qss 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 298d080077a7200c16e8bb30144a56c1dd876db158ad236455f297a281ce287b
-  data.tar.gz: 6288a783b524391c779c63cbf2ff35f3c1ef10e5934cb4f93cb51539222a2cc7
+  metadata.gz: c68b04b280ac5a32cc4f515273e2209c7f406800fff01205e6b26842ba0b1412
+  data.tar.gz: e4b7069f106a33390f8052b21fb9e569e84ef501dc957858ec82f33f638d73b2
 SHA512:
-  metadata.gz: 961d47aad2c2bc470c07ca6a3c247d43f687b83291d792ab0222f00308f33f66933ddcabae06bf31ca6a0a559dc2a19244a03ff0f7699ac32879eccb1094954d
-  data.tar.gz: 1d9c4be7c083119a1195f428dfc982b3965de12f105c25a962902317966c30a57a07b34358433084b7894da9fec7be7d05b70bae13b7db5a5bf22556f77033f9
+  metadata.gz: b98cd11a7ff2726c2939ead5f8f1a8cb93374cc26b6e1b188cd90c0c06e330feed753ff87f486db086b22aaa0b155ca3ca9f47bd25f8d309175e8bb9755bc644
+  data.tar.gz: ae1ad6f606a874f5fbb1b09df7463e290a2d268d97ff0e913d1ce24134d5b9354902e2636eca296d38e5c56d1f9d91093dff777b439464a9545d818ae2833fa4

data/CHANGELOG.md

@@ -5,6 +5,31 @@ versions follow [Semantic Versioning](https://semver.org/) (before 1.0, minor ve
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-19
+
+### Added
+- Three-tier stylesheet audit. The auditor now resolves classes against up to three tiers, and tiers 1 and 2 are
+  integrity-checked and otherwise silent (they surface only as an integrity failure):
+  1. **Core**: the gem's own `qss_core.css`, always known, never configured. `rake compile` marks it DO NOT EDIT and
+     writes `config/integrity.json` (its SHA-256, line endings normalized, plus the gem version); the auditor
+     verifies it before use. A mismatch, a missing file or a manifest from another version raises
+     `QSS::CoreIntegrityError`.
+  2. **Tool**: `auditor.tool_stylesheets`, a dev tool's own compiled chrome (for example Parapet's
+     `qss_application.css`). The tool seals each file when it builds it with the new `qss-seal` executable (or
+     `QSS::Integrity.seal`), which writes `<file>.qss-seal`; `--header` also marks the file DO NOT EDIT. An unsealed or
+     changed file raises `QSS::ToolIntegrityError`.
+  3. **Host**: `auditor.host_stylesheets`, the end consumer's own compiled output, as paths or globs relative to the
+     project root, plus whatever `QSS.configure(host_stylesheets: -> { ... })` returns (evaluated each time the
+     settings are read, in the host's own process). With nothing configured, a Rails host gets
+     `app/assets/builds/*.css`.
+- `QSS::IntegrityError`, the base of both integrity errors, so a host's CI can rescue and report one class.
+
+### Changed
+- Core's classes are now always known to `unresolved_class`. Before, setting `stylesheet_path` replaced core's
+  stylesheet, so a consumer that listed only its own file lost every core class. `stylesheet_path` and
+  `drywall_stylesheet_path` keep working (`stylesheet_path` counts as a host stylesheet). The Tailwind/QSS boundary
+  check is unchanged and still reads `drywall_stylesheet_path` only.
+
 ## [0.3.1] - 2026-10-19
 
 ### Fixed

data/README.md

@@ -153,6 +153,12 @@ to a rule setting a structural property (`display`, `position`, sizing, `flex*`/
 `QSS::QssAuditor` is the older class-whitelist auditor: it predates the bracket vocabulary (it reports `qss-w[200]`
 as unknown) and is kept for projects that still use its whitelist.
 
