bce-engine@0.5.0 release verification#

bce-engine@0.5.0 was published on 2026-09-27T14:32:21.158Z from the annotated v0.5.0 tag and is protected by an immutable GitHub Release. This record binds the installed registry artifact, source, provenance, six GitHub Release assets, and the consumer checks that preceded and followed publication. Release evidence remains first-party mechanism and supply-chain evidence.

What changed#

The release adds the enforcement half of RFC-0002 to the existing stack plane. An authored blueprint can select exact npm-v3 or root pnpm-v9 lockfiles, package.json, image files, and Node runtime files, then enforce pinnedVersion, stackClosureMatch, forbiddenStackPackage, requirePinnedImages, and allowedNodeVersions through the ordinary gate, run, and read-only MCP paths. Missing, opaque, variable, conflicting, or integrity-invalid required evidence refuses. Version 2 offline bundles bind the stack manifest and source facts, re-evaluate the report, and refuse manifest substitution or tampering.

The declared-stack contract observes selected declarations. It does not prove installed state, registry origin, deployed state, or runtime behavior. It does not resolve registries, mutate declarations, reconcile stacks, or apply repairs. The release retains the standalone snapshot/diff plane, route evidence, lifecycle, recipes, and local specification from preceding releases.

The immutable archive is a preparation snapshot: its README, guides, release-state.json, and Lane-A pin still name v0.4.0 as current and v0.5.0 as the candidate. Those mutable install surfaces are corrected by the post-publication activation PR; the released archive itself is not rewritten.

Published identity#

The registry provenance advertises predicate type https://slsa.dev/provenance/v1 for bce-engine@0.5.0. The workflow binds the package to the source commit above and .github/workflows/release.yml@refs/tags/v0.5.0. The annotated Git tag is not claimed as a cryptographic signature.

Immutable assets#

The signed payload manifest records 492 package entries and manifest digest sha256:42fa8549b4d13e0bba5dcf89fa22347f516a507ce4468dd40c784e501600560a. Its archive integrity and shasum match npm. The EvidenceRecord reports score 100, verdict pass, zero violations, source bbc898156fa5d41b89d5a09c566f4e50481ccf63, and record hash e86c8bbbae0a12885d655346a0debf8eca1f814566b94fb97724b09d99397814.

Exact installed experience#

The publish job installed the final tarball into a fresh consumer before publication and exercised the declared-stack contract from those exact bytes. A post-publication registry replay passed 52/52 route cases and 90/90 declared-stack cases on macOS arm64, Node v22.22.2, and npm 10.9.7. It independently recomputed the archive SHA-256, SHA-512 integrity, and SHA-1 shasum; the registry tarball was byte-identical to the immutable Release asset. The bounded summaries are route replay evidence and declared-stack replay evidence.

The first post-publication declared-stack replay correctly exposed a proof-harness literal that still expected predecessor 0.3.1. The activation PR changes the package proof to install the actual predecessor 0.4.0 and derives the refusal message from that installed package. The rerun then passed 90/90 using public 0.5.0 runtime bytes and public 0.4.0 predecessor bytes. This was a test-harness identity assertion, not an engine verdict failure; immutable 0.5.0 bytes are unchanged.

The tag run passed 1,412 tests with 2 skipped, the self-gate, every release gate, provenance publication, and immutable Release finalization on attempt 1. The portability run passed Ubuntu, macOS, and Windows on Node 22 and 24. The reviewed PR and published squash commit have the same Git tree.

Replay and limits#

npm view bce-engine@0.5.0 version dist.integrity dist.shasum dist.attestations
gh release download v0.5.0 --repo blueprint-conformance/bce --dir release-assets
node scripts/route-consumer-proof.mjs --registry-version 0.5.0 \
  --out registry-proof.json --evidence-dir registry-evidence

Run consumer proofs with Node 22 or newer. Verify both downloaded Sigstore bundles with the lockfile-pinned @sigstore/cli, using the GitHub OIDC issuer and exact tag-workflow identity above, and compare their payloads and archive hashes with this record.

It is not independent adoption, independent review, or product-efficacy evidence. The accepted RFC defers repair and reconciliation, and the declared-stack replay's originAuthenticity remains not-established.