Rename spec pin wrapper to check-consumer-spec-pin.sh

Update tox, spec-conformance, pyproject comment, README, and CHANGELOG.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Nathan Gillett

CHANGELOG.md

@@ -30,7 +30,7 @@ All notable changes to this repository are documented here. **PyPI** releases us
   exported from `intentproof`).
 - **Codegen/drift hardening:** add deterministic model generation and enforce
   drift policy (`generate_schema_models.py`, `verify-generated-types.sh`,
-  `check-no-bundled-schema.sh`, `check-sdk-spec-pin.sh`, delegated
+  `check-no-bundled-schema.sh`, `check-consumer-spec-pin.sh`, delegated
   `check-no-handwritten-model-types.sh`).
 - **CI/release hardening:** pin spec checkout by declared `spec-commit`; add
   hardening and spec-golden-parity jobs; require no-handwritten-model checks in

README.md

@@ -345,7 +345,7 @@ Custom **`body`** serializers: if **`body(event)`** raises, **`HttpExporter`** n
 
 **`intentproof-spec`** holds normative schemas, golden **`execution_event_cases.jsonl`**, and the canonical **`spec-conformance.sh`** toolchain.
 
-- **Version pin:** **`[tool.intentproof].spec-version`** and **`spec-commit`** in **`pyproject.toml`** match **`spec.json`** and the spec **`HEAD`** checkout; **`scripts/check-sdk-spec-pin.sh`** enforces this before conformance.
+- **Version pin:** **`[tool.intentproof].spec-version`** and **`spec-commit`** in **`pyproject.toml`** match **`spec.json`** and the spec **`HEAD`** checkout; **`scripts/check-consumer-spec-pin.sh`** delegates to **`intentproof-spec`** **`scripts/check-consumer-spec-pins.sh`** before conformance.
 
 - **CI:** every push/PR checks out this SDK plus **`intentproof-spec`** and runs **`scripts/spec-conformance.sh`** (pin check + full oracle; see `.github/workflows/ci.yml`). The **`spec-golden-parity`** job runs **`tests/unit/test_spec_golden_conformance.py`** against the same **`golden/execution_event_cases.jsonl`** using **`jsonschema`** + semantics mirrored from the spec (`tests/spec_semantics.py`).
 - **Repo-root certificates:** each run uploads **`conformance-report.json`** and **`conformance-certificate.json`** as workflow artifacts; after a green default-branch push, the conformance GitHub App commits the same files at the repo root when they differ from **`main`**.

pyproject.toml

@@ -45,7 +45,7 @@ dev = [
 ]
 
 [tool.intentproof]
-# Must match vendored intentproof-spec spec.json + git HEAD — enforced by scripts/check-sdk-spec-pin.sh
+# Must match vendored intentproof-spec spec.json + git HEAD — enforced by scripts/check-consumer-spec-pin.sh
 spec-version = "spec-v2.0.1"
 spec-commit = "40d3d0b96ded3c86030f3606a0cd0e477f88895c"
 

scripts/check-sdk-spec-pin.sh scripts/check-consumer-spec-pin.shscripts/check-sdk-spec-pin.sh renamed to scripts/check-consumer-spec-pin.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Fail if this repository's declared IntentProof spec version + commit pins do not match the spec checkout.
-# Usage: check-sdk-spec-pin.sh /absolute/or/relative/path/to/intentproof-spec
+# Usage: check-consumer-spec-pin.sh /absolute/or/relative/path/to/intentproof-spec
 set -euo pipefail
 
 spec_root="$(cd "$1" && pwd)"

scripts/spec-conformance.sh

@@ -26,7 +26,7 @@ if [[ -z "$spec_root" || ! -f "${spec_root}/scripts/run-conformance.sh" ]]; then
   exit 1
 fi
 
-bash "${sdk_root}/scripts/check-sdk-spec-pin.sh" "$spec_root"
+bash "${sdk_root}/scripts/check-consumer-spec-pin.sh" "$spec_root"
 
 export INTENTPROOF_SDK_ID="${INTENTPROOF_SDK_ID:-python}"
 export INTENTPROOF_SDK_NAME="${INTENTPROOF_SDK_NAME:-intentproof-sdk-python}"

tox.ini

@@ -21,7 +21,7 @@ commands =
 extras =
     dev
 commands =
-    bash {toxinidir}/scripts/check-sdk-spec-pin.sh {env:INTENTPROOF_SPEC_ROOT}
+    bash {toxinidir}/scripts/check-consumer-spec-pin.sh {env:INTENTPROOF_SPEC_ROOT}
     bash {toxinidir}/scripts/check-no-bundled-schema.sh
     bash {toxinidir}/scripts/check-no-handwritten-model-types.sh
     bash {toxinidir}/scripts/verify-generated-types.sh