Guard 0.19.0

Guard 0.19.0

Guard 0.19.0 supports governed repository file creation and modification at the
catalog-3 execution boundary. Runtime requirements include
governance-ledger>=0.9.0,<0.10.0; Ledger's Guard extra requires
waveframe-guard>=0.19.0,<0.20.0.

GitHub publication is complete. PyPI upload and both public installation gates
are pending Shawn's interactive upload and the attached public verifier.

Source and selected distributions

Integrated in the authorized order with merge commits; reviewed identities and
branches are preserved:

PR	Merge commit
#45	346294893bf1fe85260c5771b3288542cec4846b
#47	b57dac680e5d01c949921b703c364bb8bfc67f95
#49	96626f1adb68b50a05266c961fa7a8c9a2f9122a
#51	3896457b7df05d4c9008b440ac4082cc7e799299
#53	599c132038f66b5f15b47752505f0ed1aae1d641

• Original build source: afe5093e39bdd132bfb4da2a45e3199f1f6eca16.
• Final v0.19.0 tag source: 599c132038f66b5f15b47752505f0ed1aae1d641.
• Both Git trees: 9013bf553547c0d33cbec611f958102b80061a69; exact tree equality verified.
• The original selected distributions are attached unchanged. Integration-CI
  builds are validation artifacts and are not publication inputs.

File	SHA-256
waveframe_guard-0.19.0-py3-none-any.whl	e734836af5780fff7f834e2904c67f88a1d3a5ef1b47a2e8fc2f4e07f3dbb42f
waveframe_guard-0.19.0.tar.gz	e4230ad2ca9d6f01a24ac5c2e74064079fff531bb981682960143cdf767f19e3

Completed validation

• All seven final integrated Guard validation jobs
  pass, including source suites, package acceptance, and repository integrity.
• Selected hashes, strict Twine metadata, wheel/sdist source correspondence,
  exact build-input hashes and final tree identity pass.
• A fresh external Windows/Python 3.14 selected-archive run uses ordinary
  resolution against public Ledger 0.9.0 and Compiler 0.5.0. Installed stack
  bytes/origins, API, console/examples and pip checks pass.
• Public-compatible Guard suite: 576 passed / 157 expected skips, including
  all 149 public-compatible release cases. The extra six local skips are
  unavailable Windows symlink privileges; all reasons are recorded.
• Ledger combined default suite: 678 passed / 44 development opt-in skips;
  all 70 release cases execute.
• Both fresh entry environments execute the unchanged packaged 56-case
  catalog-3 create/modify/denial/collision/attestation/logical-replay probe.
• Upgrade from Guard 0.18 / Ledger 0.8 / Compiler 0.4 resolves the intended new
  stack, verifies installed bytes, repeats all 56 execution probes, and passes
  pip check. Ledger 0.7/0.8 resolver rejections retain genuine nonzero results.

One two-generation Guard test and two standalone producer entry points require
Git candidate provenance. They remain unchanged and are explicitly excluded
from public acceptance; the attached verifier checks real public origins and
bytes independently. The original reviewed candidate matrix
executes all 150 Guard release cases in every source/installed cell. No
candidate origin is forged, no runtime assertion is weakened, and no skipped
required execution is counted as success.

The initial local CRLF correspondence failure, the attempted Git-only provenance
test against public packages, and the pre-upload public-index 404 are retained
with their real failures. The first intermediate main-push CI was cancelled by
the existing concurrency policy; subsequent integrated checks passed. Historical
#51 Ledger failures remain preserved and were resolved by the reviewed #53
candidate set, not rewritten as successes.

Evidence and remaining gates

Attached: selected files, SHA256SUMS, original package-set.json, original
selected-evidence.zip, build/tag/source provenance, additive local and CI
evidence, authenticated support, upload script, and public verifier.

• Authorized release handoff
• Original final candidate evidence
• Original #51 mount proof and failure evidence

The selected #53 wheel was not newly mount-tested. #51's actual Linux mount
proof for wheel 2b78374416635ca551ee5470fcd1e9e390d3f08141a53c91bcba7d42516b046e
and #53's recorded runtime/190-build-input equivalence retain their original
scope. The retained 92-case Cloud #147 result is catalog-2 regression evidence,
not final public catalog-3 Cloud/Console acceptance.

Follow MANUAL-UPLOAD.md. After upload, verify-public.py must download both
actual PyPI Guard files and independently pass public Guard and public
governance-ledger[guard]==0.9.0 installation/execution. Until then both public
gates remain pending. Cloud release, deployment, activation and further
development are outside this release handoff.