mintmark 0.3.0__tar.gz → 0.3.2__tar.gz

{mintmark-0.3.0 → mintmark-0.3.2}/CHANGELOG.md

@@ -11,6 +11,32 @@ output for a fixed set of inputs. A change that alters emitted bytes for a fixed
 seed is a major version event even when no signature changed, because it breaks
 the reproducibility of every published manifest.
 
+## 0.3.2 - 2026-08-23
+
+### Security
+
+- Release checksums and GitHub build-provenance attestations now cover the
+  CycloneDX SBOM alongside the wheel and source distribution.
+- Artifact upload and download steps use immutable, Node 24-compatible action
+  revisions.
+
+Generated record and label files do not change for the same inputs. Manifests
+record the patch engine version.
+
+## 0.3.1 - 2026-08-23
+
+### Fixed
+
+- The manifest schema now uses the same 1,000,000-record per-type budget as pack
+  loading, minting, and streaming verification. The stale 50,000-record schema
+  ceiling made the published HR and banking reference shapes producible but
+  unverifiable.
+- A regression test exercises the legitimate upper boundary and confirms that
+  1,000,001 records remain rejected.
+
+Generated record and label files do not change for the same inputs. Manifests
+record the patch engine version.
+
 ## 0.3.0 - 2026-08-23
 
 ### Security

{mintmark-0.3.0 → mintmark-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mintmark
-Version: 0.3.0
+Version: 0.3.2
 Summary: Deterministic, fully synthetic, Turkish-first labeled datasets with a provenance manifest.
 Author: Mintmark contributors
 License-Expression: Apache-2.0
@@ -33,9 +33,9 @@ Description-Content-Type: text/markdown
 
 <p align="center">
   <a href="https://github.com/lokomotifai/mintmark/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/lokomotifai/mintmark/ci.yml?branch=main&amp;style=flat-square&amp;label=CI"></a>
-  <img alt="925 tests" src="https://img.shields.io/badge/tests-925-3C873A?style=flat-square">
+  <img alt="926 tests" src="https://img.shields.io/badge/tests-926-3C873A?style=flat-square">
   <img alt="18 invariants, each with a named test" src="https://img.shields.io/badge/invariants-18%20tested-3C873A?style=flat-square">
-  <a href="https://github.com/lokomotifai/mintmark/releases/tag/v0.3.0"><img alt="Release v0.3.0" src="https://img.shields.io/badge/release-v0.3.0-3C873A?style=flat-square"></a>
+  <a href="https://github.com/lokomotifai/mintmark/releases/tag/v0.3.2"><img alt="Release v0.3.2" src="https://img.shields.io/badge/release-v0.3.2-3C873A?style=flat-square"></a>
   <a href="https://pypi.org/project/mintmark/"><img alt="On PyPI" src="https://img.shields.io/pypi/v/mintmark?style=flat-square&amp;label=PyPI&amp;color=3C873A"></a>
   <a href="LICENSE"><img alt="Apache-2.0 license" src="https://img.shields.io/badge/license-Apache--2.0-3B3F46?style=flat-square"></a>
 </p>

{mintmark-0.3.0 → mintmark-0.3.2}/README.md

@@ -13,9 +13,9 @@
 
 <p align="center">
   <a href="https://github.com/lokomotifai/mintmark/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/lokomotifai/mintmark/ci.yml?branch=main&amp;style=flat-square&amp;label=CI"></a>
-  <img alt="925 tests" src="https://img.shields.io/badge/tests-925-3C873A?style=flat-square">
+  <img alt="926 tests" src="https://img.shields.io/badge/tests-926-3C873A?style=flat-square">
   <img alt="18 invariants, each with a named test" src="https://img.shields.io/badge/invariants-18%20tested-3C873A?style=flat-square">
-  <a href="https://github.com/lokomotifai/mintmark/releases/tag/v0.3.0"><img alt="Release v0.3.0" src="https://img.shields.io/badge/release-v0.3.0-3C873A?style=flat-square"></a>
+  <a href="https://github.com/lokomotifai/mintmark/releases/tag/v0.3.2"><img alt="Release v0.3.2" src="https://img.shields.io/badge/release-v0.3.2-3C873A?style=flat-square"></a>
   <a href="https://pypi.org/project/mintmark/"><img alt="On PyPI" src="https://img.shields.io/pypi/v/mintmark?style=flat-square&amp;label=PyPI&amp;color=3C873A"></a>
   <a href="LICENSE"><img alt="Apache-2.0 license" src="https://img.shields.io/badge/license-Apache--2.0-3B3F46?style=flat-square"></a>
 </p>

