kxco-pq-network 1.0.2 → 1.0.3

package/ASSESSMENT.md

@@ -60,7 +60,14 @@ default TTL, and the README already states the consequence, which is that a
 revoked key stays accepted for up to that window.
 
 **Start and update.** No release signing of its own. Published through CI with
-npm provenance.
+npm provenance from 1.0.3 onward.
+
+1.0.2 and earlier carry no attestation, and the reason is worth recording
+because it was a stale constraint rather than a decision. `--provenance` was
+deliberately omitted while this repository was private, since npm signs
+provenance only for builds from a public source repository. The repository is
+public now. The flag outlived the reason for it, and 1.0.2 shipped without an
+attestation it could have had.
 
 ## Agility
 

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.0.3
+
+This release carries a SLSA provenance attestation. No source change.
+
+**`--provenance` is back on.** It was deliberately omitted while this repository
+was private, because npm signs provenance only for builds from a public source
+repository and a private one is refused with `E422 ... Unsupported GitHub
+Actions source repository visibility`. The repository is public now, so the
+constraint is gone. The flag outlived the reason for it, and 1.0.2 shipped
+without an attestation it could have had.
+
+Verify it with `npm audit signatures kxco-pq-network`. Until now the README
+pointed at `kxco-post-quantum` for the provenance claim, because that was the
+only package in the pair that could make it. This one makes its own from here.
+
 ## 1.0.2
 
 Documentation and a dependency refresh. No source change.

package/README.md

@@ -160,7 +160,12 @@ base package's, and it is reproducible on your own machine:
 - **2,103 NIST ACVP vectors: 1,793 passed, 0 failed, 310 skipped** across FIPS 203, 204 and 205, pinned by digest
 - **225 interoperability checks passed, 0 failed, 42 not applicable** against OpenSSL 3.5, liboqs, Bouncy Castle and dilithium-py/kyber-py, in both directions and with negative controls
 - **SLSA provenance** on every [`kxco-post-quantum`](https://www.npmjs.com/package/kxco-post-quantum) release — verify with `npm audit signatures kxco-post-quantum`
-- `npm run evidence` in that package regenerates the whole bundle from source
+
+This package carries its own evidence too, and from 1.0.3 its own attestation:
+
+- **SLSA provenance on this package**, from 1.0.3 onward — verify with `npm audit signatures kxco-pq-network`
+- `npm run evidence` here records what only this package can say: identity, its own tests, its SBOM, registry signature verification, and the `kxco-post-quantum` version actually installed rather than the range declared
+- `npm run evidence` in the base package regenerates the conformance bundle from source
 
 Third-party dependencies here are pinned to exact versions, never ranges, so the
 code that performs the cryptography cannot change without a release.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kxco-pq-network",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Three levels of proof for KXCO post-quantum envelopes: the signature alone, offline; the signature plus an Armature L1 anchor; and both plus a live key-registry lookup that fails closed. Shared across the kxco-pq packages.",
   "keywords": [
     "post-quantum",