77 Releases 83 Tags

RSS Feed

• v0.10.4 9f727427a7

  Compare

  v0.10.4 — CIRR-Style Audit Export (REQ-11-004) Stable

  coreci-bot released this 2026-10-01 14:14:38 +00:00 | 38 commits to main since this release

  Phase 4: The Audit-Grade Export

  The third-party-auditor deliverable: one self-contained JSON document + a human markdown summary rendered from the same document (the anti-drift rule — the summary can never assert a number the export doesn't contain).

  What shipped

  • GET /v1/placements/admin/export: {schema_version, generated_at, summary, cohort, evidence_bundles, methodology, ledger} — every placement (active AND revoked — G-325: the correction history is what an auditor most wants to inspect) with per-placement evidence bundles resolved from SOURCE ROWS at export time (posting record, application record, full transition history, decision provenance); the complete event ledger with head_hash. No backfill — pre-v0.11 applications carry only their created_at (honest absence, A-304).
  • The methodology block states its own limits explicitly: (a) no minimum-employed-duration check (a placement = a recorded hire), (b) no salary, (c) employer-principal attestation + operator oversight — NOT third-party employment verification. G-321: the chain's proof scope (in-place mutation/fork detection), its limit (wholesale DB replacement is undetectable by the walk alone), the auditor's real anchor (export-to-export prefix continuity + head-hash comparison), and the event↔row cross-consistency check.
  • GET /v1/placements/admin/export/summary (text/markdown): totals toward the 1,000 guiding goal, the cohort table, the methodology prose, the head hash + offline chain-walk instructions (the export embeds every event — the walk needs nothing else).
  • Determinism (R-73): pinned list orderings, total generated_at exclusion, float absence — re-exports reproduce identical chains + head (test-proven).
  • Fail-closed: the export refuses to build on a broken chain (a raise, not an assert — survives python -O).
  • The admin placements block (D-109 surface 4): recorded-placement counts + per-employer chips on the moderation page + the export links (summary in-tab, JSON download) over the adminToken transport.

  The full-chain E2E proof (test_e2e_audit)

  Register → claim → admin approve → posting → verified learner applies → in_review → interview → offer → hire → placement created → the chain walks green GENESIS→head → the export reproduces identically → the overview counts the learner ONCE toward 1,000.

  Verification

  • 1103 ai-service tests (+7), 105 web, 87 CLI — green, zero warnings; mypy clean (237 files); the 252-page static export builds.
  • P4 security review verdict SHIP (determinism, no PII beyond opaque handles, methodology honesty, head-hash truth, fail-closed gates, zero CIRR-as-verification wording anywhere in apps/web).

  Downloads

  • nextcraft-linux-arm64
    117 MiB

    2026-10-01 14:16:01 +00:00
  • nextcraft-linux-arm64.sha256
    88 B

    2026-10-01 14:16:01 +00:00
  • nextcraft-linux-x64
    121 MiB

    2026-10-01 14:16:00 +00:00
  • nextcraft-linux-x64.sha256
    86 B

    2026-10-01 14:16:00 +00:00
  • nextcraft_0.10.4_amd64.deb
    28 MiB

    2026-10-01 14:16:02 +00:00
  • nextcraft_0.10.4_amd64.deb.sha256
    93 B

    2026-10-01 14:16:02 +00:00
  • nextcraft_0.10.4_arm64.deb
    27 MiB

    2026-10-01 14:16:02 +00:00
  • nextcraft_0.10.4_arm64.deb.sha256
    93 B

    2026-10-01 14:16:02 +00:00
  • Source Code (ZIP)
  • Source Code (TAR.GZ)