Prepare ProofTape 0.1.0-alpha.1 for independent review

[DelshadH]

Status

TECHNICALLY READY 0.1.0-alpha.1 RELEASE CANDIDATE; NOT AUTHORIZED FOR PUBLICATION.

This PR may be merged after its exact-head checks pass. Do not create a tag, GitHub release, or npm publication until the owner answers the final PUBLISH? YES / NO decision.

Exact revision and scope

• Reviewed head: 7109e8e63f4f204d18b74320a76acf5c0e506d1b
• Branch: codex/release-readiness-alpha1
• Target version: 0.1.0-alpha.1
• No tag, GitHub release, or registry publication has been created

ProofTape remains a narrow npm-dependency runtime comparison CLI. It records supported calls in exact base and candidate installs, emits bounded/versioned evidence, reports behavioral changes with stable exit codes, and can generate reproduction material. It does not establish observation authenticity and is not a filesystem or network sandbox.

Independent AI technical review

Fresh-context independent AI reviewers audited correctness, security, packaging, release controls, and adversarial behavior. Findings were adjudicated and remediated with regression tests. A final adversarial exact-head review at 7109e8e63f4f204d18b74320a76acf5c0e506d1b reports PASS: no actionable P0/P1 alpha-release blockers.

The final remediation includes fail-closed lexical attribution and CommonJS loader handling, exact module/replay identity, native ESM conditional-export replay, recorder write-failure handling, complete redaction/configuration binding, deterministic two-build release evidence, sanitized SBOMs, and exact reusable-workflow checkout identity. This is AI review, not represented as human approval.

Exact-head verification

Local:

npm run check                    22 files / 142 tests passed
npm run release:prepare          exact commit evidence prepared
npm run smoke:package            passed
npm run smoke:examples           passed
npm run corpus                   passed
npm run security                 0 vulnerabilities; policy/secret scan passed
git diff --check                 passed

Hosted:

• CI and release-candidate evidence: https://github.com/DelshadH/prooftape/actions/runs/30220240595
• CodeQL: https://github.com/DelshadH/prooftape/actions/runs/30220238822
• Hosted artifact: prooftape-0.1.0-alpha.1-rc-7109e8e63f4f204d18b74320a76acf5c0e506d1b

The downloaded hosted artifact manifest names the exact reviewed head, and all entries in SHA256SUMS were independently verified.

Package	Tarball SHA-256
@prooftape/schema	357d528b9d84a2bb1bd27586cc7a3a817ad174f50c55eddcb8933bf31990598e
@prooftape/core	0cc6e4f219fd2e2a4cd265f416a846e5541cd1a6bb194d0789b7b8bfb4c8c1be
@prooftape/hook	cdb09e211a6190dfe217667e3ea78fedbd5899f26dcf44f05807828da228d5b7
prooftape	b874ff03e8ad500143b27bb0ea61e938e902a16d77849b7d1ecd845e8f78aba1

Release boundary

The manual release workflow is exact-tag-bound to v0.1.0-alpha.1, tokenless/OIDC-based, least-privilege, and protected by the npm-release environment. It rebuilds and verifies release evidence before publishing with provenance.

Merging this PR is technical repository completion only. Publication remains explicitly withheld pending the owner’s final decision.