0.1.1 release record

Status: published; release-order incident remediated

0.1.1 contains no runtime, public API, schema, or serialized-contract change from 0.1.0. It replaces the TestPyPI verifier that incorrectly asked the test index to resolve Hatchling while downloading the sdist. The replacement checks three independent identities without executing an artifact:

1. the wheel and sdist built by CI match SHA256SUMS;
2. TestPyPI reports the same exact filenames and SHA-256 digests; and
3. the raw bytes served from TestPyPI hash to those same digests.

Release-order incident

The protected PyPI job was approved after TestPyPI verification, but before the tagged commit had been promoted from develop to main. The package artifacts and their provenance were correct; the branch-ordering control was not. 0.1.1 is immutable on PyPI, so remediation is to promote the exact tag commit to main and require every future release workflow to prove that its tagged commit is already an ancestor of origin/main before building or publishing.

On 31 August 2026, main was fast-forwarded to f0f9ac8, which contains both the signed v0.1.1 commit and the new ancestry guard. Git ancestry and both remote branch heads were checked after the push.

Release gates

• [x] Package, bundled coding-agent skill, changelog, and docs identify 0.1.1.
• [x] The verifier rejects unexpected files, unsafe filenames, unapproved hosts, index-version drift, metadata hash drift, and raw-byte hash drift.
• [x] Signed v0.1.1 tag passes the complete artifact matrix.
• [x] Protected TestPyPI publication and independent artifact verification pass.
• [x] Protected PyPI publication passes with the same verified artifact digests.
• [x] The exact v0.1.1 commit is promoted from develop to main.
• [x] The GitHub release records the workflow run, artifact digests, index URLs, and build provenance.