Moonweave-Systems · moonweave · Jul 16, 2026 · Jul 16, 2026
@@ -30,6 +30,10 @@ jobs:
         run: python3 scripts/check_orro_release_manifest.py --self-test
       - name: Compatibility matrix self-test
         run: python3 scripts/check_compatibility_matrix.py --self-test
+      - name: Check ORRO release state
+        run: python3 scripts/check_orro_release_state.py
+      - name: Release state self-test
+        run: python3 scripts/check_orro_release_state.py --self-test
       - name: Check ORRO packaging decision
         run: python3 scripts/check_orro_packaging_decision.py
       - name: Check ORRO fallback policy
@@ -45,7 +49,7 @@ jobs:
       - name: Check ORRO wrapper distribution
         run: python3 scripts/check_orro_wrapper_distribution.py --json --allow-network
       - name: Compile scripts
-        run: python3 -m py_compile scripts/check_no_bidi_controls.py scripts/check_orro_repo_contract.py scripts/check_orro_language_boundaries.py scripts/check_orro_assurance_contract_fixtures.py scripts/check_orro_release_manifest.py scripts/check_compatibility_matrix.py scripts/check_orro_packaging_decision.py scripts/check_orro_fallback_policy.py scripts/check_orro_command_migration.py scripts/check_orro_command_migration_dry_run.py scripts/check_orro_wrapper.py scripts/check_orro_wrapper_install.py scripts/check_orro_wrapper_distribution.py scripts/orro_e2e_smoke.py scripts/update_orro_engine_lock.py scripts/bootstrap_orro.py src/orro_wrapper/__init__.py src/orro_wrapper/__main__.py src/orro_wrapper/cli.py
+        run: python3 -m py_compile scripts/check_no_bidi_controls.py scripts/check_orro_repo_contract.py scripts/check_orro_language_boundaries.py scripts/check_orro_assurance_contract_fixtures.py scripts/check_orro_release_manifest.py scripts/check_compatibility_matrix.py scripts/check_orro_release_state.py scripts/check_orro_packaging_decision.py scripts/check_orro_fallback_policy.py scripts/check_orro_command_migration.py scripts/check_orro_command_migration_dry_run.py scripts/check_orro_wrapper.py scripts/check_orro_wrapper_install.py scripts/check_orro_wrapper_distribution.py scripts/orro_e2e_smoke.py scripts/update_orro_engine_lock.py scripts/bootstrap_orro.py src/orro_wrapper/__init__.py src/orro_wrapper/__main__.py src/orro_wrapper/cli.py
       - name: Bidi control scanner self-test
         run: python3 scripts/check_no_bidi_controls.py --self-test
       - name: Install ORRO wrapper package (editable)

@@ -64,3 +64,5 @@ jobs:
           path: dist/
       - name: Publish to PyPI (Trusted Publishing)
         uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        with:
+          skip-existing: true
@@ -17,8 +17,9 @@ Today:
 - ORRO is the product and workflow surface for observed run and review.
 - This repository keeps ORRO docs, product boundary, locks, thin wrapper package metadata, assurance contract checks, and integration-surface policy.
 - The runnable `orro` command is ORRO-owned and delegates to witnessd.
-- The `orro` package is published on PyPI (0.0.x is live); this repository now
-  sources version 0.1.0.
+- `orro` 0.1.0 is published on PyPI, and this repository is its canonical
+  source. A normal `pip install orro` installs the 0.1.0 package, whose metadata
+  declares `witnessd>=2.3.2`.
 - The local wrapper package exposes both `orro` and `orro-wrapper`.
 
 Current focus:
@@ -29,8 +30,8 @@ Current focus:
 
 ## Can I use ORRO today?
 
-Yes. The `orro` package is published on PyPI, and development dogfood can also
-run directly against pinned Depone and witnessd checkouts.
+Yes. `orro` 0.1.0 is published on PyPI, and development dogfood can also run
+directly against pinned Depone and witnessd checkouts.
 
 Current split:
 
@@ -95,7 +96,8 @@ Engine-lock update discipline is documented in
 validated engine pairs are listed in
 [`docs/compatibility-matrix.md`](docs/compatibility-matrix.md). The `orro`
 package is published on PyPI; this repository sources 0.1.0, whose publication
-is a separate release step.
+was completed as a separate release step. Repository metadata changes do not
+republish or rewrite that artifact.
 
