matrixscroll 0.3.0__tar.gz → 0.4.0__tar.gz

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/PKG-INFO

@@ -1,23 +1,24 @@
 Metadata-Version: 2.4
 Name: matrixscroll
-Version: 0.3.0
+Version: 0.4.0
 Summary: Signed provenance for agent-assisted Git commits with offline verification; emulated Ed25519 ships today and the SE050 hardware path remains an optional preview.
-Project-URL: Homepage, https://matrixscroll.com
-Project-URL: Documentation, https://matrixscroll.com/docs
+Project-URL: Homepage, https://ssx360.com
+Project-URL: Documentation, https://ssx360.com/docs
+Project-URL: Repository, https://github.com/SSX360/matrixscroll
 Project-URL: Source, https://github.com/SSX360/matrixscroll
 Project-URL: Issues, https://github.com/SSX360/matrixscroll/issues
 Project-URL: Specification, https://github.com/SSX360/matrixscroll/blob/main/SPEC.md
 Project-URL: Whitepaper, https://github.com/SSX360/matrixscroll/blob/main/docs/WHITEPAPER.md
-Project-URL: Verifier, https://matrixscroll.com/verify
-Project-URL: Compare, https://matrixscroll.com/compare
+Project-URL: Verifier, https://ssx360.com/verify
+Project-URL: Compare, https://ssx360.com/docs
 Project-URL: Changelog, https://github.com/SSX360/matrixscroll/blob/main/CHANGELOG.md
 Project-URL: Discussions, https://github.com/SSX360/matrixscroll/discussions
 Project-URL: Security, https://github.com/SSX360/matrixscroll/blob/main/SECURITY.md
 Project-URL: GitHub Action, https://github.com/SSX360/matrixscroll-verify-action
 Project-URL: PyPI Provenance, https://pypi.org/project/matrixscroll/
+Project-URL: Reference Device, https://ssx360.com/hardware
 Project-URL: Tests, https://github.com/SSX360/matrixscroll/tree/main/tests
 Project-URL: Public Roadmap, https://github.com/SSX360/matrixscroll/blob/main/docs/ROADMAP_2026-07.md
-Project-URL: Reference Device, https://matrixscroll.com/device
 Author-email: SSX360 <security@matrixscroll.com>
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -53,6 +54,8 @@ Description-Content-Type: text/markdown
 
 # Matrix Scroll
 
+[![Scroll Gate v2 (hosted)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml/badge.svg)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml)
+
 **Signed proof of who — or what — wrote every commit.** Matrix Scroll is the
 open Ed25519 commit-provenance protocol for agent-assisted Git — verified
 offline in CLI, browser, and CI. Hardware (SE050) is an optional preview trust
@@ -60,7 +63,7 @@ upgrade; emulated mode ships today.
 
 **Hosted control plane:** identity, billing, and device confirmation live at
 [ssx360.com](https://ssx360.com/). Teams evaluating protected-branch enforcement should
-[book a provenance pilot](mailto:mission@ssx360.com?subject=Provenance%20Pilot%20Inquiry);
+[book a provenance pilot](https://ssx360.com/contact?intent=pilot);
 Provisioned pilot and team accounts sign in at [ssx360.com/signup](https://ssx360.com/signup).
 
 ## Compliance evidence mapping
@@ -74,22 +77,6 @@ Matrix Scroll **maps to** and **produces evidence for** (never “required by”
 
 Full matrix: [`controls/agentic_ai_controls.json`](controls/agentic_ai_controls.json)
 