+**Three tiers of stylesheet.** Class resolution reads core's own `qss_core.css` (always, verified against the manifest
+shipped with the gem, `QSS::CoreIntegrityError` on a mismatch), any sealed tool stylesheets
+(`auditor.tool_stylesheets`, sealed by the tool's build with `qss-seal`, `QSS::ToolIntegrityError`), and the host's
+own output (`auditor.host_stylesheets`, `stylesheet_path`, `QSS.configure(host_stylesheets: -> { ... })`; a Rails host
+defaults to `app/assets/builds/*.css`).
+
 Appearance classes (colors, type styling, shadows, filters) are **deprecated** as of 0.2.0: the auditor reports each as
 orange `deprecated_decorative`, since appearance belongs to whatever fills Drywall; QSS's quantized bracket scale
 (`qss-border[2]`, `qss-text-size[14]`) is unaffected. A Drywall stylesheet compiled with the `qss` prefix is a red

data/app/assets/stylesheets/qss/qss_core.css

@@ -1,4 +1,5 @@
 @charset "UTF-8";
+/* GENERATED FILE - DO NOT EDIT. Any change is caught by the QSS integrity check (qss-seal) at audit time. */
 /*
  * QSS Core — Quantized Spatial Styling DNA
  * Driven by config/grammar.yml (via exe/qss-sync -> _qss_defaults.scss; a consumer overrides it)

data/config/grammar.yml

@@ -281,6 +281,20 @@ auditor:
   # Drywall framework configured).
   drywall_stylesheet_path: ""
 
+  # Three-tier stylesheet audit (0.4.0). Tier 1, core's own qss_core.css, is always known and always integrity-
+  # checked against the manifest shipped with the gem (QSS::CoreIntegrityError); it is not configured here.
+  #
+  # Tier 2, tool_stylesheets: a dev tool's own compiled chrome (for example Parapet's qss_application.css). Paths or
+  # globs relative to the project root. Each must be sealed by its owner (`qss-seal`); an unsealed or changed one
+  # raises QSS::ToolIntegrityError. Its classes resolve silently, nothing else is reported.
+  tool_stylesheets: []
+
+  # Tier 3, host_stylesheets: the end consumer's own compiled output (QSS overrides and Drywall). Paths or globs
+  # relative to the project root, plus whatever QSS.configure(host_stylesheets: -> { ... }) returns. When both are
+  # empty (and stylesheet_path is too), a Rails host gets app/assets/builds/*.css. stylesheet_path above still
+  # works and counts as a host stylesheet.
+  host_stylesheets: []
+
 # Files exe/qss-sync generates into. core_variables, engine, auditor and native_auditor are core's own files,
 # relative to core's root; variables is the consumer's, relative to the directory the sync is run from, and a consumer
 # normally sets it in its own config file. (Keeps file locations out of the script itself.)

data/config/integrity.json

@@ -0,0 +1,6 @@
+{
+  "version": "0.4.0",
+  "files": {
+    "qss_core.css": "1212d0a43bc833894dd1fe5eac7f0446d34d47dc68ee2130cf6b40aee741cd80"
+  }
+}

data/exe/qss-seal

@@ -0,0 +1,26 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Seals a tool-tier stylesheet (a dev tool's own compiled chrome) so the QSS auditor can verify it has not been
+# changed since it was built: writes <stylesheet>.qss-seal next to it. Run it as the last step of the tool's build.
+#
+#   qss-seal path/to/qss_application.css [--header]
+#
+# --header also marks the file DO NOT EDIT (idempotent). An audit that finds the file changed after sealing
+# raises QSS::ToolIntegrityError.
+require_relative "../lib/qss/version"
+require_relative "../lib/qss/integrity"
+
+header = ARGV.delete("--header")
+paths = ARGV
+if paths.empty? || paths.any? { |p| p.start_with?("-") }
+  warn "usage: qss-seal STYLESHEET... [--header]"
+  exit 1
+end
+
+paths.each do |path|
+  puts "Sealed #{path} -> #{QSS::Integrity.seal(path, header: !header.nil?)}"
+rescue QSS::IntegrityError => e
+  warn e.message
+  exit 1
+end

data/lib/qss/configuration.rb

@@ -41,8 +41,11 @@ module QSS
   class Configuration
     attr_reader :root, :config_path
 
