research-engineering · iperev · Sep 3, 2026 · Sep 2, 2026 · Sep 2, 2026 · Sep 2, 2026
diff --git a/.github/actions/setup-verified-npm/action.yml b/.github/actions/setup-verified-npm/action.yml
@@ -10,14 +10,14 @@ runs:
         set -euo pipefail
 
         npm_version="$(node -p "require('./package.json').packageManager.split('@').at(-1)")"
-        expected_version="11.18.0"
+        expected_version="12.0.2"
         if [ "$npm_version" != "$expected_version" ]; then
           echo "packageManager npm version drift: expected $expected_version, got $npm_version" >&2
           exit 1
         fi
 
-        tarball_url="https://registry.npmjs.org/npm/-/npm-11.18.0.tgz"
-        tarball_integrity="sha512-T67M4L5wNm0cZ7EBLErcEkY1SmzEW/WJ+SADBzsFUY1UdAPfFHXFQtZ6SEXiK0+vzXysCvAsepbMaBTwnrAD+w=="
+        tarball_url="https://registry.npmjs.org/npm/-/npm-12.0.2.tgz"
+        tarball_integrity="sha512-uIXokLlBj6FpNUTQX1PmT5pz7BlIN9QlixX+zdaSNHsd0qUXsbDLr50xzY6Sw7cJVr0uzHKDOle0swmPW/p5Qw=="
         tool_root="$RUNNER_TEMP/proofkit-verified-npm"
         archive="$tool_root/npm.tgz"
         bin_dir="$tool_root/bin"

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -25,15 +25,15 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 26.8.1
           package-manager-cache: false
 
       - name: Install verified npm
@@ -49,9 +49,9 @@ jobs:
           cache: true
 
       - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: '3.14.6'
+          python-version: '3.14.7'
 
       - name: Verify diff hygiene
         run: |
@@ -132,14 +132,14 @@ jobs:
     timeout-minutes: 12
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 26.8.1
           package-manager-cache: false
 
       - name: Install verified npm
@@ -163,14 +163,14 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 26.8.1
           package-manager-cache: false
 
       - name: Install verified npm

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -29,7 +29,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -40,14 +40,14 @@ jobs:
           cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: go
           build-mode: autobuild
 
       - name: Analyze
         id: analyze
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           output: codeql-results
           upload: never
@@ -89,7 +89,7 @@ jobs:
           echo "path=$sarif_file" >> "$GITHUB_OUTPUT"
 
       - name: Upload CodeQL SARIF
-        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: ${{ steps.sarif.outputs.path }}
           category: codeql-go
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
@@ -25,7 +25,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -38,7 +38,7 @@ jobs:
       - name: Run OSV source scan
         run: |
           set -euo pipefail
-          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2.4.0
+          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2.5.1
           scanner_bin="$(go env GOPATH)/bin/osv-scanner"
           mkdir -p artifacts/osv
           set +e
@@ -82,7 +82,7 @@ jobs:
           path: artifacts/osv
 
       - name: Upload OSV SARIF
-        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: artifacts/osv/osv-results.sarif
           category: osv-source-advisory
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -42,14 +42,14 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 26.8.1
           registry-url: ${{ env.REGISTRY_URL }}
           package-manager-cache: false
 
@@ -214,7 +214,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -279,14 +279,14 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 26.8.1
           registry-url: ${{ env.REGISTRY_URL }}
           package-manager-cache: false
 
@@ -388,22 +388,9 @@ jobs:
               sleep 10
             done
           done < artifacts/registry/package-names.txt
-          node <<'NODE'
-          const { readFileSync, readdirSync, writeFileSync } = require("node:fs");
-
-          const files = readdirSync("artifacts/registry")
-            .filter((file) => file.startsWith("pack-") && file.endsWith(".json"))
-            .sort();
-          const records = files.map((file) => {
-            const parsed = JSON.parse(readFileSync(`artifacts/registry/${file}`, "utf8"));
-            if (!Array.isArray(parsed) || parsed.length !== 1) {
-              throw new Error(`registry npm pack report ${file} must contain exactly one record`);
-            }
-            return parsed[0];
-          });
-          records.sort((left, right) => left.name.localeCompare(right.name));
-          writeFileSync("artifacts/registry/npm-pack.json", `${JSON.stringify(records, null, 2)}\n`);
-          NODE
+          go run ./internal/tools/npmregistry capture-pack-reports \
+            artifacts/registry/npm-pack.json \
+            artifacts/registry/pack-*.json
           npm run npm:registry-evidence
 
       - name: Verify root-only registry install and signatures
@@ -541,7 +528,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -602,7 +589,7 @@ jobs:
 
       - name: Publish to PyPI
         if: steps.pypi-preflight.outputs.skip_publish != 'true'
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: artifacts/pypi-dist
           print-hash: true
@@ -642,7 +629,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -653,9 +640,9 @@ jobs:
           cache: true
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 26.8.1
           package-manager-cache: false
 