-## Adoption signals
-
-Track outbound and registry traction while rolling out:
-
-| Signal | Counter |
-|--------|---------|
-| PyPI `matrixscroll` | [![PyPI downloads](https://img.shields.io/pypi/dm/matrixscroll)](https://pypi.org/project/matrixscroll/) |
-| PyPI `[mcp]` extra | [![PyPI MCP downloads](https://img.shields.io/pypi/dm/matrixscroll?label=mcp%20extra)](https://pypi.org/project/matrixscroll/) |
-| GitHub stars | [![GitHub stars](https://img.shields.io/github/stars/SSX360/matrixscroll?style=social)](https://github.com/SSX360/matrixscroll/stargazers) |
-| Scroll Gate Action | [![GitHub Action](https://img.shields.io/github/stars/SSX360/matrixscroll-verify-action?style=social)](https://github.com/SSX360/matrixscroll-verify-action) |
-| Glama MCP registry | [matrixscroll on Glama](https://glama.ai/mcp/servers/SSX360/matrixscroll) |
-
-## Hero demo (post–MCP merge)
-
-Record the 60–90s provenance flow in [`docs/HERO_DEMO.md`](docs/HERO_DEMO.md) — Scroll Gate + browser verifier + MCP verbs only.
-
 ## Install — MCP server (headline path)
 
 Agents sign commits in-loop via the **provenance-only** MCP server:
@@ -106,7 +93,7 @@ Agents sign commits in-loop via the **provenance-only** MCP server:
 ```
 
 ```bash
-pip install "matrixscroll[mcp]==0.3.0"
+pip install "matrixscroll[mcp]==0.4.0"
 matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
 ```
 
@@ -116,7 +103,7 @@ matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
 ## Also available — CLI & hooks
 
 ```bash
-pip install "matrixscroll==0.3.0"
+pip install "matrixscroll==0.4.0"
 matrixscroll hook-install
 export MATRIXSCROLL_ACTOR_TYPE=agent
 export MATRIXSCROLL_TOOL=agent-runner
@@ -149,11 +136,11 @@ preview path until device acceptance is complete.
 
 ## Honest limits
 
-- Shipping now: PyPI `matrixscroll==0.3.0`, Git post-commit hooks,
+- Shipping now: PyPI `matrixscroll==0.4.0`, Git post-commit hooks,
   `matrixscroll envelope-verify`, Scroll Gate PR verification, browser
   verifier, the GitHub Action, and a USB CDC host transport preview for the
   SE050 rollout path. Emulated mode is the default evaluation path.
-- In progress: RP2350 + SE050 firmware validation, external Ed25519-capable
+- In progress: nRF52840 + SE050 firmware validation (AP2 Vault Card PoC), external Ed25519-capable
   hardware key backends, and transparency-log integrations.
 - Not: IAM, sandboxing, prompt filtering, or an agent runtime.
 
@@ -194,7 +181,7 @@ alongside your existing scanners, branch protection, and build attestations.
 ## Quickstart (CLI)
 
 ```bash
-pip install "matrixscroll==0.3.0"
+pip install "matrixscroll==0.4.0"
 matrixscroll hook-install
 matrixscroll hook-status
 
@@ -221,7 +208,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and run
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.3.0"
+    matrixscroll-version: "0.4.0"
     require-mode: emulated
 ```
 
@@ -241,7 +228,7 @@ git push origin refs/notes/matrixscroll
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.3.0"
+    matrixscroll-version: "0.4.0"
     summary-output: provenance-summary.json
 ```
 
@@ -273,12 +260,12 @@ when they preserve the same pure Ed25519 byte contract.
 - GitHub Action: <https://github.com/SSX360/matrixscroll-verify-action>
 - Agentic AI controls: [`docs/AGENTIC_AI_SECURITY.md`](docs/AGENTIC_AI_SECURITY.md)
 - Site: <https://matrixscroll.com>
-- Reference device path: [SSX360](https://matrixscroll.com/device)
+- Reference device path: [AP2 Vault Card hardware](https://ssx360.com/hardware)
 
 ## Python API
 
 ```bash
-pip install "matrixscroll==0.3.0"
+pip install "matrixscroll==0.4.0"
 ```
 
