Beta 15: clearer authority review and safer integration examples

Beta 15: clearer authority review and safer integration examples

This release preserves the Python runtime API and dependency-free core while
improving scanner review coverage, remediation guidance and the installed-package
checks. It remains an early beta, not a claim of production readiness.

What changed

• Scanner report v6 includes per-argument remediation guidance: prefer keeping
  protected arguments out of the model-visible schema and injecting them from
  trusted application state; use exact trusted_args binding for compatibility.
  Uncertain protected arguments remain explicitly review-required, without an
  automatically selected remediation.
• A Markdown first-look section separates strong lock candidates, provisional
  review locks and data-fillable arguments. It does not change runtime policy.
• Nested argument property maps retain schema-review debt. Both scanner and
  Authority Diff review thresholds now expose these previously clean-looking
  cases; outer-argument policy and runtime behavior are unchanged.
• Integration demos use exact JSON type/value and explicit trusted-key checks,
  and restrict the model-selected read example to a trusted public catalog.
  These corrections align examples with checks already present in the runtime.
• Development installs include the build backend needed by archive tests.
• Larry Peseckis's frozen synthetic tuple-boundary evidence is preserved with
  explicit historical limitations and 16 separate maintainer regressions. It
  establishes no payment execution, business authorization or adoption claim.

Compatibility

Beta 14 emitted report v5; Beta 15 emits v6. Consumers requiring exactly v5 must
update. Authority Diff continues to accept complete v4/v5 reports for
observational comparisons. Enforcement thresholds should rescan raw schemas,
not trust imported reports as runtime policy. --fail-on-review can now exit 2
for nested schemas that previously appeared clean.

No TypeScript/npm runtime, automatic schema-projection API, deployment system,
or expanded runtime security guarantee is included.

Installation and artifact checks

Published on PyPI on
September 7, 2026. Install the exact beta:

python -m pip install "verb-authority==0.10.0b15"
python -I -m verb_authority quickstart

The quickstart uses a local mock tool, not an email service: altered recipient
and oversized body remain at 0 invocations; the independent trusted-value
control reaches 1. It does not exercise a real human-approval workflow.

Use the wheel, source archive and SHA256SUMS from this one release. Verify
the hashes before installing; do not mix files from different builds. The
TestPyPI-to-PyPI publication path reuses the same verified wheel and source
archive rather than rebuilding them between indexes.

Publication verification completed successfully:

• Exact tagged source: 431769ec6238d29743a99c1f93b09ebbd4a34b73.
• Release build and fresh-runner artifact verification.
• TestPyPI and PyPI downloaded-file hash and installed-quickstart checks.

These are release-engineering checks, not independent adoption or production
validation.

As always, the application must supply the trusted values independently of the
model and route relevant calls through the gate. Per-argument authority is not
a substitute for application identity, business rules or complete agent security.