matrixscroll 0.4.1__tar.gz → 0.4.2__tar.gz

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to the Matrix Scroll Python SDK are documented here. The
 format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.2] - 2026-06-29
+
+Crypto backend consolidation (middle path).
+
+### Changed
+- **`matrixscroll.crypto_backend`** — all Ed25519 sign/verify/keygen and
+  security-relevant SHA-256 hashing route through the `cryptography` package
+  (native wheels; no user Rust toolchain).
+- **Dependency** — `cryptography>=42.0` is now required (was `>=41.0`).
+- **Docs** — `docs/CRYPTO_BACKEND.md`, README security note, SECURITY_PROPERTIES
+  backend section.
+
+### Removed
+- Scattered direct `cryptography` / `hashlib` calls in providers and gate paths
+  in favor of the centralized backend module (Git SHA-1 wire hashing unchanged).
+
 ## [0.4.1] - 2026-06-29
 
 Universal provenance SDK expansion and SSX360 Scroll Phase 1 wrapper.

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: matrixscroll
-Version: 0.4.1
+Version: 0.4.2
 Summary: Signed provenance for agent-assisted Git commits with offline verification; emulated Ed25519 ships today and the SE050 hardware path remains an optional preview.
 Project-URL: Homepage, https://ssx360.com
 Project-URL: Documentation, https://ssx360.com/docs
@@ -38,7 +38,7 @@ Classifier: Topic :: Security :: Cryptography
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
-Requires-Dist: cryptography>=41.0
+Requires-Dist: cryptography>=42.0
 Provides-Extra: dev
 Requires-Dist: build>=1.0; extra == 'dev'
 Requires-Dist: hypothesis>=6.100; extra == 'dev'
@@ -60,7 +60,7 @@ Description-Content-Type: text/markdown
 [![Scroll Gate v2 (hosted)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml/badge.svg)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml)
 [![codecov](https://codecov.io/gh/SSX360/matrixscroll/graph/badge.svg)](https://codecov.io/gh/SSX360/matrixscroll)
 
-**112 tests** · Hypothesis-verified security properties · [Security properties](docs/SECURITY_PROPERTIES.md)
+**123 tests** · Hypothesis-verified security properties · [Security properties](docs/SECURITY_PROPERTIES.md)
 
 **Signed proof of who — or what — wrote every commit.** Matrix Scroll is the
 **universal provenance SDK** — open Ed25519 envelopes for Git commits, CI steps,
@@ -68,6 +68,10 @@ IaC changes, DB migrations, API calls, and smart-contract deploys — verified
 offline in CLI, browser, and CI. Hardware (SE050) is an optional preview trust
 upgrade; emulated mode ships today.
 
+**TAM wedge (honest):** Layer 2 universal provenance SDK ($50–200M) · Layer 3 SSX360 Scroll
+governance on Git ($200M–1B) · Scroll Gate CI ($50–150M) · Python-first ML/agent
+ecosystem via `pip install matrixscroll`.
+
 **Hosted control plane:** identity, billing, and device confirmation live at
 [ssx360.com](https://ssx360.com/). Teams evaluating protected-branch enforcement should
 [book a provenance pilot](https://ssx360.com/contact?intent=pilot);
@@ -100,7 +104,7 @@ Agents sign commits in-loop via the **provenance-only** MCP server:
 ```
 
 ```bash
-pip install "matrixscroll[mcp]==0.4.1"
+pip install "matrixscroll[mcp]==0.4.2"
 matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
 ```
 
@@ -111,7 +115,7 @@ matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
 ## Also available — CLI & hooks
 
 ```bash
-pip install "matrixscroll==0.4.1"
+pip install "matrixscroll==0.4.2"
 matrixscroll hook-install
 export MATRIXSCROLL_ACTOR_TYPE=agent
 export MATRIXSCROLL_TOOL=agent-runner
@@ -175,7 +179,7 @@ canonical UTF-8 JSON bytes (see [`SPEC.md`](SPEC.md) §4). Verifiers reject any
 