-    def initialize(root: nil, config: nil)
+    # host_stylesheets: an optional callable returning the host app's compiled stylesheet paths (or globs), called
+    # each time the settings are read, in the host's own process. Added to the config file's host_stylesheets.
+    def initialize(root: nil, config: nil, host_stylesheets: nil)
       @root = root && File.expand_path(root.to_s)
+      @host_stylesheets = host_stylesheets
       @config_path = config && resolve(config.to_s)
       @cache = {}
     end
@@ -83,6 +86,11 @@ module QSS
       settings["registry_path"] = resolve(settings["registry_path"])
       settings["stylesheet_path"] = resolve(settings["stylesheet_path"])
       settings["drywall_stylesheet_path"] = resolve(settings["drywall_stylesheet_path"])
+      settings["tool_stylesheets"] = stylesheet_list("tool_stylesheets", settings["tool_stylesheets"]) if settings.key?("tool_stylesheets")
+      if settings.key?("host_stylesheets")
+        settings["host_stylesheets"] = stylesheet_list("host_stylesheets", settings["host_stylesheets"], @host_stylesheets&.call)
+        settings["host_stylesheets"] = rails_default_stylesheets if settings["host_stylesheets"].empty? && settings["stylesheet_path"].empty?
+      end
       settings.freeze
     end
 
@@ -93,6 +101,30 @@ module QSS
 
     private
 
+    # tool_stylesheets / host_stylesheets: a list of paths or globs (relative to the root), expanded to the files that
+    # exist now, in a stable order. Anything but a list of strings is a ConfigurationError.
+    def stylesheet_list(key, configured, extra = nil)
+      entries = configured.nil? ? [] : configured
+      unless entries.is_a?(Array) && entries.all?(String)
+        raise ConfigurationError, "auditor.#{key} must be a list of paths or globs, got #{entries.inspect}"
+      end
+
+      (entries + Array(extra).map(&:to_s)).flat_map do |entry|
+        next [] if entry.empty?
+
+        path = resolve(entry)
+        entry.match?(/[*?\[{]/) ? Dir.glob(path).sort : [ path ]
+      end.uniq
+    end
+
+    # A Rails host that configures nothing gets its built CSS (cssbundling-rails / tailwindcss-rails output).
+    def rails_default_stylesheets
+      base = root_or_default
+      return [] unless base && defined?(Rails) && Rails.respond_to?(:root)
+
+      Dir.glob(File.join(base, "app", "assets", "builds", "*.css")).sort
+    end
+
     def deep_merge(base, over)
       return over unless base.is_a?(Hash) && over.is_a?(Hash)
 
@@ -105,8 +137,8 @@ module QSS
       @configuration ||= Configuration.new
     end
 
-    def configure(root:, config: nil)
-      @configuration = Configuration.new(root: root, config: config)
+    def configure(root:, config: nil, host_stylesheets: nil)
+      @configuration = Configuration.new(root: root, config: config, host_stylesheets: host_stylesheets)
     end
   end
 end

