@structupath/pi-steel 0.2.1 → 0.2.3

package/DATA_PROVENANCE.json

@@ -0,0 +1,23 @@
+{
+  "schema_version": "1.0.0",
+  "datasets": [
+    {
+      "dataset_id": "structupath-structural-shapes-v1",
+      "dataset_name": "StructuPath Structural Shapes Database",
+      "shipped_file": "skills/steel-takeoff/assets/aisc-shapes-database.json",
+      "source": "Original StructuPath dataset created from StructuPath's internal structural-shape records",
+      "copyright_holder": "StructuPath",
+      "license": "MIT",
+      "authorization": "Authorized by StructuPath for public redistribution in @structupath/pi-steel under the MIT license on 2026-07-28",
+      "rows": 477,
+      "sha256": "5a7c975c4c290c34df6f7df3b4d0d0d13a00ef7c2b1f45097a49a78d245dcc91",
+      "required_fields": [
+        "type",
+        "designation",
+        "weight_per_ft"
+      ],
+      "redistribution_permission": "authorized",
+      "release_readiness": "ready"
+    }
+  ]
+}

package/DATA_PROVENANCE.md

@@ -0,0 +1,35 @@
+# Data Provenance
+
+This file records the evidence and release decision for datasets shipped by
+pi-steel. [`DATA_PROVENANCE.json`](DATA_PROVENANCE.json) is the machine-readable
+release record checked against the shipped bytes.
+
+## StructuPath Structural Shapes Database
+
+| Field | Recorded value |
+| --- | --- |
+| Dataset name | StructuPath Structural Shapes Database |
+| Shipped file | `skills/steel-takeoff/assets/aisc-shapes-database.json` |
+| Source | Original StructuPath dataset created from StructuPath's internal structural-shape records |
+| Rows in shipped JSON | 477 |
+| SHA-256 | `5a7c975c4c290c34df6f7df3b4d0d0d13a00ef7c2b1f45097a49a78d245dcc91` |
+| Repository introduction | Initial repository commit |
+| Copyright holder | StructuPath |
+| Redistribution permission | Authorized |
+| Authorization | Authorized by StructuPath for public redistribution in @structupath/pi-steel under the MIT license on 2026-07-28 |
+| License | MIT |
+| Release gate | Ready |
+
+StructuPath confirms that it created this database from its own internal
+structural-shape records and that the dataset is not sourced from AISC. StructuPath owns the
+dataset and has authorized its public redistribution in `@structupath/pi-steel`
+under the MIT license.
+
+The dataset uses standard structural-shape designations and property names.
+Those references identify industry-standard members; they do not imply that the
+shipped database was copied, transformed, or licensed from AISC.
+
+The release check verifies the recorded path, row count, required fields,
+designation uniqueness, SHA-256 digest, ownership, license, authorization, and
+release decision. Any change to the shipped bytes or provenance record requires
+a new review.

