argus-proof 0.2.0__tar.gz → 0.2.2__tar.gz

{argus_proof-0.2.0 → argus_proof-0.2.2}/.env.example

@@ -41,6 +41,13 @@ PROOF_MODELS_DIR=~/models
 COMFYUI_BASE_URL=http://127.0.0.1:8188
 A1111_BASE_URL=http://127.0.0.1:7860
 
+# ── Safety scoring ───────────────────────────────────────────────────
+# NudeNet server for the safety scorer (its origin; /infer is appended), e.g.
+# ghcr.io/notai-tech/nudenet or any server speaking its /infer API. Unset = the
+# safety scorer is skipped. Proof never imports NudeNet (AGPL-3.0).
+#PROOF_NUDENET_URL=http://nudenet:8080
+#PROOF_NUDENET_TIMEOUT=30
+
 # remote (cloud) backend — the hosted generation endpoint + its bearer token.
 PROOF_REMOTE_URL=https://your-proof-gen.example.com
 PROOF_REMOTE_API_KEY=

{argus_proof-0.2.0 → argus_proof-0.2.2}/.github/workflows/release.yml

@@ -62,7 +62,15 @@ jobs:
 
   publish-pypi:
     runs-on: ubuntu-latest
-    needs: publish-testpypi
+    # Ordered *after* the TestPyPI rehearsal so its outcome is visible first, but
+    # deliberately not gated on it. A TestPyPI-only fault — a missing trusted
+    # publisher, an index outage — must not silently withhold the real release:
+    # that failure mode shipped argus-proof images for two tags with no wheel on
+    # PyPI, and nothing surfaced it because publish-image is independent.
+    # Only the build + install gate is required; a TestPyPI failure still marks
+    # the whole run failed, so the problem stays loud.
+    needs: [test-install, publish-testpypi]
+    if: "!cancelled() && needs.test-install.result == 'success'"
     environment: pypi
     steps:
       - uses: actions/download-artifact@v4
@@ -104,3 +112,40 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+  github-release:
+    # The GitHub Release is the last step, so it only appears once the version is
+    # actually on PyPI. Its notes are this version's CHANGELOG.md section.
+    runs-on: ubuntu-latest
+    needs: publish-pypi
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Extract release notes from CHANGELOG.md
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          awk -v head="## [${version}]" 'index($0, head) == 1 {found = 1; next} found && /^## \[/ {exit} found' \
+            CHANGELOG.md > notes.md
+          if ! grep -q '[^[:space:]]' notes.md; then
+            echo "::error::CHANGELOG.md has no section for ${version}"
+            exit 1
+          fi
+      - name: Create or update the GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag="${GITHUB_REF_NAME}"
+          prerelease=""
+          case "$tag" in *-*|*rc*|*a[0-9]*|*b[0-9]*) prerelease="--prerelease" ;; esac
+          if gh release view "$tag" >/dev/null 2>&1; then
+            # Re-run of the workflow: refresh notes and assets rather than failing.
+            gh release edit "$tag" --notes-file notes.md
+            gh release upload "$tag" dist/* --clobber
+          else
+            gh release create "$tag" dist/* --verify-tag --title "$tag" --notes-file notes.md $prerelease
+          fi

