CML Local Alpha 0.1 — Continuity Validator

Check a document, preserve its last accepted state, and export a record you can verify offline.

If an edit fails validation, the current draft and the last accepted document remain distinct. Concurrent edits report a revision conflict instead of silently overwriting another window's work.

Alpha software · Local static document checks. A PASS applies to the document checked by the bundled compiler; it does not verify external execution.

Download alpha.2 · Setup requirements · Ten-minute test · Feedback template

Download and first test

1. Download the alpha.2 archive and its SHA-256 checksum.
2. Use the Windows + WSL requirements and verification steps below. Setup time is separate from the ten-minute test.
3. Follow the test script using the supplied sample: validate it, remove a required lock, and validate again. The expected result is FAIL for the edited draft while the previous accepted state remains available. Restore the lock and validate again.

The published alpha.2 archive exports unsigned receipts. Optional signing is available in the source checkout; see receipt signing and trust before choosing that path.

The app runs locally with an existing Node.js installation. It requires no cloud account, telemetry, or third-party package installation. See WHY_CML.md for project history and provenance.

Windows + WSL start

Use existing Windows 10/11 with WSL 2, Ubuntu, a non-root default WSL user, Windows PowerShell 5.1, and a modern browser. WSL needs Node.js >=18.19, bash, flock, and tar; existing nvm installations are supported. WSL interoperability and localhost forwarding must work. Port 4180 must be available or already serving this app. Complete setup is in TESTER_README.md.

Verify the downloaded prerelease archive against its adjacent .sha256 file using Windows PowerShell:

Get-FileHash .\cml-local-alpha-0.1.0-alpha.2.tar.gz -Algorithm SHA256

In WSL, replace YOUR_WINDOWS_USER and the archive path with your own:

mkdir -p "$HOME/cml-tester"
tar -xzf /mnt/c/Users/YOUR_WINDOWS_USER/Downloads/cml-local-alpha-0.1.0-alpha.2.tar.gz -C "$HOME/cml-tester"
cd "$HOME/cml-tester/cml-local-alpha-0.1.0-alpha.2"
node --version
command -v bash flock tar
explorer.exe "$(wslpath -w "$PWD/desktop")"

In that Explorer folder, right-click Install-CML-Local-Alpha.ps1 and choose Run with PowerShell. The installer creates or updates the Windows desktop shortcut CML Local Alpha using your extracted project path, WSL distribution, and default Linux user. Keep the extracted project in this permanent directory. If you extracted elsewhere, use that directory in the cd command instead.

Double-click CML Local Alpha. It checks for an existing server, starts one if needed, waits until ready, checks Windows access, and opens http://127.0.0.1:4180. Repeated clicks reuse the server; startup is serialized. The server binds only to 127.0.0.1. Startup errors remain visible in the window.

Fallback, from your extracted project directory in WSL:

bash desktop/ensure-server.sh

Then open the same URL manually. The server stays running after the launcher closes. To stop it, run pgrep -af 'node.*server.js', identify the PID whose full project path matches your extraction, and run kill PID. For a foreground start, run node server.js from the project directory and stop with Ctrl+C.

Use and persistence

1. Use the starter, create a new document, or load a UTF-8 .cml file.
2. Edit the name and source. Edits save after a short pause; Save now confirms persistence. Wait for “Saved locally” before closing.
3. Choose Validate document. Inspect error codes and jump to reported source lines. Accepted canonical plans and normalized IR are visible separately.
4. Export verification receipt downloads a JSON receipt for the current checked revision, whether PASS or FAIL. You can also download the .cml source.

Documents persist in WSL ~/.local/share/cml-local-alpha/ across browser and server restarts. Optional CML_ALPHA_DATA_DIR selects another local directory. Back up this directory before testing an existing installation; retain it when replacing the app. Each document has an atomic JSON file. Accepted state survives a failed edit. Revisions prevent another window from silently overwriting changes; reload the document if a conflict occurs. The last 20 checks are retained. Maximum source size is 256 KiB.

The unchanged compiler snapshot is CML Reference Compiler 1.2.0-alpha.0. evidence/COMPILER_PROVENANCE.json records reused files and hashes; licenses and notices are under vendor/compiler/. No robotics telemetry, launch control, or benchmark components are included.

Receipts are reproducibility records and may include complete current and last-accepted source. The published alpha.2 archives produce unsigned receipts. This source checkout also supports optional local Ed25519 signing: configure CML_RECEIPT_SIGNING_KEY when starting the server to sign new exports, or sign a separate copy using sign-receipt.js. A configured invalid or unavailable key stops startup rather than falling back to unsigned exports. See receipt signing and trust for owner-local key setup, commands, and replacement guidance.

Offline verification rechecks internal consistency with the bundled compiler. A signature verified against an independently trusted public key additionally authenticates that key holder's endorsement. It does not establish the document's original author, creation time, custody, or external execution. Prepare sample-only content before exporting for public sharing. Altering a receipt body invalidates its existing digest and signature, if present; label any sanitized excerpt clearly rather than presenting it as the original receipt.

From your extracted project directory, use the actual downloaded receipt path:

node verify-receipt.js /mnt/c/Users/YOUR_WINDOWS_USER/Downloads/RECEIPT.json

For a signed receipt, supply the public key confirmed separately with its owner:

node verify-receipt.js SIGNED.json --trusted-key /path/to/confirmed/signing.public.pem

--trusted-key requires a signature and rejects unsigned receipts. Verification reports authentication.status as trusted-signature or unsigned separately from the receipt's PASS/FAIL verdict. Both modes keep externalExecutionVerified false.

What validation covers

Local-only static validation. A PASS means static acceptance by CML Reference Compiler 1.2.0-alpha.0 only. It does not establish runtime execution, rendering, timing verification, safety certification, human-behavior proof, deployment, or launch authority.

Verification and feedback

From the extracted project directory, run the existing tests:

node tests/run.js

Tests exercise the compiler, persistence, accepted-state preservation, receipts, concurrent edits, simulated browser workflows, and HTTP handlers in memory. They do not require network access. These tests do not verify Windows shortcut installation, live loopback serving, or browser rendering; those require manual checks on the tester's machine.

Follow the 10-minute test script and record results in the feedback template. Use only sample data in shared receipts, since receipts include complete source.