From c2697d331313c91b38ced1d757eb5a2c17b200a0 Mon Sep 17 00:00:00 2001 From: Zin Nam Date: Sun, 11 Oct 2026 13:41:16 +0200 Subject: [PATCH] Prepare the 0.1.0 release Fold the changelog into 0.1.0 and replace the build-from-source notice with install instructions. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 17 +++++------------ README.md | 16 ++++++++++------ SECURITY.md | 2 +- docs/roadmap.md | 8 ++++---- 4 files changed, 20 insertions(+), 23 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ffaaaa9..b65e723 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,18 +6,9 @@ aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] -### Changed +## [0.1.0] - 2026-10-11 -- Packages are issued by upstream's `verified_verifier::issue`; the SDK's own - producer is deleted. -- The verification crates are pinned to `dekrops/verified-cli` `v0.1.0` - (`d270ae0`), the tag Agent Billing Center and Agent Compliance Center pin. -- A claim or evidence that does not fit the contract is reported as the - protocol's `INPUT_MISMATCH` when issuing. - -## [0.1.0] - unreleased developer preview - -First scaffold. Not published to PyPI. +First developer preview. ### Added @@ -32,7 +23,9 @@ First scaffold. Not published to PyPI. - Work-unit identity and nullifiers: `work_unit`, `WorkUnitScope`. - Instrumentation: `WorkSession`, `verified_tool`, `ExecutionTrace`. - OpenAI Agents SDK adapter: `verified.integrations.openai_agents`. -- Native extension over `dekrops/verified-cli`. +- Native extension over `dekrops/verified-cli` `v0.1.0` (`d270ae0`), the tag + Agent Billing Center and Agent Compliance Center pin; packages are issued + by its `verified_verifier::issue`. - Conformance suite against `dekrops/wvp` at `c7c9de2`. ### Compatibility diff --git a/README.md b/README.md index 169f3eb..1ab4393 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ by the same Rust crates as the [`verified` CLI](https://github.com/dekrops/verif bound natively; the Python layer adds an API, not a second implementation. **Status: developer preview (0.1.0).** WVP is a draft in every version. This -SDK has not been security-audited, is not on PyPI yet, and its API will change. +SDK has not been security-audited, and its API will change. Read [what is and is not supported](docs/protocol-compatibility.md) before relying on it. @@ -21,8 +21,13 @@ Any agent. Any runtime. Independently verifiable work. ## Install -Not published yet. From a checkout, with a Rust toolchain (1.99+) and -[uv](https://docs.astral.sh/uv/): +```sh +pip install verified-python +``` + +Wheels are published for Linux, macOS and Windows; the import name is +`verified`. To work on the SDK, from a checkout with a Rust toolchain (1.99+) +and [uv](https://docs.astral.sh/uv/): ```sh git clone --recurse-submodules https://github.com/dekrops/verified-python @@ -218,9 +223,8 @@ and nullifiers; issuing `wvp-0.2` packages; framework-independent instrumentation; one framework adapter. Not here: a client for the hosted Verified platform (it has no stable -service API to call yet); claim -registration v1; statement chaining when *producing* evidence; LangGraph and -Google ADK adapters; published wheels. Details and reasons are in the +service API to call yet); claim registration v1; statement chaining when +*producing* evidence; LangGraph and Google ADK adapters. Details and reasons are in the [roadmap](docs/roadmap.md) and the [compatibility assessment](docs/protocol-compatibility.md). diff --git a/SECURITY.md b/SECURITY.md index 460e6de..16567e0 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -9,7 +9,7 @@ the sole control for a consequential decision. ## Supported versions -Only the latest commit on `main`. There are no releases yet. +Only the latest release. ## Reporting a vulnerability diff --git a/docs/roadmap.md b/docs/roadmap.md index 7b9fb24..7426b48 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -25,7 +25,7 @@ Working and tested: - **Packaging foundations**: maturin, one `abi3` wheel per platform, CI for lint, types, tests, conformance and wheels. -Known gaps at this horizon: not on PyPI; no security review; claim +Known gaps at this horizon: no security review; claim registration not bound; no platform client; source builds need Rust and network access. @@ -33,9 +33,9 @@ network access. In rough order of leverage: -1. **Publish wheels.** Register the project, resolve the `verified` import - name question (an unrelated distribution owns `verified` on PyPI), and - release through trusted publishing. +1. **Settle the bare name.** Wheels are published as `verified-python`. An + unrelated placeholder owns `verified` on PyPI; a PEP 541 request asks for + it, so that `pip install verified` cannot install something else. 2. **Move the report-to-JSON mapping upstream** (`rust/src/report.rs`), as the producer was. 3. **Stable framework adapters**: LangGraph, then Google ADK, each with