v0.4.0

BSFF v0.4.0 — fail-closed falsification engine: 7 machine-checked inv…

BSFF v0.3.0 — conjunction gate + SLSA provenance

BSFF v0.3.0

Falsification engine

• Frequentist-AND-Bayesian conjunction gate. SURVIVED now requires both a rank-order surrogate rejection (p ≤ α) and effect-size corroboration (BF10 ≥ threshold; default 3, strict 10). Fail-closed — it only ever demotes to UNSUPPORTED. Closes a measured false-positive hole: the rank-order p-value is anti-conservative for strongly autocorrelated linear-Gaussian nulls (finite-N IAAFT bias, Kugiumtzis 2002).
• Measured operating characteristic. A labelled ground-truth battery (deterministic chaos vs linear-Gaussian / white-noise nulls) is recomputed each CI run. Power held at 1.000 on Hénon/logistic; null false-positive rate restored to ≤ α on every class. Reproducible via tools/calibrate_operating_characteristic.py; full result in artifacts/operating_characteristic.json.

Supply chain

• All GitHub Actions hash-pinned to commit SHA; renovate.json + Dependabot cooldown/grouping keep them fresh.
• scorecard.yml / release-artifact.yml token permissions moved to job level (Token-Permissions 10; Scorecard publishing unblocked).
• zizmor static workflow audit in CI; persist-credentials: false on all checkouts.
• SLSA Build L3 provenance (bsff-v0.3.0.intoto.jsonl) attached to this release; subject digests cryptographically bind the published wheel and sdist.

Verification

• 90 tests; coverage ~87%. All contract gates + zizmor green.
• Provenance subjects verified byte-for-byte against the release artifacts.

This kernel reports whether a claim survived the configured falsification attacks. It does not prove BCI claims, is not externally validated against TISEAN, and is not regulatory validation.

BSFF v0.2.0

Falsification-first BCI/EEG claim kernel. Reference covariance validation, MIAAFT benchmark matrix, pipeline.run() alias, deterministic SURVIVED/REFUTED/UNSUPPORTED trichotomy, MOABB example, JOSS scaffold. 38/38 tests, CI green, tokenless PyPI publishing wired (Trusted Publishing).