@@ -169,8 +169,7 @@ git worktree remove --force "$wt"
    ```
 
 4. **Watch and verify.** Check that `Select Qualified Prerelease` names the
-   approved candidate, the GitHub Release has assets, no job failed, and the
-   wheel reached PyPI:
+   approved candidate, the GitHub Release has assets and no job failed:
 
    ```shell
    gh run watch <run-id> --exit-status
 
@@ -33,8 +33,8 @@ Release creates `vX.Y.Z` at that exact commit, then rebuilds and publishes all
 stable artifacts without rerunning qualification. Embedded versions change, so
 stable artifacts are not byte-identical to the qualified prerelease. An existing
 stable tag may be retried only if it already points to the selected commit. A retry
-publishes only missing artifacts; published images, charts, release assets, npm,
-and PyPI versions are kept, while the snap is uploaded again.
+publishes only missing artifacts; published images, charts, release assets, and
+npm versions are kept, while the snap is uploaded again.
 Stable images are saved as OCI archives during the build and pushed under the
 stable version tags during publication. Their SBOMs are verified before updating
 `latest`; the qualified prerelease's commit-SHA image tags remain unchanged.
@@ -84,17 +84,6 @@ immutable version and advance latest only for a newer version.
 
 Watch the stable release run and report its result.
 
-## PyPI publishing
+## Python SDK
 
-Stable releases publish the Python wheel to PyPI from `wheel-publish.yml`, which the `publish-pypi` job in `release-publish.yml` calls after the GitHub Release is created. The workflow downloads the wheel from the stable GitHub Release, not a run's build artifact, and checks the stable tag's source commit and the wheel's release checksum. It uses Trusted Publishing with the `pypi` GitHub environment. PyPI matches the workflow file that contains the publishing job, so configure the `openshell` PyPI project's GitHub publisher with owner `NVIDIA`, repository `OpenShell`, workflow `wheel-publish.yml`, and environment `pypi`. No PyPI API token or GitLab trigger credentials are required.
-
-The environment must allow the branch used to dispatch Release or `wheel-publish.yml`. For a support release, explicitly allow its support branch before dispatching. Required reviewers, if configured, must approve the PyPI job. An existing wheel on PyPI is skipped; PyPI does not allow replacing a published wheel.
-
-If a stable release did not reach PyPI, publish the wheel without rerunning Release:
-
-```shell
-gh workflow run wheel-publish.yml -R NVIDIA/OpenShell --ref main \
-  -f release-tag=vX.Y.Z -f source-sha=<tag commit> -f python-version=X.Y.Z
-```
-
-Development and prerelease wheels remain GitHub Release assets and do not publish to PyPI.
+Core no longer builds or publishes the Python SDK for releases. Stable and prerelease GitHub Releases carry no wheel, and nothing in core publishes to PyPI. `openshell` `0.1.7` is the last core-built wheel. From `0.1.8` on, [ai-openshell/sdk-python](https://github.com/ai-openshell/sdk-python) publishes `openshell` on the same day as each stable core release, once its update PR for the core tag merges. The rolling `dev` release still attaches a development wheel until the SDK sources leave core (NVIDIA/OpenShell#5287).
@@ -20,9 +20,6 @@ on:
         required: true
         type: boolean
     outputs:
-      python_version:
-        description: Python package version
-        value: ${{ jobs.compute-versions.outputs.python_version }}
       npm_version:
         description: TypeScript package version
         value: ${{ jobs.compute-versions.outputs.npm_version }}
@@ -56,7 +53,6 @@ jobs:
       run:
         shell: nix develop -c bash -euo pipefail {0}
     outputs:
-      python_version: ${{ steps.v.outputs.python }}
       cargo_version: ${{ steps.v.outputs.cargo }}
       npm_version: ${{ steps.v.outputs.npm }}
       deb_version: ${{ steps.v.outputs.deb }}
@@ -106,7 +102,6 @@ jobs:
           fi
           {
             echo "is_prerelease=${is_prerelease}"
-            echo "python=$(uv run --no-project python tasks/scripts/release.py get-version --python)"
             echo "cargo=$(uv run --no-project python tasks/scripts/release.py get-version --cargo)"
             echo "npm=$(uv run --no-project python tasks/scripts/release.py get-version --npm)"
             echo "deb=$(uv run --no-project python tasks/scripts/release.py get-version --deb)"
@@ -160,46 +155,6 @@ jobs:
       push-images: ${{ inputs.is-prerelease }}
       checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
 
