aetherx-reprocert 0.2.2a1__tar.gz

aetherx_reprocert-0.2.2a1/.github/ISSUE_TEMPLATE/adoption.yml

@@ -0,0 +1,78 @@
+name: Adoption / Integration Help
+description: Get help adding ReproCert to a real repository or CI workflow.
+title: "[Adoption] "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ReproCert can be added as a small evidence layer on top of an existing test, benchmark, build, or research workflow. Keep this issue non-sensitive: do not include credentials, private source code, customer data, or confidential artifacts.
+
+  - type: input
+    id: repository
+    attributes:
+      label: Repository URL
+      description: Public repository URL if available. For private projects, describe the stack without sharing confidential details.
+      placeholder: https://github.com/owner/repository
+    validations:
+      required: true
+
+  - type: textarea
+    id: claim
+    attributes:
+      label: What claim do you want to verify?
+      description: State one concrete technical claim.
+      placeholder: "Example: the benchmark median stays below 250 ms, or all pytest checks complete with zero failures."
+    validations:
+      required: true
+
+  - type: textarea
+    id: current_workflow
+    attributes:
+      label: Current command or CI workflow
+      description: Show the existing command or a small non-sensitive workflow excerpt.
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence already produced
+      description: Examples include JUnit XML, benchmark JSON, build artifacts, hashes, or logs.
+      placeholder: junit.xml, benchmark.json, dist/package.whl
+    validations:
+      required: false
+
+  - type: dropdown
+    id: integration
+    attributes:
+      label: Preferred integration
+      options:
+        - GitHub Action
+        - ReproCert CLI
+        - Pytest-native adapter
+        - JUnit integration
+        - Multi-claim suite
+        - Policy gate
+        - Signed attestation
+        - Not sure — recommend the smallest useful integration
+    validations:
+      required: true
+
+  - type: textarea
+    id: constraints
+    attributes:
+      label: Constraints
+      description: Note OS, Python version, CI provider, security restrictions, or "no product-code changes" requirements.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: boundaries
+    attributes:
+      label: Public issue boundaries
+      options:
+        - label: I confirm this issue contains no credentials, private customer data, confidential source code, or sensitive exploit details.
+          required: true
+        - label: I understand a ReproCert PASS result does not by itself establish security certification, scientific truth, or benchmark fairness.
+          required: true

aetherx_reprocert-0.2.2a1/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,71 @@
+name: Bug report
+description: Report a reproducible defect in ReproCert.
+title: "[Bug] "
+labels: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve ReproCert. Do not include credentials, private source code, customer data, or sensitive vulnerability details.
+
+  - type: input
+    id: version
+    attributes:
+      label: ReproCert version or commit
+      placeholder: 0.1.0a1 or commit SHA
+    validations:
+      required: true
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Affected surface
+      options:
+        - CLI
+        - GitHub Action
+        - Claim schema
+        - Certificate verification
+        - Evidence collection
+        - Packaging / installation
+        - Documentation
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Provide the smallest non-sensitive example that reproduces the issue.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed behavior
+    validations:
+      required: true
+
+  - type: input
+    id: platform
+    attributes:
+      label: Platform and Python version
+      placeholder: Ubuntu 24.04 / Python 3.13
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Public issue safety
+      options:
+        - label: I confirm this report contains no credentials, confidential data, private source code, or sensitive exploit details.
+          required: true

aetherx_reprocert-0.2.2a1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security guidance
+    url: https://github.com/AETHERXGLOBAL/reprocert/blob/main/SECURITY.md
+    about: Do not publish sensitive vulnerability details in a public issue.
+  - name: Support guidance
+    url: https://github.com/AETHERXGLOBAL/reprocert/blob/main/SUPPORT.md
+    about: Read the support boundary before opening a public issue.

