matrixscroll 0.2.6__tar.gz → 0.3.0__tar.gz

{matrixscroll-0.2.6 → matrixscroll-0.3.0}/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to the Matrix Scroll Python SDK are documented here. The
 format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0] - 2026-06-28
+
+Digital Rain removal and provenance-only SDK surface.
+
+### Removed
+- **Workspace intelligence modules** — deleted unused Digital Rain-era helpers
+  (`benchmark`, `brainstorm`, `scanner`, `vault`, radar modules, and related tests).
+
+### Changed
+- **Public copy** — removed Digital Rain funnel language from README, MCP docs,
+  and hero demo script; SSX360 remains the hosted control plane reference.
+- **Version pins** — bumped public quickstart and product docs to `0.3.0`.
+
 ## [0.2.6] - 2026-06-21
 
 SDK rollout hardening: generic public attribution, SE050 host transport preview,

{matrixscroll-0.2.6 → matrixscroll-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: matrixscroll
-Version: 0.2.6
+Version: 0.3.0
 Summary: Signed provenance for agent-assisted Git commits with offline verification; emulated Ed25519 ships today and the SE050 hardware path remains an optional preview.
 Project-URL: Homepage, https://matrixscroll.com
 Project-URL: Documentation, https://matrixscroll.com/docs
@@ -44,6 +44,8 @@ Requires-Dist: pytest>=7.4; extra == 'dev'
 Provides-Extra: git
 Provides-Extra: hardware
 Requires-Dist: pyserial>=3.5; extra == 'hardware'
+Provides-Extra: mcp
+Requires-Dist: mcp<2.0.0,>=1.0.0; extra == 'mcp'
 Provides-Extra: tpm
 Provides-Extra: yubikey
 Requires-Dist: python-pkcs11>=0.7; extra == 'yubikey'
@@ -51,7 +53,84 @@ Description-Content-Type: text/markdown
 
 # Matrix Scroll
 
-Signed provenance for agent-assisted Git commits with offline verification.
+**Signed proof of who — or what — wrote every commit.** Matrix Scroll is the
+open Ed25519 commit-provenance protocol for agent-assisted Git — verified
+offline in CLI, browser, and CI. Hardware (SE050) is an optional preview trust
+upgrade; emulated mode ships today.
+
+**Hosted control plane:** identity, billing, and device confirmation live at
+[ssx360.com](https://ssx360.com/). Teams evaluating protected-branch enforcement should
+[book a provenance pilot](mailto:mission@ssx360.com?subject=Provenance%20Pilot%20Inquiry);
+Provisioned pilot and team accounts sign in at [ssx360.com/signup](https://ssx360.com/signup).
+
+## Compliance evidence mapping
+
+Matrix Scroll **maps to** and **produces evidence for** (never “required by”):
+
+- **Five Eyes · Agentic AI (Apr 2026)** — cryptographic attestation that agents
+  run expected, unmodified code.
+- **EU AI Act · high-risk traceability** — verifiable commit-time audit artifacts.
+- **US federal SSDF · self-attestation** — evidence packs for supply-chain review.
+
+Full matrix: [`controls/agentic_ai_controls.json`](controls/agentic_ai_controls.json)
+
+## Adoption signals
+
+Track outbound and registry traction while rolling out:
+
+| Signal | Counter |
+|--------|---------|
+| PyPI `matrixscroll` | [![PyPI downloads](https://img.shields.io/pypi/dm/matrixscroll)](https://pypi.org/project/matrixscroll/) |
+| PyPI `[mcp]` extra | [![PyPI MCP downloads](https://img.shields.io/pypi/dm/matrixscroll?label=mcp%20extra)](https://pypi.org/project/matrixscroll/) |
+| GitHub stars | [![GitHub stars](https://img.shields.io/github/stars/SSX360/matrixscroll?style=social)](https://github.com/SSX360/matrixscroll/stargazers) |
+| Scroll Gate Action | [![GitHub Action](https://img.shields.io/github/stars/SSX360/matrixscroll-verify-action?style=social)](https://github.com/SSX360/matrixscroll-verify-action) |
+| Glama MCP registry | [matrixscroll on Glama](https://glama.ai/mcp/servers/SSX360/matrixscroll) |
+
+## Hero demo (post–MCP merge)
+
+Record the 60–90s provenance flow in [`docs/HERO_DEMO.md`](docs/HERO_DEMO.md) — Scroll Gate + browser verifier + MCP verbs only.
+
+## Install — MCP server (headline path)
+
+Agents sign commits in-loop via the **provenance-only** MCP server:
+
+```json
+{
+  "mcpServers": {
+    "matrixscroll-mcp": {
+      "command": "matrixscroll-mcp",
+      "args": []
+    }
+  }
+}
+```
+
+```bash
+pip install "matrixscroll[mcp]==0.3.0"
+matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
+```
+
+**MCP tools (provenance verbs only):** `create_envelope`, `verify_envelope`,
+`verify_pr_range` (Scroll Gate), `publish_notes`, `status`, `audit_export`.
+
+## Also available — CLI & hooks
+
+```bash
+pip install "matrixscroll==0.3.0"
+matrixscroll hook-install
+export MATRIXSCROLL_ACTOR_TYPE=agent
+export MATRIXSCROLL_TOOL=agent-runner
+git commit -m "feat: agent-assisted change"
+matrixscroll envelope-verify "$(git rev-parse HEAD)"
+```
+
+See [`docs/quickstart-git.md`](docs/quickstart-git.md) and
+[`examples/demo/agent-commit-demo.sh`](examples/demo/agent-commit-demo.sh).
+
+---
+
+This repository is the canonical SDK, verifier contract, fixture set, and
+release surface for the product.
 
