From 9d8a0f33a1fcf3075299f3a34941a4393cf6aa15 Mon Sep 17 00:00:00 2001 From: D Thomas <146stat@gmail.com> Date: Mon, 3 Aug 2026 06:37:02 +0000 Subject: [PATCH] release: prepare QuantumD 0.7.5a0 for production PyPI --- .github/workflows/publish-pypi.yml | 309 +++++++++++++++++++++++++++ CHANGELOG.md | 9 + README.md | 84 +++----- docs/getting-started/installation.md | 201 ++++++----------- docs/releases/v0.7.5-alpha.md | 43 ++++ mkdocs.yml | 1 + pyproject.toml | 4 +- 7 files changed, 464 insertions(+), 187 deletions(-) create mode 100644 .github/workflows/publish-pypi.yml create mode 100644 docs/releases/v0.7.5-alpha.md diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml new file mode 100644 index 0000000..1f7c811 --- /dev/null +++ b/.github/workflows/publish-pypi.yml @@ -0,0 +1,309 @@ +name: Production PyPI Release + +on: + workflow_dispatch: + pull_request: + paths: + - ".github/workflows/publish-pypi.yml" + - "pyproject.toml" + - "README.md" + - "src/**" + - "tests/**" + push: + tags: + - "v*-alpha" + +permissions: + contents: read + +jobs: + build: + name: Build and independently verify release + runs-on: ubuntu-latest + timeout-minutes: 35 + + permissions: + contents: read + id-token: write + + steps: + - name: Check out release commit + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + + - name: Set up Python 3.12 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.12" + cache: pip + cache-dependency-path: pyproject.toml + + - name: Install test and build tools + run: | + python -m pip install --upgrade pip + python -m pip install build twine + python -m pip install -e ".[dev]" + + - name: Enforce tag and package-version contract + run: | + python - <<'PY' + import os + import re + import tomllib + from pathlib import Path + + project = tomllib.loads( + Path("pyproject.toml").read_text() + )["project"] + + version = project["version"] + ref_type = os.environ.get("GITHUB_REF_TYPE") + ref_name = os.environ.get("GITHUB_REF_NAME") + + print(f"Package version: {version}") + print(f"GitHub ref: {ref_type}:{ref_name}") + + if ref_type == "tag": + match = re.fullmatch( + r"v(\d+)\.(\d+)\.(\d+)-alpha", + ref_name, + ) + assert match, ( + f"Unsupported release tag: {ref_name}" + ) + + major, minor, patch = match.groups() + expected = ( + f"{major}.{minor}.{patch}a0" + ) + + assert version == expected, ( + f"Tag {ref_name} requires package " + f"version {expected}, found {version}" + ) + + print("Tag/version contract: PASS") + else: + print( + "Manual build validation: " + "tag contract not applicable" + ) + PY + + - name: Compile and test source + run: | + python -m compileall -q src + python -m pytest -q + + - name: Build and validate distributions + run: | + rm -rf build dist src/*.egg-info + python -m build + python -m twine check dist/* + + - name: Inspect release wheel + run: | + python - <<'PY' + from pathlib import Path + from zipfile import ZipFile + + wheels = list(Path("dist").glob("quantumd-*.whl")) + assert len(wheels) == 1, wheels + + wheel = wheels[0] + schema = ( + "quantumd/schemas/" + "experiment-v0.1.schema.json" + ) + + with ZipFile(wheel) as archive: + names = archive.namelist() + assert schema in names + + metadata_name = next( + name + for name in names + if name.endswith(".dist-info/METADATA") + ) + + metadata = archive.read( + metadata_name + ).decode("utf-8") + + assert "Name: quantumd" in metadata + assert ( + "License-Expression: Apache-2.0" + in metadata + ) + + print(f"Wheel: {wheel}") + print("Release wheel inspection: PASS") + PY + + - name: Install built wheel into isolated release environment + run: | + WHEEL="$( + find "$GITHUB_WORKSPACE/dist" \ + -maxdepth 1 \ + -type f \ + -name 'quantumd-*.whl' \ + -print \ + -quit + )" + + test -n "$WHEEL" + + rm -rf /tmp/quantumd-release-wheel + python -m venv /tmp/quantumd-release-wheel + + /tmp/quantumd-release-wheel/bin/python \ + -m pip install --upgrade pip + + /tmp/quantumd-release-wheel/bin/python \ + -m pip install "$WHEEL" + + cd /tmp + + /tmp/quantumd-release-wheel/bin/python - <<'PYTHON' + from importlib.metadata import version + from importlib.resources import files + + import quantumd + + schema = files("quantumd.schemas").joinpath( + "experiment-v0.1.schema.json" + ) + + assert schema.is_file() + + print(f"Package: {quantumd.