controlled-text-transfer 0.1.0__tar.gz

controlled_text_transfer-0.1.0/.cttignore.example

@@ -0,0 +1,12 @@
+.git/*
+.venv/*
+*__pycache__/*
+*.py[cod]
+.pytest_cache/*
+.mypy_cache/*
+.ruff_cache/*
+.coverage
+dist/*
+build/*
+reports/*
+*.egg-info/*

controlled_text_transfer-0.1.0/CHANGELOG.md

@@ -0,0 +1,85 @@
+# Changelog
+
+## [Unreleased]
+
+## [0.1.0] - 2026-07-25
+
+### Added
+
+- `prepare`, `verify`, `restore`, and read-only `diff` commands.
+- Strict YAML policies and `.cttignore` filtering; unknown policy fields,
+  including `workers`, fail validation.
+- UTF-8 validation, optional transfer BOMs, and original BOM restoration.
+- Allowlist-based text selection and binary/oversize reporting.
+- Deterministic manifest generation.
+- SHA-256 and SHA-512 hashing with optional BLAKE3.
+- Directory, ZIP, TAR, and TAR.GZ package output.
+- Structured JSON audit logging and dry-run modes.
+- Detached signing hooks for externally managed GPG/X.509 workflows.
+- Named compatibility preflight with deterministic JSON decisions, strict
+  policy parsing, content checks, aggregate limits, and strict preparation.
+- Guarded repository cleanup with dry-run reporting and optional environment
+  removal, including source-checkout operation through an external Python
+  interpreter.
+- Stable source capture, staged self-verification, and atomic package
+  publication; archive formats publish only the requested archive.
+- Safe direct verification and restoration of ZIP, TAR, and TAR.GZ packages.
+- Enforceable detached manifest signatures using trusted injected signers,
+  with trusted verification required by default for signed packages.
+- Pytest coverage, Ruff, Black, MyPy, Bandit, GitHub Actions, PyInstaller,
+  release-metadata validation, and distribution checks. The suite enforces
+  100% application statement coverage, MyPy checks unreachable code, and
+  Bandit scans application and development scripts.
+- A `scripts/run.sh` development dispatcher with setup, test, check, report,
+  build, and guarded cleanup commands. The report command generates indexed
+  pydoc, test, coverage, static-analysis, security, dependency, and runtime
+  reports.
+- Command-scoped CLI options, descriptive built-in help, and executable
+  contracts for every advertised option.
+- The Controlled Text Transfer identity: distribution
+  `controlled-text-transfer`, package `controlled_text_transfer`, command
+  `ctt`, policy `ctt.yaml`, ignore file `.cttignore`, and manifest prefix
+  `ctt-manifest`.
+- Python 3.12 as the minimum supported runtime, including native
+  junction-safe filesystem inspection.
+- CI using locked dependencies and the canonical quality gate on pushes to
+  `dev` and `main` and on pull requests targeting `main`.
+- Weekly Dependabot maintenance for commit-SHA-pinned GitHub Actions.
+- Publication metadata linking to the `dgomez407/ctt` repository.
+- Fail-closed rejection of unsupported package formats before output is
+  written.
+- Controlled library and CLI errors for malformed manifests.
+- Publication documentation, ADRs, security guidance, and configuration
+  examples in the source distribution.
+- An offline, responsive report dashboard with test and coverage metrics,
+  accessible status presentation, formatted raw-output views, and navigation
+  from generated API documentation.
+- Responsive, navigable pydoc pages with readable signatures and docstrings,
+  mobile layouts, preserved API anchors, and print styling.
+- Fail-closed pydoc link post-processing that preserves generated application
+  targets and renders unavailable local targets as code.
+- Complete pydoc coverage for `__main__` and unambiguous
+  dashboard/package/module breadcrumbs with full module titles.
+- Security guidance, operational runbook, API reference, and ADRs.
+
+### Changed
+
+### Fixed
+
+### Security
+
+- Reject path traversal, symlink payload files, unexpected payload files, and
+  existing restore destinations.
+- Reject secret-bearing signing command arguments.
+- Reject oversized source files before reading their contents.
+- Reject linked package roots, metadata sidecars, payload roots, and payload
+  descendants.
+- Restrict manifest hashes to SHA-256, SHA-512, or optional BLAKE3 and restored
+  modes to ordinary permission bits.
+- Restore through verified sibling staging so failures leave no partial
+  destination.
+- Reject secret-bearing external signer flags in assignment form.
+- GitHub Actions use explicit least-privilege permissions and immutable
+  dependency references.
+- Releases use locked build tools and reject tagged commits that are not
+  contained in `origin/main`.

