aevum-cli 0.3.0__tar.gz → 0.5.0__tar.gz

aevum_cli-0.5.0/.gitignore

@@ -0,0 +1,52 @@
+# Python
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.venv/
+*.egg-info/
+
+# Build
+dist/
+build/
+site/
+
+# Tools
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.hypothesis/
+.cache/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Verify scripts (run locally, never commit)
+verify_*.py
+scripts/verify_*.py
+
+# Aevum development — never commit (Phase 0+)
+aevum_principles.key
+signed_principles_draft.yaml
+tools/sign_principles.py
+
+# Private keys — never commit
+*.key
+*.pem
+
+# OpenSSF Scorecard output (Phase 0+)
+results.sarif
+verify_phase3.py
+verify_phase7.py
+verify_phase8.py
+verify_phase*.py
+
+# Maintenance generated files — local only, never commit
+maintenance/generated/

{aevum_cli-0.3.0 → aevum_cli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aevum-cli
-Version: 0.3.0
+Version: 0.5.0
 Summary: Aevum -- command-line interface for operating Aevum nodes.
 Project-URL: Homepage, https://aevum.build
 Project-URL: Repository, https://github.com/aevum-labs/aevum
@@ -15,6 +15,8 @@ Requires-Dist: aevum-core
 Requires-Dist: aevum-server
 Requires-Dist: typer[all]>=0.12
 Requires-Dist: uvicorn[standard]>=0.30
+Provides-Extra: conform
+Requires-Dist: aevum-conformance; extra == 'conform'
 Provides-Extra: dev
 Requires-Dist: mypy>=1.10; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'

{aevum_cli-0.3.0 → aevum_cli-0.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "aevum-cli"
-version = "0.3.0"
+version = "0.5.0"
 description = "Aevum -- command-line interface for operating Aevum nodes."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -34,8 +34,9 @@ build-backend = "hatchling.build"
 packages = ["src/aevum"]
 
 [tool.uv.sources]
-aevum-core   = { workspace = true }
-aevum-server = { workspace = true }
+aevum-core         = { workspace = true }
+aevum-server       = { workspace = true }
+aevum-conformance  = { workspace = true }
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
@@ -58,6 +59,9 @@ select = ["E", "F", "UP", "B", "SIM", "I", "ANN"]
 ignore = ["ANN401"]
 
 [project.optional-dependencies]
+conform = [
+    "aevum-conformance",
+]
 dev = [
     "pytest>=8.0",
     "pytest-asyncio>=0.23",

{aevum_cli-0.3.0 → aevum_cli-0.5.0}/src/aevum/cli/__init__.py

@@ -11,4 +11,4 @@ Commands:
     conformance run  Run the conformance suite
 """
 
-__version__ = "0.1.0"
+__version__ = "0.4.0"

