kxco-pq-audit 1.4.2 → 1.4.3

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.4.3
+
+Documentation. No source change.
+
+The release-integrity lines now name the version that SLSA provenance and
+the CycloneDX SBOM start from, and the keyword list drops `quantum-safe`,
+which was removed on purpose in an earlier release.
+
+Every GitHub Action in CI is now pinned by commit SHA, as the page states.
+
 ## 1.4.2
 
 Documentation. No source change.

package/README.md

@@ -292,10 +292,10 @@ The checkpoint provides an on-chain timestamp proving that at least N entries ex
 
 ## Release integrity
 
-Each release carries a SLSA provenance attestation tying the published tarball to
+Every release since 1.2.0 carries a SLSA provenance attestation tying the published tarball to
 the commit and workflow that built it: verify with `npm audit signatures`, or read
 it from `registry.npmjs.org/-/npm/v1/attestations/kxco-pq-audit@<version>`. A CycloneDX
-SBOM is published as a GitHub Release asset at
+SBOM is published, from v1.2.1, as a GitHub Release asset at
 `releases/download/v<version>/sbom.cyclonedx.json`, a permanent unauthenticated
 URL. Sibling `kxco-*` packages sit on caret ranges so a correctness fix in the
 base package reaches you on the next install, with no release of every package
@@ -309,8 +309,8 @@ Evidenced, and reproducible on your own machine:
 
 - **1,793 NIST ACVP vectors passed, 0 failed** across FIPS 203, 204 and 205, pinned by digest, per [CONFORMANCE.md](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/CONFORMANCE.md). The other 310 are pairings the library refuses as weaker than the parameter set
 - **225 interoperability checks passed, 0 failed**, against OpenSSL 3.5, liboqs, Bouncy Castle and dilithium-py/kyber-py, in both directions
-- **SLSA provenance** on every published release: verify with `npm audit signatures`
-- **CycloneDX SBOM** published with each release
+- **SLSA provenance** on every release since 1.2.0: verify with `npm audit signatures`
+- **CycloneDX SBOM** published with every release since 1.2.1
 - `npm run evidence` regenerates the whole bundle from source
 
 Dependency audit history is recorded in [AUDIT.md](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/AUDIT.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kxco-pq-audit",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "description": "Tamper-evident post-quantum audit trail for regulated institutions. ML-DSA-65 signed, SHA-256 hash-chained entries: any edit, gap or reorder fails verification and names the entry. 46,544 entries a second sealed, with checkpoints anchored on Armature L1.",
   "keywords": [
     "post-quantum",
@@ -20,7 +20,6 @@
     "immutable-log",
     "signed-log",
     "sequence",
-    "quantum-safe",
     "pqc-migration",
     "digital-signature",
     "soc2",