matrixscroll 0.2.6__tar.gz → 0.4.0__tar.gz

{matrixscroll-0.2.6 → matrixscroll-0.4.0}/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to the Matrix Scroll Python SDK are documented here. The
 format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0] - 2026-06-28
+
+Digital Rain removal and provenance-only SDK surface.
+
+### Removed
+- **Workspace intelligence modules** — deleted unused Digital Rain-era helpers
+  (`benchmark`, `brainstorm`, `scanner`, `vault`, radar modules, and related tests).
+
+### Changed
+- **Public copy** — removed Digital Rain funnel language from README, MCP docs,
+  and hero demo script; SSX360 remains the hosted control plane reference.
+- **Version pins** — bumped public quickstart and product docs to `0.3.0`.
+
 ## [0.2.6] - 2026-06-21
 
 SDK rollout hardening: generic public attribution, SE050 host transport preview,

{matrixscroll-0.2.6 → matrixscroll-0.4.0}/PKG-INFO

@@ -1,23 +1,24 @@
 Metadata-Version: 2.4
 Name: matrixscroll
-Version: 0.2.6
+Version: 0.4.0
 Summary: Signed provenance for agent-assisted Git commits with offline verification; emulated Ed25519 ships today and the SE050 hardware path remains an optional preview.
-Project-URL: Homepage, https://matrixscroll.com
-Project-URL: Documentation, https://matrixscroll.com/docs
+Project-URL: Homepage, https://ssx360.com
+Project-URL: Documentation, https://ssx360.com/docs
+Project-URL: Repository, https://github.com/SSX360/matrixscroll
 Project-URL: Source, https://github.com/SSX360/matrixscroll
 Project-URL: Issues, https://github.com/SSX360/matrixscroll/issues
 Project-URL: Specification, https://github.com/SSX360/matrixscroll/blob/main/SPEC.md
 Project-URL: Whitepaper, https://github.com/SSX360/matrixscroll/blob/main/docs/WHITEPAPER.md
-Project-URL: Verifier, https://matrixscroll.com/verify
-Project-URL: Compare, https://matrixscroll.com/compare
+Project-URL: Verifier, https://ssx360.com/verify
+Project-URL: Compare, https://ssx360.com/docs
 Project-URL: Changelog, https://github.com/SSX360/matrixscroll/blob/main/CHANGELOG.md
 Project-URL: Discussions, https://github.com/SSX360/matrixscroll/discussions
 Project-URL: Security, https://github.com/SSX360/matrixscroll/blob/main/SECURITY.md
 Project-URL: GitHub Action, https://github.com/SSX360/matrixscroll-verify-action
 Project-URL: PyPI Provenance, https://pypi.org/project/matrixscroll/
+Project-URL: Reference Device, https://ssx360.com/hardware
 Project-URL: Tests, https://github.com/SSX360/matrixscroll/tree/main/tests
 Project-URL: Public Roadmap, https://github.com/SSX360/matrixscroll/blob/main/docs/ROADMAP_2026-07.md
-Project-URL: Reference Device, https://matrixscroll.com/device
 Author-email: SSX360 <security@matrixscroll.com>
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -44,6 +45,8 @@ Requires-Dist: pytest>=7.4; extra == 'dev'
 Provides-Extra: git
 Provides-Extra: hardware
 Requires-Dist: pyserial>=3.5; extra == 'hardware'
+Provides-Extra: mcp
+Requires-Dist: mcp<2.0.0,>=1.0.0; extra == 'mcp'
 Provides-Extra: tpm
 Provides-Extra: yubikey
 Requires-Dist: python-pkcs11>=0.7; extra == 'yubikey'
@@ -51,7 +54,70 @@ Description-Content-Type: text/markdown
 
