reeve 0.4.0 → 0.6.0

data/lib/reeve/testing.rb

@@ -18,7 +18,7 @@ module Reeve
   #
   #   require "reeve/testing"
   #   report = Reeve::Checks.run_all(principals: [alice, bob])
-  #   abort report.to_s unless report.passed?
+  #   abort report.to_s if report.failed? || report.nothing_checked?
   module Testing
     class << self
       # The two fixture principals the compliance suite runs every tool against. Set once,
@@ -41,17 +41,23 @@ module Reeve
       end
 
       # The tools the suite walks. Unset means every tool reeve knows about — the classes
-      # that included the DSL, guarded or not. That default is what makes an unguarded
-      # tool visible rather than merely absent.
+      # that included the DSL, guarded or not, plus every class the endpoint inventory
+      # routes to, which need not have included anything. That default is what makes an
+      # unguarded tool visible rather than merely absent.
       attr_writer :compliance_tools
 
       def compliance_tools
         source = @compliance_tools || Reeve.config.compliance_tools
-        return Reeve.registry.tool_classes if source.nil?
+        return Reeve.registry.tool_classes | inventory_tools if source.nil?
 
         Array(source.respond_to?(:call) ? source.call : source)
       end
 
+      # The host said which tools it is certifying, so a run is a subset by its own account.
+      def compliance_tools_narrowed?
+        !(@compliance_tools || Reeve.config.compliance_tools).nil?
+      end
+
       def compliance_principals?
         !(@compliance_principals || Reeve.config.compliance_principals).nil?
       end
@@ -63,6 +69,16 @@ module Reeve
 
       private
 
+      # An inventory that cannot be read adds nothing here; EndpointCoverage fails on it
+      # by name, which is a better place to learn about it than an exception in every
+      # per-tool check.
+      def inventory_tools
+        inventory = Reeve.config.inventory
+        inventory ? inventory.routed_tools : []
+      rescue StandardError
+        []
+      end
+
       def missing_principals_message
         "the reeve compliance suite needs two fixture principals with disjoint records. " \
           "Set them in your test helper:\n\n  " \

data/lib/reeve/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Reeve
-  VERSION = "0.4.0"
+  VERSION = "0.6.0"
 end

data/lib/reeve.rb

@@ -2,12 +2,15 @@
 
 require_relative "reeve/version"
 require_relative "reeve/errors"
+require_relative "reeve/ledger_key"
 require_relative "reeve/decision"
 require_relative "reeve/configuration"
 require_relative "reeve/context"
 require_relative "reeve/scope_result"
 require_relative "reeve/invocation"
 require_relative "reeve/authorization"
+require_relative "reeve/inventory"
+require_relative "reeve/railtie" if defined?(Rails::Railtie)
 
 # Reeve — per-record authorization and an append-only audit ledger for the MCP tools
 # a Rails application exposes to AI agents.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: reeve
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Victor Velazquez
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-03 00:00:00.000000000 Z
+date: 2026-10-10 00:00:00.000000000 Z
 dependencies: []
 description: |
   Reeve makes it safe for a Rails application to expose MCP (Model Context Protocol)
@@ -31,9 +31,20 @@ files:
 - lib/generators/reeve/install/templates/create_audit_entries.rb.tt
 - lib/generators/reeve/install/templates/initializer.rb.tt
 - lib/generators/reeve/upgrade/templates/add_contract_version_to_reeve_audit_entries.rb.tt
+- lib/generators/reeve/upgrade/templates/add_ledger_chain_to_reeve_audit_entries.rb.tt
 - lib/generators/reeve/upgrade/upgrade_generator.rb
 - lib/reeve.rb
 - lib/reeve/audit.rb
+- lib/reeve/audit/chain.rb
+- lib/reeve/audit/chain/canonical.rb
+- lib/reeve/audit/chain/head.rb
+- lib/reeve/audit/chain/keyring.rb
+- lib/reeve/audit/chain/normalizer.rb
+- lib/reeve/audit/chain/report.rb
+- lib/reeve/audit/chain/verification.rb
+- lib/reeve/audit/chain/verifier.rb
+- lib/reeve/audit/chain/walk.rb
+- lib/reeve/audit/chain_record.rb
 - lib/reeve/audit/entry.rb
 - lib/reeve/audit/isolated_recorder.rb
 - lib/reeve/audit/query.rb
@@ -56,10 +67,15 @@ files:
 - lib/reeve/fast_mcp.rb
 - lib/reeve/integrations/fast_mcp/context_builder.rb
 - lib/reeve/integrations/fast_mcp/tool_extension.rb
+- lib/reeve/inventory.rb
+- lib/reeve/inventory/report.rb
 - lib/reeve/invocation.rb
+- lib/reeve/ledger_key.rb
 - lib/reeve/minitest.rb
+- lib/reeve/railtie.rb
 - lib/reeve/rspec.rb
 - lib/reeve/scope_result.rb
+- lib/reeve/tasks.rb
 - lib/reeve/testing.rb
 - lib/reeve/testing/assertions.rb
 - lib/reeve/testing/checks.rb
@@ -67,7 +83,9 @@ files:
 - lib/reeve/testing/checks/base.rb
 - lib/reeve/testing/checks/contract_version.rb
 - lib/reeve/testing/checks/cross_principal_leak.rb
+- lib/reeve/testing/checks/endpoint_coverage.rb
 - lib/reeve/testing/checks/guard_declared.rb
+- lib/reeve/testing/checks/ledger_chain.rb
 - lib/reeve/testing/checks/principal_required.rb
 - lib/reeve/testing/checks/redaction_holds.rb
 - lib/reeve/testing/checks/rule_present.rb