sum-engine 0.11.0

Superseded by 0.12.0. 0.11.0 was never published to PyPI: its publish run expired unapproved on 2026-10-16. This tag carries the HMAC downgrade defect (H1) that 0.12.0 fixes; see the Security entry in the 0.12.0 section of CHANGELOG.md. Install sum-engine==0.12.0.

This section describes source and prepared package changes. GitHub merge, Worker deployment and PyPI publication are separate release steps; the published version is recorded by the repository manifest.

• Completed a retained-source browser review flow: compare an existing rewrite, inspect linked passages, record decisions, and export/import exact review packets. Generated output enters the same flow. Browser comparison is literal and advisory; source and human decisions remain unsigned. Receipt verification now checks displayed output, selected triples and slider bindings. Input/settings/review changes suppress stale extraction, rendering, verification and export results. Density is applied once. Conservative extraction fallback preserves complete source spans. Added labels, live status and reduced-motion support.

• Corrected provider-funded quota classification (#499). Added bounded streamed requests, validated triples/sliders, configured operator models, provider deadlines and SQLite Durable Object admission: per-IP and global attempt limits plus leased concurrency. Missing paid-admission infrastructure fails closed; canonical routes remain available. Admission limits attempts rather than invoiced dollars; account-level provider spending controls remain separate. New binding/migration is part of Worker deployment.

• Added explicit offline SDK TrustPolicy and reports (SDK API 1.2.0), with trusted key-ID/material catalogs, immutable revocation snapshots, revoked-key alias handling, freshness versus archival checks and independently supplied artifact bindings. Legacy default verification APIs and historical receipt bytes remain compatible. Policy does not authenticate an organization, validate sampling, or automatically validate every chain hop; callers apply per-hop policy when required. Added low-level transform revocation parity.

• Made bound agent values immutable snapshots; rejected oversized values before eviction. Compatibility: text handles keep their legacy namespace; JSON and byte values use typed v2 handles and must be rebound. There is no ambiguous cross-type legacy alias. MCP extraction now returns a setup error rather than installing a missing model over the network. Chunking retains complete sentences within explicit model/resource caps and rejects unresolved overlong input instead of silently splitting it. make install now matches full test dependencies; install-verify stays lightweight.

• Unified scalar/readout scoring for empty-source cases. New research receipts default to descriptive scope; a population confidence interpretation requires an issuer-asserted independent sampling contract with a fixed policy and distribution match. Added canonical scorer configuration and ordered source/output manifests, hash checks and NLI token-window inspection metadata. These identify evidence; they do not rederive a model's scores or prove meaning preservation.

• Retired T4's composition-invariance inference. Corrected post-processing of the stored observations shows six worsening endpoint pairs across 86 documents despite unchanged corpus medians. The v2 descriptive artifact, paired rows and erratum are committed. All historical signed JSON remains unchanged, with explicit archival regeneration adapters. Candidate paths no longer imply Pareto optimality or monotone quality. Human validation and production-generation benchmarks remain open.

• Replaced the broken extension/research API client with explicit local capture, copy and a separate workbench link. Chrome, Edge and Firefox development packages are generated from one source; no background collection or text-bearing network calls. Store publication and actual per-browser load testing are separate work. Terminal UI now says Not measured until a historical demo is replayed and discards late results after edits; its unwired action is labelled CLI instructions. Docker remains an unvalidated internal research recipe.

• Added a declared product-surface manifest and refreshed the existing product vision/playbook. Wired Worker admission/input, browser packet/DOM, extension-generation and TUI-state regressions into CI, and extended the deployed-asset byte guard. Unicode codepoint ordering now matches Python for supplementary characters in signed bindings and density selection.

• Gate 0 of the 2026-09-02 first-principles audit, closed (#474 to #478).
  The audit found that the shipped verifier is about 2,832 lines of a ~130K
  line repository, that 18 of 23 enhancement proposals fail the project's own
  buyer-or-dream filter because no adopter exists to pull them, and that what
  survives is defect repair on stranger-facing surfaces, honesty corrections
  with receipts, and distribution acts. These five PRs are the first two
  classes. Nothing here adds capability.