 # Matrix Scroll
 
-Signed provenance for agent-assisted Git commits with offline verification.
+[![Scroll Gate v2 (hosted)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml/badge.svg)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml)
+
+**Signed proof of who — or what — wrote every commit.** Matrix Scroll is the
+open Ed25519 commit-provenance protocol for agent-assisted Git — verified
+offline in CLI, browser, and CI. Hardware (SE050) is an optional preview trust
+upgrade; emulated mode ships today.
+
+**Hosted control plane:** identity, billing, and device confirmation live at
+[ssx360.com](https://ssx360.com/). Teams evaluating protected-branch enforcement should
+[book a provenance pilot](https://ssx360.com/contact?intent=pilot);
+Provisioned pilot and team accounts sign in at [ssx360.com/signup](https://ssx360.com/signup).
+
+## Compliance evidence mapping
+
+Matrix Scroll **maps to** and **produces evidence for** (never “required by”):
+
+- **Five Eyes · Agentic AI (Apr 2026)** — cryptographic attestation that agents
+  run expected, unmodified code.
+- **EU AI Act · high-risk traceability** — verifiable commit-time audit artifacts.
+- **US federal SSDF · self-attestation** — evidence packs for supply-chain review.
+
+Full matrix: [`controls/agentic_ai_controls.json`](controls/agentic_ai_controls.json)
+
+## Install — MCP server (headline path)
+
+Agents sign commits in-loop via the **provenance-only** MCP server:
+
+```json
+{
+  "mcpServers": {
+    "matrixscroll-mcp": {
+      "command": "matrixscroll-mcp",
+      "args": []
+    }
+  }
+}
+```
+
+```bash
+pip install "matrixscroll[mcp]==0.4.0"
+matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
+```
+
+**MCP tools (provenance verbs only):** `create_envelope`, `verify_envelope`,
+`verify_pr_range` (Scroll Gate), `publish_notes`, `status`, `audit_export`.
+
+## Also available — CLI & hooks
+
+```bash
+pip install "matrixscroll==0.4.0"
+matrixscroll hook-install
+export MATRIXSCROLL_ACTOR_TYPE=agent
+export MATRIXSCROLL_TOOL=agent-runner
+git commit -m "feat: agent-assisted change"
+matrixscroll envelope-verify "$(git rev-parse HEAD)"
+```
+
+See [`docs/quickstart-git.md`](docs/quickstart-git.md) and
+[`examples/demo/agent-commit-demo.sh`](examples/demo/agent-commit-demo.sh).
+
+---
+
+This repository is the canonical SDK, verifier contract, fixture set, and
+release surface for the product.
 
 Matrix Scroll is a cryptographic evidence layer for Git. When an agent, CI
 workflow, or human operator produces a commit, a signed commit envelope can
@@ -59,25 +125,65 @@ record the actor, tool, and optional bounded scope. Anyone can verify that
 envelope locally, in CI, or in the browser without trusting the editor session
 that produced it.
 
+Keep GitHub Advanced Security, Semgrep, Snyk, branch protection, and artifact
+attestations. Matrix Scroll adds signed commit-time authorship proof before
+merge, and it keeps the same offline verification contract across the CLI,
+browser, CI, and the SE050 preview path.
+
 The reference SDK ships pure Ed25519 over canonical manifest bytes today. The
 SSX360 / NXP SE050 path is the compatible next trust layer and remains a
 preview path until device acceptance is complete.
 
 ## Honest limits
 
-- Shipping now: PyPI `matrixscroll==0.2.6`, Git post-commit hooks,
+- Shipping now: PyPI `matrixscroll==0.4.0`, Git post-commit hooks,
   `matrixscroll envelope-verify`, Scroll Gate PR verification, browser
   verifier, the GitHub Action, and a USB CDC host transport preview for the
-  SE050 rollout path.
-- In progress: RP2350 + SE050 firmware validation, external Ed25519-capable
+  SE050 rollout path. Emulated mode is the default evaluation path.
+- In progress: nRF52840 + SE050 firmware validation (AP2 Vault Card PoC), external Ed25519-capable
   hardware key backends, and transparency-log integrations.
 - Not: IAM, sandboxing, prompt filtering, or an agent runtime.
 
-## Quickstart
+## Where it fits
+
+- Scanners and branch protection catch code and policy issues; Matrix Scroll
+  records who or what signed the change before push.
+- Hardware keys and build attestations remain complementary roots and downstream
+  proofs; Matrix Scroll covers commit-time provenance.
+- The public contract stays pure Ed25519 over canonical manifest bytes,
+  whether the signer is emulated today or hardware-backed later.
+
+## Common questions
+
+### What is Matrix Scroll and how does it secure Git?
+
+Matrix Scroll is signed commit-time provenance for agent-assisted Git. It
+secures Git by attaching an Ed25519-signed commit envelope to a commit,
+recording the actor, tool, and optional bounded scope, then letting reviewers
+verify that proof offline in the CLI, browser, or CI before merge.
+
+### How do hardware and emulated modes differ in Matrix Scroll?
+
+Emulated mode ships today and keeps the signing key on disk with owner-only
+permissions so teams can evaluate the full workflow now. Hardware mode keeps
+the same verifier contract and commit envelope schema, but moves the private
+key into the SE050 secure element so the host cannot export it; that path
+remains preview-only until device acceptance is complete.
+
+### How can I integrate Matrix Scroll into a CI/CD workflow?
+
+Install the SDK and hooks in your repo, publish commit envelopes to
+`refs/notes/matrixscroll` before PR review, and use
+`SSX360/matrixscroll-verify-action@v1` to verify the full PR commit range in
+GitHub Actions. Protected branches can then require Matrix Scroll proof
+alongside your existing scanners, branch protection, and build attestations.
+
+## Quickstart (CLI)
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.4.0"
 matrixscroll hook-install
+matrixscroll hook-status
 