aetherx_reprocert-0.2.2a1/.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,45 @@
+name: Feature proposal
+description: Propose a developer-facing capability for ReproCert.
+title: "[Feature] "
+labels: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Strong proposals start from a concrete developer problem and explain the evidence/trust semantics before implementation detail.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Developer problem
+      description: What workflow is difficult, ambiguous, or unreliable today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed capability
+      description: Describe the smallest useful capability.
+    validations:
+      required: true
+
+  - type: textarea
+    id: semantics
+    attributes:
+      label: Evidence and verdict semantics
+      description: How should PASS, FAIL, INCONCLUSIVE, or ERROR behave if relevant?
+
+  - type: textarea
+    id: trust
+    attributes:
+      label: Trust-boundary impact
+      description: Does this affect signing, producer identity, evidence trust, remote execution, secrets, or code execution?
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Existing tools or alternatives
+      description: Which adjacent tools or standards already solve part of the problem?

aetherx_reprocert-0.2.2a1/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,20 @@
+## What changes?
+
+Describe the smallest coherent change and the developer problem it addresses.
+
+## Evidence
+
+- [ ] Tests added or updated where behavior changed.
+- [ ] `pytest` passes locally or CI evidence is expected to establish it.
+- [ ] Documentation updated where public behavior changed.
+- [ ] Claim/verdict semantics remain explicit.
+
+## Trust-boundary review
+
+- [ ] This change does not silently expand command execution, secret access, evidence trust, signing authority, or producer-authentication claims.
+- [ ] Any new trust assumption is documented.
+- [ ] No credentials, private customer data, or confidential implementation material is included.
+
+## Claim discipline
+
+- [ ] No novelty, superiority, security-certification, scientific-validity, or production-readiness claim is introduced without evidence.

aetherx_reprocert-0.2.2a1/.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5

aetherx_reprocert-0.2.2a1/.github/workflows/attested-demo.yml

@@ -0,0 +1,70 @@
+name: Attested Demo
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'examples/**'
+      - 'schemas/**'
+      - 'pyproject.toml'
+      - 'action.yml'
+      - '.github/workflows/attested-demo.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+  attestations: write
+  artifact-metadata: write
+
+jobs:
+  certificate:
+    name: Produce and attest reference certificate
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+
+      - name: Install ReproCert
+        run: python -m pip install .
+
+      - name: Produce reference certificate
+        working-directory: examples/basic
+        run: reprocert run claim.yml --output reprocert-certificate.json
+
+      - name: Verify certificate and evidence locally
+        working-directory: examples/basic
+        run: reprocert verify reprocert-certificate.json --claim claim.yml --evidence-root .
+
+      - name: Build ReproCert custom predicate
+        working-directory: examples/basic
+        run: |
+          reprocert predicate reprocert-certificate.json             --output reprocert-predicate.json             --json
+
+      - name: Attest general producer provenance
+        uses: actions/attest@v4
+        with:
+          subject-path: examples/basic/reprocert-certificate.json
+
+      - name: Attest ReproCert predicate
+        uses: actions/attest@v4
+        with:
+          subject-path: examples/basic/reprocert-certificate.json
+          predicate-type: https://raw.githubusercontent.com/AETHERXGLOBAL/reprocert/main/schemas/attestation-predicate-v1.schema.json
+          predicate-path: examples/basic/reprocert-predicate.json
+
+      - name: Upload certificate and predicate
+        uses: actions/upload-artifact@v7
+        with:
+          name: reprocert-reference-evidence
+          path: |
+            examples/basic/reprocert-certificate.json
+            examples/basic/reprocert-predicate.json
+          if-no-files-found: error

