Added
-
RFC 3161 anchor verification now accepts repeatable, operator-supplied CRL
and OCSP files alongside pinned TSA roots. The offline verifier checks fresh
validity windows, CRL/OCSP signatures, RFC 10007 cRLSign authority, RFC 6960
responder delegation, and complete non-root path coverage. It applies RFC
3161 reason semantics: normal retirement preserves tokens generated before
revocation, while a missing reason or key compromise invalidates every token.
Indirect/delta CRLs, stale or incomplete evidence, unknown status, and
revocation evidence without a pinned path all fail closed. -
Language-native API documentation is now generated and published for the
maintained TypeScript, Rust, Go, Julia, Lean, and Protobuf surfaces. The
documentation workflow runs each ecosystem's native renderer or checker and
assembles the outputs into the MkDocs/Pages site. -
A bounded daily PyPI download-history job records only the
director-ai
series on a dedicatedmetricsbranch. The writer constrains its remote
endpoint, response size, JSON shape, retry window, CSV schema, and writable
path before publishing a snapshot.
Changed
- GitHub Actions and hash-pinned CI dependencies were refreshed to their
current security-maintained releases without weakening the existing audit,
typing, documentation, or release gates.
Fixed
-
Core releases now build the wheel and source distribution exactly once in
publish.yml. The same checksum-verified artefacts are signed, attested,
published to PyPI, and attached to the GitHub Release alongside their SBOM,
Sigstore bundles, and SHA-256 manifest.release.ymlcreates metadata only,
and release attachment refuses to overwrite an existing same-name asset. -
Documentation publication now pins the supported artifact action and
installs Protobuf tooling through a bounded, checksum-verified bootstrap. -
Timestamp-revocation tests now register fixtures deterministically and use a
stable OCSP evidence clock across the complete multi-version test suite.