 export MATRIXSCROLL_ACTOR_TYPE=agent
 export MATRIXSCROLL_TOOL=agent-runner
@@ -102,7 +208,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and run
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.4.0"
     require-mode: emulated
 ```
 
@@ -122,7 +228,7 @@ git push origin refs/notes/matrixscroll
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.4.0"
     summary-output: provenance-summary.json
 ```
 
@@ -130,7 +236,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and
 [`examples/ci/protected-branch.yml`](examples/ci/protected-branch.yml).
 
 The `--require-mode`, `--trusted-keys`, and actor or delegation policy checks
-are available in the `0.2.x` line; the examples in this README pin `0.2.6`.
+are available in the `0.2.x` line; the examples in this README pin `0.3.0`.
 
 ## Why it is different from Sigstore
 
@@ -154,12 +260,12 @@ when they preserve the same pure Ed25519 byte contract.
 - GitHub Action: <https://github.com/SSX360/matrixscroll-verify-action>
 - Agentic AI controls: [`docs/AGENTIC_AI_SECURITY.md`](docs/AGENTIC_AI_SECURITY.md)
 - Site: <https://matrixscroll.com>
-- Reference device path: <https://matrixscroll.com/device/>
+- Reference device path: [AP2 Vault Card hardware](https://ssx360.com/hardware)
 
 ## Python API
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.4.0"
 ```
 
 ```python
@@ -221,6 +327,11 @@ host transport preview and a mock path for CI; real SE050 signing still
 depends on device firmware validation. External-key backends stay out of the
 mainline until they can sign the same canonical bytes with Ed25519.
 
+For rollout order, start with `MATRIXSCROLL_MODE=emulated` for evaluation,
+layer in external Ed25519-capable signers only when they stay verifier
+compatible, and treat `hardware` as the SE050 preview path until device
+acceptance is complete.
+
 ## Compliance levels
 
 | Level | Provider | Backed by | Status |
@@ -256,6 +367,21 @@ example bounded-agent evidence manifest at
 [`examples/agentic_ai_evidence_manifest.json`](examples/agentic_ai_evidence_manifest.json),
 and executable checks in `tests/test_agentic_guidance.py`.
 
+## Model Context Protocol (MCP) Server
+
+The MCP server exposes **provenance verbs only**: `create_envelope`, `verify_envelope`,
+`verify_pr_range`, `publish_notes`, `status`, and `audit_export`.
+
+Install and register in Cursor / Claude Desktop / VS Code:
+
+```bash
+pip install "matrixscroll[mcp]==0.4.0"
+matrixscroll-mcp   # stdio
+```
+
+See the [Install — MCP server](#install--mcp-server-headline-path) section above for
+the recommended `mcp.json` snippet.
+
 ## License
 
 - Code: **Apache-2.0** (`LICENSE`).
@@ -265,3 +391,8 @@ and executable checks in `tests/test_agentic_guidance.py`.
 
 See [`SECURITY.md`](SECURITY.md). Report vulnerabilities privately to
 **security@matrixscroll.com** or via a GitHub Security Advisory.
+
+---
+
+**Protocol:** https://matrixscroll.com · **Verify:** https://matrixscroll.com/verify/  
+**Control plane:** https://ssx360.com · **Pilot:** mission@ssx360.com · **Sign in:** https://ssx360.com/signup

