fyaic · veil-chow-fyaic · Aug 11, 2026 · Aug 11, 2026
@@ -39,8 +39,8 @@ jobs:
           (
             cd dist
             shasum -a 256 tradesieve-*.whl tradesieve-*.tar.gz > ../SHA256SUMS
+            shasum -a 256 -c ../SHA256SUMS
           )
-          shasum -a 256 -c SHA256SUMS
 
       - name: Publish immutable prerelease assets
         env:

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,15 @@
 
 All notable changes to TradeSieve are documented here. Versions follow Semantic Versioning for public interfaces and PEP 440 for the Python package.
 
+## [0.1.0a3] - 2026-08-11
+
+Release-pipeline repair; application behavior is unchanged from `0.1.0a2`.
+
+### Fixed
+
+- Verify portable wheel/source-archive checksum entries from the directory containing
+  the built artifacts, with a repository regression assertion for the working path.
+
 ## [0.1.0a2] - 2026-08-11
 
 Agent-interface and delivery hardening preview.
@@ -50,5 +59,6 @@ First distributable engineering prototype.
 - No fuzzy/transliteration matching, ownership/control propagation, OFAC 50 Percent Rule, complete Russia goods/route/legal-effect engine, general workbook ingestion, production case workflow, OIDC tenancy, webhook or MCP server is included.
 - CHPL, HS and technical candidates do not constitute customs/export classification, prohibition, licence determination or clearance.
 
+[0.1.0a3]: https://github.com/fyaic/TradeSieve/releases/tag/v0.1.0-alpha.3
 [0.1.0a2]: https://github.com/fyaic/TradeSieve/releases/tag/v0.1.0-alpha.2
 [0.1.0a1]: https://github.com/fyaic/TradeSieve/releases/tag/v0.1.0-alpha.1
diff --git a/README.md b/README.md
@@ -60,7 +60,7 @@ flowchart LR
 
 ## 项目进度
 
-**当前阶段：`0.1.0a2` 高保真工程原型。EU FSF、EU Annex I、OFAC SDN 和 OFAC Consolidated 已能经过验证后作为一个四源 bundle 原子写入 PostgreSQL，并由 CLI、认证 REST、只读 MCP 和合成 CRM 调用同一个活跃版本审查服务；BIS CHPL 的 50 个 HS-6 候选和 `3A001` 首批来源绑定技术参数规则已接入。完整案件、人工作业、远程 MCP/OAuth、所有权/控制传播和俄罗斯专项货物/路线法律效果仍未完成。**
+**当前阶段：`0.1.0a3` 高保真工程原型。EU FSF、EU Annex I、OFAC SDN 和 OFAC Consolidated 已能经过验证后作为一个四源 bundle 原子写入 PostgreSQL，并由 CLI、认证 REST、只读 MCP 和合成 CRM 调用同一个活跃版本审查服务；BIS CHPL 的 50 个 HS-6 候选和 `3A001` 首批来源绑定技术参数规则已接入。完整案件、人工作业、远程 MCP/OAuth、所有权/控制传播和俄罗斯专项货物/路线法律效果仍未完成。**
 
 截至 2026-08-11，进度如下：
 

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "TradeSieve API",
-    "version": "0.1.0-alpha.2",
+    "version": "0.1.0-alpha.3",
     "summary": "Canonical contract for evidence-oriented trade-compliance screening and human review",
     "description": "Alpha prototype contract. A successful API response is not legal clearance. Only an authorized human decision can create HUMAN_CLEARED for a named action, scope, and expiry.",
     "license": {

diff --git a/compose.yaml b/compose.yaml
@@ -22,7 +22,7 @@ x-tradesieve-service: &tradesieve-service
   build:
     context: .
     dockerfile: Dockerfile
-  image: tradesieve:0.1.0-alpha.2
+  image: tradesieve:0.1.0-alpha.3
   environment: *tradesieve-environment
   init: true
   read_only: true

diff --git a/docs/demo/tradesieve-alpha-local-demo-guide.md b/docs/demo/tradesieve-alpha-local-demo-guide.md
@@ -1,7 +1,7 @@
 # TradeSieve Alpha 本地演示与接入指南
 
 **验证日期：** 2026-08-11
-**适用版本：** `0.1.0-alpha.2` 及当前 `main`
+**适用版本：** `0.1.0-alpha.3` 及当前 `main`
 **对象：** 业务负责人、合规/法务、CRM/OMS 集成开发者、CLI/Agent 使用者
 **性质：** 可运行的技术原型与接入说明，不是法律意见、自动法律判断或生产放行系统。
 
