-
v0.10.5
Stablecoreci-nextcraft-po released this
2026-10-22 04:39:50 +00:00 | 21 commits to main since this releaseDownloads
-
coreci-bot released this
2026-10-01 14:14:38 +00:00 | 38 commits to main since this releasePhase 4: The Audit-Grade Export
The third-party-auditor deliverable: one self-contained JSON document + a human markdown summary rendered from the same document (the anti-drift rule — the summary can never assert a number the export doesn't contain).
What shipped
- GET /v1/placements/admin/export:
{schema_version, generated_at, summary, cohort, evidence_bundles, methodology, ledger}— every placement (active AND revoked — G-325: the correction history is what an auditor most wants to inspect) with per-placement evidence bundles resolved from SOURCE ROWS at export time (posting record, application record, full transition history, decision provenance); the complete event ledger withhead_hash. No backfill — pre-v0.11 applications carry only their created_at (honest absence, A-304). - The methodology block states its own limits explicitly: (a) no minimum-employed-duration check (a placement = a recorded hire), (b) no salary, (c) employer-principal attestation + operator oversight — NOT third-party employment verification. G-321: the chain's proof scope (in-place mutation/fork detection), its limit (wholesale DB replacement is undetectable by the walk alone), the auditor's real anchor (export-to-export prefix continuity + head-hash comparison), and the event↔row cross-consistency check.
- GET /v1/placements/admin/export/summary (text/markdown): totals toward the 1,000 guiding goal, the cohort table, the methodology prose, the head hash + offline chain-walk instructions (the export embeds every event — the walk needs nothing else).
- Determinism (R-73): pinned list orderings, total
generated_atexclusion, float absence — re-exports reproduce identical chains + head (test-proven). - Fail-closed: the export refuses to build on a broken chain (a raise, not an assert — survives
python -O). - The admin placements block (D-109 surface 4): recorded-placement counts + per-employer chips on the moderation page + the export links (summary in-tab, JSON download) over the adminToken transport.
The full-chain E2E proof (test_e2e_audit)
Register → claim → admin approve → posting → verified learner applies → in_review → interview → offer → hire → placement created → the chain walks green GENESIS→head → the export reproduces identically → the overview counts the learner ONCE toward 1,000.
Verification
- 1103 ai-service tests (+7), 105 web, 87 CLI — green, zero warnings; mypy clean (237 files); the 252-page static export builds.
- P4 security review verdict SHIP (determinism, no PII beyond opaque handles, methodology honesty, head-hash truth, fail-closed gates, zero CIRR-as-verification wording anywhere in apps/web).
Downloads
- GET /v1/placements/admin/export:
-
2026-10-01 13:59:56 +00:00 | 40 commits to main since this releasePhase 3: Placement Reporting
The guiding outcome becomes measurable: distinct-learner counts computed from rows at query time (per employer, per start-date cohort month, cumulative toward the 1,000 north star).
What shipped
- GET /v1/placements/admin/overview (D-107):
total_active_placements,distinct_learners_placed(a learner placed twice counts ONCE — the outcome's noun is learners),guiding_goal: 1000,by_employer(count desc),by_cohort_month(the start_date calendar month, ascending). Revoked placements excluded from every count; every count computed from rows — never a denormalized counter. - GET /v1/employers/placements: the claimed entity's own placements (active + revoked history, honest empty state; session + claim gates).
packages/types/placement.ts(D-110): the fourth cross-boundary wire module, dual-schema pinned field-for-field againstplacements/base.pyinpins.test.ts(4 new pins incl. the seven-status union regex + the G-319 pin-split arm).- The engine-client placements section:
listOwnEmployerApplications, the five per-target transition functions,listOwnEmployerPlacements— AbortController everywhere, SessionRequiredError/ClaimRequiredError reuse, zero new error classes. - The NEW /employer/applications page (D-109 surface 1): the seven D-099 status badges, per-target transition CTAs (the matrix drives the CTA set), the hire form with employer-attested role title + employment start date; learner_id visible per the G-319 supersession (own applicants only); withdraw never offered to employers.