 Matrix Scroll is a cryptographic evidence layer for Git. When an agent, CI
 workflow, or human operator produces a commit, a signed commit envelope can
@@ -59,25 +138,65 @@ record the actor, tool, and optional bounded scope. Anyone can verify that
 envelope locally, in CI, or in the browser without trusting the editor session
 that produced it.
 
+Keep GitHub Advanced Security, Semgrep, Snyk, branch protection, and artifact
+attestations. Matrix Scroll adds signed commit-time authorship proof before
+merge, and it keeps the same offline verification contract across the CLI,
+browser, CI, and the SE050 preview path.
+
 The reference SDK ships pure Ed25519 over canonical manifest bytes today. The
 SSX360 / NXP SE050 path is the compatible next trust layer and remains a
 preview path until device acceptance is complete.
 
 ## Honest limits
 
-- Shipping now: PyPI `matrixscroll==0.2.6`, Git post-commit hooks,
+- Shipping now: PyPI `matrixscroll==0.3.0`, Git post-commit hooks,
   `matrixscroll envelope-verify`, Scroll Gate PR verification, browser
   verifier, the GitHub Action, and a USB CDC host transport preview for the
-  SE050 rollout path.
+  SE050 rollout path. Emulated mode is the default evaluation path.
 - In progress: RP2350 + SE050 firmware validation, external Ed25519-capable
   hardware key backends, and transparency-log integrations.
 - Not: IAM, sandboxing, prompt filtering, or an agent runtime.
 
-## Quickstart
+## Where it fits
+
+- Scanners and branch protection catch code and policy issues; Matrix Scroll
+  records who or what signed the change before push.
+- Hardware keys and build attestations remain complementary roots and downstream
+  proofs; Matrix Scroll covers commit-time provenance.
+- The public contract stays pure Ed25519 over canonical manifest bytes,
+  whether the signer is emulated today or hardware-backed later.
+
+## Common questions
+
+### What is Matrix Scroll and how does it secure Git?
+
+Matrix Scroll is signed commit-time provenance for agent-assisted Git. It
+secures Git by attaching an Ed25519-signed commit envelope to a commit,
+recording the actor, tool, and optional bounded scope, then letting reviewers
+verify that proof offline in the CLI, browser, or CI before merge.
+
+### How do hardware and emulated modes differ in Matrix Scroll?
+
+Emulated mode ships today and keeps the signing key on disk with owner-only
+permissions so teams can evaluate the full workflow now. Hardware mode keeps
+the same verifier contract and commit envelope schema, but moves the private
+key into the SE050 secure element so the host cannot export it; that path
+remains preview-only until device acceptance is complete.
+
+### How can I integrate Matrix Scroll into a CI/CD workflow?
+
+Install the SDK and hooks in your repo, publish commit envelopes to
+`refs/notes/matrixscroll` before PR review, and use
+`SSX360/matrixscroll-verify-action@v1` to verify the full PR commit range in
+GitHub Actions. Protected branches can then require Matrix Scroll proof
+alongside your existing scanners, branch protection, and build attestations.
+
+## Quickstart (CLI)
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.3.0"
 matrixscroll hook-install
+matrixscroll hook-status
 
 export MATRIXSCROLL_ACTOR_TYPE=agent
 export MATRIXSCROLL_TOOL=agent-runner
@@ -102,7 +221,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and run
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.3.0"
     require-mode: emulated
 ```
 
@@ -122,7 +241,7 @@ git push origin refs/notes/matrixscroll
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.3.0"
     summary-output: provenance-summary.json
 ```
 