 ```python
@@ -388,7 +375,7 @@ The MCP server exposes **provenance verbs only**: `create_envelope`, `verify_env
 Install and register in Cursor / Claude Desktop / VS Code:
 
 ```bash
-pip install "matrixscroll[mcp]==0.3.0"
+pip install "matrixscroll[mcp]==0.4.0"
 matrixscroll-mcp   # stdio
 ```
 

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/README.md

@@ -1,5 +1,7 @@
 # Matrix Scroll
 
+[![Scroll Gate v2 (hosted)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml/badge.svg)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml)
+
 **Signed proof of who — or what — wrote every commit.** Matrix Scroll is the
 open Ed25519 commit-provenance protocol for agent-assisted Git — verified
 offline in CLI, browser, and CI. Hardware (SE050) is an optional preview trust
@@ -7,7 +9,7 @@ upgrade; emulated mode ships today.
 
 **Hosted control plane:** identity, billing, and device confirmation live at
 [ssx360.com](https://ssx360.com/). Teams evaluating protected-branch enforcement should
-[book a provenance pilot](mailto:mission@ssx360.com?subject=Provenance%20Pilot%20Inquiry);
+[book a provenance pilot](https://ssx360.com/contact?intent=pilot);
 Provisioned pilot and team accounts sign in at [ssx360.com/signup](https://ssx360.com/signup).
 
 ## Compliance evidence mapping
@@ -21,22 +23,6 @@ Matrix Scroll **maps to** and **produces evidence for** (never “required by”
 
 Full matrix: [`controls/agentic_ai_controls.json`](controls/agentic_ai_controls.json)
 
-## Adoption signals
-
-Track outbound and registry traction while rolling out:
-
-| Signal | Counter |
-|--------|---------|
-| PyPI `matrixscroll` | [![PyPI downloads](https://img.shields.io/pypi/dm/matrixscroll)](https://pypi.org/project/matrixscroll/) |
-| PyPI `[mcp]` extra | [![PyPI MCP downloads](https://img.shields.io/pypi/dm/matrixscroll?label=mcp%20extra)](https://pypi.org/project/matrixscroll/) |
-| GitHub stars | [![GitHub stars](https://img.shields.io/github/stars/SSX360/matrixscroll?style=social)](https://github.com/SSX360/matrixscroll/stargazers) |
-| Scroll Gate Action | [![GitHub Action](https://img.shields.io/github/stars/SSX360/matrixscroll-verify-action?style=social)](https://github.com/SSX360/matrixscroll-verify-action) |
-| Glama MCP registry | [matrixscroll on Glama](https://glama.ai/mcp/servers/SSX360/matrixscroll) |
-
-## Hero demo (post–MCP merge)
-
-Record the 60–90s provenance flow in [`docs/HERO_DEMO.md`](docs/HERO_DEMO.md) — Scroll Gate + browser verifier + MCP verbs only.
-
 ## Install — MCP server (headline path)
 
 Agents sign commits in-loop via the **provenance-only** MCP server:
@@ -53,7 +39,7 @@ Agents sign commits in-loop via the **provenance-only** MCP server:
 ```
 
 ```bash
-pip install "matrixscroll[mcp]==0.3.0"
+pip install "matrixscroll[mcp]==0.4.0"
 matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
 ```
 
@@ -63,7 +49,7 @@ matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
 ## Also available — CLI & hooks
 
 ```bash
-pip install "matrixscroll==0.3.0"
+pip install "matrixscroll==0.4.0"
 matrixscroll hook-install
 export MATRIXSCROLL_ACTOR_TYPE=agent
 export MATRIXSCROLL_TOOL=agent-runner
@@ -96,11 +82,11 @@ preview path until device acceptance is complete.
 
