feat: prove PCEA 0.1.0 release readiness

.agents/skills/README.md

@@ -6,14 +6,19 @@ Canonical source:
 - Preferred: `The-Interdependency/skill-lib`
 - Temporary source: `The-Interdependency/a0/skill-lib`
 
-Source commit: `The-Interdependency/skill-lib` @ `a0cb6285e37734609b4b487ae4a2e44c6108d2b8` (verbatim sync).
+Source commit: `The-Interdependency/skill-lib` @ `5c46d0534fa0726a9078f0a242c66a217fbaa501` (verbatim sync).
 
 Installed skills:
 - `msdmd/` — Module Self-Declared Metadata Markdown
 - `test-build/` — test contract metadata blocks
 - `meta-module-build/` — metadata-first module scaffolding
-- `manifest/` — living-spec generator for `CLAUDE.md` (vendored from `The-Interdependency/skill-lib@05ee7aa`); CI runs `generate.py --check`. Refresh with `python .agents/skills/manifest/generate.py --write`.
+- `manifest/` — living-spec generator for `CLAUDE.md`; CI runs `generate.py --check`. Refresh with `python .agents/skills/manifest/generate.py --write`.
 
 Agents working in this repo should read `meta-module-build/SKILL.md` before
 creating new modules, routes, services, schemas, adapters, workers, engines,
 UI panels, migrations, or experiments.
+
+Usage guidance:
+- Treat the source commit above as the exact canonical snapshot for vendored skill files.
+- Run the repository's manifest/skill drift workflow after changing `.agents/skills/`.
+- Update vendored canonical files only by propagation from `The-Interdependency/skill-lib`; keep repo-local additions explicitly local.

.github/workflows/contract-boundary.yml

@@ -1,25 +1,55 @@
-name: contract-boundary
+name: full-suite
 
 on:
   pull_request:
   push:
     branches: [ main ]
 
 jobs:
-  boundary:
+  test:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version: ["3.9", "3.11", "3.13"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install package with dev dependencies
         run: |
           python -m pip install --upgrade pip
           python -m pip install -e ".[dev]"
-      - name: Run contract boundary tests
+      - name: Run full repository test suite
         run: |
-          PYTHONPATH=. python -m pytest -q tests/test_contract_spec.py
+          PYTHONPATH=. python -m pytest -q
+
+  release-artifact:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+      - name: Build wheel from declared package metadata
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip wheel . --no-deps --wheel-dir dist
+      - name: Install wheel outside the source tree and smoke-test public package
+        shell: bash
+        run: |
+          set -euo pipefail
+          wheel=$(printf '%s\n' dist/pcea-*.whl)
+          test -f "$wheel"
+          python -m venv /tmp/pcea-release-smoke
+          /tmp/pcea-release-smoke/bin/python -m pip install --no-deps "$wheel"
+          cd /tmp
+          /tmp/pcea-release-smoke/bin/python - <<'PY'
+          from importlib.metadata import version
+          import pcea
+
+          assert version("pcea") == "0.1.0"
+          assert callable(pcea.encrypt_state)
+          assert callable(pcea.decrypt_state)
+          assert pcea.PCEAInstance is not None
+          PY

.github/workflows/manifest-check.yml

@@ -1,8 +1,11 @@
-name: manifest drift check
+name: manifest and skill drift check
 
 # Living-spec gate: fails if CLAUDE.md's generated manifest block has drifted
 # from pyproject.toml / the repo tree. Refresh locally with:
 #   python .agents/skills/manifest/generate.py --write
+#
+# Canonical-skill gate: checks the vendored subset byte-for-byte against the
+# exact skill-lib source commit recorded in .agents/skills/README.md.
 
 on:
   pull_request:
@@ -12,15 +15,43 @@ on:
 permissions:
   contents: read
 
+env:
+  SKILL_LIB_SHA: 5c46d0534fa0726a9078f0a242c66a217fbaa501
+
 jobs:
   manifest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.11'
       - name: Vendored generate.py matches skill-lib (no local fork)
         run: cd .agents/skills/manifest && sha256sum -c generate.py.sha256
       - name: Check CLAUDE.md manifest block is in sync
         run: python .agents/skills/manifest/generate.py --root . --check
+
+  skill-drift:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out PCEA
+        uses: actions/checkout@v7
+        with:
+          path: pcea
+      - name: Check out exact canonical skill-lib snapshot
+        uses: actions/checkout@v7
+        with:
+          repository: The-Interdependency/skill-lib
+          ref: ${{ env.SKILL_LIB_SHA }}
+          path: skill-lib
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+      - name: Verify vendored canonical skills and source citation
+        run: |
+          python skill-lib/tools/check_consumer_drift.py pcea \
+            --canon-root skill-lib \
+            --sha "$SKILL_LIB_SHA" \
+            --strict-sha \
+            --require-vendored

README.md

@@ -8,6 +8,15 @@ PCEA encrypts pre-quantized integer neural architecture state using the relation
 
 Runtime state is structured as a list of seeds. Each seed is a `7×7` integer array: 7 circles × 7 tensors.
 
