evalopt v0.1.0 — Evidence over vibes

evalopt v0.1.0 — Evidence over vibes

A zero-dependency governance and evidence-integrity kernel for any agent runtime.

Agents are good at proposing work. Acceptance deserves a smaller, deterministic authority.

evalopt v0.1.0 introduces a host-independent Python kernel that evaluates immutable observations
against explicit policy and returns a content-addressed, replayable decision. It cleanly separates what
an agent or runtime reports from what policy is allowed to accept.

Install

pip install evalopt-graph==0.1.0

Python 3.10–3.14 is supported, with no required runtime dependencies.

What ships

• Deterministic acceptance. Identical policy and input records produce an identical terminal
  decision: ACCEPTED, BLOCKED, UNVERIFIED, UNSUPPORTED, or FAILED.
• Evidence integrity. Controller-owned adapter policy binds retrieved bytes, selected content,
  provenance metadata, trust, freshness, and record hashes.
• Separated support. Retrieval integrity and claim support are independent records; neither is
  treated as semantic truth by itself.
• Explicit authorization. Acceptance can require exact authority-policy, verifier, attestation, and
  support-record hashes.
• Replayable records. Policies, inputs, evidence records, and decisions serialize to canonical,
  hash-bound structures that can be validated and replayed.
• Runtime independence. Codex, Claude Code, OpenHands, LangGraph, CI, Harbor, or a custom host can
  supply observations without becoming part of the policy kernel.

Stable API

The package root exports exactly ten stable symbols:

from evalopt_graph import (
    GovernancePolicy,
    ClaimRecord,
    EvidenceRequest,
    EvidenceMaterial,
    EvidenceAttestation,
    SupportAssessment,
    EvidenceAuthority,
    AcceptanceInput,
    AcceptanceDecision,
    evaluate_acceptance,
)

This is the supported v0.1.x contract. The graph, standalone CLI, provider clients, Codex bridge,
research loop, filesystem evidence adapters, and historical lazy package-root names remain deprecated
for one migration cycle. They are host compatibility surfaces, not policy authorities.

Trust boundary

The kernel owns policy evaluation, evidence-record validation, reason codes, decision hashes, and
replay. Hosts continue to own model execution, tools, edits, retrieval, credentials, isolation,
scheduling, persistence, hidden graders, and post-run metrics.

Attestation proves that selected material was processed under a declared adapter policy and remained
content-bound. It does not prove that a source is correct, that a claim is semantically true, or that a
deployed system behaves as described.

Evidence status

The kernel is implemented and unit-proven; compatibility and Harbor mappings exercise the shared
decision path; deterministic cases provide conformance evidence for the bounded mechanism.

This release does not claim benchmark superiority, external comparison, independent reproduction,
or SOTA performance. It includes no live-model governance campaign and no official Docker SWE-bench
result. The exact current claims and prospective evaluation design are documented in
BENCHMARK_RESULTS.md
and
BENCHMARK_PROTOCOL.md.

Verify the release

Release artifacts include the wheel, source distribution, SHA256SUMS.txt, an SPDX SBOM, and GitHub
artifact attestations. After downloading the files from this release:

shasum -a 256 -c SHA256SUMS.txt
python -m pip install evalopt_graph-0.1.0-py3-none-any.whl
python -c "import evalopt_graph; print(evalopt_graph.__version__)"
gh attestation verify evalopt_graph-0.1.0-py3-none-any.whl \
  --repo ajaysurya1221/evalopt-graph

The version command must print 0.1.0. Run the same attestation command with
evalopt_graph-0.1.0.tar.gz to verify the source distribution.

Learn more

• README and quickstart
• Architecture and ownership
• Evidence results
• Harbor integration conformance
• Security policy
• Contribution guide

Thank you to everyone who challenged the trust boundary, sharpened the evidence claims, and helped turn
the evaluator-optimizer idea into a kernel small enough to inspect.