@thomasminh1995/depverdict 0.6.0-alpha.1

package/docs/decisions/diff-02-identity-compatibility-contract.md

@@ -0,0 +1,274 @@
+# DIFF-02 — Identity and Compatibility Contract
+
+- Status: Accepted for implementation
+- Date: 2026-07-19
+- Scope: `0.6.0-alpha.1`
+- Product identity: DepVerdict
+- Distribution identity: `@thomasminh1995/depverdict`
+- Canonical executable: `depverdict`
+
+## Context
+
+UpgradeLens `v0.5.0` established the current evidence formats, workflow semantics,
+and historical release record. The next preview changes the product and
+distribution identity to DepVerdict without invalidating those artifacts or
+silently changing their meaning.
+
+This decision is intentionally narrower than the later repository,
+documentation, and community migration. The repository remains
+`thomasMinh1995/UpgradeLens` during DIFF-02. Existing tags, especially `v0.5.0`,
+and existing review or qualification records remain historical facts and are
+not rewritten.
+
+## Accepted identity map
+
+| Surface | Canonical identity | Compatibility identity |
+| --- | --- | --- |
+| Product | DepVerdict | UpgradeLens in historical records |
+| Future repository | `thomasMinh1995/DepVerdict` | Current repository is not renamed here |
+| npm package | `@thomasminh1995/depverdict` | No second legacy package is introduced |
+| CLI | `depverdict` | `upgradelens`, deprecated for the `0.6.x` preview window |
+| Artifact root | `.depverdict/` | `.upgradelens/`, read-only fallback |
+| Environment prefix | `DEPVERDICT_*` | `UPGRADELENS_*`, deprecated fallback |
+| Preview version | `0.6.0-alpha.1` | `v0.5.0` remains immutable history |
+
+## 1. Package and executable contract
+
+The package name becomes `@thomasminh1995/depverdict`, and its version becomes
+`0.6.0-alpha.1`. The package exposes two executable entries:
+
+- `depverdict` is the canonical executable.
+- `upgradelens` is a thin compatibility wrapper that invokes the same command
+  dispatcher with an explicit legacy invocation identity.
+
+Both executables must produce the same exit codes, stdout payloads, and
+artifacts for the same command and inputs. The only permitted difference is a
+bounded deprecation diagnostic on stderr from the legacy executable. The
+diagnostic is emitted at most once per process and must not contain secrets.
+
+The alias remains through the `0.6.x` preview compatibility window. Its removal
+requires a separate decision and release note; this implementation does not
+silently remove it.
+
+The npm preview publication itself is outside DIFF-02. When publication is
+authorized later, it must use the `preview` dist-tag rather than `latest`.
+
+## 2. Runtime product presentation
+
+New runtime presentation uses DepVerdict:
+
+- help and version banners;
+- user-agent strings;
+- decision-first outcome headings;
+- runtime remediation text and command examples.
+
+Historical persisted names are not presentation strings. They remain unchanged
+where they participate in existing schema contracts.
+
+## 3. Persisted schema compatibility
+
+Existing artifact schemas, schema versions, reason codes, prompt versions,
+policy versions, and provider qualification identities remain unchanged.
+
+In particular, existing schemas require `generator.name` to equal
+`"UpgradeLens"`. New `0.6.0-alpha.1` artifacts therefore continue to write that
+value as a compatibility protocol identifier. The runtime product name
+`DepVerdict` is separate from this persisted protocol identifier.
+
+The existing internal version-analysis schema name
+`upgradelens_version_analysis` also remains unchanged because it participates in
+provider request and qualification compatibility.
+
+This separation prevents a brand change from masquerading as an evidence-format
+or provider-contract migration.
+
+## 4. Artifact write-root contract
+
+All implicit/default writes use `.depverdict/`.
+
+An explicit output path supplied by the caller remains authoritative. The
+runtime must not rewrite, relocate, copy, or delete explicitly addressed
+artifacts.
+
+The legacy `.upgradelens/` directory remains ignored by discovery alongside
+`.depverdict/`. This prevents either generated tree from affecting project
+analysis.
+
+## 5. Legacy artifact read contract
+
+Automatic compatibility reads use a whole-chain selection rule:
+
+1. If every required canonical artifact exists, use the canonical chain.
