worldseq

Release qualification

Freeze inventories, retain mandatory gate evidence, and validate distribution bytes.

The release inventory declares the required companies, tasks, registered realizations and gate definitions. A release is complete only when every required gate has retained passing evidence. Progress checkpoints do not permit excluding failed cases.

Start a checklist with bun run worldseq release init --out <new-directory>. It captures the current execution and exact task identities, required commands, owners, dependencies, and expected evidence paths. It initially marks every gate pending. Before qualification, initialize a fresh inventory after source, package, and catalog changes have stopped. Earlier results remain historical evidence.

Run bun run worldseq release check <directory> to reconcile the evidence. It exits nonzero for missing or failed receipts, changed artifacts, stale source/catalog, missing tasks, modified gate definitions, or unmet gate dependencies. Operator command receipts account for evidence; they are not an independent attestation of an untrusted submitter’s honesty. Instance certificates and submission verification retain their separate trusted-input requirements.

Required delivery includes standalone source/runtime distributions, built Python and TypeScript SDK packages, a tested Harbor export, runnable examples, and the complete validation receipt. SDK tests must install the wheel/tgz outside the checkout. Public package registries and a hosted leaderboard are not prerequisites.

Qualification rules

  • Every offered graded realization needs a matching retained feasibility certificate.
  • A legal author witness proves physical feasibility, not player knowledge or model skill.
  • Audit identifiability separately; indistinguishable evidence cannot demand conflicting answers.
  • Never change seeds or relax policies merely to obtain passing results.
  • Infrastructure failures are inconclusive, not participant failures.
  • Independent reconstruction and semantic mutation controls check the graders themselves.
  • Keep private seeds, certificates, witnesses, and operator credentials out of player packages.
  • Record authored simulation coefficients as assumptions with sensitivity checks.
  • Bound the claim by the verified instances, interfaces, and threat model.

Independent checker controls

From the application directory, bun test tests/lifecycle-model.test.ts explores all bounded abstract traces within its declared transition and configuration bounds. The independent model checks work, funding, capacity, dependency propagation, cancellation, and retries. It also checks funded progress and a shared-dependency diamond. Those bounds are explicit; this is not a proof for arbitrary graphs or unbounded horizons.

From the application directory, run bun run scripts/check-mutations.ts <new-output-directory>. The runner makes a disposable copy and applies the registered core, contractual, workforce, counterfactual, growth and metered-usage mutations there, leaving the working tree unchanged. Every mutation must have a passing unmodified control and a targeted assertion failure after mutation. Both outputs and the exact replacement are retained. Invalid mutation targets, compilation errors, timeouts, stale execution, or surviving mutants fail the gate. Existing output directories are rejected so failed attempts cannot be overwritten.

Retaining gate executions

From the application directory, run bun scripts/release-gate.ts <release-directory> <gate-id>. Each invocation keeps its command arguments, source/runtime identity, output logs, and receipt in a new attempt directory. The current gate receipt points to that retained attempt. Failures remain available after retries. Extra arguments cannot narrow a gate; the certificates gate alone requires its private instance-set directory. Run one gate at a time unless the global simulator worker budget permits overlap.

Initialize and execute a release inventory in the same runtime as its private certificates. For a Linux-prepared set, the certificates gate must run inside the matching frozen Linux runtime with that private volume mounted; a macOS command cannot verify Linux certificates. The other receipts in that inventory must carry the same execution digest. A full source installation in that matching runtime is needed for test, dashboard and SDK gates; the minimal private preparation image is not itself the full developer toolchain.

Set WORLDSEQ_TEST_DATABASE_URL to a dedicated test PostgreSQL database before running quality, submissions or dashboard gates. Their database-specific tests otherwise skip, which is insufficient evidence for those release requirements. Build the standalone archives with bun run release:package before the standalone and handoff gates. The smoke gate also requires Docker, npm/npx and uv with the documented Node/Python interpreter matrix available.

The certificates invocation includes the private directory as its single required argument:

bun scripts/release-gate.ts /private/release certificates /private/instances

Gate artifacts are operator evidence. Harbor’s retained test artifacts include private simulator inputs and must stay outside public distribution archives. Publish the validation summary and selected redacted receipts, not these private working directories.

