audrey 0.23.1 → 1.0.0

package/scripts/verify-paper-submission-bundle.mjs

@@ -0,0 +1,207 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { validateSchema } from '../benchmarks/validate-guardbench-artifacts.mjs';
+import { publicPath, scanFilesForLocalPaths } from '../benchmarks/public-paths.mjs';
+
+const ROOT = resolve(fileURLToPath(new URL('..', import.meta.url)));
+const DEFAULT_DIR = 'docs/paper/output/submission-bundle';
+const DEFAULT_SCHEMA = 'docs/paper/paper-submission-bundle.schema.json';
+const REQUIRED_FILES = [
+  'README.md',
+  'LICENSE',
+  'package.json',
+  'docs/paper/arxiv-compile-report.schema.json',
+  'docs/paper/output/arxiv/main.tex',
+  'docs/paper/output/arxiv/references.bib',
+  'docs/paper/output/arxiv/arxiv-manifest.json',
+  'docs/paper/output/arxiv-compile-report.json',
+  'docs/paper/audrey-paper-v1.md',
+  'docs/paper/browser-launch-plan.json',
+  'docs/paper/browser-launch-plan.schema.json',
+  'docs/paper/browser-launch-results.json',
+  'docs/paper/browser-launch-results.schema.json',
+  'docs/paper/claim-register.json',
+  'docs/paper/publication-pack.json',
+  'docs/paper/evidence-ledger.md',
+  'docs/paper/references.bib',
+  'docs/paper/SUBMISSION_README.md',
+  'benchmarks/output/guardbench-summary.json',
+  'benchmarks/output/guardbench-raw.json',
+  'benchmarks/output/external/guardbench-external-evidence.json',
+  'benchmarks/output/submission-bundle/submission-manifest.json',
+];
+const PASSED_COMPILE_FILES = [
+  'docs/paper/output/arxiv-compile/main.pdf',
+  'docs/paper/output/arxiv-compile/arxiv-compile.log',
+];
+
+function fromRoot(path) {
+  return resolve(ROOT, path);
+}
+
+function readJson(path) {
+  return JSON.parse(readFileSync(path, 'utf-8'));
+}
+
+function sha256File(path) {
+  return createHash('sha256').update(readFileSync(path)).digest('hex');
+}
+
+function walkFiles(dir, root = dir) {
+  return readdirSync(dir, { withFileTypes: true }).flatMap(entry => {
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) return walkFiles(path, root);
+    return relative(root, path).replaceAll('\\', '/');
+  });
+}
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const args = {
+    dir: DEFAULT_DIR,
+    schema: DEFAULT_SCHEMA,
+    checkSourceFreshness: true,
+    json: false,
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const token = argv[i];
+    if ((token === '--dir' || token === '--bundle-dir') && argv[i + 1]) args.dir = argv[++i];
+    else if (token === '--schema' && argv[i + 1]) args.schema = argv[++i];
+    else if (token === '--no-source-check') args.checkSourceFreshness = false;
+    else if (token === '--json') args.json = true;
+    else if (token === '--help' || token === '-h') args.help = true;
+    else throw new Error(`Unknown argument: ${token}`);
+  }
+  return args;
+}
+
+function usage() {
+  return `Usage: node scripts/verify-paper-submission-bundle.mjs [options]
+
+Options:
+  --dir <path>     Paper submission bundle directory. Default: ${DEFAULT_DIR}.
+  --schema <path>  Bundle manifest schema. Default: ${DEFAULT_SCHEMA}.
+  --no-source-check
+                  Skip checking bundled hashes against current source files.
+  --json           Print the machine-readable verification report.