__file__}") + print(f"Version: {version('quantumd')}") + print(f"Schema: {schema}") + print("Release-wheel installation: PASS") + PYTHON + + - name: Validate protected release configuration + if: github.ref_type == 'tag' + env: + GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }} + GCP_WIF_PROVIDER: ${{ vars.GCP_WIF_PROVIDER }} + GCP_RELEASE_SERVICE_ACCOUNT: ${{ vars.GCP_RELEASE_SERVICE_ACCOUNT }} + QUANTUMD_KMS_KEY_VERSION: ${{ vars.QUANTUMD_KMS_KEY_VERSION }} + run: | + test -n "$GCP_PROJECT_ID" + test -n "$GCP_WIF_PROVIDER" + test -n "$GCP_RELEASE_SERVICE_ACCOUNT" + test -n "$QUANTUMD_KMS_KEY_VERSION" + + case "$GCP_WIF_PROVIDER" in + projects/*/locations/global/workloadIdentityPools/*/providers/*) + ;; + *) + echo "Invalid Workload Identity provider" + exit 1 + ;; + esac + + case "$QUANTUMD_KMS_KEY_VERSION" in + projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*) + ;; + *) + echo "Invalid QuantumD KMS key version" + exit 1 + ;; + esac + + echo "Protected release configuration: PASS" + + - name: Authenticate to Google Cloud for release signing + if: github.ref_type == 'tag' + uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 + with: + workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }} + service_account: ${{ vars.GCP_RELEASE_SERVICE_ACCOUNT }} + project_id: ${{ vars.GCP_PROJECT_ID }} + create_credentials_file: true + export_environment_variables: true + + - name: Run KMS-attested governed release demonstration + if: github.ref_type == 'tag' + env: + QUANTUMD_KMS_KEY_VERSION: ${{ vars.QUANTUMD_KMS_KEY_VERSION }} + run: | + cd /tmp + + /tmp/quantumd-release-wheel/bin/quantumd \ + demo --shots 128 + + - name: Verify manual release build fails closed without KMS + if: github.ref_type != 'tag' + run: | + unset QUANTUMD_KMS_KEY_VERSION + unset GOOGLE_APPLICATION_CREDENTIALS + unset GOOGLE_GHA_CREDS_PATH + + cd /tmp + + set +e + DEMO_OUTPUT="$( + /tmp/quantumd-release-wheel/bin/quantumd \ + demo --shots 128 2>&1 + )" + DEMO_STATUS=$? + set -e + + printf '%s\n' "$DEMO_OUTPUT" + + test "$DEMO_STATUS" -ne 0 + + grep -F \ + "Evidence record is not signed." \ + <<< "$DEMO_OUTPUT" + + grep -F \ + "[STATUS] EXECUTION DENIED: AUTHORIZATION_FAILED" \ + <<< "$DEMO_OUTPUT" + + if grep -Fq \ + "EXECUTION COMPLETED AND ATTESTED" \ + <<< "$DEMO_OUTPUT" + then + echo "ERROR: Unsigned release unexpectedly executed." + exit 1 + fi + + echo "Manual release fail-closed check: PASS" + + - name: Upload verified release distributions + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 + with: + name: release-distributions + path: dist/* + if-no-files-found: error + retention-days: 14 + + publish-pypi: + name: Publish through production PyPI OIDC + if: >- + github.event_name == 'push' && + github.ref_type == 'tag' + needs: + - build + runs-on: ubuntu-latest + timeout-minutes: 10 + + environment: + name: pypi + url: https://pypi.org/p/quantumd + + permissions: + id-token: write + + steps: + - name: Retrieve verified distributions + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + with: + name: release-distributions + path: dist/ + + - name: Publish distributions to production PyPI + uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 diff --git a/CHANGELOG.md b/CHANGELOG.md index 00fc3db..5c566d9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,14 @@ # Changelog +## 0.7.5a0 - 2026-08-03 +### Production PyPI installation +- Added protected production PyPI publishing through GitHub OIDC. +- Made `python -m pip install quantumd` the primary installation path. +- Added `pipx` and `uv tool` paths for users who do not want to manage a virtual environment. +- Retained one complete QuantumD dependency set. +- Added Python 3.10 and Python 3.11 package classifiers. +- Preserved simulator-only local trust, hardware prohibition, and independent evidence verification. + ## Unreleased ### Public installation hardening - Added a guided Linux and WSL bootstrap using a `uv`-managed Python 3.12 environment. diff --git a/README.md b/README.md index 0514be5..6ab00c4 100644 --- a/README.md +++ b/README.md @@ -56,7 +56,7 @@ matches your role or question. | A first-time reader | [Public alpha installation](docs/getting-started/installation.md) | [Local quickstart](docs/getting-started/quickstart.md) | | A quantum developer | [Evidence Graph](docs/concepts/evidence-graph.md) | [IBM Quantum workflow](docs/providers/ibm-quantum.md) | | A security or DevSecOps engineer | [Trust boundary](docs/concepts/trust-boundary.md) | [Verify an evidence chain](docs/guides/verifying-a-chain.md) | -| A reviewer, auditor, or program leader | [What the Evidence Graph records](docs/concepts/evidence-graph.md) | [v0.7.4 alpha release](docs/releases/v0.7.4-alpha.md) | +| A reviewer, auditor, or program leader | [What the Evidence Graph records](docs/concepts/evidence-graph.md) | [v0.7.5 alpha release](docs/releases/v0.7.5-alpha.md) | | An educator, researcher, or advanced student | [Local simulation](docs/guides/local-simulation.md) | [Alpha evaluation](docs/alpha-evaluation.md) | | A contributor | [Contributing guide](CONTRIBUTING.md) | [Roadmap](docs/roadmap.md) | | A security researcher | [Security policy](SECURITY.md) | [Support boundaries](SUPPORT.md) | @@ -95,64 +95,50 @@ the same as a verified chain connecting approval to execution and results. ## Run the public alpha -QuantumD `0.7.4a0` is published on TestPyPI. Use an isolated Python environment -and download only the QuantumD wheel from TestPyPI. Dependencies are installed -from the default Python Package Index. +QuantumD `0.7.5a0` is distributed through production PyPI. The complete +QuantumD dependency set remains available through one installation. -### 1. Create a supported isolated environment - -The recommended Linux and WSL path uses `uv`, so the setup does not depend on -the operating system's default Python or `venv` package: +### 1. Install QuantumD ```bash -curl -LsSf https://astral.sh/uv/install.sh | sh -export PATH="$HOME/.local/bin:$PATH" - -uv python install 3.12 -uv venv --python 3.12 --seed ~/.venvs/quantumd-alpha -source ~/.venvs/quantumd-alpha/bin/activate -python --version +python -m pip install quantumd ``` -QuantumD supports Python 3.10 and newer. Python 3.12 is the reference alpha -environment. Users who already have a supported Python and working `venv` may -use the standard-library environment path described in the -[installation guide](docs/getting-started/installation.md). +QuantumD does not require you to create a virtual environment. The command +installs into the Python environment associated with `python`. During alpha +evaluation, you can pin the exact release: + +```bash +python -m pip install "quantumd==0.7.5a0" +``` -### 2. Download and verify the exact wheel +On systems that protect the system Python, install the command without manually +managing an environment: ```bash -python -m pip download \ - --no-deps \ - --only-binary=:all: \ - --index-url https://test.pypi.org/simple/ \ - quantumd==0.7.4a0 - -echo \ - "761a865a5aaf655f570fa3ae6f1d0f9b1b09cb89ee5519ac1843b738d251b7d2 quantumd-0.7.4a0-py3-none-any.whl" \ - | sha256sum --check +pipx install quantumd ``` -### 3. Install and run the local workflow +or: ```bash -python -m pip install \ - ./quantumd-0.7.4a0-py3-none-any.whl +uv tool install --python 3.12 quantumd +``` + +### 2. Run the local