pmquant 0.4.1__tar.gz → 0.4.3__tar.gz

pmquant-0.4.3/.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday

{pmquant-0.4.1 → pmquant-0.4.3}/.github/workflows/canary.yml

@@ -12,8 +12,8 @@ jobs:
   canary:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
       - run: pip install -e ".[dev]"
@@ -21,6 +21,10 @@ jobs:
         env:
           PMQ_CANARY: "1"
         run: pytest tests/test_canary_live.py -q
+      - name: Dependency vulnerability audit
+        run: |
+          pip install pip-audit
+          pip-audit --skip-editable
       - name: Open an issue if Polymarket drifted
         if: failure()
         env:
@@ -29,6 +33,6 @@ jobs:
           existing=$(gh issue list --label canary --state open --json number --jq length)
           if [ "$existing" = "0" ]; then
             gh issue create --label canary \
-              --title "Canary: Polymarket surface drifted ($(date -u +%F))" \
-              --body "The weekly live canary failed: an endpoint shape or the installed py-clob-client-v2 surface no longer matches what pmq was verified against. See the failed run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+              --title "Canary failed: endpoint drift or vulnerable dependency ($(date -u +%F))" \
+              --body "The weekly canary failed: an endpoint shape or the installed py-clob-client-v2 surface no longer matches what pmq was verified against, the egress allowlist saw a foreign host, or pip-audit found a vulnerable dependency. See the failed run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           fi

{pmquant-0.4.1 → pmquant-0.4.3}/.github/workflows/publish.yml

@@ -11,10 +11,10 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
 
@@ -41,4 +41,4 @@ jobs:
           python -m build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1

pmquant-0.4.3/.github/workflows/scorecard.yml

@@ -0,0 +1,28 @@
+name: scorecard
+on:
+  schedule:
+    - cron: "23 7 * * 1"        # weekly, monday 07:23 UTC
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write     # SARIF upload
+      id-token: write            # signed publication to scorecard.dev
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        with:
+          sarif_file: results.sarif

{pmquant-0.4.1 → pmquant-0.4.3}/.github/workflows/test.yml

@@ -2,6 +2,9 @@ name: tests
 on:
   push:
   pull_request:
+
+permissions:
+  contents: read
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -9,8 +12,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
       - run: pip install -e ".[dev]"

{pmquant-0.4.1 → pmquant-0.4.3}/.gitignore

@@ -7,3 +7,4 @@ build/
 .pytest_cache/
 .env
 .coverage
+.pyscn/

pmquant-0.4.3/.hypothesis/.gitignore

@@ -0,0 +1,9 @@
+# This .gitignore file was automatically created by Hypothesis. Hypothesis gitignores
+# .hypothesis by default, because we generally recommend that .hypothesis not be checked
+# into version control.
+#
+# If you *would* like to check .hypothesis into version control, you should delete this
+# file. Hypothesis will not re-create this .gitignore unless .hypothesis is deleted (and
+# if it does, that's a bug - please report it!)
+
+*

pmquant-0.4.3/.hypothesis/constants/07a2a0eac57d1dd0

@@ -0,0 +1,4 @@
+# file: /home/runner/work/pmq/pmq/src/pmq/executor.py
+# hypothesis_version: 6.156.1
+
+[0.0, 1000000.0, 137, 300, 400, 500, '0', '0.01', '0x[0-9a-fA-F]{64}', '; ', 'AssetType', 'BUY', 'FAILED', 'FAK', 'MAKER', 'MarketOrderArgs', 'MarketOrderArgsV2', 'OpenOrderParams', 'OrderArgs', 'OrderArgsV2', 'OrderType', 'POLY_BUILDER_CODE', 'POLY_FUNDER', 'POLY_PRIVATE_KEY', 'POLY_SIG_TYPE', 'SELL', 'TradeParams', '_pmq_taker4', 'amount', 'balance', 'builder_code', 'cancel_market_orders', 'crypto', 'error_msg', 'fd', 'get_open_orders', 'get_trades', 'makingAmount', 'off', 'on', 'orderID', 'order_args', 'order_type', 'params', 'payload', 'pmq', 'price', 'r', 'side', 'size', 'status', 'status_code', 'success', 'takingAmount', 'token_id', 'trader_side']

