NDDev-OpenNetwork · rldyourmnd · Sep 1, 2026 · Sep 1, 2026
diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml
@@ -2,17 +2,17 @@
 schema_version: 1
 
 bundle:
-  version: "0.4.0-dev"
+  version: "0.8.0-dev"
   release_sequence: 0
   channel: "development"
-  source_tree_digest: "sha256:376e0d4a5c11a6214ad70d8ceff8c01645fcf5a71fba332e94e4c2e6061e22a4"
-  digest: "sha256:681dfce12bea5d4826ba0516c9a1112da41e160abe68d213c27c241e07740821"
+  source_tree_digest: "sha256:9a48edf219942643d572a0105d19411a87cf2da8a22078790e3f5db57e990bbf"
+  digest: "sha256:3386cb4b176eff463c4b242ca44b1bd68595d74974de924fe899c507e2e0fa0e"
 
 projection:
-  input_digest: "sha256:1de3673910b83ab471567d083633ec096f4436e0727d068f37daebbf3d6e9ff5"
-  output_digest: "sha256:0e9aa2aa74c34b912b8b93e21da1d759ba0552fc55174898f8517d92dc95719c"
+  input_digest: "sha256:f388cf565a327cf867c1afebba066a8b7200aa0a5fecdb5491d8748b4682eadc"
+  output_digest: "sha256:13184a113afabd879c6cb8b407877cac36a62231be399503ebbd92637a1eebae"
   files:
     - path: ".gds/compiled-policy.json"
-      digest: "sha256:78d09606bb4168d74bce1f50ab62b46a7ded34652c6b23af1badfd26dd060e94"
+      digest: "sha256:b5517ed46f67866220c2b18dbfbda4a40d99f00327611e56742a118d0ac59d0b"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:28368b2b4b0e55ac288e9282739caf06b884a6297747c82104dd5a39bada3fce"
+      digest: "sha256:6e7399b2b2349ae7b3c43bca0aec2730371cd5dde04170028cb6a66845037fb6"
diff --git a/.gds/compiled-policy.json b/.gds/compiled-policy.json
@@ -2,8 +2,8 @@
   "schema_version": 1,
   "compiled_policy": {
     "repository_id": "repo_01M0EZ7TB3KNXNSP78Z8M64WXG",
-    "bundle_version": "0.4.0-dev",
-    "digest": "sha256:ebc9b06d74fa698cd1d612c7be8fb017cd76c93ba5882270e7b415b160ba7f2d"
+    "bundle_version": "0.8.0-dev",
+    "digest": "sha256:13fde780e078b9143e913db7cf706c8908b52c21ec51f28d26d3c9fdd715e080"
   },
   "sources": [
     {

diff --git a/.github/workflows/gds-ci.yml b/.github/workflows/gds-ci.yml
@@ -1,8 +1,8 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
-# bundle: 0.4.0-dev
-# source-tree-digest: sha256:376e0d4a5c11a6214ad70d8ceff8c01645fcf5a71fba332e94e4c2e6061e22a4
-# input-digest: sha256:1de3673910b83ab471567d083633ec096f4436e0727d068f37daebbf3d6e9ff5
+# bundle: 0.8.0-dev
+# source-tree-digest: sha256:9a48edf219942643d572a0105d19411a87cf2da8a22078790e3f5db57e990bbf
+# input-digest: sha256:f388cf565a327cf867c1afebba066a8b7200aa0a5fecdb5491d8748b4682eadc
 # output-digest: sha256:01fb4854784be9e4564bcc84e70786484b370879be5e5ab1dd49f8b73ea2dea4
 # edit-source:
 #   - .gds/repository.yaml

diff --git a/core/cli/root.go b/core/cli/root.go
@@ -19,7 +19,10 @@ import (
 	"github.com/NDDev-OpenNetwork/github-device-sync/core/harness"
 )
 
-var Version = "0.7.0"
+// Version is the development default; a release build overrides it with the
+// exact tag via -X. It carries the -dev suffix so an unstamped binary can
+// never claim to be a released one.
+var Version = "0.8.0-dev"
 
 type options struct {
 	json    bool

diff --git a/core/cmd/gds-controller/main.go b/core/cmd/gds-controller/main.go
@@ -23,7 +23,9 @@ import (
 	"github.com/NDDev-OpenNetwork/github-device-sync/core/webhooks"
 )
 
