@nomosprotocol/sdk 1.3.2 → 1.3.3

package/README.md

@@ -113,10 +113,15 @@ NOMOS performs the entire verification locally:
 2. Verify each link's signature and check it hasn't expired.
 3. Check that no key in the chain has been revoked.
 4. Verify the artifact's own cryptographic seal against the resolved key.
-5. Evaluate the artifact's rules against the supplied facts.
-6. Return `AUTHORIZED`, `DENIED`, or `ESCALATED`.
+5. Check whether the issuer has revoked this exact sealed version (NOMOS-SPEC-006). A revoked
+   artifact returns `DENIED` with `revoked: true` and its rules are not consulted at all.
+6. Evaluate the artifact's rules against the supplied facts.
+7. Return `AUTHORIZED`, `DENIED`, or `ESCALATED`.
 
-(NOMOS-SPEC-006 artifact-version revocation — an issuer withdrawing one specific sealed version — is checked on the Exchange rail today; wiring the same check into this rail is a known gap, not yet done.)
+Step 5 is deliberately identical to what the Exchange rail does, and runs off the same shared
+lookup. Which rail you use must never change whether an authority still stands behind its own
+artifact — otherwise revocation would be bypassable by simply presenting the artifact a
+different way.
 
 No prior artifact lookup is required.
 
@@ -126,7 +131,7 @@ The relying party does not have to trust the AI vendor, the model, or a pre-exis
 
 The root key is deliberately supplied by the relying party. NOMOS does not define a universal default root of trust.
 
-This rail is currently a working prototype and is not yet a numbered NOMOS specification. A second independent implementation is still required before treating the wire format as interoperable infrastructure.
+This rail implements [NOMOS-SPEC-007](https://github.com/nomos-spec/spec/blob/main/spec/NOMOS-SPEC-007.md), published as **Draft**. It has exactly one implementation — this one — and makes no interoperability claim until a second, independent implementation exists; that's what publishing a Draft is for.
 
 ## `.nomos` — the portable authority artifact
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nomosprotocol/sdk",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "Official TypeScript SDK for the NOMOS governance runtime",
   "publishConfig": {
     "access": "public"