data/lib/qss/integrity.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+
+module QSS
+  # Base class for every integrity failure, so a host app's CI can rescue one thing and report it.
+  class IntegrityError < StandardError; end
+
+  # The gem's own compiled stylesheet no longer matches what this gem version shipped (edited, truncated, or from
+  # another version). QSS never audits against a core it cannot vouch for.
+  class CoreIntegrityError < IntegrityError; end
+
+  # A tool-tier stylesheet (a dev tool's own chrome, for example Parapet's qss_application.css) is unsealed or no
+  # longer matches its seal. The seal is owned by the tool: it writes it at build time with `qss-seal`.
+  class ToolIntegrityError < IntegrityError; end
+
+  # Tier 1 (core) and tier 2 (tool) stylesheet integrity. A stylesheet's fingerprint is the SHA-256 of its content
+  # with line endings normalized to LF, so a CRLF working tree (this repo's own) and an LF checkout agree.
+  #
+  # Core's fingerprint lives in config/integrity.json, written by `rake compile` and shipped in the gem together
+  # with the version it belongs to. A tool's lives in a sidecar `<stylesheet>.qss-seal` written by `qss-seal`.
+  module Integrity
+    CORE_CSS = File.expand_path("../../app/assets/stylesheets/qss/qss_core.css", __dir__)
+    CORE_MANIFEST = File.expand_path("../../config/integrity.json", __dir__)
+    SEAL_SUFFIX = ".qss-seal"
+    HEADER = "/* GENERATED FILE - DO NOT EDIT. Any change is caught by the QSS integrity check (qss-seal) at audit time. */"
+
+    VERIFIED = {}
+    private_constant :VERIFIED
+
+    class << self
+      def digest(path)
+        Digest::SHA256.hexdigest(File.binread(path).gsub("\r\n", "\n"))
+      end
+
+      # Raises CoreIntegrityError unless core's stylesheet matches the manifest shipped with this gem version.
+      def verify_core!
+        check(CORE_CSS, :core, CORE_MANIFEST) do
+          manifest = read_json(CORE_MANIFEST) { |why| raise CoreIntegrityError, "QSS core integrity manifest #{why}" }
+          unless manifest["version"] == QSS::VERSION
+            raise CoreIntegrityError, "QSS core integrity manifest is for qss #{manifest['version'].inspect}, " \
+                                      "this is qss #{QSS::VERSION}"
+          end
+          raise CoreIntegrityError, "QSS core stylesheet #{CORE_CSS} is missing" unless File.file?(CORE_CSS)
+
+          expected = manifest.dig("files", "qss_core.css")
+          raise CoreIntegrityError, "QSS core integrity manifest lists no qss_core.css" if expected.to_s.empty?
+          next if expected == digest(CORE_CSS)
+
+          raise CoreIntegrityError, "#{CORE_CSS} does not match the stylesheet qss #{QSS::VERSION} shipped; " \
+                                    "reinstall the gem, never edit it"
+        end
+      end
+
+      # Raises ToolIntegrityError unless the tool's stylesheet exists, is sealed, and still matches its seal.
+      def verify_tool!(path)
+        check(path, :tool) do
+          raise ToolIntegrityError, "tool stylesheet #{path} does not exist" unless File.file?(path)
+
+          seal = seal_path(path)
+          unless File.file?(seal)
+            raise ToolIntegrityError, "tool stylesheet #{path} is not sealed; run `qss-seal #{path}` when it is built"
+          end
+          expected = read_json(seal) { |why| raise ToolIntegrityError, "seal #{seal} #{why}" }["sha256"]
+          next if expected == digest(path)
+
+          raise ToolIntegrityError, "#{path} does not match its seal (#{File.basename(seal)}); it was changed after " \
+                                    "it was built. Rebuild it, then run `qss-seal`"
+        end
+      end
+
+      # Writes the seal for a tool stylesheet. With header: true, first marks the file DO NOT EDIT (idempotent).
+      def seal(path, header: false)
+        raise ToolIntegrityError, "cannot seal #{path}: no such file" unless File.file?(path)
+
+        add_header(path) if header
+        File.write(seal_path(path), JSON.pretty_generate("sha256" => digest(path), "sealed_by" => "qss #{QSS::VERSION}") + "\n")
+        VERIFIED.clear
+        seal_path(path)
+      end
+
+      # Maintainer step (rake compile / rake seal): writes core's manifest for the current qss_core.css.
+      def write_core_manifest!
+        add_header(CORE_CSS)
+        File.write(CORE_MANIFEST, JSON.pretty_generate("version" => QSS::VERSION, "files" => { "qss_core.css" => digest(CORE_CSS) }) + "\n")
+        VERIFIED.clear
+      end
+
+      def seal_path(path)
+        "#{path}#{SEAL_SUFFIX}"
+      end
+
+      private
+
+      # Runs the block once per (path, mtime, size): the audit calls this for every file it checks.
+      def check(path, tier, *also)
+        stamp = File.file?(path) ? [ path, *also ].map { |f| File.file?(f) ? [ File.mtime(f), File.size(f) ] : nil } : nil
+        return if VERIFIED[[ tier, path ]] == stamp && stamp
+
+        yield
+        VERIFIED[[ tier, path ]] = stamp
+      end
+
+      def read_json(path)
+        return yield("is missing (#{path})") unless File.file?(path)
+
+        JSON.parse(File.read(path))
+      rescue JSON::ParserError
+        yield("is not valid JSON (#{path})")
+      end
+
+      # The header goes after a leading @charset (which only counts as the very first thing in the file).
+      def add_header(path)
+        text = File.binread(path).force_encoding("UTF-8")
+        return if text.include?(HEADER)
+
+        eol = text.include?("\r\n") ? "\r\n" : "\n"
+        charset = text[/\A@charset [^;]+;\r?\n/]
+        File.binwrite(path, "#{charset}#{HEADER}#{eol}#{text.delete_prefix(charset.to_s)}")
+      end
+    end
+  end
+end