@@ -55,7 +55,7 @@ TradeSieve 当前已经能演示一条真实运行链路：
 ```bash
 git clone git@github.com:fyaic/TradeSieve.git
 cd TradeSieve
-git checkout v0.1.0-alpha.2
+git checkout v0.1.0-alpha.3
 cp .env.example .env
 docker compose up -d --build --wait
 docker compose run --rm --no-deps app \

diff --git a/docs/getting-started/prototype-release.md b/docs/getting-started/prototype-release.md
@@ -1,6 +1,6 @@
 # Prototype release installation and handoff
 
-**Version:** `0.1.0a2`
+**Version:** `0.1.0a3`
 **Audience:** evaluator, integration developer and internal demonstrator.  
 **Boundary:** synthetic demonstration and architecture evaluation; not production legal clearance.
 
@@ -11,7 +11,7 @@ Prerequisites are Git access to the private `fyaic/TradeSieve` repository and Do
 ```bash
 git clone git@github.com:fyaic/TradeSieve.git
 cd TradeSieve
-git checkout v0.1.0-alpha.2
+git checkout v0.1.0-alpha.3
 cp .env.example .env
 docker compose up -d --build --wait
 docker compose run --rm --no-deps app \
@@ -54,7 +54,7 @@ Release assets contain a wheel and source archive. For an isolated engineering i
 
 ```bash
 python3.13 -m venv .venv
-.venv/bin/python -m pip install tradesieve-0.1.0a2-py3-none-any.whl
+.venv/bin/python -m pip install tradesieve-0.1.0a3-py3-none-any.whl
 .venv/bin/tradesieve-manage --help
 ```
 

diff --git a/docs/operations/external-dependencies.md b/docs/operations/external-dependencies.md
@@ -1,7 +1,7 @@
 # External services and outbound dependencies
 
 **Evidence date:** 2026-08-11
-**Scope:** `0.1.0a2` engineering prototype.
+**Scope:** `0.1.0a3` engineering prototype.
 
 TradeSieve does not require a commercial sanctions API. Ordinary screening reads a
 previously verified active bundle from the deployment's PostgreSQL database. Network

diff --git a/docs/product/mvp-scope.md b/docs/product/mvp-scope.md
@@ -2,7 +2,7 @@
 
 **Planning window:** 2026-08-10 through 2026-09-18 (three two-week sprints)
 **Planning assumption:** dates are a baseline until team capacity and source access are confirmed.
-**Current repository state:** `0.1.0a2` engineering prototype. A real-source screening vertical slice, active-source CLI, authenticated technical-preview REST endpoint, one local read-only stdio MCP tool and synthetic CRM are implemented. Full transaction/case persistence, reviewer workflow, webhook, remote MCP/OAuth and the broader target tool set remain acceptance targets.
+**Current repository state:** `0.1.0a3` engineering prototype. A real-source screening vertical slice, active-source CLI, authenticated technical-preview REST endpoint, one local read-only stdio MCP tool and synthetic CRM are implemented. Full transaction/case persistence, reviewer workflow, webhook, remote MCP/OAuth and the broader target tool set remain acceptance targets.
 
 ## Phase 1 outcome
 

diff --git a/docs/product/prototype-release-boundary.md b/docs/product/prototype-release-boundary.md
@@ -1,6 +1,6 @@
 # Prototype release boundary
 
-**Release target:** `0.1.0a2`
+**Release target:** `0.1.0a3`
 **Evidence date:** 2026-08-11  
 **Status:** demonstrable engineering prototype; not a production legal-clearance service.
 

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "tradesieve-repository-tools",
   "private": true,
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "description": "Pinned documentation tooling for TradeSieve",
   "devDependencies": {
     "@redocly/cli": "2.44.2"

diff --git a/pyproject.toml b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "tradesieve"
-version = "0.1.0a2"
+version = "0.1.0a3"
 description = "Independent trade-compliance decision-support service"
 readme = "README.md"
 requires-python = ">=3.13,<3.15"

@@ -115,7 +115,7 @@ def create_app(settings: Settings | None = None) -> FastAPI:
     runtime_settings = settings or get_settings()
     application = FastAPI(
         title="TradeSieve runtime foundation",
-        version="0.1.0a2",
+        version="0.1.0a3",
         debug=runtime_settings.debug,
     )
 

@@ -22,7 +22,7 @@
 
 SERVER_NAME = "tradesieve"
 SERVER_TITLE = "TradeSieve official-source screening"
-SERVER_VERSION = "0.1.0a2"
+SERVER_VERSION = "0.1.0a3"
 SERVER_INSTRUCTIONS = (
     "Read-only trade-compliance decision support. Results are not legal clearance. "
     "GREEN_CANDIDATE still requires policy controls; HOLD and REQUEST_EVIDENCE must "

diff --git a/tests/unit/test_package.py b/tests/unit/test_package.py
@@ -7,7 +7,7 @@
 
 
 def test_package_exposes_alpha_version() -> None:
-    assert __version__ == "0.1.0a2"
+    assert __version__ == "0.1.0a3"
 
 
 def test_package_registers_the_management_console_script() -> None:
@@ -17,3 +17,11 @@ def test_package_registers_the_management_console_script() -> None:
         "tradesieve-manage": "tradesieve.manage:main",
         "tradesieve-mcp": "tradesieve.mcp_server:main",
     }
+
+
+def test_release_checksums_are_verified_from_the_dist_directory() -> None:
+    root = Path(__file__).parents[2]
+    workflow = (root / ".github/workflows/release.yml").read_text(encoding="utf-8")
+
+    assert "shasum -a 256 -c ../SHA256SUMS" in workflow
+    assert "shasum -a 256 -c SHA256SUMS" not in workflow
diff --git a/uv.lock b/uv.lock