TAP-SEC Reference Implementation M4 v0.3.2: Local-Host Boundary Validation, Fail-Closed Recovery, and Public Evidence

TAP-SEC Reference Implementation M4 v0.3.2 is a public-safe research software artifact for local-host boundary validation, fail-closed recovery, continuity classification, witness-bound memory updates, formal safe/unsafe profiles, and reproducible public evidence. Status M4_PARTIAL_PASS_WITH_BLOCKED_GATES M4_LOCAL_HOST_BOUNDARY_PASS=true M4_FULL_PASS=false NOT_NORMATIVE NOT_PRODUCTION_READY The final fixture aggregate is: 16 PASS 24 PASS_FAIL_CLOSED 2 BLOCKED_EXTERNAL 0 FAIL 42 fixtures total The tested local-host boundary passed. Four external physical-evidence gates remain explicitly blocked and are not counted as passes: G05 — no distinct pinned remote witness outside the same host. G06 — no physically separate append-only witness failure domain. G07 — no physical non-exportable TPM/HSM custody. G13 — no direct Katy-attributable Joule telemetry. Exact software artifact TAP_SEC_REFERENCE_IMPLEMENTATION_M4_v0_3_2.zip SHA-256: 6760ee89bc92b9d8fea0de6a1642399ae3b126e7fa4508ac8f4921ab3de65942 Validation summary The final public artifact passed: 183/183 contract-bound tests; 672/672 public checksum records; 671/671 package-manifest records; 143 JSON parsing checks; 154 YAML parsing checks; 40/40 fixture evidence hash bindings; two clean extractions; public-safety validation; release-coherence validation; byte-identical final ZIP rebuilding. The artifact is public-safe and technically ready for scholarly distribution as an immutable local partial release. It is not a full M4 pass, a production-safety certificate, a normative standard, or an authorization for deployment in a production or safety-critical environment. GitHub resources Repository: https://github.com/Kot141078/tap-sec-reference-implementation Release: https://github.com/Kot141078/tap-sec-reference-implementation/releases/tag/m4-v0.3.2 Tag: https://github.com/Kot141078/tap-sec-reference-implementation/tree/m4-v0.3.2 Exact commit: https://github.com/Kot141078/tap-sec-reference-implementation/commit/0e8850e4cde357287764f6c2dc5aec2d950954b9 Git commit SHA: 0e8850e4cde357287764f6c2dc5aec2d950954b9 DOI 10.5281/zenodo.21688521 Author and rights holder Ivan Kotov Independent Researcher, Brussels, Belgium ORCID: 0009-0009-6002-9845 Copyright and licensing Copyright © 2026 Ivan Kotov. All author-owned rights remain vested in Ivan Kotov. Author-owned software, formal specifications, tests, validators, schemas, registries, deployment templates, and other machine-executable materials are licensed under the Apache License 2.0. Author-owned documentation, academic reports, diagrams, publication metadata, and public evidence are licensed under Creative Commons Attribution 4.0 International. Third-party and excluded materials remain under their original terms. AI tools were used under the author’s direction for drafting, implementation assistance, test orchestration, document production, and machine-assisted review. They are not authors, rights holders, independent human peer reviewers, certifiers, or endorsers. Metadata clarification The artifact declares 2026-07-29 as its document and version date. The first public GitHub Release was published on 2026-07-30T20:59:00Z. In Section 7 of the License, Citation, and Reuse Guide, “datacite.json” should read “datacite.xml”. No separate “RELEASE_CLAIMS.json” is distributed. The authoritative machine-readable release claims are provided by “PUBLICATION_STATUS.json” and “PUBLICATION_MANIFEST.json”. The GitHub repository additionally retains “.zenodo.json”.