argus_proof-0.2.2/CHANGELOG.md

@@ -0,0 +1,94 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.2.2] - 2026-10-26
+
+### Added
+- `CHANGELOG.md`, with sections for every published version (#52).
+- `release.yml` creates a **GitHub Release** for each `v*` tag once the version is on PyPI (#52).
+  Release notes come from that version's section in this file, and a missing section fails the job.
+  The built wheel and sdist are attached. Re-running the job updates the existing Release instead
+  of failing. Tags containing `-`, `rc`, `a<n>` or `b<n>` become pre-releases.
+
+### Security
+- The Docker image no longer trusts **emSign ECC Root CA - G3** after the eMudhra/emSign
+  certificate incident
+  ([details](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576)).
+  uv is pinned to 0.13.5 instead of `:latest`, because a cached `:latest` can still be a
+  pre-0.13.4 digest. The system CA bundle, which urllib callers such as the ComfyUI backend use,
+  disables emSign ECC Root CA - G3 and the Comodo AAA cross-sign root. The image installs pip 26.2.2
+  (hash-pinned) and `certifi>=2026.10.19`.
+- `certifi>=2026.10.19` is pinned in the `dev` extra.
+
+## [0.2.1] - 2026-07-22
+
+### Fixed
+- Release workflow: a TestPyPI failure no longer blocks the real PyPI publish. `publish-pypi` still
+  runs after the TestPyPI rehearsal but only requires the build and install-test jobs, and a
+  TestPyPI failure still fails the run. Before this, v0.1.0 and v0.2.0 shipped container images
+  with no wheel on PyPI.
+- `httpx2` added to the `dev` extra. Starlette's `TestClient` prefers it and raises when neither
+  `httpx2` nor `httpx` is installed.
+
+## [0.2.0] - 2026-07-21
+
+### Added
+- **Replay / read-only mode** (#45). `ARGUS_PROOF_READ_ONLY=1` (or `serve --read-only`) serves
+  stored reports but refuses live GPU evaluation and other writes with 403.
+  `/health` reports `read_only`. Off by default.
+- `GET /scorers` lists the scorers and whether each one is available.
+  `GET /report/{run_id}/image_at/{index}` serves a run's image by position, a seed-free URL for
+  blind review.
+- **Policy-taxonomy moderation** (#41). `argus_proof.moderation` scores images and input prompts
+  against a category taxonomy (sexual, violence, hate, self-harm, weapons, shocking, illegal) with
+  per-category tail stats. A Llama Guard adapter is available behind the new `[moderation]` extra.
+- `RejectReason.category` attributes a HITL reject to a policy category. This bumps
+  `PROOF_VERSION` to 1.3 (additive).
+- Cross-run stats can slice by `step_config` and by experiment labels (`label:<key>`) (#36).
+
+### Changed
+- `GridConfig` and `ExperimentMatrix` share a common `GridAxes` base instead of duplicating its
+  fields (#37).
+- The server uses the shared `argus_cortex.server` write guard (#47) instead of a local
+  `BaseHTTPMiddleware`, which buffered the `/run/stream` NDJSON stream. Requires
+  `argus-cortex>=0.2.0`.
+
+### Security
+- `image_at` validates the image id it gets from a stored report, which closes a path traversal
+  that allowed arbitrary image reads. A 404 no longer echoes the image id.
+
+## [0.1.0] - 2026-07-17
+
+First release: the MVP evaluation pipeline for trained LoRAs.
+
+### Added
+- Versioned wire contract (`PROOF_VERSION` 1.2) with a generated JSON Schema
+  (`schema/proof-wire.schema.json`).
+- Generation backends behind one protocol: ComfyUI, in-process diffusers, AUTOMATIC1111, and a
+  remote endpoint that speaks the proof wire. Every run records a model manifest with hashes.
+- Prompt-grid builder that reads curator export captions.
+- Scoring spine (composite gate with auto-pass, auto-fail and HITL bands, plus near-duplicate
+  collapse) and the scorers: phash dedup and diversity, ArcFace identity against a held-out
+  reference set, CLIPScore / pyiqa / ImageReward quality, and NudeNet safety.
+- HITL review and an optional refinement re-rank of the passing subset.
+- Reject archival.
+- CI acceptance gate with Wilson intervals (`argus-proof gate`, exit 0/1/2).
+- Cross-run stats store (parquet) with pooled pass-rate intervals per slice and Krippendorff's alpha.
+- Routed recommendations (`argus-proof recommend`).
+- A/B experiment matrix with a GPU-hour budget guardrail and optional Optuna search.
+- FiftyOne exploration (`argus-proof explore`) behind the `[fiftyone]` extra.
+- CLI verbs `run`, `score`, `report`, `inspect`, plus a FastAPI server (`argus-proof serve`) with
+  `/run/stream`, report/HITL/refine endpoints, and model and export listings.
+- Container image `ghcr.io/smk762/argus-proof`.
+
+[Unreleased]: https://github.com/smk762/argus-proof/compare/v0.2.2...HEAD
+[0.2.2]: https://github.com/smk762/argus-proof/compare/v0.2.1...v0.2.2
+[0.2.1]: https://github.com/smk762/argus-proof/compare/v0.2.0...v0.2.1
+[0.2.0]: https://github.com/smk762/argus-proof/compare/v0.1.0...v0.2.0
+[0.1.0]: https://github.com/smk762/argus-proof/releases/tag/v0.1.0

