SEIF Delivery
0.5.0 — product experience and investigation
0.5.0 changes the desktop experience; the Context Engine (0.4.0), runtime contract, Registry and SDKs are unchanged, so Build digests are stable across 0.4.0 and 0.5.0. See Product experience and Investigation.
| Claim | Proof |
|---|---|
| Five-stage workflow with stage-specific actions; coordinates of the inspected Build, trace or running runtime; focus, caret and scroll survive live refresh; keyboard rows and shortcuts | ExperienceUiTests, ProductUiTests; evidence/product-experience/ |
| Every stage renders inside 1920×1080, 1512×982 and 1024×640 windows without overflow | VisualAcceptanceTests; evidence/visual-acceptance/ |
| Investigation: four explicit investigations (local, no provider call), typed questions routed and subjects matched locally, exact-digest Build drilldown, rule/source return with unchanged evidence | InvestigationTests, ExperienceUiTests; installed-app experience journey |
| Decision provider boundary: validation, explicit fallback, opt-in, banded projection, credential refusal, no provider payload on screen | InvestigationTests; experience journey (loopback replay of the TypeSafe wire contract; synthetic outage) |
| Send test request, failing-test cause attribution, Build-diff links, directional regression colours | ExperienceUiTests; commercial journey screenshots |
| Reference and commercial journeys still pass with the installed app | clean-install-journey/, commercial isolation proof |
Not proven: live TypeSafe/Jev inference (no credential exists here; none was created), any human usability study, and native window sizes above the development display's 1280×720 working area (covered by Skia renders).
0.4.0 — runtime context, identities, portability and attestation
The release record for a source commit is not in this repository. It is generated by scripts/prove-commercial-delivery.sh from a clean committed source into artifacts/release/<version>/ (assets, proofs, signed attestation) and verified with scripts/verify-attestation.mjs. Historical evidence/ files are coordinates of earlier releases. This document describes what the pipeline proves and how; the attested proofs/ hold the measured values for the exact commit.
What is proven, and where
| Claim | Proof |
|---|---|
| Application credential resolves but cannot register, promote, deploy, roll back, approve or manage access | tests/engine/identity.test.mjs; commercial journey steps 13–24 (Python application process, denials audited) |
| CI identity reads the baseline, registers and runs regression; cannot approve, deploy or manage access | identity.test.mjs, ci.test.mjs; journey steps 25–31; Linux acceptance |
| Revocation, rotation, disable, cross-Project/environment/org denial; digests only at rest | identity.test.mjs |
| Deployment Binding contract, revisions, compatibility, secret allowlist, exact revision per deployment, Build unchanged | providers.test.mjs; journey steps 6–7, 29 (same artifact, different bindings) |
| Request-time customer context; customer record and secrets absent from Builds and traces; provider provenance | providers.test.mjs; journey steps 4, 16–19, 37–38; Linux acceptance |
| Only bound secrets reach runtime processes | wrapper-executable test on macOS; /proc/<pid>/environ in Linux x64/arm64 |
| Provider failures explicit (timeout, unavailable, not found, oversize, secret, unsafe input); timeout ≠ runtime unavailable | providers.test.mjs |
| Route moves only after readiness; draining; rollback; break-glass; distinct approver | governance.test.mjs; journey steps 33–40b |
| Truthful reproduction states including retained provider results | journey step 43; providers.test.mjs |
| CAS dedup, exact reconstruction, tamper/missing refusal, GC, backup, v1→v2 migration of real 0.3.0 data | storage.test.mjs; scale.json storage comparison |
| Indexed trace search by layer, material, source, provider at 100k traces; tenant scope | storage.test.mjs; scale.json |
| Context CI PASS/BLOCK with Registry baseline; JSON, Markdown, JUnit, annotations | ci.test.mjs; journey; Linux acceptance |
| Linux x64 and arm64 execution of the server distribution, offline, unprivileged | linux-x64-proof.json, linux-arm64-proof.json |
| Clean install, sandboxed installed-artifact journey, native UI (29 screens), no repository/SEIF source/global toolchains | clean-install.json, commercial-isolation.json, commercial-journey.json, screenshot manifest |
| Exact source → artifacts → proofs | attestation.json + DSSE envelope, verified against the public key committed at the attested source |
Artifacts
SEIF-Context-Workstation-<version>-macos-arm64.dmg (desktop, ad-hoc signed); context-control-plane-<version>-{macos-arm64,linux-x64,linux-arm64}.tar.gz (Registry, Context Runtime, Context CI, SDKs, bundled checksum-verified Node); reference runtime bundle. Desktop Linux x64 and Windows x64 are compiled (self-contained publish) but not executed: build capability, not support.
Limits that remain
No HA (single SQLite writer, local process runner); no SSO; laptop-scale measurements only; ad-hoc macOS signature (notarization path prepared, not executed without credentials); hosted GitHub Actions not executed (the shipped check script is); local release key custody (not HSM/KMS); the Linux x64 proof runs genuine x86-64 binaries under emulation on an Apple-silicon host (compatibility, not performance); lexical and external ranking only, no semantic retrieval; the binding editor is a validated JSON editor rather than a form.
See ADR 004, Release attestation, Insight ledger.