causal-continuity-engine 0.1.0__tar.gz → 0.1.2__tar.gz

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/.github/CONTRIBUTING.md

@@ -89,13 +89,14 @@ just test                             # should be green before you change anythi
 ```
 
 Install gitleaks. It is load-bearing here, not decoration: GitHub's native
-secret scanning and repository push protection are unavailable on this private
-personal-account repository. The local hook catches a credential before it
-leaves the machine; the `secrets` workflow scans pull requests, pushes to
-`main`, and the full history weekly. The hook warns rather than refuses when
-gitleaks is missing, so that server-side scan remains visible after a local
-`--no-verify`. The committed ruleset makes it merge-blocking, but the live
-ruleset still requires only `ci`; see `.github/ruleset.README.md`. If a
+secret scanning and push protection are enabled on this repository, but both
+act only once content reaches GitHub. The local hook catches a credential
+before it leaves the machine; the `secrets` workflow scans pull requests,
+pushes to `main`, and the full history weekly. The hook warns rather than
+refuses when gitleaks is missing, so that server-side scan remains visible
+after a local `--no-verify`. The live ruleset requires `ci`, `attribution`,
+`secrets`, and `DCO`, so a failing scan blocks the merge; see
+`.github/ruleset.README.md`. If a
 synthetic test value trips the scan,
 allowlist it in `.gitleaks.toml` by value, never by path, so a real secret in
 the same file is still caught.
@@ -139,10 +140,9 @@ wheel. The `ci` job fans all those paths into one context.
 
 Attribution is not one of these, and it is not a lint rule. It is enforced by
 `.githooks/pre-commit` locally and by the `attribution` job in
-`.github/workflows/no-ai-attribution.yml`. The committed desired ruleset
-requires both `attribution` and `secrets`; the live ruleset does not yet,
-and that operational drift is a blocker documented in
-`.github/ruleset.README.md`.
+`.github/workflows/no-ai-attribution.yml`. The live ruleset requires both
+`attribution` and `secrets` to pass before a merge; the apply and read-back
+procedure is in `.github/ruleset.README.md`.
 
 `docs/CAPABILITIES.md` is generated, never hand-edited. If your change moves a
 symbol a claim points at, run
@@ -223,20 +223,20 @@ sdist, and checksum manifest to a separate draft-to-final publish job. See
 
 **Sign off your commits.** Contributions are accepted under the
 [Developer Certificate of Origin 1.1](https://developercertificate.org/), and
-external contributions are asked for a
+every commit in a pull request must carry a
 `Signed-off-by` trailer:
 
 ```bash
 git commit -s -m "fix(graph): bound traversal at the configured budget"
 ```
 
-This is not enforced today. There is no DCO app, workflow, or `commit-msg`
-check for the trailer, so a pull request is not yet blocked for missing it.
-Existing history predates enforcement and is not being rewritten merely to
-add trailers. The DCO app will be enabled, and its check made required, when
-the repository goes public. `git rebase --signoff` will add the trailer if you
-forget it on an unpublished branch. By signing off you certify the DCO's terms
-and license your contribution under the repository's Apache-2.0 license.
+This is enforced. The DCO app checks every commit in a pull request and its
+`DCO` check is a required status, so a pull request missing the trailer is
+blocked from merging. Existing history predates enforcement and is not being
+rewritten merely to add trailers. `git rebase --signoff` will add the trailer
+if you forget it on an unpublished branch. By signing off you certify the
+DCO's terms and license your contribution under the repository's Apache-2.0
+license.
 
 Keep the branch focused. One defect, one pull request. Do not reformat
 adjacent code, rename things you did not introduce, or clean up unrelated dead

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/.github/SECURITY.md

@@ -15,15 +15,14 @@ quarantine barrier, the redaction path, and the event and audit chains.
