Ship reproducible pubskill-lib v0.2.0 artifacts and installed provenance

[erinepshovel-code]

Installed wheels currently lose the canonical source identity because the audit searches for a checkout-only SOURCE.md. The package now ships that identity as a resource and includes the full replay inputs in its source archive.

The release builder uses a clean exact Git archive, a pinned build toolchain, normalized source and wheel archive metadata, and a manifest binding source, doctrine, toolchain, and artifact hashes. CI compares two builds, then runs the repository tests against clean wheel and sdist installs on Python 3.11 and 3.12.

Validation at 0c305f0: two builds have identical SHA256SUMS; all 75 tests pass under each artifact on both Python versions. The fixture produces its three expected findings and the real stack audit has zero findings, with the exact canonical pin retained in every install. Release publication will use these verified bytes after this exact commit is accepted.

Independent CI builds use managed CPython 3.11.15 and enforce zlib 1.3.1; their Python 3.11/3.12 verification jobs report the same wheel and sdist hashes as the locally verified candidate. Both local and CI reproduction compare 022 and 077 file-creation masks.

Accepted exact review: #5 (comment). CI: https://github.com/The-Interdependency/pubskill-lib/actions/runs/34687143683. CodeQL archive-extraction alert 2 is fixed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-12T10:02:39.774472Z	0c305f0	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[erinepshovel-code]

@codex review

Please review exact head 9ad8f81497734abb687ca5f88b84448fd311ccb6. This release change packages canonical source provenance and the complete replay inputs, builds normalized wheel/sdist artifacts from immutable Git source with a pinned toolchain, and tests installed artifacts on Python 3.11 and 3.12.

Two local builds under 022/077 masks are byte-identical. All 74 tests pass from each artifact on both runtimes; independent CI wheel/sdist hashes match the local candidate. The fixture has its three expected findings, and the real stack consumer at c2512a5f043d106e6f4ab198a5ae56c937d66558 has zero findings with the canonical pin retained. Publication will upload these same verified bytes after this source is accepted, followed by unauthenticated public-download and consumer verification.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9ad8f81497

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[erinepshovel-code]

@codex review

Please review exact head 24622c9e84eee1c4903382d35da84d33029e3b06. The release builder now rejects any compile-time or runtime zlib other than 1.3.1 and records both identities. CI builds with uv-managed CPython 3.11.15 carrying that compressor; installed artifact suites still run on Python 3.11 and 3.12. A regression exercises both mismatches; all 75 local tests pass. The archive extraction also uses the standard data filter, and CodeQL reports alert 2 fixed. Fresh candidate builds and clean artifact qualification are underway for these exact bytes.

[erinepshovel-code]

@codex review

Please review exact head 0c305f049ed238de95fe516df6734f1dbee09a08. The compressor pin (zlib compile/runtime 1.3.1) and extraction filter are in place. The uv build-environment setup is corrected. CI https://github.com/The-Interdependency/pubskill-lib/actions/runs/34687143683 passes on 3.11/3.12. All eight CI payload hashes equal the local candidate; two builds under umasks 022/077 match across all four release files. Four clean wheel/sdist installs each pass 75 tests, the fixture returns three findings, and real stack consumption returns zero. Publication remains gated on this exact review.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 0c305f049e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".