v0.22.0

Pitloom 0.22.0 changes how the ID registry works and how Pitloom talks to its users and AI skills.

• Breaking: a registry now keys each package by name and version, so every release gets its own id; a version 3 registry is refused (regenerate it with loom id generate or loom id import). A missing magika or build now raises ImportError.
• Catalogued messages end in a stable [code], with a generated reference that the skills read.
• Also new: Git LFS pointers are listed by their oid with one warning, the size ceilings have flags, and loom records a dataset's byte size.
• Fixed: direct-URL dependencies are no longer looked up on PyPI by name (to prevent possible mismatches), non-UTF-8 file names no longer crash generation, and warnings no longer print absolute paths.

We expect 0.23.0 (mid-November tentative) to adopt new LicenseID 0.7.0 (to be released) which will offer better license expression resolution.

Install for CLI/Python API:

pip install -U pitloom

Install for AI coding assistant:

See the website on how to install Pitloom AI skills and the Claude Code plugin.
Try asking the AI agent to "generate SBOM for this project".

Report issues: https://github.com/bact/pitloom/issues

What's changed

• embed-wheel --sbom refuses an unreadable SBOM by @bact in #374
• Write a Git URL's temp checkout as by @bact in #375
• Read model licences from Safetensors and GGUF names by @bact in #376
• Split licence tests; add py-spdx-license drift guard by @bact in #377
• Handle Git LFS pointers: record oid, warn once per SBOM by @bact in #378
• Message catalogue design by @bact in #379
• Add lessons and paper notes since 0.21.1 by @bact in #380
• Add flags for the model and dataset size ceilings by @bact in #381
• Design evidence levels for recorded facts by @bact in #383
• Stop writing a Croissant item count as a dataset size by @bact in #382
• Shrink skills to 16 KB and add a pointer test by @bact in #385
• Drop absent-value provenance when a merge fills the value by @bact in #386
• Record dataset byte size and say why a hash is missing by @bact in #387
• Skills: prepare the licence database before the first run by @bact in #392
• Sanitise names in provenance via shared helpers by @bact in #389
• Add the Fact value type and one precedence rule for evidence by @bact in #391
• Add message catalogue plumbing and lfs-pointer codes by @bact in #390
• Move URL masking out of logging; document trusted-line limit by @bact in #395
• Catalogue the over-cap family and move Cap into messages by @bact in #396
• Cap licenseid below 0.7 until the 0.7 adoption by @bact in #401
• Fix non-UTF-8 file names and free text read as keys by @bact in #402
• Say with a code why an AI model was not read by @bact in #404
• Stop looking up direct-URL dependencies on PyPI by @bact in #405
• Run the slow checks at two gates per PR, not every round by @bact in #406
• Code unreadable files and unlistable directories by @bact in #408
• Give each release of a package its own registry id by @bact in #407
• Name archives by file name in over-cap warnings by @bact in #410
• Release 0.22.0 by @bact in #411

Full Changelog: v0.21.1...v0.22.0