+`;
+}
+
+export function verifyPaperSubmissionBundle(options = {}) {
+  const dir = fromRoot(options.dir ?? DEFAULT_DIR);
+  const schemaPath = fromRoot(options.schema ?? DEFAULT_SCHEMA);
+  const checkSourceFreshness = options.checkSourceFreshness !== false;
+  const manifestPath = join(dir, 'paper-submission-manifest.json');
+  const failures = [];
+  let manifest = null;
+
+  try {
+    manifest = readJson(manifestPath);
+  } catch (error) {
+    return {
+      ok: false,
+      dir,
+      files: [],
+      failures: [`paper-submission-manifest.json: ${error.message}`],
+    };
+  }
+
+  try {
+    const schema = readJson(schemaPath);
+    failures.push(...validateSchema(manifest, schema, 'audrey-paper-submission-bundle'));
+  } catch (error) {
+    failures.push(`schema: ${error.message}`);
+  }
+
+  const listed = new Map((manifest.files ?? []).map(file => [file.path, file]));
+  for (const file of REQUIRED_FILES) {
+    if (!listed.has(file)) failures.push(`paper-submission-manifest.json: missing required file record ${file}`);
+  }
+  const compileReport = listed.has('docs/paper/output/arxiv-compile-report.json')
+    ? readJson(join(dir, 'docs/paper/output/arxiv-compile-report.json'))
+    : null;
+  if (compileReport?.status === 'passed') {
+    for (const file of PASSED_COMPILE_FILES) {
+      if (!listed.has(file)) failures.push(`paper-submission-manifest.json: missing compile-proof file record ${file}`);
+    }
+  }
+  if (listed.has('paper-submission-manifest.json')) {
+    failures.push('paper-submission-manifest.json: must not include a self-hash file record');
+  }
+
+  for (const [file, record] of listed) {
+    const path = join(dir, file);
+    if (!existsSync(path)) {
+      failures.push(`${file}: listed in manifest but missing from bundle`);
+      continue;
+    }
+    const bytes = readFileSync(path).byteLength;
+    if (record.bytes !== bytes) failures.push(`${file}: byte length mismatch`);
+    const sha256 = sha256File(path);
+    if (record.sha256 !== sha256) failures.push(`${file}: sha256 mismatch`);
+    if (checkSourceFreshness && record.source) {
+      const sourcePath = fromRoot(record.source);
+      if (existsSync(sourcePath)) {
+        const sourceBytes = readFileSync(sourcePath).byteLength;
+        const sourceSha256 = sha256File(sourcePath);
+        if (record.bytes !== sourceBytes || record.sha256 !== sourceSha256) {
+          failures.push(`${file}: source file has changed since bundle creation`);
+        }
+      }
+    }
+  }
+
+  const actualFiles = walkFiles(dir).filter(file => file !== 'paper-submission-manifest.json').sort();
+  const listedFiles = [...listed.keys()].sort();
+  const actualSet = new Set(actualFiles);
+  const listedSet = new Set(listedFiles);
+  for (const file of actualFiles) {
+    if (!listedSet.has(file)) failures.push(`${file}: present in bundle but missing from manifest`);
+  }
+  for (const file of listedFiles) {
+    if (!actualSet.has(file)) failures.push(`${file}: listed in manifest but not present in bundle`);
+  }
+  for (const file of scanFilesForLocalPaths(dir, actualFiles)) {
+    failures.push(`${file}: contains a local absolute path`);
+  }
+  if (manifest.claimVerification?.ok !== true) failures.push('paper-submission-manifest.json: claimVerification is not ok');
+  if (manifest.publicationPackVerification?.ok !== true) failures.push('paper-submission-manifest.json: publicationPackVerification is not ok');
+  if (manifest.guardBenchSnapshot?.passed !== 10) failures.push('paper-submission-manifest.json: GuardBench passed count is not 10');
+  if (manifest.guardBenchSnapshot?.scenarios !== 10) failures.push('paper-submission-manifest.json: GuardBench scenario count is not 10');
+  if (manifest.guardBenchSnapshot?.redactionLeaks !== 0) failures.push('paper-submission-manifest.json: GuardBench decision redaction leaks are not 0');
+  if (manifest.guardBenchSnapshot?.artifactLeaks !== 0) failures.push('paper-submission-manifest.json: GuardBench artifact leaks are not 0');