@@ -130,7 +249,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and
 [`examples/ci/protected-branch.yml`](examples/ci/protected-branch.yml).
 
 The `--require-mode`, `--trusted-keys`, and actor or delegation policy checks
-are available in the `0.2.x` line; the examples in this README pin `0.2.6`.
+are available in the `0.2.x` line; the examples in this README pin `0.3.0`.
 
 ## Why it is different from Sigstore
 
@@ -154,12 +273,12 @@ when they preserve the same pure Ed25519 byte contract.
 - GitHub Action: <https://github.com/SSX360/matrixscroll-verify-action>
 - Agentic AI controls: [`docs/AGENTIC_AI_SECURITY.md`](docs/AGENTIC_AI_SECURITY.md)
 - Site: <https://matrixscroll.com>
-- Reference device path: <https://matrixscroll.com/device/>
+- Reference device path: [SSX360](https://matrixscroll.com/device)
 
 ## Python API
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.3.0"
 ```
 
 ```python
@@ -221,6 +340,11 @@ host transport preview and a mock path for CI; real SE050 signing still
 depends on device firmware validation. External-key backends stay out of the
 mainline until they can sign the same canonical bytes with Ed25519.
 
+For rollout order, start with `MATRIXSCROLL_MODE=emulated` for evaluation,
+layer in external Ed25519-capable signers only when they stay verifier
+compatible, and treat `hardware` as the SE050 preview path until device
+acceptance is complete.
+
 ## Compliance levels
 
 | Level | Provider | Backed by | Status |
@@ -256,6 +380,21 @@ example bounded-agent evidence manifest at
 [`examples/agentic_ai_evidence_manifest.json`](examples/agentic_ai_evidence_manifest.json),
 and executable checks in `tests/test_agentic_guidance.py`.
 
+## Model Context Protocol (MCP) Server
+
+The MCP server exposes **provenance verbs only**: `create_envelope`, `verify_envelope`,
+`verify_pr_range`, `publish_notes`, `status`, and `audit_export`.
+
+Install and register in Cursor / Claude Desktop / VS Code:
+
+```bash
+pip install "matrixscroll[mcp]==0.3.0"
+matrixscroll-mcp   # stdio
+```
+
+See the [Install — MCP server](#install--mcp-server-headline-path) section above for
+the recommended `mcp.json` snippet.
+
 ## License
 
 - Code: **Apache-2.0** (`LICENSE`).
@@ -265,3 +404,8 @@ and executable checks in `tests/test_agentic_guidance.py`.
 
 See [`SECURITY.md`](SECURITY.md). Report vulnerabilities privately to
 **security@matrixscroll.com** or via a GitHub Security Advisory.
+
+---
+
+**Protocol:** https://matrixscroll.com · **Verify:** https://matrixscroll.com/verify/  
+**Control plane:** https://ssx360.com · **Pilot:** mission@ssx360.com · **Sign in:** https://ssx360.com/signup