governed workflow +```bash quantumd quickstart my-first-quantumd-project ``` -### 4. Inspect and independently verify the evidence +### 3. Inspect and independently verify the evidence ```bash quantumd doctor my-first-quantumd-project - -quantumd verify-chain \ - my-first-quantumd-project \ - --latest +quantumd verify-chain my-first-quantumd-project --latest ``` -The local quickstart is intentionally restricted: +The local quickstart remains intentionally restricted: ```text Trust mode: LOCAL_DEVELOPMENT @@ -172,10 +158,10 @@ KMS contacted: False Hardware action: None ``` -For expanded instructions, the guided bootstrap, WSL troubleshooting, -checksum details, and source development installation, see the -[installation guide](docs/getting-started/installation.md) and -[platform-support matrix](docs/getting-started/platform-support.md). +QuantumD supports Python 3.10, 3.11, and 3.12. Python 3.12 remains the +reference release environment. See the +[installation guide](docs/getting-started/installation.md) for exact-version, +`pipx`, `uv tool`, WSL, and source-development paths. ## The Evidence Graph @@ -251,7 +237,7 @@ Read [Trust modes](docs/concepts/trust-modes.md) for the complete boundaries. | Document | What it helps you do | |---|---| -| [Installation](docs/getting-started/installation.md) | Install the exact public-alpha wheel or create a source-development environment | +| [Installation](docs/getting-started/installation.md) | Install QuantumD from production PyPI or create a source-development environment | | [Local quickstart](docs/getting-started/quickstart.md) | Create a governed simulator project and verify its evidence | | [Local simulation](docs/guides/local-simulation.md) | Understand the simulator-first workflow | | [Verify an evidence chain](docs/guides/verifying-a-chain.md) | Independently inspect the latest execution chain | @@ -272,7 +258,7 @@ Read [Trust modes](docs/concepts/trust-modes.md) for the complete boundaries. |---|---| | [Alpha evaluation](docs/alpha-evaluation.md) | Test the stranger experience and provide structured feedback | | [Evaluator worksheet](ALPHA_TESTING.md) | Record installation time, confusion, skepticism, and next-use cases | -| [v0.7.4 alpha release](docs/releases/v0.7.4-alpha.md) | Review the published alpha, checksum, and validated boundaries | +| [v0.7.5 alpha release](docs/releases/v0.7.5-alpha.md) | Review the published alpha, checksum, and validated boundaries | | [Security policy](SECURITY.md) | Report vulnerabilities privately and understand security-sensitive areas | | [Contributing](CONTRIBUTING.md) | Set up development and preserve fail-closed behavior | | [Support](SUPPORT.md) | Choose the correct public or private support channel | @@ -334,12 +320,12 @@ that generated it. ## Release provenance -The current public alpha is `v0.7.4-alpha`, published as Python package version -`0.7.4a0`. +The current production PyPI alpha is `v0.7.5-alpha`, published as Python +package version `0.7.5a0`. -- Release notes: [v0.7.4 alpha](docs/releases/v0.7.4-alpha.md) -- Package checksum: - `761a865a5aaf655f570fa3ae6f1d0f9b1b09cb89ee5519ac1843b738d251b7d2` +- Production package: [PyPI quantumd](https://pypi.org/project/quantumd/) +- Release notes: [v0.7.5 alpha](docs/releases/v0.7.5-alpha.md) +- Publishing identity: GitHub Actions Trusted Publishing through OIDC - Website: [quantumd.ai](https://quantumd.ai) - License: [Apache License 2.0](LICENSE) diff --git a/docs/getting-started/installation.md b/docs/getting-started/installation.md index f35eaec..656495e 100644 --- a/docs/getting-started/installation.md +++ b/docs/getting-started/installation.md @@ -1,188 +1,127 @@ # Installation -QuantumD runs on Linux, Windows Subsystem for Linux, Google Cloud Shell, and -other compatible Python environments. +QuantumD supports Python 3.10, 3.11, and 3.12 on Linux, Windows Subsystem for +Linux, Google Cloud Shell, and other compatible Python environments. Python +3.12 is the reference release environment. -The public alpha requires Python 3.10 or newer. Python 3.12 is the reference -environment used by release and acceptance workflows. +## Fastest installation -## Recommended environment setup - -Use `uv` when the computer does not already have a supported Python and working -virtual-environment support. This is the recommended path for WSL and for older -Linux distributions. - -Install `uv` for the current user: +Install the complete QuantumD package from production PyPI: ~~~bash -curl -LsSf https://astral.sh/uv/install.sh | sh -export PATH="$HOME/.local/bin:$PATH" +python -m pip install quantumd ~~~ -Install the reference Python and create one dedicated environment: +QuantumD does not require you to create a virtual environment. It installs into +the Python environment associated with the `python` command. -~~~bash -uv python install 3.12 -uv venv --python 3.12 --seed ~/.venvs/quantumd-alpha -source ~/.venvs/quantumd-alpha/bin/activate -python --version -~~~ - -Expected Python output begins with `Python 3.12`. - -For later terminal sessions, do not recreate the environment. Activate the same -one: +For a reproducible alpha evaluation, pin the release: ~~~bash -source ~/.venvs/quantumd-alpha/bin/activate +python -m pip install "quantumd==0.7.5a0" ~~~ -!!! note "Already have Python 3.10 or newer?" - You may use the standard library instead: - - ~~~bash - python3 -m venv ~/.venvs/quantumd-alpha - source ~/.venvs/quantumd-alpha/bin/activate - python -m pip install --upgrade pip - ~~~ - - If environment creation fails or the available Python is older than 3.10, - use the recommended `uv` path. - -## Install the published alpha - -Download only the exact QuantumD wheel from TestPyPI: +Confirm the command is available: ~~~bash -python -m pip download \ - --no-deps \ - --only-binary=:all: \ - --index-url https://test.pypi.org/simple/ \ - quantumd==0.7.4a0 +quantumd --help ~~~ -Verify the published wheel: +## Install without manually managing an environment -~~~bash -echo \ - "761a865a5aaf655f570fa3ae6f1d0f9b1b09cb89ee5519ac1843b738d251b7d2 quantumd-0.7.4a0-py3-none-any.whl" \ - | sha256sum --check -~~~ - -Install the downloaded wheel: +On a system that protects its system Python, use `pipx`: ~~~bash -python -m pip install \ - ./quantumd-0.7.4a0-py3-none-any.whl +pipx install quantumd ~~~ -Because the wheel is installed from a local file, its dependencies resolve from -the default Python Package Index rather than TestPyPI. - -!!! warning "Do not use TestPyPI as the only dependency index" - TestPyPI is a testing service and may contain unrelated or incomplete - dependency packages. Download the exact QuantumD artifact first, verify its - checksum, and then install the local wheel. - -Confirm the installation: +or `uv tool`: ~~~bash -quantumd --help +curl -LsSf https://astral.sh/uv/install.sh | sh +export PATH="$HOME/.local/bin:$PATH" +uv python install 3.12 +uv tool install --python 3.12 quantumd ~~~ -## Guided Linux and WSL bootstrap +Both tools manage isolation behind the scenes and expose the `quantumd` +command on your user path. -The repository includes a bootstrap script that installs an isolated Python -3.12 environment, downloads the exact public-alpha wheel, verifies its SHA-256 -digest, installs QuantumD, runs the local quickstart, and independently verifies -the evidence chain. +## Optional dedicated environment -Download and review the script before running it: +A dedicated environment is optional but remains useful for explicit dependency +isolation: ~~~bash -curl -fsSLO \ - https://raw.githubusercontent.com/WindDAnalytics/quantumd/main/scripts/bootstrap_public_alpha.sh - -less bootstrap_public_alpha.sh -bash bootstrap_public_alpha.sh +curl -LsSf https://astral.sh/uv/install.sh | sh +export PATH="$HOME/.local/bin:$PATH" +uv python install 3.12 +uv venv --python 3.12 --seed ~/.venvs/quantumd-alpha +source ~/.venvs/quantumd-alpha/bin/activate +python -m pip install "quantumd==0.7.5a0" ~~~ -The script does not replace the operating system's Python. Its default -environment is `~/.venvs/quantumd-alpha`. - -## Run the first governed workflow +## Run and verify the first governed workflow ~~~bash quantumd quickstart my-first-quantumd-project -~~~ - -Then inspect and independently verify it: - -~~~bash quantumd doctor my-first-quantumd-project - -quantumd verify-chain \ - my-first-quantumd-project \ - --latest +quantumd verify-chain my-first-quantumd-project --latest ~~~ -No Google Cloud account or IBM Quantum account is required for the local -simulator path. +The local path requires no Google Cloud account and no IBM Quantum account. It +must report local simulator-only trust, KMS configuration `False`, and hardware +authorization `PROHIBITED`. Independent verification must report no IBM, KMS, +or hardware action. -## Windows Subsystem for Linux +## Inspect the exact release artifact -Older WSL distributions may ship with an unsupported default Python. Ubuntu -20.04, for example, commonly provides Python 3.8. Installing a newer interpreter -through `apt` may still leave the matching `venv` package unavailable. +Download only the current wheel: -Use the recommended `uv` setup rather than replacing `/usr/bin/python3`. +~~~bash +python -m pip download \ + --no-deps \ + --only-binary=:all: \ + "quantumd==0.7.5a0" +sha256sum quantumd-0.7.5a0-py3-none-any.whl +~~~ -If the terminal prompt appears nested, such as `((.venv))`, open a clean shell -and activate only the standard QuantumD environment: +Production PyPI displays the SHA-256 digest and publishing attestation for each +release file. Compare the local digest with the file details for +`quantumd 0.7.5a0` before installing a separately downloaded artifact. ~~~bash -exec bash -source ~/.venvs/quantumd-alpha/bin/activate +python -m pip install ./quantumd-0.7.5a0-py3-none-any.whl ~~~ -Repeated activation does not corrupt QuantumD, but it creates confusing shell -prompts. +The authorized GitHub Actions workflow publishes through PyPI Trusted +Publishing with short-lived OIDC credentials. No PyPI password or long-lived +API token is stored in GitHub. -## Troubleshooting - -### `uv: command not found` +## WSL and older Linux distributions -Add the user installation directory to the current shell: +Older WSL distributions may provide Python older than 3.10. Do not replace +`/usr/bin/python3`. Use `uv tool install --python 3.12 quantumd`, or use the +optional dedicated `uv` environment above. -~~~bash -export PATH="$HOME/.local/bin:$PATH" -~~~ - -To make that persistent in Bash: +## Troubleshooting -~~~bash -echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc -source ~/.bashrc -~~~ +### `externally-managed-environment` -### Python is older than 3.10 +Use `pipx install quantumd` or `uv tool install --python 3.12 quantumd`. -Do not modify the operating system's default Python. Use: +### `quantumd: command not found` ~~~bash -uv python install 3.12 -uv venv --python 3.12 --seed ~/.venvs/quantumd-alpha +python -m pip show quantumd +python -m site --user-base ~~~ -### `python3.12-venv` cannot be located - -This can occur on older Ubuntu releases. Use the `uv` path instead of adding -more operating-system Python repositories. +Ensure the corresponding user binary directory is on `PATH`. ### A dependency fails while compiling -One dependency may need standard build tools on some Linux systems. On Ubuntu -or Debian: +On Ubuntu or Debian: ~~~bash sudo apt-get update @@ -193,25 +132,15 @@ Then rerun the installation. ## Install from source for development -Clone the repository only when contributing or evaluating unreleased changes: - ~~~bash git clone https://github.com/WindDAnalytics/quantumd.git cd quantumd - curl -LsSf https://astral.sh/uv/install.sh | sh export PATH="$HOME/.local/bin:$PATH" - uv python install 3.12 uv venv --python 3.12 --seed .venv source .venv/bin/activate - python -m pip install -e ".