+
+  return {
+    ok: failures.length === 0,
+    dir: publicPath(dir),
+    manifestPath: publicPath(manifestPath),
+    files: listedFiles,
+    failures,
+  };
+}
+
+async function main() {
+  const args = parseArgs();
+  if (args.help) {
+    console.log(usage());
+    return;
+  }
+
+  const report = verifyPaperSubmissionBundle(args);
+  if (args.json) console.log(JSON.stringify(report, null, 2));
+  else if (report.ok) console.log(`Paper submission bundle verification passed: ${report.dir}`);
+  else {
+    console.error('Paper submission bundle verification failed:');
+    for (const failure of report.failures) console.error(`- ${failure}`);
+  }
+
+  if (!report.ok) process.exit(1);
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch(error => {
+    console.error(error.stack ?? error.message);
+    process.exit(1);
+  });
+}

package/scripts/verify-publication-pack.mjs

@@ -0,0 +1,196 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { publicPath } from '../benchmarks/public-paths.mjs';
+import { validateSchema } from '../benchmarks/validate-guardbench-artifacts.mjs';
+import { verifyPaperClaims } from './verify-paper-claims.mjs';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const DEFAULT_PACK = 'docs/paper/publication-pack.json';
+const DEFAULT_SCHEMA = 'docs/paper/publication-pack.schema.json';
+const SEEDED_SECRET = 'sk-guardbench-secret-0000000000000000000000000000';
+const REQUIRED_ENTRIES = [
+  'arxiv-title',
+  'arxiv-abstract',
+  'hacker-news-title',
+  'hacker-news-comment',
+  'reddit-title',
+  'reddit-body',
+  'x-post-1',
+  'x-post-2',
+  'linkedin-post',
+];
+const X_URL_RESERVED_CHARS = 24;
+
+function fromRoot(path) {
+  return resolve(ROOT, path);
+}
+
+function readText(path) {
+  const absolute = fromRoot(path);
+  if (!existsSync(absolute)) throw new Error(`Missing required file: ${path}`);
+  return readFileSync(absolute, 'utf-8');
+}
+
+function readJson(path) {
+  return JSON.parse(readText(path));
+}
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const args = {
+    pack: DEFAULT_PACK,
+    schema: DEFAULT_SCHEMA,
+    json: false,
+  };
+
+  for (let i = 0; i < argv.length; i++) {
+    const token = argv[i];
+    if (token === '--pack' && argv[i + 1]) args.pack = argv[++i];
+    else if (token === '--schema' && argv[i + 1]) args.schema = argv[++i];
+    else if (token === '--json') args.json = true;
+    else if (token === '--help' || token === '-h') args.help = true;
+    else throw new Error(`Unknown argument: ${token}`);
+  }
+
+  return args;
+}
+
+function usage() {
+  return `Usage: node scripts/verify-publication-pack.mjs [options]
+
+Options:
+  --pack <path>    Publication pack JSON. Default: ${DEFAULT_PACK}.
+  --schema <path>  Publication pack schema. Default: ${DEFAULT_SCHEMA}.
+  --json           Print the machine-readable verification report.
+`;
+}
+
+function referencesPendingClaim(entry, claimMap) {
+  return entry.claimIds.some(id => claimMap.get(id)?.status === 'pending');
+}
+
+function hasPendingBoundaryLanguage(text) {
+  return /\b(pending|deferred|does not report|not reporting|not claimed|Stage-B|live credentialed)\b/i.test(text);
+}
+
+function validateEntry(entry, claimMap, forbiddenNeedles) {
+  const failures = [];
+  const reservedUrlChars = Number.isInteger(entry.reservedUrlChars) ? entry.reservedUrlChars : 0;
+  if (entry.text.length > entry.maxChars) {
+    failures.push(`${entry.id}: text length ${entry.text.length} exceeds maxChars ${entry.maxChars}`);
+  }
+  if (entry.text.includes(SEEDED_SECRET)) failures.push(`${entry.id}: contains seeded raw secret`);
+  if (entry.text.includes('runtime-key')) failures.push(`${entry.id}: contains runtime-key test credential`);
+  for (const claimId of entry.claimIds) {
+    if (!claimMap.has(claimId)) failures.push(`${entry.id}: unknown claim id ${claimId}`);
+  }
+  for (const needle of forbiddenNeedles) {
