[chaliy]

What changed

Document the reported Windows workaround for Bashkit 0.20.1: retain Smart App Control, pin Bashkit 0.20.0 in the affected application's environment and dependency resolution, then verify import, execution, and pytest. Add an A/B PowerShell procedure that preserves install reports, native hashes, Authenticode status, and Code Integrity event XML. Link it from the Python package README.

Why

PondGuard reported a 0.20.1 native-module block on Windows 11 / Python 3.11.9. Users need a workaround and evidence collection steps before attributing the failure to signing or provenance.

Before / After

Documentation only; runtime behavior is unchanged. Previously the Python guide offered no SAC recovery or reproduction steps. It now distinguishes launcher blocks, native-module blocks, and transitive pytest plugin imports, with a temporary constraint and a trusted-signing release plan.

Artifact inspection downloaded both published cp39-abi3-win_amd64 wheels and verified their SHA-256 against PyPI JSON. Both modules have empty PE certificate tables, both wheels use maturin 1.15.0, both PyPI wheel provenance endpoints returned HTTP 404, and the release-tag Python publish workflows are identical. The guide records exact wheel/native hashes. This does not establish the Windows policy decision or binary reputation.

Validation: all 185 scripts/tests tests passed (2 skipped); documentation links, OKF, workflow parity, changelog, capability parity, and git diff checks passed. Local just pre-pr could not run because this environment lacks just and the Rust toolchain. No native code or workflow changed. Windows/SAC execution and the PowerShell procedure are unverified here because the available environment is Linux. No authenticated X coverage was used.

Risk

• Low: documentation only.
• 0.20.0 was reported working on one machine; it is also unsigned and is not guaranteed to load everywhere.
• A permanent fix requires a trusted Authenticode identity, correct wheel RECORD regeneration, and testing the exact final artifact on SAC-On Windows 11 before a new patch release. This PR does not claim that fix or a Windows reproduction is complete.

Checklist

• Existing documentation and script checks run; no runtime tests added for prose changes
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	d014192	Commit Preview URL Branch Preview URL	Oct 28 2026, 12:12 AM