DaoyuanLi2816 · DaoyuanLi2816 · Jul 31, 2026 · Jul 31, 2026 · Jul 31, 2026 · Jul 31, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,8 +6,35 @@ All notable changes to miniVERL are recorded here. The format follows
 
 ## [Unreleased]
 
+## [0.2.5] - 2026-07-30
+
+Focused correctness release. No training objective, environment, benchmark,
+model family, adapter revision or frozen scientific result changed.
+
+### Changed
+
+- Writable manifests now publish `ready` at construction, transition atomically
+  to `running` immediately before training, and record
+  `closed_before_training` when a new trainer is closed unused.
+- Training owns private evaluation/checkpoint implementations; public calls
+  cannot switch model mode or snapshot parameters during an optimizer update.
+- Protocol-v2 final examples are environment-specific and verifier-format
+  valid, while protocol-v1 remains byte-frozen.
+- Automatic reports remain under the training run lock, and standalone
+  evaluation acquires and transfers one lock before reading configuration or
+  selecting, validating and loading a checkpoint.
+
 ### Fixed
 
+- SQLite verification classifies non-finite and overflowing numeric strings as
+  malformed instead of leaking `ValueError` or `OverflowError`; all built-in
+  verifiers are fuzzed as total functions after reset.
+- Portable artifacts redact semantic secret suffixes, authorization/cookie/
+  session fields, URL userinfo, Windows paths with spaces, UNC paths and
+  private POSIX/macOS paths without hiding useful immutable provenance.
+- The PyPI-description generator rewrites both targets of nested linked images
+  and rejects every remaining relative project target in generated Markdown
+  and built wheel metadata.
 - Release verification accepts an exact, tag-pinned banner expressed as
   Markdown or HTML while retaining source-URL and alt-text checks.
 - A browser-only PyPI challenge can be deferred after public metadata, every
@@ -374,7 +401,8 @@ Same-tokenizer only; one trajectory per forward pass; `swap` unavailable for
 quantized models; only Qwen3 and Qwen2 architectures tested; single-seed GPU
 results. The full list is in `docs/limitations.md`.
 
-[Unreleased]: https://github.com/DaoyuanLi2816/mini-verl/compare/v0.2.4...HEAD
+[Unreleased]: https://github.com/DaoyuanLi2816/mini-verl/compare/v0.2.5...HEAD
+[0.2.5]: https://github.com/DaoyuanLi2816/mini-verl/compare/v0.2.4...v0.2.5
 [0.2.4]: https://github.com/DaoyuanLi2816/mini-verl/compare/v0.2.3...v0.2.4
 [0.2.3]: https://github.com/DaoyuanLi2816/mini-verl/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/DaoyuanLi2816/mini-verl/compare/v0.2.1...v0.2.2

diff --git a/CITATION.cff b/CITATION.cff
@@ -2,8 +2,8 @@ cff-version: 1.2.0
 title: "miniVERL: On-policy distillation for tool-using agents on one GPU"
 message: "If you use miniVERL in your work, please cite it as below."
 type: software
-version: 0.2.4
-date-released: 2026-07-29
+version: 0.2.5
+date-released: 2026-07-30
 license: Apache-2.0
 repository-code: "https://github.com/DaoyuanLi2816/mini-verl"
 url: "https://github.com/DaoyuanLi2816/mini-verl"
@@ -98,4 +98,4 @@ references:
     url: "https://arxiv.org/abs/2603.07079"
     notes: >-
       Motivates recording per-token teacher entropy. Entropy-aware divergence
-      mixing is a roadmap item and is not implemented in miniVERL v0.2.4.
+      mixing is a roadmap item and is not implemented in miniVERL v0.2.5.
diff --git a/PROJECT_STATE.md b/PROJECT_STATE.md
@@ -6,6 +6,24 @@ and what it printed.
 
 Last updated: 2026-07-30.
 