pmquant-0.4.3/.hypothesis/constants/1720e64af9235558

@@ -0,0 +1,4 @@
+# file: /home/runner/work/pmq/pmq/src/pmq/__init__.py
+# hypothesis_version: 6.156.1
+
+['0.4.3', 'DEFAULT_BUILDER_CODE', 'FEE_RATES', 'Fill', 'OrderUncertain', 'PmqError', 'PolymarketExecutor', '__version__', 'band_ask_depth_usd', 'best_bid_ask', 'book_inferred_winner', 'book_meta', 'event_markets', 'fee', 'get_book', 'get_market', 'get_tape', 'http_get_json', 'parse_market', 'positions', 'resolved_winner']

pmquant-0.4.3/.hypothesis/constants/6c9ffb0a1efc27b6

@@ -0,0 +1,4 @@
+# file: /home/runner/work/pmq/pmq/src/pmq/exceptions.py
+# hypothesis_version: 6.156.1
+
+[]

pmquant-0.4.3/.hypothesis/constants/855d9c2e5b4693f1

@@ -0,0 +1,4 @@
+# file: /home/runner/work/pmq/pmq/src/pmq/data.py
+# hypothesis_version: 6.156.1
+
+[0.0, 0.03, 0.04, 0.05, 0.07, 0.9, 0.99, 1.0, 1.5, 200, '%Y-%m-%dT%H:%M:%SZ', 'Mozilla/5.0', 'User-Agent', 'a', 'asks', 'b', 'bids', 'clobTokenIds', 'conditionId', 'crypto', 'culture', 'economics', 'endDate', 'endDateIso', 'finance', 'geopolitics', 'idx_a', 'last_trade_price', 'markets', 'mentions', 'min_order_size', 'neg_risk', 'outcomePrices', 'outcome_a', 'outcome_b', 'outcome_prices_raw', 'outcomes', 'politics', 'price', 'size', 'slug', 'sports', 'tech', 'tick_size', 'timestamp', 'weather']

pmquant-0.4.3/.hypothesis/constants/ef909bf87e6ac33f

@@ -0,0 +1,4 @@
+# file: /home/runner/work/pmq/pmq/src/pmq/doctor.py
+# hypothesis_version: 6.156.1
+
+[1000000.0, 120, 160, 400, '\nverdict:', ', ', '--market', '0', '0x', '0x70a08231', '0x8da5cb5b', '2.0', 'CLOB auth/collateral', 'Content-Type', 'FAK', 'Mozilla/5.0', 'OrderType.FAK', 'POLY_FUNDER', 'POLY_PRIVATE_KEY', 'POLY_SIG_TYPE', 'User-Agent', '[!!]', '[??]', '[ok]', '__main__', 'application/json', 'data', 'drifted: ', 'error', 'eth_call', 'eth_getCode', 'funder', 'id', 'jsonrpc', 'latest', 'method', 'min_order_size', 'params', 'result', 'to', 'token_a']

