P2P Engine v0.6.8

P2P Engine 0.6.8 — 2026-09-08

P2P Engine 0.6.8 makes portable vertical identity, provenance and artifact
lifecycle semantics explicit. It completes the work tracked in GitHub issues
#8 through #11 without changing the established meaning of existing 0.6.7
semantic checksums.

The new p2p-vertical-semantic-checksum/v1 contract names the semantic
projection and canonical serialization frozen from the official 0.6.7
baseline. Static golden vectors cover projection, defaults, ordering,
null/boolean handling, Unicode, dependencies, profiles, modules, sections,
questions, rubrics, artifacts, manifest and canonical bytes. Regression tests
compare against those reviewed static values rather than calculating expected
digests with the implementation under test.

Registry protocol v2 remains backward-compatible. A legacy
semantic_checksum by itself is interpreted as semantic-checksum v1 using
SHA-256. semantic_identity is additive and optional. When both forms are
present they must identify the same digest; contradictions and unsupported
contract/algorithm combinations fail closed. Existing published registry-v2
release semantics are not rewritten.

Example contents are explicitly documentary under semantic v1. The frozen v1
projection continues to include example paths but not their contents. Changing
example bytes therefore changes artifact SHA-256 without changing semantic-v1
identity when the path is unchanged. This deliberate compatibility rule does
not introduce a semantic v2 or alter immutable release coordinates.

The new p2p-vertical-portable-provenance/v1 projection separates facts an
artifact can establish autonomously from host-owned context. Artifact and
semantic identities are calculated from available content. Lineage and
dependency relations remain declarations stored in the artifact; a referenced
dependency target identity becomes verified only when the target content is
available and matches. Registry trust, moderation, uploader identity, review,
audit and WaveKit-specific context remain outside the portable contract.

Artifact lifecycle documentation now states the boundary precisely: an
immutable .p2pv is the lossless representation of the portable artifact
layer. Byte-identical copying preserves the artifact and all declarations it
actually contains, and permits recalculation of both identities. It does not
reconstruct draft state, arbitrary host-side source_attribution, registry
state, audit, review, uploader, timestamps or WaveKit context. Existing sealed
artifacts are inspected and used directly; editing requires an explicit
clone/derive transition. No exact-import command or offline admission
capability was added.

Install

Install the exact release wheel from GitHub with uv-managed Python:

uv tool install --managed-python --python 3.12 --no-config \
  https://github.com/BINARYA/p2p-Engine/releases/download/v0.6.8/p2p_engine-0.6.8-py3-none-any.whl

Run uv tool update-shell only if uv reports that its tool binary directory is
not on PATH. Installing or replacing uv, Python or P2P Engine remains an
explicit owner action.

Compatibility

Version 0.6.8 keeps requires-python >=3.11, workspace schema 4, portable
vertical schema 3, package format 1, canonical bundle v1, registry protocol v2
and the p2p-cli/v1 transport envelope. Python 3.12 is the release-qualified
runtime. The same candidate wheel is qualified on Linux x86-64, macOS x86-64,
Windows x86-64 and macOS ARM64.

Existing 0.6.7 filesystem projects require no workspace, storage, bundle,
Choice, replica or vertical-package migration. Semantic checksum v1 reproduces
the 0.6.7 behavior exactly. The optional structured registry identity and
portable provenance projections are additive; legacy registry-v2 scalar
checksums remain valid.

WaveKit must pin and qualify the exact 0.6.8 artifact before consuming the new
identity or provenance fields. WaveKit must not reproduce P2P's semantic
projection and must continue to preserve sealed artifacts byte-identically.
Authentication, registry trust, moderation, audit and host provenance remain
WaveKit-owned responsibilities.

Checksums

The GitHub Release contains SHA256SUMS for the exact wheel and source
distribution. Verify downloaded artifacts before installation:

sha256sum --check --ignore-missing SHA256SUMS

Checksums prove downloaded-byte identity; they are not signatures.

Provenance

The explicit on-demand release workflow qualifies the exact main commit,
creates GitHub Artifact Attestations and only then creates tag v0.6.8 and the
create-only, attested GitHub Release. Verify the wheel with:

gh attestation verify p2p_engine-0.6.8-py3-none-any.whl \
  --repo BINARYA/p2p-Engine

The published assets are the same candidate bytes that pass source,
reproducibility, installed-wheel and cross-platform uv gates.