Source Read v0.2.0

Source Read v0.2.0 adds a safer truthfulness API and a reviewed source-only release pipeline.

Highlights:

• Adds assess_check() plus is_pass, is_fail, and is_unknown outcome predicates while preserving the lower-level compatibility contract.
• Makes unreadable or absent required sources explicit UNKNOWN outcomes instead of allowing accidental success.
• Hardens deterministic source-archive creation against links, hardlinks, reparse points, path aliases, mixed snapshots, partial writes, and hidden ZIP extents.
• Adds hash-locked, no-index double wheel builds, exact package metadata and RECORD validation, raw local/central/EOCD and DEFLATE-envelope checks, and an isolated runtime install.
• Expands the protected CI matrix to Python 3.11-3.14 on Linux plus Windows 3.11/3.14 and macOS 3.14.

Release identity:

• Provider-verified target commit: 66b631729fcfacc7a914bdcfdb5f9811d901d61f
• Reviewed tree: 6f37e76b5aa6aba7ba1fab7fb5bc6f2d1a9ca5c4
• Annotated tag object: d1fd523a80e3c975311d97afb5e1c9d923558089
• Source asset SHA-256: 6cee0ef1816d992a4b6cd5ee9414d3e280495e263011f5e1aae3af946a49a30c
• Review and authorization record: PR #3
• Candidate CI: 40825666960
• Candidate CodeQL: 40825661967
• Post-merge CI: 40826380169
• Post-merge CodeQL: 40826379751

The annotated tag is unsigned because no reviewed maintainer signing key is configured. Compensating controls are the provider-verified target commit, protected non-movable v* tag rules with no bypass actor, immutable GitHub Release, and GitHub's signed release-asset attestation.

This release contains only source-read-0.2.0.zip. Wheels remain validation artifacts; no PyPI or other package-registry publication was performed.

Verify the asset after download:

sha256: 6cee0ef1816d992a4b6cd5ee9414d3e280495e263011f5e1aae3af946a49a30c
gh release verify-asset v0.2.0 source-read-0.2.0.zip --repo nymrel/source-read
python scripts/verify_release.py --archive source-read-0.2.0.zip

Source Read v0.1.0

Source Read helps Python callers represent source-read outcomes without confusing an unreadable source with a successful empty result.

What it provides

• SourceRead.ok(...) and SourceRead.unreadable(...) records
• single-consumption assessment of supplied iterables
• a reserved UNKNOWN verdict and exit code 2 for unreadable or disallowed zero-source assessments
• a clear distinction between a readable empty value and no supplied source records
• safe-by-default representations and generic problem summaries
• explicit detailed diagnostics with control-character escaping
• standard-library-only runtime support for Python 3.11 through 3.14

Security and scope

Source Read is a truthfulness helper, not authentication, authorization, source-integrity verification, access control, or policy enforcement. Callers remain responsible for identifying required sources, reporting read failures honestly, and acting on the returned verdict.

The source-release tooling rejects links, reparse points, non-regular files, file-identity changes, and noncanonical ZIP bytes. Independent source review, the supported Python CI matrix, dependency analysis, and CodeQL passed for this release.

Release format

This is a source-only MIT release. The protected annotated v0.1.0 tag points to commit 51ba075b2a956785e45f236db383526979e31922.

No PyPI or other package-registry artifact is published. The attached source-read-0.1.0.zip is the separately validated deterministic source archive with SHA-256:

51b01355e544ebcad7dd9ef933c6c45924987215cc83a755c0ca10e433556e5b

That digest applies to the named attachment, not GitHub's automatically generated Source code archives.

• Release review: #1
• Tag CI: https://github.com/nymrel/source-read/actions/runs/40814314253
• Documentation and source: https://github.com/nymrel/source-read