{pmquant-0.4.1 → pmquant-0.4.3}/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## 0.4.3 (2026-07-04)
+
+* Fix: py-clob-client-v2 1.0.2 reuses its limit-order rounding table for
+  MARKET orders, so on markets whose tick size is finer than 0.01 it signs
+  taker amounts with 5-6 decimals; the V2 exchange rejects those with
+  "invalid amounts ... taker amount a max of 4 decimals" and every FAK on
+  such a market fails. The executor now clamps the market-order path to 4
+  decimals at client level (round-down: the never-exceed-budget contract is
+  intact, the dust given up is under 0.0001 share per order). Found in
+  production: a fine-tick market rejected 10 consecutive buys and the
+  fail-closed halt fired exactly as designed; nothing was booked, nothing
+  was lost. Regression test pins maker 2dp / taker 4dp on both sides for
+  ticks 0.01, 0.001 and 0.0001.
+
+* Trust batch: executable egress proof in the canary suite (records every
+  DNS resolution during a full session incl. a signed zero-fund order;
+  fails on any host outside polymarket.com; weekly CI prints the list in
+  public logs), a test pinning that the private key never reaches logs,
+  OpenSSF Scorecard workflow + badge, GitHub Actions pinned by commit SHA,
+  explicit workflow permissions, Dependabot (pip + actions), weekly
+  pip-audit wired into the canary alarm, README sections "Verify the
+  claims yourself" (egress, PEP 740 provenance, dependency watch) and
+  "Stability and maintenance" (pre-1.0 SemVer contract, the stated bar for
+  1.0, bus-factor honesty, precisely scoped help-wanted).
+* Quality pass driven by pyscn (CFG complexity, dead code, clones): the
+  template engine loop and pmq-doctor were split into single-purpose phase
+  functions (worst cyclomatic complexity 36 -> 10 across the repo, zero dead
+  code, behavior identical), and the previously untested template main loop
+  is now pinned by 17 end-to-end tests (fake clock, stubbed exchange):
+  paper fills at the real ask, budget headroom, halts, poisoning,
+  consecutive-failure exit, exchange-truth scoring. 113 tests total.
+  `pyscn check src/pmq bot-template` passes at default thresholds.
+
+## 0.4.2 (2026-07-03)
+
+* Fix: `buy_fak`/`sell_fak` cent-rounding used `int(x * 100) / 100`, which
+  floors a binary-drifted float (`16.90` stored as `16.8999…` became
+  `16.89`), silently shaving a cent off intended-clean amounts. Replaced with
+  a `Decimal`-based `_floor_cents` that rounds down without the drift, keeping
+  the never-exceed-budget contract. Matches the behavior documented in
+  docs/rounding-study.md.
+
 ## 0.4.1 (2026-07-03)
 
 * Introspection guard now also verifies `OrderArgsV2` fields (including

{pmquant-0.4.1 → pmquant-0.4.3}/CLAUDE.md

@@ -32,7 +32,10 @@ agents EDITING it. Read both before changing code.)
 
 ## Working rules
 
-* Tests green (`pytest -q`) and `ruff check .` clean before any push; add
+* Tests green (`pytest -q`) and `ruff check .` clean before any push;
+  `pyscn check src/pmq bot-template` (complexity <= 10, no dead code)
+  must stay green too; clone warnings are informational (the template
+  dash deliberately duplicates helpers to stay stdlib-standalone). Add
   tests with every behavior change. Network-touching tests go to
   `tests/test_canary_live.py` behind `PMQ_CANARY=1`, never in default CI.
 * Exchange rules (min size, tick, fee rate) are READ from the venue
@@ -42,6 +45,11 @@ agents EDITING it. Read both before changing code.)
   update CHANGELOG.md, push, then `gh release create vX.Y.Z`: PyPI publish
   is automatic via trusted publishing (no tokens anywhere). PyPI name is
   `pmquant`, import name `pmq`: keep the README line explaining it.
+* GitHub Actions stay pinned by commit SHA (dependabot bumps them); new
+  workflows get an explicit least-privilege permissions block. The egress
+  test and pip-audit ride the weekly canary: never move them to default CI
+  (they need network) and never widen the egress allowlist beyond
+  polymarket.com without updating SECURITY.md and the README section.
 * The weekly canary workflow is the drift alarm: if it opens an issue, the
   fix starts by re-running the introspection against the new surface, not
   by loosening the checks.

{pmquant-0.4.1 → pmquant-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pmquant
-Version: 0.4.1
+Version: 0.4.3
 Summary: Fail-closed execution and market-data layer for Polymarket CLOB V2: local signing, confirmed fills only, fee-correct math, working deposit-wallet (POLY_1271) support.
 Project-URL: Homepage, https://github.com/crp4222/pmq
 Project-URL: Issues, https://github.com/crp4222/pmq/issues
@@ -23,6 +23,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Requires-Dist: py-clob-client-v2<2,>=1.0.2
 Provides-Extra: dev
+Requires-Dist: hypothesis>=6.100; extra == 'dev'
 Requires-Dist: mcp>=1.2; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
 Requires-Dist: pytest-cov>=5; extra == 'dev'
@@ -41,6 +42,7 @@ Description-Content-Type: text/markdown
 [![canary](https://github.com/crp4222/pmq/actions/workflows/canary.yml/badge.svg)](https://github.com/crp4222/pmq/actions/workflows/canary.yml)
 [![coverage gate](https://img.shields.io/badge/coverage-%E2%89%A585%25%20enforced%20in%20CI-blue)](.github/workflows/test.yml)
 [![typed](https://img.shields.io/badge/types-mypy%20strict-blue)](pyproject.toml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/crp4222/pmq/badge)](https://scorecard.dev/viewer/?uri=github.com/crp4222/pmq)
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 
 Fail-closed execution and market data for **Polymarket CLOB V2**, in Python.
@@ -81,13 +83,15 @@ a real error in live trading:
 
 The full write-up with reproduction details: [docs/war-story.md](docs/war-story.md).
 