+## v0.2.5 final correctness work in progress
+
+| item | current state |
+| --- | --- |
+| audited baseline | fetched all remotes and started `v0.2.5-final-correctness` from clean public `main` at `3d3d59993a99bb1a7c1225f970a3e052a43e4dc1` (`0.2.5.dev0`) |
+| regression-first evidence | the focused pre-fix run reproduced 23 failures and 472 passes: SQLite raised `ValueError`/`OverflowError` for `nan`, infinities, overflow notation and a huge integer through both direct verification and the real rollout path; every built-in protocol-v2 final example remained the placeholder `answer` |
+| focused correctness pass | `python -m pytest` over the changed verifier, protocol, privacy, lifecycle, locking, packaging, CLI and standalone-eval surfaces passed **798 tests**; the old implementation had separately reproduced 23 verifier/protocol failures, 16 privacy failures, 5 lifecycle/concurrency failures, the report-lock race, two eval-lock races and the nested-link defect |
+| static gates | `git diff --check`, `ruff check .`, `ruff format --check .`, `mypy src/miniverl` and cached `actionlint` all pass |
+| complete local suite | after refreshing stale editable metadata from `0.2.4` to source `0.2.5.dev0`, the full non-GPU/non-network gate passed **1278** tests with **87.37%** branch coverage; the available RTX 4080 gate passed **5**, and the network gate passed **3** |
+| compatibility evidence | torch-free core passed **1021** tests on each of Python 3.10, 3.11, 3.12 and 3.13; the minimum bundle (torch 2.3.1, Transformers 4.51.3, PEFT 0.12.0, Accelerate 0.33.0, NumPy 1.24.4, bitsandbytes 0.43.3) and latest bundle (torch 2.13.0, Transformers 5.14.1, PEFT 0.20.0, Accelerate 1.14.0, NumPy 2.5.1, bitsandbytes 0.50.0) each passed both no-network training smokes; Transformers 4.51.3 and 5.14.1 each passed the **133-test** HF/config compatibility suite |
+| multiprocessing platforms | the complete Windows suite includes the new spawn-based report/eval/run-lock races and passed; a local WSL launch was unavailable because its VHDX returned `ERROR_SHARING_VIOLATION`, so the Linux multiprocessing result remains an applicable PR CI gate rather than a local claim |
+| lifecycle and ownership | new writable manifests start `ready`, transition atomically to `running`, and close-before-train as `closed_before_training`; training-private eval/checkpoint implementations are separated from public calls, automatic reports remain under the writer lock, and standalone eval transfers one pre-acquired lock before reading mutable state |
+| privacy and packaging | semantic secret suffixes, authorization/cookie/session fields, URL userinfo, paths with spaces, UNC and HTML-escaped variants are redacted; the PyPI generator rewrites nested linked images and both generated `PYPI.md` and built wheel `METADATA` reject all remaining relative project targets |
+| final-version packaging gate | an isolated `0.2.5` build produced one wheel and one sdist and passed Twine; the extracted sdist passed Ruff, format, mypy and **1278** non-GPU/non-network tests, rebuilt a wheel with the same **78-file** runtime inventory, and exposed zero relative metadata targets |
+| clean-install gate | a clean Python 3.10 core wheel install reported `0.2.5`, passed `doctor`, and kept torch/Transformers/PEFT/bitsandbytes absent; a clean Python 3.12 wheel + `[train]` install ran `demo`, `inspect`, `report`, and weights-only standalone `eval` |
+| immutable evidence | no frozen tag, adapter revision, or benchmark result was changed; the required benchmark SHA-256 remains `53fc1d4d5b7adee09618d77ad62d4086ba56b78569832d6fc7c3bcd5c2695bbc` |
+| release state | local release-source gates are complete at version `0.2.5`; no tag or public artifact exists yet, pending one focused PR and green GitHub CI/build |
+
 ## v0.2.4 framework-hardening release status
 
 | item | current state |