{matrixscroll-0.2.6 → matrixscroll-0.3.0}/README.md

@@ -1,6 +1,83 @@
 # Matrix Scroll
 
-Signed provenance for agent-assisted Git commits with offline verification.
+**Signed proof of who — or what — wrote every commit.** Matrix Scroll is the
+open Ed25519 commit-provenance protocol for agent-assisted Git — verified
+offline in CLI, browser, and CI. Hardware (SE050) is an optional preview trust
+upgrade; emulated mode ships today.
+
+**Hosted control plane:** identity, billing, and device confirmation live at
+[ssx360.com](https://ssx360.com/). Teams evaluating protected-branch enforcement should
+[book a provenance pilot](mailto:mission@ssx360.com?subject=Provenance%20Pilot%20Inquiry);
+Provisioned pilot and team accounts sign in at [ssx360.com/signup](https://ssx360.com/signup).
+
+## Compliance evidence mapping
+
+Matrix Scroll **maps to** and **produces evidence for** (never “required by”):
+
+- **Five Eyes · Agentic AI (Apr 2026)** — cryptographic attestation that agents
+  run expected, unmodified code.
+- **EU AI Act · high-risk traceability** — verifiable commit-time audit artifacts.
+- **US federal SSDF · self-attestation** — evidence packs for supply-chain review.
+
+Full matrix: [`controls/agentic_ai_controls.json`](controls/agentic_ai_controls.json)
+
+## Adoption signals
+
+Track outbound and registry traction while rolling out:
+
+| Signal | Counter |
+|--------|---------|
+| PyPI `matrixscroll` | [![PyPI downloads](https://img.shields.io/pypi/dm/matrixscroll)](https://pypi.org/project/matrixscroll/) |
+| PyPI `[mcp]` extra | [![PyPI MCP downloads](https://img.shields.io/pypi/dm/matrixscroll?label=mcp%20extra)](https://pypi.org/project/matrixscroll/) |
+| GitHub stars | [![GitHub stars](https://img.shields.io/github/stars/SSX360/matrixscroll?style=social)](https://github.com/SSX360/matrixscroll/stargazers) |
+| Scroll Gate Action | [![GitHub Action](https://img.shields.io/github/stars/SSX360/matrixscroll-verify-action?style=social)](https://github.com/SSX360/matrixscroll-verify-action) |
+| Glama MCP registry | [matrixscroll on Glama](https://glama.ai/mcp/servers/SSX360/matrixscroll) |
+
+## Hero demo (post–MCP merge)
+
+Record the 60–90s provenance flow in [`docs/HERO_DEMO.md`](docs/HERO_DEMO.md) — Scroll Gate + browser verifier + MCP verbs only.
+
+## Install — MCP server (headline path)
+
+Agents sign commits in-loop via the **provenance-only** MCP server:
+
+```json
+{
+  "mcpServers": {
+    "matrixscroll-mcp": {
+      "command": "matrixscroll-mcp",
+      "args": []
+    }
+  }
+}
+```
+
+```bash
+pip install "matrixscroll[mcp]==0.3.0"
+matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
+```
+
+**MCP tools (provenance verbs only):** `create_envelope`, `verify_envelope`,
+`verify_pr_range` (Scroll Gate), `publish_notes`, `status`, `audit_export`.
+
+## Also available — CLI & hooks
+
+```bash
+pip install "matrixscroll==0.3.0"
+matrixscroll hook-install
+export MATRIXSCROLL_ACTOR_TYPE=agent
+export MATRIXSCROLL_TOOL=agent-runner
+git commit -m "feat: agent-assisted change"
+matrixscroll envelope-verify "$(git rev-parse HEAD)"
+```
+
+See [`docs/quickstart-git.md`](docs/quickstart-git.md) and
+[`examples/demo/agent-commit-demo.sh`](examples/demo/agent-commit-demo.sh).
+
+---
+
+This repository is the canonical SDK, verifier contract, fixture set, and
+release surface for the product.
 
 Matrix Scroll is a cryptographic evidence layer for Git. When an agent, CI
 workflow, or human operator produces a commit, a signed commit envelope can
@@ -8,25 +85,65 @@ record the actor, tool, and optional bounded scope. Anyone can verify that
 envelope locally, in CI, or in the browser without trusting the editor session
 that produced it.
 
+Keep GitHub Advanced Security, Semgrep, Snyk, branch protection, and artifact
+attestations. Matrix Scroll adds signed commit-time authorship proof before
+merge, and it keeps the same offline verification contract across the CLI,
+browser, CI, and the SE050 preview path.
+
 The reference SDK ships pure Ed25519 over canonical manifest bytes today. The
 SSX360 / NXP SE050 path is the compatible next trust layer and remains a
 preview path until device acceptance is complete.
 