 ## Honest limits
 
-- Shipping now: PyPI `matrixscroll==0.4.1`, Git post-commit hooks,
+- Shipping now: PyPI `matrixscroll==0.4.2`, Git post-commit hooks,
   `matrixscroll sign-action`, `matrixscroll scroll commit` (thin wrapper),
   `matrixscroll envelope-verify`, Scroll Gate PR verification (partial SLSA L1–2),
   verifier, the GitHub Action, and a USB CDC host transport preview for the
@@ -221,7 +225,7 @@ alongside your existing scanners, branch protection, and build attestations.
 ## Quickstart (CLI)
 
 ```bash
-pip install "matrixscroll==0.4.1"
+pip install "matrixscroll==0.4.2"
 matrixscroll hook-install
 matrixscroll hook-status
 
@@ -248,7 +252,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and run
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.4.1"
+    matrixscroll-version: "0.4.2"
     require-mode: emulated
 ```
 
@@ -268,7 +272,7 @@ git push origin refs/notes/matrixscroll
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.4.1"
+    matrixscroll-version: "0.4.2"
     summary-output: provenance-summary.json
 ```
 
@@ -276,7 +280,15 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and
 [`examples/ci/protected-branch.yml`](examples/ci/protected-branch.yml).
 
 The `--require-mode`, `--trusted-keys`, and actor or delegation policy checks
-are available in the `0.2.x` line; the examples in this README pin `0.3.0`.
+ship in the current release line; examples in this README pin `0.4.2`.
+
+## Security: Ed25519 via cryptography
+
+Ed25519 signing, verification, and key generation use the [`cryptography`](https://pypi.org/project/cryptography/)
+package (required dependency, `>=42.0`). Official wheels ship native crypto
+backends (OpenSSL + Rust components) — no Rust toolchain for users. All
+primitives are centralized in `matrixscroll/crypto_backend.py`; see
+[`docs/CRYPTO_BACKEND.md`](docs/CRYPTO_BACKEND.md).
 
 ## Why it is different from Sigstore
 
@@ -291,21 +303,22 @@ when they preserve the same pure Ed25519 byte contract.
 
 ## Public proof links
 
-- Browser verifier: <https://matrixscroll.com/verify/>
-- Compare page: <https://matrixscroll.com/compare/>
+- Browser verifier: <https://ssx360.com/verify>
+- Compare page: <https://ssx360.com/compare>
+- Documentation: <https://ssx360.com/docs>
 - Specification: [`SPEC.md`](SPEC.md)
 - Commit envelope schema: [`schemas/commit-envelope.v1.json`](schemas/commit-envelope.v1.json)
 - Whitepaper: [`docs/WHITEPAPER.md`](docs/WHITEPAPER.md)
 - Conformance vectors: [`vectors/`](vectors/)
 - GitHub Action: <https://github.com/SSX360/matrixscroll-verify-action>
 - Agentic AI controls: [`docs/AGENTIC_AI_SECURITY.md`](docs/AGENTIC_AI_SECURITY.md)
-- Site: <https://matrixscroll.com>
+- Site: <https://ssx360.com/docs> (matrixscroll.com redirects here)
 - Reference device path: [AP2 Vault Card hardware](https://ssx360.com/hardware)
 
 ## Python API
 
 ```bash
-pip install "matrixscroll==0.4.1"
+pip install "matrixscroll==0.4.2"
 ```
 
 ```python
@@ -415,7 +428,7 @@ The MCP server exposes **provenance verbs only**: `create_envelope`, `verify_env
 Install and register in Cursor / Claude Desktop / VS Code:
 
 ```bash
-pip install "matrixscroll[mcp]==0.4.1"
+pip install "matrixscroll[mcp]==0.4.2"
 matrixscroll-mcp   # stdio
 ```
 
@@ -435,5 +448,5 @@ Report vulnerabilities privately to
 
 ---
 
-**Protocol:** https://matrixscroll.com · **Verify:** https://matrixscroll.com/verify/  
+**Protocol:** https://ssx360.com/docs · **Verify:** https://ssx360.com/verify  
 **Control plane:** https://ssx360.com · **Pilot:** mission@ssx360.com · **Sign in:** https://ssx360.com/signup

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/README.md

@@ -4,7 +4,7 @@
 [![Scroll Gate v2 (hosted)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml/badge.svg)](https://github.com/SSX360/matrixscroll/actions/workflows/provenance-gate.yml)
 [![codecov](https://codecov.io/gh/SSX360/matrixscroll/graph/badge.svg)](https://codecov.io/gh/SSX360/matrixscroll)
 
-**112 tests** · Hypothesis-verified security properties · [Security properties](docs/SECURITY_PROPERTIES.md)
+**123 tests** · Hypothesis-verified security properties · [Security properties](docs/SECURITY_PROPERTIES.md)
 
 **Signed proof of who — or what — wrote every commit.** Matrix Scroll is the
 **universal provenance SDK** — open Ed25519 envelopes for Git commits, CI steps,
@@ -12,6 +12,10 @@ IaC changes, DB migrations, API calls, and smart-contract deploys — verified
 offline in CLI, browser, and CI. Hardware (SE050) is an optional preview trust
 upgrade; emulated mode ships today.
 