-  build-python-wheel:
-    name: Build Python Wheel
-    needs: [compute-versions]
-    runs-on: linux-amd64-cpu8
-    timeout-minutes: 20
-    defaults:
-      run:
-        shell: nix develop -c bash -euo pipefail {0}
-    env:
-      SETUPTOOLS_SCM_PRETEND_VERSION_FOR_OPENSHELL: ${{ needs.compute-versions.outputs.python_version }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-          ref: ${{ needs.compute-versions.outputs.source_sha }}
-
-      - uses: ./.github/actions/setup-nix
-        with:
-          prepare-shell: "true"
-
-      - name: Sync Python dependencies
-        run: uv sync --frozen
-
-      - name: Build Python wheel
-        run: |
-          set -euo pipefail
-          uv run --frozen python tasks/scripts/generate_python_proto.py
-          uv build --wheel --out-dir target/wheels
-          uv run --no-project python tasks/scripts/verify-python-wheel.py target/wheels \
-            --expected-version "${SETUPTOOLS_SCM_PRETEND_VERSION_FOR_OPENSHELL}"
-          ls -la target/wheels/*.whl
-
-      - name: Upload wheel artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: python-wheel
-          path: target/wheels/*.whl
-          retention-days: 5
-
   build-deb:
     name: Build Debian Packages
     needs: [compute-versions, build-binaries, build-vm-driver]
 
@@ -124,7 +124,6 @@ jobs:
       release-tag: ${{ needs.resolve.outputs.tag }}
       source-sha: ${{ needs.build.outputs.source_sha }}
       semver: ${{ needs.build.outputs.semver }}
-      python-version: ${{ needs.build.outputs.python_version }}
       npm-version: ${{ needs.build.outputs.npm_version }}
       is-prerelease: true
     secrets:
 
@@ -27,10 +27,6 @@ on:
         description: Release version without the v prefix
         required: true
         type: string
-      python-version:
-        description: Python package version
-        required: true
-        type: string
       npm-version:
         description: TypeScript package version
         required: true
@@ -116,12 +112,6 @@ jobs:
           name: prover-checksums
           path: release/
 
-      - name: Download wheel artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: python-wheel
-          path: release/
-
       - name: Download Debian package artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -143,16 +133,6 @@ jobs:
           path: release/
           merge-multiple: true
 
-      - name: Verify wheel count
-        run: |
-          set -euo pipefail
-          shopt -s nullglob
-          wheels=(release/*.whl)
-          if [ "${#wheels[@]}" -ne 1 ]; then
-            echo "expected exactly one Python wheel, found ${#wheels[@]}" >&2
-            exit 1
-          fi
-
       - name: Generate checksums
         run: |
           set -euo pipefail
@@ -165,8 +145,7 @@ jobs:
             openshell-driver-vm-aarch64-unknown-linux-gnu.tar.gz \
             openshell-driver-vm-aarch64-apple-darwin.tar.gz \
             openshell_*.deb \
-            openshell-*.rpm \
-            *.whl > openshell-checksums-sha256.txt
+            openshell-*.rpm > openshell-checksums-sha256.txt
           cat openshell-checksums-sha256.txt
           sha256sum -- \
             openshell-gateway-x86_64-unknown-linux-gnu.tar.gz \
@@ -199,7 +178,6 @@ jobs:
             release/*.tar.gz
             release/*.deb
             release/*.rpm
-            release/*.whl
 
       - name: Upload assembled release assets
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -428,7 +406,6 @@ jobs:
             release/openshell-prover-x86_64-unknown-linux-musl.tar.gz
             release/openshell-prover-aarch64-unknown-linux-musl.tar.gz
             release/openshell-prover-aarch64-apple-darwin.tar.gz
-            release/*.whl
             release/openshell.rb
             release/openshell-checksums-sha256.txt
             release/openshell-gateway-checksums-sha256.txt
@@ -522,19 +499,6 @@ jobs:
             buf push proto --label "${RELEASE_TAG}" \
             --source-control-url "${SOURCE_CONTROL_URL}"
 
-  publish-pypi:
-    name: Publish Python Wheel
-    needs: release
-    if: ${{ !inputs.is-prerelease }}
-    permissions:
-      contents: read
-      id-token: write
-    uses: ./.github/workflows/wheel-publish.yml
-    with:
-      release-tag: ${{ inputs.release-tag }}
-      source-sha: ${{ inputs.source-sha }}
-      python-version: ${{ inputs.python-version }}
-
   publish-snap:
     name: Publish Snap
     needs: release
@@ -600,7 +564,6 @@ jobs:
       - tag-ghcr-release
       - release-helm
       - release
-      - publish-pypi
       - publish-snap
       - publish-prerelease-snap
       - publish-sdk-typescript
@@ -620,7 +583,7 @@ jobs:
           if [[ "${IS_PRERELEASE}" == "true" ]]; then
             expected+=(publish-prerelease-snap)
           else
-            expected+=(publish-pypi publish-sdk-typescript tag-sdk-go)
+            expected+=(publish-sdk-typescript tag-sdk-go)
             if [[ "${MAKE_LATEST}" == "true" ]]; then
               expected+=(publish-snap)
             fi
 
@@ -153,7 +153,6 @@ jobs:
       release-tag: ${{ needs.promote.outputs.tag }}
       source-sha: ${{ needs.build.outputs.source_sha }}
       semver: ${{ needs.build.outputs.semver }}
-      python-version: ${{ needs.build.outputs.python_version }}
       npm-version: ${{ needs.build.outputs.npm_version }}
       is-prerelease: false
       make-latest: ${{ needs.promote.outputs.make-latest == 'true' }}
 
@@ -440,7 +440,7 @@ without rerunning qualification. These artifacts have different embedded version
 from the qualified prerelease. Existing stable tags are never moved; a retry must
 resolve to the same qualified candidate. A retry rebuilds, then publishes only what
 is missing: it keeps published GHCR version tags, Helm charts, GitHub Release assets,
-npm versions, and PyPI versions. Snap uploads are not skipped.
+and npm versions. Snap uploads are not skipped.
 
