Prepare VSTD 1.2.0 and restore the public boundary

.gitattributes

@@ -5,3 +5,5 @@
 *.py text eol=lf
 *.toml text eol=lf
 *.yml text eol=lf
+*.cose binary
+*.msgpack binary

.github/ISSUE_TEMPLATE/implementation-report.yml

@@ -5,7 +5,7 @@ labels: ["implementation", "interoperability"]
 body:
   - type: markdown
     attributes:
-      value: An implementation report is evidence of an attempt, not endorsement, adoption, certification, or conformance unless the stated tests establish that bounded result.
+      value: An implementation report for the Verifier Standard (VSTD) is evidence of an attempt, not endorsement, adoption, certification, or conformance unless the stated tests establish that bounded result.
   - type: input
     id: implementation
     attributes:

.github/ISSUE_TEMPLATE/specification-ambiguity.yml

@@ -5,13 +5,13 @@ labels: ["specification", "needs-triage"]
 body:
   - type: markdown
     attributes:
-      value: Do not include secrets or vulnerability details. Use private vulnerability reporting for security-sensitive findings.
+      value: Report ambiguity in the Verifier Standard (VSTD) without including secrets or vulnerability details. Use private vulnerability reporting for security-sensitive findings.
   - type: input
     id: coordinate
     attributes:
       label: Exact coordinate
       description: File, section, schema field, layer, and release or commit.
-      placeholder: standard/VSTD-4.md section 2.10 at v1.0.1
+      placeholder: standard/VSTD-4.md section X at release or commit Y
     validations:
       required: true
   - type: textarea

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,5 +1,7 @@
 ## Coordinate
 
+> **Acronyms:** Verifier Standard (VSTD).
+
 - VSTD layer/profile:
 - Repository release or target commit:
 - Claim, schema, or implementation seam:
@@ -23,3 +25,4 @@
 - [ ] I did not strengthen a claim without stronger evidence.
 - [ ] I did not include secrets, private data, or proprietary operational material.
 - [ ] Normative text, machine-readable surfaces, examples, and tests agree.
+- [ ] README maturity, claims guidance, generated reference, and Pages status still agree.

.github/workflows/ci.yml

@@ -1,7 +1,9 @@
-name: conformance
+name: repository-checks
 
 on:
   push:
+    branches: [main]
+    tags: ["v*"]
   pull_request:
 
 permissions:
@@ -35,6 +37,19 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - run: PYTHONPATH=src python -S -c "import verifier; from verifier.core.run import load_manifest; print(verifier.__version__)"
 
+  scitt-crypto:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - run: python -m pip install ".[test,scitt]"
+      - name: Require the real SCITT/COSE statement and receipt path
+        run: |
+          python -c "import cbor2, cryptography, scitt_cose"
+          python -m pytest -q tests/test_scitt_crypto_example.py
+
   release-integrity:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -96,12 +111,16 @@ jobs:
       - run: python -m pip wheel --no-cache-dir --no-deps --wheel-dir dist .
       - run: python -m venv /tmp/vstd-wheel
       - run: /tmp/vstd-wheel/bin/python -m pip install --no-deps dist/*.whl
-      - run: /tmp/vstd-wheel/bin/vstd demo --json
-      - run: /tmp/vstd-wheel/bin/vstd plan examples/generic_run/manifest.json --json
-      - run: /tmp/vstd-wheel/bin/vstd run examples/generic_run/manifest.json --output /tmp/vstd-receipt
-      - run: /tmp/vstd-wheel/bin/vstd validate /tmp/vstd-receipt
-      - run: /tmp/vstd-wheel/bin/vstd reproduce /tmp/vstd-receipt --rerun
-      - run: /tmp/vstd-wheel/bin/verifier demo --scenario honest-unknown --json
+      - name: Exercise the installed wheel outside the source checkout
+        run: |
+          cd /tmp
+          /tmp/vstd-wheel/bin/vstd demo --json
+          /tmp/vstd-wheel/bin/vstd plan "$GITHUB_WORKSPACE/examples/generic_run/manifest.json" --json
+          /tmp/vstd-wheel/bin/vstd run "$GITHUB_WORKSPACE/examples/generic_run/manifest.json" --output /tmp/vstd-receipt
+          /tmp/vstd-wheel/bin/vstd validate /tmp/vstd-receipt
+          /tmp/vstd-wheel/bin/vstd reproduce /tmp/vstd-receipt --rerun
+          /tmp/vstd-wheel/bin/verifier demo --scenario honest-unknown --json
+          /tmp/vstd-wheel/bin/python -c 'import json; from pathlib import Path; from verifier.core.checker import IndependentAuditor; receipt=json.loads(Path("/tmp/vstd-receipt/receipt.json").read_text()); hashes=(receipt["layer4_binding"]["verifier"]["specification_hash"], IndependentAuditor.verifier_descriptor().specification_hash); assert all(value.startswith("sha256:") for value in hashes), hashes'
 
   presentation:
     runs-on: ubuntu-latest
@@ -113,23 +132,42 @@ jobs:
       - run: python scripts/check_presentation.py
       - run: python scripts/build_pages.py --output _site
 
