quantum-reasoning-skill 1.1.1 → 1.1.3

package/README.md

@@ -10,11 +10,11 @@ alive, tests each against evidence and tools, revives alternatives when new evid
 and collapses to the best-supported answer only at the end. It is a **metaphor, not quantum
 computing** — "measurement" means letting evidence collapse a branch.
 
-> **Status: protocol implemented, effectiveness not yet demonstrated.** The skill contract,
-> the reference controller and the benchmark harness are here and run. **No
-> baseline-vs-skill model evaluation has been published**, so this project makes **no claim
-> that it improves accuracy or costs less compute.** See
-> [Benchmark status](#benchmark-status) before citing any number from here.
+> **Status: protocol implemented, controller benchmark published, model evaluation pending.**
+> The skill contract, the reference controller, the benchmark harness and a deterministic
+> falsification benchmark are here and run. **A baseline-vs-skill model evaluation has NOT
+> been published**, so this project makes **no claim that it improves any language model's
+> accuracy.** See [Benchmark status](#benchmark-status) before citing any number from here.
 
 ## Quick start
 
@@ -30,7 +30,7 @@ python docs/quickstart.py
 pip install quantum-reasoning-skill
 quantum-reasoning --validate
 
-# 3. from npm — also published, 1.1.0
+# 3. from npm — also published
 npm i quantum-reasoning-skill
 npx quantum-reasoning --validate
 ```
@@ -54,7 +54,33 @@ Three channels ship `SKILL.md`, all on one version: a `git clone` (everything);
 wheel (`SKILL.md` + `VERSION` as package data, plus `reference/`, `benchmark/`, `docs/`,
 `examples/`, and a `quantum-reasoning` console script); and the npm tarball (`SKILL.md`,
 `VERSION`, `index.js`, `LICENSE`, `README.md`, and a `quantum-reasoning` bin). Both packaged
-artifacts are verified against the **built** artifact, not a checkout. Versions are locked
+artifacts are verified against the **built** artifact, not a checkout.
+
+### Supply-chain attestations
+
+Only some published versions carry a build attestation, so check before relying on one:
+
+| release | npm attestation | PyPI PEP 740 attestation |
+| --- | --- | --- |
+| `1.1.0` (npm) | yes — SLSA provenance and npm publish attestation, Sigstore | n/a |
+| `1.1.1` (npm and PyPI) | **no** | **no** |
+
+`1.1.1` was published through the long-lived-token path, which cannot produce a Sigstore
+attestation. Attestations are bound to a publish event and cannot be added afterwards, so
+this is permanent for that version. The package itself is unchanged and passes the same
+release contract as every other version; only the provenance *record* is missing.
+
+If you need to verify how a build was produced, use `1.1.0` on npm. To check an attestation
+yourself:
+
+```bash
+curl -sS -o /dev/null -w '%{http_code}\n' \
+  https://registry.npmjs.org/-/npm/v1/attestations/quantum-reasoning-skill@1.1.0   # 200
+curl -sS -o /dev/null -w '%{http_code}\n' \
+  https://registry.npmjs.org/-/npm/v1/attestations/quantum-reasoning-skill@1.1.1   # 404
+```
+
+A missing attestation is not evidence of tampering. Versions are locked
 across `VERSION`, `pyproject.toml`, `package.json`, `CITATION.cff` and `CHANGELOG.md` — read
 the value from `VERSION`, not a badge ([details](CONTRIBUTING.md#toolchain-pinning)).
 
@@ -155,9 +181,22 @@ trivially answerable questions should not pay branching cost.
 
 ## Benchmark status
 
-**There are no published benchmark results.** `benchmark/cases.jsonl` holds six deterministic
-smoke-test cases that prove the harness runs; they are explicitly **not sufficient evidence of
-reasoning improvement**. Anyone can evaluate on models they have access to; every submitted
+**What has been measured — the controller, not the model.** On 9 deterministic falsification
+scenarios, the multi-hypothesis branch controller achieved **100% final accuracy versus 22%**
+for a single-hypothesis policy that commits to its first leader (0/4 on falsification
+scenarios, 0/3 on revival scenarios; both policies scored 2/2 on the control scenarios). It
+abandoned the falsified hypothesis at the same evidence step the falsification arrived, and
+revived a rejected-then-supported alternative in 3/3 revival scenarios. Confidence calibration
+showed **no difference** (Brier score 0.033 vs 0.033), and the accuracy gain cost **109.6%
+more tokens** per scenario. Methodology and reproduction:
+[`benchmark/falsification/METHODOLOGY.md`](benchmark/falsification/METHODOLOGY.md).
+
+These results measure the reference decision controller on **synthetic evidence streams**, not
+any language model. `benchmark/cases.jsonl` holds six deterministic smoke-test cases that
+prove the harness runs; they are explicitly **not sufficient evidence of reasoning
+improvement**. A baseline-vs-skill **model** evaluation has not been published, so this
+project makes **no claim that it improves any language model's accuracy or costs less
+compute.** Anyone can evaluate on models they have access to; every submitted
 number must carry provenance (script, skill commit, provider and exact model version, run date,
 sampling parameters, repetitions, platform), and one positive run establishes no general claim.
 Rules: [CONTRIBUTING.md](CONTRIBUTING.md#benchmark-provenance-requirements).
@@ -178,4 +217,4 @@ benchmarked against the rows above it.
 
 Everything lives in [`docs/index.md`](docs/index.md) — getting started, quickstart and its
 verified output, measurement methodology, host compatibility, report forms. Release history:
-[CHANGELOG.md](CHANGELOG.md). License: [MIT](LICENSE).
+[CHANGELOG.md](CHANGELOG.md). License: [MIT](LICENSE).

package/VERSION

@@ -1 +1 @@
-1.1.1
+1.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quantum-reasoning-skill",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "Quantum-inspired reasoning skill for exploring multiple solution paths",
   "main": "index.js",
   "bin": {