Release-candidate notes — 7a16a40 (Nazm v0.3.0: public-release readiness, R1)

Frozen evidence for one tested commit. This file records what was verified at 7a16a40640b44f93713f8209d714f1fd20f45420 and is not updated as the project moves. Current implementation truth is ../capability-matrix.md; what is not done is ../limitations.md. The candidate before it is 82936f6.md, which this file does not change.

Nothing has been pushed, tagged or published. This is a candidate for Nazm v0.3.0, the toolchain release of the executable language Nazm v0.3. Making it a release is a person’s decision, and the procedure for it is at the end of this file.

Relationship to N108

82936f6 was N108’s accepted core candidate: the language, compiler, runtime, backends and the compiler written in Nazm closed under their declared scope, every class-A row VERIFIED. R1 is public-release hygiene on top of it, and changed no language or runtime semantics intentionally:

R1-C1 — a function written as a value was missing from the reference index

Found when R1’s tour (examples/tour/closures.nz) entered the corpus the reference audits read: in apply_twice(double, 5), double was in no entity’s set. The checker had recorded every named function written as a value since N50, and lowering, MIR and effects read that record; the reference index, built from Resolution::each_use, did not. So nazm references, LSP find-references, a snapshot’s references and dependencies, and every plan read from the index left such uses out, and rename refused such a function — its re-check found the name undefined — so nothing was ever renamed wrongly. The fix is one shared path: each_use reports each recorded function value as a use of the function it names, at the name’s span, so every consumer of the index sees it, nothing re-resolves a name, and no occurrence is listed twice. Every form the language accepts is covered: an argument, a let, a return, a field, a generic argument, an import and a re-export’s alias. Two corpus audits were stale since N50 and N78 and were fixed with it — a capture is the binding it copies, and x.m() in a variant’s shape is a method call when the checker says so — and structure now states by test that it offers no member at a method’s name. Epoch 29, nazm.interface/11, runtime ABI 14, nazm.resolved/1 and nazm.snapshot/3 are unchanged: the schemas now carry what they always promised, so a snapshot of a program with a function value has different references and dependencies digests than an earlier build gave. Caches written by unreleased 0.3.0 builds before 47daadf share this checker identity and may hold a unit without those uses; none was released, the repository’s own were deleted, and this candidate’s evidence was produced after the fix from fresh caches. architecture.md §7.110. Mutation evidence below.

Identities

Final support status

Evidence

All contained runs are Docker, offline, nazm-contained:1.98.1, Linux aarch64, serial, from clean worktrees, on 2026-10-07. The harness’s verification volumes were cleared before the final gate and the candidate’s worktree was new, so no check, object or cargo cache from before 47daadf was used.

c730626 → 7a16a40 changes docs/grammar.ebnf and the guide generated from it, and 47daadf → c730626 documentation, the capability report’s text, one example and the catalogue, so the stages run at 47daadf and c730626 stand for this commit. An assembly at c730626 failed in the suite — nazm-syntax’s grammar test, on the production that had no example — which is why 7a16a40 exists.

What GitHub CI establishes, and what only the contained gate does

.github/workflows/ci.yml runs, on an uncontained ubuntu-latest runner: formatting, lints, cargo xtask check, the host-safe subset (cargo xtask workspace-tests --host-safe, every test binary except those that call the containment guard — the selfhost and bootstrap stages), the lifecycle tests and the benchmark harness’s self-test. It establishes that those pass on x86_64 Linux, and nothing about the compiler stages it leaves out. It is not the release gate, and no green CI run has been recorded yet (area 33). Only the contained gate above — contained tests, selfhost, bootstrap, fuzz, mutate and release — establishes this candidate; an ordinary cargo test --workspace on an uncontained host is neither permitted for those stages nor equivalent to them (runbook.md).

Mutation evidence

The catalogue holds 1,273 entries. Which campaign established each:

0 survived, 0 unusable, 0 not injected, 0 without a verdict in either R1 campaign. N108 caught all 1,268 catalogue entries present at its gate; R1-C1 added two reference-index mutants and R1 three tooling mutants, each caught in its own responsibility-mapped campaign. Every current entry has a verdict of caught, from one of these three campaigns — not from one campaign over 1,273.

Performance

R1-C1 reads one more table into the reference index: building it for the compiler written in Nazm took a median of 2.70 ms after against 2.69 ms before (release build, 30 runs), that compilation having no function values; the cost is linear in the number of function values. The release assembly’s benchmark check passed.

