build(deps): bump qatq from 0.3.0 to 0.4.2

[dependabot]

Bumps qatq from 0.3.0 to 0.4.2.

Release notes

Sourced from qatq's releases.

QATQ v0.4.2: KV Geometry Relevance Gate

QATQ v0.4.2 adds a separate research-only profiler that tests Capacity Oracle against real KV-cache geometry without changing Oracle theorem or certificate semantics.

What changed

• qatq-kv-geometry profile reports bounded norm, cosine, angular, duplicate, spectral, token-position, and descriptive binary metrics from versioned KV captures.
• Exact computation is used for compact groups; larger groups use deterministic pair sampling with explicit coverage, error metadata, block processing, and hard resource ceilings.
• A reproducible llama.cpp corpus publishes 36 profiles across Qwen2.5 and Phi3 families, three prompt and context regimes, f16 and bf16, selected layers, all exported KV heads, keys and values, and three partition layouts.
• Every result bundle and the complete corpus are SHA-256 bound and checked in CI.

Decision boundary

Real post-RoPE key groups were highly correlated, with median maximum cosine similarity 0.954426, and the study found no defensible application capacity requirement. The evidence therefore freezes further Capacity Oracle theorem expansion and prioritizes live cold-page KV compression research. The profiler emits observations only and never emits an Oracle verdict.

The pinned exporter did not expose matched pre-RoPE keys. External human coding-theory review remains outstanding and is not claimed.

Read the decision report, release evidence, or machine-readable corpus.

Install

Install all production CLIs with the release installer:

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/kabudu/qatq/releases/download/v0.4.2/qatq-installer.sh | sh

Or install the crate with both research features enabled:

cargo install qatq --version 0.4.2 --features oracle,geometry --locked

QATQ v0.4.1: Independent Capacity Validation

QATQ v0.4.1 strengthens the evidence behind Capacity Oracle without changing its theorem set, certificate semantics, codec, or wire formats.

What changed

• A separate SageMath 10.6 implementation reproduces all 27 published binary Hamming and spherical Rankin certificate rows.
• The independent implementation imports neither QATQ source code nor expected numeric answers.
• A deterministic differential corpus now publishes requests, certificates, exact comparisons, hashes, and pinned environment versions.

Validation status

• Checkable by QATQ: Complete. All 27 certificates pass the production checker.
• Reproduced by separate software: Complete. All 27 rows agree in SageMath.
• Externally reviewed by a person: Not complete. No human coding-theory review is claimed.

Read the full release evidence or inspect the machine-readable corpus.

Install

... (truncated)

Changelog

Sourced from qatq's changelog.

0.4.2 - 2026-08-01

Added

• Added the feature-gated qatq-kv-geometry research binary with versioned capture and result contracts, bounded exact or deterministic-sampled pair analysis, norm, cosine, angular, duplicate, spectral, and descriptive binary metrics.
• Added a reproducible 36-profile llama.cpp evidence corpus spanning Qwen2.5 and Phi3 families, three prompt and context regimes, f16 and bf16, selected layers, all KV heads, and three partition layouts.

Changed

• Froze further Capacity Oracle theorem expansion after the geometry gate found high real-capture correlations and no defensible application capacity requirement; Capacity Oracle certificate semantics remain unchanged.

0.4.1 - 2026-08-01

Added

• Added a pinned, network-disabled SageMath 10.6 implementation that separately reproduces all 27 published binary Hamming and spherical Rankin certificate rows without importing QATQ code or expected numeric answers.
• Added a deterministic differential corpus with requests, certificates, SHA-256 manifests, exact per-row comparisons, environment versions, and a CI gate against the published machine-readable results.

Changed

• Distinguished certificates that are checkable by QATQ, reproduced by separate software, and externally reviewed by a person. No completed external human review is claimed.

0.4.0 - 2026-08-01

Added

• Added the feature-gated qatq-oracle binary and qatq::oracle library API for strict binary/spherical capacity requests, deterministic normalization, and SHA-256 request binding.
• Added independently checkable finite impossibility certificates for the exact binary Hamming bound and spherical Rankin bounds at maximum inner product s <= 0.
• Added fail-closed certificate checking, adversarial schema/arithmetic tests, logical exit statuses, and atomically published evidence bundles.

Changed

• Cargo-dist production archives now enable the oracle feature and include the separate qatq-oracle executable without changing QATQ or QATC wire formats.

Commits

• b099cac release: prepare QATQ 0.4.2
• 6b9dd4d feat: add bounded KV geometry relevance gate
• 659d41d ci: forbid em dashes in project text (#35)
• 5f6df18 ci: prevent hard-wrapped release notes (#34)
• dc81da5 Release QATQ 0.4.1 (#33)
• 49302da Add independent SageMath certificate validation (#31)
• 05ba39e Release QATQ 0.4.0 (#30)
• 03d8426 Add finite Capacity Oracle certificates (#29)
• d691a12 Evaluate exact 4+1 shared exponents (#28)
• c757636 Evaluate reversible cross-stream lifting (#27)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)