aevum_cli-0.5.0/src/aevum/cli/app.py

@@ -0,0 +1,252 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Aevum Labs contributors
+"""
+Top-level typer app — CLI v2. Sub-commands and direct commands registered here.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Annotated
+
+import typer
+
+from aevum.cli.commands import complication, conformance, server, store, version
+
+# Module-level import for mock.patch patchability (Rule 57).
+# Soft import: aevum-conformance is a workspace package not on PyPI, so
+# callers without it installed still get a usable CLI (conform command
+# shows a helpful error instead of crashing at startup).
+try:
+    from aevum.conformance.suite import ConformanceSuite
+except ImportError:  # pragma: no cover
+    ConformanceSuite = None  # type: ignore[assignment,misc]
+
+app = typer.Typer(
+    name="aevum",
+    help="Aevum governed context kernel — CLI v2",
+    no_args_is_help=True,
+    pretty_exceptions_enable=False,
+    rich_markup_mode="markdown",
+)
+
+app.add_typer(server.app, name="server")
+app.add_typer(store.app, name="store")
+app.add_typer(complication.app, name="complication")
+app.add_typer(conformance.app, name="conformance")
+app.command(name="version")(version.version_command)
+
+_DEFAULT_STATE = Path.home() / ".aevum"
+
+
+@app.command()
+def init(
+    state_dir: Annotated[
+        Path,
+        typer.Option("--state-dir", "-s", help="State directory path"),
+    ] = _DEFAULT_STATE,
+    principles: Annotated[
+        Path,
+        typer.Option("--principles", "-p", help="Path to signed_principles.yaml"),
+    ] = Path("signed_principles.yaml"),
+) -> None:
+    """
+    Initialize Aevum state directory and verify principles.
+
+    Creates the state directory, generates dual signing keys (Ed25519 +
+    ML-DSA-65), and verifies the signed_principles.yaml file.
+    """
+    typer.echo(f"Initializing Aevum state at {state_dir}...")
+
+    try:
+        from aevum.core.principles import PrinciplesVerifier
+        verifier = PrinciplesVerifier(principles)
+        p = verifier.verify()
+        typer.echo(f"  Principles: OK (sequence={p.sequence}, signed_by={p.signed_by[:30]}...)")
+    except Exception as exc:  # noqa: BLE001
+        typer.echo(f"  Principles: FAILED — {exc}", err=True)
+        raise typer.Exit(code=1) from None
+
+    try:
+        from aevum.core.kernel import Kernel
+        kernel = Kernel.local(
+            state_dir=state_dir,
+            principles_path=principles,
+            tsa_enabled=False,
+        )
+        ed25519_pub = kernel.signer.ed25519_public_key.hex()[:16]
+        typer.echo(f"  Keys: OK (ed25519={ed25519_pub}...)")
+        typer.echo(f"  Canaries: PASS ({len(kernel.principles.immutable_ids())} immutable principles)")
+    except Exception as exc:  # noqa: BLE001
+        typer.echo(f"  Kernel init: FAILED — {exc}", err=True)
+        raise typer.Exit(code=1) from None
+
+    typer.echo(typer.style("Aevum initialized successfully.", fg=typer.colors.GREEN))
+
+
+@app.command()
+def verify(
+    session_id: Annotated[str, typer.Argument(help="Session ID to verify")],
+    state_dir: Annotated[
+        Path,
+        typer.Option("--state-dir", "-s"),
+    ] = _DEFAULT_STATE,
+) -> None:
+    """
+    Verify a session's Merkle root and signatures.
+
+    Re-reads the stored session events from SQLite, recomputes the
+    Merkle root, and compares it to the signed root in the sigchain.
+    """
+    db_path = state_dir / "aevum.db"
+    if not db_path.exists():
+        typer.echo(f"Database not found: {db_path}", err=True)
+        raise typer.Exit(code=1)
+
+    try:
+        from aevum.core.replay import ReplayEngine
+        engine = ReplayEngine(db_path)
+        result = engine.replay(session_id)
+
+        if result.all_matched:
+            typer.echo(typer.style(
+                f"Session {session_id[:8]}... VERIFIED",
+                fg=typer.colors.GREEN,
+            ))
+            typer.echo(f"  Merkle root: {result.original_merkle_root[:16]}...")
+            typer.echo(f"  Events: {len(result.event_results)}")
+        else:
+            typer.echo(typer.style(
+                f"Session {session_id[:8]}... TAMPERED",
+                fg=typer.colors.RED,
+            ), err=True)
+            typer.echo(
+                f"  First divergence: event #{result.first_divergence}", err=True
+            )
+            raise typer.Exit(code=1)
+
+    except ValueError as exc:
+        typer.echo(f"Session not found: {exc}", err=True)
+        raise typer.Exit(code=1) from None
+
+
+@app.command(name="audit-pack")
+def audit_pack(
+    session_id: Annotated[str, typer.Argument(help="Session ID")],
+    output: Annotated[
+        Path | None,
+        typer.Option("--output", "-o", help="Output file path (default: stdout)"),
+    ] = None,
+    state_dir: Annotated[
+        Path,
+        typer.Option("--state-dir", "-s"),
+    ] = _DEFAULT_STATE,
+) -> None:
+    """
+    Export EU AI Act Article 12 audit pack for a session.
+
+    Produces a JSON-LD document using the PROV-O vocabulary.
+    """
+    db_path = state_dir / "aevum.db"
+    if not db_path.exists():
+        typer.echo(f"Database not found: {db_path}", err=True)
+        raise typer.Exit(code=1)
+
+    try:
+        from aevum.core.audit.audit_pack import AuditPackExporter
+        exporter = AuditPackExporter(db_path)
+        json_text = exporter.export_json(session_id)
+
+        if output:
+            output.write_text(json_text, encoding="utf-8")
+            typer.echo(f"Audit pack written to {output}")
+        else:
+            typer.echo(json_text)
+
+    except Exception as exc:  # noqa: BLE001
+        typer.echo(f"Audit pack error: {exc}", err=True)
+        raise typer.Exit(code=1) from None
+
+
+@app.command()
+def conform(
+    output: Annotated[
+        str,
+        typer.Option("--output", "-o", help="Output format: text or json"),
+    ] = "text",
+) -> None:
+    """
+    Run the 9-invariant conformance suite.
+
+    Tests all required Aevum behavioral invariants and prints a report.
+    Exit code 0 = all pass, 1 = one or more fail.
+    """
+    if ConformanceSuite is None:
+        typer.echo(
+            "aevum-conformance is not installed. Install it with: pip install aevum-conformance",
+            err=True,
+        )
+        raise typer.Exit(code=1)
+    suite = ConformanceSuite()
+    result = suite.run_all()
+
+    if output == "json":
+        typer.echo(json.dumps(result.to_dict(), indent=2))
+    else:
+        typer.echo(result.render())
+
+    if not result.all_passed:
+        raise typer.Exit(code=1)
+
+
+@app.command()
+def replay(
+    session_id: Annotated[str, typer.Argument(help="Session ID to replay")],
+    verbose: Annotated[
+        bool,
+        typer.Option("--verbose", "-v", help="Show per-event results"),
+    ] = False,
+    state_dir: Annotated[
+        Path,
+        typer.Option("--state-dir", "-s"),
+    ] = _DEFAULT_STATE,
+) -> None:
+    """
+    Replay a session and verify Merkle chain integrity.
+
+    Re-reads all events and recomputes the Merkle root. Reports any
+    divergence from the stored root (indicating tampering).
+    """
+    db_path = state_dir / "aevum.db"
+    if not db_path.exists():
+        typer.echo(f"Database not found: {db_path}", err=True)
+        raise typer.Exit(code=1)
+
+    try:
+        from aevum.core.replay import ReplayEngine
+        engine = ReplayEngine(db_path)
+        result = engine.replay(session_id)
+
+        status = (
+            typer.style("PASS", fg=typer.colors.GREEN)
+            if result.all_matched
+            else typer.style("FAIL", fg=typer.colors.RED)
+        )
+        typer.echo(f"Replay {session_id[:8]}...: {status}")
+        typer.echo(f"  Events: {len(result.event_results)}")
+        typer.echo(f"  Merkle root: {result.original_merkle_root[:16]}...")
+
+        if verbose:
+            for ev in result.event_results:
+                ev_status = "OK" if ev.matched else "DIVERGED"
+                typer.echo(f"  [{ev.sequence:3d}] {ev.event_type:<12} {ev_status}")
+
+        if not result.all_matched:
+            typer.echo(
+                f"  First divergence: event #{result.first_divergence}", err=True
+            )
+            raise typer.Exit(code=1)
+
+    except ValueError as exc:
+        typer.echo(f"Session not found: {exc}", err=True)
+        raise typer.Exit(code=1) from None