 
 | Version | Supported |
 |---|---|
-| Before the first release — latest commit on `main` | Yes |
+| Latest commit on `main` | Yes |
 | 0.1.x — latest published release | Yes |
 | Older releases and arbitrary commits | No |
 | Anything else | No such version exists |
 
 This is pre-1.0 software with no release branches. A fix lands on `main`; if it
 affects the latest published release, the supported delivery is a new 0.1.x
-patch release rather than mutating or backporting to an older artifact. Before
-the first release, the reviewed tip of `main` is the only supported version.
+patch release rather than mutating or backporting to an older artifact.
 
 Hosted CI requires fixes to pass on Python 3.11, 3.12, 3.13 and 3.14 on Linux,
 and on Python 3.14 natively on Windows and macOS 15 ARM64.
@@ -34,24 +33,11 @@ and on Python 3.14 natively on Windows and macOS 15 ARM64.
 either — if you are unsure whether something is a vulnerability, treat it as
 one until it has been triaged.
 
-**While this repository is private, there is no reporting channel at all.**
-GitHub's private vulnerability reporting is unavailable to outside
-reporters; repository security advisories are unavailable on private
-repositories under this account, so there is no draft advisory to open even
-with repository access; GitHub has no user-to-user messaging; and the
-maintainer's GitHub no-reply address does not accept inbound mail. This
-project is therefore **not soliciting external security reports** while it
-is private. If you have found something, hold the report until the
-repository is public rather than routing it somewhere public in the
-meantime.
-
-Standing up a monitored contact address is a prerequisite for making this
-repository public. The flip does not happen before there is somewhere for a
-report to land.
-
-**Once this repository is public**, use GitHub private vulnerability
-reporting: Security tab → **Report a vulnerability**. That is the channel,
-and it is the point at which reports become welcome.
+**Use GitHub private vulnerability reporting: Security tab → Report a
+vulnerability.** That is the channel, and reports are welcome. It is the only
+one: GitHub has no user-to-user messaging, and the maintainer's GitHub
+no-reply address does not accept inbound mail, so a report sent anywhere else
+will not arrive.
 
 This project has one maintainer and no on-call rotation. There is no
 guaranteed response time and no bug bounty. What is offered instead: a
@@ -173,8 +159,8 @@ this project wants reported. Concretely:
 
 ## Coordinated disclosure
 
-Once the public private-vulnerability-reporting channel above is live, report
-there and give a fix a reasonable window before publishing. If a
+Report through the private-vulnerability-reporting channel above and give a
+fix a reasonable window before publishing. If a
 report is valid, the advisory will credit you by whatever name and link you
 ask for, or anonymously if you prefer. If a report is not valid, you will get
 the reasoning rather than silence.

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/.github/scripts/verify_distributions.py

@@ -77,7 +77,7 @@ GITHOOK_FILES = {
 SDIST_SOURCE_TREES = {
     "benchmarks": {".py"},
     IMPORT_PACKAGE: {".py", "py.typed"},
-    "docs": {".md", ".png"},
+    "docs": {".md", ".png", ".svg"},
     "schemas": {".json"},
     "tests": {".py"},
     "vectors": {".json", ".py"},

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/.github/workflows/release.yml

@@ -129,10 +129,14 @@ jobs:
           sdist="$(find dist -maxdepth 1 -type f -name 'causal_continuity_engine-*.tar.gz' -print -quit)"
           expected_manifest="$(mktemp)"
           trap 'rm -f "$expected_manifest"' EXIT
+          # SHA256SUMS is defined as filename-ordered by both the builder and
+          # verify_distributions.py, so sort on the filename field. Sorting the
+          # whole line would order by digest and match only when the digests
+          # happen to sort the same way the filenames do.
           for artifact in "$sdist" "$wheel"; do
             digest="$(sha256sum "$artifact" | cut -d ' ' -f 1)"
             printf '%s  %s\n' "$digest" "$(basename "$artifact")"
-          done | LC_ALL=C sort > "$expected_manifest"
+          done | LC_ALL=C sort -k2 > "$expected_manifest"
           cmp --silent "$expected_manifest" dist/SHA256SUMS
           echo "validated artifact $ARTIFACT_ID at sha256:$EXPECTED_ARTIFACT_DIGEST"
 
@@ -246,10 +250,11 @@ jobs:
           test -f dist/SHA256SUMS
           expected_manifest="$(mktemp)"
           trap 'rm -f "$expected_manifest"' EXIT
+          # Filename-ordered, matching the builder and verify_distributions.py.
