JACKAL v1.7.3: release 41-tool evidence surface

.github/workflows/gaussian-proof-gate.yml

@@ -32,6 +32,12 @@ jobs:
           python3 release/tools/range_proof_identity.py check --lane range --proof-only
           python3 release/tools/range_proof_identity.py check --lane int-cert --proof-only
 
+      - name: Reject repository-wide Lean admissions and trust bypasses
+        run: |
+          python3 -B tools/lean_admission_audit.py --source-check
+          python3 -B -m unittest \
+            tests.lean_admission_audit_test.LeanAdmissionAuditMutationTest -v
+
       # The committed checker hashes are for the recorded macOS/arm64 builds.
       # A release seal must additionally run the full, platform-matching gate:
       # python3 release/tools/gaussian_proof_identity.py check --lane gaussian
@@ -45,16 +51,24 @@ jobs:
     steps:
       - name: Check out exact revision
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
 
-      - name: Mechanical 38-tool inventory and pack-reachability lock
+      - name: Mechanical 41-tool inventory and pack-reachability lock
         run: |
           python3 - <<'PY'
           import json
           tools = json.load(open("plugin/hermes/tools.json"))["tools"]
           names = sorted(t["name"] for t in tools)
-          assert len(names) == 38, f"expected 38 tools, found {len(names)}"
+          assert len(names) == 41, f"expected 41 tools, found {len(names)}"
           assert "jackal_claim" in names and "jackal_verify_bundle" in names
           assert "jackal_integrate_bound_cert" in names
+          program_tools = {
+              "jackal_anubis_check_program",
+              "jackal_anubis_verify_program",
+              "jackal_anubis_verify_program_receipt",
+          }
+          assert program_tools <= set(names), "program-evidence tool omission"
           # Every domain-pack operation must be reachable through some tool.
           # `core.exact.mod_pow.v1` routes to the `mod-pow` engine command that
           # `jackal_mod_pow` already exposes, so it is exempt BY NAME.
@@ -69,11 +83,18 @@ jobs:
                   assert len(owners) == 1, f"{op} exposed by {owners}, expected 1"
           full = json.load(open("plugin/hermes/profiles/full.json"))["tools"]
           assert full == [t["name"] for t in tools], "full profile != tools.json order"
-          print(f"38-tool inventory locked: {len(names)} tools; "
+          print(f"41-tool inventory locked: {len(names)} tools; "
                 f"{sum(len(p['operation_ids']) for p in registry['packs'])} "
                 "pack operations reachable")
           PY
 
+      - name: Canonical capability inventory
+        run: |
+          python3 -B tools/capability_inventory.py --check
+          python3 -B -m unittest tests.capability_inventory_test -v
+          python3 -B tools/capability_drift_gate.py
+          python3 -B -m unittest tests.capability_drift_gate_test -v
+
       - name: v1.5.0 compatibility floor (additive-only surface lock)
         run: python3 tools/compat_floor.py --check
 

.github/workflows/jackal-codex-plugin.yml

@@ -19,6 +19,9 @@ jobs:
     steps:
       - name: Check out exact revision
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Require the supported host and fixed Python prerequisite
         run: |
@@ -27,6 +30,14 @@ jobs:
           test -x /opt/homebrew/bin/python3
           /opt/homebrew/bin/python3 -c 'import sys; assert sys.version_info >= (3, 10)'
 
+      - name: Verify canonical capability and documentation contracts
+        run: |
+          /opt/homebrew/bin/python3 -B tools/capability_inventory.py --check
+          /opt/homebrew/bin/python3 -B tools/capability_drift_gate.py
+          /opt/homebrew/bin/python3 -B -m unittest \
+            tests.capability_inventory_test \
+            tests.capability_drift_gate_test -v
+
       - name: Run complete Codex plugin unit suite
         run: /opt/homebrew/bin/python3 -B -m unittest discover -s tests/codex_plugin -v
 

GETTING-STARTED.md

@@ -10,24 +10,30 @@ loudly, with a named reason — instead of printing something plausible.
 
 This guide takes you from install to reading your first certified result.
 