controlled_text_transfer-0.1.0/LICENSE

@@ -0,0 +1,7 @@
+MIT License
+
+Copyright (c) 2026 Controlled Text Transfer contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files, to deal in the Software without restriction, subject to the following conditions: the above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.

controlled_text_transfer-0.1.0/MANIFEST.in

@@ -0,0 +1,4 @@
+include CHANGELOG.md README-quickstart.md SECURITY.md ctt.spec ctt.yaml.example .cttignore.example
+recursive-include docs *.md
+recursive-include scripts *.md *.py *.sh
+recursive-include tests *.md *.py

controlled_text_transfer-0.1.0/PKG-INFO

@@ -0,0 +1,223 @@
+Metadata-Version: 2.4
+Name: controlled-text-transfer
+Version: 0.1.0
+Summary: Auditable text-only preparation and restoration for controlled file transfers
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/dgomez407/ctt
+Project-URL: Repository, https://github.com/dgomez407/ctt
+Project-URL: Issues, https://github.com/dgomez407/ctt/issues
+Project-URL: Changelog, https://github.com/dgomez407/ctt/blob/main/CHANGELOG.md
+Keywords: controlled-transfer,file-integrity,security,text-files
+Classifier: Development Status :: 4 - Beta
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Archiving
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: PyYAML>=6.0
+Provides-Extra: blake3
+Requires-Dist: blake3>=0.4; extra == "blake3"
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-cov>=5; extra == "dev"
+Requires-Dist: ruff>=0.5; extra == "dev"
+Requires-Dist: black>=24; extra == "dev"
+Requires-Dist: mypy>=1.10; extra == "dev"
+Requires-Dist: bandit>=1.7; extra == "dev"
+Requires-Dist: pyinstaller>=6; extra == "dev"
+Requires-Dist: build>=1; extra == "dev"
+Requires-Dist: twine>=6; extra == "dev"
+Dynamic: license-file
+
+# Controlled Text Transfer 0.1.0
+
+Controlled Text Transfer (`ctt`) prepares an allowlisted set of text files for
+a controlled transfer that accepts only `.txt` names. It appends `.txt`,
+preserves content and paths in a signed-ready JSON manifest, adds an optional
+UTF-8 BOM only to transfer copies, and restores byte-identical originals.
+Python 3.12 or newer is required.
+
+For the shortest path to running the application, see
+[README-quickstart.md](README-quickstart.md).
+
+## Documentation
+
+- [Documentation index](docs/README.md)
+- [Operations runbook](docs/operations.md)
+- [Policy reference and examples](docs/policy.md)
+- [Complete CLI option reference](docs/cli.md)
+- [CLI and library API](docs/api.md)
+- [Security guidance](SECURITY.md)
+- [Architecture Decision Records](docs/decisions/README.md)
+- [Changelog](CHANGELOG.md)
+- [Contributor and agent guidelines](AGENTS.md)
+- [Repository-specific agent guidance](AGENTS-project.md)
+- [Gemini agent entry point](GEMINI.md)
+
+## Repository Map
+
+- [GitHub workflow details](.github/workflows/README.md)
+- [Development scripts](scripts/README.md)
+- [Source code](src/README.md)
+- [Test suite](tests/README.md)
+
+## GitHub automation
+
+GitHub-specific automation enforces the same build, test, security, and
+release requirements documented for local development. It uses
+least-privilege permissions, immutable action references, and locked Python
+dependencies.
+
+- [Workflow definitions](.github/workflows/README.md)
+- [`dependabot.yml`](.github/dependabot.yml) maintains pinned GitHub Actions
+  dependencies.
+
+## Quick start
+
+```bash
+python -m pip install .
+ctt prepare ./source ./transfer --policy ctt.yaml
+ctt preflight ./source --policy ctt.yaml --json
+ctt verify ./transfer
+ctt restore ./transfer ./restored
+ctt diff ./transfer ./source --json
+```
+
+## Commands
+
+| Command | Purpose |
+|---|---|
+| `uv run ctt preflight SOURCE --json` | Produce a read-only compatibility report |
+| `uv run ctt prepare SOURCE TRANSFER --strict` | Build only when every candidate passes |
+| `uv run ctt verify TRANSFER` | Verify a directory or supported archive |
+| `uv run ctt restore TRANSFER DESTINATION` | Restore verified original files |
+| `uv run --extra dev pytest` | Install missing development tools and run all tests |
+| `bash scripts/run.sh check` | Run the complete local quality gate |
+| `bash scripts/run.sh report` | Generate browsable API, coverage, quality, and security reports |
+
+Use `--dry-run` with `prepare` or `restore` to inspect the operation without
+writing. Use `--log-json` for machine-readable audit events. Directory format
+publishes the requested directory; `zip`, `tar`, and `tar.gz` publish only the
+corresponding archive.
+
+Use `prepare --strict --json-report preflight.json` to publish nothing when a
+candidate is rejected while retaining a deterministic compatibility report.
+Verification and restoration accept canonical directories and generated
+archives directly. Directory verification rejects linked package or payload
+paths, and restoration publishes only after its staged output validates.
