warrant 0.5.0

warrant 0.5.0

133 commits since v0.4.0. Two things define this release: a machine boundary a
CI system can consume, and — for the first time — release assets that make the
README's "no clone, no build, no account" quest actually true. Releases
v0.2.0–v0.4.0 carried zero assets, so the README's curl line 404'd; this one
ships the packs it promises.

The machine boundary: verify --store-mode --json

warrant verify --store-mode --json emits warrant.verify-report@v0 — a
closed schema (exactly seven top-level keys, exactly {level, subject, message}
per finding) with two guarantees a consumer may rely on: the errors/warnings
counts always bind the findings, and any future field ships under a new tag,
never inside @v0. Both implementations emit it; owner-side tests assert the
producer contract on every vector. This is the boundary the new GitHub Action
consumes.

Honesty note: 0.4.0 shipped while the README already documented this flag, so
pip install warrant-verify plus the README produced unrecognized arguments.
The fix is structural, not apologetic: tools/check_release_surface.py now
extracts every documented CLI invocation and validates it against the built
wheel, and the publish workflow fails if the artifact cannot do what the docs
say. That state is now unpublishable rather than merely regrettable.

Adoption surface

• GitHub Action (s0fractal/warrant@master, or pin this tag): installs the
  verifier from PyPI, verifies a store or evidence pack, fails the job on any
  error, writes a summary, and exposes ok / records / errors / warnings
  / the full report as outputs. It does a capability check, not a version
  check — and a review found the version input was being spliced into shell;
  that injection is closed.
• Release evidence packs: air-canada-pack.zip and cross-vendor-pack.zip
  (plus SHA256SUMS) are attached to this release. Built by
  tools/build_release_packs.sh, which refuses to ship anything key-shaped and
  verifies each zip the way a stranger will — unzipped, in an empty directory,
  with no repo on the path.
• in-toto bridge: express a decision as an in-toto Statement v1, with a
  tamper matrix — the format stops being an island.

Third implementation, and verifier hardening

• impl-rs now verifies stores, so three independent implementations
  (Python, Go, Rust) agree on what verifies and — checked against hostile
  stores — on what does not. The Rust Ed25519 is from scratch and was audited
  externally (two P0s found and fixed).
• Verifier fixes found by external gates: a blob could be swapped at its own
  address and both verifiers said ok (the fix covers all five content kinds);
  lone surrogates are rejected in both implementations (one I-JSON domain);
  policy/ski/json-blob paths no longer crash on hostile input; why's exit
  status now matches its honest output; a supplied keyring is no longer
  reported as absent. The BOM refusal is now named in the canon rather than
  incidental.

Settlement: a rule that can say when an argument is over

tools/settle.py under policies/gate-settlement.json: a gated item is
settled unless a reproduction executes — silence blocks nothing, and
blocking power belongs to re-runnable evidence, not to a signature. Built after
eight consecutive single-family review gates produced eight AMENDs and no
convergence, while a three-family gate found the P0s immediately. The rule is
itself gated (47 cases plus a randomized fuzzer), and its own gates found and
fixed defects in it — including a sort order that silently swallowed P0s.

Governance and record

• AGENTS.md: no direct-to-master, no self-declared roster authority — written
  after an agent did both.
• SECURITY.md and CITATION.cff: a project about provenance had no
  disclosure process; now it does.
• Prior-art record attested by parties that are not us; maintainer delegation
  written down as a bounded lease.
• EU AI Act Article 12 mapping (DRAFT, dated because it decays).
• WRT-002 key-state / lifecycle-authority design continues as a draft —
  eight revisions in, still design only, not adopted.
• tools/check.py: one command that runs every claim in the repository —
  currently 27 checks — and reports what it could not run.

Verify this release

pipx install warrant-verify
curl -LO https://github.com/s0fractal/warrant/releases/latest/download/air-canada-pack.zip
unzip air-canada-pack.zip
warrant --store air-canada-pack/.warrants verify
warrant --store air-canada-pack/.warrants check b423b6a82c3451bfbd75563b39e6391093a64db57941d9247a61a6c620bd997f

The last line re-executes the reason on your machine and prints
pass result=65cd957fee7e… atp_spent=17. You are not trusting a log; you are
recomputing the argument.