TAB-29: prepare Tabellio v0.7.0 release candidate

[hudsonaikins]

Summary

Prepare the Tabellio v0.7.0 release candidate so teams can install the package, identify the runner, and reject stale or conflicting candidate evidence.

Review fixes

• Detect nested tracked-file changes hidden by Git index flags.
• Provide the installed tabellio-provenance-demo command.
• Package public validator files without private local state.
• Remove the historical v0.6 manifest from the v0.7 candidate.
• Require runner identity for current manifests; reject legacy evidence when the exact committed manifest requires identity, while preserving compatibility for other manifests.
• Repair synthetic fixtures to include real committed validation contracts.

Validation

Exact candidate: 5306a31d616397f4f93f41e78065086a8d33b4e4.

• All GitHub checks passed: Tests, validate, Fallow changed-code, Package dry-run.
• Buildkite #183 passed all six jobs: https://buildkite.com/intelip/tabellio/builds/183
• Canonical exact-head validation gate passed.
• v0.7 release validation gate passed on rerun. The first attempt failed an intermittent index-timestamp assertion; isolated checks and the rerun passed. No root cause is claimed.
• Focused tests: 28 passed. Status fixture tests: 10 passed.
• Local Fallow audit passed with zero introduced complexity or duplication. Hosted Fallow passed on retry after a demo failure; no root cause is claimed.
• Evidence envelope and external-action policy checks passed: tabellio-pr-evidence-5306a31.json.
• Canonical ledger: refs/tabellio/validations:commits/5306a31d616397f4f93f41e78065086a8d33b4e4/validation-f8dc2fbc-cab3-48f1-89d5-dfa4bd385314.json.
• Release ledger: refs/tabellio/validations:commits/5306a31d616397f4f93f41e78065086a8d33b4e4/validation-2f43665c-7bff-43f3-8d46-2d3fb59a8318.json.

Boundaries

This PR prepares source for v0.7.0. Merge does not publish an npm package, create a release, or deploy production. Historical PR #44 is superseded by this candidate.

Plane-Work-Item: TAB-29
Entire-Checkpoint: 3fd6b8c1294c

[makeplane]

Linked to Plane Work Item(s)

References

• (TAB-29) Release the first useful version

This comment was auto-generated by Plane

[hudsonaikins]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 34f6bff8ad

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[hudsonaikins]

@codex review

Please review updated head d9be7d3. It addresses the three prior findings: nested Git index flags, the installed provenance demo command, and package inclusion of private local state. Focused regressions, both exact-head gates, and an installed-package demo passed. The PR description contains the current evidence.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: d9be7d325c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[hudsonaikins]

@codex review

Updated final head: 79849b2. This adds a test-only fixture cleanup to the three review fixes in d9be7d3. The 11 focused regressions and local changed-code quality audit pass with zero introduced duplication. Exact-head validation and hosted checks are running.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 79849b2480

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[hudsonaikins]

@codex review

Merge-authorized head: 2620379. GitHub updated this branch with main's #57 local Fallow commands. The three earlier findings are fixed and their threads resolved. Required checks are running on this exact updated candidate.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 26203793ae

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[hudsonaikins]

@codex review

Please review exact head 5306a31. Both latest P1 findings are fixed: the obsolete v0.6 manifest is removed, and identity-required manifests reject legacy evidence without runner identity. Compatibility remains for non-identity-required manifests. Required GitHub checks, Buildkite #183, canonical and v0.7 local gates passed. Fixture repairs and regression tests are included.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 5306a31d61

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".