Before private realization registration, run bun scripts/review-fairness.ts <new-private-review-directory>. The production review checks every mandatory question against its reviewed mechanism: worst-case notice publication precedes the answer deadline, equivalent hidden causes accept the same conclusion, and exact counterfactual components are disclosed in public contracts. Unknown requirements or changed reviewed semantics fail this audit. The generated reviews.json is separate from physical feasibility witnesses.

One Linux execution for preparation and qualification

Create a full validation image from the final source without copying private stores or installation caches. This is an operator image, never a participant image:

bun scripts/release-linux.ts --out /new/private/linux-qualification
docker build -t worldseq-qualification:release /new/private/linux-qualification

The generated Dockerfile pins the same Bun OCI image as private preparation, plus Node 24.13.0, Docker CLI 29.1.3 and uv 0.9.28 by OCI digest. It includes dashboard source, tests, SDKs and packaging scripts and installs the full frozen dependency lock. SDK checks run the declared Node 22/24/Bun and Python 3.11–3.14 matrix inside this Linux qualification environment; those consumer interpreters do not replace the gate parent’s Bun runtime. Network access is required to install tools and the pinned consumer dependencies. No model provider is invoked.

Use a fresh named source volume per frozen candidate so package builds and gate prerequisites survive separate container invocations. The image supplies its initial contents. Reusing a volume from another source revision fails the startup source check. The separate private volume retains the registered realizations and gate artifacts:

docker volume create worldseq-qualification-source
WORLDSEQ_POSTGRES_CONTAINER="$(docker compose -f compose.yaml ps -q postgres)"
test -n "$WORLDSEQ_POSTGRES_CONTAINER"

docker run --rm --init --user 0:0 \
  --network "container:$WORLDSEQ_POSTGRES_CONTAINER" \
  -v worldseq-qualification-source:/opt/worldseq \
  -v /absolute/private/instance-work:/private \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -e WORLDSEQ_QUALIFICATION_INSTANCES=/private/instances \
  -e WORLDSEQ_TEST_DATABASE_URL=postgres://worldseq:worldseq-local-only@127.0.0.1:5432/worldseq \
  worldseq-qualification:release \
  bun src/cli.ts release init --out /private/release

Docker Desktop can reject host-directory mounts when file sharing exhausts descriptors. A named private volume avoids that path: replace the host-directory mount with --mount type=volume,source=YOUR_EXISTING_PRIVATE_VOLUME,target=/private. Use the exact prepared volume; an empty replacement does not contain the registered realizations. For artifact export, omit --rm and keep the stopped operator container until docker cp CONTAINER:/private/release ./retained-release finishes. Harbor itself uploads task inputs and copies logs, so its nested containers do not require host-directory mounts. The Docker socket remains an operator-only bind mount.

The database URI above is the local development configuration inside the existing PostgreSQL container’s network namespace. Substitute a dedicated test database and its real credentials when needed. Root access and the Docker socket allow the trusted operator to build and test sibling containers; never expose that socket, source volume, or private volume to a player. Harbor tests still enforce their own participant isolation. Do not run heavy gates alongside a campaign that already occupies the simulator-worker budget.

Repeat the same container options with one command at a time:

bun run release:package
bun scripts/release-gate.ts /private/release catalog
bun scripts/release-gate.ts /private/release quality
bun scripts/release-gate.ts /private/release standalone
bun scripts/release-gate.ts /private/release certificates /private/instances
bun src/cli.ts release check /private/release

Run every other manifest gate as well; the commands above illustrate the workflow and do not form a substitute release subset. Database-dependent gates now fail before launch if their test database URI is absent or invalid. The standalone gate puts its smoke receipts and install logs under its retained attempt directory. Disposable installation directories stay outside that evidence tree, so package-manager symlinks cannot invalidate the regular-file evidence inventory; failed install workspaces remain available for diagnosis and successful ones are removed. release:package writes the archives to the persistent source volume; copy the final handoff and archives out through a trusted container after all checks pass.

On every invocation, startup checks the frozen source and pinned runtime declarations, then verifies that WORLDSEQ_QUALIFICATION_INSTANCES names a complete registration whose exact execution digest matches the running Linux process. Different Bun versions, platforms, architectures or source bytes cannot be combined into a passing release inventory. If correcting code changed that digest, use the explicit unissued-instance revision workflow with the binding environment variable unset, then prepare all preserved realizations again. Set the variable to the new complete registration before qualification. Never edit a certificate’s execution field or omit the binding to combine old evidence.