Register v0.9 common population and prospective release contract

.github/workflows/ci.yml

@@ -32,6 +32,12 @@ jobs:
           # release tag, so the full history and tags must be present.
           fetch-depth: 0
       - uses: dtolnay/rust-toolchain@stable
+      - name: Verify prospective v0.9 common population and plan boundaries
+        run: |
+          python3 scripts/check-v090-population-plan.py
+          python3 scripts/test-v090-population-plan.py
+          python3 scripts/check-release-v090-results.py --plan-only
+          python3 scripts/test-release-v090-results.py
       - run: cargo fmt --check
       - run: cargo test
       - run: cargo run -- validate

docs/populations.md

@@ -68,3 +68,18 @@ implied by this selection; the [Swift contract](swift-kernel.md) records the
 unresolved scope. `scripts/write-swift-population.py` authors the initial
 manifest and refuses to overwrite one. Future published fixture changes need a
 new population identity and explicit review.
+
+## Prospective v0.9.0 common population
+
+`--population v0.9.0` selects the registered 1,108-case union of the v0.8.0
+1,000-case corpus and `swift-synthetic-v3`'s 108 cases. A scan of `cases/` alone sees
+1,104 cases with 104 Swift inputs. The runner already includes the four opaque
+Swift inputs under `populations/swift-opaque-v3`, so its default discovery is
+1,108 cases with 108 Swift inputs. The named common population pins those exact
+bytes and membership independently of future default discovery.
+The old named populations retain their exact membership and fixture revisions.
+
+This selection is prospective and does not publish new results or activate a
+score. Use the [v0.9.0 release contract](v0.9.0-release-contract.md) and its exact
+partition plan before execution. All freeze-bound reports require fresh evidence
+under the common revision; historical revision strings must not be relabeled.

docs/v0.9.0-pin-review.md

@@ -0,0 +1,36 @@
+# v0.9.0 dated adapter pin review
+
+`docs/adapters.md` is hash-bound by the accepted R2 review packet. This versioned
+appendix records the new review without changing those accepted historical bytes.
+The release contract links this appendix as the prospective pin declaration.
+
+## 2026-09-29 — v0.9.0 common-population pin review
+
+This dated review precedes execution. The whole-corpus membership change does not
+requalify newer tools or rewrite historical pins. Official upstream observations
+and exact hold reasons are retained in [the versioned review](../reports/releases/v0.9.0/pins.json).
+The executable contract must still verify runtime and query/model identities.
+
+| Component | Selected pin | Latest observed | Decision and reason |
+| --- | --- | --- | --- |
+| bifrost | `0.11.4` | `0.11.5` | hold: Retain the qualified anchor-reconciliation adapter/runtime while this release integrates Swift membership; upgrading would require separate adapter and native-policy qualification and compete with the active Bifrost performance reservation. |
+| codeql-non-swift | `2.27.1` | `2.27.1` | bump-pending-compatibility: The release policy forbids mixed CLI versions. Align to Swift's identity/control-verified CLI; preserve historical 2.27.0 runners and verify held query-pack compatibility before execution. |
+| codeql-swift | `2.27.1` | `2.27.1` | current: Retain the exact qualified patched extractor, schema and pack inventories from plan06; upstream CLI currency does not replace those identities. |
+| joern | `4.0.628` | `4.0.641` | hold: Retain exact frontend/engine identity, model-off controls and native unsupported decisions qualified for current108. Adopting 13 newer daily version numbers requires new qualification outside the minimum population integration. |
+| semgrep | `1.177.0` | `1.178.0` | hold: Retain the witnessed matching runtime and committed rule/configuration contract; the prior package/runtime identity discrepancy requires explicit fresh qualification for a bump. |
+| opentaint | `0.4.6` | `0.4.6` | current: Retain exact analyzer, models and rules archives. |
+| infer | `1.3.0` | `1.3.0` | current: Retain exact binary and shipped-model capability decisions. |
+| flowdroid | `2.15.1` | `2.15.1` | current: Retain exact JAR, Android platform and D8 identities. |
+| pyre-check | `0.10.0` | `0.10.0` | current: Retain exact pyre.bin and established Pysa adapter. |
+| pyrefly | `1.3.1` | `1.3.2` | hold: Retain the qualified Pyre/Pyrefly pairing; the type-environment change needs separate compatibility qualification. |
+| semgrep-rules | `40b8c63f75dc7c22c8a77482d73bfb864b146f7e` | `a84ff9cc2453ca91d581380de4b8b3f272f6f4be` | hold: Retain audited native capability boundary and exact vendored rule bytes; a moving rule snapshot requires renewed engagement and unsupported qualification. |
+
+CodeQL query packs and their transitive locks, Swift extractor/schema patches,
+Joern models and native capability controls are held at their exact committed
+identities; no floating resolution or implicit model activation is permitted.
+
+For this review, Swift/Joern “qualified” means identity and control verification
+only, not aggregate-resource or scored qualification. Current108 typed outcomes
+remain unchanged. Before execution Semgrep launcher and core version witnesses
+must both match `1.177.0`; a hold reason does not resolve an identity discrepancy.
+Release notes must disclose every held pin that is older than reviewed upstream.

