Updated: 2026-08-13
Source basis: 4adf20412028aa858a982c2149c3622327efa11a
Canonical repository: github.com/luanmorenommaciel/brief-spec
This document separates implementation, validation, host evidence, and publication. A local or globally installed candidate is not a public release.
| Boundary | Evidence | Status |
|---|---|---|
| Source candidate | Version 0.5.0 derived from 4adf20412028aa858a982c2149c3622327efa11a |
Locally validated release candidate from an uncommitted worktree |
| Repository | private canonical repository |
Renamed; visibility is still private |
| Latest GitHub release | v0.2.0 |
Published historical release |
| Local gates | 469 tests, 403 source checks, 459 wheel checks, 86.25% coverage on macOS / Python 3.13.9 | Lint, formatting, release verification, tests, and coverage pass locally |
| Hosted CI | run 31708342030 for 4adf20412028aa858a982c2149c3622327efa11a |
blocked-before-execution; steps executed: false |
| Live harness evidence | Sanitized disposable-repository results retained locally | Codex 8/8, Claude 8/8, OMP 4/4, Grok 4/4, and Kimi 4/4 passed |
| Live release authorization | release/live-e2e-evidence.json; source fingerprint 975647c437867b419979db657413ce7e377ce1e19ad678eaeb18a3328781c6ec |
authorized by none |
GitHub v0.5.0 |
Release API and workflow state | not-published |
| PyPI core/PDF/audio | PyPI project/file lookup | not-published / not-published / not-published |
| Canonical schemas | GitHub v0.5.0 release assets plus brief-spec-schemas.bundle.json |
built locally; not published |
The hosted failure is infrastructure evidence, not repository test evidence: GitHub rejected the
jobs before any step ran because of the recorded GitHub Actions billing or spending limit condition. The five required
local live-host gates are authorized; public release remains blocked on the exact-SHA hosted and
account-owned publication gates.
| Harness | Current claim |
|---|---|
| codex | live-verified |
| claude | live-verified |
| omp | live-verified |
| grok | live-verified |
| kimi | live-verified |
| copilot | experimental |
| cursor | experimental |
| goose | experimental |
live-verified means the deterministic installation controls and the required authenticated live
matrix passed for this local candidate. hold is a visible unresolved condition. experimental
is best effort and non-blocking.
| Harness | Passed/required | Local sanitized summary |
|---|---|---|
| codex | 8/8 | .briefspec/live-e2e/ultimate-final-codex/summary.json |
| claude | 8/8 | .briefspec/live-e2e/ultimate-final-claude/summary.json |
| omp | 4/4 | .briefspec/live-e2e/ultimate-final-omp/summary.json |
| grok | 4/4 | .briefspec/live-e2e/ultimate-final-grok-verified/summary.json |
| kimi | 4/4 | .briefspec/live-e2e/ultimate-final-kimi/summary.json |
Every passing scenario required the host hook, bounded contract, strict validation, equivalent deterministic downloads, bundle and receipt verification, and an authorized-change check. The summaries retain metadata and hashes, not credentials or raw transcripts. Grok's native gate uses passive classification hooks, one bounded Stop repair, and a native read/edit allowlist in a disposable repository; shell, web, memory, and subagents remain disabled.
The committed evidence file contains only sanitized decisions, artifact hashes, categorical failure reasons, and hashed opaque session references. CI recomputes its release-source fingerprint and the release authorization fails closed unless all required hosts pass.
| Boundary | Retained evidence | Status |
|---|---|---|
| Distribution set | .briefspec/ultimate-release-candidate-dist; manifest 0aedc4e61157632cfdb17f220a11093d7d12c8e4dd7d91382eb1e7fa66dd431f |
Six wheel/sdist files pass Twine, SHA-256, resource projection, and wheel/sdist clean-room installation |
| Core wheel | SHA-256 77305f5d5c08504baf3b91eeb5264566aeff74d5e7eb71bbf0dbed0921dff2c2 |
Installed globally from these exact bytes |
| Offline schemas | SHA-256 ae182e3db46c8c9b124edad4131f2a13cd8412414ee47988132b47784772c6c6 |
Built and validated locally; not published |
| Global tool | Core plus PDF and audio renderers | Core, PDF, and audio 0.5.0 installed from the exact local wheel set |
| Global doctors | User and detected project scopes | Codex, Claude, OMP, Grok, Kimi, and Cursor PASS; absent Copilot and lifecycle-limited Goose WARN |
| Intentional overrides | Receipt-owned paths only | Converge Claude and Nexo Codex PASS at 0.5.0 |
| Rollback | Byte-for-byte manifest verification | Pre-upgrade user and receipt-owned Converge/Nexo snapshots restored and the final candidate reapplied; unrelated dirty-status digests remained byte-identical |
The artifact manifest intentionally has no hosted source authorization: these bytes came from an uncommitted local worktree. Hosted CI must rebuild once from the exact committed revision and the release workflow must reuse those hosted bytes unchanged.
| Gate | Local result |
|---|---|
| Self-contained HTML | PASS at desktop and mobile widths with zero external requests |
| Playwright PDF | PASS for selectable text, fonts, metadata, geometry, page rendering, and deterministic bundle bytes |
| Offline macOS audio | PASS for MP3 decoding, duration, disclosure, source-script hash, and deterministic bundle bytes |
| Explicit-consent OpenAI audio | Not run because OPENAI_API_KEY is absent; mocked coverage passed |
- honest classification with negation masking, abstention, decision records, and reported-marker downgrade;
- zero-network and no-plugin verification defaults, SSRF-safe public-address policy, bounded files and archives, and no command execution;
- receipt-hash ownership with preservation of locally modified skills;
- deterministic runtime precedence and hermetic no-CLI/fake-CLI test lanes;
- status-first human renderings, portable release-hosted schemas, and an offline schema bundle;
- exact-SHA CI authorization that reuses tested bytes and blocks tag-time rebuilding;
- evidence-based harness maturity, with all five required hosts live-verified.
- Restore hosted CI execution
- Choose public visibility at release time
- Register three PyPI Trusted Publishers
- Approve the v0.5.0 tag and public release
The repository-owned implementation may prepare these gates but cannot truthfully mark them complete. The release workflow must consume the exact candidate artifact produced by successful CI, publish identical bytes through Trusted Publishing, verify PyPI/GitHub digests, then finalize GitHub.
Historical v0.1.0 evidence remains in
verification-v0.1.0.md and is never promoted to current evidence.