13.0 RELEASE PROOF.
A release is a chain of identities. Tag, commit, package, manifest and reproduction have to agree. “It built on my machine” is not a release identity.
00 immutable Git identity
TAG v13.0.0 TAG OBJECT 81f36fa28a8caa343145b01632e7563c089a87cc PEELED 3b68536dc280dade3afde1620eeffbeb0309ec97 CLASS VIRTUAL_QUALIFIED_SOFTWARE_FINAL
10 package identity
ZIP dbyte-v13.0.0-windows-x64.zip BYTES 4016724 ENTRIES 536 RUNTIME 25 SHA256 40468ef823543b23638d633fbfc5e7e82b6da23ce4659238a3c427f2916337d9 MANIFEST SHA bd663298e02aa1c195799851a744d951f4a657c6735eed0f725e82695ff1da9c
The website package was independently reproduced twice from the exact tagged source with line-ending conversion disabled. Both ZIPs produced the same SHA-256 and the package verifier passed. This matters because ordinary Windows checkout conversion can change text bytes and invalidate deterministic source provenance even when Git history itself is correct.
20 binary identities
dbyte.exe 645b1277116f7681c1abbf40777992a12b259f150826bccdb51b16a63e4a7d98 dbytec.exe 645184f0aa838851ac5d37fc0322377a780eb55926f0aac41ce0c9f7e24b84f6
30 language release receipt
The language release recorded final receipt SHA-256 bf177552f4c75e70d6c7dd38b7de6a48f5520d71b3fed6f43aadb08556f5412f. The website does not replace that evidence; it mirrors the stable source contracts and publishes independently reproduced package bytes.
40 raw evidence
50 explicit non-claims
Physical BIOSTAR qualification remains pending. Real storage is disarmed. Full OS is pending. The release proves the named software/virtual contract, not those future boundaries.
60 reproducing the package
The deterministic Windows package is sensitive to source bytes, including line endings. An ordinary Windows checkout with automatic CRLF conversion can therefore fail source-provenance checks even when it points at the correct Git commit. The accepted reproduction used an isolated exact-tag checkout with line-ending conversion disabled, then ran the project packager twice and required byte-identical ZIP output.
A release verifier should bind the peeled commit, tag object, package manifest, ZIP hash, binary hashes and clean extraction smoke. If one identity changes, dependent evidence is stale. The correct response is to rebuild or reclassify the candidate, not to edit an expected hash until the test turns green.