{aevum_cli-0.3.0 → aevum_cli-0.5.0}/src/aevum/cli/commands/server.py

@@ -17,7 +17,7 @@ app = typer.Typer(help="Manage the Aevum HTTP API server.")
 
 @app.command("start")
 def start(
-    host: Annotated[str, typer.Option(help="Bind host")] = "0.0.0.0",
+    host: Annotated[str, typer.Option(help="Bind host")] = "0.0.0.0",  # nosec B104
     port: Annotated[int, typer.Option(help="Bind port")] = 8000,
     workers: Annotated[int, typer.Option(help="Number of uvicorn workers")] = 1,
     graph: Annotated[
@@ -78,7 +78,7 @@ def _build_engine(graph: str) -> Engine:
         try:
             import psycopg
             from aevum.store.postgres import PostgresStore
-            from aevum.store.postgres.store import initialize_schema
+            from aevum.store.postgres.schema import initialize_schema
             conn = psycopg.connect(dsn)
             initialize_schema(conn)
             typer.echo("Graph backend: PostgreSQL")

{aevum_cli-0.3.0 → aevum_cli-0.5.0}/src/aevum/cli/commands/store.py

@@ -32,7 +32,7 @@ def migrate(
         raise typer.Exit(code=1)
 
     try:
-        from aevum.store.postgres.store import migrate_from_oxigraph
+        from aevum.store.postgres.migrate import migrate_from_oxigraph
     except ImportError:
         typer.echo("Error: aevum-store-postgres is not installed.", err=True)
         raise typer.Exit(code=1) from None
@@ -44,7 +44,7 @@ def migrate(
     try:
         import psycopg
         conn = psycopg.connect(postgres_dsn)
-        migrated = migrate_from_oxigraph(oxigraph_path, conn)
+        migrated = migrate_from_oxigraph(oxigraph_path, conn)  # type: ignore[arg-type]  # Phase 2: wire store construction
         typer.echo(f"Migration complete: {migrated} entities transferred.")
     except Exception as e:
         typer.echo(f"Migration failed: {e}", err=True)

{aevum_cli-0.3.0 → aevum_cli-0.5.0}/src/aevum/cli/commands/version.py

@@ -11,12 +11,9 @@ import typer
 _PACKAGES = [
     "aevum-core",
     "aevum-server",
-    "aevum-sdk",
     "aevum-store-oxigraph",
     "aevum-store-postgres",
     "aevum-mcp",
-    "aevum-oidc",
-    "aevum-llm",
     "aevum-cli",
 ]
 