package/PUBLIC_DATA_POLICY.md

@@ -0,0 +1,52 @@
+# Public Data Policy
+
+This repository is public. Source code, documentation, tests, fixtures, generated
+goldens, commit metadata, issue text, and release artifacts must be safe for public
+distribution.
+
+## Allowed
+
+- Clearly labeled synthetic projects, customers, vendors, people, and identifiers.
+- Published standards data whose source, edition, license, and redistribution rights
+  are documented.
+- Invented dimensions and quantities that do not reproduce a private project.
+- Placeholder configuration such as `Example Fabricator` and `Example City, ST`.
+- Product behavior and generic steel-domain terminology.
+- Public gallery media reviewed before publication and pinned in the scanner by
+  exact repository path and SHA-256 digest. Replacing it requires a new review and
+  digest.
+
+## Prohibited
+
+- Private company names or identifiers other than the public StructuPath product
+  identity.
+- Customer, vendor, employee, subcontractor, or project names and contact details.
+- Real job numbers, drawing references, addresses, schedules, quotes, bids, rates,
+  margins, payroll, costs, terms, or contract language.
+- Production drawings, takeoffs, BOMs, nests, RFQs, quotes, reports, screenshots, or
+  generated artifacts, including "anonymized" copies derived from them.
+- Company profiles, logos, signatures, credentials, tokens, local absolute paths, or
+  exported cloud files.
+- Facts that link this product to a private operating company, facility, customer, or
+  internal workflow unless separately approved for publication.
+
+## Fixture Rules
+
+1. Create fixtures from scratch; do not sanitize production files for public use.
+2. Prefix project-like identifiers with `SYNTHETIC-` or `EXAMPLE-`.
+3. Use `Example Customer`, `Example Vendor`, `Example Fabricator`, and
+   `Example City, ST` unless a test requires another obviously fictional value.
+4. Omit prices and commercial terms unless the test specifically requires them. When
+   required, label values as synthetic in the same fixture.
+5. Keep private inputs and generated outputs outside the repository in ignored
+   directories such as `private/`, `local-data/`, `customer-data/`, or `outputs/`.
+6. Run `python3 scripts/check-public-data.py` before every commit and release. Before
+   pushing, also scan the outgoing range with
+   `python3 scripts/check-public-data.py --range <remote-ref>..HEAD`.
+7. Put private names and identifiers, one per line, in the ignored local file
+   `.pi-steel/private-terms.txt`; the scanner checks them without committing the
+   denylist or echoing matched text.
+
+Git history is public too. Removing a value from the current tree does not remove it
+from prior commits. Use `npm run privacy:history` for a redacted audit; history
+cleanup requires an explicit coordinated rewrite.

package/README.md

@@ -1,8 +1,23 @@
 # pi-steel
 
-Structural steel estimating skills for the [Pi coding agent](https://pi.dev) — built by working steel estimators, not by people guessing what a takeoff is.
+[![npm version](https://img.shields.io/npm/v/%40structupath%2Fpi-steel)](https://www.npmjs.com/package/@structupath/pi-steel)
+[![CI](https://github.com/StructuPath/pi-steel/actions/workflows/ci.yml/badge.svg)](https://github.com/StructuPath/pi-steel/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Pi package](https://img.shields.io/badge/Pi-package-7c3aed)](https://pi.dev/packages?name=pi-steel)
 
-By [StructuPath](https://structupath.ai), from the team behind a production structural-steel fabrication shop in Denver, CO.
+Structural-steel estimating skills for the [Pi coding agent](https://pi.dev):
+validated takeoffs, plate nesting, guarded DXF output, draft vendor RFQs, and a
+review-gated estimate pipeline.
+
+Built by [StructuPath](https://structupath.ai).
+
+## Demo
+
+![pi-steel builds a synthetic estimate package](https://raw.githubusercontent.com/StructuPath/pi-steel/main/docs/assets/pi-steel-demo.gif)
+
+This demo uses only the repository's synthetic fixture. It runs the complete
+`takeoff → nest → draft RFQ` pipeline and publishes an isolated package with a
+machine-readable `rfq_ready_for_review` outcome.
 
