pq-verify v2.8.1

Fixed

• --audit-kem with an unknown parameter set exited 1. A typo such as
  ML-KEM-999 raised a traceback and exited 1, which a CI gate reads as
  "this library has findings". It now names the valid sets and exits 2, like
  every other input error.

• --audit-so named the wrong parameter set. An NTT is shared by every
  parameter set of its scheme, but the scan labelled every ML-KEM NTT
  "ML-KEM-1024" and every ML-DSA NTT "ML-DSA-87", including a 768 or 65
  library's. It now reports ML-KEM-512/768/1024 / ML-DSA-44/65/87.

• ACVP prompts cited every pinned NIST commit. An ML-KEM prompt's
  vectorSource listed the ML-DSA and SLH-DSA commits too; it now cites only
  the suites it was built from.

• Install hints no longer advise --break-system-packages. They point to
  pip install "pq-verify[full]".

• The CLI printed the integrity verdict twice after a self-suite run; it now
  prints once and still applies --require-full-coverage.

• --audit-kem bound the wrong function on mlkem-native. Symbols were
  picked by substring, taking the first name containing keypair and
  derand. On mlkem-native that is the internal indcpa_keypair_derand, so
  a correct, formally verified library was reported as FINDINGS PRESENT
  (35/60). Its decaps (_dec, not kem_dec) was not found at all, so from
  the CLI it could not be audited. Symbols are now matched by exact suffix
  across PQClean, mlkem-native and liboqs naming, internal K-PKE routines are
  excluded, a library exporting several parameter sets resolves to the one
  asked for, and an ambiguous match is refused instead of guessed.

• Pinned NIST vectors re-cut to NIST's corrected files. The bundle shipped
  two files from before NIST fixed them:

  Files	Was	Now	NIST's fix
  ML-KEM-encapDecap-FIPS203 (3)	c924096	ad33b3d	"corrects ML-KEM encapDecap tests that included ek that were longer than intended"
  ML-DSA-sigVer-FIPS204 (2)	2972def	a7f283c	"corrects ML-DSA sigVer FIPS204 sample json files for issue with ModifyZ disposition"

  In the old encapDecap file every invalid encapsulation key was 416 bytes
  over length, so it was rejected on length alone and the FIPS 203 §7.2
  modulus check never saw an invalid key. A checker with no modulus check
  scored 30/30 on it; on the corrected vectors it scores 15/30. pq-verify's
  own checks agree with all 60 key-check labels in the corrected file. Counts
  are unchanged: ML-KEM 240/240, ML-DSA 615/615, SLH-DSA 120/120, offline.

  ML-KEM and ML-DSA prompt IDs change (SLH-DSA's do not). A prompt from
  --emit-prompt under 2.8.0 for those sets was generated from the old
  questions. Re-issue it before verifying a response;
  2.8.0 still reproduces the old results.

• The NIST watcher now checks the shipped bundle. It compared upstream only
  to its own baseline. The baseline was advanced to NIST's fixes but the bundle
  was not, so every weekly run reported "no change". It now also compares
  upstream to MANIFEST.json and reports files the bundle lags, and it adds to
  one open issue instead of opening a new one each week.

Added

• --audit-kem negative testing. The audit now feeds the library NIST's
  invalid keys: ekCheck (5 encapsulation keys with a coefficient ≥ q,
  FIPS 203 §7.2) and dkCheck (5 decapsulation keys with a corrupted H(ek),
  §7.3). Each must be refused with a nonzero return while the valid ones are
  accepted. A full audit is now 80 checks. mlkem-native passes 80/80 at all
  three parameter sets; PQClean's clean ML-KEM accepts all ten invalid
  keys (70/80): its API has no rejection path, so the check falls to every
  caller. Details in AUDITS.md.
• --kem-keypair / --kem-encaps / --kem-decaps name the entry points
  when auto-detection finds none or several.
• Reports name the vector revision, e.g. vectors: pinned (NIST ACVP-Server ad33b3d), and ACVP / --audit-kem results carry it as vectors.
  MANIFEST.json records each file's NIST commit and now covers the two
  SLH-DSA files it omitted.
• Tests: every bundled key-check key has its parameter set's exact length
  (fails on the old bundle), the manifest covers the whole bundle, and the
  watcher flags a lagging bundle.

---

Verifying this release

gh attestation verify pq_verify-2.8.1-py3-none-any.whl \
   --repo bigDSanalyst/pq-verify

Built by .github/workflows/release.yml from commit ceed826761bf5ae1bcc47a54690751fa6d647c4f,
after the full suite and all 855 NIST ACVP vectors passed on Python 3.9 through 3.13.
An SPDX SBOM is attached and attested.