v0.53.0 — TypeScript SDK (Phase K)

TypeScript SDK — @genesismesh/sdk

Genesis Mesh now ships a standalone TypeScript client for the NA HTTP API, decoupled from the Python main repo at sdk-ts/.

Architecture

Layer separation mirrors the main repo:

File	Purpose
src/auth.ts	canonicalJson, Ed25519/PKCS8-DER signing, buildAdminHeaders
src/client.ts	HttpTransport — fetch, timeout, typed error mapping
src/types.ts	30+ protocol interfaces (snake_case matching Pydantic models)
src/errors.ts	Typed error classes; fromHttpError handles NA nested format
src/index.ts	GenesisMeshClient with 7 sub-clients + full re-exports

Sub-clients

agreement · attestation · boundary · consensus · dataUsage · disclosure · evidence

Admin routes are signed with buildAdminHeaders (Ed25519 over canonical JSON). Public routes are unsigned.

Quality

• 74 Jest tests — ESM + ts-jest, all pass
• ESM + CJS dual build (npm run build)
• Live smoke test at sandbox/sdk-smoke/ — 16/16 checks pass against a real 001-NA instance

Smoke test coverage

treaty → offer → accept → verify · boundary decide/verify · evidence build/verify · attestation issue/revoke · recognition policy · data usage policy/intent/verify

Bug fixes from smoke testing

• DataSourceDescriptor: added required source_type + owner_sovereign_id fields
• fromHttpError: handles NA nested {error:{message,code}} format
• Agreement accept requires a recognition treaty for the responder to be issued first
• Role validation: must use role: prefix (role:client, role:anchor, etc.)
• Evidence verdicts: allow | block | escalate | warn (not trusted)

Next

• v0.54.0 — Go SDK (sdk-go/)
• v0.55.0 — C# SDK (sdk-cs/)

v0.52.1 — Trust API production hardening + /ship skill

What's new

• Rate limiting on all unauthenticated verify/prove routes (60 req/60 s) and GET /data-usage/policy (120 req/60 s) — previously only admin routes were guarded.
• Audit events on all 14 signing and verification handlers across the 6 Trust API blueprints.
• Error sanitization — internal exception details no longer appear in API responses; logged server-side only.
• 15 missing model exports added to genesis_mesh/models/__init__.py: all Trust API types are now importable from the top-level package.
• /ship project skill at .claude/commands/ship.md — encodes the full release process (pre-flight, vision enforcement, gate suite, commit, tag, GitHub release, memory update) so future releases follow the same production standard without relying on session memory.

Upgrade

pip install genesis-mesh==0.52.1

Full changelog: CHANGELOG.md

v0.52.0 — Trust API Surface (NA HTTP Endpoints)

Summary

Six new Network Authority route blueprints expose every SDK-required stable protocol operation over HTTP.

The SDK tier (v0.53 TypeScript, v0.54 Go, v0.55 C#) now has a well-tested HTTP surface to call, rather than needing to reimplement the protocol cryptography independently.

New HTTP routes

Domain	Routes
Agreement	POST /admin/agreements/offer, /counter, /accept · POST /agreements/verify
Boundary	POST /admin/boundary/decide · POST /boundary/verify
Trust evidence	POST /admin/trust-evidence · POST /trust-evidence/verify
Selective disclosure	POST /admin/disclosure/commit, /nullifier · POST /disclosure/prove, /verify
Consensus	POST /admin/consensus/vote, /proof · POST /consensus/verify
Data usage	POST /admin/data-usage/policy, /intent · GET /data-usage/policy · POST /data-usage/verify

Security constraint

Admin routes enforce one rule: the NA constructs canonical protocol artifacts from declared intent and signs them. Pre-built model payloads are never accepted for signing. POST /disclosure/prove is intentionally unauthenticated — all inputs are caller-supplied and no NA state is used.

HTTP reference

Full documentation at docs/api/trust-http.md: route, auth, request/response shape, error codes, and curl examples for every endpoint.