-var version = "0.4.0-dev"
+// version is the development default; the release builder stamps the exact
+// tag via -X main.version. The -dev suffix keeps an unstamped binary honest.
+var version = "0.8.0-dev"
 
 func main() {
 	ctx, stop := signal.NotifyContext(

diff --git a/core/compiler/types.go b/core/compiler/types.go
@@ -8,7 +8,11 @@ import (
 	"github.com/NDDev-OpenNetwork/github-device-sync/core/domain"
 )
 
-const DevelopmentBundleVersion = "0.4.0-dev"
+// DevelopmentBundleVersion stamps bundles compiled from policy sources on a
+// policy-owner checkout. It tracks the current release line with a -dev
+// suffix so a development bundle is dated honestly; the development channel
+// field, not this string, is what classifies the bundle.
+const DevelopmentBundleVersion = "0.8.0-dev"
 
 type PolicySource struct {
 	SchemaVersion int               `json:"schema_version"`

diff --git a/core/context/provenance.go b/core/context/provenance.go
@@ -68,15 +68,21 @@ func (prover *CanonicalPolicyProver) Verify(
 			err,
 		)}
 	}
-	if document.Bundle.Channel != "development" ||
-		document.Bundle.Version != compiler.DevelopmentBundleVersion {
+	if document.Bundle.Channel != "development" {
 		// Released candidates can only be produced from an archive that passed
 		// full envelope, manifest and member verification. The committed lock
 		// retains that artifact/content/attestation identity and the exact
 		// generated bytes; it deliberately does not require policy source copies
 		// in every consumer repository.
 		return nil
 	}
+	// The channel alone classifies the bundle. This used to also require the
+	// version to equal the current DevelopmentBundleVersion, which meant that
+	// bumping that constant silently reclassified every not-yet-regenerated
+	// development lock as released and skipped its source verification — the
+	// opposite of what a version bump should do. A development bundle carrying
+	// an older dev version is still a development bundle and is verified as
+	// one.
 	if estateRoot == "" {
 		return []domain.Finding{policyProvenanceFinding(
 			"GDS_CONTEXT_POLICY_ESTATE_NOT_PROVEN",

diff --git a/tests/golden/projections/control-plane/.claude/CLAUDE.md b/tests/golden/projections/control-plane/.claude/CLAUDE.md
@@ -1,9 +1,9 @@
 <!--
 GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
-bundle: 0.4.0-dev
+bundle: 0.8.0-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:68bb64d7bf23cbfbe3e1d2865285306c1198e556420ecbd3e7284873ab0de762
+input-digest: sha256:219ef57969079d002d66fee569234d522948f265bcca42505726642ef93571c1
 output-digest: sha256:88cb57297d8d713287872a8afaca8d42f7146ecf7a091e4996e65eee8f962665
 edit-source:
   - .gds/repository.yaml

diff --git a/tests/golden/projections/control-plane/.gds/bundle.lock.yaml b/tests/golden/projections/control-plane/.gds/bundle.lock.yaml
@@ -2,21 +2,21 @@
 schema_version: 1
 
 bundle:
-  version: "0.4.0-dev"
+  version: "0.8.0-dev"
   release_sequence: 0
   channel: "development"
   source_tree_digest: "sha256:0000000000000000000000000000000000000000000000000000000000000001"
-  digest: "sha256:d4645c8b942733304420ab2b92860914887b2cf90ea41dc6a836ac870a4b3182"
+  digest: "sha256:0226e28bcb10a18e1868f3af7ded0c27de1debd676ef23c64af9c4826436f506"
 
