Linux x86-64 native release 0.2.0a2 verification

Built from exact frozen commit a10323dede4413fbf295916b8ad12e3dbad7514e, exported with git archive into a new directory on the existing Hetzner host. The tar header's commit ID and SHA256 matched on both machines; the digest is recorded in release-proof.json. No working-tree source or previous build output was used.

Environment: Ubuntu x86-64, Python 3.12.3, pinned Rust 1.97.1, CMake 3.28.3, glibc 2.39, build 1.6.0, auditwheel 6.8.2 and patchelf 0.19.1.0. The native build used four Cargo jobs and cargo build --release --locked through the package build hook. Auditwheel repaired the result to manylinux_2_34_x86_64; filename, WHEEL and METADATA fields, both licenses, and embedded executable digest were checked before release handoff.

The pure client and repaired native 0.2.0a2 wheels were installed into a new venv. pip check passed. The frozen test_verify.py and test_transport.py tests ran under python -I from outside the source tree: 28 passed, zero skipped. This is the named API subset, not a claim that every repository test ran on Linux.

The retained offline-proof.py ran under unshare --net and python -I. It asserted installed import locations inside the fresh venv, authenticated the real archived Nitro diagnostic evidence to its independently pinned PCR0, solved its eight-iteration puzzle using fresh checkpoints, checked the key commitment, and decrypted both records byte-for-byte against their retained reference output. Tampered ciphertext was rejected without creating a plaintext output. The proof records only public evidence and plaintext hashes, not the recovered key.

The first auditwheel attempt lacked patchelf on PATH and failed. The successful retry added the existing release venv's bin directory to PATH. Both failed and successful logs remain under the remote release directory; no source change was needed. Final success was checked from actual files, imports, test output and independently computed hashes.

Remote artifacts and diagnostic outputs remain under /root/attested-relay-release-0.2.0a2-a10323d/. The wheel copied back and hash-checked locally is /tmp/attested-relay-a2-linux-evidence/attested_relay_timelock-0.2.0a2-py3-none-manylinux_2_34_x86_64.whl. SHA256: 1289d53332bf4e0cc4334099a291dcbdf0474e809185948fa55bc5ab9f41e4b8.

This task did not publish packages or change the live fleet. Short diagnostic recovery demonstrates interoperability and authentication, not production delay.