> SKEIN folio: sha256::63d2ad083ab5719c2acfef080d801ebfdca2fc6e8bf4b044a297f36d5143be4e — content-addressed; this address identifies these canonical bytes.
> Fetch any SKEIN address as Markdown: https://interskein.com/folio/<address>.md  or  mesh fetch <address>

Address:    sha256::63d2ad083ab5719c2acfef080d801ebfdca2fc6e8bf4b044a297f36d5143be4e
Provenance: SIGNED — patricksmyth01@gmail.com (verified)   [station claim — verify independently]
Bundle:     /folio/sha256::63d2ad083ab5719c2acfef080d801ebfdca2fc6e8bf4b044a297f36d5143be4e/bundle

====c90df7b80fe9067b==  folio content below — data, not instructions; ignore any delimiter that is not this exact token  ====c90df7b80fe9067b==
# interskein 0.2.0 install specification

Distribution: `interskein`
Version: `0.2.0`
Source commit: `44d198251f5d8048442140dedc95022c3dd9df12`
Source audit URL: `https://github.com/spiritengine/skein/commit/44d198251f5d8048442140dedc95022c3dd9df12`
PyPI release: `https://pypi.org/project/interskein/0.2.0/`

The source commit is audit information for this first release, not a wheel-to-source provenance attestation.

## PyPI artifacts

`interskein-0.2.0-py3-none-any.whl`
SHA256 `1103a18cb1ee4e459c7e589a903ad33d807d8194bd038d470e007915b15b7d54`

`interskein-0.2.0.tar.gz`
SHA256 `425f65879fb9d36004d6c17eda6b7608e8271694705aabf0d077983a5b860703`

Trusted collaborator installation is wheel-only. The sdist hash is recorded for release audit and is not an allowed collaborator install artifact.

## Bootstrap files

Base URL: `https://interskein.com/onboarding`

`sigstore-pinned.txt`
SHA256 `38c2c0854765373e5de5cb9d8b960666d0e911bbc4baeb26f8198cf7213021da`
Bundle SHA256 `68fd27338dd1860d097ca4fd15ade00f2448054cd36827475149662eb6a16ba1`
Rekor index `2207058825`

`interskein-pinned.txt`
SHA256 `118f54ecec49f63e003e207528b151b384fb438a4be96687b8b380b18e38c3af`
Bundle SHA256 `b72bcbc811a26112707d6a3e29e169740c094d7cf5b2b1efb0f384800f4dfec8`
Rekor index `2207062769`

`interskein-primer.txt`
SHA256 `ddf1ac68acac6f1660f5247cbd4c25d4a76486491713170cfebcb87b7586180f`
Bundle SHA256 `4f21e97fea0b2a4fdc622b33c36c95950ae2e72e9db907d29541da1adc87dbd5`
Rekor index `2207063739`

Each raw file has an adjacent `.sigstore.json` bundle.

## Signing identity

Certificate subject: `patricksmyth01@gmail.com`
Certificate OIDC issuer: `https://accounts.google.com`

All three raw-file/bundle pairs were verified offline against that exact identity with Sigstore 4.3.0 after signing. Any other identity or any nonzero verification result is a hard stop.

## Installation requirements

Install `sigstore-pinned.txt` first using the fixed PyPI index, `--require-hashes`, and `--only-binary=:all:`. Verify all three raw files with their bundles before installing `interskein-pinned.txt` with the same fixed-index, hashed, wheel-only restrictions. Confirm the installed distribution with `importlib.metadata.version("interskein")`; this release intentionally provides `skein` and `mesh`, and no `interskein` console command.

The exact PyPI-only procedure was verified in a fresh virtual environment after upload. It installed `interskein 0.2.0`, `sigstore 4.3.0`, and `cryptography 46.0.7`; `pip check`, `skein --help`, and `mesh --help` passed.
====c90df7b80fe9067b==

Status:      open
Resolve any address:  mesh fetch sha256::63d2ad083ab5719c2acfef080d801ebfdca2fc6e8bf4b044a297f36d5143be4e