 Use `scripts/update_orro_engine_lock.py` for future pin updates so the e2e
 engine lock, release manifest, and compatibility matrix stay aligned. The

@@ -79,8 +79,8 @@ python3 scripts/bootstrap_orro.py \
   --json
 ```
 
-The `orro` package is published on PyPI; 0.0.x is live and this repository now
-sources 0.1.0 with `witnessd>=2.3.2`.
+`orro` 0.1.0 is published on PyPI, this repository is its canonical source, and
+the package metadata declares `witnessd>=2.3.2`.
 
 The wrapper distribution smoke is separate from bootstrap:
 

@@ -5,16 +5,21 @@ proof, not verifier truth, not approval, and not assurance. It does not replace
 Depone or witnessd engine tests, and it does not imply that unlisted future
 commits are compatible.
 
+`orro` 0.1.0 is published on PyPI, and this repository is its canonical source.
+
 ```text
 Depone verifies; witnessd executes; ORRO exposes the workflow.
 ```
 
 | Matrix entry | ORRO repo commit | witnessd commit | Depone commit | e2e status | notes |
 | --- | --- | --- | --- | --- | --- |
-| depone-n-witnessd-n | n/a | `9715ea278242ac920a721f6079aad6cebf49cd40` | `44eb26ef84a239d4d04570d763c549cee05839ee` | pass | Current locally validated engine pair; witnessd commit is published on the configured remote. |
+| depone-n-witnessd-n | n/a | `ae260fb9c020a0bf9e00b60d4053a8fcd7adc8a9` | `e1b020b8300c569e35f771c9f84f6998f99a86ce` | pass | Current locally validated engine pair; witnessd v2.3.3. |
 | depone-n-witnessd-n-1 | n/a | `d601fa86fd8b658e8f4a2cf7fa4b35bde26c554d` | `0e86a55ad10c464d35308a7b6315860a47bcf8a5` | warn | Declared downgrade row, not a release lock. |
 | depone-n-1-witnessd-n | n/a | `90d4bc77b71cecf464f1f8a820d9fe17b308211f` | `b203130b5720c6ef6fc9b7492f085ac5ee733786` | warn | Declared downgrade row, not a release lock. |
-| orro-rc-locked-triplet | `136c07d714ca61e999097de69859515961f9638b` | `5db87ac975452d9fed233306645e179b78087d68` | `e1b020b8300c569e35f771c9f84f6998f99a86ce` | pass | Matches `engine-lock/orro-e2e-engine-lock.json`, `release/orro-release-manifest.v0.json`, and `release/compatibility-matrix.v0.json`. |
+| orro-rc-locked-triplet | `136c07d714ca61e999097de69859515961f9638b` | `ae260fb9c020a0bf9e00b60d4053a8fcd7adc8a9` | `e1b020b8300c569e35f771c9f84f6998f99a86ce` | pass | Matches witnessd v2.3.3, `engine-lock/orro-e2e-engine-lock.json`, `release/orro-release-manifest.v0.json`, and `release/compatibility-matrix.v0.json`. |
+
+The locked witnessd revision is release `v2.3.3` (source version 2.3.3). It
+satisfies the published ORRO package requirement `witnessd>=2.3.2`.
 
 Related files:
 

@@ -42,6 +42,7 @@ checkout or open an intentional engine-lock update PR.
    ```bash
    python3 scripts/update_orro_engine_lock.py \
      --witnessd-commit <40-hex-witnessd-commit> \
+     --witnessd-version <X.Y.Z-witnessd-version> \
      --depone-commit <40-hex-depone-commit>
    ```
 

@@ -1,17 +1,16 @@
 # Install
 
-The `orro` package is published on PyPI (0.0.x is live). This repository now
-sources 0.1.0, whose metadata declares `witnessd>=2.3.2`; publishing that new
-version is a separate release step. The package exposes `orro` and the
-`orro-wrapper` compatibility alias.
+`orro` 0.1.0 is published on PyPI, and this repository is its canonical source.
+The package metadata declares `witnessd>=2.3.2`, and the package exposes `orro`
+plus the `orro-wrapper` compatibility alias.
 