           for artifact in "$sdist" "$wheel"; do
             digest="$(sha256sum "$artifact" | cut -d ' ' -f 1)"
             printf '%s  %s\n' "$digest" "$(basename "$artifact")"
-          done | LC_ALL=C sort > "$expected_manifest"
+          done | LC_ALL=C sort -k2 > "$expected_manifest"
           cmp --silent "$expected_manifest" dist/SHA256SUMS
           mkdir upload
           mv "$wheel" "$sdist" upload/

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/AGENTS.md

@@ -42,8 +42,7 @@ gates too, not optional extras. The `test` job in
 to `main`, across Python 3.11, 3.12, 3.13 and 3.14. The runner stops at the first
 failure. Native Windows and macOS 15 ARM64 invoke the same sequence on 3.14,
 and the artifact job builds twice and exercises an installed wheel. The `ci`
-job fans all four paths in. It is the only status context required by the live branch
-ruleset today.
+job fans all four paths in.
 The committed desired state in `.github/ruleset.json` was applied and read
 back on 2026-08-08: branch ruleset `20590966` is active with no bypass
 actors, required signatures, and merge-blocking `ci`, `attribution`,
@@ -53,9 +52,9 @@ settings are mutable — re-read the live objects rather than trusting this
 sentence.
 `commit-signature-audit.yml` reports GitHub's verdict for the exact pushed
 `main` SHA, but it runs after the commit has landed. It is a detective signal,
-not a substitute for the desired preventive `required_signatures` branch rule.
-Treat `.github/ruleset.README.md` as the drift register and do not describe
-the desired controls as live enforcement.
+not a substitute for the preventive `required_signatures` branch rule.
+Treat `.github/ruleset.README.md` as the drift register: re-read the live
+objects before describing any control as enforced.
 
 The `justfile` exposes focused local commands. Hosted Linux, Windows, macOS,
 and release jobs use `run_gates.py` so no separately downloaded command runner can

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/CHANGELOG.md

@@ -9,6 +9,56 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 No unreleased changes.
 
+## 0.1.2 — 2026-08-09
+
+A documentation and hygiene release. No engine, schema, proof, or HTTP
+behaviour changed; the only executable changes are the credential-handling and
+release-workflow fixes below.
+
+`v0.1.1` was tagged from this same work and never published: the release
+workflow's checksum recheck rejected its own verified artifacts, for the reason
+recorded under Fixed. The tag is left in place so that failure stays
+attributable, and the version was incremented rather than reused.
+
+### Fixed
+
+- **`cce-engine serve` no longer echoes a byte of the API token file.** A
+  token file containing non-ASCII bytes surfaced Python's decode error, which
+  quotes the offending byte value. The raw bytes are now checked before
+  decoding and the command fails with `api token file must be ASCII`, naming
+  no content. Found while closing out a CodeQL triage: the alert itself was a
+  false positive, this residue was not.
+- **The release workflow's checksum recheck compared the manifest in the wrong
+  order.** `SHA256SUMS` is filename-ordered, as both `build_distributions.py`
+  and `verify_distributions.py` define it, but the two shell rechecks in
+  `release.yml` sorted whole lines — which begin with the digest. The
+  comparison therefore succeeded only when the artifacts' digests happened to
+  sort the same way their filenames do, making every release a coin flip that
+  0.1.0 won and the 0.1.1 attempt lost. Both rechecks now sort on the filename
+  field, and a regression test pins the contract.
+- **Documentation that described the repository as private and unpublished.**
+  Those statements were accurate when written and became false when the
+  repository went public and 0.1.0 shipped. The security policy was the
+  serious one — it stated there was no reporting channel at all and told
+  anyone who found a defect to withhold the report until the repository was
+  public, while private vulnerability reporting was already enabled.