 ## Honest limits
 
-- Shipping now: PyPI `matrixscroll==0.2.6`, Git post-commit hooks,
+- Shipping now: PyPI `matrixscroll==0.3.0`, Git post-commit hooks,
   `matrixscroll envelope-verify`, Scroll Gate PR verification, browser
   verifier, the GitHub Action, and a USB CDC host transport preview for the
-  SE050 rollout path.
+  SE050 rollout path. Emulated mode is the default evaluation path.
 - In progress: RP2350 + SE050 firmware validation, external Ed25519-capable
   hardware key backends, and transparency-log integrations.
 - Not: IAM, sandboxing, prompt filtering, or an agent runtime.
 
-## Quickstart
+## Where it fits
+
+- Scanners and branch protection catch code and policy issues; Matrix Scroll
+  records who or what signed the change before push.
+- Hardware keys and build attestations remain complementary roots and downstream
+  proofs; Matrix Scroll covers commit-time provenance.
+- The public contract stays pure Ed25519 over canonical manifest bytes,
+  whether the signer is emulated today or hardware-backed later.
+
+## Common questions
+
+### What is Matrix Scroll and how does it secure Git?
+
+Matrix Scroll is signed commit-time provenance for agent-assisted Git. It
+secures Git by attaching an Ed25519-signed commit envelope to a commit,
+recording the actor, tool, and optional bounded scope, then letting reviewers
+verify that proof offline in the CLI, browser, or CI before merge.
+
+### How do hardware and emulated modes differ in Matrix Scroll?
+
+Emulated mode ships today and keeps the signing key on disk with owner-only
+permissions so teams can evaluate the full workflow now. Hardware mode keeps
+the same verifier contract and commit envelope schema, but moves the private
+key into the SE050 secure element so the host cannot export it; that path
+remains preview-only until device acceptance is complete.
+
+### How can I integrate Matrix Scroll into a CI/CD workflow?
+
+Install the SDK and hooks in your repo, publish commit envelopes to
+`refs/notes/matrixscroll` before PR review, and use
+`SSX360/matrixscroll-verify-action@v1` to verify the full PR commit range in
+GitHub Actions. Protected branches can then require Matrix Scroll proof
+alongside your existing scanners, branch protection, and build attestations.
+
+## Quickstart (CLI)
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.3.0"
 matrixscroll hook-install
+matrixscroll hook-status
 
 export MATRIXSCROLL_ACTOR_TYPE=agent
 export MATRIXSCROLL_TOOL=agent-runner
@@ -51,7 +168,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and run
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.3.0"
     require-mode: emulated
 ```
 
@@ -71,7 +188,7 @@ git push origin refs/notes/matrixscroll
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.3.0"
     summary-output: provenance-summary.json
 ```
 
@@ -79,7 +196,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and
 [`examples/ci/protected-branch.yml`](examples/ci/protected-branch.yml).
 
 The `--require-mode`, `--trusted-keys`, and actor or delegation policy checks
-are available in the `0.2.x` line; the examples in this README pin `0.2.6`.
+are available in the `0.2.x` line; the examples in this README pin `0.3.0`.
 
 ## Why it is different from Sigstore
 
@@ -103,12 +220,12 @@ when they preserve the same pure Ed25519 byte contract.
 - GitHub Action: <https://github.com/SSX360/matrixscroll-verify-action>
 - Agentic AI controls: [`docs/AGENTIC_AI_SECURITY.md`](docs/AGENTIC_AI_SECURITY.md)
 - Site: <https://matrixscroll.com>
-- Reference device path: <https://matrixscroll.com/device/>
+- Reference device path: [SSX360](https://matrixscroll.com/device)
 
 ## Python API
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.3.0"
 ```
 
 ```python
@@ -170,6 +287,11 @@ host transport preview and a mock path for CI; real SE050 signing still
 depends on device firmware validation. External-key backends stay out of the
 mainline until they can sign the same canonical bytes with Ed25519.
 
+For rollout order, start with `MATRIXSCROLL_MODE=emulated` for evaluation,
+layer in external Ed25519-capable signers only when they stay verifier
+compatible, and treat `hardware` as the SE050 preview path until device
+acceptance is complete.
+
 ## Compliance levels
 
 | Level | Provider | Backed by | Status |
@@ -205,6 +327,21 @@ example bounded-agent evidence manifest at
 [`examples/agentic_ai_evidence_manifest.json`](examples/agentic_ai_evidence_manifest.json),
 and executable checks in `tests/test_agentic_guidance.py`.
 