- The overview's real placements section replaces the mock "Placement Rate" card (D-092: never leave a convertible surface on mock); talent-match analytics stay mock-labeled honestly.
Verification
- 1096 ai-service tests (+7), 105 web (+4 pins), 87 CLI — all green, zero warnings; mypy clean (236 files); eslint 9/9; the static export builds.
- Verify four layers PASS; the counts-discipline check: zero denormalized counters anywhere.
Downloads
- GET /v1/placements/admin/overview (D-107):
-
2026-10-01 13:12:26 +00:00 | 42 commits to main since this releasePhase 2: Employer-Side Application State Machine
The v0.6
submitted-only application status extends to the full hiring lifecycle (D-099:submitted → in_review → interview → offer → hired / rejected / withdrawn— forward-only with skip-forward, three terminals), driven by three principal classes with the G-311 gate order everywhere: 401 session → 403 claim → 403 cross-entity → 409 matrix — never a 409 before a 403.What shipped
- Employer per-target transition routes (
/v1/employers/applications/{id}/in-review|/interview|/offer|/reject|/hire): the matrix stays out of request bodies; hire carries employer-attested{role_title, start_date}(G-324 bounds; D-103 date-only); every transition appends the ledger in the same transaction (D-100) + anemployer_audit_eventsrow (the D-089 lane). - The employer pipeline list with learner_id visible per the G-319 supersession (application-scoped reads only; the own-postings list stays counts-only — both arms pinned).
- Learner withdraw (
/v1/marketplace/applications/{id}/withdraw): the unchanged D-043 stack (G-5 allowlist → verified 18+ → the existing apply-rate window — no new knobs); employers can never withdraw (D-099). - G-323 apply-terminal guard: re-applying to a withdrawn/rejected/hired application → 409
application_terminal, never a 200 "applied" lie; idempotent 200 on live applications unchanged (A-408). - The operator lane (
/v1/placements/admin/*, fail-closed): the generic transition route withtoas a closed pydantic Literal (G-327: unknown → 422, matrix-illegal → 409), revoke (D-102), and the R-80 re-hire — a fresh placement +placement.rehiredledger event without touching the terminal application (G-326:decided_at= the re-hire event's stamp); the partial-unique IntegrityError surfaces as an honest 409.
Verification
- 1089 ai-service tests (fast lane, +36), 101 web, 87 CLI — all green, zero warnings; mypy clean (235 files); ruff clean.
- P2 security review verdict SHIP (zero P0s; the gate orders scratch-probed including the foreign-terminal arm); verify four layers PASS; the v0.10 G-319 counts-only pin green unmodified.
Downloads
- Employer per-target transition routes (
-
2026-10-01 12:38:48 +00:00 | 44 commits to main since this releasePhase 1: Placement Store + Evidence Ledger
The 9th D-027 store family:
ai_service/placements/—PlacementRow(immutable at creation except the operator correctionactive → revoked; partial UNIQUE indexuq_active_placement_per_applicationonapplication_id WHERE status='active', the G-316 shape — revoked rows stay in history, a re-hire creates a fresh row) +PlacementEventRow(the append-only GLOBAL sha256 hash chain: canonical JSON +prev_hash,UNIQUE(prev_hash)fork backstop,GENESIS_HASHpinned, NO delete path anywhere in the module).What shipped
- The D-099 transition matrix (forward-only with skip-forward;
hired/rejected/withdrawnterminal) + the D-101 event vocabulary incl. the R-80 placement lane (placement.created/revoked/rehired). - The ONE transactional
transition_application(D-100): the marketplace application status write + the ledger append + the PlacementRow-on-hired land in ONE commit (flush-then-hash-then-commit — the row's own autoincrement id participates in its own hash); the placements store is the ONLY post-creation writer ofapplication.status(R-78, stated + verified). - The correction lane:
revoke_placement(active → revoked only) +rehire_placement(R-80: fresh PlacementRow +placement.rehiredevent,decided_at= the re-hire event's stamp per G-326; the partial-unique IntegrityError surfaces as the honest 409). - The adversarial suite (22 tests): tamper (second-engine UPDATE →
verify_chainfails), fork (duplicate prev_hash → IntegrityError), concurrency (two engines — one winner, never two events on one prev_hash), no-delete-path source pin, tz-conversion pin (aware non-UTC inputs convert — the security review's P0 fix), actor-vocabulary enforcement. - Wiring: main.py lifespan (getattr-guard) +
get_placement_storeDI; the marketplace store gains ONLY theget_applicationpoint read.