argus_proof-0.2.2/CLAUDE.md

@@ -0,0 +1,53 @@
+# CLAUDE.md — argus-proof
+
+Guidance for AI agents working in this repo. Human-facing usage lives in [README.md](README.md); this file is the orientation an agent needs to change code safely.
+
+## What this is
+
+The **post-training evaluation/optimisation** stage — it closes the suite loop: generate a sample grid from a trained LoRA, score it against the curated dataset it was trained from, and emit a pass/fail verdict that feeds back to curation, captioning, and training.
+
+```
+argus-quarry -> argus-curator -> argus-lens -> argus-forge -> your trainer -> argus-proof
+  acquire        curate/export    caption       configs        LoRA           evaluate + optimise
+```
+
+**The forge→proof handoff is a soft join, not an embed.** A `RunManifest` links back to the curator export via `source_manifest` (the `manifest.jsonl`) and, when the LoRA came through the suite, to forge's `training_run_id` (== forge `RunEvent.run_id`). Both are optional — a LoRA can be supplied ad hoc. Proof owns its own `run_id` (the eval run), distinct from the forge training run. README.md is the source of truth for behaviour; it is unusually detailed.
+
+## Layout
+
+`src/argus_proof/`:
+
+- `models.py` — Pydantic v2 wire types, the three versioned top-level shapes (`RunManifest`, `EvalReport`, `RejectArchive`) plus `RunSpec`/grid/gate/acceptance models. **This is the API contract**; `wire_schema()`/`render_wire_schema()` back `argus-proof schema` and the committed `schema/proof-wire.schema.json`.
+- `grid.py` / `experiment.py` — the prompt-grid builder (axes × prompts × seeds → `RunSpec`s) and the A/B `ExperimentMatrix` that varies base-checkpoint × step-config as outer factors.
+- `backends/` — pluggable generation engines over `base.GenBackend`: `comfyui` (shipped), `diffusers`, `a1111`, `remote`; `workflow.py`/`pnginfo.py`/`http.py` are shared helpers. `get_backend(name, ...)` selects by config (`_BACKENDS` registry).
+- `scoring/` — `base.py` (the `ImageScorer`/`Deduper`/`DiversityScorer` protocols + `METRIC_FIELDS`), `orchestrator.py` (`score_run`), `gate.py`, `summary.py`; concrete scorers under `scoring/scorers/` (phash, identity, quality behind the `[score]` extra; safety posts to a NudeNet server at `PROOF_NUDENET_URL` through argus-cortex's `NudeNetClient` — **never import `nudenet` in-process: it is AGPL-3.0**).
+- `reports.py` (`ReportStore`, `apply_hitl`), `refinement.py`, `acceptance.py`, `recommend.py`, `crossrun.py`, `archive.py`, `stats.py`, `moderation.py`, `explore.py` — the report store + the optimisation layers on top of a scored run.
+- `cli.py` — Typer app (`inspect`, `run`, `score`, `report`, `gate`, `recommend`, `experiment`, `explore`, `schema`, `serve`).
+- `server/app.py` — FastAPI micro-server on **:8104** (peer to lens :8100, curator :8101, quarry :8102, forge :8103); backs the argus-studio `/proof` view. Optional `[server]` extra.
+- `templates/comfyui_sdxl_lora.json` — the shipped parametric ComfyUI workflow (`$placeholder` graph).
+
+## Commands
+
+```bash
+make install   # uv venv + editable install with [dev,server,cli]
+make test      # uv run --no-sync pytest --tb=short -q
+make lint      # ruff 0.15.16 check + format --check
+make format    # ruff format + check --fix
+```
+
+Run a single test: `uv run --no-sync pytest tests/test_scoring.py::test_name -q`.
+
+## Conventions & gotchas
+
+- **The wire schema is checked in CI** (`argus-proof schema --check` runs post-test). If you touch `WIRE_MODELS`/types in `models.py`, regenerate: `argus-proof schema > schema/proof-wire.schema.json`. Bump `PROOF_VERSION` (minor = additive field/metric, major = breaking) and mind `SUPPORTED_PROOF_MAJORS`.
+- **Pass-rate is computed over near-duplicate *groups*, not raw frames** (`n_passed / n_groups`), so a Monte-Carlo cluster counts once. Never revert this to per-image — it's the core anti-inflation invariant. `n_groups == n_images` when no deduper ran.
+- **Scorers return normalised `[0,1]` (higher = better) or `None`** — never a fabricated `0.0` for an axis that didn't run. At most one scorer per metric (`METRIC_FIELDS`); the orchestrator raises if two target the same one. The `[0,1]` quality-scorer normalisation `lo`/`hi` defaults are **placeholders** — calibrate against real generations.
+- **Every model file is pinned by SHA256** in the `RunManifest`, not by filename — a run must reconstruct exactly. Backends resolve a requested name to a file and hash it; don't record a name without its digest. `RejectArchive`/`RejectRecord` are **image-free by construction** (keyed by `(run_id, seed)` — seed + manifest reconstructs the pixels); never add a path/thumbnail field there.
+- **Refinement is a separate layer.** `ImageScores.refinement` never overwrites the first-pass `hitl_rating`/`reject_reasons` or the verdict; refining an image not in the passing subset is refused.
+- **Backend swap is a config change, not a code change** — scoring/report code is engine-agnostic (`PROOF_BACKEND` selects). Keep new engines behind `GenBackend` + the `_BACKENDS` registry; heavy adapters stay lazy-imported and `is_available()`-guarded (same for optional scorers/moderation/explore).
+- **Server safety — don't loosen either boundary:**
+  - Images are addressed by `(run_id, image_id)`, both validated against a strict charset (`_SAFE_ID`) — **no client-supplied filesystem path is ever resolved**. Keep it that way; there is no traversal surface by design.
+  - Read-only/replay mode (`ARGUS_PROOF_READ_ONLY`, `serve --read-only`): every mutating request — `POST /run/stream` (live GPU eval) above all — is refused with `403` via the shared `argus_cortex.server.WriteGuard`. `/health` echoes the flag. It fails *safe*.
+  - Concurrent report writes are serialised by a per-run `flock` sidecar (`reports.py`), so a streaming run's write and a reviewer's HITL save can't drop updates. On non-POSIX it degrades to a no-op — don't rely on it for multi-host.
+- Shared suite code (taxonomy, wire-schema tooling, the server write-guard/env-flag helpers, `RemoteBackend`) lives in **argus-cortex** (`argus-cortex[server]`) — reuse it, don't re-implement.
+- Versioning is git-tag-derived (`hatch-vcs`); `_version.py` is generated (gitignored). `structlog` logging, Pydantic v2, async server (`asyncio_mode = auto`), ruff line-length 120. Scaffolded from `argus-pkg-template` — `copier update` pulls tooling changes.