-## Runs in production
+## Runs in production: my own money, daily
 
-The maintainer's own bot trades through this exact executor 24/7 with real
-money. Example receipt (2026-07-03): settlement transaction
+I built pmq for my own trading. It executes real volume with my funds every
+day, and it has never booked a fill the exchange did not confirm. If you
+want to see it on-chain, here is a settlement from one of my wallets
+(2026-07-03):
 [`0x387f5f09...100d88a8`](https://polygonscan.com/tx/0x387f5f09c031bb36a71c54adc978b1ed4d50c67f6dd3f0c2c8068391100d88a8)
 on the CTF Exchange V2: a FAK market buy built by this library, matched and
-settled, with the builder code visible in the calldata. Additionally, a weekly
+settled, with the builder code visible in the calldata. A weekly
 [canary workflow](.github/workflows/canary.yml) exercises the real endpoints
 and the installed client surface, and opens an issue by itself if Polymarket
 drifts.
@@ -160,9 +164,10 @@ else:
         print(fill.matched_shares, "shares at", fill.price, "order", fill.order_id)
 ```
 
-`sell_fak` and `limit_gtc` follow the same contract. The buy path has carried
-live volume; treat the sell path as following the same documented semantics
-with less battle time.
+`sell_fak` and `limit_gtc` follow the same contract. Both FAK paths have
+carried real volume: a production round trip (buy 5.149 @ 0.94, sell back
+5.14 @ 0.94, cross-checked via `get_trades`) confirmed the mirrored
+`makingAmount`/`takingAmount` semantics on 2026-07-03.
 
 ## The signature_type table nobody gives you
 
@@ -247,12 +252,60 @@ shipped demo strategy is an API illustration meant to be replaced.
 * Keys are read from the environment, used to instantiate the signer, and
   never logged. No custody, no backend, no telemetry, zero network calls
   besides Polymarket endpoints.
-* Beware of the documented wave of fake "polymarket bot" repositories that
-  steal private keys. Read the source: pmq is small on purpose.
+* A documented wave of fake "polymarket bot" repositories steals private
+  keys; pmq is deliberately small so the entire execution path stays
+  readable in minutes by anyone who wants to look.
 * Fund the trading wallet with what you can afford to lose. Nothing here is
   financial advice; prediction-market access is restricted in some
   jurisdictions and compliance is on you.
 
+## If you feel like checking any of it
+
+None of the claims above require taking my word; each one comes with a
+handle you can pull, whenever you care to:
+
+* **Egress.** `PMQ_CANARY=1 pytest tests/test_canary_live.py -k egress -s`
+  records every DNS resolution during a full session (market data, auth
+  derivation, one signed order) and fails on any host outside
+  `polymarket.com`. Last observed list: `clob.polymarket.com`,
+  `gamma-api.polymarket.com`, nothing else. The weekly
+  [canary](../../actions/workflows/canary.yml) prints that list in public
+  CI logs. One designed exception: `pmq-doctor`'s optional on-chain checks
+  use the public Polygon RPCs named in its source.
+* **Provenance.** Releases carry a signed PEP 740 attestation (Sigstore,
+  via PyPI trusted publishing): click "provenance" next to any file on the
+  [PyPI files page](https://pypi.org/project/pmquant/#files), or fetch it
+  raw from PyPI's integrity API. The signing identity is this repository's
+  `publish.yml` workflow.
+* **Dependencies.** Dependabot files weekly bump PRs (Python and
