@kudzujs/core 0.16.17 → 0.16.18

package/MIGRATION_ROADMAP.md

@@ -57,7 +57,7 @@ Syntax compatibility does not mean reproducing React wholesale. Kudzu accepts th
 - stronger JavaScript failure resilience;
 - no remaining material large-route build-scaling weakness.
 
-The completed 0.9 plan defines the cross-framework comparison and release gate. The active application packet is `0.21.3` in the capability release plan below. Benchmark-only feature omission, unmatched accessibility, weighted scores that hide losses, and unrecorded environment differences do not count as proof.
+The completed 0.9 plan defines the cross-framework comparison and release gate. The active application packet is `0.21.4` in the capability release plan below. Benchmark-only feature omission, unmatched accessibility, weighted scores that hide losses, and unrecorded environment differences do not count as proof.
 
 ### 0.10.0 Through 0.21.x: Application Capability Release Train
 

package/README.md

@@ -14,7 +14,7 @@ Kudzu compiles ordinary React-shaped TypeScript and TSX into complete static HTM
 
 > Experimental `0.16.x`: the compiler API and supported TSX surface may change.
 
-**Latest release: 0.16.17 - Browser performance gates.** Kudzu now enforces maintained median budgets for keyed collections, bounded 10,000-item ranges, and enhanced navigation while preserving its existing lazy-load and long-session memory bounds. Read the [release notes](./RELEASES.md#01617---browser-performance-gates), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.16.17), or follow the [architecture packet](./docs/next-architecture/README.md).
+**Latest release: 0.16.18 - AI attribution integrity.** Kudzu's delivery harness now rejects successful-looking attempts that omit their raw attribution trace instead of counting them as zero-cost successes. No framework ranking is claimed; the production-shaped `0.21.4` comparison remains active. Read the [release notes](./RELEASES.md#01618---ai-attribution-integrity), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.16.18), or follow the [architecture packet](./docs/next-architecture/README.md).
 
 - [Documentation](https://kudzujs.cloud/docs)
 - [Installation guide](https://kudzujs.cloud/docs#install)

package/RELEASES.md

@@ -1,5 +1,37 @@
 # Kudzu Releases
 
+## 0.16.18 - AI Attribution Integrity
+
+Kudzu 0.16.18 makes the AI delivery evidence boundary fail closed before the
+production-shaped `0.21.4` comparison.
+
+### Changed in 0.16.18
+
+- Requires a recorded raw attribution trace before an AI delivery attempt can
+  count as a success, even when its adapter, build, and acceptance all pass.
+- Retains missing-trace attempts as incomplete failures and reports zero
+  successes instead of synthetic zero-token, zero-cost successes.
+- Keeps per-success token and monetary claims unavailable when no attributable
+  success exists.
+- Adds a focused exit-zero/no-trace regression while preserving the existing
+  paired success/failure and tooling-comparison checks.
+- Records the production corpus boundary: existing complete applications cover
+  content, forms, CRUD/shared state, and resource ownership, while the pinned
+  public commerce comparator remains the smallest complete paired source.
+- Claims no framework ranking and leaves `0.21.4` active until five attempts per
+  framework and task pass the complete behavior, accessibility, build, browser,
+  output, maintainability, and retained-performance contract.
+- Adds one harness condition and no semantic primitive, compiler pass, runtime
+  concept, application API, dependency, or application browser byte.
+- Updates `create-kudzu@0.1.143` to generate projects on
+  `@kudzujs/core@^0.16.18`.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.16.18
+```
+
 ## 0.16.17 - Browser Performance Gates
 
 Kudzu 0.16.17 turns existing browser performance and memory evidence into

package/docs/next-architecture/README.md

@@ -15,7 +15,7 @@ The completed `0.9.0` milestone is recorded in [`0.9-semantic-compression.md`](.
 
 [`1.0-large-application-compatibility-audit.md`](./1.0-large-application-compatibility-audit.md) records the first post-0.9 probes against Memos, Apache Answer, and Actual Budget. The audit finds that reduced slices build but whole-application source retention and behavior parity do not yet pass.
 
-[`application-capability-release-plan.md`](./application-capability-release-plan.md) is the authoritative post-0.9 execution queue, currently at `0.21.3`. It assigns one application-capability section to each minor release and one independently accepted evidence packet to each patch release from `0.10.0` through the `1.0.0` gate. It supersedes the provisional 0.10/0.11/0.12 tool-first ordering in the completed 0.9 handoff without rewriting that historical record.
+[`application-capability-release-plan.md`](./application-capability-release-plan.md) is the authoritative post-0.9 execution queue, currently at `0.21.4`. It assigns one application-capability section to each minor release and one independently accepted evidence packet to each patch release from `0.10.0` through the `1.0.0` gate. It supersedes the provisional 0.10/0.11/0.12 tool-first ordering in the completed 0.9 handoff without rewriting that historical record.
 