 ## Honest limits
 
-- Shipping now: PyPI `matrixscroll==0.3.0`, Git post-commit hooks,
+- Shipping now: PyPI `matrixscroll==0.4.0`, Git post-commit hooks,
   `matrixscroll envelope-verify`, Scroll Gate PR verification, browser
   verifier, the GitHub Action, and a USB CDC host transport preview for the
   SE050 rollout path. Emulated mode is the default evaluation path.
-- In progress: RP2350 + SE050 firmware validation, external Ed25519-capable
+- In progress: nRF52840 + SE050 firmware validation (AP2 Vault Card PoC), external Ed25519-capable
   hardware key backends, and transparency-log integrations.
 - Not: IAM, sandboxing, prompt filtering, or an agent runtime.
 
@@ -141,7 +127,7 @@ alongside your existing scanners, branch protection, and build attestations.
 ## Quickstart (CLI)
 
 ```bash
-pip install "matrixscroll==0.3.0"
+pip install "matrixscroll==0.4.0"
 matrixscroll hook-install
 matrixscroll hook-status
 
@@ -168,7 +154,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and run
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.3.0"
+    matrixscroll-version: "0.4.0"
     require-mode: emulated
 ```
 
@@ -188,7 +174,7 @@ git push origin refs/notes/matrixscroll
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.3.0"
+    matrixscroll-version: "0.4.0"
     summary-output: provenance-summary.json
 ```
 
@@ -220,12 +206,12 @@ when they preserve the same pure Ed25519 byte contract.
 - GitHub Action: <https://github.com/SSX360/matrixscroll-verify-action>
 - Agentic AI controls: [`docs/AGENTIC_AI_SECURITY.md`](docs/AGENTIC_AI_SECURITY.md)
 - Site: <https://matrixscroll.com>
-- Reference device path: [SSX360](https://matrixscroll.com/device)
+- Reference device path: [AP2 Vault Card hardware](https://ssx360.com/hardware)
 
 ## Python API
 
 ```bash
-pip install "matrixscroll==0.3.0"
+pip install "matrixscroll==0.4.0"
 ```
 
 ```python
@@ -335,7 +321,7 @@ The MCP server exposes **provenance verbs only**: `create_envelope`, `verify_env
 Install and register in Cursor / Claude Desktop / VS Code:
 
 ```bash
-pip install "matrixscroll[mcp]==0.3.0"
+pip install "matrixscroll[mcp]==0.4.0"
 matrixscroll-mcp   # stdio
 ```
 

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/docs/ADOPTER_KIT.md

@@ -11,7 +11,7 @@ who want to trial Matrix Scroll without changing their core workflow.
 
