GOVP 0.1.13

What's Changed

• Activate the production GOVP gate extension by @enekosz in #25
• Add static GOVP publication workflow by @enekosz in #26

Full Changelog: v0.1.12...v0.1.13

GOVP 0.1.12

What's Changed

• Update public references for GOVP 0.1.11 by @enekosz in #21
• Add GOVP-EXT-1 evidence envelopes by @enekosz in #24

Full Changelog: v0.1.11...v0.1.12

GOVP 0.1.11

What's Changed

• Retry immutable release attestation verification by @enekosz in #16
• Document JavaScript verifier 0.1.1 by @enekosz in #17
• Document npm JavaScript verifier by @enekosz in #18
• Document the published JavaScript verifier by @enekosz in #19
• Security: harden status and Ed25519 verification by @enekosz in #20

Full Changelog: v0.1.10...v0.1.11

GOVP 0.1.10

What's Changed

• Fix immutable release validation by @enekosz in #13
• Fix PyPI release version validation by @enekosz in #14
• Stabilize GOVP 0.1.10 status and issuance by @enekosz in #15

Full Changelog: v0.1.9...v0.1.10

GOVP 0.1.9

What's Changed

• Make GOVP adoption developer-first by @enekosz in #6
• Harden immutable release publishing by @enekosz in #8
• Add canonical GOVP visual identity by @enekosz in #9
• Add broken artifact verification demo by @enekosz in #10
• Stabilize GOVP 0.1.9 distribution by @enekosz in #11

Full Changelog: v0.1.8...v0.1.9

GOVP 0.1.8 — first stable public protocol release

GOVP 0.1.8 — first stable public protocol release

Sign once. Verify anywhere.

GOVP is an open protocol for portable, independently verifiable digital
artifacts. A GOVP record binds an artifact identity and SHA-256 digest to an
Ed25519 signature without requiring a GOVP account, central API or hosted
verification service.

Why this release matters

• freezes the GOVP-1 wire format and its byte-exact signing rules;
• ships the normative specification, JSON Schema and conformance vectors;
• provides the Python reference verifier and command-line interface;
• verifies locally and works without a central service;
• uses synthetic examples and contains no product, tenant or operational data;
• is licensed under Apache-2.0, with separate GOVP and Gemacode trademark
  boundaries.

Audited source

This release points to the exact clean-root commit reviewed for publication:

commit  c25516f471ed38f4b28a23b8eaa9af490a8f7f8b
tree    ea8f08bc83465edddf2707a25963becd9237d084
archive 501853028dd51ba37b67459690230f089b87dc3b6fd6e61e577aa79a32306f56

The independent AI-assisted re-audit result supplied by the project owner was
approved for publication for that exact archive digest. The review noted
two non-blocking operational points: privately issued 0.1.x records containing
raw non-ASCII URL text may require migration to URI-ASCII, and consumers
should bind provenance to the archive hash and source commit.

The developer-facing README and community files were improved after the audit
on main. They do not change the specification, schema or conformance
vectors. The release tag intentionally remains attached to the audited commit.

Install and verify

python -m venv .venv
. .venv/bin/activate
python -m pip install govp-0.1.8-py3-none-any.whl
govp self-test

Or install directly from the immutable tag:

pipx install git+https://github.com/govp-protocol/govp.git@v0.1.8
govp self-test

See VERIFY-RELEASE.md and RELEASE-MANIFEST-v0.1.8.json in the release
assets for provenance and exact verification commands.

Integrity

This is an immutable GitHub release. After publication, GitHub locks the tag
and assets and generates a cryptographically verifiable release attestation.

gh release verify v0.1.8 --repo govp-protocol/govp

GOVP proves that the declared key signed the exact record and, when artifact
bytes are supplied, that the digest matches. GOVP does not prove that a
statement is true or that an event occurred.