aetherx_reprocert-0.2.2a1/.github/workflows/ci.yml

@@ -0,0 +1,217 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: ${{ matrix.os }} / Python ${{ matrix.python }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python: ['3.11', '3.13', '3.14']
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install
+        run: python -m pip install -e ".[dev]"
+
+      - name: Unit and adversarial tests
+        run: pytest
+
+      - name: Reference claim round-trip
+        working-directory: examples/basic
+        shell: bash
+        run: |
+          reprocert run claim.yml --output certificate.json
+          reprocert verify certificate.json --claim claim.yml --evidence-root .
+          reprocert inspect certificate.json --json
+
+      - name: Policy gate round-trip
+        working-directory: examples/basic
+        shell: bash
+        run: |
+          reprocert policy certificate.json ../policy/strict-ci.yml             --output policy-result.json             --json
+
+      - name: JUnit adapter round-trip
+        working-directory: examples/junit
+        shell: bash
+        run: |
+          reprocert run claim.yml --output certificate.json
+          reprocert verify certificate.json --claim claim.yml --evidence-root .
+
+      - name: Pytest-native adapter round-trip
+        shell: bash
+        run: |
+          reprocert pytest --workdir examples/pytest-native --output pytest-native-certificate.json -- -q test_sample.py
+          reprocert verify             pytest-native-certificate.json             --claim examples/pytest-native/.reprocert-pytest-claim.json             --evidence-root examples/pytest-native
+
+      - name: Multi-claim suite round-trip
+        working-directory: examples
+        shell: bash
+        run: |
+          reprocert suite suite.yml             --output suite-report.json             --certificate-dir .reprocert/certificates             --json
+
+  action-smoke:
+    name: Reusable Action smoke test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Execute ReproCert Action
+        id: reprocert
+        uses: ./
+        with:
+          claim: examples/basic/claim.yml
+          certificate: reprocert-action-certificate.json
+
+      - name: Assert exported verdict and digest
+        shell: bash
+        run: |
+          test "${{ steps.reprocert.outputs.verdict }}" = "PASS"
+          test -n "${{ steps.reprocert.outputs.certificate-digest }}"
+
+  container-profile:
+    name: Hardened container profile / Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+
+      - name: Install
+        run: python -m pip install -e ".[dev]"
+
+      - name: Resolve immutable Alpine image identity
+        shell: bash
+        run: |
+          docker pull alpine:3.20
+          image="$(docker image inspect alpine:3.20 --format '{{index .RepoDigests 0}}')"
+          echo "REPROCERT_TEST_IMAGE=$image" >> "$GITHUB_ENV"
+
+      - name: Create digest-pinned container claim
+        shell: bash
+        run: |
+          python - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+
+          claim = {
+              "apiVersion": "reprocert.dev/v1alpha1",
+              "kind": "ReproducibilityClaim",
+              "metadata": {
+                  "id": "container-profile-smoke",
+                  "title": "Hardened container execution profile",
+              },
+              "spec": {
+                  "command": ["sh", "-c", "printf ok > result.txt"],
+                  "container": {
+                      "engine": "docker",
+                      "image": os.environ["REPROCERT_TEST_IMAGE"],
+                      "network": "none",
+                      "read_only_root": True,
+                      "drop_capabilities": True,
+                      "no_new_privileges": True,
+                      "pids_limit": 128,
+                  },
+                  "evidence": ["result.txt"],
+                  "checks": [
+                      {
+                          "id": "container-result",
+                          "source": {"type": "text", "path": "result.txt"},
+                          "op": "eq",
+                          "expected": "ok",
+                      }
+                  ],
+              },
+          }
+          Path("container-claim.json").write_text(
+              json.dumps(claim, indent=2) + "\n",
+              encoding="utf-8",
+          )
+          PY
+
+      - name: Execute digest-pinned container claim
+        shell: bash
+        run: |
+          set +e
+          reprocert run container-claim.json --output container-certificate.json
+          rc=$?
+          python - <<'PY'
+          import json
+          from pathlib import Path
+          cert = json.loads(Path("container-certificate.json").read_text())
+          print(json.dumps({
+              "verdict": cert["verdict"],
+              "exit_code": cert["run"]["exit_code"],
+              "execution_error": cert["run"]["execution_error"],
+              "stderr_excerpt": cert["run"]["stderr_excerpt"],
+              "container": cert["run"].get("container"),
+          }, indent=2))
+          PY
+          if [ "$rc" -ne 0 ]; then
+            exit "$rc"
+          fi
+          reprocert policy container-certificate.json examples/policy/container-required.yml --output container-policy-result.json
+          reprocert inspect container-certificate.json --json
+
+      - name: Assert hardened profile evidence
+        shell: python
+        run: |
+          import json
+          import os
+          from pathlib import Path
+
+          cert = json.loads(Path("container-certificate.json").read_text())
+          profile = cert["run"]["container"]
+          assert profile["image"] == os.environ["REPROCERT_TEST_IMAGE"]
+          assert profile["network"] == "none"
+          assert profile["read_only_root"] is True
+          assert profile["drop_capabilities"] is True
+          assert profile["no_new_privileges"] is True
+          assert cert["verdict"] == "PASS"
+
+  package:
+    name: Build package
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+
+      - name: Build isolated package
+        run: |
+          python -m pip install build
+          python -m build
+
+      - name: Upload package artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: reprocert-dist
+          path: dist/*
+          if-no-files-found: error