+**TAM wedge (honest):** Layer 2 universal provenance SDK ($50–200M) · Layer 3 SSX360 Scroll
+governance on Git ($200M–1B) · Scroll Gate CI ($50–150M) · Python-first ML/agent
+ecosystem via `pip install matrixscroll`.
+
 **Hosted control plane:** identity, billing, and device confirmation live at
 [ssx360.com](https://ssx360.com/). Teams evaluating protected-branch enforcement should
 [book a provenance pilot](https://ssx360.com/contact?intent=pilot);
@@ -44,7 +48,7 @@ Agents sign commits in-loop via the **provenance-only** MCP server:
 ```
 
 ```bash
-pip install "matrixscroll[mcp]==0.4.1"
+pip install "matrixscroll[mcp]==0.4.2"
 matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
 ```
 
@@ -55,7 +59,7 @@ matrixscroll-mcp   # stdio — register in Cursor / Claude Desktop / VS Code
 ## Also available — CLI & hooks
 
 ```bash
-pip install "matrixscroll==0.4.1"
+pip install "matrixscroll==0.4.2"
 matrixscroll hook-install
 export MATRIXSCROLL_ACTOR_TYPE=agent
 export MATRIXSCROLL_TOOL=agent-runner
@@ -119,7 +123,7 @@ canonical UTF-8 JSON bytes (see [`SPEC.md`](SPEC.md) §4). Verifiers reject any
 
 ## Honest limits
 
-- Shipping now: PyPI `matrixscroll==0.4.1`, Git post-commit hooks,
+- Shipping now: PyPI `matrixscroll==0.4.2`, Git post-commit hooks,
   `matrixscroll sign-action`, `matrixscroll scroll commit` (thin wrapper),
   `matrixscroll envelope-verify`, Scroll Gate PR verification (partial SLSA L1–2),
   verifier, the GitHub Action, and a USB CDC host transport preview for the
@@ -165,7 +169,7 @@ alongside your existing scanners, branch protection, and build attestations.
 ## Quickstart (CLI)
 
 ```bash
-pip install "matrixscroll==0.4.1"
+pip install "matrixscroll==0.4.2"
 matrixscroll hook-install
 matrixscroll hook-status
 
@@ -192,7 +196,7 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and run
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.4.1"
+    matrixscroll-version: "0.4.2"
     require-mode: emulated
 ```
 
@@ -212,7 +216,7 @@ git push origin refs/notes/matrixscroll
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.4.1"
+    matrixscroll-version: "0.4.2"
     summary-output: provenance-summary.json
 ```
 
@@ -220,7 +224,15 @@ See [`docs/quickstart-git.md`](docs/quickstart-git.md) and
 [`examples/ci/protected-branch.yml`](examples/ci/protected-branch.yml).
 
 The `--require-mode`, `--trusted-keys`, and actor or delegation policy checks
-are available in the `0.2.x` line; the examples in this README pin `0.3.0`.
+ship in the current release line; examples in this README pin `0.4.2`.
+
+## Security: Ed25519 via cryptography
+
+Ed25519 signing, verification, and key generation use the [`cryptography`](https://pypi.org/project/cryptography/)
+package (required dependency, `>=42.0`). Official wheels ship native crypto
+backends (OpenSSL + Rust components) — no Rust toolchain for users. All
+primitives are centralized in `matrixscroll/crypto_backend.py`; see
+[`docs/CRYPTO_BACKEND.md`](docs/CRYPTO_BACKEND.md).
 
 ## Why it is different from Sigstore
 
@@ -235,21 +247,22 @@ when they preserve the same pure Ed25519 byte contract.
 
 ## Public proof links
 
-- Browser verifier: <https://matrixscroll.com/verify/>
-- Compare page: <https://matrixscroll.com/compare/>
+- Browser verifier: <https://ssx360.com/verify>
+- Compare page: <https://ssx360.com/compare>
+- Documentation: <https://ssx360.com/docs>
 - Specification: [`SPEC.md`](SPEC.md)
 - Commit envelope schema: [`schemas/commit-envelope.v1.json`](schemas/commit-envelope.v1.json)
 - Whitepaper: [`docs/WHITEPAPER.md`](docs/WHITEPAPER.md)
 - Conformance vectors: [`vectors/`](vectors/)
 - GitHub Action: <https://github.com/SSX360/matrixscroll-verify-action>
 - Agentic AI controls: [`docs/AGENTIC_AI_SECURITY.md`](docs/AGENTIC_AI_SECURITY.md)
-- Site: <https://matrixscroll.com>
+- Site: <https://ssx360.com/docs> (matrixscroll.com redirects here)
 - Reference device path: [AP2 Vault Card hardware](https://ssx360.com/hardware)
 
 ## Python API
 