argus_proof-0.2.2/Dockerfile

@@ -0,0 +1,39 @@
+# syntax=docker/dockerfile:1
+FROM python:3.11-slim
+
+# Pin past the eMudhra/emSign incident. A floating :latest tag can stay cached
+# on a pre-0.13.4 digest, which still trusts emSign ECC Root CA - G3.
+# https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /bin/
+
+WORKDIR /app
+
+# hatch-vcs derives the version from git history, so the build context must
+# include .git (keep it out of .dockerignore for this image) and the image
+# needs the git binary for setuptools-scm to read it (slim ships without it).
+# ComfyUI and the other urllib callers trust this bundle, not certifi.
+# Distrust emSign ECC Root CA - G3 and the Comodo AAA cross-sign root.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends ca-certificates git \
+    && sed -i \
+        -e 's|^mozilla/emSign_ECC_Root_CA_-_G3|!mozilla/emSign_ECC_Root_CA_-_G3|' \
+        -e 's|^mozilla/Comodo_AAA|!mozilla/Comodo_AAA|' \
+        /etc/ca-certificates.conf \
+    && update-ca-certificates --fresh >/dev/null \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY . .
+
+# Extras baked into the image. Default keeps it light; build with
+# EXTRAS="server,cli,score" for the full scorer stack (torch, insightface, …).
+ARG EXTRAS="server,cli"
+
+# pillow + imagehash ride along regardless: they power phash near-dup collapse
+# and diversity (honest group pass-rates) at negligible image cost.
+RUN python -m pip install --no-cache-dir \
+        "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" \
+    && uv pip install --system --no-cache "certifi>=2026.10.19" ".[${EXTRAS}]" pillow imagehash
+
+EXPOSE 8104
+CMD ["argus-proof", "serve", "--port", "8104", "--cors"]
+