 ```bash
 python3 -m pip install orro
 ```
 
-Until 0.1.0 is published, that command installs the live 0.0.x release.
-Development dogfood may instead use the source checkout and pinned engine
-repositories directly.
+That command installs `orro` 0.1.0 and resolves its `witnessd>=2.3.2`
+dependency. Development dogfood may instead use the source checkout and pinned
+engine repositories directly.
 
 Current development layout uses the engine repositories directly:
 

@@ -12,9 +12,8 @@ ORRO will remain product/distribution/wrapper only while Depone and witnessd
 stay separate engine repositories.
 
 Current command source is the ORRO-owned `orro` console script, which delegates
-to witnessd. The `orro` package is published on PyPI (0.0.x is live), and this
-repository now sources 0.1.0 with a `witnessd>=2.3.2` dependency. Publishing
-0.1.0 is a separate approved release step.
+to witnessd. `orro` 0.1.0 is published on PyPI, this repository is its canonical
+source, and its package metadata declares `witnessd>=2.3.2`.
 
 The package remains a thin wrapper that delegates to the existing engine
 command surface. It must contain no engine code.
@@ -51,9 +50,9 @@ The ORRO repository must not contain:
    The local wheel distribution smoke verifies that the built wheel exposes
    `orro` and `orro-wrapper`, and contains no engine packages or engine
    implementation files.
-3. Published package: current phase. `orro` 0.0.x is live on PyPI, this
-   repository sources 0.1.0, and any new release still requires pinned-engine
-   e2e, boundary checks, bootstrap checks, and release metadata to remain green.
+3. Published package: current phase. `orro` 0.1.0 is published on PyPI from this
+   repository. Any new release still requires pinned-engine e2e, boundary
+   checks, bootstrap checks, and release metadata to remain green.
 
 4. Command ownership: current phase. `orro = orro_wrapper.cli:main` and
    `orro-wrapper = orro_wrapper.cli:main` are committed package metadata. Both

@@ -67,5 +67,6 @@ mismatched engines and point to bootstrap/setup commands, but it must not
 auto-select different engine commits or rewrite the engine lock outside an
 intentional update PR.
 
-The `orro` package is published on PyPI; 0.0.x is live and this repository now
-sources 0.1.0 with `witnessd>=2.3.2`.
+`orro` 0.1.0 is published on PyPI, this repository is its canonical source, and
+the package metadata declares `witnessd>=2.3.2`. The current engine lock pins
+witnessd 2.3.3 at tag `v2.3.3`, satisfying that declared dependency.
@@ -31,8 +31,8 @@ witnessd-hosted engine surface.
 The release manifest and compatibility matrix are product/distribution
 metadata. They record which pinned engine pair has passed ORRO e2e CI, but they
 are not proof, not verifier truth, not approval, and not assurance. Engine-lock
-update process is intentional and PR-reviewed. The `orro` package is published
-on PyPI; 0.0.x is live and this repository now sources 0.1.0.
+update process is intentional and PR-reviewed. `orro` 0.1.0 is published on
+PyPI, and this repository is its canonical source.
 
 The packaging decision in `docs/packaging-decision.md` and
 `packaging/wrapper-package-plan.v0.json` is also product metadata, not package

@@ -1,8 +1,7 @@
 # Thin Wrapper Plan
 
-The ORRO repository is the canonical source of the published `orro`
-distribution. PyPI has live 0.0.x releases; this repository now sources 0.1.0
-and declares `witnessd>=2.3.2`.
+`orro` 0.1.0 is published on PyPI, and the ORRO repository is its canonical
+source. The package metadata declares `witnessd>=2.3.2`.
 
 ## Current State
 

@@ -46,9 +46,8 @@ the engine command the operator explicitly invoked. The wrapper only delegates.
 
 ## Relationship To Packaging
 
-This repository is the canonical source of the published `orro` package. PyPI
-has live 0.0.x releases; this repository sources 0.1.0 and declares
-`witnessd>=2.3.2`.
+`orro` 0.1.0 is published on PyPI, and this repository is its canonical source.
+The package metadata declares `witnessd>=2.3.2`.
 
 Package work must keep:
 

@@ -57,6 +57,5 @@ This is local distribution smoke only. It builds and installs a local wheel, but
 it does not publish a package, upload artifacts, create a marketplace release,
 or claim verifier truth.
 