+2. If the canonical chain is complete and legacy artifacts also exist, use the
+   canonical chain and emit one bounded `LEGACY_ARTIFACT_ROOT_IGNORED`
+   diagnostic.
+3. If no canonical member exists and every required legacy artifact exists, use
+   the legacy chain and emit one bounded `LEGACY_ARTIFACT_ROOT_USED`
+   diagnostic.
+4. If both roots contain members but the canonical chain is incomplete, or the
+   only available inputs form a split/partial chain, fail closed with
+   `ARTIFACT_ROOT_CONFLICT`.
+5. If neither root contains a member, select canonical paths so the established
+   missing-input behavior remains authoritative.
+
+The resolver never combines artifacts from both roots. It never judges
+lineage by timestamps and never repairs a chain by copying files.
+
+Explicit input paths bypass automatic root selection. An explicitly selected
+legacy path is allowed because caller intent is unambiguous.
+
+## 6. Stage-boundary behavior
+
+Automatic root selection is applied at input boundaries that consume persisted
+workflow state, including:
+
+- research manifest loading;
+- version-analysis manifest, knowledge manifest, and evidence-bundle loading;
+- migration-checklist workflow input loading;
+- default migration-qualification resolution.
+
+Each boundary declares its complete required input set. A downstream stage must
+not fill missing canonical members from legacy storage.
+
+A standalone stage may read a complete legacy input set and write its output to
+the canonical default root. That does not grant later stages permission to
+merge the roots. The caller must regenerate a complete canonical chain or use
+explicit input paths.
+
+## 7. Environment compatibility contract
+
+Supported canonical variables are:
+
+- `DEPVERDICT_AI_PROVIDER`
+- `DEPVERDICT_AI_ENDPOINT`
+- `DEPVERDICT_AI_MODEL`
+- `DEPVERDICT_AI_AUTHORIZATION`
+- `DEPVERDICT_AI_TIMEOUT_MS`
+- `DEPVERDICT_AI_TIMEOUT_SECONDS`
+- `DEPVERDICT_AI_MAX_RESPONSE_BYTES`
+- `DEPVERDICT_AI_DEBUG`
+
+Each maps one-to-one to the corresponding `UPGRADELENS_*` legacy variable.
+
+Resolution precedence is:
+
+1. explicit programmatic or CLI override;
+2. canonical `DEPVERDICT_*` environment variable;
+3. legacy `UPGRADELENS_*` environment variable;
+4. established default.
+
+When both mapped environment variables are present, the canonical value wins.
+The runtime emits one bounded conflict diagnostic naming variable keys only.
+When only a legacy variable is used, the runtime emits one bounded deprecation
+diagnostic naming the key only.
+
+Diagnostics must never print values. This is mandatory for
+`*_AUTHORIZATION` and applies uniformly to every mapping. Unknown variables
+under either prefix are ignored.
+
+Injected environment objects are closed worlds: passing `{}` must not fall
+through to `process.env`.
+
+## 8. Diagnostic contract
+
+Compatibility diagnostics go to stderr and never alter structured stdout.
+Diagnostic emission is bounded within one invocation:
+
+- one legacy-executable warning;
+- at most one warning per mapped environment key;
+- at most one artifact-root diagnostic per resolved input chain.
+
+Diagnostics contain stable codes where programmatic interpretation is useful
+and do not include absolute paths, environment values, authorization material,
+or artifact contents.
+
+## 9. Programmatic API contract
+
+Existing public exports remain stable for this preview. Compatibility helpers
+are internal implementation details unless separately promoted through a
+future public-API decision.
+
+Programmatic calls to `runCli` default to canonical invocation identity and do
+not receive a legacy-executable warning. Tests and embedders may explicitly
+provide invocation identity and isolated diagnostic state.
+
+Existing loader return shapes and validation behavior remain unchanged except
+for the documented automatic selection of a complete legacy artifact chain.
+
+## 10. Qualification and evidence contract
+
+Provider qualification does not become valid merely because the product was
+renamed. The existing provider, endpoint, model, schema, prompt, policy, and
+test-vector identity fields remain the qualification authority.
+
+For an implicit default qualification path, canonical storage wins and a
+complete legacy record may be used as fallback. An explicit qualification path
+never falls back elsewhere. A malformed or mismatched selected record fails
+closed; the resolver does not search another root for a more favorable answer.