 ```bash
-pip install "matrixscroll==0.4.1"
+pip install "matrixscroll==0.4.2"
 ```
 
 ```python
@@ -359,7 +372,7 @@ The MCP server exposes **provenance verbs only**: `create_envelope`, `verify_env
 Install and register in Cursor / Claude Desktop / VS Code:
 
 ```bash
-pip install "matrixscroll[mcp]==0.4.1"
+pip install "matrixscroll[mcp]==0.4.2"
 matrixscroll-mcp   # stdio
 ```
 
@@ -379,5 +392,5 @@ Report vulnerabilities privately to
 
 ---
 
-**Protocol:** https://matrixscroll.com · **Verify:** https://matrixscroll.com/verify/  
+**Protocol:** https://ssx360.com/docs · **Verify:** https://ssx360.com/verify  
 **Control plane:** https://ssx360.com · **Pilot:** mission@ssx360.com · **Sign in:** https://ssx360.com/signup

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/ADOPTER_KIT.md

@@ -11,7 +11,7 @@ who want to trial Matrix Scroll without changing their core workflow.
 
 ## 15-minute pilot
 
-1. Install `matrixscroll==0.3.0` in one repo.
+1. Install `matrixscroll==0.4.1` in one repo.
 2. Run `matrixscroll hook-install`.
 3. Make one agent-assisted commit and verify it locally.
 4. Publish notes with `matrixscroll envelope-publish-notes`.
@@ -38,7 +38,7 @@ jobs:
           head-ref: ${{ github.event.pull_request.head.sha }}
           base-ref: ${{ github.event.pull_request.base.sha }}
           source: notes
-          matrixscroll-version: "0.3.0"
+          matrixscroll-version: "0.4.1"
           require-mode: emulated
 ```
 
@@ -64,7 +64,7 @@ jobs:
 ## Clean-machine proof status
 
 Recorded on `2026-06-21` against the pinned public flow:
-`pip install "matrixscroll==0.3.0"` -> `matrixscroll hook-install` ->
+`pip install "matrixscroll==0.4.1"` -> `matrixscroll hook-install` ->
 `matrixscroll hook-status` -> first agent-assisted commit ->
 `matrixscroll envelope-verify`.
 

matrixscroll-0.4.2/docs/CRYPTO_BACKEND.md

@@ -0,0 +1,48 @@
+# Cryptographic backend (middle path)
+
+Matrix Scroll v0.4.2+ routes all Ed25519 and security-relevant SHA-256
+operations through a single Python module: `matrixscroll/crypto_backend.py`.
+
+## Design
+
+| Approach | What users install | Crypto implementation |
+| -------- | ------------------ | --------------------- |
+| **Full Rust rewrite** | Python SDK + Rust extension build chain | Custom PyO3/maturin crate |
+| **Middle path (this release)** | `pip install matrixscroll` only | `cryptography` wheels (OpenSSL + Rust components) |
+| **Pure Python fallback** | No native deps | Not used — removed from the reference SDK |
+
+The middle path keeps the public Python API, CLI, and MCP surface unchanged while
+moving primitive work onto battle-tested native code shipped inside official
+`cryptography` wheels. Users never run `cargo` or `maturin`.
+
+## Primitives
+
+| Operation | Module API | Underlying primitive |
+| --------- | ---------- | -------------------- |
+| Ed25519 key generation | `generate_ed25519_private_key()` | `cryptography.hazmat.primitives.asymmetric.ed25519` |
+| Ed25519 sign / verify | `ed25519_sign`, `ed25519_verify` | Same |
+| SHA-256 (device IDs, gate digests, Rekor bridge) | `sha256`, `sha256_hex` | `cryptography.hazmat.primitives.hashes.SHA256` |
+
+Git object hashing (`hashlib.sha1` in `matrixscroll/git.py`) stays on the
+stdlib because it implements Git wire-format identifiers, not provenance
+signatures.
+
+## Optional provider paths
+
+- **Emulated / TPM mock / SE050 mock** — software Ed25519 via this backend.
+- **SE050 hardware** — signing occurs on the secure element; the host verifies
+  responses with the same backend where needed.
+- **YubiKey PIV preview** — experimental ECDSA path; not part of the v1 Ed25519
+  contract and not routed through Ed25519 helpers here.
+
+## Dependency pin
+
+`pyproject.toml` requires `cryptography>=42.0` as a mandatory (non-optional)
+dependency.
+
+## Diagnostics
+
+```python
+from matrixscroll.crypto_backend import backend_info
+print(backend_info())
+```

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/FIVE_MINUTES.md

@@ -12,7 +12,7 @@ five-minute path from `pip install` to a verifiable commit envelope.
 ## 1. Install the SDK
 