+
+`diff` is read-only and reports added, removed, modified, and unchanged
+allowlisted files when compared with the source directory.
+
+## Architecture
+
+The package keeps transformation, integrity verification, packaging, signing
+hooks, and CLI concerns small and separable. The core uses a policy-driven
+allowlist and a versioned manifest; archive creation is optional; signing is
+delegated to externally managed key infrastructure. See ADR-001 through
+ADR-012 for the rationale and rejected alternatives.
+
+## Policy and detection
+
+The default policy uses an explicit extension/name allowlist, UTF-8 decoding, a 10 MiB per-file limit, and SHA-256. Files that are binary, undecodable, ignored by `.cttignore`, oversized, or not allowlisted are reported in the manifest and never copied. `.cttignore` patterns use simple gitignore-like glob matching.
+
+The concrete `generic-text-v1` compatibility profile also checks aggregate
+size, file count, path depth and length, filename characters, line endings,
+control characters, Unicode policy, line length, prohibited textual patterns,
+and the `.txt` transfer extension. See the
+[policy reference](docs/policy.md) for every field, default, and example.
+
+SHA-512 is available through `hash_algorithm: sha512`. BLAKE3 is optional
+(`uv sync --extra blake3`) and fails closed with a clear message when
+unavailable.
+
+## Security notes
+
+The source directory is never modified. Destination directories must not
+already exist. Oversized sources are rejected before content reads. Every
+manifest path is checked against a link-free package root to prevent traversal
+and external reads. Verification hashes transfer bytes before restoration;
+restoration validates a staged destination after removing the transport BOM
+and publishes it atomically. Do not treat a checksum as authenticity: use a
+separately managed digital signature and verify it in the approved environment.
+
+Signing is exposed through a detached-signature hook in
+`controlled_text_transfer.signing`;
+integrate approved GPG or X.509 tooling outside this package. Never pass
+private keys or passphrases through CLI arguments, environment variables, or
+manifest content. See [SECURITY.md](SECURITY.md) for the operating guidance.
+Archives should be scanned by the CDS and malware controls; renaming or
+encoding is not a bypass.
+
+Packages that declare a signature require a trusted verifier by default.
+`--allow-unverified-signature` performs explicitly unauthenticated,
+integrity-only verification.
+
+## Development
+
+The Bash dispatcher provides memorable shortcuts:
+
+```bash
+bash scripts/run.sh setup
+bash scripts/run.sh test
+bash scripts/run.sh check
+bash scripts/run.sh build
+bash scripts/run.sh clean --dry-run
+```
+
+Run `bash scripts/run.sh help` for the command summary. The underlying commands
+remain available directly:
+
+```bash
+uv sync --extra dev
+uv run pytest
+uv run ruff check .
+uv run black --check .
+uv run mypy src
+uv run bandit -r src scripts
+```
+
+After deleting `.venv`, either run `uv sync --extra dev` before the quality
+commands or use `uv run --extra dev pytest` to install the development extra
+and run the complete test suite in one step. Plain `uv run pytest` cannot find
+pytest in a newly created runtime-only environment. Use
+`uv run --extra dev pytest -q` as the equivalent concise-output alternative.
+
+The package is pipx-friendly because it exposes the `ctt` console script.
+Build a standalone executable with `pyinstaller ctt.spec`; keep
+generated binaries out of source control.
+
+### Clean generated artifacts
+
+Preview the repository-scoped cleanup, then remove reproducible build and test
+artifacts:
+
+```bash
+bash scripts/run.sh clean --dry-run
+bash scripts/run.sh clean
+```
+
+The default removes `build/`, `dist/`, tool caches, `.coverage`,
+`__pycache__/`, and `*.egg-info/`; it preserves source, configuration,
+`uv.lock`, and `.venv`. To remove `.venv` too, run
+`bash scripts/run.sh clean --environment`; the dispatcher selects the first
+`python` on `PATH` outside the project environment. The action refuses to
+delete its active interpreter. It never
+cleans uv's shared global cache because that can affect other projects.
+
+## Publishing
+
+Releases use PyPI Trusted Publishing through
+`.github/workflows/release.yml`. Configure a pending GitHub publisher for
+project `controlled-text-transfer`, owner `dgomez407`, repository `ctt`,
+workflow `release.yml`, and environment `pypi`. After the quality gates pass,
+push a version tag such as `v0.1.0` from a commit contained in `main`. The
+workflow verifies that the tagged commit belongs to `origin/main`, the tag,
+package version, README, and changelog agree; reruns the locked quality gates;
+validates the wheel and source distribution; and publishes them without a
+stored API token.