 ## 15-minute pilot
 
-1. Install `matrixscroll==0.2.6` in one repo.
+1. Install `matrixscroll==0.3.0` in one repo.
 2. Run `matrixscroll hook-install`.
 3. Make one agent-assisted commit and verify it locally.
 4. Publish notes with `matrixscroll envelope-publish-notes`.
@@ -38,7 +38,7 @@ jobs:
           head-ref: ${{ github.event.pull_request.head.sha }}
           base-ref: ${{ github.event.pull_request.base.sha }}
           source: notes
-          matrixscroll-version: "0.2.6"
+          matrixscroll-version: "0.3.0"
           require-mode: emulated
 ```
 
@@ -64,7 +64,7 @@ jobs:
 ## Clean-machine proof status
 
 Recorded on `2026-06-21` against the pinned public flow:
-`pip install "matrixscroll==0.2.6"` -> `matrixscroll hook-install` ->
+`pip install "matrixscroll==0.3.0"` -> `matrixscroll hook-install` ->
 `matrixscroll hook-status` -> first agent-assisted commit ->
 `matrixscroll envelope-verify`.
 

matrixscroll-0.4.0/docs/ADOPTION.md

@@ -0,0 +1,13 @@
+# Adoption signals (internal)
+
+Track outbound and registry traction while rolling out. Not published on the public README.
+
+| Signal | Counter |
+|--------|---------|
+| PyPI `matrixscroll` | [![PyPI downloads](https://img.shields.io/pypi/dm/matrixscroll)](https://pypi.org/project/matrixscroll/) |
+| PyPI `[mcp]` extra | [![PyPI MCP downloads](https://img.shields.io/pypi/dm/matrixscroll?label=mcp%20extra)](https://pypi.org/project/matrixscroll/) |
+| GitHub stars | [![GitHub stars](https://img.shields.io/github/stars/SSX360/matrixscroll?style=social)](https://github.com/SSX360/matrixscroll/stargazers) |
+| Scroll Gate Action | [![GitHub Action](https://img.shields.io/github/stars/SSX360/matrixscroll-verify-action?style=social)](https://github.com/SSX360/matrixscroll-verify-action) |
+| Glama MCP registry | [matrixscroll on Glama](https://glama.ai/mcp/servers/SSX360/matrixscroll) |
+
+Update this file during GTM reviews; keep badges out of user-facing install docs.

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/docs/COMPARISON.md

@@ -60,7 +60,7 @@ No single competitor listed above combines all four today.
 - **CI gate:** Scroll Gate ships in **0.2.3+** — PR commit-range verification via `envelope-verify-range`, git notes transport (`refs/notes/matrixscroll`), and filesystem bundles. [`matrixscroll-verify-action`](https://github.com/SSX360/matrixscroll-verify-action) supports `head-ref`/`base-ref` range mode with agent/human counts.
 - **Owner/delegation attestation:** Optional `delegation` block in commit envelope schema (**0.2.4+**); see [`delegation-attestation-rfc.md`](delegation-attestation-rfc.md). Alien still leads on OIDC/DPoP owner binding.
 - **Multi-agent commits:** Multiple actors in one envelope — on the roadmap.
-- **Rekor / GUAC export:** Dry-run CLI ships in **0.2.6** (`envelope-publish-rekor`, `envelope-export-guac`); full Rekor upload integration still in progress.
+- **Rekor / GUAC export:** Dry-run CLI ships in **0.3.0** (`envelope-publish-rekor`, `envelope-export-guac`); full Rekor upload integration still in progress.
 - **Hardware:** SSX360 reference device and Scroll Key retail are **in progress**; L1 emulated key is what you can use now.
 
 ## When to use what

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/docs/FIVE_MINUTES.md

@@ -12,7 +12,7 @@ five-minute path from `pip install` to a verifiable commit envelope.
 ## 1. Install the SDK
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.3.0"
 matrixscroll hook-install
 matrixscroll hook-status
 ```
@@ -61,7 +61,7 @@ git push origin refs/notes/matrixscroll
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.3.0"
     require-mode: emulated
 ```
 

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/docs/ROADMAP_2026-07.md

@@ -8,13 +8,13 @@ what ships now before widening the story.
 ## Baseline on June 21, 2026
 
 - GitHub: early public repo, product-first docs, and offline verification
-- Current public release target: `matrixscroll==0.2.6`
+- Current public release target: `matrixscroll==0.3.0`
 - Public trust contract: pure Ed25519 over canonical manifest bytes
 - Hardware path: SSX360 SE050 reference implementation in progress
 
 ## Next 7 days
 
-- cut and publish `0.2.6` without widening the manifest or verify surface
+- cut and publish `0.3.0` without widening the manifest or verify surface
 - make the GitHub Action a real public proof surface
 - align site, README, action docs, and PyPI around one install flow
 - remove broken links and stale release drift from public copy

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/docs/WHITEPAPER.md

@@ -71,7 +71,7 @@ Full wire format: [`SPEC.md`](../SPEC.md). Schema: [`schemas/commit-envelope.v1.
 ### 1. Install
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.3.0"
 matrixscroll hook-install
 matrixscroll hook-status
 ```
@@ -87,7 +87,7 @@ matrixscroll envelope-verify "$(git rev-parse HEAD)"
 
 Hooks default to **warn mode**; set `"enforce": true` in `.git/matrixscroll/config.json` to block commits when signing fails. See [`docs/quickstart-git.md`](quickstart-git.md).
 