{argus_proof-0.2.0 → argus_proof-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: argus-proof
-Version: 0.2.0
+Version: 0.2.2
 Summary: Post-training LoRA evaluation and optimisation: generate samples from a trained LoRA and score them against the curated dataset it was trained from
 Project-URL: Repository, https://github.com/smk762/argus-proof
 Author: smk762
@@ -14,13 +14,15 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
-Requires-Dist: argus-cortex>=0.2.0
+Requires-Dist: argus-cortex<0.5,>=0.4
 Requires-Dist: pydantic>=2.7
 Requires-Dist: structlog>=24.0
 Provides-Extra: cli
 Requires-Dist: rich>=13.0; extra == 'cli'
 Requires-Dist: typer>=0.12; extra == 'cli'
 Provides-Extra: dev
+Requires-Dist: certifi>=2026.10.19; extra == 'dev'
+Requires-Dist: httpx2>=2.7; extra == 'dev'
 Requires-Dist: httpx>=0.27; extra == 'dev'
 Requires-Dist: imagehash>=4.3; extra == 'dev'
 Requires-Dist: krippendorff>=0.6; extra == 'dev'
@@ -51,14 +53,13 @@ Provides-Extra: score
 Requires-Dist: image-reward>=1.5; extra == 'score'
 Requires-Dist: imagehash>=4.3; extra == 'score'
 Requires-Dist: insightface>=0.7; extra == 'score'
-Requires-Dist: nudenet>=3.0; extra == 'score'
 Requires-Dist: onnxruntime>=1.16; extra == 'score'
 Requires-Dist: pillow>=10.0; extra == 'score'
 Requires-Dist: pyiqa>=0.1.10; extra == 'score'
 Requires-Dist: torch>=2.0; extra == 'score'
 Requires-Dist: torchmetrics>=1.0; extra == 'score'
 Provides-Extra: server
-Requires-Dist: argus-cortex[server]>=0.2.0; extra == 'server'
+Requires-Dist: argus-cortex[server]<0.5,>=0.4; extra == 'server'
 Requires-Dist: fastapi>=0.110; extra == 'server'
 Requires-Dist: python-multipart>=0.0.7; extra == 'server'
 Requires-Dist: uvicorn>=0.27; extra == 'server'
@@ -219,7 +220,7 @@ skips it when the extra is absent). Shipped:
 - **dedup + diversity** — `PhashDeduper`, `PhashDiversityScorer` (perceptual hash, CPU-only)
 - **identity** — `IdentityScorer` (InsightFace ArcFace cosine vs a held-out reference set)
 - **quality / adherence** — `clip_score_scorer()` (CLIPScore), `pyiqa_scorer()` (CLIP-IQA), `image_reward_scorer()` (ImageReward), each normalising its raw score to `[0,1]`
-- **safety** — `SafetyScorer` (NudeNet ensemble, `1 - unsafe`); set a `safety` hard gate to auto-fail unsafe images. `safety_tail_aggregate()` surfaces the any-hit/min/percentile tail
+- **safety** — `SafetyScorer` (NudeNet ensemble, `1 - unsafe`); set a `safety` hard gate to auto-fail unsafe images. `safety_tail_aggregate()` surfaces the any-hit/min/percentile tail. NudeNet runs as a **server over HTTP** (`PROOF_NUDENET_URL`, via argus-cortex's `NudeNetClient`), never in-process (it is AGPL-3.0); without a URL the scorer is skipped. "Unsafe" is the suite's exposed-nudity set (exposed buttocks, breasts, genitalia, anus), the same as curator's
 
 ```python
 from argus_proof.scoring import score_run
@@ -450,6 +451,8 @@ make lint
 
 - **CI** runs via the shared [`argus-ci`](https://github.com/smk762/argus-ci) reusable workflow.
 - **Release** publishes to PyPI (OIDC trusted publishing) and GHCR on `v*` tags.
+- Once PyPI has the version, a **GitHub Release** is created with that version's
+  `CHANGELOG.md` section as its notes. Add the section before you tag; the job fails without it.
 - Versioning is derived from git tags via `hatch-vcs` — tag `vX.Y.Z` to cut a release.
 
 This repo was scaffolded from [`argus-pkg-template`](https://github.com/smk762/argus-pkg-template).

{argus_proof-0.2.0 → argus_proof-0.2.2}/README.md

@@ -150,7 +150,7 @@ skips it when the extra is absent). Shipped:
 - **dedup + diversity** — `PhashDeduper`, `PhashDiversityScorer` (perceptual hash, CPU-only)
 - **identity** — `IdentityScorer` (InsightFace ArcFace cosine vs a held-out reference set)
 - **quality / adherence** — `clip_score_scorer()` (CLIPScore), `pyiqa_scorer()` (CLIP-IQA), `image_reward_scorer()` (ImageReward), each normalising its raw score to `[0,1]`
-- **safety** — `SafetyScorer` (NudeNet ensemble, `1 - unsafe`); set a `safety` hard gate to auto-fail unsafe images. `safety_tail_aggregate()` surfaces the any-hit/min/percentile tail
+- **safety** — `SafetyScorer` (NudeNet ensemble, `1 - unsafe`); set a `safety` hard gate to auto-fail unsafe images. `safety_tail_aggregate()` surfaces the any-hit/min/percentile tail. NudeNet runs as a **server over HTTP** (`PROOF_NUDENET_URL`, via argus-cortex's `NudeNetClient`), never in-process (it is AGPL-3.0); without a URL the scorer is skipped. "Unsafe" is the suite's exposed-nudity set (exposed buttocks, breasts, genitalia, anus), the same as curator's
 