+  `CONTRIBUTING.md` also said sign-off was unenforced and that native secret
+  scanning was unavailable, and `docs/RELEASE.md` said the release workflow
+  did not upload to PyPI and that installation instructions must not name
+  `pip install`. Each now states the live state, re-read from the API rather
+  than assumed.
+- **The README demo image is referenced by an absolute URL.** PyPI does not
+  resolve repository-relative image paths, so the relative form would have
+  rendered as a broken image on the project page while rendering correctly on
+  GitHub.
+
+### Added
+
+- A terminal quickstart demo on the README's first screen, built from real
+  captured command output.
+- `.svg` assets under `docs/` are admitted to the reviewed source contract and
+  ship in the sdist, alongside the existing `.png` allowance.
+
 ## 0.1.0 — 2026-08-08
 
 Everything below is new; this is the first release.

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/CITATION.cff

@@ -8,8 +8,8 @@ authors:
   - given-names: Thomas
     family-names: Albrecht
     alias: The Quantum Falcon
-version: 0.1.0
-date-released: 2026-08-08
+version: 0.1.2
+date-released: 2026-08-09
 license: Apache-2.0
 repository-code: https://github.com/thequantumfalcon/causal-continuity-engine
 url: https://github.com/thequantumfalcon/causal-continuity-engine

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/MANIFEST.in

@@ -6,6 +6,7 @@ recursive-include causal_continuity_engine *.py py.typed
 recursive-include benchmarks *.py
 recursive-include docs *.md
 include docs/assets/social-preview.png
+include docs/assets/demo.svg
 recursive-include schemas *.json
 recursive-include tests *.py
 recursive-include vectors *.py *.json

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: causal-continuity-engine
-Version: 0.1.0
+Version: 0.1.2
 Summary: Causal Continuity Engine - continuity, causal invalidation, and proof for long-running coding agents
 Author: Thomas Albrecht
 License-Expression: Apache-2.0
@@ -30,7 +30,7 @@ Requires-Dist: pytest==9.1.1; extra == "dev"
 Requires-Dist: ruff==0.16.1; extra == "dev"
 Requires-Dist: build==1.5.0; extra == "dev"
 Requires-Dist: jsonschema==4.26.0; extra == "dev"
-Requires-Dist: pip==26.1.2; extra == "dev"
+Requires-Dist: pip==26.2; extra == "dev"
 Dynamic: license-file
 
 # Causal Continuity Engine
@@ -41,6 +41,8 @@ Continuity, causal invalidation, and proof for long-running coding agents.
 ![license](https://img.shields.io/badge/license-Apache_2.0-blue.svg)
 ![python](https://img.shields.io/badge/python-3.11%2B-blue.svg)
 
+<p align="center"><img src="https://raw.githubusercontent.com/thequantumfalcon/causal-continuity-engine/main/docs/assets/demo.svg" alt="cce-engine quickstart: install, init, audit verify, assumptions" width="760"></p>
+
 ## The problem
 
 An agent working a codebase over weeks does not fail by forgetting text. It
@@ -85,23 +87,29 @@ parsing rather than importing, so a lazy or guarded import is caught too. CI
 invokes the same `.github/scripts/check_stdlib.py` scanner through
 `run_gates.py` on every pull request and every push to `main`.
 
-The intended PyPI distribution name is `causal-continuity-engine`, the import
-package is `causal_continuity_engine`, and the executable is `cce-engine`. The
-distribution is not yet published; the coordinated name-claim step is tracked
-in [docs/PUBLIC-FLIP.md](docs/PUBLIC-FLIP.md). Those longer names are
-intentional: the shorter `cce` distribution, import namespace, and command are
-already used by an unrelated published project.
+The PyPI distribution name is `causal-continuity-engine`, the import package is
+`causal_continuity_engine`, and the executable is `cce-engine`. Those longer
+names are intentional: the shorter `cce` distribution, import namespace, and
+command are already used by an unrelated published project.
 
 ## Quickstart
 
 Under five minutes, no dependencies beyond the package itself.
