AP-034: align Auths language SDKs and current docs

Cargo.toml

@@ -105,7 +105,7 @@ edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.91"
 repository = "https://github.com/auths-dev/auths-proof"
-homepage = "https://github.com/auths-dev/auths-proof"
+homepage = "https://auths.dev"
 
 [workspace.dependencies]
 auths = { version = "0.1.0", path = "core/crates/auths", default-features = false }

README.md

@@ -1,6 +1,8 @@
-# auths-proof
+# Auths
 
-The strictly offline reference kernel for Auths Proof Protocol V1.
+Auths is an open protocol and SDK for proof-carrying, bounded machine
+authority. The `auths-proof` component is its strictly offline reference
+kernel for Auths Proof Protocol V1.
 
 > Auths owns authority. Adapters establish bounded facts.
 
@@ -40,7 +42,9 @@ attachment input, and resource limit is an explicit immutable verifier input.
 
 Target packages:
 
-- `auths-proof`: supported embedded Rust facade and actionable results;
+- `auths`: supported consumer-facing Rust core facade;
+- `auths-sdk`: idiomatic embedded authorization SDK;
+- `auths-proof`: bounded proof-protocol component and actionable results;
 - `auths-proof-wasm`: prebuildable three-input WebAssembly boundary;
 - `auths-model`: validated V1 protocol and context types;
 - `auths-codec`: constrained deterministic CBOR and domain-separated IDs;
@@ -84,9 +88,10 @@ Canonical `.cbor` files are generated only through:
 cargo xtask wire --update
 ```
 
-Networking and transports belong to `auths-proof-exchange`. Profiles, live
-resolvers, runtime state, receipts, execution, custody, independent
-implementations, and Auths Lab belong to `auths-proof-apps`.
+Networking and transports belong to the `auths-proof-exchange` components.
+Profiles, live resolvers, runtime state, receipts, execution, custody,
+independent implementations, and Auths Lab remain outside the offline proof
+kernel in the workspace's product and demo layers.
 
 This repository is prelaunch and pre-audit. Passing corpus, fuzz-smoke, and
 WASM equivalence gates is not an independent security review.

bindings/python/README.md

@@ -1,10 +1,10 @@
-# auths-proof for Python
+# Auths for Python
 
-`auths-proof` embeds the Auths Proof Protocol V1 verifier. Verification is
+The `auths` package embeds the Auths Proof Protocol V1 verifier. Verification is
 deterministic, performs no I/O, and accepts exactly three byte strings:
 
 ```python
-from auths_proof import verify
+from auths import verify
 
 result = verify(proof_cbor, canonical_action_cbor, trusted_context_cbor)
 if result.kind == "authorized":

bindings/python/pyproject.toml

@@ -3,9 +3,9 @@ requires = ["maturin>=1.9,<2"]
 build-backend = "maturin"
 
 [project]
-name = "auths-proof"
+name = "auths"
 version = "0.1.0"
-description = "Embedded offline verification for Auths Proof Protocol V1"
+description = "Embedded Auths SDK with offline proof verification"
 readme = "README.md"
 requires-python = ">=3.9"
 license = "MIT OR Apache-2.0"
@@ -17,6 +17,6 @@ classifiers = [
 
 [tool.maturin]
 manifest-path = "Cargo.toml"
-module-name = "auths_proof._native"
+module-name = "auths._native"
 python-source = "python"
 features = ["pyo3/abi3-py39"]

bindings/python/python/auths_proof/__init__.py → bindings/python/python/auths/__init__.py

@@ -1,4 +1,4 @@
-"""Idiomatic embedded Auths Proof Protocol V1 verification."""
+"""Idiomatic embedded Auths SDK with Proof Protocol V1 verification."""
 
 from __future__ import annotations
 

bindings/python/src/lib.rs

@@ -21,7 +21,7 @@ fn verify_v1<'py>(
     Ok(PyBytes::new(py, &result))
 }
 
-/// Installs the private native extension consumed by `auths_proof`.
+/// Installs the private native extension consumed by `auths`.
 #[pymodule]
 fn _native(module: &Bound<'_, PyModule>) -> PyResult<()> {
     module.add_function(wrap_pyfunction!(verify_v1, module)?)?;

bindings/python/tests/test_api.py

@@ -4,8 +4,8 @@
 
 import pytest
 
-import auths_proof
-from auths_proof import Authorized, Denied, VerifiedAction, verify
+import auths
+from auths import Authorized, Denied, VerifiedAction, verify
 