[dev]" -~~~ - -Run the development acceptance checks: - -~~~bash python -m pytest -q bash scripts/public_alpha_acceptance.sh ~~~ diff --git a/docs/releases/v0.7.5-alpha.md b/docs/releases/v0.7.5-alpha.md new file mode 100644 index 0000000..f7c6d97 --- /dev/null +++ b/docs/releases/v0.7.5-alpha.md @@ -0,0 +1,43 @@ +# QuantumD v0.7.5 alpha + +QuantumD `0.7.5a0` establishes production PyPI as the primary public +installation channel. + +## Release identity + +~~~text +Version: 0.7.5a0 +Tag: v0.7.5-alpha +Index: Production PyPI +Package: quantumd +~~~ + +## Installation experience + +~~~bash +python -m pip install quantumd +quantumd quickstart my-first-quantumd-project +~~~ + +A manually created virtual environment is optional. `pipx` and `uv tool` are +documented for systems that protect the system Python. QuantumD retains one +complete dependency set. + +## Protected production publishing + +The release workflow enforces the tag/version contract, tests and inspects the +distributions, installs the wheel into a clean environment, runs a KMS-attested +governed release demonstration, and publishes through PyPI Trusted Publishing +and GitHub OIDC. No stored PyPI password or long-lived API token is used. + +## Preserved trust boundaries + +The public local workflow remains `LOCAL_DEVELOPMENT`, +`LOCAL_SIMULATION_ONLY`, and hardware `PROHIBITED`. Production distribution +does not expand local hardware authority or weaken independent verification. + +## Alpha limitations + +QuantumD remains alpha software. Interfaces and evidence schemas may change +before a stable release. Local signing is for simulator evaluation, not +organization-controlled production authority. diff --git a/mkdocs.yml b/mkdocs.yml index 0a1083d..4eb1f5b 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -68,6 +68,7 @@ nav: - Alpha Evaluation: alpha-evaluation.md - Releases: + - v0.7.5 Alpha: releases/v0.7.5-alpha.md - v0.7.4 Alpha: releases/v0.7.4-alpha.md - Roadmap: roadmap.md diff --git a/pyproject.toml b/pyproject.toml index d15ce79..ea6cd37 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "quantumd" -version = "0.7.4a0" +version = "0.7.5a0" description = "Governed verification, policy enforcement, and evidence-bound execution for quantum software." readme = "README.md" requires-python = ">=3.10" @@ -27,7 +27,7 @@ dependencies = [ license = "Apache-2.0" license-files = ["LICENSE"] keywords = ["quantum computing", "quantum software", "governance", "verification", "reproducibility", "devsecops"] -classifiers = ["Development Status :: 3 - Alpha", "Environment :: Console", "Intended Audience :: Developers", "Intended Audience :: Information Technology", "Intended Audience :: Science/Research", "Operating System :: OS Independent", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3 :: Only", "Programming Language :: Python :: 3.12", "Topic :: Scientific/Engineering", "Topic :: Security", "Topic :: Software Development :: Quality Assurance", "Topic :: Software Development :: Testing"] +classifiers = ["Development Status :: 3 - Alpha", "Environment :: Console", "Intended Audience :: Developers", "Intended Audience :: Information Technology", "Intended Audience :: Science/Research", "Operating System :: OS Independent", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3 :: Only", "Programming Language :: Python :: 3.10", "Programming Language :: Python :: 3.11", "Programming Language :: Python :: 3.12", "Topic :: Scientific/Engineering", "Topic :: Security", "Topic :: Software Development :: Quality Assurance", "Topic :: Software Development :: Testing"] [project.optional-dependencies] dev = [