+
+## 11. Packaging and CI contract
+
+The package-content guard must inspect the actual packed tarball and require
+both executable files. Existing protections against captures, credentials,
+local artifacts, and repository-only material remain active.
+
+Package smoke verification must install the packed scoped package, invoke both
+executables, verify canonical programmatic import, and confirm:
+
+- canonical help/version output presents DepVerdict;
+- the canonical executable has clean stderr for ordinary help/version calls;
+- the legacy executable emits only its bounded warning;
+- package export shape remains compatible;
+- no publish or registry mutation occurs.
+
+Hosted CI keeps read-only permissions, tests supported Node versions, and
+sanitizes both canonical and legacy environment prefixes.
+
+No repository rename, tag creation, commit, push, npm publish, or dist-tag
+mutation is authorized by this decision.
+
+## 12. Brand preflight
+
+The required pre-implementation preflight ran at `2026-07-19T08:05:34Z`.
+Exact-name checks found no direct collision for DepVerdict on npm, GitHub
+repository search, PyPI, RubyGems, or the local executable path. General web
+queries also returned no exact software or company result.
+
+Crates.io returned an access denial, and unauthenticated GitHub code search was
+unavailable, so those checks are recorded as unverified rather than clear.
+Domain RDAP responses are only weak availability signals.
+
+Classification: `BRAND_PREFLIGHT_CLEAR_WITH_LOW_RISK`.
+
+This classification is time-sensitive, is not a reservation, and is not a
+legal or trademark clearance.
+
+## 13. Legacy compatibility removal criteria
+
+The legacy CLI, environment mappings, and artifact fallback may be removed only
+after all of the following are true:
+
+- the complete `0.6.x` preview compatibility window has shipped;
+- canonical CLI, environment, and artifact-root usage is documented in the
+  repository/community migration;
+- telemetry-free evidence available to the project, such as issue reports and
+  preview feedback, reveals no unresolved Blocker or High migration defect;
+- removal is announced in release notes before or with the removing release;
+- the removing release includes an explicit breaking-change decision, focused
+  tests, and migration guidance;
+- historical `.upgradelens/` artifacts remain readable by a documented retained
+  release even if a future major removes automatic fallback.
+
+Calendar time alone is not a removal criterion. DIFF-02 does not authorize the
+removal.
+
+## Consequences
+
+DepVerdict becomes the only canonical identity for new runtime use while one
+bounded compatibility window protects existing automation and persisted
+evidence. The implementation accepts some deliberate dual naming internally:
+DepVerdict for the product, and UpgradeLens for unchanged artifact protocols.
+
+Repository naming, broad documentation replacement, community-template
+migration, release publication, and removal scheduling remain work for later
+gates.

package/docs/decisions/diff-03-repository-docs-community-migration.md

@@ -0,0 +1,165 @@
+# DIFF-03 — Repository, Documentation, and Community Identity Migration
+
+- Status: Accepted for implementation
+- Date: 2026-07-19
+- Scope: `0.6.0-alpha.1`
+- Product identity: DepVerdict
+- Repository at the DIFF-03 implementation checkpoint: `thomasMinh1995/UpgradeLens`
+- Current canonical repository: `thomasMinh1995/DepVerdict`
+- Post-rename status updated: 2026-07-19
+
+## Context and two-phase boundary
+
+DIFF-02 established the DepVerdict package, executable, artifact-root, and
+environment identities. DIFF-03 originally made the repository experience use
+that identity before the separate GitHub rename. The rename has since completed:
+`https://github.com/thomasMinh1995/DepVerdict` is canonical. The former URL is
+retained only as historical truth, migration explanation, and a redirect
+compatibility aid. npm publication, runtime compatibility, and historical evidence
+remain separate boundaries.