 ```python
 from argus_proof.scoring import score_run
@@ -381,6 +381,8 @@ make lint
 
 - **CI** runs via the shared [`argus-ci`](https://github.com/smk762/argus-ci) reusable workflow.
 - **Release** publishes to PyPI (OIDC trusted publishing) and GHCR on `v*` tags.
+- Once PyPI has the version, a **GitHub Release** is created with that version's
+  `CHANGELOG.md` section as its notes. Add the section before you tag; the job fails without it.
 - Versioning is derived from git tags via `hatch-vcs` — tag `vX.Y.Z` to cut a release.
 
 This repo was scaffolded from [`argus-pkg-template`](https://github.com/smk762/argus-pkg-template).

{argus_proof-0.2.0 → argus_proof-0.2.2}/pyproject.toml

@@ -22,7 +22,10 @@ classifiers = [
 dependencies = [
     # Shared suite foundation (taxonomy, wire-schema tooling, AI-backend contract,
     # and the server write-guard scaffolding used by server/app.py — 0.2.0+).
-    "argus-cortex>=0.2.0",
+    # 0.4+: argus_cortex.moderation (the NudeNet client the safety scorer uses).
+    # Capped below the next minor: argus-cortex is pre-1.0, where a minor bump
+    # carries no compatibility guarantee.
+    "argus-cortex>=0.4,<0.5",
     "pydantic>=2.7",
     "structlog>=24.0",
 ]
@@ -30,7 +33,7 @@ dependencies = [
 [project.optional-dependencies]
 # argus-cortex[server] pulls starlette for the shared write-guard (argus_cortex.server);
 # fastapi provides it too, but the extra declares the dependency honestly.
-server = ["fastapi>=0.110", "uvicorn>=0.27", "python-multipart>=0.0.7", "argus-cortex[server]>=0.2.0"]
+server = ["fastapi>=0.110", "uvicorn>=0.27", "python-multipart>=0.0.7", "argus-cortex[server]>=0.4,<0.5"]
 cli = ["typer>=0.12", "rich>=13.0"]
 # Concrete scorers (implement argus_proof.scoring protocols): dedup/diversity
 # (phash) + identity (InsightFace ArcFace) + quality (CLIPScore/pyiqa/ImageReward).
@@ -45,7 +48,6 @@ score = [
     "torchmetrics>=1.0",
     "pyiqa>=0.1.10",
     "image-reward>=1.5",
-    "nudenet>=3.0",
 ]
 # Cross-run stats store (pass-rate CIs use the dependency-free argus_proof.stats;
 # the parquet store needs polars, inter-rater reliability the krippendorff pkg).
@@ -67,7 +69,7 @@ diffusers = ["diffusers>=0.27", "torch>=2.0", "transformers>=4.38", "accelerate>
 # outputs + input prompts. LLM-weight, so opt-in; lazy-imported by
 # argus_proof.moderation and is_available()-guarded (absent -> a clear hint).
 moderation = ["transformers>=4.43", "torch>=2.0", "accelerate>=0.27", "pillow>=10.0"]
-dev = ["pytest>=8.0", "pytest-asyncio>=0.23", "ruff==0.15.16", "httpx>=0.27", "pillow>=10.0", "imagehash>=4.3", "polars>=1.0", "krippendorff>=0.6", "optuna>=3.0"]
+dev = ["pytest>=8.0", "pytest-asyncio>=0.23", "ruff==0.15.16", "httpx>=0.27", "certifi>=2026.10.19", "pillow>=10.0", "imagehash>=4.3", "polars>=1.0", "krippendorff>=0.6", "optuna>=3.0", "httpx2>=2.7"]
 
 [project.scripts]
 argus-proof = "argus_proof.cli:app"