 
 ```bash
-git clone https://github.com/thequantumfalcon/causal-continuity-engine
-cd causal-continuity-engine
 python -m venv .venv
 # Activate with: source .venv/bin/activate          (macOS/Linux)
 #            or: .venv\Scripts\Activate.ps1         (Windows PowerShell)
+python -m pip install causal-continuity-engine
+```
+
+To work on the engine instead of using it, install the checkout editable — see
+[.github/CONTRIBUTING.md](.github/CONTRIBUTING.md) for the full toolchain:
+
+```bash
+git clone https://github.com/thequantumfalcon/causal-continuity-engine
+cd causal-continuity-engine
+python -m venv .venv
 python -m pip install -e .
 ```
 
@@ -674,9 +682,9 @@ change, and there is no deprecation policy yet.
 - Hosted CI requires the full suite on Python 3.11, 3.12, 3.13 and 3.14 on
   Linux and natively on Windows 3.14 and macOS 15 ARM64/Python 3.14; 10/10
   ContinuityBench scenarios pass with all 6 metrics at target
-- Repository-policy JSON records the stricter desired state, not current live
-  enforcement. The exact remote drift and apply/read-back procedure are in
-  [.github/ruleset.README.md](.github/ruleset.README.md).
+- Repository-policy JSON was applied and read back against the live rulesets.
+  Remote settings are mutable, so the apply/read-back procedure that re-checks
+  them is in [.github/ruleset.README.md](.github/ruleset.README.md).
 - The accepted ADRs in [docs/adr/ADR-INDEX.md](docs/adr/ADR-INDEX.md),
   including the per-round review notes
 - Capability claims that must mechanically resolve, generated into
@@ -710,9 +718,9 @@ condition.
   of every requirement identifier used by code, tests, ADRs, and coverage.
 - [docs/REQUIREMENTS_COVERAGE.md](docs/REQUIREMENTS_COVERAGE.md) — the
   per-requirement implementation status and supporting evidence.
-- [docs/PUBLIC-FLIP.md](docs/PUBLIC-FLIP.md) — what is deliberately switched off
-  while this repository is private, and the exact command that turns each one
-  on. Read it before changing the repository's visibility.
+- [docs/PUBLIC-FLIP.md](docs/PUBLIC-FLIP.md) — the register of every control
+  that could not be enabled while this repository was private, with the exact
+  command that turned each one on at the flip.
 - [docs/RELEASE.md](docs/RELEASE.md) — the reproducible, signed, immutable-ready
   release procedure and its continuity-bound attestation roadmap.
 - [docs/RESEARCH-ROADMAP.md](docs/RESEARCH-ROADMAP.md) — standards-backed

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/README.md

@@ -6,6 +6,8 @@ Continuity, causal invalidation, and proof for long-running coding agents.
 ![license](https://img.shields.io/badge/license-Apache_2.0-blue.svg)
 ![python](https://img.shields.io/badge/python-3.11%2B-blue.svg)
 
+<p align="center"><img src="https://raw.githubusercontent.com/thequantumfalcon/causal-continuity-engine/main/docs/assets/demo.svg" alt="cce-engine quickstart: install, init, audit verify, assumptions" width="760"></p>
+
 ## The problem
 
 An agent working a codebase over weeks does not fail by forgetting text. It
@@ -50,23 +52,29 @@ parsing rather than importing, so a lazy or guarded import is caught too. CI
 invokes the same `.github/scripts/check_stdlib.py` scanner through
 `run_gates.py` on every pull request and every push to `main`.
 
-The intended PyPI distribution name is `causal-continuity-engine`, the import
-package is `causal_continuity_engine`, and the executable is `cce-engine`. The
-distribution is not yet published; the coordinated name-claim step is tracked
-in [docs/PUBLIC-FLIP.md](docs/PUBLIC-FLIP.md). Those longer names are
-intentional: the shorter `cce` distribution, import namespace, and command are
-already used by an unrelated published project.
+The PyPI distribution name is `causal-continuity-engine`, the import package is
+`causal_continuity_engine`, and the executable is `cce-engine`. Those longer
+names are intentional: the shorter `cce` distribution, import namespace, and
+command are already used by an unrelated published project.