 projection:
-  input_digest: "sha256:68bb64d7bf23cbfbe3e1d2865285306c1198e556420ecbd3e7284873ab0de762"
-  output_digest: "sha256:5d8ae23fa17b98ebc32d062fc3c0b2db38b9c235bfe76aaba77b7d73ffe71466"
+  input_digest: "sha256:219ef57969079d002d66fee569234d522948f265bcca42505726642ef93571c1"
+  output_digest: "sha256:a1607491555e1ab5d2d782bce3b1cddf3386b3fa609be3864a9934365265b411"
   files:
     - path: ".claude/CLAUDE.md"
-      digest: "sha256:d44c29db06429be314480b8b013872c1b4df3c146c1b2aa31a57ffa2d89e3cf4"
+      digest: "sha256:ba65eecfa28d3e90c8141c115e684920700510e322783371e2e98b9e6d14835e"
     - path: ".gds/compiled-policy.json"
-      digest: "sha256:09752cc0cbe57dc3097f884927e2089a9730b9ebcf86ac27228812d54c5760f8"
+      digest: "sha256:24850d3c840160a5bef16753424da983b1e220984e2457fd22ee03ed278f1f1b"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:c3172226c6544ad5c99d25004b504c9be51fdc58ce27f062653313d9e4d56b99"
+      digest: "sha256:f0c853df6a9c564895c11fc7520621c0c59e9f24b86d476fcd4fd4cc2203dc62"
     - path: "AGENTS.md"
-      digest: "sha256:1b95a1c220648598dbad21f13ef947ea5881759f13276a9920350864b7600cc7"
+      digest: "sha256:730986b8d110ec0e6f26952c4b91a9dda8611f13d1b51bf7fd9e7d5114558e32"
diff --git a/tests/golden/projections/control-plane/.gds/compiled-policy.json b/tests/golden/projections/control-plane/.gds/compiled-policy.json
@@ -2,8 +2,8 @@
   "schema_version": 1,
   "compiled_policy": {
     "repository_id": "repo_01M0EZ7TB3KNXNSP78Z8M64WXG",
-    "bundle_version": "0.4.0-dev",
-    "digest": "sha256:b566e3cc1e46f30d55eec1545b6e22697be999a2c0d80fe27068319d3630443d"
+    "bundle_version": "0.8.0-dev",
+    "digest": "sha256:6253c6e0acd800613d125ec82cf08ed8ead053d4908de5438b3d710b4dc236e5"
   },
   "sources": [
     {

diff --git a/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml b/tests/golden/projections/control-plane/.github/workflows/gds-ci.yml
@@ -1,8 +1,8 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
-# bundle: 0.4.0-dev
+# bundle: 0.8.0-dev
 # source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-# input-digest: sha256:68bb64d7bf23cbfbe3e1d2865285306c1198e556420ecbd3e7284873ab0de762
+# input-digest: sha256:219ef57969079d002d66fee569234d522948f265bcca42505726642ef93571c1
 # output-digest: sha256:01fb4854784be9e4564bcc84e70786484b370879be5e5ab1dd49f8b73ea2dea4
 # edit-source:
 #   - .gds/repository.yaml

diff --git a/tests/golden/projections/control-plane/AGENTS.md b/tests/golden/projections/control-plane/AGENTS.md
@@ -1,10 +1,10 @@
 <!--
 GENERATED FILE - DO NOT EDIT DIRECTLY
 generator: gds
-bundle: 0.4.0-dev
+bundle: 0.8.0-dev
 source-tree-digest: sha256:0000000000000000000000000000000000000000000000000000000000000001
-input-digest: sha256:68bb64d7bf23cbfbe3e1d2865285306c1198e556420ecbd3e7284873ab0de762
-output-digest: sha256:670970518bda1458ad0fb14b276a6ba9add2ef7491ba406774e7094d159b7109
+input-digest: sha256:219ef57969079d002d66fee569234d522948f265bcca42505726642ef93571c1
+output-digest: sha256:ece934738d1ed0bb3532f6db213366f3d60c064e6c0aa79101b3c0b4a9e4e06c
 edit-source:
   - .gds/repository.yaml
   - policies/base/repository-default.yaml
@@ -66,6 +66,6 @@ GDS is the public engine for a multi-owner GitHub estate. It loads an external e
 
 ## Facts
 
-- Repository `repo_01M0EZ7TB3KNXNSP78Z8M64WXG`, roles `control-plane`, bundle `0.4.0-dev`.
+- Repository `repo_01M0EZ7TB3KNXNSP78Z8M64WXG`, roles `control-plane`, bundle `0.8.0-dev`.
 - Canonical inputs: `.gds/repository.yaml`; compiled result: `.gds/compiled-policy.json`.
 - Visibility `public`, data `public`.