+
+## 1. Normative and historical ownership
+
+Each old-name reference is assigned one ownership class before editing:
+
+| Class | Ownership and migration rule |
+| --- | --- |
+| `CURRENT_NORMATIVE` | Describes the current product or contributor workflow; migrate to DepVerdict. |
+| `CURRENT_COMPATIBILITY_DOCUMENTATION` | Keep the old identity only while explaining the bounded `0.6.x` compatibility window. |
+| `HISTORICAL_RECORD` | Preserve the name, command, version, path, URL, and result that were true when the record was produced. |
+| `VERSIONED_ARCHITECTURE_RECORD` | Preserve when it defines a completed version or milestone; current operational documents may receive a narrowly scoped migration note or canonical example update. |
+| `TEST_FIXTURE_ASSERTION` | Preserve when it protects schema, protocol, compatibility, or historical behavior. |
+| `RUNTIME_IDENTITY_ALREADY_MIGRATED` | Do not change except to keep current documentation and checks aligned with DIFF-02. |
+| `EXTERNAL_PROJECT_REFERENCE` | Preserve the external project's actual identity and comparison evidence. |
+| `UNRELATED_TEXT` | Leave unchanged. |
+
+Current normative owners include the root README and community policies, current
+issue and pull-request templates, current operational documentation, the current
+Technical Preview sample, package-facing metadata, and workflow presentation.
+Milestone reports under `docs/reviews/`, RR/MP/MVP/OSS reports, capture evidence,
+and `docs/releases/v0.5.0-technical-preview.md` remain historical records.
+
+## 2. Product-name migration rule
+
+Current prose uses **DepVerdict**. Canonical examples use:
+
+- package `@thomasminh1995/depverdict`;
+- executable `depverdict`;
+- artifact root `.depverdict/`;
+- environment prefix `DEPVERDICT_*`.
+
+The old executable, artifact root, and environment prefix appear in current
+material only to document compatibility or a verified transition route. The
+persisted protocol identifier `generator.name: "UpgradeLens"`, schema names,
+task IDs, reason codes, qualification identities, and old fixtures remain
+unchanged under the DIFF-02 compatibility contract.
+
+## 3. Live repository URL rule
+
+After the completed manual rename:
+
+- relative links remain preferred for repository files;
+- clone, issue, metadata, badge, and security URLs use the canonical
+  `thomasMinh1995/DepVerdict` route;
+- the former `thomasMinh1995/UpgradeLens` route may appear only in historical or
+  migration context.
+
+GitHub redirects are a continuity aid, not the permanent documentation strategy.
+
+## 4. Security advisory URL rule
+
+Vulnerability reports use:
+
+`https://github.com/thomasMinh1995/DepVerdict/security/advisories/new`
+
+This canonical private route remains in `SECURITY.md` and the issue-form
+configuration. No vulnerability report is routed through a public issue.
+
+## 5. Conduct contact strategy
+
+Decision: `KEEP_VERIFIED_LEGACY_CONTACT_FOR_ONE_PREVIEW`.
+
+`upgradelens.conduct@gmail.com` remains the verified private conduct channel for
+the DepVerdict community during the `0.6.x` preview transition. It is not described
+as deprecated because no replacement exists and has been tested. A maintainer may
+later create and verify a DepVerdict-named contact; documentation changes only
+after that channel is proven usable. No new email is invented by this migration.
+
+## 6. README, CLI, package, and installation contract
+
+The README must:
+
+- identify DepVerdict as a decision-first CLI for evidence-bounded dependency
+  upgrade analysis and visibly label it Public Technical Preview / Alpha;
+- distinguish target availability from a recommendation;
+- show `depverdict analyze .`, `--offline`, `--fail-on-incomplete`, and exact
+  supported target-selector examples;
+- describe deterministic decisions, coverage-aware impact, evidence-bounded
+  handoff, and mandatory human review;
+- state that source is not modified and suggested verification commands are not
+  executed;
+- keep Migration Checklist experimental and opt-in;
+- explain model/provider qualification as identity-specific and describe offline
+  limitations.
+
+The planned npm command is
+`npm install -g @thomasminh1995/depverdict@preview`. It must remain explicitly
+pre-publication until distribution qualification confirms the preview exists.
+Source setup uses the canonical DepVerdict clone URL and
+`node ./bin/depverdict.js`.
+
+## 7. Legacy compatibility window
+
+The `upgradelens` executable, `.upgradelens/` read fallback, and
+`UPGRADELENS_*` environment fallback remain for one bounded `0.6.x` preview
+window. Canonical values win conflicts and legacy use warns without printing
+values. The migration guide must state that removal requires a separate decision
+and release note; the window is not an indefinite support promise.