{matrixscroll-0.2.6 → matrixscroll-0.4.0}/README.md

@@ -1,6 +1,69 @@
 # Matrix Scroll
 
-Signed provenance for agent-assisted Git commits with offline verification.
+[![Scroll Gate v2 (hosted)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml/badge.svg)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml)
+
+**Signed proof of who — or what — wrote every commit.** Matrix Scroll is the
+open Ed25519 commit-provenance protocol for agent-assisted Git — verified
+offline in CLI, browser, and CI. Hardware (SE050) is an optional preview trust
+upgrade; emulated mode ships today.
+
+**Hosted control plane:** identity, billing, and device confirmation live at
+[ssx360.com](https://ssx360.com/). Teams evaluating protected-branch enforcement should
+[book a provenance pilot](https://ssx360.com/contact?intent=pilot);
+Provisioned pilot and team accounts sign in at [ssx360.com/signup](https://ssx360.com/signup).
+
+## Compliance evidence mapping
+
+Matrix Scroll **maps to** and **produces evidence for** (never “required by”):
+
+- **Five Eyes · Agentic AI (Apr 2026)** — cryptographic attestation that agents
+  run expected, unmodified code.
+- **EU AI Act · high-risk traceability** — verifiable commit-time audit artifacts.
+- **US federal SSDF · self-attestation** — evidence packs for supply-chain review.
+
+Full matrix: [`controls/agentic_ai_controls.json`](controls/agentic_ai_controls.json)
+
+## Install — MCP server (headline path)
+
+Agents sign commits in-loop via the **provenance-only** MCP server:
+
+```json
+{
+  "mcpServers": {
+    "matrixscroll-mcp": {
+      "command": "matrixscroll-mcp",
+      "args": []
+    }
+  }
+}
+```
+
+```bash
+pip install "matrixscroll[mcp]==0.4.0"
+matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
+```
+
+**MCP tools (provenance verbs only):** `create_envelope`, `verify_envelope`,
+`verify_pr_range` (Scroll Gate), `publish_notes`, `status`, `audit_export`.
+
+## Also available — CLI & hooks
+
+```bash
+pip install "matrixscroll==0.4.0"
+matrixscroll hook-install
+export MATRIXSCROLL_ACTOR_TYPE=agent
+export MATRIXSCROLL_TOOL=agent-runner
+git commit -m "feat: agent-assisted change"
+matrixscroll envelope-verify "$(git rev-parse HEAD)"
+```
+
+See [`docs/quickstart-git.md`](docs/quickstart-git.md) and
+[`examples/demo/agent-commit-demo.sh`](examples/demo/agent-commit-demo.sh).
+
+---
+
+This repository is the canonical SDK, verifier contract, fixture set, and
+release surface for the product.
 
 Matrix Scroll is a cryptographic evidence layer for Git. When an agent, CI
 workflow, or human operator produces a commit, a signed commit envelope can
@@ -8,25 +71,65 @@ record the actor, tool, and optional bounded scope. Anyone can verify that
 envelope locally, in CI, or in the browser without trusting the editor session
 that produced it.
 
+Keep GitHub Advanced Security, Semgrep, Snyk, branch protection, and artifact
+attestations. Matrix Scroll adds signed commit-time authorship proof before
+merge, and it keeps the same offline verification contract across the CLI,
+browser, CI, and the SE050 preview path.
+
 The reference SDK ships pure Ed25519 over canonical manifest bytes today. The
 SSX360 / NXP SE050 path is the compatible next trust layer and remains a
 preview path until device acceptance is complete.
 
 ## Honest limits
 
-- Shipping now: PyPI `matrixscroll==0.2.6`, Git post-commit hooks,
+- Shipping now: PyPI `matrixscroll==0.4.0`, Git post-commit hooks,
   `matrixscroll envelope-verify`, Scroll Gate PR verification, browser
   verifier, the GitHub Action, and a USB CDC host transport preview for the
-  SE050 rollout path.
-- In progress: RP2350 + SE050 firmware validation, external Ed25519-capable
+  SE050 rollout path. Emulated mode is the default evaluation path.
+- In progress: nRF52840 + SE050 firmware validation (AP2 Vault Card PoC), external Ed25519-capable
   hardware key backends, and transparency-log integrations.
 - Not: IAM, sandboxing, prompt filtering, or an agent runtime.
 