+  SHA-pinned GitHub Actions), and the weekly canary runs `pip-audit`; a
+  hit opens an issue by itself.
+* **The source.** Five small modules; the whole execution path reads in
+  minutes. The grep targets that answer the important questions fastest
+  are listed in [SECURITY.md](SECURITY.md).
+
+## Stability and maintenance
+
+* Pre-1.0 SemVer: PATCH releases only fix, MINOR releases may change the
+  public API with the migration named in [CHANGELOG.md](CHANGELOG.md).
+  Nothing changes silently.
+* Deprecated APIs keep working and warn for at least one MINOR release
+  before removal.
+* The bar for 1.0, stated in advance: months of green weekly canaries, the
+  maker path (`limit_gtc`) production-proven with real volume the way the
+  FAK paths already are, and external production users.
+* Bus-factor honesty: one maintainer, who trades real money through this
+  exact code daily (strongest available incentive to keep it correct). The
+  mitigations are structural, not promises: five small modules, the
+  executable fill-contract test table, a weekly canary that opens issues by
+  itself, SHA-pinned CI. Operational rule: if the canary badge goes red and
+  stays red, treat the project as unmaintained and pin your last known-good
+  version.
+* Help wanted, precisely scoped: production receipts for `signature_type`
+  1 and 2 accounts (legacy Magic/email and browser-wallet proxies). Both
+  paths are introspection-tested but have never carried real money through
+  this library; the maintainer's own accounts are all types 0 and 3.
+
 ## License
 
 MIT

{pmquant-0.4.1 → pmquant-0.4.3}/README.md

@@ -7,6 +7,7 @@
 [![canary](https://github.com/crp4222/pmq/actions/workflows/canary.yml/badge.svg)](https://github.com/crp4222/pmq/actions/workflows/canary.yml)
 [![coverage gate](https://img.shields.io/badge/coverage-%E2%89%A585%25%20enforced%20in%20CI-blue)](.github/workflows/test.yml)
 [![typed](https://img.shields.io/badge/types-mypy%20strict-blue)](pyproject.toml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/crp4222/pmq/badge)](https://scorecard.dev/viewer/?uri=github.com/crp4222/pmq)
 [![license](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 
 Fail-closed execution and market data for **Polymarket CLOB V2**, in Python.
@@ -47,13 +48,15 @@ a real error in live trading:
 
 The full write-up with reproduction details: [docs/war-story.md](docs/war-story.md).
 
-## Runs in production
+## Runs in production: my own money, daily
 
-The maintainer's own bot trades through this exact executor 24/7 with real
-money. Example receipt (2026-07-03): settlement transaction
+I built pmq for my own trading. It executes real volume with my funds every
+day, and it has never booked a fill the exchange did not confirm. If you
+want to see it on-chain, here is a settlement from one of my wallets
+(2026-07-03):
 [`0x387f5f09...100d88a8`](https://polygonscan.com/tx/0x387f5f09c031bb36a71c54adc978b1ed4d50c67f6dd3f0c2c8068391100d88a8)
 on the CTF Exchange V2: a FAK market buy built by this library, matched and
-settled, with the builder code visible in the calldata. Additionally, a weekly
+settled, with the builder code visible in the calldata. A weekly
 [canary workflow](.github/workflows/canary.yml) exercises the real endpoints
 and the installed client surface, and opens an issue by itself if Polymarket
 drifts.
@@ -126,9 +129,10 @@ else:
         print(fill.matched_shares, "shares at", fill.price, "order", fill.order_id)
 ```
 