aetherx_reprocert-0.2.2a1/.github/workflows/release.yml

@@ -0,0 +1,73 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build release distributions
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout released source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: '3.13'
+
+      - name: Verify release tag matches package version
+        shell: python
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          import os
+          import tomllib
+          from pathlib import Path
+
+          data = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))
+          version = data["project"]["version"]
+          expected = f"v{version}"
+          actual = os.environ["RELEASE_TAG"]
+          if actual != expected:
+              raise SystemExit(
+                  f"Release tag {actual!r} does not match package version {expected!r}"
+              )
+          print(f"release identity verified: {actual}")
+
+      - name: Build distributions
+        run: |
+          python -m pip install build
+          python -m build
+
+      - name: Upload release distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: python-package-distributions
+          path: dist/*
+          if-no-files-found: error
+
+  publish-pypi:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/aetherx-reprocert/
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download release distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: python-package-distributions
+          path: dist
+
+      - name: Publish package
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33

aetherx_reprocert-0.2.2a1/.github/workflows/stable-channel-proof.yml

@@ -0,0 +1,64 @@
+name: Stable v0.2 Channel Proof
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'action.yml'
+      - 'src/**'
+      - 'pyproject.toml'
+      - '.github/workflows/stable-channel-proof.yml'
+  pull_request:
+    paths:
+      - '.github/workflows/stable-channel-proof.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  action-channel:
+    name: Consume AETHERXGLOBAL/reprocert@v0.2
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout consumer fixture
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Consume stable ReproCert action channel
+        id: reprocert
+        uses: AETHERXGLOBAL/reprocert@v0.2
+        with:
+          claim: examples/basic/claim.yml
+          certificate: stable-channel-certificate.json
+
+      - name: Assert stable action result
+        shell: bash
+        run: |
+          test "${{ steps.reprocert.outputs.verdict }}" = "PASS"
+          test -n "${{ steps.reprocert.outputs.certificate-digest }}"
+          test -f stable-channel-certificate.json
+
+  git-install-channel:
+    name: Self-service install from public v0.2 channel
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: '3.13'
+
+      - name: Install directly from public stable channel
+        run: |
+          python -m pip install "git+https://github.com/AETHERXGLOBAL/reprocert.git@v0.2"
+          reprocert --version
+
+      - name: Zero-contact self-service round-trip
+        shell: bash
+        run: |
+          mkdir consumer
+          cd consumer
+          reprocert init command --github-actions
+          reprocert doctor
+          reprocert run reprocert.yml -o certificate.json
+          reprocert verify certificate.json --claim reprocert.yml --evidence-root .
+          grep -q "AETHERXGLOBAL/reprocert@v0.2" .github/workflows/reprocert.yml

aetherx_reprocert-0.2.2a1/.gitignore

@@ -0,0 +1,16 @@
+__pycache__/
+.pytest_cache/
+*.py[cod]
+dist/
+build/
+*.egg-info/
+certificate.json
+reprocert-certificate.json
+reprocert-pytest-certificate.json
+reprocert-policy-result.json
+reprocert-predicate.json
+reprocert-suite-report.json
+result.json
+.reprocert/
+.reprocert-pytest-claim.json
+.reprocert-pytest-junit.xml