# Changelog

## 1.0.0 final SDK ABI reconciliation — 2026-08-26

- Reconciled the exact SDK ABI tuple to 36/55/45/24 and pinned identities `0x0c18d05c868716fad4bfc1fcfad2da51c83f247de06a7e3871dcece768a9526f`, `0x954aeee609e92a621e726dcae77be193085651626941d582ca2f7f3b7c073d8c`, `0xcf81d69fed252f21bfd7661ff53868aa81b9ce1a4a1c89edbec9eaabffa7ad0a`, and `0xe31e9d196bf5a37c328313f688b0d6eff881847e6c46437c1fc617faff8e80e3`.
- Added Partnership's two read-only flourishing constants without granting them protected-decision authority.
- Added Governance codehash getters, append-only only-self canonical-address pinning, and the codehash-bound call-policy overload while removing the retired unpinned overload.
- Captured the exact four-deployment SDK write-method closure and fail-closed exclusion of Governance configuration writes.
- Confirmed that the 11 SDK reads and 20 generated V3 API route identities are unchanged.

## 1.0.0 final Base bond binding refresh — 2026-08-26

- Pinned final Accountability and BondState source hashes `fffa8756…ccffa` and `d22611af…d14b`.
- Replaced the stale 44-signature Accountability snapshot with the exact final 36-signature source ABI and identity `0x0c18d05c…a9526f`; retired generic dispute/finalization selectors are prohibited.
- Expanded the source transition closure to 25 with `SettlementFrozen -> Cancelled`.
- Added typed same-timestamp canonical revalidation and pause-safe accepted-liability timeout/refund semantics, vectors, and normal/optimized regressions.

## 1.0.0 final independent audit closure — 2026-08-26

- Closed H-01 by rejecting every settlement/finalization transition, including `SettlementFrozen -> Settled`, at `activePeriodEnd` and later while preserving acceptance at end minus one.
- Closed M-01 by synchronizing the mapping and interface snapshot to the exact 24 source-valid transitions, including all three staged-to-expired edges.
- Added normal/optimized and independent-harness regressions without changing the justified frozen 8-positive/38-adversarial corpus.

## 1.0.0 stabilized bond timing refresh — 2026-08-25

- Reverified and pinned the exact current `AccountabilityBondV3Safe.sol` and `BondStateV3.sol` source hashes with all 15 supported modules.
- Made `activePeriodEnd` explicitly half-open and required staged response/challenge/decision windows to finish strictly before it.
- Added direct `end-1`, `end`, `end+1`, and staged-window regressions without changing the frozen 8/38 vector corpus.

## 1.0.0 third-audit structural hardening — 2026-08-26

- Made protected-decision provenance a closed, typed, reachable DAG; rejected self/multi-node cycles, generic source escapes, untyped derivations, and recursive prohibited extension content.
- Unified exact-commit validation in one candidate envelope binding commit/tree, mapping, interface, evidence, manifest, license, and committed inclusion.
- Made conformance reporting a read-only post-commit phase capable of a truthful conformant result in an isolated clean candidate; removed fixed-point and hardcoded-failure behavior.
- Excluded known ephemeral caches during development discovery, rejected them in release mode, and made manifest coverage exact for source artifacts.
- Added third-audit regression coverage and an isolated temporary-commit end-to-end test. The governance source digest remains intentionally blocked pending the separate Base remediation.

## 1.0.0 residual-audit hardening — 2026-08-26

- Fixed the exact corpus at 8 positive and 38 adversarial vectors and prohibited empty/partial/internal-error success.
- Added objective report evidence recomputation, fresh-time evaluation, exact Git object/tree/inclusion/cleanliness gates, and truthful blocked output.
- Added closed provenance graphs, stronger signature structure and settlement bindings, state-history continuity, pull-credit reconciliation, pause-safe funded exits, and fresh privacy-preserving portability rules.
- Hash-bound all 15 current source modules and normalized all 20 generated V3 routes.
- Added residual-finding and 13-case regression coverage in normal and optimized Python.

SPDX-License-Identifier: MIT

## 1.0.0 - 2026-08-25

Initial repository-local normative specification, strict schemas, canonical mappings, stable errors, deterministic vectors, offline conformance harness, checksum checker, and tests. No deployment, authorization, audit, endorsement, signing, or publication is claimed.

### Independent adversarial remediation

Closed all 16 independent findings (C-01 through C-02, H-01 through H-08, M-01 through M-05, and L-01) and rejected all 21 independently reported invalid mutations. Added the exact canonical interface snapshot, eighth mutual-settlement schema/vector, 29-check registry, machine-readable compatibility policy, strict semantic validation, immutable evidence/commit bindings, complete 15/4/11/20 surface mappings, full manifest/symlink safety, normal and optimized fail-closed behavior, 38 frozen adversarial vectors, and finding-by-finding regression/tamper coverage.

### Licensing resolution

Added and exact-digest-bound the user-selected canonical root MIT License (`Copyright (c) 2026 Vaultfire contributors`). Added SPDX metadata, fail-closed license validation, and missing/modified/wrong/stale-digest negative tests. Open licensing remains distinct from deployment and production decentralization.