+<!-- JACKAL_CURRENT_SURFACE_V1_BEGIN -->
+The v1.7.3 release agent surface contains 41-tool entries, derived and checked
+in `release/capability_inventory_v1.json`. The annotated tag, GitHub release,
+package receipt, and downloaded asset must all bind the same release identity.
+<!-- JACKAL_CURRENT_SURFACE_V1_END -->
+
 ## 1. Install
 
 ### Option A — download the release package (Apple Silicon macOS)
 
-The GitHub release ships one sealed package,
-`jackal-v1.7.0-macos-arm64.tar.gz`; the `jackal-native` binary lives INSIDE
-it, next to every pinned checker and wrapper. Verify the tarball against the
+The current public release ships
+`jackal-v1.7.3-macos-arm64.tar.gz`; the `jackal-native` binary lives inside it,
+next to every pinned checker and wrapper. Verify the tarball against the
 release `SHA256SUMS`, extract it, and check the binary against
 [`PROVENANCE.md`](PROVENANCE.md):
 
 ```bash
 git clone https://github.com/AnubisQuantumCipher/jackal.git
 cd jackal
-# download jackal-v1.7.0-macos-arm64.tar.gz (+ SHA256SUMS) from the
+# download jackal-v1.7.3-macos-arm64.tar.gz (+ SHA256SUMS) from the
 # Releases page into this directory, then:
 shasum -a 256 -c SHA256SUMS --ignore-missing
-tar -xzf jackal-v1.7.0-macos-arm64.tar.gz
-cp jackal-v1.7.0-macos-arm64/jackal-native .
+tar -xzf jackal-v1.7.3-macos-arm64.tar.gz
+cp jackal-v1.7.3-macos-arm64/jackal-native .
 shasum -a 256 jackal-native        # compare against PROVENANCE.md
 chmod +x jackal-native
 ./jackal self-test
@@ -252,10 +258,11 @@ embedded certificate, tested end to end in
 
 ## 5c. The Hermes / MCP-style plugin
 
-The bundled `plugin/hermes/jackal_hermes` exposes thirty-four tools — the
-eleven formal wrappers, twenty-one weaker-lane adapters, and the two v1.6.0
-claim-kernel front doors — that an MCP-speaking host
-can call over stdio JSON-RPC or a small HTTP wrapper.  A recomputed
+The bundled `plugin/hermes/jackal_hermes` exposes forty-one tools: eleven
+formal wrappers, twenty-one weaker-lane adapters, two claim-kernel front doors,
+four domain-pack lanes, and three inventory-safe-v1 Anubis program-evidence
+lanes. An MCP-speaking host can call them over stdio JSON-RPC or a small HTTP
+wrapper. A recomputed
 bundle hash MUST equal the pinned value in `release/MANIFEST.sha256`
 under `plugin_hermes` before the plugin accepts any request:
 
@@ -270,24 +277,24 @@ plugin/hermes/jackal_hermes call jackal_verify_receipt \
     "$(< /tmp/formal-receipt.json)"
 ```
 
-Thirty-four tools total: eleven proof-carrying (`jackal_range_bound`,
+Forty-one tools total: eleven proof-carrying (`jackal_range_bound`,
 `jackal_gaussian_integral`, `jackal_integrate_bound_cert`,
-`jackal_sqrt_rat_bound`, `jackal_exp_rat_bound`,
-`jackal_ln_rat_bound`, `jackal_sin_rat_bound`, `jackal_cos_rat_bound`,
-`jackal_atan_rat_bound`, `jackal_tanh_rat_bound`, `jackal_verify_receipt`),
-twenty-one weaker-lane adapters — the seven numeric lanes
-(`jackal_exact`, `jackal_evaluate`, `jackal_diff`, `jackal_integrate`,
-`jackal_integrate_adaptive`, `jackal_integrate_bound`, `jackal_solve`) and
-the fourteen exact-CAS lanes (`jackal_canon`, `jackal_poly_canon`,
-`jackal_poly_eq`, `jackal_poly_gcd`, `jackal_ratfunc_canon`,
-`jackal_roots_isolate`, `jackal_alg_sign`, `jackal_alg_cmp`, `jackal_xgcd`,
-`jackal_mod_pow`, `jackal_mod_inv`, `jackal_crt`, `jackal_divides`,
-`jackal_prime_cert`) — plus the two v1.6.0 claim-kernel front doors
-(`jackal_claim`, `jackal_verify_bundle`) —
-that thread through the same pinned engine and return the engine's
-honest inventory-derived class with `formal: false` — status inflation
-is structurally impossible.  See `plugin/hermes/README.md` for the full
-refusal-class table.
+`jackal_sqrt_rat_bound`, `jackal_exp_rat_bound`, `jackal_ln_rat_bound`,
+`jackal_sin_rat_bound`, `jackal_cos_rat_bound`, `jackal_atan_rat_bound`,
+`jackal_tanh_rat_bound`, `jackal_verify_receipt`); twenty-one weaker-lane
+adapters — seven numeric and fourteen exact-CAS tools; two v1.6.0 claim-kernel
+front doors (`jackal_claim`, `jackal_verify_bundle`); four domain-pack tools
+(`jackal_test_exists`, `jackal_claim_cites_test`, `jackal_decision_rank`,
+`jackal_decision_rank_v2`); and three program tools
+(`jackal_anubis_check_program`, `jackal_anubis_verify_program`,
+`jackal_anubis_verify_program_receipt`).
+
+Domain-pack structural results stay consequence-capped at `informational`;
+decision results stay capped at `decision-boundary`. Program success is only
+`verified-program-evidence` / `verified-program-receipt` under
+`inventory-safe-v1`, with policy-construct-totality, source-to-VC, SMT-to-CNF,
+source-native, runtime, and universal-soundness residuals preserved. See
+`plugin/hermes/README.md` for the full refusal-class table.
 
