[Tom Gamble (gambtho)]

Publish validated local OCI layouts by exact manifest digest, with explicit origin-bound credentials and Bearer authentication.
Add manual, owner-gated frozen-contract release qualification and one Python integration page.
No registry pull, tags, signing, live publication, or release is performed.
Verified locally: Python 3.10/3.14 (893 tests each), strict mypy Linux/Windows targets, Go normal/race/private-umask tests, vet/staticcheck/tidy, actionlint, docs links/site/Chromium, and TypeScript parity.
Independent adversarial review found an origin-normalization credential leak and encoding-error disclosure; both are fixed with RED→GREEN regressions and an independent correction check.
Release qualification was rehearsed with owned temporary Git/catalog fixtures; no live release was run.

[Copilot]

🟡 Changes recommended

Unresolved issues can leak Authorization headers across hosts, qualify releases without the selected cataloged contract, and block publication by misparsing valid Bearer challenges.

4 open issues

• Use the selected contract checkout for every differential oracle · New
• Reject non-ASCII hostnames before attaching credentials · New
• Require the selected maintenance tag to map to v0.8 · New
• Parse auth parameters with optional whitespace around equals · New

What changed in this PR

Adds digest-preserving OCI publication to the Python SDK and a manual release workflow that qualifies distributions against a selected frozen Suite contract.

Changes:

• Introduces Registry.publish with explicit origin-bound credentials, authentication, upload replay, and remote manifest verification.
• Adds release qualification, artifact integrity checks, and optional protected PyPI publication.
• Documents the integration path and expands registry, packaging, release, and documentation tests.

File	Description
scripts/​check-python-release.py	Validates release identities, schemas, provenance, and artifact hashes.
python/​tests/​test_write_conformance.py	Allows selecting the frozen Go writer oracle.
python/​tests/​test_release.py	Tests qualification gates and artifact integrity.
python/​tests/​test_registry.py	Tests publication, authentication, replay, and remote verification.
python/​tests/​test_registry_failures.py	Tests refusal paths, credential isolation, and resource cleanup.
python/​tests/​test_build.py	Exercises publication from installed distributions.
python/​tests/​conftest.py	Requires registry and release tests to pass without skips.
python/​tests/​_registry_fixture.py	Provides an owned loopback registry fixture.
python/​src/​agent_suite/​_registry.py	Implements validated, exact-digest OCI publication.
python/​src/​agent_suite/​_registry_http.py	Handles HTTP authentication, redirects, and bounded responses.
python/​src/​agent_suite/​__init__.py	Exports the public Registry API.
python/​requirements-dev.txt	Adds Requests type stubs.
python/​README.md	Updates publication capabilities and identity guidance.
python/​pyproject.toml	Adds the pinned Requests dependency.
docs/​releases.md	Documents Python release preparation.
docs/​python.md	Explains SDK integration, credentials, publication, and qualification.
docs/​.vitepress/​site.test.mjs	Checks rendered Python documentation and links.
docs/​.vitepress/​config.mts	Adds Python documentation to site navigation.
docs/​.vitepress/​browser.test.mjs	Checks Python page navigation and responsive layout.
.github/​workflows/​python-release.yml	Adds manual qualification and optional protected publication.

_{Review effort: Balanced}