0.6.1 — offer on the package page

0.6.0: world confirmation adapters + the Provider Truth Atlas

Your database knows what you did, not what arrived. confirm.ts asks the
provider — and keeps three answers instead of two. 'unknown' (a 500, a
timeout, a revoked key) is NOT 'absent'; most implementations collapse
them into a boolean, which is the double-charge bug wearing a helpful
face. Here it escalates to a human, because guessing about an
irreversible effect is the thing this library exists to prevent.

Only 404 means absent. A bounced email is confirmed — the send happened.
A canceled Stripe intent is confirmed — it exists.

docs/PROVIDER-ATLAS.md starts the measured-not-assumed record, with
MEASURED / DOCUMENTED / UNKNOWN marked per row and the method written
down so anyone can repeat or refute it. Vendor claims are never printed
as measurements.

18 tests, all mocked — no live provider calls. Suite 121 green.

0.5.0: notarised receipts — evidence an outsider can check

receipt() answers 'did this run once?' from the operator's own records,
which is worth nothing to an auditor: a log you keep about yourself is a
diary entry. ReceiptLedger hash-chains receipts so editing, deleting or
reordering any entry breaks every hash after it — tampering is caught by
arithmetic instead of trust, and verifyChain() needs only the entries.

Honest limits stated in code, README and audit output: a chain proves the
sequence is unedited, NOT who wrote it (signatures are a later step), and
'confirmed by a provider' is never printed the same as 'nobody asked'.

12 tests, most of them attacks: edit, delete, reorder, and a re-hashed
local forgery that still breaks at the following link. Suite 103 green.

0.4.0: One Door — dedup, budget and clearance as one atomic gate

Three protections that only work honestly when they share a choke point:
the once lease answers 'already done?', SpendLimiter answers 'affordable?'
(reserved before the effect, never consumed by a replay), and a clearance
policy answers 'may this run without a human?' — checked first, so an
uncleared action costs nothing.

Refusals are values (not_cleared | over_budget | conflict), a failing
effect frees both the reservation and the key, and the storm test proves
50 concurrent passes produce one execution with budget charged once.

8 new tests; suite 91 green. Consumer smoke test on the built artifact.

0.3.0: add once-kernel-audit — the duplicate-finder as a zero-code CLI

The audit feature (findDuplicates) shipped in 0.2.0 already needs no store and
no call-site changes, but it still required writing code to use it. That's a
real barrier for the person most likely to actually have the data: someone
with a payments export or a send log, not necessarily a developer.

  npx once-kernel-audit payments.json --at=created_at --subject=customer,plan

JSON and JSONL only, deliberately -- not CSV. A CSV parser has quoting and
encoding edge cases that are easy to get subtly wrong, and a silent misparse
is the worst possible failure mode for a tool whose entire job is finding
money that moved twice. Export to JSON first.

--at and --subject are required and never guessed. Auto-detecting which
fields mean "the same operation" would be guessing at the one judgment call
this whole library exists to get right -- get it wrong and you either miss
real duplicates or flag a legitimate recurring charge as one.

Every failure path was tested deliberately, not just the happy path: a
missing file, malformed JSON, and -- the dangerous one -- a mapped field
that doesn't exist in the data. That last case must refuse loudly rather
than silently treat the field as undefined, because that would make every
row look like the same (empty) subject and report unrelated records as one
giant false duplicate group.

Verified from the packed tarball, not the working copy, after the CLI
example was added to README.md and its own test proves it runs from the
shell with zero imports -- the same discipline applied to every other
documented example in this package.

21 new tests (11 CLI-level, 1 README-level, plus the failure-path coverage).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>