Reproducibility and provenance

Kept apart, as capability-matrix.md area 32 requires:

Independent verification of the artifact

The archive was extracted on the host and every file’s SHA-256 recomputed with Python’s hashlib, not with the tool that wrote the manifest: 221 files in the archive, 220 manifest entries, 220 of 220 match, none missing, and the only file not listed is MANIFEST.txt itself; bin/nazm is the manifest’s binary-sha; the archive’s MANIFEST.txt and PROVENANCE.txt are the published ones. The manifest names version: nazm 0.3.0, the binary’s own text is “Nazm language v0.3, toolchain 0.3.0”, and the README inside is the v0.3.0 page. The archive’s file name does not carry the version; the publisher names the uploaded file (step 7).

Evidence index

target/gates/r1f/evidence-7a16a40/ — an evidence bundle (nazm.evidence/1), 23 files indexed by BLAKE3, index.json SHA-256 550f1a963bb7aaa1cf32d7b5304deba4b1c79b2cb01cfcd6d560190c363e0123, verified with cargo xtask evidence --verify: the release’s MANIFEST.txt and PROVENANCE.txt, both archives’ SHA-256, the independent redigest, both assembly logs and the failed c730626 one, the c730626 and 47daadf gate logs with both campaigns’ journals, the lifecycle runs and the host-safe run. The archives are under target/gates/r1f/final-rc1/ and final-rc2/, build output and not tracked.

Known limitations

limitations.md is the list. In the release’s terms: the eight class-B rows’ limitations; the class-C blockers; x86_64-unknown-linux-gnu compile-only; reproducibility shown on one host and one image only; no signed attestation of this candidate; the oracle runs the sequential subset only; the interpreter, the compiler written in Nazm and a program that calls C keep a thread per task; structure completion offers no methods, and at x.m() and x.m(1) it declines with two different internal reasons (both “no answer”; no schema or protocol exposes the difference); the parser’s help text for a refused construct still lists the v0.1 subset, and nazm capabilities’s types line lists the eight built-in type names and not the five other capability types.

The human release procedure

Every step is a person’s, in this order, from a clean checkout of exactly this commit. Stop at the first step that does not pass.

1. Check out the commit. git checkout 7a16a40640b44f93713f8209d714f1fd20f45420; git status --porcelain must print nothing. Delete any .nazm/ directory a build before 47daadf left in the checkout.
2. Build the images (network here and nowhere after): docker/contained.Dockerfile (nazm-contained:1.98.1), and for the platform runs nazm-qemu:n86, nazm-wasm:n64, nazm-evm:n70 and nazm-debug:n58.
3. Run the gates, contained and offline, each exiting 0: cargo xtask contained cache clear; cargo xtask contained tests; cargo xtask contained selfhost; cargo xtask contained bootstrap; cargo xtask contained fuzz 300; cargo test -p xtask --test lifecycle -- --ignored --test-threads 1; cargo xtask check and cargo test -p nazm-cli --test docs; and, if a full campaign is wanted rather than this file’s composition, cargo xtask contained --profile p4t4 mutate --strategy targeted --verify-killers, resumed with --resume until complete.
4. Run the platform tests on the host: cargo test -p nazm-cli --test accel --test boards --test contract_property --test debugger --test debugger_v3 --test evm --test freestanding --test realtime --test wasm --test wasm_contract -- --ignored.
5. Assemble the candidate twice: cargo xtask contained --profile p4t4 release, copying target/release-candidate/ aside after each; the two nazm-release-candidate.tar.gz must be byte-identical (cmp), and their SHA-256 must be this file’s a5e2ee97… if the image is the same. It tags, pushes and uploads nothing.
6. Verify independently, and attest if wanted: extract the archive and compare every file’s SHA-256 with MANIFEST.txt, both ways; cargo xtask evidence --verify over the gate’s evidence bundle; optionally nazm attest sign --key KEY PROVENANCE.txt nazm-release-candidate.tar.gz and nazm attest verify with the signer’s allowed-signers file.
7. Decide. Only then, and only by a person: tag v0.3.0 at this commit, push the branch and the tag, and publish the archive — named for the release, for example nazm-0.3.0-aarch64-unknown-linux-gnu.tar.gz (the bytes unchanged) — with MANIFEST.txt, PROVENANCE.txt and this file beside it. Enable GitHub private vulnerability reporting, which SECURITY.md names first, and confirm the maintainer address it falls back to. None of this has been done.

Nothing has been pushed, tagged or published.

Appendix — the workspace suite by crate

The release assembly’s cargo test --workspace at 7a16a40, read from its log (final1.log in the evidence bundle; final2.log is identical in every count), binary by binary, grouped by crate; doc-tests are one row.

2492 passed, 0 failed, 47 ignored.