+
+## 8. Release and version ownership
+
+`docs/releases/v0.5.0-technical-preview.md` remains an immutable UpgradeLens
+historical release record. The current preview is owned by
+`docs/releases/v0.6.0-alpha.1-depverdict-preview.md`. The new file is a release
+draft, does not claim npm availability or `latest`, and does not claim autonomous
+migration.
+
+## 9. Badge and workflow-link strategy
+
+Workflow display text uses DepVerdict. Any README workflow badge uses the
+canonical repository URL. No npm badge is shown until a preview package has
+actually been published. Hosted CI must be rerun at the exact post-remediation
+commit.
+
+## 10. Package boundary
+
+The migration guide, this decision, the current release draft, current operational
+documentation, and the DIFF-03 report are intentionally package-visible under the
+existing `docs` allowlist. Community `.github/` files and the repository-only
+sample remain excluded. Package guard required assets will include the current
+migration decision and guide without treating a total tarball file count as a
+business invariant.
+
+Generated `.depverdict/` and `.upgradelens/` trees, RR02 captures, credentials,
+environment files, duplicate/copy artifacts, and private qualification data remain
+forbidden package content.
+
+## 11. Post-rename manual checklist
+
+Post-rename status:
+
+1. GitHub repository rename, canonical origin, former-URL redirect, pull requests,
+   issues, Releases, Actions history, branch settings, and Private Vulnerability
+   Reporting were externally verified by DIFF-04.
+2. `package.json`, clone examples, advisory routes, current release/migration
+   status, and identity tests are remediated by DIFF-04-FIX.
+3. Historical GitHub Release presentation was remediated by the explicitly
+   approved DIFF-04-FIX live metadata edit.
+4. Identity checks, link checks, package guard, clean-install smoke, and hosted CI
+   must run on the exact post-remediation commit/configuration.
+
+The verified conduct address remains unchanged until a separately created
+DepVerdict address has been tested. Removal of the UpgradeLens compatibility
+identity requires the end of the documented preview window, usage review, a
+separate compatibility decision, release notes, passing canonical-only tests, and
+no remaining supported consumer dependency on the legacy interfaces.

package/docs/decisions/diff-04-release-evidence-gap-acceptance.md

@@ -0,0 +1,110 @@
+# DIFF-04 — Historical release evidence-gap acceptance
+
+- Status: `ACCEPTED`
+- Scope: one-time UpgradeLens-to-DepVerdict GitHub Release presentation repair
+- Baseline collected: 2026-07-19T10:42:43Z
+- Maintainer approval recorded: 2026-07-19T11:18:54Z
+- Canonical repository: `thomasMinh1995/DepVerdict`
+
+## Decision boundary
+
+A complete release-ID, state, timestamp, and asset inventory was not retained
+before the repository rename and release-title edits. That missing before-state
+cannot be recreated retrospectively and must not be described as proven.
+
+The retained evidence and current read-only checks support a bounded repair:
+
+- all five annotated remote tag objects and peeled commits match local refs;
+- the retained DIFF-01 snapshot independently proves continuity for the
+  `v0.5.0` tag object and peeled commit;
+- the retained DIFF-01 snapshot and current API agree on the `v0.5.0` published
+  timestamp and non-draft/non-prerelease state;
+- all five current releases have zero assets;
+- no evidence reviewed conflicts with the current tags or release targets.
+
+This record does **not** claim that assets never existed, never changed, or were
+never removed. It does **not** prove before-state release IDs, titles, bodies,
+states, timestamps, or assets where no retained evidence exists.