 
 ## 5d. Claim bundles — composing lanes into replayable evidence graphs

PROVENANCE.md

@@ -8,6 +8,138 @@ measurement stated as failed rather than papered over.
 source → compiler pin → deterministic build → binary hash → gate receipts → adjudication
 ```
 
+<!-- JACKAL_CURRENT_SURFACE_V1_BEGIN -->
+The v1.7.3 release binds an ordered 41-tool surface through
+`release/capability_inventory_v1.json`. The package identity is recorded in
+`release/evidence/package_alignment_v173_release.json`; the annotated tag,
+GitHub asset, and read-back receipt must match those exact bytes.
+<!-- JACKAL_CURRENT_SURFACE_V1_END -->
+
+## v1.7.3 — unified domain-pack and Anubis program evidence — 2026-08-20 to 2026-08-22
+
+This release line starts from merged PR #11 commit
+`73854110cb82d78b2843d5028e1e0d5970b0ad5a`; `git show --stat` on that
+commit names the W3/W4/W6/W10 merge. The new program accept conditions and
+domain-pack compatibility minimum were initially held for architect review;
+the approval is recorded in
+`release/evidence/architect_release_authorization_v173.json` before
+merge/tag/publication.
+
+### Surface and trust contract
+
+`python3 tools/profile_verify.py` observed:
+
+```text
+core=3
+formal=13
+full=41
+profile_verification=verified tools_declared=41 nesting=core<=formal<=full OK
+```
+
+The three additive tools are `jackal_anubis_check_program`,
+`jackal_anubis_verify_program`, and
+`jackal_anubis_verify_program_receipt`. Success vocabulary is limited to
+`verified-program-evidence` / `verified-program-receipt`.
+
+The prototype profile name `contracted-safe-v1` was not inherited. The v3
+producer exports a producer-attested whole-function inventory but no
+independently checkable construct-total walker coverage. The shipped release
+therefore uses `inventory-safe-v1` and records
+`policy-construct-totality-not-established`, plus open source-to-VC,
+SMT-to-CNF, source-native, runtime, and universal-soundness boundaries.
+
+The caller pins source, compiler, artifact, and policy identities. Only Safe
+mode, one source leaf, the exact twelve-stage and six-consumer rosters, nonzero
+one-to-one proof paths, approved Z3 UNSAT, and independent RUP replay are
+admitted. No program-verifier command executes the compiled artifact.
+
+The domain-pack manifests now declare
+`v1.7.3 <= release < v2.0.0`; their self-digests and the registry self-digest
+were regenerated from bytes. `python3 -I -S -B tools/domain_pack_verify.py
+--root .` returned `status=accepted`, `pack_count=3`, and
+`operation_count=5`. The release manifest independently pins the registry,
+pack verifier, and three operation checkers.
+
+### Package receipts
+
+Two independent invocations of `release/build_package_v173.sh --build`, each
+with its own absolute `JACKAL_DIST`, produced byte-identical tarballs; `cmp`
+exited 0:
+
+The producing source was the clean commit
+`aaf7058ce98bf84ecd7b587f1ffff5f6a923f878` (tree
+`e5f02743d121acbc1d9128d6c3ceaaf81542d583`). This provenance record is a
+later derived checkpoint and is not represented as the commit that produced
+the package.
+
+```text
+basename            jackal-v1.7.3-macos-arm64.tar.gz
+sha256              68b0e7850fcb60358633908f70ffcf405cbbef103b04d3d93dd1298789e505ae
+bytes               158363786
+files               106
+extracted-file-bytes 555511970
+SHA256SUMS sha256    a78fc05e2ebd56f31263d54ccdbf7fcc2ff92d270758720c3e235d5a3121568a
+```
+
+Tar member file bytes and fresh-extraction file bytes independently summed to