Tests

45 new tests in genesis_mesh/tests/test_na_trust_api.py. Full suite: 1,088 tests passing.

v0.51.0 — Public API Stability + Protocol Conformance Suite

What's new

Protocol Conformance Suite

conformance/ is a new directory with deterministic reference vectors for every major trust operation in Genesis Mesh. Alternative implementations (TypeScript, Go, C#) can load these vectors and verify their own output against the Python reference.

• 9 suites, 11 vectors: signatures, treaties, attestations, revocation, IBCT, trust evidence, selective disclosure, consensus, data usage.
• Fixed key seeds: all vectors use bytes(range(32)) / bytes(range(32, 64)) / bytes(range(64, 96)) as Ed25519 seeds, making outputs stable and reproducible.
• conformance/runner.py: importable runner with run_suite(name) and run_all().
• conformance/generate_vectors.py: regenerate vectors from the reference implementation after a protocol change.
• genesis_mesh/tests/test_conformance.py: 9 parametrized pytest cases, all green.

Public API Stability Contract

docs/stability.md declares the first versioned stability contract for Genesis Mesh. Every stable CLI command and Python symbol is listed with the version it stabilized in. Symbols absent from that page are internal with no stability guarantee.

Deprecation Policy

DEPRECATION_POLICY.md defines the lifecycle: announce → one minor version maintenance window → removal. Security fixes are exempt and may remove behavior immediately.

Stats

• 1050 tests pass (9 new conformance tests + 1041 pre-existing)
• Sphinx build: clean, no warnings
• All pre-push hooks pass: pip-audit, CLI smoke, pytest

v0.50.0 — Maintainer Quality

Maintainer Quality

v0.50.0 is a repository quality release. No Python code or tests changed.

Added

• .github/ISSUE_TEMPLATE/bug.yml — structured bug report with version dropdown, component selector, reproduction steps, expected/actual behavior, and environment fields.
• .github/ISSUE_TEMPLATE/feature.yml — structured feature request with problem statement, proposed solution, alternatives, and research links.
• .github/pull_request_template.md — PR checklist: tests, Sphinx build, CHANGELOG, no-secrets guard.
• CODEOWNERS — assigns @thaersaidi to trust/, models/, crypto/, ops/tamarin/, cli/, and docs/.
• ops/release-checklist.md — step-by-step pre-release, release, and post-release checklist.

Changed

• CONTRIBUTING.md — full 8-section guide: dev setup, running tests, docs build, branch naming, commit style, PR process, protocol-change requirements, and release process.
• README.md — pruned to quick-start scope: one-paragraph description, install, three-command quickstart, docs link, contributing link, security link, license.

1,041 tests pass. Sphinx build: zero warnings.

v0.49.0 — Documentation Restructure by Phase

Documentation Restructure by Phase

v0.49.0 is a documentation-only release. No Python code, CLI commands, or tests changed.

What changed

New: docs/development/phases/ — 10 per-phase Markdown pages (phase-a through phase-j).

Each page covers:

• The question the phase answered
• What changed (per-release detail)
• Value added (what guarantees were established)
• What became possible (what the next phase built on)
• Key releases table

Restructured: docs/development/history.md is now a one-screen timeline table with links to per-phase pages, a narrative arc, and the Patterns / What Is True Today / Where to Read More sections.

Updated: docs/index.md toctree lists all 10 phase pages under the Development section.

Phases

Phase	Versions	Theme
A	v0.1.0 – v0.5.2	Foundation
B	v0.6.0 – v0.8.0	Agent Layer
C	v0.9.0 – v0.12.0	The Trust Thesis
D	v0.12.1	Operational Proof
E	v0.13.0 – v0.17.11	Operator Readiness
F	v0.18.0 – v0.21.0	Multi-Cloud Operation
G	v0.22.0 – v0.25.0	Application Layer
H	v0.26.0 – v0.31.0	Governed Relationships
I	v0.32.0 – v0.37.0	Runtime Trust Layer
J	v0.38.0 – v0.48.1	Third Trust Cycle

1,041 tests pass. Sphinx build: zero warnings.

