v0.96.0 Release Recap

v0.96.0 is a non-breaking KV audit release that adds verification for derived KV refresh receipts.

What's New

Area	New in v0.96.0	Why it matters
KV receipt verifier	contextdb repair kv-cache receipt verify	Lets operators re-check derived KV refresh receipts before trusting incident evidence
Value hash check	--value-file PATH	Recomputes the reviewed value SHA-256 when the value artifact is available
Report evidence	Embedded report and doctor-command verification	Catches edited receipts, stale report state, and drifted confirmation commands
Feature metadata	kv-derived-refresh-receipt-verify	Lets live deployments advertise derived KV receipt verification support

Operator Flow

After an executed derived refresh writes a receipt, verify it with the reviewed value artifact:

contextdb repair kv-cache receipt verify \
  --receipt context-prod-support-recent-nodes.receipt.json \
  --value-file context-prod-support-recent-nodes.value.json \
  --report

If the value file is not available, the verifier still checks receipt structure, embedded executed report evidence, written keys, and the recomputed doctor confirmation command.

Compatibility

This release is intentionally non-breaking. Existing KV refresh, derived value, receipt generation, and doctor freshness behavior are unchanged; verification is a new opt-in command.

Verification

Release verification included:

go test -count=1 ./cmd/contextdb
go test -count=1 ./...
npm run docs:build
git diff --check

The next reliability slice should focus on publishing the retry fatigue preset schema or adding a doctor lane for KV receipt verification.