{mintmark-0.3.0 → mintmark-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mintmark"
-version = "0.3.0"
+version = "0.3.2"
 description = "Deterministic, fully synthetic, Turkish-first labeled datasets with a provenance manifest."
 readme = "README.md"
 requires-python = ">=3.12,<3.13"

{mintmark-0.3.0 → mintmark-0.3.2}/schemas/manifest.schema.json

@@ -86,7 +86,7 @@
               "additionalProperties": {
                 "type": "integer",
                 "minimum": 0,
-                "maximum": 50000
+                "maximum": 1000000
               }
             },
             "date_window": {
@@ -231,7 +231,7 @@
           "additionalProperties": {
             "type": "integer",
             "minimum": 0,
-            "maximum": 50000
+            "maximum": 1000000
           }
         },
         "distributions": {

{mintmark-0.3.0 → mintmark-0.3.2}/src/mintmark/engine/version.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-VERSION = "0.3.0"
+VERSION = "0.3.2"

{mintmark-0.3.0 → mintmark-0.3.2}/tests/adversarial/test_numeric_resource_limits.py

@@ -2,9 +2,11 @@
 
 from __future__ import annotations
 
+import json
 import shutil
 from pathlib import Path
 
+import jsonschema
 import pytest
 import yaml
 
@@ -95,6 +97,26 @@ def test_recipe_record_count_is_bounded(tmp_path: Path) -> None:
         load_pack(pack)
 
 
+def test_manifest_schema_uses_the_pack_record_count_budget(tmp_path: Path) -> None:
+    out = tmp_path / "manifest-budget"
+    mint(pack=CONFORMANCE, recipe="full", seed=1, out=out, invocation="pytest")
+    document = json.loads((out / "MINTMARK.json").read_text(encoding="utf-8"))
+    schema = json.loads(
+        (Path(__file__).resolve().parents[2] / "schemas" / "manifest.schema.json").read_text(
+            encoding="utf-8"
+        )
+    )
+
+    document["recipe"]["parameters"]["records"]["transaction"] = MAX_RECORDS_PER_TYPE
+    document["stats"]["record_counts"]["transaction"] = MAX_RECORDS_PER_TYPE
+    jsonschema.validate(document, schema)
+
+    document["recipe"]["parameters"]["records"]["transaction"] = MAX_RECORDS_PER_TYPE + 1
+    document["stats"]["record_counts"]["transaction"] = MAX_RECORDS_PER_TYPE + 1
+    with pytest.raises(jsonschema.ValidationError):
+        jsonschema.validate(document, schema)
+
+
 def test_runtime_record_override_uses_the_same_budget(tmp_path: Path) -> None:
     out = tmp_path / "out"
     with pytest.raises(MintError, match="record-count-limit"):

{mintmark-0.3.0 → mintmark-0.3.2}/tests/unit/test_workflows.py

@@ -171,8 +171,14 @@ def test_release_scans_and_seals_the_exact_built_artifacts_before_oidc() -> None
     assert "uv build --no-build-isolation" in build_text
     assert "uv export --locked --no-dev --no-emit-project" in build_text
     assert "tools/canary.py dist/" in build_text
-    assert "sha256sum mintmark-*.whl mintmark-*.tar.gz" in build_text
+    assert "sha256sum mintmark-*.whl mintmark-*.tar.gz sbom.json" in build_text
     assert "sha256sum -c SHA256SUMS" in publish_text
+    attestation = next(
+        step
+        for step in publish_steps
+        if step.get("uses", "").startswith("actions/attest-build-provenance@")
+    )
+    assert "dist/sbom.json" in attestation["with"]["subject-path"]
     publisher = next(
         step
         for step in publish_steps
@@ -180,5 +186,9 @@ def test_release_scans_and_seals_the_exact_built_artifacts_before_oidc() -> None
     )
     assert publisher["uses"].startswith("pypa/gh-action-pypi-publish@")
     assert publisher["with"]["verify-metadata"] is True
+    github_release = next(
+        step for step in publish_steps if "gh release create" in step.get("run", "")
+    )
+    assert github_release["env"]["GH_REPO"] == "${{ github.repository }}"
     canary = next(step for step in build_steps if "MINTMARK_CANARY" in step.get("env", {}))
     assert "refs/tags/v" in canary.get("if", "")