-## Quickstart
+## Where it fits
+
+- Scanners and branch protection catch code and policy issues; Matrix Scroll
+  records who or what signed the change before push.
+- Hardware keys and build attestations remain complementary roots and downstream
+  proofs; Matrix Scroll covers commit-time provenance.
+- The public contract stays pure Ed25519 over canonical manifest bytes,
+  whether the signer is emulated today or hardware-backed later.
+
+## Common questions
+
+### What is Matrix Scroll and how does it secure Git?
+
+Matrix Scroll is signed commit-time provenance for agent-assisted Git. It
+secures Git by attaching an Ed25519-signed commit envelope to a commit,
+recording the actor, tool, and optional bounded scope, then letting reviewers
+verify that proof offline in the CLI, browser, or CI before merge.
+
+### How do hardware and emulated modes differ in Matrix Scroll?
+
+Emulated mode ships today and keeps the signing key on disk with owner-only
+permissions so teams can evaluate the full workflow now. Hardware mode keeps
+the same verifier contract and commit envelope schema, but moves the private
+key into the SE050 secure element so the host cannot export it; that path
+remains preview-only until device acceptance is complete.
+
+### How can I integrate Matrix Scroll into a CI/CD workflow?
+
+Install the SDK and hooks in your repo, publish commit envelopes to
+`refs/notes/matrixscroll` before PR review, and use
+`SSX360/matrixscroll-verify-action@v1` to verify the full PR commit range in
+GitHub Actions. Protected branches can then require Matrix Scroll proof
+alongside your existing scanners, branch protection, and build attestations.
+
+## Quickstart (CLI)
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.4.0"
 matrixscroll hook-install
+matrixscroll hook-status
 
 export MATRIXSCROLL_ACTOR_TYPE=agent
 export MATRIXSCROLL_TOOL=agent-runner
@@ -51,7 +154,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and run
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.4.0"
     require-mode: emulated
 ```
 
@@ -71,7 +174,7 @@ git push origin refs/notes/matrixscroll
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.4.0"
     summary-output: provenance-summary.json
 ```
 
@@ -79,7 +182,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and
 [`examples/ci/protected-branch.yml`](examples/ci/protected-branch.yml).
 
 The `--require-mode`, `--trusted-keys`, and actor or delegation policy checks
-are available in the `0.2.x` line; the examples in this README pin `0.2.6`.
+are available in the `0.2.x` line; the examples in this README pin `0.3.0`.
 
 ## Why it is different from Sigstore
 
@@ -103,12 +206,12 @@ when they preserve the same pure Ed25519 byte contract.
 - GitHub Action: <https://github.com/SSX360/matrixscroll-verify-action>
 - Agentic AI controls: [`docs/AGENTIC_AI_SECURITY.md`](docs/AGENTIC_AI_SECURITY.md)
 - Site: <https://matrixscroll.com>
-- Reference device path: <https://matrixscroll.com/device/>
+- Reference device path: [AP2 Vault Card hardware](https://ssx360.com/hardware)
 
 ## Python API
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.4.0"
 ```
 
 ```python
@@ -170,6 +273,11 @@ host transport preview and a mock path for CI; real SE050 signing still
 depends on device firmware validation. External-key backends stay out of the
 mainline until they can sign the same canonical bytes with Ed25519.
 
+For rollout order, start with `MATRIXSCROLL_MODE=emulated` for evaluation,
+layer in external Ed25519-capable signers only when they stay verifier
+compatible, and treat `hardware` as the SE050 preview path until device
+acceptance is complete.
+
 ## Compliance levels
 
 | Level | Provider | Backed by | Status |
@@ -205,6 +313,21 @@ example bounded-agent evidence manifest at
 [`examples/agentic_ai_evidence_manifest.json`](examples/agentic_ai_evidence_manifest.json),
 and executable checks in `tests/test_agentic_guidance.py`.
 
+## Model Context Protocol (MCP) Server
+
+The MCP server exposes **provenance verbs only**: `create_envelope`, `verify_envelope`,
+`verify_pr_range`, `publish_notes`, `status`, and `audit_export`.
+
+Install and register in Cursor / Claude Desktop / VS Code:
+
+```bash
+pip install "matrixscroll[mcp]==0.4.0"
+matrixscroll-mcp   # stdio
+```
+
+See the [Install — MCP server](#install--mcp-server-headline-path) section above for
+the recommended `mcp.json` snippet.
+
 ## License
 
 - Code: **Apache-2.0** (`LICENSE`).
@@ -214,3 +337,8 @@ and executable checks in `tests/test_agentic_guidance.py`.
 