+## Model Context Protocol (MCP) Server
+
+The MCP server exposes **provenance verbs only**: `create_envelope`, `verify_envelope`,
+`verify_pr_range`, `publish_notes`, `status`, and `audit_export`.
+
+Install and register in Cursor / Claude Desktop / VS Code:
+
+```bash
+pip install "matrixscroll[mcp]==0.3.0"
+matrixscroll-mcp   # stdio
+```
+
+See the [Install — MCP server](#install--mcp-server-headline-path) section above for
+the recommended `mcp.json` snippet.
+
 ## License
 
 - Code: **Apache-2.0** (`LICENSE`).
@@ -214,3 +351,8 @@ and executable checks in `tests/test_agentic_guidance.py`.
 
 See [`SECURITY.md`](SECURITY.md). Report vulnerabilities privately to
 **security@matrixscroll.com** or via a GitHub Security Advisory.
+
+---
+
+**Protocol:** https://matrixscroll.com · **Verify:** https://matrixscroll.com/verify/  
+**Control plane:** https://ssx360.com · **Pilot:** mission@ssx360.com · **Sign in:** https://ssx360.com/signup

{matrixscroll-0.2.6 → matrixscroll-0.3.0}/docs/ADOPTER_KIT.md

@@ -61,6 +61,26 @@ jobs:
 - Matrix Scroll does not replace IAM or sandboxing
 - Matrix Scroll does not replace release-signing or artifact attestations
 
+## Clean-machine proof status
+
+Recorded on `2026-06-21` against the pinned public flow:
+`pip install "matrixscroll==0.2.6"` -> `matrixscroll hook-install` ->
+`matrixscroll hook-status` -> first agent-assisted commit ->
+`matrixscroll envelope-verify`.
+
+Hosted source of truth: GitHub Actions run
+`27904509800` on `codex/trust-layer-rollout`.
+
+| Platform | Result | Notes |
+| --- | --- | --- |
+| Windows | PASS | GitHub-hosted smoke completed with `1.0s` to first verified commit. Local temp-venv proof also passed in `8.7s`. |
+| Ubuntu | PASS | GitHub-hosted smoke completed with `0.4s` to first verified commit. |
+| macOS | PASS | GitHub-hosted smoke completed with `0.3s` to first verified commit. |
+
+Local environment note: the workspace WSL image is still missing `python3-pip`
+and `python3-venv`, so local Ubuntu reproduction remains under-provisioned even
+though launch evidence is now covered by the hosted workflow.
+
 ## Public follow-through
 
 If a pilot works, publish one of these:

matrixscroll-0.3.0/docs/HERO_DEMO.md

@@ -0,0 +1,45 @@
+# Hero demo script (60–90 seconds)
+
+Record this flow once. It is the highest-value GTM asset for the quarter.
+
+## Cast
+
+- **Agent:** Cursor or Claude Code in a bound workspace
+- **Producer:** `matrixscroll` hooks / MCP `create_envelope`
+- **Enforcer:** Scroll Gate (`SSX360/matrixscroll-verify-action@v1`)
+- **Verifier:** [matrixscroll.com/verify/](https://matrixscroll.com/verify/) (offline, no portal trust)
+
+## Beat sheet
+
+| Time | Screen | Narration hook |
+|------|--------|----------------|
+| 0:00 | Terminal / IDE | "An agent just committed. Who — or what — wrote it?" |
+| 0:10 | `git log -1` + hook output | "Matrix Scroll signs an Ed25519 envelope at commit time — actor, tool, scope." |
+| 0:25 | Envelope JSON (redacted keys OK) | "This is the proof object. Repo contents never left the machine." |
+| 0:35 | GitHub PR + Scroll Gate check | "Scroll Gate verifies the full PR range — signed vs unsigned, trusted vs untrusted." |
+| 0:50 | Browser verifier paste | "Anyone verifies offline at matrixscroll.com/verify — no SSX360 login required." |
+| 1:05 | SSX360 portal flash (optional) | "Identity, billing, and audit live on the control plane — verification does not." |
+| 1:15 | CTA slate | "Verify → Install → Pilot." |
+
+## Commands (copy-paste)
+
+```bash
+export MATRIXSCROLL_ACTOR_TYPE=agent
+export MATRIXSCROLL_TOOL=cursor
+git commit -m "feat: demo agent change"
+matrixscroll envelope-verify "$(git rev-parse HEAD)"
+matrixscroll envelope-publish-notes --base origin/main --head HEAD
+git push origin refs/notes/matrixscroll
+```
+
+Open PR → show **Scroll Gate** check green → paste envelope into browser verifier.
+
+## Do not say
+
+- "Required by" / "mandated" / regulation names as requirements
+- Repo intelligence / scanner as the lead story
+
+## Do say
+
+- "Maps to" / "produces evidence for" compliance frameworks
+- "Signed before merge" / "offline-verifiable" / "Scroll Gate"

