0.18.0 — published to PyPI

surfaceplate 0.18.0 is on PyPI: https://pypi.org/project/surfaceplate/0.18.0/

pip install surfaceplate==0.18.0
pip install 'surfaceplate[adopt]==0.18.0'   # the adoption wizard

Published from commit a345f2b by run 34633838735, which refuses to run on a push or a tag and uploads only after a named human approves the pypi environment. Self-check for that commit: run 34633040724.

This release is not approved, independently validated, or audited by being published. org/decisions/README.md records that no independent validator exists for this repository. Establishing one is what the packet below is for.

Artefacts

File	sha256
INDEPENDENT_REVIEW_PACKET-0.18.0.html	2cbdd97b510551009d8ea2fce7c4dcb3b9f54249ba165a1407c2a5f623496ba6
surfaceplate-0.18.0.zip	bda9442b4808880ff6090e93ace39d67b6bd7ef8f067cf8dff38950142cb428a
PyPI sdist surfaceplate-0.18.0.tar.gz	6bdcacc9b8f815550131dba09b17a293b2696237ae191f833bf607bca1445125
PyPI wheel surfaceplate-0.18.0-py3-none-any.whl	7de54c0f96dc4555405f71ff8d83074845a44921384c9f7747374eb4e6d3f96d

A checksum proves integrity. It never proves authenticity or the absence of malicious content.

What the packet asks for

Two parts, and they need different things from a reviewer.

Part A — F6. Every integrity anchor in this project sits inside the boundary it checks, so the framework cannot verify its own digest. Closing it needs someone who is not the maintainer and who can execute — recomputing the manifest anchor independently and reporting what they got. A reviewer who can only read cannot close it, and the first cross-provider review said so, correctly.

Part B — the independent audit, which is the last item before 1.0.

F6 remains open in org/FINDINGS.md and will stay open until a recomputation is returned, recorded under governance/assurance/, and names a reviewer who is not the maintainer.

Supported Pythons

3.10, 3.11, 3.12 and 3.13 — each installed and exercised in CI on every push. 3.9 is not supported and the metadata now says so: jsonschema==4.26.0 requires >=3.10, so requires-python = ">=3.9" had never been true (F163).

0.16.1 — independent review packet

Independent review packet — 0.16.1

No independent reviewer has looked at Surfaceplate yet. Every finding on record so far was found
by the same party who maintains it — stated plainly in org/FINDINGS.md's own closing section, not hidden.

This release attaches a self-contained review packet for the published 0.16.1 commit
(3231f3a8851cbdfa663f02bec94022ead85c73a0), tagged pypi/0.16.1. It splits into two independent
asks:

• Part A (~30 minutes, no context needed): recompute one SHA-256 from the published PyPI
  package and check it against the framework anchor this project publishes. Two independent ways
  to reach the same number are given, so nothing needs to be taken on trust.
• Part B (a few hours, wants judgement): a scoped audit against
  audit/AUDIT_SCOPE.md's
  ten criteria, with a stated time-boxed minimum and an explicit claim-labelling convention
  (FACT FROM PACKAGE / INFERENCE / RECOMMENDATION / EVIDENCE GAP) — "I could not establish
  this" is a legitimate answer.

Assets

File	SHA-256
INDEPENDENT_REVIEW_PACKET-0.16.1.html	59bd0a33352d5b079a2d6888bebc302886363fa482218a15457d8e2339760daa
surfaceplate-0.16.1.zip	b097ca5c84d790590f41fab85e96a2f2fff2119d7cf5a0acf46d1dabc86c95df

SHA256SUMS is attached alongside them. Verify what you downloaded before you read it:

sha256sum -c SHA256SUMS

Either return — Part A or Part B — is recorded as a named, dated assurance record under
governance/assurance/, never folded silently into "validated."
org/decisions/DR-64.md
states exactly what closes F6, this framework's oldest open finding.

This release exists to distribute the review packet, not to change the install route. Every
instruction still names the git form until 1.0 — see
org/decisions/DR-61.md.