@clearproof/content 0.5.0 → 0.6.0

package/content/topics/circuits.md

@@ -56,6 +56,17 @@ Some acceptance properties live outside the circuit. The authorization service c
 
 `ComplianceProof(20, 10)` in `compliance.circom` publishes 16 values, including `is_compliant`, a tier-derived `sar_review_flag`, the amount tier, the jurisdiction and the tier thresholds. It remains a demo and parity path with its own verifier, SDK function and tests. Legacy proofs are never current pilot authorization.
 
+## Source package
+
+`@clearproof/circuits` publishes these sources for inspection and compilation, with no compiled artifacts or keys (from 0.6.0; 0.3.0 and earlier were an outdated legacy-only package with development artifacts). Install it with `circomlib` and compile with `-l node_modules`:
+
+```bash
+npm install @clearproof/circuits circomlib
+circom node_modules/@clearproof/circuits/circuits/pilot_compliance.circom -l node_modules --r1cs --wasm
+```
+
+`circuits/MANIFEST.json` in the package lists the SHA-256 of each repository file and each packaged file; the only change is that `circomlib` includes are rewritten to `circomlib/...`. `circomlib` is licensed GPL-3.0 and is a peer dependency, not bundled.
+
 ## Building development artifacts
 
 ```bash

package/content/topics/quickstart.md

@@ -11,17 +11,17 @@ This is a development setup guide, checked September 25, 2026. Use synthetic dat
 
 ## Public package access
 
-The [main source repository](https://github.com/repfigit/clearproof) is public. Public npm packages are available at version 0.3.0:
+The [main source repository](https://github.com/repfigit/clearproof) is public. npm packages are at version 0.6.0:
 
 ```bash
-npm install @clearproof/proof@0.3.0
+npm install @clearproof/proof@0.6.0
 ```
 
 Proof generation requires compatible circuit WASM and proving-key files. Verification requires the matching verification key. Inspect package contents before relying on exported artifact paths; installing the SDK alone does not create a complete proving environment.
 
-The 0.3.0 packages predate the pilot and cover the legacy 16-signal profile only. The source checkout (0.4.0, unpublished) contains the pilot. Do not assume they are the same.
+0.6.0 includes the pilot and the current `pilot-transfer-v3` profile. `@clearproof/circuits` publishes the circuit sources only, with no compiled artifacts or keys.
 
-The published CLI currently cannot be installed from the public registry because its `@clearproof/content` dependency is unavailable. The standalone proof SDK installation was verified. Use a source checkout for CLI evaluation. The source setup below was verified from a clean clone of `main` on September 15, 2026 at commit `1c8d385` (locked workspace install, workspace build, built-CLI `--help`, Python sync and the Python unit suite); it covers the documented commands, not the circuit compilation path shown later, which additionally requires circom and Powers of Tau inputs.
+The CLI installs from npm with `npm install -g @clearproof/cli` (verified September 26, 2026). The source setup below builds the same workspaces and adds the Python API, circuits and pilot acceptance tooling.
 
 ## Source setup for the unreleased pilot
 

package/content/topics/sdk.md

@@ -7,15 +7,15 @@ cli-topic: sdk
 
 # TypeScript SDK
 
-`@clearproof/proof` provides proof generation, cryptographic verification and counterparty discovery. Published version: **0.3.0**, checked September 25, 2026. That release predates the pilot: it covers the legacy 16-signal profile only. The pilot functions described below exist in the source checkout (0.4.0, unpublished). Confirm the installed version before using its types.
+`@clearproof/proof` provides proof generation, cryptographic verification and counterparty discovery. Published version: **0.6.0**, checked September 26, 2026. It includes the pilot functions and the legacy 16-signal functions described below. Confirm the installed version before using its types.
 
 ## Installation
 
 ```bash
-npm install @clearproof/proof@0.3.0
+npm install @clearproof/proof@0.6.0
 ```
 
-## Legacy proof API (in the published 0.3.0 package)
+## Legacy proof API
 
 ```typescript
 import { generateProof, verifyProof, type ComplianceInput } from '@clearproof/proof';
@@ -32,7 +32,7 @@ The caller supplies compatible artifacts. The SDK maps camelCase fields to Circo
 
 `verified.valid` describes cryptographic verification. `isCompliant` and `sarReviewFlag` interpret circuit outputs; they do not establish full registry acceptance, current policy authorization or legal compliance. Additional trust, freshness, revocation, domain and replay checks remain necessary.
 
-## Pilot functions (source checkout)
+## Pilot functions
 
 | Function | Purpose |
 | --- | --- |

package/content/topics/security.md

@@ -28,6 +28,6 @@ Use synthetic records and testnet funds. Check approved issuer/root/artifact pro
 
 ## Vulnerability reporting
 
-The repository security policy lists **security@clearproof.dev** as its reporting address. Share reproduction steps and impact privately; do not post sensitive exploit details or personal information in a public issue. This documentation does not verify mailbox operation or promise a response-time SLA.
+[Report privately through GitHub](https://github.com/repfigit/clearproof/security/advisories/new) (preferred) or email **security@clearproof.dev**. Share reproduction steps and impact privately; do not post sensitive exploit details or personal information in a public issue. See [report an issue](/docs/report-issues). This documentation does not promise a response-time SLA.
 
 No active paid bug-bounty program is announced here. See [project status](/docs/status) for the implementation and assurance work that remains.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clearproof/content",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Single source of truth for all clearproof developer-facing content",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",