 Stable image builds save multi-platform OCI archives as workflow artifacts without
 pushing to GHCR. Publication copies those archives, including their attestations,
@@ -725,14 +725,13 @@ Each step that publishes to an external registry, store, or site lives in its ow
 | `.github/workflows/release-auto-tag.yml` | Weekdays at 14:00 Europe/Zurich, tags the next `-pre.N` on `main` when commits landed since the latest one, then dispatches Pre-release. It skips when the train has no `-pre.1` or its version is already stable, so push each train's `-pre.1` tag by hand. |
 | `.github/workflows/release-prerelease.yml` | Pre-release orchestrator, triggered by prerelease tag pushes or dispatched by Release Auto-Tag or manually. A tagless dispatch creates the next candidate on its branch; explicit tags select existing candidates. Builds, then publishes and qualifies in parallel. Qualification failure fails the run and sends the failure notification; published artifacts remain available. |
 | `.github/workflows/release-build.yml` | Shared version computation, binary and image builds, and package builds. Validates that the tag matches the caller's release kind. |
-| `.github/workflows/release-publish.yml` | Shared artifact assembly, OCI image tags and Helm chart publication, and package publication. Stable releases also publish release-labeled public schemas to Buf (`BUF_TOKEN` required) and GitHub Releases, and call the PyPI, snap, npm, and Go SDK publishers. |
+| `.github/workflows/release-publish.yml` | Shared artifact assembly, OCI image tags and Helm chart publication, and package publication. Stable releases also publish release-labeled public schemas to Buf (`BUF_TOKEN` required) and GitHub Releases, and call the snap, npm, and Go SDK publishers. The Python SDK is released from [ai-openshell/sdk-python](https://github.com/ai-openshell/sdk-python), so stable and prerelease GitHub Releases carry no wheel. |
 | `.github/workflows/release-notes.yml` | Shared prompt-driven release notes generation through Inference Hub, used by prerelease previews, notes-only previews, and stable releases. Stable releases reuse the promoted prerelease's preview when available. |
 | `.github/workflows/release-qualification.yml` | Reusable qualification suites and result aggregation. Runs security scans, conformance and feature integration, Docker and VM E2E, protobuf compatibility, and advisory compatibility review. |
 | `.github/workflows/snap-package.yml` | Builds snap and component artifacts for Release Dev, Release, and Pre-release without Store credentials or publication. |
 | `.github/workflows/snap-publish.yml` | Uploads existing snap and component artifacts directly to a Store channel without rebuilding. Release Dev uses `latest/edge`, Pre-release uses `latest/beta`, and Release uses `latest/stable` for the stable rebuild. Uploads queue per channel and architecture, so tagged beta and stable jobs recheck repository tags after earlier publication finishes and before updating their floating channels. Manual dispatch uploads the `snap-linux-*` artifacts from `artifact-run-id`. |
 | `.github/workflows/sdk-typescript-publish.yml` | Publishes the TypeScript SDK to GitHub Packages. Called by stable Release; manual dispatch publishes a given tag and npm version. |
 | `.github/workflows/sdk-go-tag.yml` | Creates the `sdk/go/vX.Y.Z` tag and asks the Go module proxy to fetch it. Called by stable Release; manual dispatch tags a given version and commit. |
-| `.github/workflows/wheel-publish.yml` | Publishes the wheel attached to a stable GitHub Release to PyPI with Trusted Publishing in the `pypi` environment. Called by stable Release; manual dispatch publishes a given tag. |
 | `.github/workflows/release-canary.yml` | Smoke-tests published dev artifacts in the `macos`, `ubuntu-deb`, `ubuntu-snap-system-docker`, `fedora`, and `kubernetes` (kind + Helm) jobs. Each job reaches its gateway and creates, exercises, and deletes a sandbox. The `ubuntu-snap-system-docker` job verifies a compatible system Docker lifecycle, while `ubuntu-snap-docker-preflight` tests fail-fast behavior when Docker is absent or supplied by the Docker snap. The positive snap lane also runs a local policy containment check with the packaged prover. It runs automatically after `Release Dev` succeeds and supports manual dispatch (`gh workflow run release-canary.yml --ref <branch>`). See the `test-release-canary` skill for the playbook and local kind reproduction. |
 
 ## Required status contexts