Public release checklist

Trust boundaries

• Threat model and package READMEs match actual behaviour.
• No “secret-free”, “proof”, “safe”, “tamper-proof”, or truth/authenticity claims exceed tested properties.
• Packet task and metadata are covered by the outbound-content policy.
• Receipt rechecks cannot address paths or working directories outside a verifier-selected root.
• Commands require a controller-owned exact allowlist, an absolute executable path, controller-owned success criteria, and explicit opt-in.
• Hermes integration documents the operator-review workflow and does not claim human authentication, global egress, or OS-sandbox enforcement.
• Native Hermes preparation requires registered Git projects, explicit includes, and a clean commit by default.
• Native Hermes return verification requires OUTPUT_MANIFEST.json and receipt.json, rechecks all evidence without executing commands, and does not merge changes automatically.

Adversarial verification

• Traversal, absolute path, duplicate member, source/destination symlink, hardlink, device, FIFO, extra-file, compressed/decompressed size, PAX metadata, member-count, digest-snapshot, and manifest-privacy tests pass.
• Path rebinding, symlink escape, unknown evidence, duplicate claim, digest forgery, untrusted key, command policy, and wrong-context receipt tests pass.
• A clean end-to-end packet -> work -> receipt -> controller recheck passes.
• Changing one input, output, command policy, packet digest, or receipt byte produces the expected failure.
• Preapproval review and approval reject mismatched archive/state data and tampered local manifests, digest sidecars, links, special files, or extra payload files.

Supply chain and packaging

• Ruff, test matrix, package builds, and twine check pass from a clean clone.
• Wheels contain only intended package files.
• GitHub Actions are least-privilege and pinned to reviewed commit SHAs.
• Dependabot/Renovate and CodeQL configuration reviewed.
• Public main CI and CodeQL completed successfully after source publication.
• Public GitHub repository name and CLI names checked immediately before source publication.
• PyPI distribution names checked on 2026-08-22 immediately before release preparation; both names returned 404 and must be checked once more before the tag is pushed.
• The agent-packet pending publisher targets repository mauricemohr88-debug/agent-trust-kit, workflow ci.yml, and environment pypi.
• The agent-receipt pending publisher targets repository mauricemohr88-debug/agent-trust-kit, workflow ci.yml, and environment pypi-agent-receipt.
• Both publishing jobs use job-scoped OIDC; no long-lived PyPI upload token is stored.

Release decision

• One real but non-sensitive workflow has been dogfooded and recorded.
• At least two outside testers can follow the quick start without help.
• Maurice approved v0.1.0 on 2026-08-22 as an early public beta while the outside-tester goal remains visibly open in issue #3.
• Native Hermes plugin installation and a synthetic return have been tested from a clean user-plugin directory on a supported Hermes release.
• Open security blockers are zero.
• Maurice explicitly approves public GitHub source publication.
• Public GitHub source repository published.
• Maurice explicitly approves PyPI package publication on 2026-08-22.