 
 ## Quickstart
 
 Under five minutes, no dependencies beyond the package itself.
 
 ```bash
-git clone https://github.com/thequantumfalcon/causal-continuity-engine
-cd causal-continuity-engine
 python -m venv .venv
 # Activate with: source .venv/bin/activate          (macOS/Linux)
 #            or: .venv\Scripts\Activate.ps1         (Windows PowerShell)
+python -m pip install causal-continuity-engine
+```
+
+To work on the engine instead of using it, install the checkout editable — see
+[.github/CONTRIBUTING.md](.github/CONTRIBUTING.md) for the full toolchain:
+
+```bash
+git clone https://github.com/thequantumfalcon/causal-continuity-engine
+cd causal-continuity-engine
+python -m venv .venv
 python -m pip install -e .
 ```
 
@@ -639,9 +647,9 @@ change, and there is no deprecation policy yet.
 - Hosted CI requires the full suite on Python 3.11, 3.12, 3.13 and 3.14 on
   Linux and natively on Windows 3.14 and macOS 15 ARM64/Python 3.14; 10/10
   ContinuityBench scenarios pass with all 6 metrics at target
-- Repository-policy JSON records the stricter desired state, not current live
-  enforcement. The exact remote drift and apply/read-back procedure are in
-  [.github/ruleset.README.md](.github/ruleset.README.md).
+- Repository-policy JSON was applied and read back against the live rulesets.
+  Remote settings are mutable, so the apply/read-back procedure that re-checks
+  them is in [.github/ruleset.README.md](.github/ruleset.README.md).
 - The accepted ADRs in [docs/adr/ADR-INDEX.md](docs/adr/ADR-INDEX.md),
   including the per-round review notes
 - Capability claims that must mechanically resolve, generated into
@@ -675,9 +683,9 @@ condition.
   of every requirement identifier used by code, tests, ADRs, and coverage.
 - [docs/REQUIREMENTS_COVERAGE.md](docs/REQUIREMENTS_COVERAGE.md) — the
   per-requirement implementation status and supporting evidence.
-- [docs/PUBLIC-FLIP.md](docs/PUBLIC-FLIP.md) — what is deliberately switched off
-  while this repository is private, and the exact command that turns each one
-  on. Read it before changing the repository's visibility.
+- [docs/PUBLIC-FLIP.md](docs/PUBLIC-FLIP.md) — the register of every control
+  that could not be enabled while this repository was private, with the exact
+  command that turned each one on at the flip.
 - [docs/RELEASE.md](docs/RELEASE.md) — the reproducible, signed, immutable-ready
   release procedure and its continuity-bound attestation roadmap.
 - [docs/RESEARCH-ROADMAP.md](docs/RESEARCH-ROADMAP.md) — standards-backed

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/causal_continuity_engine/__init__.py

@@ -7,7 +7,7 @@ authenticated runtime records are not replay-derived (ADR-001). Storage is
 SQLite implementing the PostgreSQL-first relational adjacency design (ADR-011).
 """
 
-__version__ = "0.1.0"
+__version__ = "0.1.2"
 
 SCHEMA_VERSIONS = {
     "anchor": "cce.anchor.v1",

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/causal_continuity_engine/cli.py

@@ -1144,8 +1144,10 @@ def cmd_serve(args):
     engine, meta = _engine(args)
     root = Path("." if args.dir is None else args.dir)
     _, cce_dir = _physical_cce_directory(root, root / ".cce")
-    api_token = _read_private(_secret_path(cce_dir, meta["api_token_file"])) \
-        .decode("ascii")
+    token_bytes = _read_private(_secret_path(cce_dir, meta["api_token_file"]))
+    if not token_bytes.isascii():
+        raise ValueError("api token file must be ASCII")
+    api_token = token_bytes.decode("ascii")
     webhook_secret = _read_private(
         _secret_path(cce_dir, meta["webhook_secret_file"]))
     print(_sanitize_human(

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/causal_continuity_engine.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: causal-continuity-engine
-Version: 0.1.0
+Version: 0.1.2
 Summary: Causal Continuity Engine - continuity, causal invalidation, and proof for long-running coding agents
 Author: Thomas Albrecht
 License-Expression: Apache-2.0
@@ -30,7 +30,7 @@ Requires-Dist: pytest==9.1.1; extra == "dev"
 Requires-Dist: ruff==0.16.1; extra == "dev"
 Requires-Dist: build==1.5.0; extra == "dev"
 Requires-Dist: jsonschema==4.26.0; extra == "dev"
-Requires-Dist: pip==26.1.2; extra == "dev"
+Requires-Dist: pip==26.2; extra == "dev"
 Dynamic: license-file
 
 # Causal Continuity Engine
@@ -41,6 +41,8 @@ Continuity, causal invalidation, and proof for long-running coding agents.