Honesty block
- The chain detects in-place mutation/fork of an intact sequence; wholesale DB replacement is detectable only via export-to-export continuity (stated in the P4 export methodology per G-321).
- No PII in payloads (status enums, role_title, ISO start dates, opaque actor handles).
Verification
- 1053 ai-service tests (fast lane, +22), 101 web, 87 CLI — all green, zero warnings; mypy clean (231 files, zero new overrides); ruff clean.
- Verify stage: four layers PASS (structural, behavioral, security, quality); REQ-11-001 every clause evidenced.
Downloads
- The D-099 transition matrix (forward-only with skip-forward;
-
2026-10-01 11:47:33 +00:00 | 46 commits to main since this releasev0.11 CIRR-Style Placement Tracking and Audit — phase 0
Phase 0 locks the v0.11 specification (REQ-F-020 activated as REQ-11-001..005 per D-098, founder scope confirmed 2026-10-01): the machinery that makes the guiding outcome (≥1,000 learners placed, CIRR-style third-party audit) measurable and auditable — the 9th D-027 store with the hash-chained placement_event ledger, the employer-side application state machine (submitted → in_review → interview → offer → hired/rejected/withdrawn), placement reporting (distinct-learner counts toward 1,000, per employer, per start-date cohort month), the audit-grade export (cohort snapshot + evidence bundles + methodology + chain head), and learner placement visibility.
Phase 0 stages
- SPECIFY (D-098): scope locked — REQ-F-020 activated as REQ-11-001..005; out of scope: third-party auditor integration (the export IS the deliverable), learner self-report, salary tracking, public stats pages.
- CLARIFY (D-099..D-112): 14 decisions — the D-099 status matrix (forward-only + skip-forward, three terminals), the D-100 one-transaction transition_application, the D-101 global sha256 hash chain (canonical JSON + prev_hash, UNIQUE fork backstop), D-102 partial-unique active-placement guard + revoke semantics, D-103 employer-attested start_date, D-104 learner routes on the D-043 stack, D-105 per-target employer routes (G-311 gate order), D-106 the operator lane, D-107 distinct-learner counting, D-108 the export + summary, D-109 four web surfaces, D-110 placement.ts wire pins, D-111 the tamper-test doctrine, D-112 the 9th-store migration shape.
- RESEARCH (R-67..R-80): CIRR methodology transfer with the three pilot gaps the export must state; the flush-then-hash-then-commit append shape; ATS prior art; export determinism rules; all seams probe-verified; the R-80 re-hire-after-revoke coherence gap found + pinned.
- PLAN: 6 phases, wave-ordered (ledger → machine → reporting → export → visibility → ship); all 10 open risks mapped to tasks; MVP/UX sections written before execute.
- GRILL (G-321..G-328): verdict PROCEED at 0.82 — 8 binding decisions: export verification-scope honesty (the walk cannot detect a wholesale DB rewrite — export-to-export continuity is the anchor), the mine point-read (learner status panel never depends on client-persisted ids), apply-on-terminal → 409 (never a 200 applied lie), role_title field bounds, revoked placements' evidence bundles, the re-hired row's decided_at, the operator route's 422/409 split, and the no-CIRR-verified-theater wording rule.
- MVP/UX gate: PASS — 7 user-facing surfaces, the 7-step happy path, 7 UX acceptance criteria.
Honesty block (carried into the milestone)
- Placement evidence is employer-principal attestation + operator oversight — NOT third-party employment verification.
- No minimum-employed-duration check and no salary at pilot; both stated in the export methodology.
- The hash chain detects in-place mutation/fork of an intact sequence; wholesale DB replacement is detectable only via export-to-export continuity.
Verification
- Ship gates at phase 0: 1031 ai-service tests (fast lane), 101 web tests, 87 CLI tests, ruff + mypy green — all existing suites green unmodified (phase 0 is
.ciagent/-only). - Tags advance the v0.10.x line (P0 → v0.10.0 … P6 → v0.10.6 = milestone release).
