Skip to content

Apizr 0.2.1

Published on 21 September 2026: PyPI and GitHub release.

0.2.1 strengthens maintenance checks and release evidence for the existing 0.2.x line. Python 3.11–3.14, static capability discovery and readiness, REST/MCP generation, the legacy pipeline and experimental governed execution remain supported with their existing contracts.

Changes since 0.2.0

  • Google Analytics is removed. Optional GitHub repository statistics remain off by default. New contributions require DCO 1.1 declarations; maintenance and coordinated security disclosure remain best-effort without guaranteed deadlines.
  • Ordinary descendant verification now requires disappearance or a zombie state within a bounded observation window and no continuing heartbeat. Failure output records process state, group, parent and available Linux signal data. This addresses #79 by strengthening the test; it does not change production execution or prove the cause of the older single-snapshot failure.
  • The required checks include 18 targeted security mutations, macOS validation, 90% global branch coverage and a separate measured legacy coverage floor.
  • CI preserves exact source/lock, runtime and validation SBOMs, test, coverage, mutation and dependency reports, and signed build provenance.
  • Publication produces a managed Apizr signature and RFC 3161 timestamp over a delivery receipt, then verifies identity, timestamp and artifact hashes before PyPI upload. The receipt binds previously verified files; it does not claim that Attest supervised their earlier build.
  • All 138 locked third-party versions have scoped license reviews, preserved notices and blocking license/archive/denied-package checks. See the dependency policy for review scope and redistribution obligations; this is not a complete native/container audit.
  • Documentation distinguishes published files from later verification builds, restores the repository release display, credits third-party assets and removes obsolete Product Hunt promotion. Pinned GitHub Actions were updated.

Compatibility and boundaries

No application feature is removed or introduced by this maintenance release. Static analysis does not execute supplied code. Direct generated servers import trusted source; governed invocation executes it in a worker. READY remains a static assessment, not a runtime security guarantee.

Local-process execution does not isolate filesystem/network access. OCI requires a trusted Linux Docker host and worker image and is not a VM. Class/method capabilities, absolute subprocess prohibition and the historical duplicate/ overload limitation retain their separate issue scopes. Release receipts do not add an Attest runtime API or user-facing signing feature to generated applications.

The original 0.2.0 files and tag remain unchanged.

Publication record

Tag v0.2.1 identifies 8ab471de436b1ca92a3b213c40402c5241926d5a. The release forwards the exact distributions from CI 35643284451, with Security 35643284471 and Documentation 35643284588 successful on that commit. All passed on their first attempt. There was no publication rebuild.

Distribution SHA-256
outerspace_apizr-0.2.1-py3-none-any.whl b726b3d4b67e0aca296cc53728a352211279e093475365dffb4bc1310853f69f
outerspace_apizr-0.2.1.tar.gz cf353c94d62df7b7ea555449788bff475991fd2af3a7f583cdd28e9784076079

Publication run 35649886030 verified provenance, signed and timestamped the delivery, published to PyPI and archived the evidence. The protected environment's normal reviews were used; no administrator bypass was enabled. All ten GitHub release assets were downloaded and compared with their verified inputs. Public PyPI metadata, README and downloaded wheel/sdist bytes match the hashes above.

The attached apizr-attest-receipt.tar.gz has SHA-256 214787e167c8f6c92885b7ee8eacf4eb60204ba980e024219d16d0e43b3c8666. Its RFC 3161 timestamp is 2026-09-21T20:16:30Z. Independent offline verification after extraction, using the repository's separately held trust store, passed schema, consistency, expected Apizr signature, timestamp and recomputation, without warnings. The manifest binds the distributions, CI/dependency evidence, exact source commit and CI run. This is the delivered release receipt, distinct from the earlier identity-setup and local signing tests.

A fresh Python 3.14 environment installed outerspace-apizr==0.2.1 from the public PyPI index. Outside checkout, version detection, all six introductory README commands, governed execution and legacy notebook generation passed. The master CI separately passed Python 3.11–3.14, macOS and OCI validation: Linux reports 1,585 passing tests and 38 intentional skips per Python version; macOS reports 1,584 passing tests and 39 skips. The dedicated OCI suite is recorded separately; repeated samples are not additional distinct cases. All 18 targeted security mutations were detected.

The published documentation was checked in fresh browser contexts and with a previously stored Analytics consent: neither the Analytics loader nor Analytics requests remained. Optional GitHub statistics remain off by default. Google Fonts requests are separate existing theme behavior; removal of Analytics is not a claim that the site makes no third-party requests.

See verification commands, managed identity and trust and maintainer publication instructions.