+    if (entry.text.includes(needle)) failures.push(`${entry.id}: contains forbidden claim text: ${needle}`);
+  }
+  if (referencesPendingClaim(entry, claimMap) && !hasPendingBoundaryLanguage(entry.text)) {
+    failures.push(`${entry.id}: references a pending claim without explicit pending/deferred boundary language`);
+  }
+  if (/10\/10/.test(entry.text) && !/\b(local|Stage-A)\b/i.test(entry.text)) {
+    failures.push(`${entry.id}: 10/10 claim must be scoped as local or Stage-A`);
+  }
+  if (/\b(Mem0|Zep)\b/.test(entry.text) && !hasPendingBoundaryLanguage(entry.text)) {
+    failures.push(`${entry.id}: Mem0/Zep mention must include pending/deferred boundary language`);
+  }
+  if (entry.platform === 'hacker-news' && entry.kind === 'title' && entry.text.length > 80) {
+    failures.push(`${entry.id}: Hacker News title should stay at or below 80 characters`);
+  }
+  if (entry.platform === 'x' && entry.text.length > 280) {
+    failures.push(`${entry.id}: X post should stay at or below 280 characters`);
+  }
+  if (entry.platform === 'x' && entry.requiresArtifactUrl === true) {
+    if (!Number.isInteger(entry.reservedUrlChars)) {
+      failures.push(`${entry.id}: X post requiring an artifact URL must set reservedUrlChars`);
+    } else if (entry.reservedUrlChars < X_URL_RESERVED_CHARS) {
+      failures.push(`${entry.id}: X artifact URL reserve must be at least ${X_URL_RESERVED_CHARS} characters`);
+    }
+    if (entry.text.length + reservedUrlChars > entry.maxChars) {
+      failures.push(`${entry.id}: text length ${entry.text.length} plus URL reserve ${reservedUrlChars} exceeds maxChars ${entry.maxChars}`);
+    }
+  }
+  return failures;
+}
+
+export async function verifyPublicationPack(options = {}) {
+  const pack = readJson(options.pack ?? DEFAULT_PACK);
+  const schema = readJson(options.schema ?? DEFAULT_SCHEMA);
+  const claimReport = await verifyPaperClaims();
+  const claimRegister = readJson(pack.claimRegister);
+  const claimMap = new Map((claimRegister.claims ?? []).map(claim => [claim.id, claim]));
+  const forbiddenNeedles = (claimRegister.claims ?? []).flatMap(claim =>
+    (claim.forbiddenText ?? []).map(needle => needle.text));
+
+  const schemaFailures = validateSchema(pack, schema, 'audrey-publication-pack');
+  const ids = new Set();
+  const entryReports = [];
+  const failures = [...schemaFailures.map(failure => `publication pack schema: ${failure}`)];
+
+  if (!claimReport.ok) failures.push(...claimReport.failures.map(failure => `claim verifier: ${failure}`));
+
+  for (const entry of pack.entries ?? []) {
+    const entryFailures = [];
+    const reservedUrlChars = Number.isInteger(entry.reservedUrlChars) ? entry.reservedUrlChars : 0;
+    if (ids.has(entry.id)) entryFailures.push(`${entry.id}: duplicate entry id`);
+    ids.add(entry.id);
+    entryFailures.push(...validateEntry(entry, claimMap, forbiddenNeedles));
+    entryReports.push({
+      id: entry.id,
+      platform: entry.platform,
+      kind: entry.kind,
+      chars: entry.text.length,
+      maxChars: entry.maxChars,
+      requiresArtifactUrl: entry.requiresArtifactUrl === true,
+      reservedUrlChars,
+      effectiveChars: entry.text.length + reservedUrlChars,
+      claimIds: entry.claimIds,
+      ok: entryFailures.length === 0,
+      failures: entryFailures,
+    });
+    failures.push(...entryFailures);
+  }
+
+  for (const id of REQUIRED_ENTRIES) {
+    if (!ids.has(id)) failures.push(`Missing required publication-pack entry: ${id}`);
+  }
+
+  return {
+    schemaVersion: '1.0.0',
+    suite: 'Audrey publication pack verification',
+    generatedAt: new Date().toISOString(),
+    ok: failures.length === 0,
+    pack: publicPath(fromRoot(options.pack ?? DEFAULT_PACK)),
+    entries: entryReports,
+    failures,
+  };
+}
+
+async function main() {
+  const args = parseArgs();
+  if (args.help) {
+    console.log(usage());
+    return;
+  }
+
+  const report = await verifyPublicationPack(args);
+  if (args.json) {
+    console.log(JSON.stringify(report, null, 2));