-The `orro` package is published on PyPI. PyPI has live 0.0.x releases, while
-this repository sources 0.1.0 with `witnessd>=2.3.2`; publishing 0.1.0 is a
-separate approved step.
+`orro` 0.1.0 is published on PyPI, this repository is its canonical source, and
+the package metadata declares `witnessd>=2.3.2`.
@@ -3,8 +3,9 @@
   "schema_version": "1.0",
   "witnessd": {
     "repository": "Moonweave-Systems/witnessd",
-    "commit": "5db87ac975452d9fed233306645e179b78087d68",
-    "ref_name": "5db87ac975452d9fed233306645e179b78087d68"
+    "commit": "ae260fb9c020a0bf9e00b60d4053a8fcd7adc8a9",
+    "version": "2.3.3",
+    "ref_name": "v2.3.3"
   },
   "depone": {
     "repository": "Moonweave-Systems/Depone",

@@ -5,7 +5,7 @@
   "package_goal": "single user-facing ORRO install that prepares and invokes pinned Depone and witnessd engines",
   "distribution_name": "orro",
   "source_version": "0.1.0",
-  "published_pypi_versions": "0.0.x",
+  "published_pypi_versions": "0.1.0",
   "current_command_source": "ORRO-owned orro console script",
   "published_package": true,
   "phases": [
@@ -30,7 +30,7 @@
     {
       "phase": "published-package",
       "status": "current",
-      "description": "Record that orro 0.0.x is live on PyPI and this repository now sources 0.1.0; publishing 0.1.0 remains a separate approved release step.",
+      "description": "Record that orro 0.1.0 is published on PyPI and this repository is its canonical source.",
       "contains_engine_logic": false
     }
   ],

@@ -10,9 +10,10 @@
       "id": "depone-n-witnessd-n",
       "type": "engine-pair",
       "depone_commit": "e1b020b8300c569e35f771c9f84f6998f99a86ce",
-      "witnessd_commit": "5db87ac975452d9fed233306645e179b78087d68",
+      "witnessd_commit": "ae260fb9c020a0bf9e00b60d4053a8fcd7adc8a9",
       "status": "pass",
-      "notes": "Current locally validated engine pair; witnessd commit is published on the configured remote."
+      "notes": "Current locally validated engine pair; witnessd commit is published on the configured remote.",
+      "witnessd_version": "2.3.3"
     },
     {
       "id": "depone-n-witnessd-n-1",
@@ -35,11 +36,12 @@
       "type": "product-triplet",
       "orro_commit": "136c07d714ca61e999097de69859515961f9638b",
       "depone_commit": "e1b020b8300c569e35f771c9f84f6998f99a86ce",
-      "witnessd_commit": "5db87ac975452d9fed233306645e179b78087d68",
+      "witnessd_commit": "ae260fb9c020a0bf9e00b60d4053a8fcd7adc8a9",
       "status": "pass",
       "engine_lock": "engine-lock/orro-e2e-engine-lock.json",
       "release_manifest": "release/orro-release-manifest.v0.json",
-      "notes": "ORRO release-candidate base with the updated immutable engine triplet."
+      "notes": "ORRO release-candidate base with the updated immutable engine triplet.",
+      "witnessd_version": "2.3.3"
     }
   ],
   "boundary": {

@@ -10,7 +10,8 @@
   "engines": {
     "witnessd": {
       "repository": "Moonweave-Systems/witnessd",
-      "commit": "5db87ac975452d9fed233306645e179b78087d68",
+      "commit": "ae260fb9c020a0bf9e00b60d4053a8fcd7adc8a9",
+      "version": "2.3.3",
       "role": "execution engine"
     },
     "depone": {

@@ -20,6 +20,7 @@
 RELEASE_MANIFEST_PATH = ROOT / "release" / "orro-release-manifest.v0.json"
 DOC_MATRIX_PATH = ROOT / "docs" / "compatibility-matrix.md"
 COMMIT_RE = re.compile(r"^[0-9a-f]{40}$")
+VERSION_RE = re.compile(r"^\d+\.\d+\.\d+$")
 FORBIDDEN_REFS = {"main", "master", "HEAD"}
 
 
@@ -133,6 +134,10 @@ def validate_matrix_shape(matrix: dict[str, Any]) -> dict[str, dict[str, Any]]:
             require_commit(f"{entry_id}.orro_commit", entry.get("orro_commit"))
         if entry.get("status") not in {"pass", "warn"}:
             fail(f"{entry_id}.status must be pass or warn")
+    for entry_id in ("depone-n-witnessd-n", "orro-rc-locked-triplet"):
+        version = by_id[entry_id].get("witnessd_version")
+        if not isinstance(version, str) or VERSION_RE.fullmatch(version) is None:
+            fail(f"{entry_id}.witnessd_version must be an X.Y.Z version")
     return by_id
 
 
@@ -152,6 +157,10 @@ def validate_lock_and_manifest(by_id: dict[str, dict[str, Any]]) -> None:
         fail("engine-lock witnessd commit must match depone-n-witnessd-n")
     if lock["depone"].get("commit") != current["depone_commit"]:
