reeve 0.5.0 → 0.7.0

data/lib/reeve/testing/ledger.rb

@@ -10,7 +10,8 @@ module Reeve
     # the ledger is absent.
     #
     # A host with its own non-ActiveRecord recorder can pass any object with these six
-    # methods as `ledger:` to any ledger-reading check.
+    # methods as `ledger:` to any ledger-reading check; LedgerChain also asks for
+    # #verify_chain, and is skipped by a ledger that has none.
     class Ledger
       def self.default
         new
@@ -67,6 +68,15 @@ module Reeve
         entry_class.column_names.map(&:to_s)
       end
 
+      # The chain's verification of the whole ledger (specs/002), or nil when the ledger is
+      # not loaded. The kit's only way to the chain: it names Reeve::Audit::Chain here, at
+      # call time, so `require "reeve/testing"` still loads with no ActiveRecord at all.
+      def verify_chain
+        return nil unless available? && Reeve::Audit.const_defined?(:Chain, false)
+
+        Reeve::Audit::Chain.verify(entry_class: entry_class)
+      end
+
       private
 
       def entry_class

data/lib/reeve/testing/report.rb

@@ -31,6 +31,14 @@ module Reeve
         !results.empty? && results.all?(&:skipped?)
       end
 
+      # A check had nothing to examine — a per-tool check run over no tools at all. passed?
+      # is still true then, since nothing failed; a test framework shows the skip, but a
+      # gate with no framework (a CI script, a deploy step) has only this to stop on. A skip
+      # for a missing inventory is not this: there the tools existed and were checked.
+      def nothing_checked?
+        results.any? { |result| result.skipped? && result.details[:coverage] == :none }
+      end
+
       def failures
         results.select(&:failed?)
       end

data/lib/reeve/testing.rb

@@ -18,7 +18,7 @@ module Reeve
   #
   #   require "reeve/testing"
   #   report = Reeve::Checks.run_all(principals: [alice, bob])
-  #   abort report.to_s unless report.passed?
+  #   abort report.to_s if report.failed? || report.nothing_checked?
   module Testing
     class << self
       # The two fixture principals the compliance suite runs every tool against. Set once,

data/lib/reeve/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Reeve
-  VERSION = "0.5.0"
+  VERSION = "0.7.0"
 end

data/lib/reeve.rb

@@ -2,6 +2,7 @@
 
 require_relative "reeve/version"
 require_relative "reeve/errors"
+require_relative "reeve/ledger_key"
 require_relative "reeve/decision"
 require_relative "reeve/configuration"
 require_relative "reeve/context"
@@ -9,6 +10,7 @@ require_relative "reeve/scope_result"
 require_relative "reeve/invocation"
 require_relative "reeve/authorization"
 require_relative "reeve/inventory"
+require_relative "reeve/railtie" if defined?(Rails::Railtie)
 
 # Reeve — per-record authorization and an append-only audit ledger for the MCP tools
 # a Rails application exposes to AI agents.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: reeve
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Victor Velazquez
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-01 00:00:00.000000000 Z
+date: 2026-10-23 00:00:00.000000000 Z
 dependencies: []
 description: |
   Reeve makes it safe for a Rails application to expose MCP (Model Context Protocol)
@@ -31,9 +31,27 @@ files:
 - lib/generators/reeve/install/templates/create_audit_entries.rb.tt
 - lib/generators/reeve/install/templates/initializer.rb.tt
 - lib/generators/reeve/upgrade/templates/add_contract_version_to_reeve_audit_entries.rb.tt
+- lib/generators/reeve/upgrade/templates/add_key_epochs_to_reeve_audit_entries.rb.tt
+- lib/generators/reeve/upgrade/templates/add_ledger_chain_to_reeve_audit_entries.rb.tt
 - lib/generators/reeve/upgrade/upgrade_generator.rb
+- lib/generators/reeve/upgrade/upgrade_notes.rb
 - lib/reeve.rb
 - lib/reeve/audit.rb
+- lib/reeve/audit/chain.rb
+- lib/reeve/audit/chain/canonical.rb
+- lib/reeve/audit/chain/epoch_rules.rb
+- lib/reeve/audit/chain/epochs.rb
+- lib/reeve/audit/chain/head.rb
+- lib/reeve/audit/chain/keyring.rb
+- lib/reeve/audit/chain/normalizer.rb
+- lib/reeve/audit/chain/report.rb
+- lib/reeve/audit/chain/rotation.rb
+- lib/reeve/audit/chain/schema.rb
+- lib/reeve/audit/chain/verification.rb
+- lib/reeve/audit/chain/verifier.rb
+- lib/reeve/audit/chain/walk.rb
+- lib/reeve/audit/chain_epoch.rb
+- lib/reeve/audit/chain_record.rb
 - lib/reeve/audit/entry.rb
 - lib/reeve/audit/isolated_recorder.rb
 - lib/reeve/audit/query.rb
@@ -59,9 +77,12 @@ files:
 - lib/reeve/inventory.rb
 - lib/reeve/inventory/report.rb
 - lib/reeve/invocation.rb
+- lib/reeve/ledger_key.rb
 - lib/reeve/minitest.rb
+- lib/reeve/railtie.rb
 - lib/reeve/rspec.rb
 - lib/reeve/scope_result.rb
+- lib/reeve/tasks.rb
 - lib/reeve/testing.rb
 - lib/reeve/testing/assertions.rb
 - lib/reeve/testing/checks.rb
@@ -71,6 +92,7 @@ files:
 - lib/reeve/testing/checks/cross_principal_leak.rb
 - lib/reeve/testing/checks/endpoint_coverage.rb
 - lib/reeve/testing/checks/guard_declared.rb
+- lib/reeve/testing/checks/ledger_chain.rb
 - lib/reeve/testing/checks/principal_required.rb
 - lib/reeve/testing/checks/redaction_holds.rb
 - lib/reeve/testing/checks/rule_present.rb