scpe-protocol 0.2.0__tar.gz → 0.2.1__tar.gz

{scpe_protocol-0.2.0/scpe_protocol.egg-info → scpe_protocol-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: scpe-protocol
-Version: 0.2.0
+Version: 0.2.1
 Summary: SCPE: an open protocol for verifiable provenance of any digital artifact — who signed a contribution or file, what they declared about AI use, and that nothing was tampered with, verified offline with no server and no new accounts. Ships the single-file reference verifier, its producer, and a CLI (`scpe`) that seals a pull request from it.
 Author: Augusto Bastos
 License-Expression: Apache-2.0
@@ -44,7 +44,11 @@ Dynamic: license-file
   <img alt="spec" src="https://img.shields.io/badge/spec-scpe%2F0.1-41c257?style=flat-square&labelColor=0b0b0c">
   <img alt="python" src="https://img.shields.io/badge/python-3.11%2B-41c257?style=flat-square&labelColor=0b0b0c">
   <img alt="license" src="https://img.shields.io/badge/code-Apache--2.0-41c257?style=flat-square&labelColor=0b0b0c">
-  <img alt="status" src="https://img.shields.io/badge/v0.2-early-d29922?style=flat-square&labelColor=0b0b0c">
+  <img alt="status" src="https://img.shields.io/badge/v0.2.1-early-d29922?style=flat-square&labelColor=0b0b0c">
+</p>
+
+<p align="center">
+  <a href="https://augbastos.github.io/scpe/"><b>augbastos.github.io/scpe</b></a> — what it is, in one page
 </p>
 
 An open protocol for two questions a pull request cannot answer today: **who signed this
@@ -188,22 +192,28 @@ anchors and what a verdict is worth under each.
 Add a workflow that verifies every PR and posts a seal. Set `require` to gate merges.
 
 ```yaml
-# .github/workflows/scpe.yml — see docs/workflows/scpe.yml for the fork-safe full version
-- uses: augbastos/scpe@v0.2
+# .github/workflows/scpe.yml — the step. Copy BOTH files from docs/workflows/ for the
+# fork-safe version: scpe.yml (verify) and its companion scpe-seal.yml (post the seal).
+- uses: augbastos/scpe@v0.2.1
   with:
     level: "1"        # 1 = disclosure lint · 2 = signed envelope required
     require: "true"   # fail the check on anything not verifiable
 ```
 
-Pin the exact tag while the protocol is pre-1.0. `v0.2` is an **immutable alias** — it points at
-one commit and is never moved, so a fix arrives as a new tag you adopt by editing the pin, not as
-a silent change under the one you already wrote. It is also the first release in which the Action
-verifies the `scpe/0.1` envelope itself; `v0.1.x` verified a different, now-removed format, so
-upgrading from it is a behaviour change and not a patch — [docs/MIGRATION.md](docs/MIGRATION.md)
-has the steps.
-
-The Action uses a fork-safe two-job split: the untrusted job (which runs contributor code) holds
-no secrets; only a trusted follow-up job posts the comment. Neither level installs anything in the
+Pin the exact tag while the protocol is pre-1.0. Every tag here is an **immutable alias** — it
+points at one commit and is never moved, so a fix arrives as a new tag you adopt by editing the
+pin, not as a silent change under the one you already wrote. `v0.2.1` is that in practice: `v0.2`
+shipped a seal banner that read `VERIFIED` on unattested PRs and a workflow template GitHub
+refuses to register, and both were fixed by publishing a new tag rather than by moving the old
+one. The `v0.2` line is also the first in which the Action verifies the `scpe/0.1` envelope
+itself; `v0.1.x` verified a different, now-removed format, so upgrading from it is a behaviour
+change and not a patch — [docs/MIGRATION.md](docs/MIGRATION.md) has the steps.
+
+The Action uses a fork-safe two-job split, and the two jobs live in **two files**: the untrusted
+job in `scpe.yml` (which runs contributor code) holds no secrets, and only the trusted follow-up
+job in `scpe-seal.yml` posts the comment. Two files is a GitHub constraint, not a preference — a
+workflow that names itself in its own `workflow_run` trigger fails to register at all. Neither
+level installs anything in the
 runner — both run stdlib-only Python straight out of the Action's own checkout, so the bytes that
 decide a merge are the bytes of the tag you pinned, not whatever a package index serves that day.
 Check out with `fetch-depth: 0`: level 2 recomputes the diff as `git diff <base>...<head>`, and the
@@ -237,7 +247,7 @@ passing all eighteen does not by itself show that the `key_source` MUST is honou
 checked by inspection. Every vector ships its own `keys` file so the suite runs offline, and no
 vector reaches the `forge` anchor.
 
-**Cost** — measured on the Python reference (Ryzen 5 5600H, Python 3.14, `local` provider):
+**Cost**
 
 | | Measured |
 |---|---|
@@ -264,7 +274,7 @@ single machine — not a formal benchmark suite.
 
 ## Status
 
-**v0.2 — early.** This is a specification plus a reference implementation (a single-file
+**v0.2.1 — early.** This is a specification plus a reference implementation (a single-file
 verifier, a producer, and a maintainer-side Action). The full test suite — including a 100-PR
 stress proof and a local end-to-end — runs on every push; the CI badge above is its live
 result. Two more independent verifiers, in Go and Rust, reach the same verdict as the Python