 
 CORPUS = (
@@ -63,15 +63,15 @@ def test_portable_decoder_rejects_shape_version_and_trailing_data() -> None:
     assert canonical[-2:] == b"\x0f\x02"
 
     with pytest.raises(ValueError, match="trailing"):
-        auths_proof._decode_result(canonical + b"\x00")
+        auths._decode_result(canonical + b"\x00")
 
     reordered_keys = bytes([0xB0, 0x01, 0x04, 0x00, 0x00]) + canonical[5:]
     with pytest.raises(ValueError, match="canonical"):
-        auths_proof._decode_result(reordered_keys)
+        auths._decode_result(reordered_keys)
 
     unknown_field = bytes([0xB1]) + canonical[1:] + b"\x10\xf6"
     with pytest.raises(ValueError, match="shape"):
-        auths_proof._decode_result(unknown_field)
+        auths._decode_result(unknown_field)
 
     with pytest.raises(ValueError, match="ABI version"):
-        auths_proof._decode_result(canonical[:-1] + b"\x03")
+        auths._decode_result(canonical[:-1] + b"\x03")

bindings/typescript/README.md

@@ -1,9 +1,10 @@
-# `@auths-dev/proof`
+# `@auths-dev/sdk`
 
-Embedded Auths Proof Protocol V1 verification for browser and Node.
+The embedded Auths SDK for browser and Node. Its current public surface wraps
+the bounded Auths Proof Protocol V1 verifier.
 
 ```ts
-import { loadAuths } from "@auths-dev/proof";
+import { loadAuths } from "@auths-dev/sdk";
 
 const auths = await loadAuths();
 const result = auths.verify(proofBytes, canonicalActionBytes, contextBytes);

bindings/typescript/package.json

@@ -1,7 +1,7 @@
 {
-  "name": "@auths-dev/proof",
+  "name": "@auths-dev/sdk",
   "version": "0.1.0",
-  "description": "Embedded Auths Proof Protocol V1 verifier for browser and Node",
+  "description": "Embedded Auths SDK for browser and Node",
   "type": "module",
   "exports": {
     ".": {

compliance.toml

@@ -1232,7 +1232,7 @@ stateful-replay-budget-component = [
   "product/stores/auths-stores/src/lifecycle.rs#crash_matrix_reopens_old_or_new_canonical_state_never_partial_state",
 ]
 
-[packages."@auths-dev/proof"]
+[packages."@auths-dev/sdk"]
 kind = "npm"
 layer = "bindings"
 path = "bindings/typescript"
@@ -1247,7 +1247,7 @@ transports = []
 configuration_inputs = ["executed-verifier-configuration", "required-verifier-configuration"]
 security_state = []
 
-[packages."@auths-dev/proof".claims]
+[packages."@auths-dev/sdk".claims]
 core-wire-consumer = ["bindings/typescript/test/api.test.js#portable decoder rejects shape version and trailing data"]
 language-binding = ["bindings/typescript/test/api.test.js#configuration mismatch reports required and executed commitments"]
 

demos/github-issue/web/index.html

@@ -16,7 +16,7 @@
 
     <header class="site-header">
       <nav class="nav-shell" aria-label="Primary navigation">
-        <a class="wordmark" href="https://auths-proof-site.vercel.app">
+        <a class="wordmark" href="https://auths.dev">
           auths <i aria-hidden="true">/</i> <small>github lab</small>
         </a>
         <div class="nav-links">

demos/kubernetes-rollout/web/index.html

@@ -12,7 +12,7 @@
     <a class="skip-link" href="#workbench">Skip to the demo</a>
     <header class="site-header">
       <nav class="nav-shell" aria-label="Primary navigation">
-        <a class="wordmark" href="https://auths-proof-site.vercel.app">auths <i>/</i> <small>kubernetes lab</small></a>
+        <a class="wordmark" href="https://auths.dev">auths <i>/</i> <small>kubernetes lab</small></a>
         <div class="nav-links">
           <a href="#workbench">Exact rollout</a>
           <a href="#how">How it works</a>

demos/live-lab/web/index.html

@@ -23,7 +23,7 @@
       <nav class="nav-shell" aria-label="Primary navigation">
         <a
           class="wordmark"
-          href="https://auths-proof-site.vercel.app"
