autorate 0.1.2 — public package links

autorate 0.1.2 - public package links and an accurate licence line

Released 2026-11-09. This is the second PyPI distribution. 0.1.1 was
never a PyPI release: the v0.1.1 git tag is an Action-listing metadata patch
whose rebuilt wheel and sdist are byte-identical to 0.1.0. The PyPI version
therefore goes 0.1.0 -> 0.1.2.

What changed

• pyproject.toml: version 0.1.2; added [project.urls] with Homepage,
  Repository, Issues and Releases, all pointing at the now-public repository.
  PRD §8.1 calls a package whose links point at a private tree incoherent.
• README.md: the licence line previously named no grant at all. It now names
  Apache-2.0 and refers to LICENSE, without implying rights beyond that grant.
• uv.lock: re-resolved offline for the new version (plus one marker
  normalisation). No dependency was added or upgraded.

Inputs, commands, verdict logic, badge path, action.yml, .github/workflows/
and the byte-compared data/ tree are unchanged.

Verification (all exit codes read from their own commands)

Gate	Reading
autorate verify --protocol protocol.json	rc 0, corpus present, re-derived 649 /649 values, protocol ce43f8e29cc1
Clean-clone verify (corpus absent)	rc 0, re-derived 612 /612 values
Full corpus-present suite	1255 passed, 3 skipped, 0 failed
Full corpus-absent export lane	1227 passed, 31 skipped, 0 failed; lane defined by AUTORATE_FEISHU_ROOT=/nonexistent plus AUTORATE_TRACKED_FILES=<manifest> (146 paths)
F8 + upstream + toolchain guards	33 passed
Badge JSON / SVG	both 0 diff at 612 /612, corpus-absent lane
Lane ruff / compileall / YAML / TOML	rc 0 each
Credential-shaped leak scan over tracked tree	0 hits
§0.3 PRD leak test	8 hits, all lawful (law's own definition and conditional predicates), adjudicated in the M1 opening report; no pattern widened
Planted negative controls	15/15 observed red and restored; the four F8 files' sha256 prefixes are unchanged from gate4_plants.json
Published-artefact delta	git diff --name-only HEAD~1 -- data/ docs/ empty for the 0.1.2 commit
Real CI run 42484712287	offline, cross-libc-verify (macos-latest), cross-libc-verify (ubuntu-latest) all success

The export lane's skip count differs from the 2026-11-08 run (1220 passed, 38 skipped): the total is still 1258 tests and both lanes have 0 failures. It
is recorded as a reading, not presented as byte-identical history.

Artefacts

File	SHA-256
autorate-0.1.2-py3-none-any.whl	7709d3faa560417efcbd8066f6db79d741d995bbbb9b23d2d595ed2a6fb38205
autorate-0.1.2.tar.gz	69ea625071fbeeedad346c1e3fe3e14555395ab51a7435c91ca9a2041f7acff2

• twine check: PASSED for both.
• sdist: 47 entries, 0 *.jsonl records rows, 0 internal directories
  (docs/, tests/, .github/, .superpowers/, tools/), includes
  pyproject.toml, README.md, LICENSE.
• wheel METADATA: Version: 0.1.2, License: Apache-2.0, four Project-URL
  headers.
• Anonymous PyPI JSON: latest 0.1.2, releases ['0.1.0', '0.1.2'],
  project_urls present; project page HTTP 200.
• Downloaded wheel and sdist reproduce both SHA-256 values exactly.
• Clean venv install of autorate==0.1.2: --help rc 0. verify in a
  directory with no evidence bundle returns rc 4 with a named refusal
  ("protocol.json is declared published ... and is not in this checkout").
  This is the documented boundary: the evidence bundle comes from the
  repository, not from PyPI. It is not a passing verification.

Order and deviations

• PRD §8.1 (PyPI release -> tag) is followed: the upload preceded this tag.
  v0.1.0, its Release and the PyPI 0.1.0 files are untouched.
• PRD §12.3 ruling A2 ("the version stays 0.1.0") was the decision not to cut
  1.0.0 before criteria G1-G5 are met; it did not forbid patch releases. The
  owner authorised 0.1.2 on 2026-11-08. The frozen protocol still prints
  G1 not_certifiable, G3 not_measured, G4 not_met.
• The Marketplace listing autorate-gate moved to v0.1.2 when this Release
  was published. Verified anonymously after publication:
  latestRelease.tagName = v0.1.2, with both v0.1.1 and v0.1.2 visible on
  the listing. No Marketplace metadata changed in this release, so no listing
  edit was requested here.

Not done

No new upstream issue or PR, no awesome-list interaction, no skip/xfail/
ignore, no relaxed guard, no change to any file the frozen verify compares.
SonarCloud's PR #14 historical failure was left unaltered; the current main tip
analyses neutral.

autorate 0.1.1 — Action listing metadata

autorate 0.1.1 - Action listing metadata

This release exists so the in-repo composite Action can be listed on GitHub
Marketplace. It changes no distributed byte: PyPI stays at autorate==0.1.0.