         fail("engine-lock Depone commit must match depone-n-witnessd-n")
+    if lock["witnessd"].get("version") != current["witnessd_version"]:
+        fail("engine-lock witnessd version must match depone-n-witnessd-n")
+    if lock["witnessd"].get("ref_name") != f"v{current['witnessd_version']}":
+        fail("engine-lock witnessd ref_name must match depone-n-witnessd-n version")
     engines = manifest.get("engines")
     product = manifest.get("product")
     if not isinstance(engines, dict) or not isinstance(product, dict):
@@ -160,6 +169,8 @@ def validate_lock_and_manifest(by_id: dict[str, dict[str, Any]]) -> None:
         fail("release manifest product.commit must match ORRO triplet")
     if engines.get("witnessd", {}).get("commit") != triplet["witnessd_commit"]:
         fail("release manifest witnessd commit must match ORRO triplet")
+    if engines.get("witnessd", {}).get("version") != triplet["witnessd_version"]:
+        fail("release manifest witnessd version must match ORRO triplet")
     if engines.get("depone", {}).get("commit") != triplet["depone_commit"]:
         fail("release manifest Depone commit must match ORRO triplet")
 
@@ -173,11 +184,12 @@ def validate_doc_matrix(by_id: dict[str, dict[str, Any]]) -> None:
         "orro-rc-locked-triplet",
     ):
         entry = by_id[entry_id]
-        if entry_id not in text:
+        row = next((line for line in text.splitlines() if line.startswith(f"| {entry_id} |")), None)
+        if row is None:
             fail(f"docs compatibility matrix missing {entry_id}")
-        for key in ("orro_commit", "witnessd_commit", "depone_commit"):
+        for key in ("orro_commit", "witnessd_commit", "witnessd_version", "depone_commit"):
             value = entry.get(key)
-            if isinstance(value, str) and value not in text:
+            if isinstance(value, str) and value not in row:
                 fail(f"docs compatibility matrix missing {entry_id}.{key}")
 
 
@@ -220,10 +232,10 @@ def self_test() -> int:
         "not_verifier_truth": True,
         "not_package_publish": True,
         "entries": [
-            {"id": "depone-n-witnessd-n", "depone_commit": "1" * 40, "witnessd_commit": "2" * 40, "status": "pass"},
+            {"id": "depone-n-witnessd-n", "depone_commit": "1" * 40, "witnessd_commit": "2" * 40, "witnessd_version": "2.3.3", "status": "pass"},
             {"id": "depone-n-witnessd-n-1", "depone_commit": "1" * 40, "witnessd_commit": "3" * 40, "status": "warn"},
             {"id": "depone-n-1-witnessd-n", "depone_commit": "4" * 40, "witnessd_commit": "2" * 40, "status": "warn"},
-            {"id": "orro-rc-locked-triplet", "orro_commit": "5" * 40, "depone_commit": "1" * 40, "witnessd_commit": "2" * 40, "status": "pass"},
+            {"id": "orro-rc-locked-triplet", "orro_commit": "5" * 40, "depone_commit": "1" * 40, "witnessd_commit": "2" * 40, "witnessd_version": "2.3.3", "status": "pass"},
         ],
         "boundary": {
             "approves_merge": False,
@@ -234,13 +246,22 @@ def self_test() -> int:
     }
     validate_matrix_shape(matrix)
     matrix["entries"][0]["witnessd_commit"] = "main"
+    try:
+        with contextlib.redirect_stderr(io.StringIO()):
+            validate_matrix_shape(matrix)
+    except SystemExit:
+        matrix["entries"][0]["witnessd_commit"] = "2" * 40
+    else:
+        print("self-test failed: mutable ref was accepted", file=sys.stderr)
+        return 1
+    matrix["entries"][0]["witnessd_version"] = "latest"
     try:
         with contextlib.redirect_stderr(io.StringIO()):
             validate_matrix_shape(matrix)
     except SystemExit:
         print("ORRO compatibility matrix self-test: pass")
         return 0
-    print("self-test failed: mutable ref was accepted", file=sys.stderr)
+    print("self-test failed: invalid witnessd version was accepted", file=sys.stderr)
     return 1
 
 

@@ -100,7 +100,7 @@ def check_docs() -> None:
     require_contains("fallback docs", text, "intentional engine-lock update PR")
     require_contains("fallback docs", text, "proofrun")
     require_contains("fallback docs", text, "proofcheck")
-    require_contains("fallback docs", text, "The `orro` package is published on PyPI")
+    require_contains("fallback docs", text, "`orro` 0.1.0 is published on PyPI")
 
 
 def main() -> int: