zeocore 0.37.0

A signing manifest can take its digests from a reviewed build inventory instead of having them written into release.yaml for every release. With pins: inventory in the signing section the manifest keeps the reviewed structure only, and the digests come from a zeo.build-inventory/v1 file that goes through an ordinary pull request (release/inventory/<version>.json). The inventory names its release version, and its path is always release/inventory/<version>.json. The signing service admits it only when the commit is merged to the default branch, holds exactly those bytes at that path, the pull request that produced the commit added or changed that very file, and the latest council/approve status on the commit was created by the adopted approver (otherwise inventory_unreviewed, or review_unreadable when GitHub cannot be read). zeocore release sign, verify, receive and pack take an optional inventory (and pack an inventory_path and version); a request without them is unchanged byte for byte. A refusing port, zeo_core.release.signing.event_auth, is added for authenticating the release event after the seal: it checks that the seal verified and that the event is the unchanged canonical document, and then always holds, because no mechanism for a JSON payload is adopted. Files read from GitHub are bounded, and a repeated key in an inventory or an event is refused. Manifests that pin their own digests are not affected.

What's Changed

• signing: digests from a reviewed build inventory; a refusing port for the release event (SOW-44 rev 2) by @matorclawson in #185

Full Changelog: v0.36.9...v0.37.0

zeocore 0.36.9

PublicSourceHTTP serialises requests per host instead of globally. Before, one lock was held for the
whole of every request, including the one-request-per-second pacing wait, so a read from one source
(say the flight source waiting out its pacing) kept every other source (weather, exchange rates) from
starting. Now each host has its own lock: the same host still never has two requests in flight, and its
pacing, its 60 s cache and its 20-requests-per-10-minutes budget are unchanged, but different hosts run at
the same time. The refused-request counter is still exact under many threads.

What's Changed

• briefing_sources: one request at a time per host, not globally (sow: zeocore-SOW-43) by @matorclawson in #177

Full Changelog: v0.36.8...v0.36.9

zeocore 0.36.8

contracts/ now holds only zeocore's own published schemas (contracts/zeocore-v1/). The three
interoperability fixture sets that were vendored there (broker-1.4, merger-v1, runtime-host-v1) are
test data, so they moved to tests/fixtures/. Their repository names are example names, and each
SOURCE.txt is one neutral line. No installed code changes. The Broker 1.4.0 digest vectors changed
because the repository name is part of the digested request: github.pr.open is now
e721996e4649… (445 canonical bytes). Copies vendored elsewhere keep their old values and are not required to change.

The release-on-merge component can now serve repositories that are not Python packages on PyPI. The version script is a file, .github/release/plan.py, that a runner outside GitHub Actions can run as it stands (the workflow keeps an identical inline copy, and a test fails if they differ). It takes a tag namespace (tag_prefix, default v) and an index setting (index, default PyPI, or none), and it prints the tag it computed. Each GitHub Release now carries a release-event.json (schema zeo.release-event/v1) that names the version, tag, commit, tree, the notes' digest and every released file's digest, and ends with a digest of itself. .github/release/README.md lists the executor's files, its options and how a private repository runs it. Nothing changes for zeocore's own releases. Tests also pin that the component takes no version, commit or ref, and that only the docs site can be started by hand.

The release-metadata tests no longer inherit the CI runner's GITHUB_* variables. One of them, the check that a credential in the git remote is refused, failed on GitHub's runners (which set GITHUB_REPOSITORY) and stopped the release of the previous merge. Tests only; no change to what a release does.

What's Changed

• release component B: plan.py with tag namespace and no-index options; release event by @matorclawson in #182
• contracts: interoperability fixtures move to tests/fixtures, example names (PR-C) (sow: zeocore-SOW-43) by @matorclawson in #178
• release tests: never inherit the runner's GITHUB_* variables (fixes the #182 release run) by @matorclawson in #183

Full Changelog: v0.36.7...v0.36.8

zeocore 0.36.7

Tests now pin the shape of the release component: it takes only project, verify and build (never a version, commit or ref), its only trigger is workflow_call, no release workflow can be started by hand (only the docs site can), and its three executor files are listed in .github/release/README.md, which also shows how another repository calls the component unchanged. No behaviour changes.

What's Changed

• release component A: pin the shape, list the executor's files, document the unchanged call by @matorclawson in #181

Full Changelog: v0.36.6...v0.36.7

zeocore 0.36.6

The test that keeps CONTRIBUTING.md free of internal material also rejects host and account names (matormini, matorclawson, ENG-UK). Test only; no code changes.

What's Changed

• charter test: also reject host and account names (council P3 of #179) (sow: zeocore-SOW-43) by @matorclawson in #180

Full Changelog: v0.36.5...v0.36.6

zeocore 0.36.5

Cleaner for people who clone the repository. CONTRIBUTING.md is now written for outside contributors (issue first, fork, make setup, make verify, tests with fakes, a changelog fragment, a pull request) and says that org seats follow an internal charter, which is kept in the org records instead. The tracked CLAUDE.md is a short, neutral note for coding agents; a maintainer's own entrypoint that imports a private checkout lives in an untracked CLAUDE.local.md. The maintainer working notes under docs/reports/ and docs/MERGER-PROOF.md are removed. Test data no longer carries a personal home directory, a private repository name or a local receipt path. No code changes.