aevum_cli-0.5.0/tests/test_phase8_cli.py

@@ -0,0 +1,352 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2024-2026 Aevum Labs contributors
+"""
+CLI tests — Phase 8. Rule 05: always strip ANSI codes before asserting on text output.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import sqlite3
+from datetime import UTC, datetime
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+from typer.testing import CliRunner
+
+from aevum.cli.app import app
+
+
+def strip_ansi(text: str) -> str:
+    """Rule 05: strip ANSI escape codes before any assertion."""
+    return re.sub(r"\x1b\[[0-9;]*[mGKH]", "", text)
+
+
+runner = CliRunner()
+
+
+class TestConformCommand:
+    def test_conform_exits_0_when_all_pass(self) -> None:
+        with patch("aevum.cli.app.ConformanceSuite") as mock_cls:
+            mock_suite = MagicMock()
+            mock_result = MagicMock()
+            mock_result.all_passed = True
+            mock_result.render.return_value = "STATUS: PASS (9/9)"
+            mock_suite.run_all.return_value = mock_result
+            mock_cls.return_value = mock_suite
+
+            result = runner.invoke(app, ["conform"])
+        assert result.exit_code == 0
+        assert "PASS" in strip_ansi(result.output)
+
+    def test_conform_exits_1_when_any_fail(self) -> None:
+        with patch("aevum.cli.app.ConformanceSuite") as mock_cls:
+            mock_suite = MagicMock()
+            mock_result = MagicMock()
+            mock_result.all_passed = False
+            mock_result.render.return_value = "STATUS: FAIL (8/9)"
+            mock_suite.run_all.return_value = mock_result
+            mock_cls.return_value = mock_suite
+
+            result = runner.invoke(app, ["conform"])
+        assert result.exit_code == 1
+
+    def test_conform_json_output(self) -> None:
+        with patch("aevum.cli.app.ConformanceSuite") as mock_cls:
+            mock_suite = MagicMock()
+            mock_result = MagicMock()
+            mock_result.all_passed = True
+            mock_result.to_dict.return_value = {"passed": True, "total_count": 9}
+            mock_suite.run_all.return_value = mock_result
+            mock_cls.return_value = mock_suite
+
+            result = runner.invoke(app, ["conform", "--output", "json"])
+        assert result.exit_code == 0
+        parsed = json.loads(strip_ansi(result.output))
+        assert parsed["passed"] is True
+
+    def test_conform_output_no_ansi_in_text(self) -> None:
+        """ANSI stripping must clean the output (Rule 05)."""
+        with patch("aevum.cli.app.ConformanceSuite") as mock_cls:
+            mock_suite = MagicMock()
+            mock_result = MagicMock()
+            mock_result.all_passed = True
+            mock_result.render.return_value = "PASS (9/9)"
+            mock_suite.run_all.return_value = mock_result
+            mock_cls.return_value = mock_suite
+            result = runner.invoke(app, ["conform"])
+        clean = strip_ansi(result.output)
+        assert "\x1b" not in clean
+
+    def test_conform_json_fails_raises_exit_1(self) -> None:
+        with patch("aevum.cli.app.ConformanceSuite") as mock_cls:
+            mock_suite = MagicMock()
+            mock_result = MagicMock()
+            mock_result.all_passed = False
+            mock_result.to_dict.return_value = {"passed": False, "total_count": 9}
+            mock_suite.run_all.return_value = mock_result
+            mock_cls.return_value = mock_suite
+
+            result = runner.invoke(app, ["conform", "--output", "json"])
+        assert result.exit_code == 1
+
+    def test_conform_default_output_is_text(self) -> None:
+        with patch("aevum.cli.app.ConformanceSuite") as mock_cls:
+            mock_suite = MagicMock()
+            mock_result = MagicMock()
+            mock_result.all_passed = True
+            mock_result.render.return_value = "PASS (9/9)"
+            mock_suite.run_all.return_value = mock_result
+            mock_cls.return_value = mock_suite
+
+            runner.invoke(app, ["conform"])
+        # text mode calls render(), not to_dict()
+        assert mock_result.render.called
+
+
+class TestVerifyCommand:
+    def _make_db(self, tmp_path: Path) -> None:
+        """Create a minimal sessions DB for testing."""
+        db = tmp_path / "aevum.db"
+        conn = sqlite3.connect(str(db))
+        conn.executescript("""
+            CREATE TABLE sessions (
+                session_id TEXT PRIMARY KEY, commit_type TEXT,
+                principal TEXT, purpose TEXT, started_at TEXT,
+                closed_at TEXT, event_count INTEGER, fact_count INTEGER,
+                checkpoint_count INTEGER, merkle_root TEXT,
+                ed25519_sig TEXT, mldsa65_sig TEXT, ed25519_pub TEXT,