v0.48.1 — Enterprise-Grade Example Suite

What's New

• 25 animated terminal GIF demos covering all Phase H/I/J protocol features
• Shared terminal_render.py and _bootstrap.py for all demos
• GIF image references added to all 25 feature example markdown files
• Roadmap plans v0.49–v0.56 (docs restructure → interoperability proof)

Fixes

• Package version correctly set to 0.48.1 (was missing from initial tag)
• cryptography upgraded 48.0.0 → 48.0.1 (GHSA-537c-gmf6-5ccf)
• All repo URLs migrated to GenesisMeshLabs/genesismesh

1,041 pytest tests pass; Sphinx builds clean with no warnings.

v0.48.0 - Formal PeerRiskSignal Verification (Tamarin)

Formal PeerRiskSignal Verification (Tamarin)

Closes the Third Trust Cycle (v0.38–v0.48) with formal proofs over the PeerRiskSignal state machine.

What is new

Three Tamarin Prover security lemmas in ops/tamarin/risk_signal/peer_risk_signal.spthy:

Lemma	Status	Proves
signal_bounded	Proved	Signal value always in {low, mid, high} (abstracting [0.0, 1.0])
anomaly_detection_responsive	Proved	SuddenDrop cannot permanently suppress anomaly detection
no_single_source_cascade	Proved	Cascade amplification requires genuine independent observations from each detecting sovereign

Executable property tests (no Tamarin required)

genesis_mesh/tests/test_risk_signal_formal.py — 13 property-based tests covering signal boundedness, anomaly responsiveness, and cascade isolation.

genesis_mesh/tests/test_risk_signal_tamarin.py — pytest wrappers that invoke tamarin-prover --prove; skip automatically when tamarin-prover is not installed.

What is NOT proved

• Implementation fidelity (Python bugs, floating-point precision)
• Timing attacks on the continuous decay formula
• Cross-sovereign collusion (two observers coordinating)

Tests

17 new tests (14 pass unconditionally; 3 Tamarin runners skip without tamarin-prover).
Full suite: 1041 passed, 4 skipped.

Third Trust Cycle complete

v0.38–v0.48: adversarial hardening, communication privacy, overlay discovery, process-level mediation, trust path performance, data usage attestation, formal verification.

v0.47.0 - Data Usage Attestation Layer

Data Usage Attestation Layer

Signed pre- and post-execution attestation for data access. Implements the Data Plane from arXiv:2606.12320 (Five-Plane Reference Architecture).

What is new

• DataLicensePolicy — operator-issued source allowlist, access type list, prohibited classification tags, volume cap; signed by licensor
• DataAccessIntent — agent-signed pre-execution declaration (expires in TTL)
• DataAccessRecord — agent-signed post-execution record linked to intent
• DataUsageViolation — structured violation record with 7 typed reasons
• verify_data_access_intent() — pre-execution compliance check; reports all violations
• verify_data_access_record() — post-execution compliance check
• DataUsageGate — BoundaryEngine gate; blocks execution when intent exceeds license scope
• genesis-mesh trust data policy / intent / record / verify CLI

Scope constraint

Payment, royalty calculation, and external settlement are explicitly out of scope. DataAccessRecord is an attestation artefact; downstream systems decide what, if anything, to charge.

Tests

20 new tests; full suite: 1024 passed, 1 skipped.

v0.46.0 - Trust Path Performance and Atlas Pruning

Trust Path Performance and Atlas Pruning

Signed TTL-bound trust path caching and verifiable graph pruning.

Added

• TrustPathCache: signed collection of BFS trust path results for a graph snapshot
• TrustPathEntry: signed, TTL-bound single (source, target) cache entry
• GraphPruningPolicy: 3 pruning conditions + staleness guard
• PrunedAtlasExport: signed audit export with per-edge removal reasons
• \cache_trust_path(): BFS path computation, signed + TTL-bounded
• \lookup_trust_path(): O(1) cache lookup (expires on TTL or graph digest mismatch)
• \�uild_trust_path_cache(): multi-pair pre-computation
• \prune_graph(): removes expired/revoked/empty-scope edges; refuses stale graphs
• \genesis-mesh trust atlas {cache,lookup,prune}\ CLI extensions

Notes

• 21 new tests; 1004 total pass.