What's Changed

• public hygiene B: outsider CONTRIBUTING intro, neutral CLAUDE.md, notes off the site (sow: zeocore-SOW-43) by @matorclawson in #179

Full Changelog: v0.36.4...v0.36.5

zeocore 0.36.4

Display polish for the traveller cards. Pass airports={"KJFK": Airport("KJFK", "JFK", "New York"), ...}
(the class's airport table) to render_snapshot_html or render_card_html and the cards say "Landing about
17:35 at JFK" and "London (LHR) to New York (JFK)", with the ICAO codes only in the details line; without
the table the codes are shown as given. The arrival timeline no longer repeats its verdict as a minutes line
(the headline carries it, coloured late or spare). The market card drops the market-hours line and writes the
publication date in words ("published 21 Oct"). The long "COMPUTED from the flight estimate, ..." label is now
"COMPUTED" with its inputs named in the details (a replay still never claims a computation). The adapter's own
live-position text ("Live position: 25000 ft, 350 kt, position 5 s old") is shown as "In the air · 25,000 ft ·
350 kt · position 5 s old"; any other status text is shown as the provider gave it.

What's Changed

• widget_html: polish: airport code and city, no repeated verdict, short COMPUTED label, tidy status (sow: zeocore-SOW-43) by @matorclawson in #176

Full Changelog: v0.36.3...v0.36.4

zeocore 0.36.3

Follow-up to the traveller cards. Each card reads in the order title (and any REPLAY or
SUPERSEDED state), the answer, how fresh it is, then the provenance labels. A list that crosses a
daylight-saving change names the zone on every time (01:00 EDT, 01:00 EST) in the weather table and
the timeline, and a timeline that spans two days shows the weekday on every stop. The weather chart is
drawn in a 300-unit box so a 262 px card renders its labels above 16 px. The tables sit in a labelled,
keyboard-focusable scroll region. render_snapshot_html and render_card_html take an optional aware
now so relative text ("in about 2 h") is the same every time; without it the text counts from each
card's own fetch time. The test that checked "no socket, no bind" by searching the source text now
checks the syntax tree (no socket-type import, no bind or listen call), because the markup attribute
tabindex contains the letters "bind".
The moment a relative claim counts from sits in the same line as the claim: the flight headline
ends "..., in about 7 h 55 min, as of 09:40 at JFK" and the timeline's freshness line reads
"computed from a live position 5 min old, as of 09:40 at JFK" (UTC, labelled, without a Place). The
moment is the card's fetch time, or the supplied now, so a relative time is never read as live
wall-clock time.

What's Changed

• widget_html: answer-first order, DST zone names, multi-day weekdays, 300-unit chart, labelled scroll, supplied now (sow: zeocore-SOW-43) by @matorclawson in #175

Full Changelog: v0.36.2...v0.36.3

zeocore 0.36.2

The HTML renderer shows the cards the way a traveller reads them. Pass place=Place("JFK", "New York JFK", "America/New_York") to render_snapshot_html or render_card_html and every
time is in that place's zone, short ("Landing about 17:35 at JFK, in about 7 h 55 min"), with
the full ISO time only in a small details line; without a Place every time is UTC and says
so (a payload's own timezone, often UTC, is never trusted as the traveller's). Each card
leads with its one big fact: the flight's landing time, "14 °C, 0.2 mm rain at landing",
"You will make it: 32 h 5 min spare" (or "miss it"), "1 EUR = 1.1234 USD". Rates are shown to
4 places and changes to 2 (half-even; a nonzero value is never shown as zero). Fields the
source lacks are left out, and "airline schedule not provided by this source" is said once.
Freshness lines: a forecast says "forecast, issued <the provider's issue time>" (never the
fetch time) and the arrival timeline "computed from a live position old"; replay shows
no line, delayed beats daily beats these, and a position is "live". The weather chart is
larger with labelled hours and degrees, and the two tables scroll inside their card instead of
running into the next. Layout is CSS checked by tests, not measured in a browser by this
change.
The cards use the Rasa deck palette (taupe, ink, pink), larger type with an answer-first line, and
columns that follow the container's width (two at 960 px and up), with no font or image fetched.
The flight headline names the route's own destination (the Place only sets the zone); the arrival
timeline's headline carries its assumption ("assuming a 75 min transfer") and lists its stops in time
order; a weather table that crosses a daylight-saving change says "local time (EDT/EST)"; the weather
chart is drawn near its rendered size so its labels are readable, and the board says whose clock the
times are on (or that destination time is unavailable and times are UTC). Visible times in the card
footers are local, with the exact ISO times inside a details line; changes are shown to two places.

What's Changed

• widget_html: traveller cards: local time at the place, answer-first, exact freshness, Rasa palette (sow: zeocore-SOW-43) by @matorclawson in #174

Full Changelog: v0.36.1...v0.36.2

zeocore 0.36.1

The HTML renderer no longer calls a forecast or a computed timeline "live". The weather
card's one freshness line reads "forecast, not a live reading" and the arrival timeline's
reads "computed from its inputs, not a live reading"; the flight card (a position read now)
keeps "live", and the daily and delayed lines and the REPLAY rule are unchanged. Tables
(the hourly forecast and the market watchlist) now sit in a scrolling box inside their card
and cards may shrink in the grid, so a wide table no longer runs out of its card into the
next one at desktop width, and no value is clipped. The layout is set by CSS rules checked
by tests; it has not been measured in a browser by this change.

What's Changed

• widget_html: forecast/timeline are not 'live'; tables scroll in their card (sow: zeocore-SOW-43) by @matorclawson in #173

Full Changelog: v0.36.0...v0.36.1