-**Windows:** support landed in matrixscroll **0.2.1**; pin **0.2.6** or newer in pilot environments.
+**Windows:** support landed in matrixscroll **0.2.1**; pin **0.3.0** or newer in pilot environments.
 
 ### 3. CI gate
 
@@ -95,12 +95,12 @@ Hooks default to **warn mode**; set `"enforce": true` in `.git/matrixscroll/conf
 - uses: SSX360/matrixscroll-verify-action@v1
   with:
     manifest: path/to/signed-manifest.json
-    matrixscroll-version: "0.2.6"
+    matrixscroll-version: "0.3.0"
     require-mode: emulated
     trusted-keys: trusted-keys.json
 ```
 
-Policy flags (`--require-mode`, `--trusted-keys`) are available in the `0.2.x` line; this whitepaper pins `0.2.6` for copy-and-paste examples.
+Policy flags (`--require-mode`, `--trusted-keys`) are available in the `0.2.x` line; this whitepaper pins `0.3.0` for copy-and-paste examples.
 
 ### 4. Optional scope manifest
 

matrixscroll-0.4.0/docs/commercial/PLATFORM_PIVOT.md

@@ -0,0 +1,62 @@
+# SSX360 platform pivot — migration guide
+
+Matrix Scroll remains the **open protocol and thin client** (PyPI + MCP). SSX360 is the **hosted control plane** for identity, billing, network verification, audit, and fleet cards.
+
+## URL map
+
+| Old | New |
+|-----|-----|
+| matrixscroll.com (catch-all) | ssx360.com/docs |
+| matrixscroll.com/verify | ssx360.com/verify |
+| matrixscroll.com/hardware | ssx360.com/hardware |
+| PyPI Homepage | ssx360.com |
+
+## Product split
+
+**Free (local):** `create_envelope`, `verify_envelope`, `status`, emulated signing, hooks.
+
+**Paid (network, `SSX360_API_KEY`):** hosted Scroll Gate, `list_envelopes`, platform audit export, team policy, compliance.
+
+## Signup & API keys
+
+1. Sign up at [ssx360.com/signup](https://ssx360.com/signup)
+2. A **Community API key** is provisioned automatically on first sign-in
+3. Community tier: **100 hosted verifications/day**
+4. Manage keys at [ssx360.com/settings](https://ssx360.com/settings)
+
+## CI migration (Scroll Gate v2)
+
+See [SCROLL_GATE_V2.md](./SCROLL_GATE_V2.md). Set `SSX360_API_KEY` in GitHub Actions secrets.
+
+## SDK 0.4.0
+
+```bash
+pip install "matrixscroll[mcp]==0.4.0"
+```
+
+New module: `matrixscroll.cloud` — HTTP client for ssx360.com APIs.
+
+## MCP environment
+
+```json
+{
+  "mcpServers": {
+    "matrixscroll-mcp": {
+      "command": "matrixscroll-mcp",
+      "env": {
+        "SSX360_API_KEY": "sk_live_..."
+      }
+    }
+  }
+}
+```
+
+## Pricing tiers
+
+| Tier | Price | Highlights |
+|------|-------|------------|
+| Community | Free | Auto API key, 100 verifications/day, local signing |
+| Team | $99–299/org/mo | Seats, audit export, shared history |
+| Enterprise | Contact | SSO, SIEM, custom policy |
+
+Upgrade at [ssx360.com/#pricing](https://ssx360.com/#pricing).

matrixscroll-0.4.0/docs/commercial/SCROLL_GATE_V2.md

@@ -0,0 +1,47 @@
+# Scroll Gate v2 — hosted verification
+
+Scroll Gate **v2** calls the SSX360 hosted API. Local-only verification remains in the Matrix Scroll SDK and MCP (`verify_envelope`, offline `source=local|notes|bundle`).
+
+## Requirements
+
+- **`SSX360_API_KEY`** — required for CI and hosted MCP Scroll Gate
+- Community tier includes **100 CI verifications/day**
+- Get a key at [ssx360.com/signup](https://ssx360.com/signup)
+
+## GitHub Actions
+
+Add repository secret `SSX360_API_KEY` (Settings → Secrets → Actions).
+
+The workflow in `.github/workflows/provenance-gate.yml` posts to:
+
+```text
+POST https://ssx360.com/api/v1/verify
+Authorization: Bearer $SSX360_API_KEY
+```
+
+Example body:
+
+```json
+{
+  "base": "<base-sha>",
+  "head": "<head-sha>",
+  "commits": []
+}
+```
+
+## Migration from v1
+
+| v1 (local) | v2 (hosted) |
+|------------|-------------|
+| `matrixscroll-verify-action@v1` | `curl` or `@v2` action against ssx360.com |
+| Local git notes only | Network audit + usage metering |
+| No API key | `SSX360_API_KEY` required |
+
+## MCP
+
+Set `SSX360_API_KEY` in your MCP server environment. The default `verify_pr_range` source is `hosted`. Use `source=notes` for offline git-notes verification without a key.
+
+## Docs
+
+- Platform docs: [ssx360.com/docs](https://ssx360.com/docs)
+- Migration guide: [PLATFORM_PIVOT.md](./PLATFORM_PIVOT.md)

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/docs/hardware-provider.md

@@ -23,7 +23,7 @@ matrixscroll status
 ## Quickstart (USB CDC preview)
 
