- mullion is now listed on the open-source page, beside Postern and sigrix-mcp.
- A new On PyPI section names the three packages you can install: postern-conformance, sigrix-mcp and mullion.
- mullion's licence, Python requirement and version are read from the installed package, so the page cannot go stale.
- The Resources menu names all three projects instead of Postern alone.
What shipped
-
New
mullion on the open-source pageThe image pipeline extracted out of Sigrix — open, fit, watermark, encode — with its repository, licence and module list.
-
New
Published packages sectionThe three distributions Sigrix publishes, each linking to its own PyPI page, so nobody has to guess a package name.
-
Imp
Live package factsmullion's licence, Python requirement and version are read from the installed distribution rather than written into the page.
-
Imp
Resources menu names every projectThe menu read "Postern protocol" while the page already carried more than Postern.
-
Imp
sigrix-mcp release pinned by commitThe step holding the package's PyPI upload rights tracked a moving branch; it now names a commit, with a test that fails if that changes.
What's changing
Open source at Sigrix says what this platform publishes and under which licence. It carried two projects — the Postern protocol and the sigrix-mcp publishing server. It now carries three.
mullion is the image pipeline. Every picture anyone hands Sigrix — an avatar, a storefront cover, a sample render — is opened, fitted, sometimes watermarked and re-encoded by it. It began as a module inside Sigrix and became its own package when a second codebase needed exactly it. Nothing in it knows what a marketplace is, which is what makes it useful to anyone else who takes uploads.
The packages, by name
A new On PyPI section lists the three distributions Sigrix publishes, each linking to its own package page:
postern-conformance— point it at a running Postern runner and it reports which of the specification's levels that runner meets.sigrix-mcp— publish a prompt, persona or skill to Sigrix from the AI client you already write in.mullion— the image pipeline, with nothing of this marketplace in it.
Naming them is the point. postern on PyPI belongs to an unrelated project, so guessing a package name installs somebody else's code.
All three are released the same way: a tagged build, published through PyPI's trusted publishing, so there is no long-lived token stored anywhere to leak or rotate. The one step that spends those upload rights now names an exact commit of the publishing action in sigrix-mcp too, rather than a branch that can move under it.
Facts read, not typed
mullion is the one project Sigrix installs rather than only links to, so its row is read rather than written: the licence, the Python requirement, the module list and the version in use all come from the copy running this site. When the platform upgrades the library, the page follows on its own.
The Resources menu in the top navigation now names all three projects as well. It had read "Postern protocol" since the days when Postern was the only thing published.
The protocol itself has its own page: Postern carries the specification, the hosted schemas and the live status of the Sigrix side of it.
Postern, sigrix-mcp and mullion, each with its repository, licence and package.
postern on PyPI is an unrelated project, so the page names the packages Sigrix actually publishes.
mullion's row is read from the installed package, so the page follows the platform on its own.
If you build against Sigrix, the contract is public. The protocol an agent is run and licensed under, the client a seller publishes through, and the library that handles every image uploaded here are all Apache-2.0 and readable before you install anything.
The page now names the exact package for each one, which matters more than it sounds: a near-miss on PyPI installs somebody else's code.
Get product updates in your inbox.
One email every two weeks. Real release notes, no fluff. Unsubscribe anytime.