SemVer-Trust

SemVer-Trust Review Attestation Predicate — v0.2

https://semver-trust.dev/review/v0.2 is the successor predicate type for SemVer-Trust review attestations that can feed draft v0.10/v0.9/v0.8/v0.7/v0.6/v0.5/v0.4 release evaluation. It supersedes review/v0.1 for new conformance claims; v0.1 remains historical and verifiable under its legacy semantics only.

JSON Schema: schemas/review-v0.2.json.

The v0.2 review predicate binds:

• the explicit specification, predicate, evaluator, repository identity, actor identity, source-control, and verification-time profiles used for evaluation;
• stable repository identity, merge context, and the pull-request or merge-request identity;
• the exact source revisions and final target revision covered by the review;
• canonical reviewer actor identities, credential identities, reviewer class, verdict, approval state, coverage mode, approval revision or approved diff, and whether the approval was still effective at merge;
• merge strategy and capture mode, including the information needed to evaluate squash/rebase workflows without pretending the post-merge commit already carries the original review facts.
• separate-execution evidence for agent review when the review is counted as independent agent corroboration.

Only qualified reviews can raise trust under draft v0.10: the verdict must be approved, the approval must be active at merge, the approved revision or diff must match the final reviewed content, and reviewer distinctness is evaluated on canonical actors rather than raw credentials. Comments, changes-requested reviews, stale approvals, withdrawn approvals, wrong-revision approvals, and non-independent agent reviews remain recordable as facts but do not count.

The predicate is intentionally closed except for declared extension maps. Any change that alters validation or interpretation requires a new predicate URI and schema.

This site is open source. Improve this page.