docs/v0.9.0-release-contract.md

@@ -0,0 +1,102 @@
+# v0.9.0 whole-corpus release contract
+
+This prospective registration is not a release or a score activation. It adds
+an explicitly selected `--population v0.9.0` execution population while retaining
+the default corpus and every historical population, report, outcome and freeze.
+
+## Population and report scope
+
+The population is exactly the 1,000 cases bound by v0.8.0 plus the 108 immutable
+`swift-synthetic-v3` cases: 1,108 unique cases across 14 languages. It includes
+the four opaque Swift inputs outside `cases/`. Its common fixture revision is
+`sha256:7c8619b2d4a93467fd0a502ed03668bfc8f3b9878a7bd5e9271c7aca31f75f62`.
+`populations/v0.9.0.json` binds case and fixture hashes.
+
+`reports/releases/v0.9.0/plan.json` registers exact membership for 92 report
+partitions and 4,252 rows. It preserves the existing 82 partitions and adds five
+Swift partitions each for CodeQL and Joern. Bifrost Swift is unsupported; no
+fictional Bifrost Swift execution or reserved-track activation is introduced.
+
+All reports must come from fresh execution or prospectively bound unsupported
+capability decisions under the common revision. Historical reports are references,
+never new-run evidence, and their fixture revision must not be relabeled. Keep
+runner-error, inconclusive and unsupported distinct; none is a negative. Retain
+all failed attempts and bind normalization to independently verifiable raw bytes.
+The Darwin aggregate-resource limitation remains visible in Swift outcomes.
+
+## Execution review and resources
+
+The plan remains non-executable until the parent reviews the exact commands,
+pins, query/rule/model identities, controls and acquisition/storage budget.
+The authorized scope is the full normal release route, including necessary fresh
+matrix evidence, freeze and publication. Generic scope approval is not repeated.
+
+Run one analyzer serially. Ongoing Bifrost work has priority, including its
+uncontended performance slot. Do not infer availability merely from a process
+snapshot. Current #3735 reservation is active as of the September 29 review.
+Before restoration, account for compressed downloads, extraction scratch,
+installed tools and retained output. Require at least 64 GiB free after tool
+restoration: 40 GiB reserve plus 24 GiB CodeQL scratch. Recheck before each lane;
+pause safely if the reserve or exclusive slot is lost. Preserve shared caches,
+active/warm targets and all hash-bound evidence.
+
+Historical wall timestamps suggest 17.73 hours for one serial correctness matrix,
+including each multi-partition Swift run once. This is a diagnostic cost estimate,
+not a promised runtime or qualifying uncontended measurement. The initial budget
+is 28.6 hours including 50% timing contingency and two setup hours; separately
+resolve controls, repeats and acquisition before making the plan executable.
+CodeQL dominates the historical cost (15.82 hours). Do not silently start an
+unbounded retry loop or relax cutoffs to fit the budget.
+
+New outputs belong under the versioned release namespace. Existing harnesses
+that write fixed report/raw paths require isolation or versioned output support
+before execution; never replace bytes referenced by prior freezes. Swift normal
+v1 scripts and plans are hash-bound historical inputs and require a new versioned
+common-population integration, not edits behind their existing hashes.
+
+## Delivery sequence
+
+1. Merge population and execution-contract integration with focused checks and
+   exact-head green CI. Record dated upstream pin decisions before execution.
+2. Obtain parent review of the concrete executable matrix; run serially under
+   the resource reservation and preserve all outcomes and raw evidence.
+3. Merge fresh evidence separately from the freeze.
+4. From clean merged main, create and validate a new freeze and generated site
+   artifacts in a separate PR. Preserve historical freezes and archives.
+5. Verify exact-head CI, tag ancestry/tree and canonical release notes. Publish
+   the tag/release and Pages, then verify terminal deployment and live version,
+   freeze identity, denominators and representative scorecards.
+6. Close #220/#215 only after live acceptance is satisfied.
+
+## Discovery and historical publication
+
+A filesystem-only scan of `cases/` sees 1,104 cases (104 Swift). The current
+runner already discovers 1,108 cases (108 Swift), because `all_case_paths` includes
+`populations/swift-opaque-v3`. This registration preserves that behavior.
+Use the named `v0.9.0` population for the new common run and freeze; it pins
+all 108 Swift cases, including the four opaque cases outside `cases/`. The named
+`swift-synthetic-v3` population remains 108 cases with its original Swift-only
+revision. These are different population identities and must never be joined by
+silently editing denominator or revision strings.
+
+The existing v0.8.0 tag resolves to
+`9c0916338abc42ab13565b5d9e6f310d46134afc`; Pages was deployed from that commit and
+the live homepage identifies v0.8.0. The September 29 audit found no GitHub
+release object for that tag (API 404). That separate historical publication gap
+is recorded here, not repaired by retroactively publishing v0.8.0 in this work.
+The hard-coded v0.8.0 release checker remains unchanged.
+
+The parent reviewed and accepted the 1,108/92/4,252 scope and provisional 28.6-hour
+planning envelope. This is not execution clearance: the exact unique-group
+commands, retention/storage peaks, required controls, retry and resume behavior
+must be reviewed before runs. `control-plan.json` retains the previous normal
+release's 19 script probes, two warm series and nine overhead groups as explicit
+integration work; no extra accuracy experiment is introduced.
+
+## Pin review preservation
+
+The [dated pin review](v0.9.0-pin-review.md) is a versioned appendix because
+`docs/adapters.md` is bound by the accepted R2 review packet. Its original bytes
+and review hashes remain unchanged. The appendix and `pins.json` supply the new
+pre-execution declaration. CodeQL must use one CLI version, 2.27.1, across every
+new partition; non-Swift held-pack compatibility remains an execution blocker.