-`sell_fak` and `limit_gtc` follow the same contract. The buy path has carried
-live volume; treat the sell path as following the same documented semantics
-with less battle time.
+`sell_fak` and `limit_gtc` follow the same contract. Both FAK paths have
+carried real volume: a production round trip (buy 5.149 @ 0.94, sell back
+5.14 @ 0.94, cross-checked via `get_trades`) confirmed the mirrored
+`makingAmount`/`takingAmount` semantics on 2026-07-03.
 
 ## The signature_type table nobody gives you
 
@@ -213,12 +217,60 @@ shipped demo strategy is an API illustration meant to be replaced.
 * Keys are read from the environment, used to instantiate the signer, and
   never logged. No custody, no backend, no telemetry, zero network calls
   besides Polymarket endpoints.
-* Beware of the documented wave of fake "polymarket bot" repositories that
-  steal private keys. Read the source: pmq is small on purpose.
+* A documented wave of fake "polymarket bot" repositories steals private
+  keys; pmq is deliberately small so the entire execution path stays
+  readable in minutes by anyone who wants to look.
 * Fund the trading wallet with what you can afford to lose. Nothing here is
   financial advice; prediction-market access is restricted in some
   jurisdictions and compliance is on you.
 
+## If you feel like checking any of it
+
+None of the claims above require taking my word; each one comes with a
+handle you can pull, whenever you care to:
+
+* **Egress.** `PMQ_CANARY=1 pytest tests/test_canary_live.py -k egress -s`
+  records every DNS resolution during a full session (market data, auth
+  derivation, one signed order) and fails on any host outside
+  `polymarket.com`. Last observed list: `clob.polymarket.com`,
+  `gamma-api.polymarket.com`, nothing else. The weekly
+  [canary](../../actions/workflows/canary.yml) prints that list in public
+  CI logs. One designed exception: `pmq-doctor`'s optional on-chain checks
+  use the public Polygon RPCs named in its source.
+* **Provenance.** Releases carry a signed PEP 740 attestation (Sigstore,
+  via PyPI trusted publishing): click "provenance" next to any file on the
+  [PyPI files page](https://pypi.org/project/pmquant/#files), or fetch it
+  raw from PyPI's integrity API. The signing identity is this repository's
+  `publish.yml` workflow.
+* **Dependencies.** Dependabot files weekly bump PRs (Python and
+  SHA-pinned GitHub Actions), and the weekly canary runs `pip-audit`; a
+  hit opens an issue by itself.
+* **The source.** Five small modules; the whole execution path reads in
+  minutes. The grep targets that answer the important questions fastest
+  are listed in [SECURITY.md](SECURITY.md).
+
+## Stability and maintenance
+
+* Pre-1.0 SemVer: PATCH releases only fix, MINOR releases may change the
+  public API with the migration named in [CHANGELOG.md](CHANGELOG.md).
+  Nothing changes silently.
+* Deprecated APIs keep working and warn for at least one MINOR release
+  before removal.
+* The bar for 1.0, stated in advance: months of green weekly canaries, the
+  maker path (`limit_gtc`) production-proven with real volume the way the
+  FAK paths already are, and external production users.
+* Bus-factor honesty: one maintainer, who trades real money through this
+  exact code daily (strongest available incentive to keep it correct). The
+  mitigations are structural, not promises: five small modules, the
+  executable fill-contract test table, a weekly canary that opens issues by
+  itself, SHA-pinned CI. Operational rule: if the canary badge goes red and
+  stays red, treat the project as unmaintained and pin your last known-good
+  version.
+* Help wanted, precisely scoped: production receipts for `signature_type`
+  1 and 2 accounts (legacy Magic/email and browser-wallet proxies). Both
+  paths are introspection-tested but have never carried real money through
+  this library; the maintainer's own accounts are all types 0 and 3.
+
 ## License
 
 MIT

{pmquant-0.4.1 → pmquant-0.4.3}/SECURITY.md

@@ -14,14 +14,25 @@
   matches the API surface pmq was verified against (introspection at startup),
   rather than signing through changed semantics.
 
-## Reading the source before trusting it
+## Small enough to read
 
-A documented wave of fake "polymarket bot" repositories steals private keys.
-pmq is deliberately small (five modules) so you can audit the entire execution
-path in minutes. Grep targets that settle the important questions fast:
+A documented wave of fake "polymarket bot" repositories steals private keys;
+pmq is deliberately small (five modules) so the entire execution path reads
+in minutes. For whoever wants the fast route, the grep targets that settle
+the important questions:
 `POLY_PRIVATE_KEY` (read once, passed to the official client), `builder_code`
 (the disclosure and the opt-out), `http` (every host contacted).
 
+## Automated watch
+
+* Weekly canary CI runs the egress test (every DNS resolution during a full
+  session must stay inside polymarket.com) and `pip-audit` over the
+  dependency tree; any failure opens a labeled issue automatically.
+* Dependabot files weekly update PRs for Python dependencies and for the
+  GitHub Actions, which are pinned by commit SHA.
+* PyPI releases carry signed PEP 740 attestations (see "Verify the claims
+  yourself" in the README).
+
 ## Reporting a vulnerability
 
 Open a GitHub security advisory on this repository (Security tab, "Report a