RELEASE_NOTES_0.3.4.md

Read-only source from the unchanged 0.3.4 kit. Existing license terms apply.

# AIL 0.3.4 — verification and public-release update

Released September 26, 2026. Creator: Wakely Wolf.
This is software release **0.3.4**, following 0.3.3. The wire language stays
**AIL/0.2** and wallet/packet formats stay **0.3**. It is not language version 3.4.

## What changed

1. Fixed JavaScript verification of altered subject fields. Role, grant,
   language, identity assurance and normalized identifiers must exactly match
   the supported signed profile. Previously normalization could mask changes
   to those outer fields even though the signature itself was not forged.
2. Added expected SHA-256 fingerprint checks in the console and Python CLI.
   A correctly signed packet made with a different key now fails this check,
   even if it uses the same name. Obtain the expected fingerprint independently.
3. Removed the prefilled Wakely Wolf identity from the new-key form and made
   generated filenames generic. Creator attribution and original declared-owner
   examples remain. Generating a key does not establish AIL ownership.
4. Separated error displays from download controls so failed generation or
   unlocking can be corrected and retried. Creation downloads remain tied to
   the generated wallet even after another wallet is used to sign a packet.
5. Added downloadable local verification reports, distinct trust statuses,
   stale-result clearing when verification inputs change, and a clear-session
   action. Reports contain public verification results, never a private wallet.
6. Added a 1 MiB input-file limit, stricter JavaScript base64 validation, wallet
   iteration-metadata validation, and consistent principal syntax in Python.
7. Added regression tests, rebuilt the Python wheel and refreshed release hashes.

## Existing owner: keep your key

Open `owner_app/index.html` or `OPEN_AIL_OWNER.bat`. Use **step 2** with your
existing private wallet and password. Do not create another wallet just to
upgrade the software. Public packets produced by the previous supported
release retain the same format. Your real wallet was not used in release tests.
Keep the PRIVATE wallet and its password out of website downloads.

## Verify a known key

In step 3 select the public identity packet, then enter the expected fingerprint
from your trusted record. A match links the packet to that key, not to an
independently verified legal identity. Pasting the fingerprint from an unknown
packet into the expected field establishes no additional trust.

CLI after installation:

```sh
ail verify-packet AIL_Identity_Packet.json --trusted-fingerprint "sha256:YOUR_64_HEX_DIGITS"
```

Replace the placeholder with a real fingerprint. Exit code 0 means all requested
checks passed; 1 means failure. Run anchor and fingerprint checks separately.
The console stays offline; an uploaded anchor file does not prove web origin.

## Scope

This release updates the uploaded reference/owner kit, not the live website or
its separate conversation console. Existing manuals describe AIL/0.2 and remain
unchanged historical reference documents. This note governs 0.3.4 UI behavior.
A valid signature does not establish legal ownership or external permissions.