 ```bash
-pip install "matrixscroll==0.3.0"
+pip install "matrixscroll==0.4.1"
 matrixscroll hook-install
 matrixscroll hook-status
 ```
@@ -61,7 +61,7 @@ git push origin refs/notes/matrixscroll
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.3.0"
+    matrixscroll-version: "0.4.1"
     require-mode: emulated
 ```
 

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/ROADMAP_2026-07.md

@@ -8,13 +8,13 @@ what ships now before widening the story.
 ## Baseline on June 21, 2026
 
 - GitHub: early public repo, product-first docs, and offline verification
-- Current public release target: `matrixscroll==0.3.0`
+- Current public release: `matrixscroll==0.4.1`
 - Public trust contract: pure Ed25519 over canonical manifest bytes
 - Hardware path: SSX360 SE050 reference implementation in progress
 
 ## Next 7 days
 
-- cut and publish `0.3.0` without widening the manifest or verify surface
+- Public release: `matrixscroll==0.4.1` (universal provenance + scroll commit)
 - make the GitHub Action a real public proof surface
 - align site, README, action docs, and PyPI around one install flow
 - remove broken links and stale release drift from public copy

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/SECURITY_PROPERTIES.md

@@ -1,6 +1,6 @@
 # Matrix Scroll security properties
 
-Machine-checkable guarantees for the reference SDK (v0.4.0). Properties marked
+Machine-checkable guarantees for the reference SDK (v0.4.2). Properties marked
 **verified** have Hypothesis property tests in `tests/test_security_properties.py`.
 Formal TLA+ models are on the public roadmap.
 
@@ -13,6 +13,16 @@ Formal TLA+ models are on the public roadmap.
 | **P5** | Offline verification | Envelope verification requires no network, hosted API, or hardware ping once the envelope and trusted key set are local. | **Verified** (unit) |
 | **P6** | Algorithm binding | Only Ed25519 (RFC 8032) signatures with `algorithm: "ed25519"` are accepted; other algorithms are rejected. | **Verified** (unit + vectors) |
 
+## Cryptographic backend
+
+All Ed25519 and security-relevant SHA-256 operations in the reference SDK route
+through `matrixscroll/crypto_backend.py`, backed by the [`cryptography`](https://pypi.org/project/cryptography/)
+package (official wheels bundle OpenSSL and Rust components; users install with
+`pip install matrixscroll` only). There is no pure-Python Ed25519 fallback.
+
+See [`CRYPTO_BACKEND.md`](CRYPTO_BACKEND.md) for the middle-path design vs a full
+Rust rewrite.
+
 ## Standards alignment
 
 - **Ed25519:** [RFC 8032](https://www.rfc-editor.org/rfc/rfc8032) — 32-byte seed, 32-byte public key, 64-byte signature.