data/lib/qss/qss_auditor.rb

@@ -123,7 +123,7 @@ module QSS
 
     BRAND_COLORS = {"black"=>"#000000", "white"=>"#ffffff", "transparent"=>"transparent", "none"=>"none", "slate-50"=>"#f8fafc", "slate-100"=>"#f1f5f9", "slate-200"=>"#e2e8f0", "slate-300"=>"#cbd5e1", "slate-400"=>"#94a3b8", "slate-500"=>"#64748b", "slate-600"=>"#475569", "slate-700"=>"#334155", "slate-800"=>"#1e293b", "slate-900"=>"#0f172a", "slate-950"=>"#020617", "rose-500"=>"#f43f5e"}.freeze
 
-    AUDITOR_CONFIG = {"id_prefix"=>"", "structural_words"=>["header", "footer", "sidebar", "workspace", "main", "panel", "frame", "wrapper", "nav", "aside"], "narrow_words"=>["header", "footer", "sidebar", "workspace", "main", "panel", "frame", "wrapper", "nav", "aside"], "icon_prefixes"=>[], "registry_path"=>"", "stylesheet_path"=>"", "drywall_stylesheet_path"=>"", "portal_root"=>"#qss-portal"}.freeze
+    AUDITOR_CONFIG = {"id_prefix"=>"", "structural_words"=>["header", "footer", "sidebar", "workspace", "main", "panel", "frame", "wrapper", "nav", "aside"], "narrow_words"=>["header", "footer", "sidebar", "workspace", "main", "panel", "frame", "wrapper", "nav", "aside"], "icon_prefixes"=>[], "registry_path"=>"", "stylesheet_path"=>"", "drywall_stylesheet_path"=>"", "tool_stylesheets"=>[], "host_stylesheets"=>[], "portal_root"=>"#qss-portal"}.freeze
     # QSS-GENERATED-END
     # rubocop:enable all
 

data/lib/qss/qss_native_auditor.rb

@@ -9,7 +9,7 @@ module QSS
     # GENERATED FROM grammar.yml - DO NOT EDIT
     PAYLOAD_TAGS = ["p", "h1", "h2", "h3", "h4", "h5", "h6", "span", "label", "blockquote", "li"].freeze
 
-    AUDITOR_CONFIG = {"id_prefix"=>"", "structural_words"=>["header", "footer", "sidebar", "workspace", "main", "panel", "frame", "wrapper", "nav", "aside"], "narrow_words"=>["header", "footer", "sidebar", "workspace", "main", "panel", "frame", "wrapper", "nav", "aside"], "icon_prefixes"=>[], "registry_path"=>"", "stylesheet_path"=>"", "drywall_stylesheet_path"=>"", "portal_root"=>"#qss-portal"}.freeze
+    AUDITOR_CONFIG = {"id_prefix"=>"", "structural_words"=>["header", "footer", "sidebar", "workspace", "main", "panel", "frame", "wrapper", "nav", "aside"], "narrow_words"=>["header", "footer", "sidebar", "workspace", "main", "panel", "frame", "wrapper", "nav", "aside"], "icon_prefixes"=>[], "registry_path"=>"", "stylesheet_path"=>"", "drywall_stylesheet_path"=>"", "tool_stylesheets"=>[], "host_stylesheets"=>[], "portal_root"=>"#qss-portal"}.freeze
     # QSS-GENERATED-END
     # rubocop:enable all
 
