AIIR v1.6.0

Install

pip install aiir==1.6.0

GitHub Action — uses: invariant-systems-ai/aiir@v1
Docker — docker run ghcr.io/invariant-systems-ai/aiir:1.6.0
GitLab CI/CD — Catalog component

What's Changed

🧩 Other Changes

• fix(vscode): restore browser button dispatch in pop-out panels by @InvariantSystems in #137
• ci: add contribution assessment gate and fix pulse intake by @InvariantSystems in #138
• ci: fix action-health Rekor bundle import path by @InvariantSystems in #139
• feat: add generic commitment receipts by @InvariantSystems in #141
• chore(deps): bump the actions-minor group with 3 updates by @dependabot[bot] in #145
• chore(deps): bump the actions-minor group with 3 updates by @dependabot[bot] in #148
• chore: refresh pip-audit lock for urllib3 by @InvariantSystems in #151
• Honor Sigstore sidecars during release verification by @InvariantSystems in #147
• test: sync website public surface contract by @InvariantSystems in #152
• fix: align public surfaces and add agent trace interop by @InvariantSystems in #150
• feat: add vendor-agnostic quantum workload provenance module by @InvariantSystems in #140
• feat: add research evidence verification workflows by @InvariantSystems in #143
• feat: centralize automation secret sync and public proof surfaces by @InvariantSystems in #144
• fix: harden VS Code webview panel command fallback by @InvariantSystems in #153
• chore(deps): bump the actions-minor group with 2 updates by @dependabot[bot] in #155
• chore: catch up AIIR maintenance backlog by @InvariantSystems in #160
• chore: clean up public AIIR surface drift by @InvariantSystems in #161
• docs: close branch cleanup follow-up by @InvariantSystems in #162
• docs: record website metrics remediation by @InvariantSystems in #163
• chore(sync): reconcile GitLab mirror hygiene by @InvariantSystems in #164
• chore(sync): respect protected GitLab main by @InvariantSystems in #166
• chore(release): 1.6.0 — GitLab AI provenance evidence pack by @InvariantSystems in #167

Full Changelog: v1.5.1...v1.6.0

Provenance & Verification

Artifact	SHA-256	Rekor log index	Provenance
aiir-1.6.0-py3-none-any.whl	sha256:c1714ce3e83ade88f70162609e540c926c3a9c1ff758e920e9260bb20f22b54a	1730301092	PyPI attestation · GitHub bundle
aiir-1.6.0.tar.gz	sha256:8d26f0b99f24e37ce66b2a46781aa142d694746b5f48eee75b8de254cf42c658	1730301540	PyPI attestation · GitHub bundle
aiir-sbom.cdx.json	sha256:e0171afd2447618f3a1cf9cb8b725684a058c707a14d70013dd8a40095bbb035	-	GitHub release asset

# Verify the published release evidence for aiir==1.6.0
python scripts/verify-release-evidence.py 1.6.0