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/SOFTWARE_PRODUCTS.md

@@ -5,7 +5,7 @@ manifest bytes today.
 
 | Product | Status | Access | Notes |
 |---------|--------|--------|-------|
-| **Matrix Scroll SDK** | GA | PyPI `matrixscroll==0.3.0` | Hooks, envelopes, Scroll Gate, policy CLI |
+| **Matrix Scroll SDK** | GA | PyPI `matrixscroll==0.4.1` | Hooks, envelopes, Scroll Gate, policy CLI |
 | **Scroll Gate CI** | GA | [`matrixscroll-verify-action@v1`](https://github.com/SSX360/matrixscroll-verify-action) | PR range + manifest verify |
 | **Browser verifier** | GA | [matrixscroll.com/verify](https://matrixscroll.com/verify/) | Offline paste-and-verify |
 | **Protocol docs** | GA | [matrixscroll.com/docs](https://matrixscroll.com/docs/) | SPEC mirror, whitepaper, quickstarts |
@@ -18,7 +18,7 @@ manifest bytes today.
 ## Developer install
 
 ```bash
-pip install "matrixscroll==0.3.0"
+pip install "matrixscroll==0.4.1"
 matrixscroll hook-install
 export MATRIXSCROLL_ACTOR_TYPE=agent
 export MATRIXSCROLL_TOOL=agent-runner
@@ -34,7 +34,7 @@ matrixscroll envelope-verify "$(git rev-parse HEAD)"
     head-ref: ${{ github.event.pull_request.head.sha }}
     base-ref: ${{ github.event.pull_request.base.sha }}
     source: notes
-    matrixscroll-version: "0.3.0"
+    matrixscroll-version: "0.4.1"
     summary-output: provenance-summary.json
 ```
 

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/WHITEPAPER.md

@@ -71,7 +71,7 @@ Full wire format: [`SPEC.md`](../SPEC.md). Schema: [`schemas/commit-envelope.v1.
 ### 1. Install
 
 ```bash
-pip install "matrixscroll==0.3.0"
+pip install "matrixscroll==0.4.1"
 matrixscroll hook-install
 matrixscroll hook-status
 ```
@@ -87,7 +87,7 @@ matrixscroll envelope-verify "$(git rev-parse HEAD)"
 
 Hooks default to **warn mode**; set `"enforce": true` in `.git/matrixscroll/config.json` to block commits when signing fails. See [`docs/quickstart-git.md`](quickstart-git.md).
 
-**Windows:** support landed in matrixscroll **0.2.1**; pin **0.3.0** or newer in pilot environments.
+**Windows:** support landed in matrixscroll **0.2.1**; pin **0.4.1** in pilot environments.
 
 ### 3. CI gate
 
@@ -95,12 +95,12 @@ Hooks default to **warn mode**; set `"enforce": true` in `.git/matrixscroll/conf
 - uses: SSX360/matrixscroll-verify-action@v1
   with:
     manifest: path/to/signed-manifest.json
-    matrixscroll-version: "0.3.0"
+    matrixscroll-version: "0.4.1"
     require-mode: emulated
     trusted-keys: trusted-keys.json
 ```
 
-Policy flags (`--require-mode`, `--trusted-keys`) are available in the `0.2.x` line; this whitepaper pins `0.3.0` for copy-and-paste examples.
+Policy flags (`--require-mode`, `--trusted-keys`) ship in the current release; this whitepaper pins `0.4.1` for copy-and-paste examples.
 
 ### 4. Optional scope manifest
 

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/commercial/PLATFORM_PIVOT.md

@@ -28,13 +28,13 @@ Matrix Scroll remains the **open protocol and thin client** (PyPI + MCP). SSX360
 
 See [SCROLL_GATE_V2.md](./SCROLL_GATE_V2.md). Set `SSX360_API_KEY` in GitHub Actions secrets.
 
-## SDK 0.4.0
+## SDK 0.4.1
 
 ```bash
-pip install "matrixscroll[mcp]==0.4.0"
+pip install "matrixscroll[mcp]==0.4.1"
 ```
 
-New module: `matrixscroll.cloud` — HTTP client for ssx360.com APIs.
+New in 0.4.1: `sign-action`, `scroll commit`, expanded MCP `sign_action`. Module `matrixscroll.cloud` — HTTP client for ssx360.com APIs.
 
 ## MCP environment
 

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/commercial/SSX360_SCROLL.md

@@ -12,7 +12,7 @@ See also the platform copy in [digital-rain/docs/commercial/SSX360_SCROLL.md](ht
 ## Quick start
 
 ```bash
-pip install "matrixscroll==0.4.1"
+pip install "matrixscroll==0.4.2"
 matrixscroll hook-install
 matrixscroll scroll commit -m "feat: governed commit"
 ```

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/hardware-provider.md

@@ -23,7 +23,7 @@ matrixscroll status
 ## Quickstart (USB CDC preview)
 