 ```bash
-pip install "matrixscroll[hardware]==0.2.6"
+pip install "matrixscroll[hardware]==0.3.0"
 export MATRIXSCROLL_MODE=hardware
 export MATRIXSCROLL_SE050_PORT=/dev/ttyACM0
 matrixscroll status

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/docs/quickstart-agent.md

@@ -6,7 +6,7 @@ without coupling public docs to a specific editor or assistant brand.
 ## One-time setup
 
 ```bash
-pip install "matrixscroll>=0.2.6"
+pip install "matrixscroll>=0.3.0"
 matrixscroll hook-install
 ```
 

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/docs/quickstart-claude-code.md

@@ -6,7 +6,7 @@ verifiable provenance.
 ## One-time setup
 
 ```bash
-pip install "matrixscroll>=0.2.6"
+pip install "matrixscroll>=0.3.0"
 matrixscroll hook-install
 ```
 

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/docs/quickstart-git.md

@@ -12,7 +12,7 @@ verify that proof offline before merge.
 ## Install hooks
 
 ```bash
-pip install "matrixscroll==0.2.6"
+pip install "matrixscroll==0.3.0"
 matrixscroll hook-install
 matrixscroll hook-status
 ```
@@ -42,10 +42,10 @@ Enable enforce mode in `.git/matrixscroll/config.json`:
 
 ## Windows
 
-Windows support landed in **matrixscroll 0.2.1**. Pin `0.2.6` or newer after upgrading:
+Windows support landed in **matrixscroll 0.2.1**. Pin `0.3.0` or newer after upgrading:
 
 ```powershell
-pip install -U "matrixscroll==0.2.6"
+pip install -U "matrixscroll==0.3.0"
 matrixscroll hook-install
 ```
 
@@ -89,7 +89,7 @@ Use [`SSX360/matrixscroll-verify-action@v1`](https://github.com/SSX360/matrixscr
 
 ## How can I integrate Matrix Scroll into a CI/CD workflow?
 
-1. Install `matrixscroll==0.2.6` and `matrixscroll hook-install` in the repo.
+1. Install `matrixscroll==0.3.0` and `matrixscroll hook-install` in the repo.
 2. Publish commit envelopes to `refs/notes/matrixscroll` before PR review.
 3. Run `SSX360/matrixscroll-verify-action@v1` in GitHub Actions to verify the
    full PR commit range from notes.