+
+## Invariant classification
+
+| Invariant | Classification | Evidence |
+| --- | --- | --- |
+| `v0.5.0` tag object and peeled target continuity | `PROVEN` | DIFF-01 retained object `4750606ca85f990ee69d60ab4673caca5fbfb89b` and target `74d57344db254d0109ea951dc7c44853cdad9be0`; current local and remote refs match. |
+| `v0.1.1`–`v0.4.0` current tag objects and peeled targets | `SUPPORTED_BY_CURRENT_STATE_ONLY` | Current local and remote refs match; no complete retained pre-rename ref inventory was found. |
+| `v0.5.0` published timestamp and draft/prerelease state | `PROVEN` | DIFF-01 and current GitHub API agree on `2026-07-19T02:56:50Z`, draft false, prerelease false. |
+| Earlier release IDs/states/timestamps before rename | `UNKNOWN_BEFORE_STATE` | Current API supplies values, but no complete retained before-state inventory was found. |
+| Release asset state before rename | `UNKNOWN_BEFORE_STATE` | No retained asset IDs, names, sizes, digests, or explicit zero-asset inventory was found. |
+| Current absence of release assets | `SUPPORTED_BY_CURRENT_STATE_ONLY` | Current GitHub API reports zero assets for all five releases. |
+| Conflicting tag/target/asset evidence | `SUPPORTED_BY_CURRENT_STATE_ONLY` | No conflict was found in retained records, Git history, current refs, or current API state. |
+
+## Maintainer acceptance
+
+The maintainer explicitly accepted both the five-release metadata plan and this
+bounded evidence-gap statement in the DIFF-04-FIX Codex task. Approval covered
+only the approved titles and bodies. No credential was included in or retained by
+the approval record.
+
+## Pre-edit release baseline
+
+This table is the mandatory baseline for all future release mutations. API
+`target_commitish` currently reports `main`; the immutable target values below are
+the peeled Git tag commits.
+
+| ID | Tag | Tag object | Peeled commit | Draft / prerelease | Created / published / updated (UTC) | Assets |
+| ---: | --- | --- | --- | --- | --- | ---: |
+| `353312307` | `v0.1.1` | `5716a6f8d00119d106487830c37b37957b171919` | `95cd3025c27d2c4d8e97f711625541ee0da7dbc0` | false / false | `2026-07-13T17:10:16Z` / `17:16:09Z` / `2026-07-19T10:08:01Z` | 0 |
+| `353747096` | `v0.2.0` | `2b82aae4ce49184175c2eb13a421610ca1c31a9a` | `411c9e6216d9476b48d72311c9163b2a563d1e60` | false / false | `2026-07-14T11:12:11Z` / `11:22:02Z` / `2026-07-19T10:08:52Z` | 0 |
+| `354822066` | `v0.3.0` | `4849f78a594f468cdcfa45151498168869685a55` | `8fea8ec5b06dd6c85a0f600be1d566d65ef2c7a2` | false / false | `2026-07-16T01:40:55Z` / `01:43:27Z` / `2026-07-19T10:09:10Z` | 0 |
+| `355150303` | `v0.4.0` | `6c7983000468d53704eeaf00bb9dd98c6d2e638a` | `734be0b9395b0bd74454badc010e4df237319cc3` | false / false | `2026-07-16T14:33:06Z` / `14:35:09Z` / `2026-07-19T10:09:31Z` | 0 |
+| `356244177` | `v0.5.0` | `4750606ca85f990ee69d60ab4673caca5fbfb89b` | `74d57344db254d0109ea951dc7c44853cdad9be0` | false / false | `2026-07-19T02:55:33Z` / `02:56:50Z` / `2026-07-19T09:43:20Z` | 0 |
+
+## Exact approved-operation candidate
+
+Every body receives this exact prefix:
+
+```markdown
+> **Project rename:** This release was originally published under the
+> **UpgradeLens** name. The project is now **DepVerdict**:
+> https://github.com/thomasMinh1995/DepVerdict
+>
+> This historical release remains associated with its original tag and commit.
+```
+
+After the prefix and one blank line, the current body is preserved with each
+body-local `DepVerdict` product-name token changed to `UpgradeLens`. No claim,
+section, tag, target, state, timestamp, or asset is otherwise changed.