{argus_proof-0.2.0 → argus_proof-0.2.2}/src/argus_proof/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.2.0'
-__version_tuple__ = version_tuple = (0, 2, 0)
+__version__ = version = '0.2.2'
+__version_tuple__ = version_tuple = (0, 2, 2)
 
 __commit_id__ = commit_id = None

{argus_proof-0.2.0 → argus_proof-0.2.2}/src/argus_proof/scoring/scorers/safety.py

@@ -7,7 +7,8 @@ set a ``safety`` hard gate to auto-fail (and flag ``unsafe``) anything too risky
 
 An **ensemble** of detectors is combined conservatively (worst/most-unsafe wins).
 The detector is injectable, so the scoring logic is CI-tested with a fake; the
-real :class:`NudeNetDetector` is lazy and behind the ``[score]`` extra.
+real :class:`NudeNetDetector` calls a NudeNet server (``PROOF_NUDENET_URL``)
+and is unavailable without one.
 
 :func:`safety_tail_aggregate` gives the run-level tail view (any-hit / min-safety
 / low percentile) that matters for safety, where the mean hides a single bad frame.
@@ -15,12 +16,21 @@ real :class:`NudeNetDetector` is lazy and behind the ``[score]`` extra.
 
 from __future__ import annotations
 
+import os
 from collections.abc import Sequence
 from pathlib import Path
 from typing import TYPE_CHECKING, Protocol, runtime_checkable
 
+from argus_cortex.moderation import (
+    DEFAULT_EXPOSED_LABELS,
+    CheckFailed,
+    ModerationConfigError,
+    NudeNetClient,
+    exposed_score,
+)
+
 from argus_proof.models import ScorerProvenance
-from argus_proof.scoring.scorers._util import clamp01, module_available
+from argus_proof.scoring.scorers._util import clamp01
 from argus_proof.scoring.scorers._util import percentile as _percentile
 
 if TYPE_CHECKING:
@@ -28,6 +38,12 @@ if TYPE_CHECKING:
     from argus_proof.scoring.base import ScoreContext
 
 
+# The NudeNet server (its origin) and per-image timeout, kept in lock-step with .env.example.
+ENV_NUDENET_URL = "PROOF_NUDENET_URL"
+ENV_NUDENET_TIMEOUT = "PROOF_NUDENET_TIMEOUT"
+DEFAULT_NUDENET_TIMEOUT = 30.0
+
+
 @runtime_checkable
 class SafetyDetector(Protocol):
     """Returns an image's unsafe probability in ``[0, 1]`` (or ``None`` if unknown)."""
@@ -81,45 +97,70 @@ class SafetyScorer:
 
 
 class NudeNetDetector:
-    """Unsafe-probability via NudeNet 3.x ``NudeDetector`` (max exposed-class score).
-
-    NudeNet 3.x replaced the old ``NudeClassifier`` with ``NudeDetector().detect()``,
-    which returns a list of ``{"class", "score", "box"}`` detections; the unsafe
-    score is the max confidence over the *exposed* classes. Heavy (onnxruntime +
-    model); lazy, behind the ``[score]`` extra. A detector error on one image
-    returns ``None`` (skip it) rather than crashing the whole scoring run.
+    """Unsafe-probability from a NudeNet server over HTTP (max exposed-class score).
+
+    Proof never imports NudeNet (AGPL-3.0): it posts each image to a NudeNet
+    server through argus-cortex's :class:`~argus_cortex.moderation.NudeNetClient`.
+    The server is ``PROOF_NUDENET_URL`` (its origin, e.g. ``http://nudenet:8080``)
+    unless *base_url* is given; without one the detector is unavailable and the
+    orchestrator skips it.
+
+    The unsafe score is the highest score among the suite's exposed-nudity
+    classes (:data:`~argus_cortex.moderation.DEFAULT_EXPOSED_LABELS`: exposed
+    buttocks, breasts, genitalia, anus), shared with curator. Faces, covered
+    parts, and bare feet, belly, armpits or male chest do not count. A failed
+    check on one image returns ``None`` (skip it) rather than crashing the run.
     """
 
     name = "nudenet"
 