+  codeql:
+    name: CodeQL (Python)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        with:
+          languages: python
+          queries: security-extended
+      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+
+  # This identifier remains stable because main branch protection requires it.
   conformance-gate:
     if: always()
-    needs: [base, stdlib-smoke, release-integrity, release-reproducibility, installed-wheel-smoke, presentation]
+    needs: [base, stdlib-smoke, scitt-crypto, release-integrity, release-reproducibility, installed-wheel-smoke, presentation, codeql]
     runs-on: ubuntu-latest
     steps:
       - name: Require every declared support and artifact check
         env:
           BASE: ${{ needs.base.result }}
           STDLIB: ${{ needs.stdlib-smoke.result }}
+          SCITT: ${{ needs.scitt-crypto.result }}
           RELEASE: ${{ needs.release-integrity.result }}
           REPRODUCIBLE: ${{ needs.release-reproducibility.result }}
           WHEEL: ${{ needs.installed-wheel-smoke.result }}
           PRESENTATION: ${{ needs.presentation.result }}
+          CODEQL: ${{ needs.codeql.result }}
         run: |
           test "$BASE" = success
           test "$STDLIB" = success
+          test "$SCITT" = success
           test "$RELEASE" = success
           test "$REPRODUCIBLE" = success
           test "$WHEEL" = success
           test "$PRESENTATION" = success
+          test "$CODEQL" = success

.github/workflows/release.yml

@@ -24,6 +24,9 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Require TIME CLEAR in the exact tagged checkout
+        run: python scripts/check_time_status.py
+
       - name: Require a protected-main commit and matching package version
         env:
           GH_TOKEN: ${{ github.token }}
@@ -36,6 +39,9 @@ jobs:
           test "$VERSION" = "$PACKAGE_VERSION"
           test "$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/check-runs" --jq '[.check_runs[] | select(.name == "conformance-gate" and .conclusion == "success")] | length')" -ge 1
 
+      - name: Require finalized release metadata in the exact tagged checkout
+        run: python scripts/check_release_metadata.py --version "${GITHUB_REF_NAME#v}"
+
       - name: Re-run conformance on the tagged checkout
         run: |
           python -m pip install ".[test,release]"
@@ -55,12 +61,14 @@ jobs:
           python scripts/check_release_boundary.py dist/*.zip dist/*.whl dist/*.tar.gz
           python -m venv /tmp/vstd-release-wheel
           /tmp/vstd-release-wheel/bin/python -m pip install --no-deps dist/*.whl
+          cd /tmp
           /tmp/vstd-release-wheel/bin/vstd demo --json
-          /tmp/vstd-release-wheel/bin/vstd plan examples/generic_run/manifest.json --json
-          /tmp/vstd-release-wheel/bin/vstd run examples/generic_run/manifest.json --output /tmp/vstd-release-receipt
+          /tmp/vstd-release-wheel/bin/vstd plan "$GITHUB_WORKSPACE/examples/generic_run/manifest.json" --json
+          /tmp/vstd-release-wheel/bin/vstd run "$GITHUB_WORKSPACE/examples/generic_run/manifest.json" --output /tmp/vstd-release-receipt
           /tmp/vstd-release-wheel/bin/vstd validate /tmp/vstd-release-receipt
           /tmp/vstd-release-wheel/bin/vstd reproduce /tmp/vstd-release-receipt --rerun
           /tmp/vstd-release-wheel/bin/vstd hardware list --json >/dev/null
+          /tmp/vstd-release-wheel/bin/python -c 'import json; from pathlib import Path; from verifier.core.checker import IndependentAuditor; receipt=json.loads(Path("/tmp/vstd-release-receipt/receipt.json").read_text()); hashes=(receipt["layer4_binding"]["verifier"]["specification_hash"], IndependentAuditor.verifier_descriptor().specification_hash); assert all(value.startswith("sha256:") for value in hashes), hashes'
 
       - name: Attest every published artifact
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2

.zenodo.json

@@ -4,7 +4,7 @@
       "name": "Roost, Tyler"
     }
   ],
-  "description": "A two-axis verification ladder and reference implementation for bounded claims, provenance graphs, substrate accountability, grounded refutation certificates, and computed verification depth.",
+  "description": "Release-candidate metadata for a verification-domain language and Python reference implementation that packages bounded computational claims with explicit evidence, checking mechanisms, limits, refutation conditions, provenance, and reproducibility information. It does not replace native domain verifiers or strengthen their results. Publication metadata is assigned only after the release exists.",
   "keywords": [
     "verification",
     "provenance",
@@ -13,10 +13,11 @@
     "software supply chain",
     "accelerator accountability",
     "refutability",
-    "proof certificates"
+    "proof certificates",
+    "bounded claims"
   ],
   "license": "Apache-2.0",
-  "title": "VSTD: A Two-Axis Ladder for Refutable Verification",
-  "version": "1.1.3",
+  "title": "Verifier Standard (VSTD): Bounded, Refutable Evidence for Computational Claims",
+  "version": "1.2.0",
   "upload_type": "software"
 }