+                mldsa65_pub TEXT, tsa_token TEXT, sigchain_entry_id INTEGER
+            );
+            CREATE TABLE session_events (
+                event_id TEXT PRIMARY KEY, session_id TEXT,
+                sequence INTEGER, event_type TEXT, occurred_at TEXT,
+                input_hash TEXT, output_hash TEXT, latency_ms INTEGER
+            );
+        """)
+        h = hashlib.sha256(b"").hexdigest()
+        now = datetime.now(UTC).isoformat()
+        conn.execute(
+            "INSERT INTO sessions VALUES (?,?,?,?,?,?,?,?,?,?,NULL,NULL,NULL,NULL,NULL,NULL)",
+            ("sess-abc", "complete", "alice", "test", now, now, 0, 0, 0, h),
+        )
+        conn.commit()
+        conn.close()
+
+    def test_verify_missing_db_exits_1(self, tmp_path: Path) -> None:
+        result = runner.invoke(
+            app, ["verify", "sess-abc", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 1
+        assert "not found" in strip_ansi(result.output).lower()
+
+    def test_verify_valid_session_exits_0(self, tmp_path: Path) -> None:
+        self._make_db(tmp_path)
+        result = runner.invoke(
+            app, ["verify", "sess-abc", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 0
+        assert "VERIFIED" in strip_ansi(result.output)
+
+    def test_verify_missing_session_exits_1(self, tmp_path: Path) -> None:
+        self._make_db(tmp_path)
+        result = runner.invoke(
+            app, ["verify", "nonexistent", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 1
+
+    def test_verify_shows_merkle_root(self, tmp_path: Path) -> None:
+        self._make_db(tmp_path)
+        result = runner.invoke(
+            app, ["verify", "sess-abc", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 0
+        assert "Merkle root:" in strip_ansi(result.output)
+
+    def test_verify_shows_event_count(self, tmp_path: Path) -> None:
+        self._make_db(tmp_path)
+        result = runner.invoke(
+            app, ["verify", "sess-abc", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 0
+        assert "Events: 0" in strip_ansi(result.output)
+
+    def test_verify_help(self) -> None:
+        result = runner.invoke(app, ["verify", "--help"])
+        assert result.exit_code == 0
+        clean = strip_ansi(result.output)
+        assert "session" in clean.lower() or "verify" in clean.lower()
+
+
+class TestReplayCommand:
+    def _make_db(self, tmp_path: Path) -> None:
+        db = tmp_path / "aevum.db"
+        conn = sqlite3.connect(str(db))
+        conn.executescript("""
+            CREATE TABLE sessions (
+                session_id TEXT PRIMARY KEY, commit_type TEXT,
+                principal TEXT, purpose TEXT, started_at TEXT,
+                closed_at TEXT, event_count INTEGER, fact_count INTEGER,
+                checkpoint_count INTEGER, merkle_root TEXT,
+                ed25519_sig TEXT, mldsa65_sig TEXT, ed25519_pub TEXT,
+                mldsa65_pub TEXT, tsa_token TEXT, sigchain_entry_id INTEGER
+            );
+            CREATE TABLE session_events (
+                event_id TEXT PRIMARY KEY, session_id TEXT,
+                sequence INTEGER, event_type TEXT, occurred_at TEXT,
+                input_hash TEXT, output_hash TEXT, latency_ms INTEGER
+            );
+        """)
+        h = hashlib.sha256(b"").hexdigest()
+        now = datetime.now(UTC).isoformat()
+        conn.execute(
+            "INSERT INTO sessions VALUES (?,?,?,?,?,?,?,?,?,?,NULL,NULL,NULL,NULL,NULL,NULL)",
+            ("sess-xyz", "complete", "bob", "replay-test", now, now, 0, 0, 0, h),
+        )
+        conn.commit()
+        conn.close()
+
+    def test_replay_help_text_parseable(self) -> None:
+        result = runner.invoke(app, ["replay", "--help"])
+        assert result.exit_code == 0
+        clean = strip_ansi(result.output)
+        assert "replay" in clean.lower() or "session" in clean.lower()
+
+    def test_replay_missing_db_exits_1(self, tmp_path: Path) -> None:
+        result = runner.invoke(
+            app, ["replay", "sess-xyz", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 1
+        assert "not found" in strip_ansi(result.output).lower()
+
+    def test_replay_valid_session_exits_0(self, tmp_path: Path) -> None:
+        self._make_db(tmp_path)
+        result = runner.invoke(
+            app, ["replay", "sess-xyz", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 0
+        assert "PASS" in strip_ansi(result.output)
+
+    def test_replay_missing_session_exits_1(self, tmp_path: Path) -> None:
+        self._make_db(tmp_path)
+        result = runner.invoke(
+            app, ["replay", "no-such-session", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 1
+
