Development log 02: making release evidence easier to check

23 October 2026 · By V. This entry covers the recorded resource and release-integrity development pass: site 0.4.0, VVault/VRelay 0.2.6 and V Cipher 0.1.6 research. It describes that historical pass, not a claim that every current build has the same test count.

Package only reviewed source paths

The source archive process moved to an explicit reviewed file manifest. It rejects links, missing or unlisted paths and forbidden private/runtime file types before generating archives. The point is to make accidental file inclusion harder and the package contents easier to inspect.

A file allowlist cannot prove the text inside an approved file contains no secrets. Content review is still necessary. The internal record did not find an actual private-file leak in the project checkout.

Bind downloadable bytes to the build report

The artifact validator checks the embedded VGuard APK against its published report’s digest, length and artifact name. Fresh SDK checks were recorded separately from source-only checks. A signature establishes a signing identity for those bytes; it does not establish that the program is secure or works correctly on a phone.

Bound work that cannot complete

The recorded pass added one deadline for offline setup and guards against overlapping installation requests. It also refuses a full replay tracker before expensive cryptographic work begins. Browser background jobs may still complete after a page timeout; that distinction is documented rather than hidden.

What was checked

The historical record reports 166 Node tests passing, plus separate SDK verification and Python/Web Crypto interoperability checks. Those results have a defined scope. Actual Android routing and lifecycle behaviour, physical two-phone operation and independent review remained incomplete.

Read the full review and its limits · Inspect source and release evidence