 ## Install
 
@@ -10,56 +25,122 @@ By [StructuPath](https://structupath.ai), from the team behind a production stru
 pi install npm:@structupath/pi-steel
 ```
 
-## What's Inside
+Then ask Pi:
 
-### `steel-takeoff` — takeoffs, BOMs, tonnage
+```text
+Do a structural-steel takeoff from these drawings and build a validated BOM.
+Nest these rectangular plate parts on 96 × 48 stock.
+Prepare a draft RFQ from this estimate.
+```
 
-Structural steel quantity takeoff with a bundled **AISC 16th Edition shapes database (477 shapes)** — W, HSS, angles, channels, pipe — plus scripts the agent runs directly:
+Run the local dependency check when using the source repository:
 
-- `lookup-member.sh` — full property set for any AISC designation (`W14X30` → plf, d, bf, A, Ix, Sx, …)
-- `calculate-weight.sh` — BOM totals with connection and misc-steel allowances, tonnage, cost sensitivity
-- `validate-bom.py` — catches invalid designations, wrong grades, duplicate marks, unreasonable weights
+```bash
+npm run doctor
+```
 
-Also includes reference guides for AISC shape families, takeoff procedures with worked examples, connection types and hardware weights, material grades, and bolt capacities.
+## What is included
 
-Ask your agent things like:
+| Skill | Purpose | Primary outputs |
+| --- | --- | --- |
+| `steel-takeoff` | Validate member designations and calculate BOM weight and tonnage | Validated BOM and findings |
+| `steel-nest` | Lay out plate parts with kerf, gap, and edge-margin controls | Nest results, cut list, reference drawings, and guarded burn DXFs |
+| `steel-rfq` | Compile estimate data into a reviewable vendor request | Draft `.xlsx` RFQ and semantic workbook record |
+| `steel-estimate` | Orchestrate the complete review-gated workflow | Immutable run directory, QA report, lineage, manifests, nesting, and draft RFQ |
 
-> "Do a takeoff from these drawings and build me a BOM"
-> "What's the lightest W-shape with depth ≥ 18" and Ix ≥ 1000?"
-> "Total tonnage on this BOM with 12% connections"
+### Takeoff
 
-### `steel-nest` — plate nesting & burn-table DXF
+`steel-takeoff` provides structural-shape lookup, weight calculation, and BOM
+validation helpers. It checks member designations, grades, duplicate marks, and
+unreasonable weights. It calculates from supplied quantities and allowances; it
+does not invent pricing.
 
-The plate-layout step CAM software does, minus the CAM seat: MaxRects bin-packing of parts onto stock plates with kerf/gap/edge-margin spacing, holes and rectangular cutouts, yield/scrap/reusable-drop numbers, and material cost. Outputs a labeled layout (PDF + PNG per plate), a cut list, and **one DXF per sheet for the burn table** (part outlines on `PROFILE`, holes on `HOLES`, origin at sheet corner — ready for ProNest/FastCAM/SigmaNEST import).
+### Nesting and DXF safety
 
-Honest about its limits: rectangular parts nest exactly; irregular parts nest by bounding box (flagged, never hidden); it deliberately does **not** emit G-code — kerf comp, lead-ins, and pierce points belong to your table's real post-processor.
+`steel-nest` uses MaxRects bin packing for rectangular parts and reports yield,
+scrap, reusable drops, and unplaced material. Irregular parts are estimated by
+bounding box and are always flagged.
 
-> "How many sheets does this job need?"
-> "Nest these parts on 96×48 plate and give me the yield"
-> "Lay this out for the burn table"
+Per-sheet `burn_plate_N.dxf` files are emitted only when the full nest is
+complete and every supported hole remains inside its part. Otherwise, pi-steel
+suppresses burn DXFs for the entire run and leaves clearly labeled estimating
+and reference artifacts for review. It does not emit G-code or claim
+machine-specific CAM compatibility.
 
-Requires `ezdxf`, `matplotlib`, `numpy` (`pip install ezdxf matplotlib numpy`).
+### Draft RFQs
 
-### `steel-rfq` — vendor quote requests
+`steel-rfq` groups material by stock family, carries approved nesting data into
+the workbook, and provides fill-in columns for vendor pricing. Workbooks remain
+drafts until a person reviews and issues them.
 