 ## Required Invariants
 

package/docs/next-architecture/application-capability-release-plan.md

@@ -2069,7 +2069,7 @@ and browser bytes change by zero. Exact samples and limitations are recorded in
 - **Stop condition:** version metadata changes before the exact candidate passes.
 - **Done condition:** the reviewed commit is independently publishable.
 
-**Candidate evidence:** accepted as `@kudzujs/core@0.16.17` and
+**Result:** released as `@kudzujs/core@0.16.17` and
 `create-kudzu@0.1.142`. The exact versioned tree passes `npm run check`, all 301
 remaining tests after the application contract, package smoke, generator
 creation, and both registry dry runs. Tarball inspection records the expected 85
@@ -2091,6 +2091,13 @@ rollback contract remains forward-only: a failed push, tag, publication, or
 registry verification keeps this packet active; a published npm version or tag
 is never moved and requires a forward-fix patch.
 
+Commit `e9b33c04a7a2a382b858069910e4473800e7b70a`, tag `v0.16.17`, the
+[GitHub release](https://github.com/kudzujs/kudzu/releases/tag/v0.16.17), and
+[publish workflow](https://github.com/kudzujs/kudzu/actions/runs/33704726784)
+are complete. npm exposes core `0.16.17` and generator `0.1.142`; a fresh
+registry-generated application resolves core `0.16.17` and passes its complete
+TypeScript and Kudzu build check.
+
 ### `0.21.4`: AI Delivery Proof
 
 - **Purpose:** run the final equal-condition comparison on production-shaped
@@ -2102,6 +2109,25 @@ is never moved and requires a forward-fix patch.
 - **Done condition:** the evidence either authorizes `1.0.0` or names the next
   measured blocker without changing the release criteria.
 
+The first independently reviewable evidence-integrity prerequisite is released
+as `@kudzujs/core@0.16.18`. A successful adapter result without its raw
+attribution trace previously remained eligible for the success-rate and median
+successful-cost denominators with synthetic zero metrics. The runner now
+requires the trace in the success predicate, retains that attempt as an
+incomplete failure, and withholds unsupported per-success claims. The focused
+three-test harness passes and the change adds one condition with no semantic
+primitive, compiler pass, runtime concept, application API, dependency, or
+application browser byte.
+
+This prerequisite makes no framework ranking. Existing complete fixtures cover
+the content, forms, CRUD/shared-state, and resource/realtime task classes. The
+pinned public `kudzu-based-bench` storefront at commit
+`f2d5be1a516c539e30f7125f6870d42b1dd02ecd` remains the smallest complete paired
+commerce source. The next exact action is to freeze equivalent pre-task starters
+and complete acceptance journeys for those five classes, then run at least five
+interleaved attempts per framework and task under one model, tool, context, and
+time contract.
+
 ## `1.0.0`: Stable Application Model
 
 `1.0.0` is authorized only after every required `0.21.x` gate passes. It means:
@@ -2246,4 +2272,5 @@ release transaction where possible or document and publish a forward-fix patch.
 | `0.21.0` | Closed by existing semantics | Preserve the complete browser parity matrix, large-list keyboard/release acceptance, and static exclusion controls. | No production change; no release consumed |
 | `0.21.1` | Released as `0.16.16` | Preserve 100/1,000/10,000-route phase, RSS, output, digest, incremental-equivalence, recovery, and bounded canonical-AST retention evidence. | Full 10,000-route report has one complete measured run after two measured-stage diagnostics; no projection used |
 | `0.21.2` | Closed by existing semantics | Preserve initial/session/lazy bytes, keyed/range/navigation median alarms, and bounded endurance ownership evidence. | Same-revision absolute gates; structural artifact bytes are not compressed network transfer |
-| `0.21.3` | Candidate accepted as `0.16.17` | Complete the immutable release transaction, then advance to `0.21.4`. | One initial navigation benchmark invocation stalled at the outer timeout; its clean seven-profile rerun passed all alarms |
+| `0.21.3` | Released as `0.16.17` | Preserve exact package, browser, benchmark, registry, and fresh-install evidence. | One initial navigation benchmark invocation stalled at the outer timeout; its clean seven-profile rerun passed all alarms |
+| `0.21.4` | Active; attribution prerequisite released as `0.16.18` | Freeze paired production starters and complete acceptance for the five required task classes, then run at least five interleaved attempts per framework and task. | No local complete React + Vite starter set; derive four pairs from maintained complete fixtures and pin the public commerce pair |

package/docs/next-architecture/compiler-current-architecture.md

@@ -1,6 +1,6 @@
 # Current Compiler Architecture
 
-This maps the current `0.16.17` architecture, built on the completed `0.9.0` semantic-compression release and `0.8.23` Goal A compiler foundation. The active application packet is `0.21.3`; file and function names are the stable references, while line numbers are intentionally omitted because later work may still move code.
+This maps the current `0.16.18` architecture, built on the completed `0.9.0` semantic-compression release and `0.8.23` Goal A compiler foundation. The active application packet is `0.21.4`; file and function names are the stable references, while line numbers are intentionally omitted because later work may still move code.
 
