| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| pic_standard-0.9.0a2-py3-none-any.whl | 2026-09-17 | 66.1 kB | |
| pic_standard-0.9.0a2-py3-none-any.whl.publish.attestation | 2026-09-17 | 9.6 kB | |
| pic_standard-0.9.0a2.tar.gz | 2026-09-17 | 113.8 kB | |
| pic_standard-0.9.0a2.tar.gz.publish.attestation | 2026-09-17 | 9.7 kB | |
| README.md | 2026-09-17 | 1.1 kB | |
| v0.9.0-alpha.2 source code.tar.gz | 2026-09-17 | 673.0 kB | |
| v0.9.0-alpha.2 source code.zip | 2026-09-17 | 820.2 kB | |
| Totals: 7 Items | 1.7 MB | 0 | |
v0.9.0a2: Independent Review Hardening
Alpha 2 stop in the v0.9.0a1 -> v0.9.0a2 -> v0.9.0 sequence.
Highlights:
- New PIC_DUPLICATE_ID error code and pipeline step 2c uniqueness check.
- Strict SHA-256 lowercase representation.
- Strict Base64 signature representation.
- Exact-value tool binding, with whitespace normalization removed.
- PipelineOptions.strict_trust now defaults to True.
- PICLegacyTrustModeWarning fires on explicit strict_trust=False.
- Adapter defaults aligned with the secure default.
- pic-cli verify --legacy-trust added as explicit compatibility opt-in.
- 11 new conformance vectors: 73 -> 84.
- Independent-review provenance docs added under docs/independent-reviews/.
Aggregated PRs: [#144], [#145], [#146], [#147], [#148].
The proposal envelope remains otherwise compatible with v0.9.0a1. Legacy trust mode remains callable as an explicit opt-in and is not scheduled for removal in the v0.9.x series.
TypeScript verifier parity is not shipped in v0.9.0a2 and remains the v0.9.0 final-release milestone.
Nothing in this release is a certification, audit, endorsement, or general security guarantee.