-Turns a steel estimate/takeoff spreadsheet into a standardized vendor RFQ (.xlsx): materials grouped the way vendors stock them (W-shapes / plate / flat bar), yellow fill-in pricing columns, nesting/drop reference, and terms & conditions — branded with **your** company profile. When `steel-nest` has run for the job, its cutting plan flows straight into the RFQ's nesting table.
+Copy the example company profile to a private project location:
 
-The three skills chain into a full estimating pipeline: **takeoff → nest → RFQ**.
+```bash
+mkdir -p .pi-steel
+cp skills/steel-rfq/assets/company-profile.example.json \
+  .pi-steel/company-profile.json
+```
 
-One-time setup: copy `skills/steel-rfq/assets/company-profile.example.json` to `company-profile.json` and put in your company name, city, and payment terms. The skill will ask and offer to save it if you skip this.
+Complete that local copy with approved company information. Never commit the
+completed profile.
 
-> "Send this takeoff out for pricing"
-> "Generate an RFQ from this estimate"
+## Workflow and outcomes
 
-## Requirements
+```text
+estimate input
+    ↓
+contract validation → plate nesting → draft RFQ compilation
+    ↓
+QA findings + lineage + immutable run manifest
+    ↓
+ready | needs_review | blocked
+```
 
-- `jq` and `python3` (with `pandas` + `openpyxl` for RFQ generation)
-- macOS or Linux
+Each run is published below the requested output root and referenced by
+`latest-run.json`. Exit status `0` means geometry-verified, `2` means human
+review is required, and `3` means the workflow is blocked. A blocked run never
+contains an RFQ workbook.
 
-## License
+## Public-repository safety
 
-MIT. AISC shape data derived from the publicly available AISC Shapes Database v16.0.
+This repository and all committed examples are public. Do not add:
 
----
+- company profiles or internal business context;
+- customer, vendor, employee, project, bid, or contract data;
+- live pricing, margins, terms, credentials, or private contact information;
+- generated RFQs, takeoffs, PDFs, DXFs, spreadsheets, or output directories.
+
+Keep operational inputs and generated artifacts outside the repository. See the
+[public data policy](PUBLIC_DATA_POLICY.md) and
+[data provenance record](DATA_PROVENANCE.md) before contributing.
+
+## Documentation
+
+- [GitHub wiki](https://github.com/StructuPath/pi-steel/wiki)
+- [Public data policy](PUBLIC_DATA_POLICY.md)
+- [Data provenance](DATA_PROVENANCE.md)
+- [Pi package catalog](https://pi.dev/packages?name=pi-steel)
+- [npm package](https://www.npmjs.com/package/@structupath/pi-steel)
+
+## Development
+
+```bash
+npm test                 # base, no-render suite
+npm run test:full        # PDF/PNG/DXF/LibreOffice smoke tests
+npm run privacy:check    # current public-repository data guard
+npm run privacy:history  # redacted audit of reachable history
+npm run pack:check       # npm contents and installed-runtime smoke test
+npm run provenance:check # shape-data integrity and recorded decision
+npm run release:check    # complete release gate
+```
+
+The current package version is `0.2.3`. `release:check` verifies the test,
+privacy, package-content, shape-data integrity, ownership, license, and
+redistribution contracts before publication.
+
+## License
 
-Building software for steel fabricators? See [structupath.ai](https://structupath.ai).
+StructuPath-authored code, documentation, and the bundled StructuPath Structural
+Shapes Database are distributed under the MIT license. Dataset ownership,
+authorization, and integrity evidence are documented in
+[DATA_PROVENANCE.md](DATA_PROVENANCE.md).

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@structupath/pi-steel",
-  "version": "0.2.1",
-  "description": "Structural steel estimating skills for the Pi coding agent — AISC takeoffs, bills of material, tonnage calcs, plate nesting with burn-table DXF output, and vendor RFQ generation.",
+  "version": "0.2.3",
+  "description": "Structural steel estimating for Pi — validated takeoffs, plate nesting, guarded DXF output, and review-ready RFQ packages.",