 See [`SECURITY.md`](SECURITY.md). Report vulnerabilities privately to
 **security@matrixscroll.com** or via a GitHub Security Advisory.
+
+---
+
+**Protocol:** https://matrixscroll.com · **Verify:** https://matrixscroll.com/verify/  
+**Control plane:** https://ssx360.com · **Pilot:** mission@ssx360.com · **Sign in:** https://ssx360.com/signup

{matrixscroll-0.2.6 → matrixscroll-0.4.0}/docs/ADOPTER_KIT.md

@@ -11,7 +11,7 @@ who want to trial Matrix Scroll without changing their core workflow.
 
 ## 15-minute pilot
 
-1. Install `matrixscroll==0.2.6` in one repo.
+1. Install `matrixscroll==0.3.0` in one repo.
 2. Run `matrixscroll hook-install`.
 3. Make one agent-assisted commit and verify it locally.
 4. Publish notes with `matrixscroll envelope-publish-notes`.
@@ -38,7 +38,7 @@ jobs:
           head-ref: ${{ github.event.pull_request.head.sha }}
           base-ref: ${{ github.event.pull_request.base.sha }}
           source: notes
-          matrixscroll-version: "0.2.6"
+          matrixscroll-version: "0.3.0"
           require-mode: emulated
 ```
 
@@ -61,6 +61,26 @@ jobs:
 - Matrix Scroll does not replace IAM or sandboxing
 - Matrix Scroll does not replace release-signing or artifact attestations
 
+## Clean-machine proof status
+
+Recorded on `2026-06-21` against the pinned public flow:
+`pip install "matrixscroll==0.3.0"` -> `matrixscroll hook-install` ->
+`matrixscroll hook-status` -> first agent-assisted commit ->
+`matrixscroll envelope-verify`.
+
+Hosted source of truth: GitHub Actions run
+`27904509800` on `codex/trust-layer-rollout`.
+
+| Platform | Result | Notes |
+| --- | --- | --- |
+| Windows | PASS | GitHub-hosted smoke completed with `1.0s` to first verified commit. Local temp-venv proof also passed in `8.7s`. |
+| Ubuntu | PASS | GitHub-hosted smoke completed with `0.4s` to first verified commit. |
+| macOS | PASS | GitHub-hosted smoke completed with `0.3s` to first verified commit. |
+
+Local environment note: the workspace WSL image is still missing `python3-pip`
+and `python3-venv`, so local Ubuntu reproduction remains under-provisioned even
+though launch evidence is now covered by the hosted workflow.
+
 ## Public follow-through
 
 If a pilot works, publish one of these:

matrixscroll-0.4.0/docs/ADOPTION.md

@@ -0,0 +1,13 @@
+# Adoption signals (internal)
+
+Track outbound and registry traction while rolling out. Not published on the public README.
+
+| Signal | Counter |
+|--------|---------|
+| PyPI `matrixscroll` | [![PyPI downloads](https://img.shields.io/pypi/dm/matrixscroll)](https://pypi.org/project/matrixscroll/) |
+| PyPI `[mcp]` extra | [![PyPI MCP downloads](https://img.shields.io/pypi/dm/matrixscroll?label=mcp%20extra)](https://pypi.org/project/matrixscroll/) |
+| GitHub stars | [![GitHub stars](https://img.shields.io/github/stars/SSX360/matrixscroll?style=social)](https://github.com/SSX360/matrixscroll/stargazers) |
+| Scroll Gate Action | [![GitHub Action](https://img.shields.io/github/stars/SSX360/matrixscroll-verify-action?style=social)](https://github.com/SSX360/matrixscroll-verify-action) |
+| Glama MCP registry | [matrixscroll on Glama](https://glama.ai/mcp/servers/SSX360/matrixscroll) |
+
+Update this file during GTM reviews; keep badges out of user-facing install docs.

{matrixscroll-0.2.6 → matrixscroll-0.4.0}/docs/COMPARISON.md

@@ -60,7 +60,7 @@ No single competitor listed above combines all four today.
 - **CI gate:** Scroll Gate ships in **0.2.3+** — PR commit-range verification via `envelope-verify-range`, git notes transport (`refs/notes/matrixscroll`), and filesystem bundles. [`matrixscroll-verify-action`](https://github.com/SSX360/matrixscroll-verify-action) supports `head-ref`/`base-ref` range mode with agent/human counts.
 - **Owner/delegation attestation:** Optional `delegation` block in commit envelope schema (**0.2.4+**); see [`delegation-attestation-rfc.md`](delegation-attestation-rfc.md). Alien still leads on OIDC/DPoP owner binding.
