P2P Engine v0.6.5

P2P Engine 0.6.5 — 2026-09-06

P2P Engine 0.6.5 closes the P2P-side discrepancies found by the final
local/remote memory roadmap audit. It does not change the selected filesystem
storage architecture, workspace schema, synchronization protocol or authority
model.

The remote-only profile is now described accurately as a WaveKit-owned access
mode. A remote-only user has no client-local P2P root, CLI, MCP stdio server
or generated integration artifacts; authenticated web, API and MCP HTTP
instructions and tool discovery come from WaveKit. P2P still exposes this
boundary in its profile matrix, while every local artifact renderer rejects
remote-only before writing instead of falling through to standalone or
linked-local assumptions.

Maintained WaveKit transition documentation is bound by tests to the current
fixture manifest and runtime version. Release documentation also distinguishes
the repository's actual create-only, attested and checksum-pinned publication
process from GitHub-enforced immutable releases, which are not enabled.

Install

Install the exact release wheel from GitHub with uv-managed Python:

uv tool install --managed-python --python 3.12 --no-config \
  https://github.com/BINARYA/p2p-Engine/releases/download/v0.6.5/p2p_engine-0.6.5-py3-none-any.whl

Run uv tool update-shell only if uv reports that its tool binary directory is
not on PATH. Installing or replacing uv, Python or P2P Engine remains an
explicit owner action.

Compatibility

Version 0.6.5 keeps requires-python >=3.11, workspace schema 4, portable
vertical schema 3, canonical bundle v1 and the p2p-cli/v1 JSON envelope.
Python 3.12 is the release-qualified runtime. The same candidate wheel is
qualified on Linux x86-64, macOS x86-64, Windows x86-64 and macOS ARM64.

Existing 0.6.4 filesystem projects remain valid and require no storage,
workspace, bundle, authority, linked-replica or WaveKit server migration.
Standalone and linked-local generated integrations keep their existing public
behavior. WaveKit should update its exact wheel pin only after this release has
successfully published.

Checksums

The GitHub Release contains SHA256SUMS for the exact wheel and source
distribution. Verify downloaded artifacts before installation:

sha256sum --check --ignore-missing SHA256SUMS

Checksums prove downloaded-byte identity; they are not signatures.

Provenance

The explicit on-demand release workflow qualifies the exact main commit,
creates GitHub Artifact Attestations and only then creates tag v0.6.5 and the
create-only, attested GitHub Release. Verify the wheel with:

gh attestation verify p2p_engine-0.6.5-py3-none-any.whl \
  --repo BINARYA/p2p-Engine

The published assets are the same candidate bytes that pass source,
reproducibility, installed-wheel and cross-platform uv gates.