   "type": "module",
   "keywords": [
     "pi-package",
@@ -10,7 +10,6 @@
     "structural-steel",
     "estimating",
     "takeoff",
-    "aisc",
     "bom",
     "rfq",
     "construction",
@@ -30,14 +29,46 @@
   "engines": {
     "node": ">=20.6.0"
   },
+  "scripts": {
+    "doctor": "python3 scripts/doctor.py",
+    "lint": "ruff check skills scripts tests",
+    "test": "python3 -m pytest -m 'not full_render'",
+    "test:contracts": "python3 -m pytest tests/test_contracts.py tests/test_run_manifests.py tests/test_rfq_workbook_contract.py",
+    "test:full": "python3 -m pytest -m full_render",
+    "test:runtime": "python3 -m pytest tests/test_runtime_bootstrap.py tests/test_run_manifests.py tests/test_installed_scripts.py",
+    "privacy:check": "python3 scripts/check-public-data.py",
+    "privacy:history": "python3 scripts/check-public-data.py --history",
+    "provenance:check": "python3 scripts/check-data-provenance.py",
+    "pack:check": "python3 -m pytest tests/test_package_contents.py tests/test_installed_scripts.py",
+    "pack:dry-run": "npm pack --dry-run",
+    "release:check": "npm test && npm run privacy:check && npm run pack:check && python3 scripts/check-data-provenance.py --release",
+    "prepublishOnly": "npm run release:check"
+  },
   "pi": {
     "skills": [
       "./skills"
-    ]
+    ],
+    "image": "https://raw.githubusercontent.com/StructuPath/pi-steel/main/docs/assets/pi-steel-gallery.webp"
   },
   "files": [
     "skills",
+    "!skills/**/__pycache__",
+    "!skills/**/*.pyc",
+    "!skills/**/company-profile.json",
+    "scripts/doctor.py",
+    "scripts/check-public-data.py",
+    "scripts/check-data-provenance.py",
+    "pyproject.toml",
+    "requirements.txt",
+    "requirements-tested.txt",
+    "requirements-dev.txt",
+    "requirements-render.txt",
+    "DATA_PROVENANCE.md",
+    "DATA_PROVENANCE.json",
+    "docs/assets/pi-steel-demo.gif",
+    "docs/assets/pi-steel-gallery.webp",
     "README.md",
+    "PUBLIC_DATA_POLICY.md",
     "LICENSE"
   ]
 }

package/pyproject.toml

@@ -0,0 +1,28 @@
+[project]
+name = "pi-steel-runtime"
+version = "0.2.3"
+description = "Python runtime dependencies and test configuration for pi-steel"
+requires-python = ">=3.11,<3.14"
+dependencies = [
+  "ezdxf>=1.3,<2",
+  "jsonschema>=4.23,<5",
+  "matplotlib>=3.9,<4",
+  "numpy>=2.1,<3",
+  "openpyxl>=3.1,<4",
+  "pandas>=2.2,<3",
+]
+
+[project.optional-dependencies]
+test = [
+  "pytest>=8.3,<10",
+]
+
+[tool.pytest.ini_options]
+addopts = "-ra"
+testpaths = ["tests"]
+markers = [
+  "full_render: requires LibreOffice and Poppler system tools",
+]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/*.py" = ["E402"]

package/requirements-dev.txt

@@ -0,0 +1,5 @@
+-r requirements.txt
+
+# Base test tier; full-render tests also require the documented system tools.
+pytest>=8.3,<10
+ruff>=0.11,<0.12

package/requirements-render.txt

@@ -0,0 +1 @@
+# Full-render tests additionally require LibreOffice and Poppler system tools.

package/requirements-tested.txt

@@ -0,0 +1,9 @@
+# Exact environment exercised during the v0.3 runtime bootstrap work.
+jsonschema==4.26.0
+openpyxl==3.1.5
+pandas==2.3.3
+pytest==9.0.2
+ruff==0.11.13
+ezdxf==1.4.4
+matplotlib==3.10.9
+numpy==2.4.1

package/requirements.txt

@@ -0,0 +1,7 @@
+# Required by the validated estimate and RFQ runtime.
+ezdxf>=1.3,<2
+jsonschema>=4.23,<5
+matplotlib>=3.9,<4
+numpy>=2.1,<3
+openpyxl>=3.1,<4
+pandas>=2.2,<3

package/scripts/check-data-provenance.py

@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""Verify shipped shape data and enforce its public-release decision."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+PROVENANCE_PATH = ROOT / "DATA_PROVENANCE.md"
+PROVENANCE_RECORD_PATH = ROOT / "DATA_PROVENANCE.json"
+
+
+def audit() -> dict:
+    errors: list[str] = []
+    try:
+        parsed_record = json.loads(PROVENANCE_RECORD_PATH.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        errors.append("DATA_PROVENANCE.json is missing or invalid")
+        parsed_record = {}
+    if not isinstance(parsed_record, dict):
