chore: promote qualified public candidate

.github/CODEOWNERS

@@ -1,8 +1,4 @@
-# Temporary bootstrap owner. This does not provide independent review when that owner
-# authors a change. Code-owner review is required by the default-branch ruleset as of
-# the 2026-08-10 audit, so this file is live enforcement, not a placeholder: replace
-# it with an independent, write-capable owner or team, then update the live protection
-# and the governance records together.
+# Default owners for repository content.
 * @picogrid/edge
 
 # Public runtime, protocol boundary, and artifact policy.

.github/workflows/release.yml

@@ -17,10 +17,9 @@ env:
   UV_VERSION: "0.7.20"
 
 jobs:
-  # Release Please authors version-bump pull requests, so it may only run in the
-  # private engineering upstream. Public main accepts byte-preserving export merges
-  # exclusively; a bump commit authored there would break the export equivalence
-  # barrier described in PUBLIC_DISTRIBUTION.md.
+  # The canonical public repository derives release state from its immutable version
+  # tag. Release Please is reserved for repositories where automated version PRs are
+  # explicitly enabled.
   release-please:
     name: Prepare or create a draft release
     if: >-
@@ -48,14 +47,13 @@ jobs:
           manifest-file: .github/.release-please-manifest.json
           target-branch: main
 
-  # Every downstream job consumes this job's outputs, never Release Please's
-  # directly. In the private upstream it passes the Release Please outputs through
-  # unchanged. In the public distribution repository, where Release Please is
-  # deliberately disabled, it derives the same identity from the merged and
-  # equivalence-verified tree: the version is read from pyproject.toml, the tag is
-  # that version prefixed with "v", and release state is resolved by immutable tag
-  # and numeric release ID. A merged tree that resolves to an already published
-  # release stops without rebuilding or publishing.
+  # Every downstream job consumes normalized outputs rather than binding directly
+  # to one release-state provider. For the canonical public repository, Release
+  # Please is skipped while release automation is enabled, so the repository derives
+  # the same identity from the merged and equivalence-verified tree: the version
+  # comes from pyproject.toml, and release state is resolved by immutable tag and
+  # numeric release ID. A tree that resolves to an already published release stops
+  # without rebuilding or publishing.
   resolve-release:
     name: Resolve the release candidate identity
     if: >-

.github/workflows/scorecard.yml

@@ -39,9 +39,8 @@ jobs:
         with:
           results_file: results.sarif
           results_format: sarif
-          # Publish only from the public distribution repository, and only once
-          # the cutover step that authorizes publication sets the opt-in
-          # variable there. The byte-identical private copy never publishes.
+          # Publish only from the canonical public repository after the explicit
+          # publication opt-in is enabled.
           publish_results: >-
             ${{ github.repository == 'picogrid/ecn-sdk-python'
             && vars.SCORECARD_PUBLISH_ENABLED == 'true' }}

.gitignore

@@ -15,7 +15,6 @@ src/*.egg-info/
 **/__pycache__/
 # Credential-like files stay visible to repository and release scans.
 .worktrees/
-.claude/
 
 # Playwright run output
 test-results/

CHANGELOG.md

@@ -80,6 +80,10 @@ published.
 - Mock results validate SDK behavior but do not establish compatibility with a
   deployed ECN.
 
+- The versioned `ecn-wire-conformance` corpus (version 0.2) pins every fixture by
+  SHA-256, pins canonical JSON encodings where applicable, and fails CI on unhashed
+  corpus changes.
+
 ### Documentation
 
 - A published documentation site provides installation, authentication, preflight,

CONTRIBUTING.md

@@ -85,6 +85,9 @@ Use the complete release gate for the final candidate:
 make verify-release
 ```
 
+Run the release gate from a clean Git worktree. It fails before building when tracked
+or untracked changes prevent the candidate from being attributed to one commit.
+
 The release gate removes `node_modules`, `.astro`, and `site-dist` while reproducing
 the release environment. Run `make docs-install` again before another documentation
 check or preview.

MANIFEST.in

@@ -40,10 +40,8 @@ include docs/quickstarts/sensor-publisher.md
 include docs/reference/api.md
 include docs/reference/configuration.md
 include docs/reference/coordinate-reference.md
-include docs/reference/evidence-status.md
 include docs/reference/exceptions.md
 include docs/reference/licensing.md
-include docs/reference/original-ecn-integration-parity.md
 include docs/reference/wire-formats.md
 include docs/security/credentials.md
 include docs/shipped-tooling.md
@@ -180,7 +178,6 @@ include operator-app/tests/publication-screenshot.spec.ts
 include operator-app/tests/screenshot.config.ts
 include operator-app/tsconfig.json
 include scripts/generate_api_reference.py
-include scripts/original-guide-inventory.json
 include scripts/public-api-manifest.json
 include scripts/release-policy.json
 include scripts/type-completeness-allowlist.json

Makefile

@@ -1,9 +1,7 @@
 UV ?= uv
 SOURCE_DATE_EPOCH ?= 1735689600
-PUBLIC_EXPORT_DIR ?= build/public-export
-PUBLIC_EXPORT_RECORD ?= build/public-export-record.json
 
-.PHONY: check-deps check-license sync-deps generate-reference check-reference verify-types verify-release version-sync check-public-export public-export dry-run-cutover docs-install docs-check docs-smoke-local wheelhouse
+.PHONY: check-deps check-license sync-deps generate-reference check-reference verify-types verify-release version-sync docs-install docs-check docs-smoke-local wheelhouse
 
 docs-install:
 	npm --prefix docs ci
@@ -42,14 +40,7 @@ verify-release: check-deps check-license
 version-sync:
 	PYTHONDONTWRITEBYTECODE=1 $(UV) run --frozen python -m scripts.version_sync
 
-check-public-export:
-	PYTHONDONTWRITEBYTECODE=1 $(UV) run --python 3.11 --no-project --with packaging==26.3 python -m scripts.public_export --verify
-
-public-export:
-	PYTHONDONTWRITEBYTECODE=1 $(UV) run --python 3.11 --no-project --with packaging==26.3 python -m scripts.public_export --out "$(PUBLIC_EXPORT_DIR)" --record "$(PUBLIC_EXPORT_RECORD)" --clean
-
-dry-run-cutover:
-	PYTHONDONTWRITEBYTECODE=1 $(UV) run --python 3.11 --no-project --with packaging==26.3 python -m scripts.public_export --dry-run-cutover
+-include scripts/public-export.mk
 
 wheelhouse:
 	PYTHONDONTWRITEBYTECODE=1 $(UV) run --python 3.11 --no-project --with pip python -m scripts.build_wheelhouse