v431 release

.github/workflows/publish-sdk-dev.yml

@@ -53,6 +53,12 @@ jobs:
         working-directory: sdk/python
         run: uv build --out-dir ../../dist
 
+      # PEP 740 provenance, same as the rc/stable publish jobs. Running it on
+      # the dev channel means a broken attestation step fails here on every
+      # push to main instead of for the first time during a release.
+      - name: Generate PEP 740 attestations
+        uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6
+
       - name: Publish to TestPyPI
         run: |
           uv publish --trusted-publishing always \

.github/workflows/release-train.yml

@@ -360,6 +360,12 @@ jobs:
       - name: Build SDK wheel and sdist
         working-directory: sdk/python
         run: uv build --out-dir ../../dist
+      # PEP 740 provenance: sign every dist with this job's OIDC identity
+      # (must match the trusted publisher, so it runs here rather than in
+      # build-core-wheels.yml). uv publish uploads the resulting
+      # *.publish.attestation files alongside each dist.
+      - name: Generate PEP 740 attestations
+        uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6
       # --check-url makes a re-run after a partial upload idempotent: files
       # already on the index are skipped instead of failing with a 400
       # duplicate (e.g. the SDK wheel landed but bittensor-core didn't).

.github/workflows/watch-mainnet-release.yml

@@ -254,6 +254,14 @@ jobs:
         working-directory: sdk/python
         run: uv build --out-dir ../../dist
 
+      # PEP 740 provenance: sign every dist with this job's OIDC identity.
+      # Must happen here, not in build-core-wheels.yml — PyPI only accepts
+      # attestations whose Sigstore identity matches the trusted publisher
+      # doing the upload. uv publish picks up the *.publish.attestation
+      # files from dist/ automatically.
+      - name: Generate PEP 740 attestations
+        uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6
+
       # --check-url makes a re-run after a partial upload idempotent: files
       # already on the index are skipped instead of failing with a 400
       # duplicate (e.g. the SDK wheel landed but bittensor-core didn't).

docs/internals/release-process.mdx

@@ -74,7 +74,8 @@ running your runtime with a public endpoint
 yet, it cuts the release train's artifacts:
 
 1. **GitHub release** `v<spec_version>`
-2. **Python SDK + bittensor-core wheels** to PyPI (trusted publishing)
+2. **Python SDK + bittensor-core wheels** to PyPI (trusted publishing, with
+   PEP 740 provenance attestations)
 3. **Publishable Rust crates** to crates.io (auto-discovered; workspace crates
    are `publish = false` while they depend on the patched polkadot-sdk fork)
 4. **Production website/docs** to Vercel

sdk/python/bittensor/cli/main.py

@@ -22,6 +22,7 @@
 from .. import __version__, wallets
 from .._generated.errors import ERRORS
 from ..config import get as config_default
+from ..error_descriptions import DESCRIPTIONS
 from ..intents import list_tools
 from ..result import EXPLANATIONS, REMEDIATION, ErrorCode, classify_error
 from ..settings import DEFAULT_NETWORK
@@ -326,6 +327,7 @@ def _chain_error_matches(query: str) -> list[dict[str, str]]:
                 "name": info.name,
                 "code": code.value,
                 "docs": info.docs,
+                "description": DESCRIPTIONS.get(info.name, ""),
                 "help": REMEDIATION[code],
             }
         )

sdk/python/bittensor/cli/output.py

@@ -1496,6 +1496,8 @@ def _print_failure(self, result: ExtrinsicResult) -> None:
             return
         if error.name:
             self._sub_diag("note", f"the chain rejected the call with `{error.name}`")
+        if error.description:
+            self._sub_diag("note", error.description)
         self._sub_diag("help", error.remediation)
         if result.explorer_url:
             self._sub_diag("see", result.explorer_url)
@@ -1554,8 +1556,10 @@ def error_catalog(self, title: str, records: list[dict[str, str]]) -> None:
         self._out.print(f"[dim]{len(records)} {suffix}[/dim]")
 
     def explain_chain(self, matches: list[dict[str, str]]) -> None:
-        """Explain exact chain error names: the on-chain docs plus the semantic
-        code each classifies to. One block per pallet when a name collides."""
+        """Explain exact chain error names: the researched description (trigger
+        plus where to check) with the on-chain docs as fallback, and the
+        semantic code each classifies to. One block per pallet when a name
+        collides."""
         if self.json_mode:
             self._json(matches[0] if len(matches) == 1 else matches)
             return
@@ -1568,7 +1572,8 @@ def explain_chain(self, matches: list[dict[str, str]]) -> None:
             header.append(f"{match['pallet']}.{match['name']}")
             self._out.print(header)
             self._out.print()
-            self._out.print(_prose(_diagnostic(match["docs"] or match["name"])))
+            body = match.get("description") or match["docs"] or match["name"]
+            self._out.print(_prose(_diagnostic(body)))
             self._out.print()
             self._sub_diag("help", match["help"], console=self._out)
         for code in dict.fromkeys(match["code"] for match in matches):