+        errors.append("DATA_PROVENANCE.json must contain an object")
+        parsed_record = {}
+
+    datasets = parsed_record.get("datasets", [])
+    if (
+        not isinstance(datasets, list)
+        or len(datasets) != 1
+        or not isinstance(datasets[0], dict)
+    ):
+        errors.append("expected exactly one declared shipped dataset object")
+        dataset = {}
+    else:
+        dataset = datasets[0]
+
+    shipped_file = dataset.get("shipped_file")
+    if not isinstance(shipped_file, str) or not shipped_file:
+        errors.append("declared dataset must have a non-empty shipped_file")
+        raw = b""
+    else:
+        shapes_path = ROOT / shipped_file
+        try:
+            raw = shapes_path.read_bytes()
+        except OSError:
+            errors.append("declared shape data is missing or unreadable")
+            raw = b""
+
+    checksum = hashlib.sha256(raw).hexdigest()
+    if checksum != dataset.get("sha256"):
+        errors.append("shape data checksum differs from DATA_PROVENANCE.json")
+
+    try:
+        rows = json.loads(raw)
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        errors.append("declared shape data is not valid JSON")
+        rows = []
+
+    expected_rows = dataset.get("rows")
+    if not isinstance(rows, list) or len(rows) != expected_rows:
+        errors.append(f"expected {expected_rows} shape rows")
+        rows = rows if isinstance(rows, list) else []
+
+    required_fields = set(dataset.get("required_fields", []))
+    designations: list[str] = []
+    for index, row in enumerate(rows):
+        if not isinstance(row, dict):
+            errors.append(f"shape row {index} is not an object")
+            continue
+        missing = required_fields - row.keys()
+        if missing:
+            errors.append(f"shape row {index} is missing {sorted(missing)}")
+        designation = row.get("designation")
+        if isinstance(designation, str):
+            designations.append(designation)
+
+    if len(designations) != len(set(designations)):
+        errors.append("shape designations are not unique")
+
+    try:
+        provenance = PROVENANCE_PATH.read_text(encoding="utf-8")
+    except OSError:
+        errors.append("DATA_PROVENANCE.md is missing or unreadable")
+        provenance = ""
+
+    permission = dataset.get("redistribution_permission")
+    release_readiness = dataset.get("release_readiness")
+    if release_readiness == "ready" and permission != "authorized":
+        errors.append("release-ready data must have authorized redistribution")
+
+    documented_values = (
+        dataset.get("dataset_name"),
+        dataset.get("source"),
+        dataset.get("copyright_holder"),
+        dataset.get("license"),
+        dataset.get("authorization"),
+        str(expected_rows),
+        dataset.get("sha256"),
+        "Redistribution permission | Authorized",
+        "Release gate | Ready",
+    )
+    if not all(value and value in provenance for value in documented_values):
+        errors.append("DATA_PROVENANCE.md differs from the machine-readable record")
+
+    return {
+        "schema_version": "1.0.0",
+        "integrity": "passed" if not errors else "failed",
+        "dataset_id": dataset.get("dataset_id"),
+        "dataset_name": dataset.get("dataset_name"),
+        "copyright_holder": dataset.get("copyright_holder"),
+        "license": dataset.get("license"),
+        "release_readiness": release_readiness,
+        "redistribution_permission": permission,
+        "shape_rows": len(rows),
+        "sha256": checksum,
+        "errors": errors,
+    }
+
+
+def main(argv=None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--release",
+        action="store_true",
+        help="fail while redistribution permission is unresolved",
+    )
+    args = parser.parse_args(argv)
+    report = audit()
+    print(json.dumps(report, indent=2, sort_keys=True))
+    if report["errors"]:
+        return 1
+    if args.release and report["release_readiness"] != "ready":
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())