{matrixscroll-0.2.6 → matrixscroll-0.3.0}/docs/SOFTWARE_PRODUCTS.md

@@ -5,7 +5,7 @@ manifest bytes today.
 
 | Product | Status | Access | Notes |
 |---------|--------|--------|-------|
-| **Matrix Scroll SDK** | GA | PyPI `matrixscroll==0.2.6` | Hooks, envelopes, Scroll Gate, policy CLI |
+| **Matrix Scroll SDK** | GA | PyPI `matrixscroll==0.3.0` | Hooks, envelopes, Scroll Gate, policy CLI |
 | **Scroll Gate CI** | GA | [`matrixscroll-verify-action@v1`](https://github.com/SSX360/matrixscroll-verify-action) | PR range + manifest verify |
 | **Browser verifier** | GA | [matrixscroll.com/verify](https://matrixscroll.com/verify/) | Offline paste-and-verify |
 | **Protocol docs** | GA | [matrixscroll.com/docs](https://matrixscroll.com/docs/) | SPEC mirror, whitepaper, quickstarts |
@@ -18,7 +18,7 @@ manifest bytes today.
 ## Developer install
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.3.0"
 matrixscroll hook-install
 export MATRIXSCROLL_ACTOR_TYPE=agent
 export MATRIXSCROLL_TOOL=agent-runner
@@ -34,7 +34,7 @@ matrixscroll envelope-verify "$(git rev-parse HEAD)"
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.3.0"
     summary-output: provenance-summary.json
 ```
 

{matrixscroll-0.2.6 → matrixscroll-0.3.0}/docs/quickstart-git.md

@@ -2,6 +2,13 @@
 
 Matrix Scroll Git hooks attach a signed **commit envelope** to every local commit.
 
+## What is Matrix Scroll and how does it secure Git?
+
+Matrix Scroll is signed commit-time provenance for agent-assisted Git. It
+secures Git by attaching an Ed25519-signed commit envelope to each commit,
+recording the actor, tool, and optional bounded scope, then letting reviewers
+verify that proof offline before merge.
+
 ## Install hooks
 
 ```bash
@@ -80,6 +87,15 @@ matrixscroll envelope-verify-range --base origin/main --head HEAD --source bundl
 
 Use [`SSX360/matrixscroll-verify-action@v1`](https://github.com/SSX360/matrixscroll-verify-action) for GitHub Actions.
 
+## How can I integrate Matrix Scroll into a CI/CD workflow?
+
+1. Install `matrixscroll==0.2.6` and `matrixscroll hook-install` in the repo.
+2. Publish commit envelopes to `refs/notes/matrixscroll` before PR review.
+3. Run `SSX360/matrixscroll-verify-action@v1` in GitHub Actions to verify the
+   full PR commit range from notes.
+4. Require that job on protected branches so CI blocks unsigned or unverifiable
+   PR commits before merge.
+
 **Time anchoring:** envelope `signed_at` is informational only. Use Git commit
 graph order or ledger insertion order for chronology — not self-reported timestamps.
 
@@ -115,6 +131,14 @@ graph order or ledger insertion order for chronology — not self-reported times
    ```
 5. Fail-closed: CI fetches `refs/notes/matrixscroll` from origin; missing notes fail the gate.
 
+## How do hardware and emulated modes differ in Matrix Scroll?
+
+Emulated mode ships today and stores the signing key on disk with owner-only
+permissions so teams can trial the entire workflow immediately. Hardware mode
+keeps the same commit envelope schema and verifier behavior, but moves the
+private key into the SE050 secure element so the host cannot export it; that
+path stays preview-only until device acceptance is complete.
+
 `MATRIXSCROLL_TOOL` is free-form provenance metadata. Use the label you want
 auditors and CI reviewers to see, such as `agent-runner`, `git-cli`, or your
 internal tool name.