controlled_text_transfer-0.1.0/README-quickstart.md

@@ -0,0 +1,111 @@
+# Controlled Text Transfer Quick Start
+
+Run these commands from the repository root. `uv` creates and manages the
+Python 3.12-or-newer environment automatically; no separate installation is
+required.
+
+## Show the CLI
+
+```bash
+uv run ctt --help
+```
+
+## Prepare and transfer files
+
+Replace `./source` with the directory containing the files to transfer:
+
+```bash
+uv run ctt preflight ./source --json
+uv run ctt prepare ./source ./transfer --strict
+uv run ctt verify ./transfer
+uv run ctt restore ./transfer ./restored
+```
+
+- `preflight` reports which files will be accepted, transformed, or rejected.
+- `prepare --strict` creates nothing if any candidate is rejected.
+- `verify` checks the manifest, paths, sizes, and hashes.
+- `restore` recreates the original files in a new destination directory.
+
+## Use a policy file
+
+```bash
+uv run ctt prepare ./source ./transfer --policy ./ctt.yaml --strict
+```
+
+The default `directory` package format creates `./transfer`. ZIP, TAR, and
+TAR.GZ policies instead create `./transfer.zip`, `./transfer.tar`, or
+`./transfer.tar.gz`.
+
+For all options:
+
+```bash
+uv run ctt prepare --help
+uv run ctt verify --help
+```
+
+The [complete CLI option reference](docs/cli.md) explains how and why to use
+every option, including signing and machine-readable output.
+
+To preview or perform a cleanup of generated repository artifacts:
+
+```bash
+uv run python scripts/clean.py --dry-run
+uv run python scripts/clean.py
+```
+
+## Run the tests
+
+From Bash, use the development dispatcher:
+
+```bash
+bash scripts/run.sh test
+```
+
+Run every quality gate before review:
+
+```bash
+bash scripts/run.sh check
+```
+
+After a fresh clone or after removing `.venv`, include the development extra:
+
+```bash
+uv run --extra dev pytest
+```
+
+For the same complete suite with concise output:
+
+```bash
+uv run --extra dev pytest -q
+```
+
+Alternatively, install all development tools first and then run commands
+without repeating the extra:
+
+```bash
+uv sync --extra dev
+uv run pytest
+```
+
+The suite enforces 100% aggregate statement coverage. Its terminal report omits
+fully covered modules so remaining gaps are easier to review.
+
+Other dispatcher commands are:
+
+```bash
+bash scripts/run.sh setup
+bash scripts/run.sh report
+bash scripts/run.sh build
+bash scripts/run.sh clean --dry-run
+bash scripts/run.sh clean --environment
+bash scripts/run.sh help
+```
+
+The report command writes a browsable `reports/index.html`. Use
+`bash scripts/run.sh report --pydoc-only` for fast API documentation, or see
+the [scripts guide](scripts/README.md) for every generated report.
+
+See [README.md](./README.md) for architecture and
+[docs/operations.md](./docs/operations.md) for operational guidance. See the
+[policy reference](./docs/policy.md) for every supported field and practical
+examples.