What changed

• action.yml top-level description: 233 -> 117 characters. Marketplace
  requires fewer than 125. The shorter text still names the four verdicts
  (certified, not-certifiable, drift, not-run) and still states that
  the CLI, not the Action, owns the statistics.
• action.yml branding.color: gray -> gray-dark. gray is not in
  GitHub's allow-list; check-circle was already a valid Feather icon.

What did not change

• Inputs, outputs, shell commands, verdict logic and badge path: unchanged.
• Rebuilding wheel and sdist from this tree reproduces the published PyPI
  0.1.0 artefacts byte for byte (both sha256 identical); action.yml is in
  neither artefact.
• v0.1.0, its Release and the PyPI upload are untouched.

Verification

• autorate verify rc 0, re-derived 649 /649 values.
• F8 + upstream guards: 33 passed.
• Badge JSON/SVG: both 0 diff at re-derived 612 /612 values.
• Lane ruff (--select=E9,F63,F7,F82,F401,F811) and compileall: rc 0.
• CI run 42480211949 on aa7c21c: success (three jobs).

Deviation from PRD section 8.1

Section 8.1 orders PyPI release -> tag. This tag has no new PyPI release,
because no distributed byte changed; uploading an identical distribution
under 0.1.1 would claim a difference that does not exist. The tag exists only
to give Marketplace a release whose action.yml passes its validation.

Listing status

Published to GitHub Marketplace on 2026-11-08: https://github.com/marketplace/actions/autorate-gate
The listing latest release is v0.1.1; anonymous access returns HTTP 200.

autorate 0.1.0 — first public release

autorate 0.1.0

First public release. pip install autorate installs the library and the console script; the
in-repo composite GitHub Action and the four-state badge live in this repository, not in the wheel.

Published artefacts

file	SHA-256
autorate-0.1.0-py3-none-any.whl	5b6cb8d2b5af526c6375c77a4f8c64c6960bb05cf05843cf3adaa029b8fb449b
autorate-0.1.0.tar.gz	82a6cfe2286e88dd761c2c67e31ce61eaaafc2999beed82d4ef5759a1d476d63

Both were built from d16929e, the tip gated, pushed and CI-green at release time. PyPI metadata
was read back anonymously and the downloaded files re-hashed to the values above.

What the package does and does not contain

The sdist and wheel carry src/, the certificate/denominator artefacts under data/,
protocol.json, README.md, LICENSE and pyproject.toml. They contain zero
data/records_*.jsonl rows, zero docs/, zero tests/ and zero .github/ entries: PRD 8.4 says a
public share exposes certificates, bounds, denominators and digests, never records rows. Verified
against the downloaded sdist (0 matching entries).

autorate verify re-derives this tree's published numbers and therefore needs the committed
evidence bundle; from a plain pip install it refuses with exit 4 and explains which artefact is
absent. The repository, not the wheel, is the way to get that bundle. autorate --help and
autorate compare work from the installed wheel (both rc 0, re-checked from a clean venv against
the published PyPI wheel).

Gates at the tagged tree

autorate verify rc 0 / re-derived 649 /649 values (corpus present); full suite
1255 passed, 3 skipped; export lane 1220 passed, 38 skipped with a 146-line tracked manifest;
F8 guards 20 passed; 15 plants all red and all restored byte-identical; badge re-minted from the
export with 0 diff on both JSON and SVG; ruff / compileall / YAML all clean; two-stage credential
scan stage-two 0 hits; machine-absolute-path literals 0. Real GitHub Actions on main: ci run
42364970656 success (offline 1224 passed, 34 skipped, 612 /612, cross-libc ubuntu + macos
success); action-gate run 42357968496 certified / 612 /612 / corpus absent / object-db.

Known open items

• The SonarCloud C Security Rating on New Code check on PR #14 (2026-11-07) failed on the three F8 files; the same analysis on the current main tip is neutral. Nothing was
  suppressed and no guard was relaxed; fixing it would change the gated tree and void the evidence.
• docs/upstream/ holds dated, never-submitted drafts (measured 2026-10-14). A 2026-11-07
  re-measurement against laya 0.4.27 found no live finding (28 passed, 0 failed), so no upstream
  issue or PR was filed. The drafts are kept as dated transcripts, not as statements about the
  upstream's present code. Note on the tagged tree: at v0.1.0 those drafts still used the
  present tense ("one still describes the current release"). Section 8.3 item 1 requires such a
  sentence to be corrected or dropped, not annotated; the correction landed on main immediately
  after the tag as a docs-only commit. The tag was deliberately not moved, because both published
  PyPI artefacts were built from this exact tree and neither artefact contains docs/.
• The Action is listed on GitHub Marketplace starting with v0.1.1. This v0.1.0 tree was never a Marketplace release: its action.yml carried a 233-character description and the invalid colour gray, both rejected by the listing checks.
• This tag follows the PyPI upload because §8.1's corrected order puts visibility before PyPI and
  the tag after it. §7's older "tag before publishing" wording is superseded by §13.8 item 4.