The published 0.4.0 predates the Attesto 3 verifier surfaces (disclosure v1/v2,
bundle provenance root and offline revocation, effective assurance, Pedersen
opening verification) and, on PyPI, is missing ten modules outright. 0.5.0 is
the lockstep version the registry-readiness gate requires across all four.
Wheel and npm pack pass the artifact policy; publishing waits on registry
credentials. The npm allowlist now accepts LICENSE, which npm always packs.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
