VSTD v1.1.2

Source tag signature status: SIGNED_AND_GITHUB_VERIFIED (valid).

Correction recorded 2026-08-22: the initial notes reported UNSIGNED because the clean release runner did not import the maintainer's public key before calling local git verify-tag. GitHub's tag-object verification reports the existing signature as valid. This correction changes release metadata only; the tag and release assets are unchanged.

Every uploaded asset is bound to the exact public commit by the external release manifest and a GitHub artifact attestation. The wheel and source distribution published to PyPI are the same tested files attached here. Verify a GitHub asset with:

gh attestation verify PATH_TO_ASSET --repo TimeLordRaps/verifier

• Rename the import package verifiable to verifier and the distribution
  verifiable-standard to verifier-standard, so no published name reuses the ordinary-English
  adjective or the maintainer's former project name. The vstd, verifier, and
  verifiable command names all continue to work; verifiable is a command name only
  and no longer names an import package.

• Derive the release source-archive name from the manifest during verification, so
  manifests published through v1.1.1 that bind verifiable-standard-<release>.zip
  remain verifiable without republishing.

• Record the import-package, distribution, and archive renames in
  WIRE_IDENTIFIERS.md. No receipt wire identifier, schema $id, or canonical digest
  changes.

• Attribute the specifications, distribution metadata, and governance decision rights to
  TimeLordRaps. The legal name remains the copyright holder in NOTICE.

• Add a normalized, byte-reproducible Python source distribution beside the reproducible
  wheel; verify their name, version, import package, and frozen console-script set before
  release.

• Publish only the tested wheel and source distribution through PyPI Trusted Publishing
  after explicit approval in the protected pypi environment. The GitHub release keeps
  the full source ZIP and external byte manifest as the public provenance coordinate.

• Document that the unrelated PyPI project named verifier shares the same import name
  and must not be co-installed; this is an ecosystem collision boundary, not a claim to
  that distribution coordinate.

• Rename the VSTD-2 section 7 lifecycle term VERIFIABLE to GEOMETRY_INSPECTABLE
  and record in WIRE_IDENTIFIERS.md that the section 7 vocabulary is prose-only, so
  no status token reuses the maintainer's name and no wire value changes.

• Label the reference emulator's synthetic accelerator descriptor vendor as
  EMULATED instead of the maintainer's name, so fabricated hardware evidence cannot
  read as maintainer attestation.

• Remove maintainer-scoped phrasing from normative specification prose: conformance is
  defined by the documents, and the independent auditor role is named by the standard
  rather than by the maintainer.

• Correct the SimulacraBench synthetic specimen additively: unobserved private
  artifacts now remain IDENTIFIED, and the public challenge stops at
  CHALLENGED without a founder-authored adjudication.

• Require content-bound observed bytes before deriving AVAILABLE or PORTABLE;
  locator and retention declarations alone no longer elevate availability.

• Expand the public presentation gate to reject drive-qualified paths, private
  locator schemes, deployment fields, local model artifact filenames, business
  operations identifiers, common secret shapes, and email addresses.