+          href="https://auths.dev"
           aria-label="Auths home"
         >
           auths
@@ -34,7 +34,7 @@
         <div class="desktop-nav">
           <a href="#evidence">How it works</a>
           <a
-            href="https://auths-proof-docs.vercel.app"
+            href="https://docs.auths.dev"
             rel="noreferrer"
             target="_blank"
           >
@@ -59,7 +59,7 @@
             <a href="#evidence">How it works</a>
             <a href="#experiment">Run the proof</a>
             <a
-              href="https://auths-proof-docs.vercel.app"
+              href="https://docs.auths.dev"
               rel="noreferrer"
               target="_blank"
             >

demos/radicle-issue/web/index.html

@@ -16,7 +16,7 @@
 
     <header class="site-header">
       <nav class="nav-shell" aria-label="Primary navigation">
-        <a class="wordmark" href="https://auths-proof-site.vercel.app">
+        <a class="wordmark" href="https://auths.dev">
           auths <i aria-hidden="true">/</i> <small>radicle lab</small>
         </a>
         <div class="nav-links">

demos/rest-api-authorization/web/index.html

@@ -12,7 +12,7 @@
     <a class="skip-link" href="#workbench">Skip to the demo</a>
     <header class="site-header">
       <nav class="nav-shell" aria-label="Primary navigation">
-        <a class="wordmark" href="https://auths-proof-site.vercel.app">auths <i>/</i> <small>records lab</small></a>
+        <a class="wordmark" href="https://auths.dev">auths <i>/</i> <small>records lab</small></a>
         <div class="nav-links">
           <a href="#workbench">Live request</a>
           <a href="#evidence">Receipts</a>

demos/stripe-refund/web/index.html

@@ -16,7 +16,7 @@
 
     <header class="site-header">
       <nav class="nav-shell" aria-label="Primary navigation">
-        <a class="wordmark" href="https://auths-proof-site.vercel.app">
+        <a class="wordmark" href="https://auths.dev">
           auths <i aria-hidden="true">/</i> <small>stripe lab</small>
         </a>
         <div class="nav-links">

docs/specs/0027-product-grade-typescript-sdk.md

@@ -26,7 +26,7 @@ requirements on conforming implementations.
 
 ## 1. Decision
 
-Auths will make the existing `@auths-dev/proof` package the first polished
+Auths will make the existing `@auths-dev/sdk` coordinate the first polished
 developer-preview SDK.
 
 The package currently exposes the portable three-input verifier and a sealed
@@ -74,7 +74,7 @@ as required by their change classifications.
 
 The implementation begins from these maintained surfaces:
 
-- `bindings/typescript` publishes `@auths-dev/proof`;
+- `bindings/typescript` prepares `@auths-dev/sdk`;
 - `auths-proof-wasm` exposes the supported portable verification boundary;
 - `auths-sdk` owns the embedded Rust verifier and product-facing profile
   decoding;
@@ -134,7 +134,7 @@ The Phase 10 developer preview MUST NOT:
 The happy path MUST fit this conceptual shape:
 
 ```ts
-import { loadAuths, mcp } from "@auths-dev/proof";
+import { loadAuths, mcp } from "@auths-dev/sdk";
 
 const auths = await loadAuths({ signer, trustedAuthority });
 
@@ -215,7 +215,7 @@ Developer errors and authorization outcomes are different:
 +-------|------------|-------------|-------------|--------------------------+
         |            |             |             |
         v            v             v             v
-+----------------------- @auths-dev/proof ------------------------+
++------------------------ @auths-dev/sdk -------------------------+
 | workflow API | resource lifetimes | typed results | explanations |
 | profile facade | signer port | approval port | advanced raw API  |
 +-------------------------------|----------------------------------+

