v0.5.3 — installer hardening

Adversarial-audit fixes to the installer only; the rule body is byte-identical to 0.5.1/0.5.2.

• Refuses symlinked destinations and paths resolving outside the project (a hostile checkout could otherwise redirect the write anywhere, even with --force).
• Malformed or duplicated managed markers abort with a clear message instead of false success, silent content loss, or a stale duplicate block.
• Every destructive dedicated-file update saves the replaced content to <file>.bak (the signature test cannot tell an old Trial rule from a personal file quoting it).
• --update (undocumented --force alias) removed; unknown flags are rejected with usage.
• Known limitation, documented: no version comparison — an older package re-run overwrites a newer rule (recover via .bak or VCS).

Full details in CHANGELOG.md. 24/24 tests; the five new guards were verified to fail against the 0.5.2 installer before the fix.

Trial v0.5.2 — installer upgrade path

Installer upgrade path for dedicated-file targets; no rule change.

• Dedicated-file targets (claude, cursor, windsurf, cline, kiro, roo) now upgrade in place instead of refusing every second write; same-version reinstall is idempotent.
• Foreign files at the destination path are still protected (refused, with a --force escape hatch).
• The canonical private-draft, fail-closed rule body is byte-identical to 0.5.1.

Full changelog: https://github.com/Da7-Tech/trial/blob/main/CHANGELOG.md

v0.5.1 — activation contract hardening

What changed\n\n- Added regression coverage that requires Cursor to keep alwaysApply: true.\n- Added regression coverage that requires the Claude and packaged skill descriptions to advertise the pre-delivery trigger before their full bodies are loaded.\n- Moved the root specification version into standards-compliant metadata so all shipped skill entry points pass the canonical skill validator.\n\nThe canonical private-draft, fail-closed Trial rule is byte-identical to v0.5.0. This patch prevents adapter metadata from silently making the gate optional.\n\n## Verification\n\n- 17 repository tests passed.\n- Three skill entry points passed the canonical validator.\n- Three independent policy mutations were killed.\n- The packed artifact installed successfully into all 12 supported targets.

v0.5.0 — pre-delivery evidence gate

Pre-delivery enforcement

Trial now gates the response itself:

• The proposed final response remains a private draft until every user-visible claim is accepted.
• NOT_PROVEN, NEEDS_EVIDENCE, and NEEDS_FIX remain internal and return the agent to proof or repair.
• Unsupported success claims cannot be softened into implied completion.
• If proof remains impossible after bounded repair, the only permitted output is a precise incomplete status.
• All twelve supported agent formats carry the same canonical rule.

Verification

• 16 repository tests passed.
• The skill validator passed.
• A packed-install probe verified the gate in all twelve supported targets.
• A policy mutation that re-exposed the internal verdict was killed by the regression suite.
• Privacy and whitespace checks passed.

Measurement note

The published live-agent benchmark measured the version 0.4 receipt-and-coverage rule. Version 0.5 preserves that rule and adds the stronger pre-delivery contract, which has deterministic policy coverage but has not yet been re-benchmarked on live agents.

v0.4.2 — evidence harness hardening

The measured Trial rule is unchanged. This patch hardens the evidence around it.

• Replaces source-text coverage detection with a behavioral mutation test at the user-facing middleware boundary.
• Adds adversarial grader regressions for comment-only decoys, uncovered fixes, and genuine covering tests.
• Exercises all 12 documented installer targets, including overwrite refusal and idempotent shared-file updates.
• Clarifies that the repository publishes aggregate historical results and selected excerpts; the shipped harness supports fresh reruns, not reconstruction of artifacts that were not retained.

v0.4.0 — the measured release

Receipts replace hashes, coverage beats green, a real subagent fallback, 12 agent formats byte-synced in CI, a Claude Code plugin, a zero-dep installer — and the first controlled measurement on real agent sessions, losing metrics included. Full details in CHANGELOG.md and benchmarks/results/2026-07-02-false-done-and-cost.md.