VSTD v1.1.3

Source tag signature status: SIGNED_AND_GITHUB_VERIFIED (valid).

Correction recorded 2026-08-22: the initial notes reported UNSIGNED because the clean release runner did not import the maintainer's public key before calling local git verify-tag. GitHub's tag-object verification reports the existing signature as valid. This correction changes release metadata only; the tag and release assets are unchanged.

Every uploaded asset is bound to the exact public commit by the external release manifest and a GitHub artifact attestation. The wheel and source distribution published to PyPI are the same tested files attached here. Verify a GitHub asset with:

gh attestation verify PATH_TO_ASSET --repo TimeLordRaps/verifier

• Canonicalize source ZIP timestamps in UTC and remove host ZIP metadata, so the
  same Git coordinate produces byte-identical source archives on Windows and Linux.
• Canonicalize generated wheel and source-distribution newlines, archive member
  order, modes, timestamps, and ownership. Rebuild wheel RECORD after normalization
  and use compression-independent ZIP members plus a stable USTAR/gzip container.
• Normalize common HTTPS and SSH spellings of the Git origin before recording the
  public repository coordinate in a release manifest.
• Require CI to build the complete release artifact set independently on Windows and
  Linux and fail the conformance gate unless every resulting byte is identical.
• Record that v1.1.2 remained a signed, tested, and attested GitHub-only release:
  its protected PyPI deployment was cancelled after cross-platform build differences
  were detected, before any Python distribution was uploaded.