v0.4.1: add integrity envelopes, typed approvals, runtime preconditions and executable-plan artifacts

CHANGELOG.md

@@ -1,4 +1,15 @@
 # Changelog
+## 0.4.1 - 2026-08-02
+- Added self-verifying admission and reconciliation envelopes under one canonicalisation profile.
+- Added typed capability compilation, injected runtime preconditions, accurate prior-state
+  compensation, and provider claim enforcement.
+- Added a verified admission-to-desired-revision adapter and world-safe revision record IDs.
+- Published v0.4.1 approval, executable-plan and desired-revision schemas. Operational providers
+  and durable/PostgreSQL execution remain out of scope.
+- Review hardening removes inferred runtime facts, rejects ambiguous mandates, types the legacy
+  admission adapter, binds runtime approvals to their decision, and removes order-derived manifest
+  authority selection.
+
 ## 0.3.0 - 2026-08-02
 - Added deterministic compilation of admitted plans, typed provider contracts and
   resolution, explicit execution state and evidence, dry run, retry, compensation,

README.md

@@ -1,5 +1,7 @@
 # NetSovereign
 
+Current package version: **0.4.1**. See the [v0.4.1 enforceable artefact chain](docs/artefact-chain-v0.4.1.md).
+
 > **Experimental / pre-alpha:** v0.2 models intent and plans change only. It provides no operational infrastructure or security guarantees.
 
 NetSovereign defines sovereign digital worlds. **NetEngine** is the future compiler and reconciliation runtime that may materialise declared authorities through replaceable providers. Sovereignty means that recognised institutions can govern a world's naming, numbering, registry, trust, identity, transit, mail, and catalogue authority without making any particular service canonical.

SECURITY.md

@@ -1,2 +1,10 @@
 # Security
+
+## Pre-alpha approval boundary
+
+v0.4.1 binds explicitly verified, unexpired approval evidence to an exact proposal and gate, but
+does not authenticate actors or verify signatures. Asserted evidence and the fake provider are not
+production trust boundaries. Runtime predicates fail closed before provider work; observations
+remain evidence and cannot rewrite authority.
+
 This pre-alpha package performs offline declaration parsing; it is not a security boundary and makes no runtime assurance. Report vulnerabilities privately through GitHub's security advisory facility. Never include secrets. Provider execution, durable state, identity, PKI, routing, and federation are deferred.

docs/artefact-chain-v0.4.1.md

@@ -0,0 +1,38 @@
+# Enforceable artefact chain (v0.4.1)
+
+NetEngine keeps declaration, decision, evidence, materialisation and execution distinct:
+
+`WorldSpec → diagnostics → WorldManifest → AcceptedWorldRevision → AdmissionDecision → ReconciliationPlan → ExecutablePlan → ExecutionRun`.
+
+Declarations and manifests are canonical sovereign artefacts. Admission is a mandate-aware
+decision; approvals and observations are evidence, never authority. Provider bindings are
+replaceable materialisation choices. Plans and executable plans are derived artefacts.
+
+## Integrity and gates
+
+Persistent integrity envelopes use `netsovereign.canonical-json/v1` and `sha256:<hex>`.
+Admissions bind revisions, changes, evidence, issues, gates and status. Plans bind their source
+decision, revision and manifest digests, approval set, predicates, dependencies, capabilities,
+outcomes and reversibility. Compilation verifies a loaded plan unconditionally.
+
+Execution evaluates sovereign predicates against an injected `RuntimeFacts` snapshot before
+provider validation or mutation. A failure records the exact predicate as evidence. Provider
+validation is a later, separate gate. The executor never infers facts from a plan; the explicitly
+named `offline_demo_facts()` helper is restricted to the fake-provider CLI demonstration.
+
+Capabilities are provider-neutral and versioned. Compilation resolves the declared requirement,
+binds the descriptor into the executable fingerprint, and rejects incompatible versions, unsafe
+retry, dry-run and compensation postures. Compensation restores retained prior state; delete is
+not presumed reversible.
+
+## Security boundary and compatibility
+
+Approval authentication remains a pre-alpha seam. Only evidence explicitly marked `verified`,
+unexpired, and bound to the exact proposal digest and gate satisfies admission. This release does
+not provide signatures, operational providers, PostgreSQL runtime integration, restart recovery,
+high availability or daemon reconciliation.
+
+The v0.2 admission and plan schemas gain integrity-envelope fields. New v0.4.1 approval,
+executable-plan and desired-revision schemas are published. The typed desired-revision adapter is
+the supported activation path; legacy prototype records remain readable but are not admission
+proof. Their compatibility shape is an explicit typed adapter rather than an arbitrary dictionary.

docs/roadmap.md

@@ -1,8 +1,9 @@
 # NetSovereign roadmap
 
-Implementation status: v0.1 through v0.4 are implemented and tested. v0.4 supplies the
-bounded, single-node durable control-plane seams and PostgreSQL schema; v0.5 naming
-materialisation remains planned and is not implied by those interfaces.
+Implementation status: v0.1 through v0.4.1 are implemented and tested. v0.4 supplies a bounded
+local repository prototype and PostgreSQL schema, not integrated durable execution. v0.4.1 binds
+the cumulative semantic chain before later durability. Checkpoints, restart recovery, operational
+providers and v0.5 naming materialisation remain planned and are not implied by these interfaces.
 
 NetSovereign develops authority and intent before operational adapters. Versions v0.2 through v0.4
 are a single dependency chain: real DNS, PKI, identity, or gateway providers must not begin until

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "netsovereign"
-version = "0.4.0"
+version = "0.4.1"
 description = "Provider-neutral compiler and reconciliation runtime for sovereign worlds"
 readme = "README.md"
 requires-python = ">=3.12"