+  } else if (report.ok) {
+    console.log(`Publication pack verification passed: ${report.entries.length} entry(s)`);
+  } else {
+    console.error('Publication pack verification failed:');
+    for (const failure of report.failures) console.error(`- ${failure}`);
+  }
+
+  if (!report.ok) process.exit(1);
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch(error => {
+    console.error(error.stack ?? error.message);
+    process.exit(1);
+  });
+}

package/scripts/verify-python-package.py

@@ -0,0 +1,201 @@
+import argparse
+import json
+import re
+import subprocess
+import sys
+import tarfile
+import zipfile
+from pathlib import Path
+
+
+ROOT = Path.cwd()
+PYTHON_ROOT = ROOT / "python"
+DIST = PYTHON_ROOT / "dist"
+LOCAL_PATH_RE = re.compile(r"(?<![A-Za-z])(?:[A-Za-z]:[\\/]|file://|\\\\\?\\)")
+
+
+def read_text(path):
+    return path.read_text(encoding="utf-8")
+
+
+def package_version():
+    text = read_text(PYTHON_ROOT / "audrey_memory" / "_version.py")
+    match = re.search(r'__version__\s*=\s*"([^"]+)"', text)
+    if not match:
+        raise RuntimeError("python/audrey_memory/_version.py is missing __version__")
+    return match.group(1)
+
+
+def pyproject_name():
+    text = read_text(PYTHON_ROOT / "pyproject.toml")
+    match = re.search(r'^name\s*=\s*"([^"]+)"', text, re.MULTILINE)
+    if not match:
+        raise RuntimeError("python/pyproject.toml is missing project name")
+    return match.group(1)
+
+
+def metadata_value(text, key):
+    match = re.search(rf"^{re.escape(key)}:\s*(.+)$", text, re.MULTILINE)
+    return match.group(1).strip() if match else None
+
+
+def metadata_values(text, key):
+    return re.findall(rf"^{re.escape(key)}:\s*(.+)$", text, re.MULTILINE)
+
+
+def ensure(condition, message, failures):
+    if not condition:
+        failures.append(message)
+
+
+def check_local_paths(label, values, failures):
+    for value in values:
+        if LOCAL_PATH_RE.search(value):
+            failures.append(f"{label} contains local absolute path: {value}")
+
+
+def wheel_metadata(wheel_path, version, failures):
+    expected = {
+        "audrey_memory/__init__.py",
+        "audrey_memory/_version.py",
+        "audrey_memory/client.py",
+        "audrey_memory/types.py",
+        "audrey_memory/py.typed",
+        f"audrey_memory-{version}.dist-info/METADATA",
+        f"audrey_memory-{version}.dist-info/WHEEL",
+        f"audrey_memory-{version}.dist-info/RECORD",
+    }
+    with zipfile.ZipFile(wheel_path) as wheel:
+        names = set(wheel.namelist())
+        metadata = wheel.read(f"audrey_memory-{version}.dist-info/METADATA").decode("utf-8")
+        wheel_info = wheel.read(f"audrey_memory-{version}.dist-info/WHEEL").decode("utf-8")
+
+    missing = sorted(expected - names)
+    ensure(not missing, f"wheel is missing expected files: {', '.join(missing)}", failures)
+    check_local_paths("wheel filename", names, failures)
+    check_local_paths("wheel metadata", [metadata, wheel_info], failures)
+    return metadata, wheel_info, sorted(names)
+
+
+def sdist_metadata(sdist_path, version, failures):
+    prefix = f"audrey_memory-{version}/"
+    expected = {
+        f"{prefix}README.md",
+        f"{prefix}pyproject.toml",
+        f"{prefix}audrey_memory/__init__.py",
+        f"{prefix}audrey_memory/_version.py",
+        f"{prefix}audrey_memory/client.py",
+        f"{prefix}audrey_memory/types.py",
+        f"{prefix}audrey_memory/py.typed",
+        f"{prefix}audrey_memory.egg-info/PKG-INFO",
+    }
+    with tarfile.open(sdist_path, "r:gz") as sdist:
+        names = set(sdist.getnames())
+        pkg_info_file = sdist.extractfile(f"{prefix}audrey_memory.egg-info/PKG-INFO")
+        if pkg_info_file is None:
+            raise RuntimeError("sdist is missing PKG-INFO")
+        pkg_info = pkg_info_file.read().decode("utf-8")
+
+    missing = sorted(expected - names)
+    ensure(not missing, f"sdist is missing expected files: {', '.join(missing)}", failures)