+## Security status
+
+**Experimental research software.** PCEA has not undergone independent
+cryptographic review and is not claimed suitable for protecting sensitive or
+production data. Version 0.1.0, if released, is a research release of the
+symmetric transform and its falsification/proving harnesses. Where real-world
+confidentiality is required, use reviewed standard cryptography rather than
+substituting PCEA for it.
+
 ## Algorithm
 
 For each integer value at address `(seed_idx, circle_idx, tensor_idx)`:
@@ -63,21 +72,23 @@ assert dec.decrypt(e2) == [state2]
 
 The shipped `pcea/` package is the symmetric, state-synchronized transform described above. Its correctness and contract tests live in `tests/test_cipher.py`, `tests/test_codec.py`, `tests/test_kdf.py`, `tests/test_instance.py`, and `tests/test_contract_spec.py`.
 
-The `pcea-ucns/` directory is different: it is an attack-and-feasibility workspace for possible UCNS-native key-establishment or gonal/state-communication layers around PCEA. Those files do **not** upgrade the symmetric PCEA runtime into a proven public-key encryption system. They record candidate constructions, measured breaks, and open gates for any future PCEA-UCNS layer. See `pcea-ucns/README.md` for the concrete proving-ground workflow.
+The `pcea-ucns/` directory is different: it is an attack-and-feasibility workspace for possible UCNS-native key-establishment, authenticated-session, or gonal/state-communication layers around PCEA. Those files do **not** upgrade the symmetric PCEA runtime into a proven public-key encryption or production-secure session system. They record candidate constructions, measured breaks, surviving regression checks, and open gates. See `pcea-ucns/README.md` for the concrete proving-ground workflow.
 
 Important testing boundaries:
 
 - PCEA runtime tests run without `ucns` and cover round trips, key-state mismatch behavior, fixed-width codec behavior, KDF determinism/sensitivity, and state advancement.
 - PCEA-UCNS tests are attack/regression harnesses. They are skipped when `ucns` is not installed, keeping the symmetric runtime testable without UCNS.
 - Passing a PCEA-UCNS harness means only that the measured behavior has not drifted; it is not a proof of cryptographic security.
 - Several PCEA-UCNS harnesses intentionally pin breaks or negative findings, including oracle-domain factorization, positional/factor-count attacks, prefix-read reconstruction, and Minkowski set-basis recovery.
+- `ratcheted_session.py` is a non-runtime prototype around provisioned PCEA state; its current replay/transcript/rollback/key-separation tests are prerequisites for harder attack work, not a promotion certificate.
 - The gonal architecture tests include a measured PCEA-advanced candidate that resists simple frequency/known-plaintext probes in the harness, but the module still marks further attacks and the 53→32 bridge as gates before any shipped `gonal_cipher.py`.
 
 Useful commands:
 
 ```bash
 python -m pytest -q
 python -m pytest -q tests/test_cipher.py tests/test_codec.py tests/test_kdf.py tests/test_instance.py tests/test_contract_spec.py
+python -m pytest -q tests/test_ratcheted_session.py tests/test_option_family_specs.py
 python -m pytest -q tests/test_attack_harness.py tests/test_positional_attack.py tests/test_quotient_attack.py tests/test_prefix_read_break.py tests/test_projection_action_candidate.py tests/test_pruning_scaling.py tests/test_attack1_minkowski_break.py tests/test_three_factor_attack.py tests/test_factor_count_sweep.py tests/test_gonal_architecture.py
 ```
 
@@ -95,7 +106,7 @@ This keeps PCEA cryptographic claims decoupled from UCNS analytic-frontier work.
 Enforcement:
 
 - `tests/test_contract_spec.py` is a release gate for this boundary.
-- `.github/workflows/contract-boundary.yml` runs this gate in CI for pull requests and pushes to `main`.
+- `.github/workflows/contract-boundary.yml` runs the **full repository suite** on Python 3.9, 3.11, and 3.13 for pull requests and pushes to `main`, and also builds/installs the declared wheel outside the source tree as a release-artifact smoke test.
 
 ## Install