@@ -455,6 +455,7 @@ module QSS
 
       def self.load(path)
         path = path.to_s.empty? ? CORE_CSS_PATH : path
+        QSS::Integrity.verify_core! if path == CORE_CSS_PATH
         return Set.new unless File.exist?(path)
         mtime = File.mtime(path)
         cached = CACHE[path]
@@ -914,15 +915,18 @@ module QSS
       narrow_pattern = narrow_structural_pattern(settings)
       portal_label = portal_label(settings)
       registry = Registry.load(settings['registry_path'])
-      known_classes = Stylesheet.load(settings['stylesheet_path'])
+      # Three tiers (0.4.0). Core's own CSS is always known and always integrity-checked; a tool's sealed chrome
+      # resolves silently; the host's own output (host_stylesheets, plus the older stylesheet_path) is what its markup
+      # renders against. A class resolving in the Drywall framework's own compiled CSS is just as real (DESIGN_HISTORY
+      # #12.8: unresolved_class once ignored drywall_stylesheet_path, flagging every real Tailwind class dead).
       drywall_stylesheet_path = settings['drywall_stylesheet_path'].to_s
-      # A class resolving in the Drywall framework's own compiled CSS is just as real as one resolving in QSS's
-      # own -- unresolved_class checked only stylesheet_path before this, so every genuinely real, genuinely
-      # compiled Drywall decoration class (color, typography, spacing, ...) was flagged dead regardless (confirmed
-      # bug, DESIGN_HISTORY #12.8: reproduced against a real Tailwind build, outside any consumer's own debt).
+      host_stylesheets = ([ settings['stylesheet_path'].to_s ] + Array(settings['host_stylesheets'])).reject(&:empty?).uniq
+      Array(settings['tool_stylesheets']).each { |path| QSS::Integrity.verify_tool!(path) }
+      known_classes = Stylesheet.load('')
+      (Array(settings['tool_stylesheets']) + host_stylesheets).each { |path| known_classes |= Stylesheet.load(path) }
       known_classes |= Stylesheet.load(drywall_stylesheet_path) unless drywall_stylesheet_path.empty?
       drywall_properties = Stylesheet.load_properties(settings['drywall_stylesheet_path'])
-      checked_stylesheets = [ settings['stylesheet_path'].to_s.empty? ? "core's qss_core.css" : settings['stylesheet_path'] ]
+      checked_stylesheets = [ "core's qss_core.css" ] + host_stylesheets
       checked_stylesheets << drywall_stylesheet_path unless drywall_stylesheet_path.empty?
       stylesheet_label = checked_stylesheets.size > 1 ? "either compiled stylesheet (#{checked_stylesheets.join(' or ')})" : "the compiled stylesheet (#{checked_stylesheets.first})"
       exempt_prefixes = [ prefix, IdRules::FRAMEWORK_PREFIX ]

data/lib/qss/version.rb

@@ -3,7 +3,7 @@
 module QSS
   # The gem's version. QSS::VERSION is the usual spelling; QSS::Version::STRING the same value.
   module Version
-    STRING = "0.3.1"
+    STRING = "0.4.0"
   end
 
   VERSION = Version::STRING

data/lib/qss.rb

@@ -10,6 +10,7 @@ require "json"
 require "qss/version"            # QSS::Version, QSS::VERSION
 require "qss/blueprints"         # QSS::Blueprints        (QSS.grid, QSS.object: layout arithmetic, object blueprints)
 require "qss/configuration"      # QSS::Configuration     (the consuming project's settings, read at runtime)
+require "qss/integrity"          # QSS::Integrity         (core and tool stylesheet integrity; QSS::IntegrityError)
 require "qss/qss_auditor"        # QSS::QssAuditor        (DSL-whitelist auditor)
 require "qss/qss_native_auditor" # QSS::QssNativeAuditor  (native-CSS auditor)
 require "qss/engine" if defined?(::Rails::Engine) # QSS::Engine (Rails only: serves QSS's assets)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: qss
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
 platform: ruby
 authors:
 - Kraig Fairhurst
@@ -108,6 +108,7 @@ email:
 executables:
 - qss-core-render-check
 - qss-engine-render-check
+- qss-seal
 - qss-sync
 extensions: []
 extra_rdoc_files: []
@@ -122,14 +123,17 @@ files:
 - app/assets/stylesheets/qss/qss_core.css
 - app/assets/stylesheets/qss/qss_core.scss
 - config/grammar.yml
+- config/integrity.json
 - config/qss-objects.json
 - exe/qss-core-render-check
 - exe/qss-engine-render-check
+- exe/qss-seal
 - exe/qss-sync
 - lib/qss.rb
 - lib/qss/blueprints.rb
 - lib/qss/configuration.rb
 - lib/qss/engine.rb
+- lib/qss/integrity.rb
 - lib/qss/qss_auditor.rb
 - lib/qss/qss_native_auditor.rb
 - lib/qss/version.rb