+    check_local_paths("sdist filename", names, failures)
+    check_local_paths("sdist metadata", [pkg_info], failures)
+    return pkg_info, sorted(names)
+
+
+def check_metadata(label, text, name, version, failures):
+    ensure(metadata_value(text, "Name") == name, f"{label} Name is not {name}", failures)
+    ensure(metadata_value(text, "Version") == version, f"{label} Version is not {version}", failures)
+    ensure(metadata_value(text, "Requires-Python") == ">=3.9", f"{label} Requires-Python is not >=3.9", failures)
+    requires = metadata_values(text, "Requires-Dist")
+    ensure(any(value.startswith("httpx") for value in requires), f"{label} is missing httpx dependency", failures)
+    ensure(any(value.startswith("pydantic") for value in requires), f"{label} is missing pydantic dependency", failures)
+
+
+def twine_check(paths):
+    command = [sys.executable, "-m", "twine", "check", *[str(path) for path in paths]]
+    return subprocess.run(command, cwd=ROOT, capture_output=True, text=True)
+
+
+def public_path(path):
+    try:
+        return path.relative_to(ROOT).as_posix()
+    except ValueError:
+        return path.as_posix()
+
+
+def public_output(text):
+    if not text:
+        return ""
+    return text.replace(str(ROOT), ".").replace(ROOT.as_posix(), ".")
+
+
+def verify(version=None, skip_twine=False):
+    version = version or package_version()
+    name = pyproject_name()
+    wheel_path = DIST / f"audrey_memory-{version}-py3-none-any.whl"
+    sdist_path = DIST / f"audrey_memory-{version}.tar.gz"
+    failures = []
+
+    ensure(wheel_path.exists(), f"missing wheel: {wheel_path.as_posix()}", failures)
+    ensure(sdist_path.exists(), f"missing sdist: {sdist_path.as_posix()}", failures)
+
+    wheel_files = []
+    sdist_files = []
+    if wheel_path.exists():
+        wheel_meta, _wheel_info, wheel_files = wheel_metadata(wheel_path, version, failures)
+        check_metadata("wheel METADATA", wheel_meta, name, version, failures)
+    if sdist_path.exists():
+        sdist_meta, sdist_files = sdist_metadata(sdist_path, version, failures)
+        check_metadata("sdist PKG-INFO", sdist_meta, name, version, failures)
+
+    twine = None
+    if not skip_twine and wheel_path.exists() and sdist_path.exists():
+        result = twine_check([wheel_path, sdist_path])
+        twine = {
+            "ok": result.returncode == 0,
+            "stdout": public_output(result.stdout.strip()),
+            "stderr": public_output(result.stderr.strip()),
+        }
+        if result.returncode != 0:
+            failures.append(f"twine check failed: {result.stderr.strip() or result.stdout.strip()}")
+
+    return {
+        "schemaVersion": "1.0.0",
+        "suite": "Audrey Python package verification",
+        "ok": not failures,
+        "packageName": name,
+        "version": version,
+        "wheel": public_path(wheel_path),
+        "sdist": public_path(sdist_path),
+        "wheelFiles": wheel_files,
+        "sdistFiles": sdist_files,
+        "twine": twine,
+        "failures": failures,
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Verify Audrey Python wheel/sdist release artifacts.")
+    parser.add_argument("--version", default=None)
+    parser.add_argument("--skip-twine", action="store_true")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+
+    report = verify(version=args.version, skip_twine=args.skip_twine)
+    if args.json:
+        print(json.dumps(report, indent=2))
+    elif report["ok"]:
+        twine_status = "twine skipped" if report["twine"] is None else "twine passed"
+        print(f"Python package verification passed: {report['packageName']} {report['version']} ({twine_status})")
+    else:
+        print("Python package verification failed:", file=sys.stderr)
+        for failure in report["failures"]:
+            print(f"- {failure}", file=sys.stderr)
+
+    if not report["ok"]:
+        raise SystemExit(1)
+
+
+if __name__ == "__main__":
+    main()