formal/qualification/aeneas/source-closure.json

@@ -1,6 +1,6 @@
 {
   "schema": "auths-proof-translation-source-closure/v2",
-  "digest": "c5f185d14eb2afa12eb39d424fab17d3b943f16fd070f60c0b8df8da40785542",
+  "digest": "deeaa08cb05e8b456b3f72dc0d01d281bb59815006db6ac4e04aa79f3abdfc08",
   "files": [
     {
       "path": "Cargo.lock",
@@ -9,7 +9,7 @@
     },
     {
       "path": "Cargo.toml",
-      "sha256": "4a97d98bce9edb8b5f0ecf2828d3b9994d3fc73ded7d0c964e0e9c379a9c5427",
+      "sha256": "ad7c0b5266d3a37a722e952c8c2f4ee8971119364667c9a580b3f14dcd1a08e9",
       "normalization": "translated-cargo-closure-v1"
     },
     {

product/README.md

@@ -1,7 +1,7 @@
-# auths-proof-apps
+# Auths product layer
 
-Effectful applications and control-plane components for Auths Proof Protocol
-V1.
+Effectful applications and control-plane components for Auths. These build on
+the bounded Auths Proof Protocol V1 kernel.
 
 Start with the [developer integration guide](docs/developer-integration.md)
 for the Rust, TypeScript/WASM, Python, and pure-Go package surfaces.
@@ -51,8 +51,8 @@ the release-candidate publication set):
   entry points;
 - `auths-deployment`: replay- and blast-radius-safe deployment execution;
 - `auths-profile-kit`: deterministic fixtures and hostile-input scaffolding;
-- `@auths-dev/proof`: precompiled WASM with an idiomatic TypeScript API;
-- `auths-proof`: stable-ABI Python wheels;
+- `@auths-dev/sdk`: precompiled WASM with an idiomatic TypeScript API;
+- `auths`: stable-ABI Python wheels;
 - `auths.dev/independent-verifier/auths`: independent pure-Go verifier.
 
 The MCP reference runtime emits content-addressed canonical decision receipts

product/SECURITY.md

@@ -1,7 +1,7 @@
 # Security Policy
 
-`auths-proof-apps` `0.1.x` is pre-audit software. Do not use it as the sole
-production authorization control.
+Auths `0.1.x` is pre-audit software. Do not use it as the sole production
+authorization control.
 
 Report vulnerabilities privately through the repository host's Security
 Advisory feature. Include the affected commit, exact canonical MCP body and

product/docs/developer-integration.md

@@ -48,16 +48,16 @@ runtime supplies the same invariant with challenge exchange, receipts, and
 transport bindings.
 
 Safe grant planning and external key custody are available from the same
-package as `auths_proof_sdk::authority` and `auths_proof_sdk::custody`. The
+package as `auths_sdk::authority` and `auths_sdk::custody`. The
 planner rejects delegation widening before any signing provider is invoked.
 
 ### TypeScript
 
-Install `@auths-dev/proof`. Published packages include compiled JavaScript,
+Install `@auths-dev/sdk`. The prepared package includes compiled JavaScript,
 declarations, and precompiled WASM:
 
 ```typescript
-import { loadAuths } from "@auths-dev/proof";
+import { loadAuths } from "@auths-dev/sdk";
 
 const auths = await loadAuths();
 const result = auths.verify(proof, canonicalAction, trustedContext);
@@ -70,10 +70,10 @@ if (result.kind === "authorized") {
 
 ### Python
 
-Install the `auths-proof` wheel:
+Install the `auths` wheel:
 
 ```python
-from auths_proof import verify
+from auths import verify
 
 result = verify(proof_cbor, canonical_action_cbor, trusted_context_cbor)
 if result.kind == "authorized":
@@ -139,9 +139,6 @@ go test ./...
 Treat corpus disagreement, an unknown critical identifier, or an unavailable
 replay/budget store as a fail-closed release blocker.
 
-This repository's GitHub workflows also check out the private
-`auths-dev/auths-proof` and `auths-dev/auths-proof-exchange` repositories.
-Configure an `AUTHS_READ_TOKEN` Actions secret with read-only Contents access
-to those sibling repositories to enable the cross-repository jobs. Until that
-credential exists, a visible preflight succeeds and those jobs are explicitly
-skipped; they are never reported as having run.
+This repository's GitHub workflows run the cross-language corpus against the
+workspace's Rust, TypeScript, Python, and Go surfaces. A skipped implementation
+is reported as skipped; it is never represented as having run.