+
+| ID / tag | Before title | Approved candidate title | Before body SHA-256 / bytes | Candidate body SHA-256 / bytes | Product-name replacements |
+| --- | --- | --- | --- | --- | ---: |
+| `353312307` / `v0.1.1` | `DepVerdict v0.1.1 — MVP-01 Project Discovery Foundation` | `UpgradeLens v0.1.1 — MVP-01 Project Discovery Foundation` | `72c80ae81fe4432ae5c5c19f5a88db7ed3ce114a879e763bb628c2758b0025dd` / 1963 | `17c9f1ece26eb1f6af20fb438b800d0cd74f3117aea979566ebb5b16b11c28e1` / 2227 | 6 |
+| `353747096` / `v0.2.0` | `DepVerdict v0.2.0 — Knowledge Research` | `UpgradeLens v0.2.0 — Knowledge Research` | `357a718be404db84510663d485a59d95a9670028f2be77b60de9900e6ecc3080` / 4319 | `32af0823ca8199a5c041b48ceb4b126d9a0cdec369128463f4da5e9d2d560411` / 4588 | 11 |
+| `354822066` / `v0.3.0` | `DepVerdict v0.3.0 — AI Version Analysis` | `UpgradeLens v0.3.0 — AI Version Analysis` | `6efaeca1fa7b38601e3cb1d1eee984740b36f7ae2da06093fb211f7815da2bfc` / 565 | `8b264cb667a555c392f9e688e49fbf91e8145beec19ef76d2b4edb5c1eef7262` / 823 | 0 |
+| `355150303` / `v0.4.0` | `DepVerdict v0.4.0 — Repository Impact Analytics` | `UpgradeLens v0.4.0 — Repository Impact Analytics` | `83a35b7972090f6d0e6a54db6026b605875430109071d3be56d8ef8aa89cd0a5` / 1075 | `b71c108f31b1cb31d331cb89bda5fd5aec8fa63ca857d3b86825cd69c3383ff3` / 1335 | 2 |
+| `356244177` / `v0.5.0` | `DepVerdict v0.5.0 — Evidence-Bounded Migration Planning` | `UpgradeLens v0.5.0 — Evidence-Bounded Migration Planning` | `e06386beb973627f65ab9190415eff7577e3da6f986e370eac96f68e2e0a2f44` / 731 | `0d556e775bff4c27e16b0090b1203d4d09567d0c3e3d8b28ce353cee16e54eba` / 990 | 1 |
+
+The maintainer approved these five release IDs, titles, body transformation, and
+the bounded evidence-gap statement. All five approved edits completed.
+
+## Post-edit release baseline
+
+Read-only GitHub API and remote-ref verification completed after the approved
+edits. Release ID, tag, `target_commitish`, annotated tag object, peeled commit,
+draft/prerelease state, created/published timestamps, and asset arrays are
+unchanged. GitHub changed the API-managed `updated_at` timestamp when each
+title/body changed; that field was not supplied in any PATCH payload.
+
+| ID / tag | Current title | Body SHA-256 | Updated at (UTC) | Assets |
+| --- | --- | --- | --- | ---: |
+| `353312307` / `v0.1.1` | `UpgradeLens v0.1.1 — MVP-01 Project Discovery Foundation` | `17c9f1ece26eb1f6af20fb438b800d0cd74f3117aea979566ebb5b16b11c28e1` | `2026-07-19T11:17:07Z` | 0 |
+| `353747096` / `v0.2.0` | `UpgradeLens v0.2.0 — Knowledge Research` | `32af0823ca8199a5c041b48ceb4b126d9a0cdec369128463f4da5e9d2d560411` | `2026-07-19T11:17:46Z` | 0 |
+| `354822066` / `v0.3.0` | `UpgradeLens v0.3.0 — AI Version Analysis` | `8b264cb667a555c392f9e688e49fbf91e8145beec19ef76d2b4edb5c1eef7262` | `2026-07-19T11:17:47Z` | 0 |
+| `355150303` / `v0.4.0` | `UpgradeLens v0.4.0 — Repository Impact Analytics` | `b71c108f31b1cb31d331cb89bda5fd5aec8fa63ca857d3b86825cd69c3383ff3` | `2026-07-19T11:17:48Z` | 0 |
+| `356244177` / `v0.5.0` | `UpgradeLens v0.5.0 — Evidence-Bounded Migration Planning` | `0d556e775bff4c27e16b0090b1203d4d09567d0c3e3d8b28ce353cee16e54eba` | `2026-07-19T11:17:48Z` | 0 |
+
+## Future mutation rule
+
+Before every future GitHub Release mutation, capture release ID, tag, tag object,
+peeled target, title/body digest, draft/prerelease state, timestamps, and complete
+asset ID/name/size/digest inventory. After the mutation, recapture and compare the
+same fields. Unexpected changes fail closed.