+    def test_replay_verbose_flag_accepted(self, tmp_path: Path) -> None:
+        self._make_db(tmp_path)
+        result = runner.invoke(
+            app, ["replay", "sess-xyz", "--verbose", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 0
+
+
+class TestAuditPackCommand:
+    def _make_db(self, tmp_path: Path, session_id: str = "s1") -> None:
+        db = tmp_path / "aevum.db"
+        conn = sqlite3.connect(str(db))
+        conn.executescript("""
+            CREATE TABLE sessions (
+                session_id TEXT PRIMARY KEY, commit_type TEXT,
+                principal TEXT, purpose TEXT, started_at TEXT,
+                closed_at TEXT, event_count INTEGER, fact_count INTEGER,
+                checkpoint_count INTEGER, merkle_root TEXT,
+                ed25519_sig TEXT, mldsa65_sig TEXT, ed25519_pub TEXT,
+                mldsa65_pub TEXT, tsa_token TEXT, sigchain_entry_id INTEGER
+            );
+            CREATE TABLE session_events (
+                event_id TEXT PRIMARY KEY, session_id TEXT,
+                sequence INTEGER, event_type TEXT, occurred_at TEXT,
+                input_hash TEXT, output_hash TEXT, latency_ms INTEGER
+            );
+        """)
+        h = hashlib.sha256(b"").hexdigest()
+        now = datetime.now(UTC).isoformat()
+        conn.execute(
+            "INSERT INTO sessions VALUES (?,?,?,?,?,?,?,?,?,?,NULL,NULL,NULL,NULL,NULL,NULL)",
+            (session_id, "complete", "alice", "test", now, now, 0, 0, 0, h),
+        )
+        conn.commit()
+        conn.close()
+
+    def test_audit_pack_missing_db_exits_1(self, tmp_path: Path) -> None:
+        result = runner.invoke(
+            app, ["audit-pack", "sess-1", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 1
+
+    def test_audit_pack_to_stdout(self, tmp_path: Path) -> None:
+        self._make_db(tmp_path)
+        result = runner.invoke(
+            app, ["audit-pack", "s1", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 0
+        pack = json.loads(strip_ansi(result.output))
+        assert "@context" in pack
+        assert "@graph" in pack
+
+    def test_audit_pack_to_file(self, tmp_path: Path) -> None:
+        """Audit pack writes JSON-LD to a file."""
+        self._make_db(tmp_path)
+        out_file = tmp_path / "pack.json"
+        result = runner.invoke(app, [
+            "audit-pack", "s1",
+            "--state-dir", str(tmp_path),
+            "--output", str(out_file),
+        ])
+        assert result.exit_code == 0
+        assert out_file.exists()
+        pack = json.loads(out_file.read_text())
+        assert "@context" in pack
+        assert "@graph" in pack
+
+    def test_audit_pack_missing_session_exits_1(self, tmp_path: Path) -> None:
+        self._make_db(tmp_path)
+        result = runner.invoke(
+            app, ["audit-pack", "no-such-session", "--state-dir", str(tmp_path)]
+        )
+        assert result.exit_code == 1
+
+    def test_audit_pack_help(self) -> None:
+        result = runner.invoke(app, ["audit-pack", "--help"])
+        assert result.exit_code == 0
+        clean = strip_ansi(result.output)
+        assert "session" in clean.lower() or "audit" in clean.lower()
+
+
+class TestCLIHelp:
+    def test_help_shows_all_new_commands(self) -> None:
+        result = runner.invoke(app, ["--help"])
+        assert result.exit_code == 0
+        clean = strip_ansi(result.output)
+        for cmd in ("init", "verify", "audit-pack", "conform", "replay"):
+            assert cmd in clean
+
+    def test_help_still_shows_existing_commands(self) -> None:
+        result = runner.invoke(app, ["--help"])
+        assert result.exit_code == 0
+        clean = strip_ansi(result.output)
+        for cmd in ("version", "server", "store", "complication", "conformance"):
+            assert cmd in clean
+
+    def test_each_new_command_has_help(self) -> None:
+        for cmd in ("init", "verify", "audit-pack", "conform", "replay"):
+            result = runner.invoke(app, [cmd, "--help"])
+            assert result.exit_code == 0, f"--help failed for command: {cmd}"
+
+    def test_init_help_mentions_state_dir(self) -> None:
+        result = runner.invoke(app, ["init", "--help"])
+        assert result.exit_code == 0
+        assert "state-dir" in strip_ansi(result.output)
+
+    def test_conform_help_mentions_output(self) -> None:
+        result = runner.invoke(app, ["conform", "--help"])
+        assert result.exit_code == 0
+        assert "output" in strip_ansi(result.output).lower()
+
+    def test_replay_help_mentions_verbose(self) -> None:
+        result = runner.invoke(app, ["replay", "--help"])
+        assert result.exit_code == 0
+        assert "verbose" in strip_ansi(result.output).lower()