       - name: Install verified npm
@@ -740,7 +727,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -763,17 +750,17 @@ jobs:
           path: artifacts/release
 
       - name: Attest release artifact provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-checksums: artifacts/release/checksums.sha256
 
       - name: Attest release metadata provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-checksums: artifacts/release/metadata-checksums.sha256
 
       - name: Attest release SBOM
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-checksums: artifacts/release/sbom-subjects.sha256
           sbom-path: artifacts/release/sbom.cdx.json
@@ -842,14 +829,14 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 24.18.0
+          node-version: 26.8.1
           package-manager-cache: false
 
       - name: Setup Go

diff --git a/.github/workflows/scorecard-publish.yml b/.github/workflows/scorecard-publish.yml
@@ -28,12 +28,12 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Publish Scorecard results
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           publish_results: true
           results_file: scorecard-public-results.json

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -27,12 +27,12 @@ jobs:
       pull-requests: read
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           publish_results: false
           results_file: scorecard-results.sarif
@@ -65,7 +65,7 @@ jobs:
           path: artifacts/scorecard
 
       - name: Upload Scorecard SARIF
-        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: artifacts/scorecard/scorecard-results.sarif
           category: scorecard-repository-hygiene
diff --git a/.github/workflows/semantic-diff.yml b/.github/workflows/semantic-diff.yml
@@ -30,11 +30,11 @@ jobs:
       SEM_LOCAL: "1"
       SEM_NO_TELEMETRY: "1"
       SEM_NO_UPDATE_CHECK: "1"
-      SEM_VERSION: v0.20.0
-      SEM_LINUX_X86_64_SHA256: cf7249d797bed05d59e16cfa1b417e872087d558611e9f675a13810edba33dbf
+      SEM_VERSION: v0.24.0
+      SEM_LINUX_X86_64_SHA256: 90f31b67a351aa2ec6492167d35c5636e9128bee9c528529219423c146831a4e
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false

diff --git a/BACKLOG.md b/BACKLOG.md
@@ -55,4 +55,4 @@ records, generated release manifests, or the owning docs named above.
 | DEFERRED | VALUE-01 | Admit exact value-evidence comparisons only after a real producer and downstream consumer establish the public record boundary; detailed candidate contract is retained in [issue #65](https://github.com/research-engineering/agentic-proofkit/issues/65). | A real execution-receipt projection, baseline producer, and downstream consumer prove an exact producer-output-to-admission round trip plus compact/full-graph inclusion or an intentional omission non-claim; otherwise no public command is added. |
 | BLOCKED | RELOCATION-01 | Add provenance-bounded witness relocation candidates without introducing a second binding path or trusting a caller-authored prior digest; detailed candidate contract is retained in [issue #66](https://github.com/research-engineering/agentic-proofkit/issues/66). | An owner-admitted content-addressed baseline binds witness id, prior path and digest, source revision, evidence class, authentication non-claims, and freshness non-claims; the scanner then proves the zero/one/many match partition while remaining non-current until fresh execution evidence exists. |
 | BLOCKED | RELEASE-01 | Prove signed protected-tag release policy as provider-side release governance, not source-only intent. | Repository tag protection/ruleset and release workflow variables require signed annotated release tags; the next public release records provider-side evidence or the row is explicitly retired as an accepted non-claim. |
-| BLOCKED | RELEASE-02 | Retire the inaccurate PyPI `0.1.159` wheel compatibility and license projection without mutating immutable release history. | After a public replacement release proves macOS 12.0 wheel tags, embedded MIT license identity, npm/PyPI/GitHub byte closure, and installed-package smoke, yank PyPI `0.1.159` with an exact compatibility-and-license reason and retain provider evidence of the yank. |
+| BLOCKED | RELEASE-02 | Retire the inaccurate PyPI `0.1.159` wheel compatibility and license projection without mutating immutable release history. | After a public replacement release proves that each advertised macOS wheel minimum is no lower than its embedded Mach-O minimum, embedded MIT license identity, npm/PyPI/GitHub byte closure, and installed-package smoke, yank PyPI `0.1.159` with an exact compatibility-and-license reason and retain provider evidence of the yank. |
diff --git a/README.md b/README.md
@@ -50,7 +50,7 @@ CLI, not as a Python SDK. Python projects should still treat CLI/JSON records,
 exit codes, and package metadata as the public contract.
 
 <!-- proofkit:platform-python:start -->
-Supported binary targets are macOS 12 or later on arm64 or x64.
+Supported binary targets are macOS 13 or later on arm64 or x64.
 Linux manylinux 2.17 or later is supported on arm64 or x64. Windows is unsupported. The Python
 runner requires Python 3.9 or later and wraps the same Go CLI; it is not a
 Python SDK.