 ## Responsibility Map
 

package/docs/next-architecture/large-application-ai-native-roadmap.md

@@ -2,9 +2,9 @@
 
 ## Status
 
-Completed compiler-foundation record and longer-term plan after `0.8.35`. The [`0.9-semantic-compression.md`](./0.9-semantic-compression.md) execution queue is complete. The active queue for current work is [`application-capability-release-plan.md`](./application-capability-release-plan.md) at packet `0.21.3`. This document does not mark any remaining planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
+Completed compiler-foundation record and longer-term plan after `0.8.35`. The [`0.9-semantic-compression.md`](./0.9-semantic-compression.md) execution queue is complete. The active queue for current work is [`application-capability-release-plan.md`](./application-capability-release-plan.md) at packet `0.21.4`. This document does not mark any remaining planned capability as supported and does not authorize a React runtime, VDOM, hydration, retained browser component tree, generic rerenderer, public store/query/resource API, SPA router, or islands.
 
-[`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains the product authority for product invariants and fixture-driven feature selection. [`application-capability-release-plan.md`](./application-capability-release-plan.md) is authoritative for current work order and evidence at packet `0.21.3`; this plan retains the completed foundation, deferred program, and long-term production gates. If implementation evidence changes either boundary, update the relevant document before broadening a patch.
+[`MIGRATION_ROADMAP.md`](../../MIGRATION_ROADMAP.md) remains the product authority for product invariants and fixture-driven feature selection. [`application-capability-release-plan.md`](./application-capability-release-plan.md) is authoritative for current work order and evidence at packet `0.21.4`; this plan retains the completed foundation, deferred program, and long-term production gates. If implementation evidence changes either boundary, update the relevant document before broadening a patch.
 
 ## Product Outcome
 
@@ -483,4 +483,4 @@ The first comparison is Kudzu versus React + Vite using the same agent, model, t
 
 ## Immediate Decision
 
-All listed foundation and `0.9` slices are complete. Current work continues at `0.21.3` package and release candidate proof under the [`application-capability-release-plan.md`](./application-capability-release-plan.md); keep ResourceIR limited to qualifying independent fixtures, and do not add range ownership, virtualization, optimistic transactions, a public adapter/store API, or a router before evidence justifies them.
+All listed foundation and `0.9` slices are complete. Current work continues at `0.21.4` AI delivery proof under the [`application-capability-release-plan.md`](./application-capability-release-plan.md); keep ResourceIR limited to qualifying independent fixtures, and do not add range ownership, virtualization, optimistic transactions, a public adapter/store API, or a router before evidence justifies them.

package/docs/next-architecture/versioning.md

@@ -1,6 +1,6 @@
 # Planned Version Sequence
 
-This is an execution sequence, not release history. `0.8.16` through `0.8.62` are completed scopes represented by package/release records. The `0.10.0` through `1.0.0` minor/patch sequence is maintained in [`application-capability-release-plan.md`](./application-capability-release-plan.md), currently at `0.21.3`; that plan supersedes the provisional tool-first 0.10/0.11/0.12 ordering in the completed 0.9 handoff.
+This is an execution sequence, not release history. `0.8.16` through `0.8.62` are completed scopes represented by package/release records. The `0.10.0` through `1.0.0` minor/patch sequence is maintained in [`application-capability-release-plan.md`](./application-capability-release-plan.md), currently at `0.21.4`; that plan supersedes the provisional tool-first 0.10/0.11/0.12 ordering in the completed 0.9 handoff.
 
 Keep each patch behavior-preserving and independently reviewable. If a boundary proves inseparable, revise this plan before combining releases; do not silently broaden a patch.
 
@@ -66,7 +66,7 @@ Keep each patch behavior-preserving and independently reviewable. If a boundary
 
 ## Generator Versions
 
-`create-kudzu@0.1.142` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.16.17`.
+`create-kudzu@0.1.143` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.16.18`.
 
 ## Release Boundary
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kudzujs/core",
-  "version": "0.16.17",
+  "version": "0.16.18",
   "description": "HTML-first TSX framework with synchronous state semantics and no virtual DOM",
   "type": "module",
   "license": "MIT",