 - **Multi-agent commits:** Multiple actors in one envelope — on the roadmap.
-- **Rekor / GUAC export:** Dry-run CLI ships in **0.2.6** (`envelope-publish-rekor`, `envelope-export-guac`); full Rekor upload integration still in progress.
+- **Rekor / GUAC export:** Dry-run CLI ships in **0.3.0** (`envelope-publish-rekor`, `envelope-export-guac`); full Rekor upload integration still in progress.
 - **Hardware:** SSX360 reference device and Scroll Key retail are **in progress**; L1 emulated key is what you can use now.
 
 ## When to use what

{matrixscroll-0.2.6 → matrixscroll-0.4.0}/docs/FIVE_MINUTES.md

@@ -12,7 +12,7 @@ five-minute path from `pip install` to a verifiable commit envelope.
 ## 1. Install the SDK
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.3.0"
 matrixscroll hook-install
 matrixscroll hook-status
 ```
@@ -61,7 +61,7 @@ git push origin refs/notes/matrixscroll
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.3.0"
     require-mode: emulated
 ```
 

matrixscroll-0.4.0/docs/HERO_DEMO.md

@@ -0,0 +1,45 @@
+# Hero demo script (60–90 seconds)
+
+Record this flow once. It is the highest-value GTM asset for the quarter.
+
+## Cast
+
+- **Agent:** Cursor or Claude Code in a bound workspace
+- **Producer:** `matrixscroll` hooks / MCP `create_envelope`
+- **Enforcer:** Scroll Gate (`SSX360/matrixscroll-verify-action@v1`)
+- **Verifier:** [matrixscroll.com/verify/](https://matrixscroll.com/verify/) (offline, no portal trust)
+
+## Beat sheet
+
+| Time | Screen | Narration hook |
+|------|--------|----------------|
+| 0:00 | Terminal / IDE | "An agent just committed. Who — or what — wrote it?" |
+| 0:10 | `git log -1` + hook output | "Matrix Scroll signs an Ed25519 envelope at commit time — actor, tool, scope." |
+| 0:25 | Envelope JSON (redacted keys OK) | "This is the proof object. Repo contents never left the machine." |
+| 0:35 | GitHub PR + Scroll Gate check | "Scroll Gate verifies the full PR range — signed vs unsigned, trusted vs untrusted." |
+| 0:50 | Browser verifier paste | "Anyone verifies offline at matrixscroll.com/verify — no SSX360 login required." |
+| 1:05 | SSX360 portal flash (optional) | "Identity, billing, and audit live on the control plane — verification does not." |
+| 1:15 | CTA slate | "Verify → Install → Pilot." |
+
+## Commands (copy-paste)
+
+```bash
+export MATRIXSCROLL_ACTOR_TYPE=agent
+export MATRIXSCROLL_TOOL=cursor
+git commit -m "feat: demo agent change"
+matrixscroll envelope-verify "$(git rev-parse HEAD)"
+matrixscroll envelope-publish-notes --base origin/main --head HEAD
+git push origin refs/notes/matrixscroll
+```
+
+Open PR → show **Scroll Gate** check green → paste envelope into browser verifier.
+
+## Do not say
+
+- "Required by" / "mandated" / regulation names as requirements
+- Repo intelligence / scanner as the lead story
+
+## Do say
+
+- "Maps to" / "produces evidence for" compliance frameworks
+- "Signed before merge" / "offline-verifiable" / "Scroll Gate"

{matrixscroll-0.2.6 → matrixscroll-0.4.0}/docs/ROADMAP_2026-07.md

@@ -8,13 +8,13 @@ what ships now before widening the story.
 ## Baseline on June 21, 2026
 
 - GitHub: early public repo, product-first docs, and offline verification
-- Current public release target: `matrixscroll==0.2.6`
+- Current public release target: `matrixscroll==0.3.0`
 - Public trust contract: pure Ed25519 over canonical manifest bytes
 - Hardware path: SSX360 SE050 reference implementation in progress
 
 ## Next 7 days
 
-- cut and publish `0.2.6` without widening the manifest or verify surface
+- cut and publish `0.3.0` without widening the manifest or verify surface
 - make the GitHub Action a real public proof surface
 - align site, README, action docs, and PyPI around one install flow
 - remove broken links and stale release drift from public copy