0.4.0 — the specification judges the implementation
Historical release note. ESS now publishes a standalone conformance report; workflow consumers translate that report at their own boundary.
This is the release where a specification first generated its own conformance suite, ran it against an implementation, and produced a report a workflow consumer could translate into its own evidence vocabulary.
Both halves are proven, which matters more than either alone:
- a correct implementation passes 27 of 27 scenarios and the task completes;
- the same implementation with one fault injected fails the scenario that exists to catch it, and the engine refuses to let the task complete, naming the principle that refused.
Five scenario families
Outcomes, lifecycle transitions, wrong-state refusals, entity invariants, and bindings with their mapping, delivery and failure clauses. 27 scenarios from the normative example, 31 from a fixture built for the corners the normative example cannot reach.
Suites are committed and drift-checked as a gate step, and the index lists every construct that got no scenario. A suite quietly holding fewer checks than you think is the one failure a passing run cannot show you.
Twelve deliberately wrong implementations
Each with a matrix row asserting it is caught by the scenario meant to catch it, and a blast-radius allowance per fault.
One fault is caught by nothing, and says so: an event may be published with any payload, because nothing in the model relates a command's input to an emitted payload. Naming the hole in the release is the only version of this that is useful.
The oracle criticised the specification language first
Four model gaps closed — and two were found by a generated suite refusing to generate, rather than by anyone reasoning about it: which instance a command acts on, and what a command does when attempted in the wrong state.
Both were writable before and unassertable. It took something trying to generate a test from them to notice.
An honest limit, in the code
independent: true is structural rather than attested, and the code says so: it proves a record
came from the runner and not the agent. Nothing signs it, and the provenance digest is left empty
rather than faking tamper evidence.
1,216 tests, 50 suites.
Written retrospectively from this release's CHANGELOG.md section and its annotated tag; no
re-run command output.