 ![license](https://img.shields.io/badge/license-Apache_2.0-blue.svg)
 ![python](https://img.shields.io/badge/python-3.11%2B-blue.svg)
 
+<p align="center"><img src="https://raw.githubusercontent.com/thequantumfalcon/causal-continuity-engine/main/docs/assets/demo.svg" alt="cce-engine quickstart: install, init, audit verify, assumptions" width="760"></p>
+
 ## The problem
 
 An agent working a codebase over weeks does not fail by forgetting text. It
@@ -85,23 +87,29 @@ parsing rather than importing, so a lazy or guarded import is caught too. CI
 invokes the same `.github/scripts/check_stdlib.py` scanner through
 `run_gates.py` on every pull request and every push to `main`.
 
-The intended PyPI distribution name is `causal-continuity-engine`, the import
-package is `causal_continuity_engine`, and the executable is `cce-engine`. The
-distribution is not yet published; the coordinated name-claim step is tracked
-in [docs/PUBLIC-FLIP.md](docs/PUBLIC-FLIP.md). Those longer names are
-intentional: the shorter `cce` distribution, import namespace, and command are
-already used by an unrelated published project.
+The PyPI distribution name is `causal-continuity-engine`, the import package is
+`causal_continuity_engine`, and the executable is `cce-engine`. Those longer
+names are intentional: the shorter `cce` distribution, import namespace, and
+command are already used by an unrelated published project.
 
 ## Quickstart
 
 Under five minutes, no dependencies beyond the package itself.
 
 ```bash
-git clone https://github.com/thequantumfalcon/causal-continuity-engine
-cd causal-continuity-engine
 python -m venv .venv
 # Activate with: source .venv/bin/activate          (macOS/Linux)
 #            or: .venv\Scripts\Activate.ps1         (Windows PowerShell)
+python -m pip install causal-continuity-engine
+```
+
+To work on the engine instead of using it, install the checkout editable — see
+[.github/CONTRIBUTING.md](.github/CONTRIBUTING.md) for the full toolchain:
+
+```bash
+git clone https://github.com/thequantumfalcon/causal-continuity-engine
+cd causal-continuity-engine
+python -m venv .venv
 python -m pip install -e .
 ```
 
@@ -674,9 +682,9 @@ change, and there is no deprecation policy yet.
 - Hosted CI requires the full suite on Python 3.11, 3.12, 3.13 and 3.14 on
   Linux and natively on Windows 3.14 and macOS 15 ARM64/Python 3.14; 10/10
   ContinuityBench scenarios pass with all 6 metrics at target
-- Repository-policy JSON records the stricter desired state, not current live
-  enforcement. The exact remote drift and apply/read-back procedure are in
-  [.github/ruleset.README.md](.github/ruleset.README.md).
+- Repository-policy JSON was applied and read back against the live rulesets.
+  Remote settings are mutable, so the apply/read-back procedure that re-checks
+  them is in [.github/ruleset.README.md](.github/ruleset.README.md).
 - The accepted ADRs in [docs/adr/ADR-INDEX.md](docs/adr/ADR-INDEX.md),
   including the per-round review notes
 - Capability claims that must mechanically resolve, generated into
@@ -710,9 +718,9 @@ condition.
   of every requirement identifier used by code, tests, ADRs, and coverage.
