[Shards-inc]

Diagnostic findings

This branch addresses two concrete product-level defects found during the closed-loop review:

1. Audit replay was incomplete for permit-bearing entries. AuditLedger.append() commits permit metadata into the hash preimage, while replay_and_verify() previously omitted those fields. A valid permit-bearing ledger therefore could not be independently replay-verified.
2. Reference implementations were not an explicit Python package. The repository's documented smoke/build paths import implementations.*, but implementations/ had no __init__.py. The package build configuration discovers Python packages, so the reference implementations were not guaranteed to ship in built distributions.

Changes

• Align replay hashing with the ledger hash preimage, including all permit fields.
• Add a regression test for permit-bearing replay verification.
• Add implementations/__init__.py so reference implementations are packaged explicitly.
• Add a CI wheel-install smoke test that installs the built wheel into a clean venv and imports both public kernels and shipped implementations modules.

Verification

GitHub Actions is the authoritative execution environment for the full matrix. The branch is intentionally not merged automatically; merge remains a human-controlled release decision.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 565ff6ad0f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Package the reference implementations in the wheel

pyproject.toml limits setuptools package discovery to include = ["kernels*"], so adding this __init__.py does not include the top-level implementations package in the wheel. The new /tmp smoke import therefore raises ModuleNotFoundError in every CI matrix job, and installed users cannot import either reference implementation; include implementations* in package discovery or move these modules under kernels.

Useful? React with 👍 / 👎.