Release evidence
This page records the evidence-backed pilot baseline and the validation path toward external audit and production approval.
Evidence baseline
| Item | Value |
|---|---|
| Pilot version | 0.1.0-rc.1 |
| Release-gate baseline | 1b6a8d42a8f582a7563c7b9c65de5b72e15262d6 |
| Release-gate date | August 9, 2026 |
| Implementation status baseline | e4eb993a041fea7012e3e0e28c5db21b4a05eb17 |
| Status review date | August 15, 2026 |
| Execution boundary | Non-production sandbox |
| Working tree at baseline | Clean |
The baseline release gate recorded exact JavaScript dependency installation, Rust formatting and strict linting, the full Rust test suite, console and pilot script tests, deterministic browser-bundle rebuilds, secret scanning, locked release builds, build metadata, and SHA-256 checksums.
Dependency hygiene runs as a separate CI job. External dependency review and security audit remain dedicated production-readiness gates.
The August 15 implementation evidence report updates the whitepaper-to-code
status review against commit e4eb993a041fea7012e3e0e28c5db21b4a05eb17.
It does not replace the historical August 9 release-gate record or transfer its
test counts to a different commit.
Later integration validation
The Lit validation sidecar and deployed recovery drill were advanced through
commit a8b8efe48fbc8962a55d8f2664f1bb06cd3065cf on August 1, 2026. Those changes
form the current integration-validation track; promotion to an immutable release
artifact follows the next release gate.
On August 9, 2026, the complete local release gate passed at commit
1b6a8d42a8f582a7563c7b9c65de5b72e15262d6 with a clean working tree. It
completed 436 Rust tests with zero failures and 3 ignored tests, 40 Node console
and script tests with zero failures, and 12 Lit Action tests with zero failures.
Formatting, strict linting, browser-bundle rebuilds, credential scanning, locked
release builds, build metadata, and SHA-256 checksums also passed. The resulting
artifact remains a non-production release candidate. A dedicated Lit Group,
PKP, immutable Action, and least-privilege usage key completed a live Chipotle
authorization run. Public-testnet Gate deployment and upgrade evidence are still
pending.
Evidence available to an approved reviewer
- build metadata and artifact checksums;
- automated test and CI results;
- pilot acceptance report and companion JSON exports;
- authorization certificate and public transcript evidence;
- terminal execution or validation receipt;
- independent witness receipt when configured; and
- known-limitations and whitepaper-to-code alignment records.
Production evidence roadmap
- third-party audit report and remediation closure;
- named partner acceptance sign-off;
- HSM/KMS/TEE key-custody attestation;
- independently administered multi-host signer evidence;
- production SLO and incident history; and
- immutable public release artifacts tied to a signed tag.
The public cryptographic-core repository is bufrr/luvion-Protocol-Core. Commercial pilot materials are shared selectively while interfaces and the security boundary remain under design-partner review.