matrixscroll-0.4.0/docs/quickstart-mcp.md

@@ -0,0 +1,62 @@
+# Matrix Scroll MCP quickstart
+
+Install the provenance MCP server so agents can sign and verify commit envelopes in-loop.
+
+## Install
+
+```bash
+pip install "matrixscroll[mcp]==0.4.0"
+```
+
+The console script `matrixscroll-mcp` is the preferred entry point. `python -m matrixscroll.mcp` also works.
+
+## Register in your editor
+
+Add this to `.cursor/mcp.json` (project) or your global MCP config:
+
+```json
+{
+  "mcpServers": {
+    "matrixscroll-mcp": {
+      "type": "stdio",
+      "command": "matrixscroll-mcp",
+      "args": [],
+      "env": {
+        "SSX360_API_KEY": "sk_live_..."
+      }
+    }
+  }
+}
+```
+
+On Windows, if `matrixscroll-mcp` is not on PATH, use the full path to the script inside your virtual environment.
+
+Get a free Community API key (100 hosted verifications/day) at [ssx360.com/signup](https://ssx360.com/signup).
+
+## Verify the connection
+
+1. Enable the server in your editor's MCP settings.
+2. Invoke the `status` tool (free, local).
+3. Invoke `list_envelopes` to confirm network access with your API key.
+
+## Tool tiers
+
+| Tool | Tier |
+|------|------|
+| `create_envelope`, `verify_envelope`, `status` | Free (local) |
+| `verify_pr_range` (hosted), `list_envelopes`, `audit_export` | Requires `SSX360_API_KEY` |
+
+Use `verify_pr_range` with `source=notes` for offline git-notes verification without a key.
+
+## CLI and hooks (repos without MCP)
+
+For Git hook and CI workflows without MCP, use:
+
+```bash
+pip install "matrixscroll==0.4.0"
+matrixscroll hook-install
+```
+
+Scroll Gate v2 CI calls `https://ssx360.com/api/v1/verify` — see [SCROLL_GATE_V2.md](./commercial/SCROLL_GATE_V2.md).
+
+See [FIVE_MINUTES.md](./FIVE_MINUTES.md) for the hook path.

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/docs/rekor-guac-bridge-design.md

@@ -1,6 +1,6 @@
 # Rekor / GUAC envelope bridge (design)
 
-> Status: MVP shipped in v0.2.6 (`envelope-export-guac`, `envelope-publish-rekor` dry-run).
+> Status: MVP shipped in v0.3.0 (`envelope-export-guac`, `envelope-publish-rekor` dry-run).
 
 ## Goal
 

{matrixscroll-0.3.0 → matrixscroll-0.4.0}/examples/ci/protected-branch.yml

@@ -24,7 +24,7 @@ jobs:
         uses: SSX360/matrixscroll-verify-action@v1
         with:
           manifest: examples/release-manifest.signed.json
-          matrixscroll-version: "0.2.6"
+          matrixscroll-version: "0.3.0"
 
   verify-pr-envelopes:
     runs-on: ubuntu-latest
@@ -42,7 +42,7 @@ jobs:
           source: notes
           notes-ref: refs/notes/matrixscroll
           fetch-notes: "true"
-          matrixscroll-version: "0.2.6"
+          matrixscroll-version: "0.3.0"
           summary-output: provenance-summary.json
         # Optional policy enforcement:
         # require-mode: emulated
@@ -71,4 +71,4 @@ jobs:
           base-ref: ${{ github.event.pull_request.base.sha }}
           source: bundle
           bundle-dir: evidence/bundle
-          matrixscroll-version: "0.2.6"
+          matrixscroll-version: "0.3.0"