+`555511970`. `tests/package_unified_v173_test.py` checks exact checksum
+inventory, extra/missing/tampered-file controls, missing-pack isolation,
+declared-but-unreachable program-tool refusal, stale source/binary refusal,
+profile/catalog parity, and the selected release window.
+
+The repaired canonical parity gate targeted `build_package_v173.sh`, not the
+superseded v1.7.0 builder:
+
+```text
+python3 -B tests/claim_package_parity_test.py
+CLAIM_PACKAGE_PARITY_PASS rows=60 failures=0
+```
+
+Its mutation test points the instrument back at
+`build_package_v170.sh` and observes `superseded-builder`.
+
+### COVENANT replay
+
+Caller-selected COVENANT source bytes:
+
+```text
+source sha256       037f63a2b2ca72d29a74503db09d5a0d1e0d4fb84a0cd778226751f22acb83ad
+compiler sha256     0d6a8f89355eb9ec5971749daf943567c204ed9f2d3001edbd46599f4540d7d6
+artifact sha256     e10f5550344c2e002e08139b4a1658d9151ccb707ddcb4adc6dfd73a31c555ff
+receipt sha256      8341ec180add6475f193f47e218b7af88fe2ef6437474c92ede4dfe1ecc02423
+proof objects       9
+RUP additions       615
+```
+
+Repository CLI, repository plugin, fresh-package CLI, and fresh-package plugin
+all returned the bounded program success status. Receipt replay returned
+`verified-program-receipt`. An assurance edit with a recomputed outer digest
+returned `receipt-semantic-mismatch`; pristine replay then returned
+`verified-program-receipt` again. The structured record is
+`release/evidence/anubis_program_dogfood_v1.json`.
+
+### Plugin and evaluation receipts
+
+The candidate Codex plugin pins the package and complete `SHA256SUMS`. A fresh isolated
+Codex install observed 41 registered tools; exact, formal, refusal, claim
+bundle, and formal-receipt gates returned their bounded expected statuses. A
+second fresh MCP process replayed the program receipt and refused its semantic
+tamper. The candidate-wrapper aggregate is
+`c69610183dd207fe8c476e686554f51454b83d96815ad63bea0e4f39dbadf0ac`;
+it is the SHA-256 of the generated eight-row
+`plugins/jackel/PLUGIN_IDENTITY.sha256` for this candidate, not an identity
+from the public default branch.
+
+Live transcript-bearing Codex sessions attempted the W3/W10 tools, but the
+noninteractive host cancelled every MCP call, including with
+`approval_policy=never`. `evals/v2/runner.py` still does not invoke a model or
+emit profile identity, and no adapter converts Codex JSONL events into
+protocol-admissible autonomous rows. `tools/eval_v2_gate.py` therefore returned
+`EVAL_V2_GATE_NOT_MEASURABLE` exit 3; this is not a pass and no JACKAL accuracy
+claim is made.
+
+---
+
 ## Branch record — `feat/domain-pack-protocol`, 2026-08-19 — UNSEALED — domain-pack protocol: programming-status and decision packs + the `lcm`/`gcd` epistemic-class repair
 
 **This is not a seal.** No package was built, no binary was produced, and no

README.md

@@ -12,6 +12,14 @@ plausible.
 for Apple Silicon macOS, or build from source with an Anubis compiler), first commands, and
 how to read the trust labels. License: [MIT](LICENSE).
 
+<!-- JACKAL_CURRENT_SURFACE_V1_BEGIN -->
+**Current agent surface:** the v1.7.3 release exports an ordered 41-tool catalog
+whose schemas, profiles, status classes, dependencies, and host exposure are
+generated in `release/capability_inventory_v1.json`. The annotated `v1.7.3`
+tag, GitHub release, package receipt, and downloadable asset must bind the
+same exact release bytes.
+<!-- JACKAL_CURRENT_SURFACE_V1_END -->
+
 JACKAL is written in **Anubis Safe mode**. It does not try to win by adding another wall of