aevum_cli-0.3.0/.gitignore

@@ -1,31 +0,0 @@
-# Python
-__pycache__/
-*.pyc
-*.pyo
-*.pyd
-.venv/
-*.egg-info/
-
-# Build
-dist/
-build/
-
-# Tools
-.mypy_cache/
-.ruff_cache/
-.pytest_cache/
-.hypothesis/
-
-# IDE
-.vscode/
-.idea/
-*.swp
-*.swo
-
-# OS
-.DS_Store
-Thumbs.db
-
-# Verify scripts (run locally, never commit)
-verify_phase*.py
-scripts/verify_phase*.py

aevum_cli-0.3.0/src/aevum/cli/app.py

@@ -1,22 +0,0 @@
-"""
-Top-level typer app. Sub-commands registered here.
-"""
-
-from __future__ import annotations
-
-import typer
-
-from aevum.cli.commands import complication, conformance, server, store, version
-
-app = typer.Typer(
-    name="aevum",
-    help="Aevum context kernel -- command-line interface.",
-    no_args_is_help=True,
-    pretty_exceptions_enable=False,
-)
-
-app.add_typer(server.app, name="server")
-app.add_typer(store.app, name="store")
-app.add_typer(complication.app, name="complication")
-app.add_typer(conformance.app, name="conformance")
-app.command(name="version")(version.version_command)