  • The per-PR test job never ran the shipped SDK's tests (#478). It
    installed only requirements-prod.txt, which carries no joserfc, mcp,
    or hypothesis; 17 test files (574 tests after parametrization, the
    [verify] SDK suite among them) importorskip'd away and the job stayed
    green at 2,330 collected against 2,904 locally. CI now installs
    .[verify,mcp,dev], a conftest guard reds any whole-tree CI run that
    would under-collect (keyed on the CI env var so it cannot be switched
    off by editing the step that regressed), and [verify] joins the wheel
    smoke matrix with a no-numpy/scipy/torch assertion. Proven in a fresh
    production-floor venv: guard fires (exit 4), then 2,794 collected.
  • Worker and Python kept different triples at density < 1 (#475). The
    Worker sorted axiom keys with ICU localeCompare; Python sorts by
    codepoint. The kept prefix differs, and it is hashed into the signed
    tome_hash. Codepoint sort in the Worker; a Python-generated fixture
    asserted by both runtimes (npm run test:density, in CI). Fails 5 of 9
    checks against the old comparator.
  • Issuer and verifier used different mean kernels (#476). numpy
    pairwise mean versus the SDK's fsum; point_estimate_micro could land
    either side of a round-half-even tie on even-n inputs (the bound never
    diverged). The issuer now uses the SDK kernel; a brute-force test over
    the micro grid asserts the seam exists and is closed.
  • Node verifier passed unparseable keys (#477). Every throw inside
    verifyEd25519 became unsupported, rendered as a green PASS with a
    false "Node lacks Ed25519" excuse. Five statuses with one meaning each;
    malformed fails closed; genuine unsupported exits 5, "could not
    verify", so scripts can tell it from both pass and fail. Adversarial
    case A8; harness now 8 of 8.
  • Honesty pass over eleven surfaces measured false at source (#474).
    The retracted rho range still printed by five executable surfaces in
    0.10.0; PyPI summary and sum --help describing the pre-receipt
    product; a dead example host in the CLI; the paper's artifact statement
    naming the wrong Node verifier; the proxy's unit disclosed as a
    punctuation-or-newline segment rather than a sentence; two incompatible
    definitions of "Stage B"; three stale facts in CLAUDE.md; a scope stamp
    on the render-frontier vision; ShareableRender marked library-only; the
    README curl block now verifies the receipt it fetches; the duplicate
    [0.6.0] heading relabelled so the release mirror sees one section per
    version.

• Correction to the 0.10.0 notes, and the actual fix (#473). The 0.10.0
  entry credited #443 with fixing meaning_diff. It did not. #443 removed an
  AttributeError; the very next line called list() on
  MeaningReadout.source_claims, which the dataclass declares int, so every
  real call still died with TypeError behind error_class: internal, after
  paying the full judge cost. The regression pin could not fire because its
  hand-typed stub passed tuples for those int fields, a shape the real judge
  never produces. Re-found by the 2026-09-02 audit by reading both halves.
  Fix: wire the two count fields as the ints they are. Guard: the pin now
  builds its readout through the real explain_meaning_loss with a
  deterministic containment judge, so it can only carry production's types,
  and a new test pins those types against the dataclass annotations.
  Confirmed to reproduce the exact production failure on the unfixed tool.

• Node verifier exit code carried the structural verdict, not the Ed25519
  one (#472). standalone_verifier/verify.js printed FAILED and exited 0 on
  a bundle with intact content and a forged signature. A Critical from the
  2026-08-28 audit that was never fixed; the file had not been touched since
  April. Fixed by returning overallMatch; guarded by adversarial case A7
  (signature-only tamper), which fails on the unfixed file and runs in
  per-PR CI.