 buttons. It treats a serious calculation as a bounded scientific claim: value, units,
 uncertainty, method, assumptions, sensitivity, residual, non-claims, and a reproducible
@@ -159,7 +167,7 @@ checker on this machine** — recomputing the outer digest alone is not
 sufficient. The Hermes/MCP-style plugin (`plugin/hermes/jackal_hermes`) threads every
 call through the same shared validator, the same formal-status gate, the same
 pinned executables, and additionally bind the plugin's OWN bundle hash into the
-receipt via `identities.plugin_sha256`. The Hermes plugin exposes thirty-eight
+receipt via `identities.plugin_sha256`. The Hermes plugin exposes forty-one
 tools — eleven formal (`jackal_range_bound`, `jackal_gaussian_integral`,
 `jackal_integrate_bound_cert`,
 `jackal_sqrt_rat_bound`, `jackal_exp_rat_bound`, `jackal_ln_rat_bound`,
@@ -183,6 +191,19 @@ manifest-pinned independent checker over the emitted certificate so only an
 `ACCEPT` verdict returns success. A `test-exists-cert` is an exact statement
 about bytes and never evidence that the code under test is correct.
 
+The remaining three tools are the inventory-safe-v1 Anubis program-evidence
+lane: `jackal_anubis_check_program`, `jackal_anubis_verify_program`, and
+`jackal_anubis_verify_program_receipt`. They require caller-pinned
+source/compiler/artifact/policy identities, Safe mode, strict
+`anubis.program-evidence.v3` rosters, evidence-tree closure, approved Z3 UNSAT
+replay, and independent RUP replay. They never execute the compiled artifact
+and can emit only `verified-program-evidence` or
+`verified-program-receipt`. The policy binds a producer-attested whole-function
+inventory but does not establish construct-total walker coverage, so the
+receipt names `policy-construct-totality-not-established` alongside the open
+source-to-VC, SMT-to-CNF, source-native, runtime, and universal-soundness
+boundaries.
+
 The eleven-category A→B→A mutation harness (`tests/cert_mutations_11.py`)
 plus the receipt-semantic mutation harness (`tests/receipt_semantic_mutations.py`,
 42/42 including the two §487 audit locks for U+2028 parser-differential
@@ -614,10 +635,12 @@ The kernel is deliberately small and closed:
   revoked v1.7.0 receipts refuse. The claim kernel's own hull arithmetic
   still caps at `bounded`.
 
-Hermes exposes the kernel as two additive tools — `jackal_claim` and
-`jackal_verify_bundle` — alongside the 31 unchanged v1.5.0 tools (33 at
-the v1.6.0 seal; the v1.7.0 `jackal_integrate_bound_cert` brings the
-inventory to thirty-four).  Hostile controls
+The v1.7.3 release exposes one ordered 41-tool catalog across JACKAL,
+Hermes, and Codex. It includes the claim/bundle front doors, the current
+request-bound `jackal_integrate_bound_cert` lane, four domain-pack routes,
+and three caller-pinned Anubis program-evidence routes; the generated
+`release/capability_inventory_v1.json` is the count and schema authority.
+Hostile controls
 (108-row matrix: serialization, graph identity, laundering, units,
 consequence floors, freshness/replay, machine arithmetic, legacy
 compatibility, rendering), A→B→A tamper gates over the seven claim trust
@@ -639,7 +662,7 @@ never degrades to a weaker lane behind the caller's back. The protocol, its v1
 ceilings and its mandatory nonclaims are specified in
 [`domain_packs/PACK_SPEC.md`](domain_packs/PACK_SPEC.md) and bound by
 `domain_packs/registry_v1.json`; the declared compatibility window is
-`v1.8.0 <= release < v2.0.0`.
+`v1.7.3 <= release < v2.0.0`.
 
 One route ABI for every pack: