Secure ENV 0.8.2

Secure ENV 0.8.2

Requires Hermes 0.21.7 or newer, Python 3.11+, and Linux/POSIX. Verified with Hermes 0.21.7 and 0.22.0. Older Hermes installations must stay on their compatible plugin line; this release does not migrate a running installation.

Changes

• Adds explicitly authorized, retained-target code policies, including ordered/indexed code groups and synthetic coverage up to 100 fields. Segmented fields no longer require a site-specific maxlength=1 convention. Legacy OTP admission remains separate.
• Improves passwordless/email-verification recognition while preserving credential, card, ambiguity, membership, navigation and original-target guards. Includes controlled tests using public React/Privy input-handler fixtures with license/provenance notices.
• Uses one frozen Unicode 14.0.0 policy in the server and HTTPS client. Validation does not depend on the browser or Python Unicode database version. Invalid or missing policy refuses; multiline permission remains explicit.
• Adds explicit exact-card policy/lifecycle protections and safe fill diagnostics without logging submitted secrets.
• Reduces proof-read handoff overhead with four bounded readers and ordered owner, guard and census phases. A document census cannot overtake its guard. Focus and writes remain outside these batches. Original captured-transport deadlines, cancellation, consent and per-write validation remain enforced; authorization TTLs are unchanged.
• Preserves the public captured-CDP transport and the collision-free plugin tool name secure_env_vault. Hermes' native Vault tools remain separate. There is no private-transport fallback or automatic recapture after connection replacement.

Verification

The exact attached wheel passed 103 tests, 0 failures, 1 inapplicable-case skip on each host (Hermes 0.21.7 and 0.22.0; nine installed-wheel test files per host, serial execution, no file retries). These include registered synthetic HTTPS code fills, 100-field scenarios, Unicode handling, original-wire authority and guard ordering.

All 39 packaged payload files match the reviewed source and isolated installation. Independent delta reviews approved the frozen Unicode contract and the corrected guard-before-census ordering. These are scoped final-wheel checks following earlier source-suite and correction runs, not a claim that the entire suite was rerun once from scratch. Synthetic tests do not establish compatibility with every website or screen reader.

Installation notes

The main branch remains unchanged; this release is tagged from migrate/public-capture. Use the v0.8.2 tag or the attached wheel for this version, not an unpinned default-branch checkout. Existing Hermes catalog installations use their separately reviewed SHA pin and are not automatically updated by this release.

Installation does not configure TLS, owner authorization, enable the plugin or restart the gateway. Follow the versioned README and retain a backup before any operator-approved deployment. Never enter secrets in chat.

The attached wheel and reviewed source snapshot have checksums in SHA256SUMS.