v0.6.3

Arras 0.6.3

Arras is published on PyPI and
npm.
The Python wheel and sdist now use registry-compatible dependency metadata;
the carried public API catalog agrees with Python and npm package version 0.6.3.
This preserves the qualified Truss 0.0.50, Weft 0.4.51 and UMF core 0.10.0 cohort.
The unchanged npm 0.6.1 package
was also published and verified. Python 0.6.1 was never published to PyPI; the
failed immutable 0.6.2 tag remains a build record.

Verified delivery

• Release run 40257854519:
  all ten gates passed, including Linux native, installed doctor, official UMF,
  packed theme/browser, downstream and anonymous public-download qualification.
  The GitHub release has 17 assets including SHA256SUMS.
• Fresh macOS arm64 installation: 64 native cases passed, with eight declared
  limits and seven replica-only cases inapplicable; all 172 payload files matched
  and cleanup passed. This does not establish a system dynamic-link audit.
• Actual Lakebase over the WAN: all twelve acceptance cases passed for the
  qualified CPython 3.11.17 / GraphQL 3.3.0 cohort, including original cleanup,
  independent read-only audit and process/group absence before custody handback.
  The Mac run separately observed CPython 3.11.9 / GraphQL 3.3.1.
• Registry run 40261690123:
  successful attempt two verified exact registry bytes and fresh PyPI/npm installs.
  PyPI's first trusted upload passed. npm's first OIDC upload succeeded with
  signed provenance; npm processing
  exceeded the initial visibility wait. The retry skipped the matching upload
  and passed byte and install verification.

The qualification index
and publication record
retain the scoped evidence, receipt hashes and failed attempts. Reviewed
orchestration corrections did not change the immutable tag, target source or
qualified artifacts.

Installation and future releases

Install both Python extras directly from public PyPI, without a wheelhouse or
extra index:

pip install 'arras[truss,umf]'

Arras 0.6.3 resolves the qualified Truss 0.0.50, UMF core 0.10.0 and Weft 0.4.51
cohort. Public-extras run 40370325928
passed fresh isolated CPython 3.11 installs on hosted Linux x86_64 and macOS arm64.
Both jobs verified all 19 downloaded distributions came from public PyPI,
no direct-URL references, exact qualified Arras/UMF/Truss/Weft archive digests,
pip check, installed imports, Arras doctor, official UMF document admission
and Weft support. A separate fresh local Mac install passed the literal
unversioned command above. The raw receipts and verification index
retain the platform-specific scope; these installation checks add no new
native/database/provider qualification.

The original registry run's base-only receipt remains historical evidence;
the later public-extras receipts establish the combined extras installation.
The original tag and all 17 release assets are unchanged. The UI remains
npm install @documentdrivendx/arras-ui@0.6.3. Verify SHA256SUMS before using
GitHub release assets.

Future successful tagged releases automatically publish the exact qualified
assets through GitHub OIDC after all ten Release gates and public-download
checks pass. Python qualification also requires both hosted public-extras
fresh-install gates. UMF, Truss and Weft dependency releases publish through
their matching GitHub Actions/PyPI trusted publishers; UMF 0.10.2 has completed
the automatic release-event-to-OIDC publication path. The main-only pypi and
npm environments need no per-release
approval or stored registry tokens. npm visibility is bounded at 600 seconds
within a 20-minute publication job; PyPI retains 180 seconds. Only absence is
retried; conflicting bytes and other errors fail immediately.

Runtime support remains latest-only. Admitted UMF 0.10 database lineages upgrade
by forward migration to the latest runtime, without an age cutoff; historical
runtimes and pre-0.10 compatibility are outside support.

Artifact identity

• Target source: 81d560310f46f1d2c105e6635d70b0eeb97d4684
• Annotated tag object: 04af6523b7cba0388bb4848215078f9f30cc8575
• Wheel SHA-256: ef8dec70d8e0089e776166303bc622b573825f2a4e071791a316b58e22a40d0d
• npm tarball SHA-256: 17be04205f928e8b4636ec3665ae03fa21f610c24307624a95b7c7b21f0e4585
• SHA256SUMS SHA-256: 066cc8fa198d1763b568af37010520f47091682309571cbc839f3ab6a40a6827

Build provenance

• Driver commit: 9f3406f78d20379bebd4b1b58958ec78f9798352
• Driver workflow: DocumentDrivenDX/arras/.github/workflows/release.yml@refs/heads/main
• Target tag: v0.6.3
• Target source commit: 81d560310f46f1d2c105e6635d70b0eeb97d4684
• Workflow run: 40257854519 attempt 1

What's Changed

• Correct the carried API catalog and qualify Arras 0.6.3 by @easel in #13

Full Changelog: v0.6.2...v0.6.3