77 Releases 83 Tags

RSS Feed

• v0.10.1 6b0b20cee1

  Compare

  v0.10.1 — Placement Store + Evidence Ledger (REQ-11-001) Stable

  coreci-bot released this 2026-10-01 12:38:48 +00:00 | 44 commits to main since this release

  Phase 1: Placement Store + Evidence Ledger

  The 9th D-027 store family: ai_service/placements/ — PlacementRow (immutable at creation except the operator correction active → revoked; partial UNIQUE index uq_active_placement_per_application on application_id WHERE status='active', the G-316 shape — revoked rows stay in history, a re-hire creates a fresh row) + PlacementEventRow (the append-only GLOBAL sha256 hash chain: canonical JSON + prev_hash, UNIQUE(prev_hash) fork backstop, GENESIS_HASH pinned, NO delete path anywhere in the module).

  What shipped

  • The D-099 transition matrix (forward-only with skip-forward; hired/rejected/withdrawn terminal) + the D-101 event vocabulary incl. the R-80 placement lane (placement.created/revoked/rehired).
  • The ONE transactional transition_application (D-100): the marketplace application status write + the ledger append + the PlacementRow-on-hired land in ONE commit (flush-then-hash-then-commit — the row's own autoincrement id participates in its own hash); the placements store is the ONLY post-creation writer of application.status (R-78, stated + verified).
  • The correction lane: revoke_placement (active → revoked only) + rehire_placement (R-80: fresh PlacementRow + placement.rehired event, decided_at = the re-hire event's stamp per G-326; the partial-unique IntegrityError surfaces as the honest 409).
  • The adversarial suite (22 tests): tamper (second-engine UPDATE → verify_chain fails), fork (duplicate prev_hash → IntegrityError), concurrency (two engines — one winner, never two events on one prev_hash), no-delete-path source pin, tz-conversion pin (aware non-UTC inputs convert — the security review's P0 fix), actor-vocabulary enforcement.
  • Wiring: main.py lifespan (getattr-guard) + get_placement_store DI; the marketplace store gains ONLY the get_application point read.

  Honesty block

  • The chain detects in-place mutation/fork of an intact sequence; wholesale DB replacement is detectable only via export-to-export continuity (stated in the P4 export methodology per G-321).
  • No PII in payloads (status enums, role_title, ISO start dates, opaque actor handles).

  Verification

  • 1053 ai-service tests (fast lane, +22), 101 web, 87 CLI — all green, zero warnings; mypy clean (231 files, zero new overrides); ruff clean.
  • Verify stage: four layers PASS (structural, behavioral, security, quality); REQ-11-001 every clause evidenced.

  Downloads

  • nextcraft-linux-arm64
    117 MiB

    2026-10-01 12:40:16 +00:00
  • nextcraft-linux-arm64.sha256
    88 B

    2026-10-01 12:40:16 +00:00
  • nextcraft-linux-x64
    121 MiB

    2026-10-01 12:40:14 +00:00
  • nextcraft-linux-x64.sha256
    86 B

    2026-10-01 12:40:15 +00:00
  • nextcraft_0.10.1_amd64.deb
    28 MiB

    2026-10-01 12:40:16 +00:00
  • nextcraft_0.10.1_amd64.deb.sha256
    93 B

    2026-10-01 12:40:16 +00:00
  • nextcraft_0.10.1_arm64.deb
    27 MiB

    2026-10-01 12:40:17 +00:00
  • nextcraft_0.10.1_arm64.deb.sha256
    93 B

    2026-10-01 12:40:17 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)