[chaliy]

What

Package the first Python distribution as markkit, exposing import markkit with no legacy markkit_python alias. The internal Rust package remains markkit-python; core Rust and npm APIs/versions are unchanged.

Why

The old Python build inherited the Rust package name and required a missing PyPI token. The first public Python release needs its intended package/import identity and the configured PyPI Trusted Publisher.

How

• Root pyproject.toml supplies Python metadata and selects the binding crate. Git-based sdists retain the complete workspace and byte-identical security lockfile; the irrelevant directory symlink is excluded.
• Build and smoke-test wheel+sdist before upload. Only the isolated upload job gets id-token: write; it uses the pinned official PyPA publishing action without stored credentials.
• Verify the actual public PyPI artifacts against the build digests, install the public wheel and run native extraction after publication. Manual dry runs never enter upload.

Risk

• Initial prebuilt wheel coverage remains Linux x64/glibc >=2.38/CPython 3.12. Other platforms can build the sdist with Rust/native build tools; source rebuilding was validated on macOS ARM64 with Rust 1.99.
• v0.1.1 remains immutable for already-published Rust/npm artifacts. Python 0.1.1 is the first Python publication and is built from this merged change.

Security

Reviewed package identity, immutable artifact handoff, preserved dependency locks and publisher credential exposure. OIDC permission is limited to the upload job; builds and public-install verification have read-only permissions. No token, custom trust-policy or global security changes.

Validation

• just pre-pr: formatting, clippy, 221 passing Rust tests, cargo-deny all categories passed.
• maturin build --release --locked --offline --sdist: rebuilt the wheel from the actual source archive. Workspace Cargo.toml and Cargo.lock in the archive are byte-identical to source.
• twine check --strict passed for wheel and sdist.
• Clean CPython 3.12 environment: import markkit, sync/async/options extraction pass; find_spec("markkit_python") is None.
• actionlint passed for both Python workflows.
• Linux release dry run 40021713134 passed: source archive rebuild, manylinux_2_38_x86_64 wheel, strict metadata validation and clean native import. Upload and public-install jobs were skipped as intended.

Actual installed-wheel smoke:

Distribution: markkit 0.1.1
import markkit: PASS
extract_html_sync("<h1>Smoke</h1>"): # Smoke
async extraction / options API: PASS
markkit_python alias: absent

Follow-ups

Additional prebuilt wheel platforms are outside this initial release. The source distribution is included and verified for source installs.

Checklist

• Tests added or updated
• Evidence attached for user-visible changes
• Backward compatibility considered: this is the first Python release
• Security review performed
• Linux CI and manual dry run passed
• All review comments addressed: no comments or review threads outstanding