false
   },
   "bundleDigest": {