provared 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,90 @@
 # Changelog
 
+## 0.3.0 (10 October 2026)
+
+- 2026-10-10: **a development stand-in for a passkey**, `provared/dev`
+  in JavaScript and `provared.dev` in Python, so that a first record can
+  be made without a browser: `developmentPasskey` (an ES256 key made in
+  memory that returns the three values a passkey returns, for the page
+  address `http://localhost`), `developmentSlip` (a slip it signed, with
+  new keys for the agent, a book holding the slip, and the stand-in's
+  thumbprint for a checker) and `developmentRecorder` (the stub writer
+  opened under such a slip, in one call). It is not a passkey and no
+  person confirms anything through it, so the issuer's name in every
+  slip it signs is made to end with " (development)", whatever name is
+  given, and the checker prints that name. The library itself (`provared`)
+  does not export it, and the checker does not use it. A first record in
+  one file: `examples/first-record.mjs` and
+  `python/examples/first_record.py`, each run by a test.
+- 2026-10-10: `provared-check --sample` checks the sample record that
+  comes with the library, naming the stand-in passkey, the recorder and
+  the time-stamp service it was made with as trusted, and prints their
+  fingerprints; with `--json` the result alone. A file or another option
+  given with it is refused.
+- 2026-10-10: the README is now a short landing page (install, a first
+  record, the four parts, what is only here, what a record does not
+  prove, where everything else is), and its former body is
+  `docs/guide.md`, unchanged but for the additions above. New:
+  `SECURITY.md` (how to report a fault in the security of a record) and
+  `CONTRIBUTING.md` (fault reports and other implementations welcome;
+  code only under a contributor agreement, whose text is not ready yet).
+  `package.json` and `python/pyproject.toml` gain a homepage, keywords
+  and a longer description. Version 0.3.0 in both, not yet published.
+- 2026-10-10: the pages at prova.red: the home page's first screen now
+  shows the checker's summary and the install lines before the four
+  parts, with the plain word first and the short name after ("the
+  permission (a Slip)"); a first record of your own, in three commands,
+  with the file above and the LangChain package; "what the author found
+  nowhere else (October 2026)"; the status promises that every published
+  version stays on npm and the Python Package Index. The plain-words page
+  says that the 25 rounds of review were by AI reviewers and that no
+  person other than the author has reviewed the code yet, gives the date
+  from which the EU AI Act's logging duty applies (2 December 2027),
+  marks its charity example as invented, and uses "flight recorder" only
+  as a description. The developer page shows the code that made the
+  sample record and says the same about the reviews. All three pages
+  gain preview tags, an icon (`favicon.svg`, four coloured squares) and
+  a preview image (`preview.png`, drawn from a small page in a headless
+  browser), with the content security policy widened by `img-src 'self'`
+  only; `robots.txt` and `sitemap.xml` are added, and the workflow copies
+  everything in `site/`. Nothing in the library changes for this.
+- 2026-10-10: the pages for prova.red, in `site/`: what a record
+  proves, the command-line checker's own answer for the sample record
+  (run on Node.js 24.19), how to try it, what is only here, how it is
+  built, where it is, a worked example for developers ("An agent goes
+  over its limit, and the record shows where") and "Provared in plain
+  words", three minutes for a reader who does not write code, with two
+  drawings that follow the sample record. No script, no font, no image,
+  no form: each page loads nothing from anywhere and keeps nothing about
+  a reader, and says so. The drawings carry their colours as plain SVG
+  attributes as well as through the style sheet, and the pages load the
+  style sheet under a versioned address, so a browser that kept an
+  earlier copy still draws them right. A workflow, `.github/workflows/pages.yml`,
+  publishes them with GitHub Pages from the main branch, with the
+  checking page at `/check/` (with the library and the sample it loads,
+  copied as they are) and built as one file at `/provared-check.html`.
+  The four actions it uses are GitHub's own, each pinned to the commit
+  of a released version. The site is not published until the domain
+  points at it. Nothing in the library, the checker or the package
+  changes.
+- 2026-10-08: two small Python packages for agent frameworks, in
+  `python/integrations/`, each in a folder of its own, which names its
+  framework. Each puts every tool call of an agent behind the stub
+  writer with no change to the tools: the check before acting is asked,
+  the tool runs only if the slip allows it, and a stub is written; a call
+  that is not allowed is not run, and the model is told why. Each checks
+  the call as the tool receives it: one must come last among the parts
+  that wrap tool calls, and refuses to run otherwise; the other wraps
+  each of the agent's own sets of tools, wherever it stands. Each works with ordinary
+  and asynchronous agents: the stub writer runs in a thread of its own
+  for each call, and cancelling a run cancels a tool that is waiting.
+  Each is tested with its framework's own stand-in model, inside the
+  examples' guard. An independent review found eight faults in the first
+  draft, among them a reviewer's change that got past the slip and
+  asynchronous agents that could hang; each is fixed and tested. They use
+  only the public interface of the `provared` package, which itself still
+  names no product. Not yet published.
+
 ## 0.2.0 (8 October 2026)
 
 - 2026-10-08: version 0.2.0, for the npm package and, for the first