 - [docs/REQUIREMENTS_COVERAGE.md](docs/REQUIREMENTS_COVERAGE.md) — the
   per-requirement implementation status and supporting evidence.
-- [docs/PUBLIC-FLIP.md](docs/PUBLIC-FLIP.md) — what is deliberately switched off
-  while this repository is private, and the exact command that turns each one
-  on. Read it before changing the repository's visibility.
+- [docs/PUBLIC-FLIP.md](docs/PUBLIC-FLIP.md) — the register of every control
+  that could not be enabled while this repository was private, with the exact
+  command that turned each one on at the flip.
 - [docs/RELEASE.md](docs/RELEASE.md) — the reproducible, signed, immutable-ready
   release procedure and its continuity-bound attestation roadmap.
 - [docs/RESEARCH-ROADMAP.md](docs/RESEARCH-ROADMAP.md) — standards-backed

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/causal_continuity_engine.egg-info/SOURCES.txt

@@ -86,6 +86,7 @@ docs/REQUIREMENTS_COVERAGE.md
 docs/RESEARCH-ROADMAP.md
 docs/TESTING.md
 docs/adr/ADR-INDEX.md
+docs/assets/demo.svg
 docs/assets/social-preview.png
 justfile
 pyproject.toml

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/causal_continuity_engine.egg-info/requires.txt

@@ -4,4 +4,4 @@ pytest==9.1.1
 ruff==0.16.1
 build==1.5.0
 jsonschema==4.26.0
-pip==26.1.2
+pip==26.2

{causal_continuity_engine-0.1.0 → causal_continuity_engine-0.1.2}/docs/RELEASE.md

@@ -13,9 +13,8 @@ and remain bound to the reviewed tag.
 2. Preserve the repository-level requirement for full-length commit SHAs on
    every GitHub Action reference. The 2026-08-04 API read-back reports
    `sha_pinning_required: true`.
-3. Preserve release immutability. It was enabled and read back through the
-   GitHub API on 2026-08-04, before any tag or release existed. The setting is
-   not retroactive, so verify it again before the first tag.
+3. Preserve release immutability. It was enabled before any tag or release
+   existed. The setting is not retroactive, so verify it again before each tag.
 4. Confirm the maintainer's signing key renders both commits and signed tags
    as **Verified** on GitHub, and record the expected key fingerprint or SSH
    principal in the operator's release record.
@@ -181,17 +180,18 @@ Python image (or an equivalently authenticated interpreter distribution).
 
 ## Python package index publication
 
-The GitHub release workflow does **not** currently upload to PyPI. The intended
-name `causal-continuity-engine` was unclaimed when checked on 2026-08-04, and a
-[pending Trusted Publisher does not reserve it](https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/).
-Before claiming registry availability, configure a protected `pypi` GitHub
-environment and a pending publisher bound exactly to this owner, repository,
-and `release.yml`. Then add a separately reviewed OIDC publish job that receives
-only the already verified wheel and sdist, uses no long-lived token, emits
-PEP 740 attestations, and verifies PyPI's exposed SHA-256 digests before the
-release is announced. Until that path is approved and exercised, installation
-instructions remain source/GitHub based and must not say `pip install
-causal-continuity-engine`.
+The GitHub release workflow uploads to PyPI. The name
+`causal-continuity-engine` was claimed by the first successful publish
+(0.1.0, 2026-08-08); a
+[pending Trusted Publisher does not reserve a name](https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/),
+only publishing does.
+
+The `pypi` job runs after `verify` and `publish`, is gated on the protected
+`pypi` environment, and authenticates by OIDC Trusted Publishing bound to this
+owner, repository, and `release.yml` — no long-lived token. It receives only
+the already verified wheel and sdist, re-checks them against the checksum
+manifest before upload, and emits PEP 740 attestations. Require PyPI's exposed
+SHA-256 digests to match the GitHub release assets before announcing.
 
 Do not reuse a failed version or replace an asset. Correct the cause, increment
 the version, and create a new signed tag so the failure remains attributable.