 ```bash
-pip install "matrixscroll[hardware]==0.3.0"
+pip install "matrixscroll[hardware]==0.4.1"
 export MATRIXSCROLL_MODE=hardware
 export MATRIXSCROLL_SE050_PORT=/dev/ttyACM0
 matrixscroll status

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/quickstart-agent.md

@@ -6,7 +6,7 @@ without coupling public docs to a specific editor or assistant brand.
 ## One-time setup
 
 ```bash
-pip install "matrixscroll>=0.3.0"
+pip install "matrixscroll>=0.4.1"
 matrixscroll hook-install
 ```
 

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/quickstart-claude-code.md

@@ -6,7 +6,7 @@ verifiable provenance.
 ## One-time setup
 
 ```bash
-pip install "matrixscroll>=0.3.0"
+pip install "matrixscroll>=0.4.1"
 matrixscroll hook-install
 ```
 

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/quickstart-git.md

@@ -12,7 +12,7 @@ verify that proof offline before merge.
 ## Install hooks
 
 ```bash
-pip install "matrixscroll==0.3.0"
+pip install "matrixscroll==0.4.1"
 matrixscroll hook-install
 matrixscroll hook-status
 ```
@@ -42,10 +42,10 @@ Enable enforce mode in `.git/matrixscroll/config.json`:
 
 ## Windows
 
-Windows support landed in **matrixscroll 0.2.1**. Pin `0.3.0` or newer after upgrading:
+Windows support landed in **matrixscroll 0.2.1**. Pin `0.4.1` after upgrading:
 
 ```powershell
-pip install -U "matrixscroll==0.3.0"
+pip install -U "matrixscroll==0.4.1"
 matrixscroll hook-install
 ```
 
@@ -89,7 +89,7 @@ Use [`SSX360/matrixscroll-verify-action@v1`](https://github.com/SSX360/matrixscr
 
 ## How can I integrate Matrix Scroll into a CI/CD workflow?
 
-1. Install `matrixscroll==0.3.0` and `matrixscroll hook-install` in the repo.
+1. Install `matrixscroll==0.4.1` and `matrixscroll hook-install` in the repo.
 2. Publish commit envelopes to `refs/notes/matrixscroll` before PR review.
 3. Run `SSX360/matrixscroll-verify-action@v1` in GitHub Actions to verify the
    full PR commit range from notes.

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/docs/quickstart-mcp.md

@@ -5,7 +5,7 @@ Install the provenance MCP server so agents can sign and verify commit envelopes
 ## Install
 
 ```bash
-pip install "matrixscroll[mcp]==0.4.0"
+pip install "matrixscroll[mcp]==0.4.1"
 ```
 
 The console script `matrixscroll-mcp` is the preferred entry point. `python -m matrixscroll.mcp` also works.
@@ -53,7 +53,7 @@ Use `verify_pr_range` with `source=notes` for offline git-notes verification wit
 For Git hook and CI workflows without MCP, use:
 
 ```bash
-pip install "matrixscroll==0.4.0"
+pip install "matrixscroll==0.4.1"
 matrixscroll hook-install
 ```
 

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/examples/ci/protected-branch.yml

@@ -24,7 +24,7 @@ jobs:
         uses: SSX360/matrixscroll-verify-action@v1
         with:
           manifest: examples/release-manifest.signed.json
-          matrixscroll-version: "0.3.0"
+          matrixscroll-version: "0.4.1"
 
   verify-pr-envelopes:
     runs-on: ubuntu-latest
@@ -42,7 +42,7 @@ jobs:
           source: notes
           notes-ref: refs/notes/matrixscroll
           fetch-notes: "true"
-          matrixscroll-version: "0.3.0"
+          matrixscroll-version: "0.4.1"
           summary-output: provenance-summary.json
         # Optional policy enforcement:
         # require-mode: emulated
@@ -71,4 +71,4 @@ jobs:
           base-ref: ${{ github.event.pull_request.base.sha }}
           source: bundle
           bundle-dir: evidence/bundle
-          matrixscroll-version: "0.3.0"
+          matrixscroll-version: "0.4.1"

{matrixscroll-0.4.1 → matrixscroll-0.4.2}/matrixscroll/__init__.py

@@ -40,7 +40,7 @@ from ._core import (
     verify_manifest,
 )
 
-__version__ = "0.4.0"
+__version__ = "0.4.2"
 
 __all__ = [
     "ALGORITHM",