controlled_text_transfer-0.1.0/README.md

@@ -0,0 +1,187 @@
+# Controlled Text Transfer 0.1.0
+
+Controlled Text Transfer (`ctt`) prepares an allowlisted set of text files for
+a controlled transfer that accepts only `.txt` names. It appends `.txt`,
+preserves content and paths in a signed-ready JSON manifest, adds an optional
+UTF-8 BOM only to transfer copies, and restores byte-identical originals.
+Python 3.12 or newer is required.
+
+For the shortest path to running the application, see
+[README-quickstart.md](README-quickstart.md).
+
+## Documentation
+
+- [Documentation index](docs/README.md)
+- [Operations runbook](docs/operations.md)
+- [Policy reference and examples](docs/policy.md)
+- [Complete CLI option reference](docs/cli.md)
+- [CLI and library API](docs/api.md)
+- [Security guidance](SECURITY.md)
+- [Architecture Decision Records](docs/decisions/README.md)
+- [Changelog](CHANGELOG.md)
+- [Contributor and agent guidelines](AGENTS.md)
+- [Repository-specific agent guidance](AGENTS-project.md)
+- [Gemini agent entry point](GEMINI.md)
+
+## Repository Map
+
+- [GitHub workflow details](.github/workflows/README.md)
+- [Development scripts](scripts/README.md)
+- [Source code](src/README.md)
+- [Test suite](tests/README.md)
+
+## GitHub automation
+
+GitHub-specific automation enforces the same build, test, security, and
+release requirements documented for local development. It uses
+least-privilege permissions, immutable action references, and locked Python
+dependencies.
+
+- [Workflow definitions](.github/workflows/README.md)
+- [`dependabot.yml`](.github/dependabot.yml) maintains pinned GitHub Actions
+  dependencies.
+
+## Quick start
+
+```bash
+python -m pip install .
+ctt prepare ./source ./transfer --policy ctt.yaml
+ctt preflight ./source --policy ctt.yaml --json
+ctt verify ./transfer
+ctt restore ./transfer ./restored
+ctt diff ./transfer ./source --json
+```
+
+## Commands
+
+| Command | Purpose |
+|---|---|
+| `uv run ctt preflight SOURCE --json` | Produce a read-only compatibility report |
+| `uv run ctt prepare SOURCE TRANSFER --strict` | Build only when every candidate passes |
+| `uv run ctt verify TRANSFER` | Verify a directory or supported archive |
+| `uv run ctt restore TRANSFER DESTINATION` | Restore verified original files |
+| `uv run --extra dev pytest` | Install missing development tools and run all tests |
+| `bash scripts/run.sh check` | Run the complete local quality gate |
+| `bash scripts/run.sh report` | Generate browsable API, coverage, quality, and security reports |
+
+Use `--dry-run` with `prepare` or `restore` to inspect the operation without
+writing. Use `--log-json` for machine-readable audit events. Directory format
+publishes the requested directory; `zip`, `tar`, and `tar.gz` publish only the
+corresponding archive.
+
+Use `prepare --strict --json-report preflight.json` to publish nothing when a
+candidate is rejected while retaining a deterministic compatibility report.
+Verification and restoration accept canonical directories and generated
+archives directly. Directory verification rejects linked package or payload
+paths, and restoration publishes only after its staged output validates.
+
+`diff` is read-only and reports added, removed, modified, and unchanged
+allowlisted files when compared with the source directory.
+
+## Architecture
+
+The package keeps transformation, integrity verification, packaging, signing
+hooks, and CLI concerns small and separable. The core uses a policy-driven
+allowlist and a versioned manifest; archive creation is optional; signing is
+delegated to externally managed key infrastructure. See ADR-001 through
+ADR-012 for the rationale and rejected alternatives.
+
+## Policy and detection
+
+The default policy uses an explicit extension/name allowlist, UTF-8 decoding, a 10 MiB per-file limit, and SHA-256. Files that are binary, undecodable, ignored by `.cttignore`, oversized, or not allowlisted are reported in the manifest and never copied. `.cttignore` patterns use simple gitignore-like glob matching.