Downloads
-
2026-10-01 01:05:46 +00:00 | 49 commits to main since this releasev0.10 B2B Employer Network — milestone complete
The v0.10 milestone ships employers as principals of the marketplace (REQ-F-019 activated as REQ-10-001..005 per D-085): employer identity, entity claims with admin adjudication, a real-data dashboard, self-serve postings through the shared entitlement gate, self-serve checkout through the real webhook path, and the admin network overview.
Requirements
- REQ-10-001 — Employer Auth Foundation: employers become principals with scrypt password hashing, hashed session tokens, and login/register throttles (G-311/G-312/G-315). No plaintext credentials at rest; sessions revocable server-side.
- REQ-10-002 — Employer Entity Claim: claim/verify over the v0.6 marketplace entities with advisory evidence adjudication and operator-mediated admin approval (D-089/G-316/G-317).
- REQ-10-003 — Employer Dashboard: the dashboard converted to real data with honest empty/pending/processing states — no mock charts.
- REQ-10-004 — Self-Serve Posting Management: employer write surface through the shared D-091 entitlement gate, byte-identical with the admin operator path; G-318 own-drafts guard; honest 402/403 states per G-320b.
- REQ-10-005 — Self-Serve Checkout: checkout over the v0.9 catalog through the REAL webhook path, with the own-session mock-complete closing the G-301 class; G-302/G-303/G-304 carried forward from v0.9.
Phase history (tags v0.9.0–v0.9.6, the v0.9.x tag lane per D-064)
- v0.9.0 — Phase 0, Specify & Plan: scope lock (D-085), clarify D-086..D-097, research R-55..R-66, plan, grill G-311..G-320, MVP/UX gate PASS.
- v0.9.1 — Phase 1, Employer Auth: scrypt auth, hashed sessions, throttles, the /me identity surface.
- v0.9.2 — Phase 2, Entity Claim: claim/verify flow, advisory evidence, the admin claim queue.
- v0.9.3 — Phase 3, Dashboard: the employer dashboard converted to real data with honest states.
- v0.9.4 — Phase 4, Self-Serve Postings: the shared D-091 entitlement gate with admin-path parity, employer write surface.
- v0.9.5 — Phase 5, Self-Serve Checkout + Admin Network Overview: the checkout flow over the real webhook path, the admin accounts/claim-queue/audit panel.
- v0.9.6 — Phase 6, Final Review & Ship: final review verdict SHIP (2 P0s found + fixed, 3 P1s dispositioned), audit verdict PASS (reconstruction clean, discipline green, 2 minor notes); milestone merge to main.
What's mock / deferred at pilot (honesty block)
- Checkout mock-complete path: at pilot, checkout completes via the own-session mock-complete transaction (operator-mediated real-money flow deferred per D-076); webhook state resolves from local rows only (G-302).
- Email verification: deferred per D-097 — registration does not verify email ownership at pilot.
- Claim approval: operator-mediated per D-089 — an admin adjudicates evidence and approves claims; evidence is advisory, not cryptographic proof.
Verification
- Final ship gates: 1031 ai-service tests (fast), 101 web tests, production build clean.
- The tag lane (D-064) built every release's full asset matrix on v0.9.0–v0.9.6.
Downloads
-
2026-10-01 00:37:18 +00:00 | 39 commits to main since this releaseREQ-10-005 complete — the B2B loop closes.
- Employer-principal checkout over the v0.9 catalog through the REAL webhook path with the buyer = the session's claimed entity
- Own-session mock-complete closing the G-301 class (checkout honesty verified null-purchase)
- Own entitlement view with honest states (employer billing surfaces what was actually purchased — no phantom entitlements)
- Pricing CTAs → employer-login per D-079-supersession, with the enterprise Contact Sales pin retained
- Admin moderation page gains the network overview — accounts, advisory-evidence claim queue, audit — per D-094 / A-304
Verification: 1028 fast pytest (ai-service) + 101 web tests green; production build clean (251/251 pages).
Downloads