+
+The concrete `generic-text-v1` compatibility profile also checks aggregate
+size, file count, path depth and length, filename characters, line endings,
+control characters, Unicode policy, line length, prohibited textual patterns,
+and the `.txt` transfer extension. See the
+[policy reference](docs/policy.md) for every field, default, and example.
+
+SHA-512 is available through `hash_algorithm: sha512`. BLAKE3 is optional
+(`uv sync --extra blake3`) and fails closed with a clear message when
+unavailable.
+
+## Security notes
+
+The source directory is never modified. Destination directories must not
+already exist. Oversized sources are rejected before content reads. Every
+manifest path is checked against a link-free package root to prevent traversal
+and external reads. Verification hashes transfer bytes before restoration;
+restoration validates a staged destination after removing the transport BOM
+and publishes it atomically. Do not treat a checksum as authenticity: use a
+separately managed digital signature and verify it in the approved environment.
+
+Signing is exposed through a detached-signature hook in
+`controlled_text_transfer.signing`;
+integrate approved GPG or X.509 tooling outside this package. Never pass
+private keys or passphrases through CLI arguments, environment variables, or
+manifest content. See [SECURITY.md](SECURITY.md) for the operating guidance.
+Archives should be scanned by the CDS and malware controls; renaming or
+encoding is not a bypass.
+
+Packages that declare a signature require a trusted verifier by default.
+`--allow-unverified-signature` performs explicitly unauthenticated,
+integrity-only verification.
+
+## Development
+
+The Bash dispatcher provides memorable shortcuts:
+
+```bash
+bash scripts/run.sh setup
+bash scripts/run.sh test
+bash scripts/run.sh check
+bash scripts/run.sh build
+bash scripts/run.sh clean --dry-run
+```
+
+Run `bash scripts/run.sh help` for the command summary. The underlying commands
+remain available directly:
+
+```bash
+uv sync --extra dev
+uv run pytest
+uv run ruff check .
+uv run black --check .
+uv run mypy src
+uv run bandit -r src scripts
+```
+
+After deleting `.venv`, either run `uv sync --extra dev` before the quality
+commands or use `uv run --extra dev pytest` to install the development extra
+and run the complete test suite in one step. Plain `uv run pytest` cannot find
+pytest in a newly created runtime-only environment. Use
+`uv run --extra dev pytest -q` as the equivalent concise-output alternative.
+
+The package is pipx-friendly because it exposes the `ctt` console script.
+Build a standalone executable with `pyinstaller ctt.spec`; keep
+generated binaries out of source control.
+
+### Clean generated artifacts
+
+Preview the repository-scoped cleanup, then remove reproducible build and test
+artifacts:
+
+```bash
+bash scripts/run.sh clean --dry-run
+bash scripts/run.sh clean
+```
+
+The default removes `build/`, `dist/`, tool caches, `.coverage`,
+`__pycache__/`, and `*.egg-info/`; it preserves source, configuration,
+`uv.lock`, and `.venv`. To remove `.venv` too, run
+`bash scripts/run.sh clean --environment`; the dispatcher selects the first
+`python` on `PATH` outside the project environment. The action refuses to
+delete its active interpreter. It never
+cleans uv's shared global cache because that can affect other projects.
+
+## Publishing
+
+Releases use PyPI Trusted Publishing through
+`.github/workflows/release.yml`. Configure a pending GitHub publisher for
+project `controlled-text-transfer`, owner `dgomez407`, repository `ctt`,
+workflow `release.yml`, and environment `pypi`. After the quality gates pass,
+push a version tag such as `v0.1.0` from a commit contained in `main`. The
+workflow verifies that the tagged commit belongs to `origin/main`, the tag,
+package version, README, and changelog agree; reruns the locked quality gates;
+validates the wheel and source distribution; and publishes them without a
+stored API token.