-    def __init__(self, unsafe_classes: frozenset[str] | None = None) -> None:
-        # Default: any explicit "*_EXPOSED" class (genitalia, breast, buttocks,
-        # anus). Override to widen/narrow what counts as unsafe.
-        self._unsafe_classes = unsafe_classes
-        self._detector = None
+    def __init__(
+        self,
+        unsafe_classes: frozenset[str] | None = None,
+        base_url: str | None = None,
+        timeout: float | None = None,
+    ) -> None:
+        # Override to widen/narrow what counts as unsafe (NudeNet class names).
+        self._unsafe_classes = unsafe_classes if unsafe_classes is not None else frozenset(DEFAULT_EXPOSED_LABELS)
+        self._base_url = base_url
+        self._timeout = timeout
+        self._client: NudeNetClient | None = None
+
+    def _url(self) -> str:
+        return (self._base_url if self._base_url is not None else os.environ.get(ENV_NUDENET_URL, "")).strip()
 
     def is_available(self) -> bool:
-        return module_available("nudenet")
-
-    def _load(self):  # noqa: ANN202 - nudenet types aren't importable without the extra
-        if self._detector is None:
-            from nudenet import NudeDetector
+        if not self._url():
+            return False
+        try:
+            self._load()
+        except ModerationConfigError:
+            return False
+        return True
 
-            self._detector = NudeDetector()
-        return self._detector
+    def _load(self) -> NudeNetClient:
+        if self._client is None:
+            timeout = self._timeout or _float_env(ENV_NUDENET_TIMEOUT, DEFAULT_NUDENET_TIMEOUT)
+            self._client = NudeNetClient(self._url(), timeout=timeout)
+        return self._client
 
     def _is_unsafe(self, label: str) -> bool:
-        if self._unsafe_classes is not None:
-            return label in self._unsafe_classes
-        return label.endswith("_EXPOSED")
+        return label in self._unsafe_classes
 
     def unsafe_probability(self, image_path: Path) -> float | None:
         try:
-            detections = self._load().detect(str(image_path))
-        except Exception:  # noqa: BLE001 - one bad image must not abort the run
+            result = self._load().check(Path(image_path).read_bytes(), Path(image_path).name)
+        except (CheckFailed, ModerationConfigError, OSError):  # one bad image must not abort the run
             return None
-        scores = [float(d["score"]) for d in detections if self._is_unsafe(str(d.get("class", "")))]
-        return max(scores) if scores else 0.0  # no exposed detection -> safe
+        return exposed_score(result.labels, sorted(self._unsafe_classes))  # no exposed detection -> 0.0 (safe)
+
+
+def _float_env(name: str, default: float) -> float:
+    try:
+        value = float(os.environ.get(name, ""))
+    except ValueError:
+        return default
+    return value if value > 0 else default
 
 
 def safety_tail_aggregate(report: EvalReport, *, unsafe_below: float = 0.5) -> dict[str, float]:

{argus_proof-0.2.0 → argus_proof-0.2.2}/tests/test_scorers_safety.py

@@ -1,5 +1,9 @@
 from __future__ import annotations
 
+import json
+import threading
+from collections.abc import Iterator
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 
 import pytest
@@ -121,26 +125,92 @@ def test_tail_aggregate_no_safety_scores() -> None:
 
 
 # --------------------------------------------------------------------------
-# NudeNetDetector (3.x API) — pure logic + graceful degradation
+# NudeNetDetector — a NudeNet server over HTTP (argus-cortex's client)
 # --------------------------------------------------------------------------
 
 
-def test_nudenet_unsafe_class_heuristic() -> None:
+class _NudeNet(BaseHTTPRequestHandler):
+    """Speaks NudeNet's /infer API; answers by the uploaded file's name."""
+
+    answers = {
+        "topless.png": [
+            {"class": "FEMALE_BREAST_EXPOSED", "score": 0.81, "box": [0, 0, 5, 5]},
+            {"class": "FACE_FEMALE", "score": 0.93, "box": [0, 0, 5, 5]},
+        ],
+        "beach.png": [
+            {"class": "FEET_EXPOSED", "score": 0.9, "box": [0, 0, 5, 5]},
+            {"class": "MALE_BREAST_EXPOSED", "score": 0.7, "box": [0, 0, 5, 5]},
+        ],
+    }
+
+    def log_message(self, *args) -> None:  # keep test output quiet
+        pass
+
+    def do_POST(self) -> None:
+        body = self.rfile.read(int(self.headers["Content-Length"]))
+        name = next(n for n in self.answers if f'filename="{n}"'.encode() in body) if b"broken" not in body else None
+        if name is None:
+            self.send_response(500)
+            self.end_headers()
+            return
+        out = json.dumps({"prediction": [self.answers[name]], "success": True}).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(out)))
+        self.end_headers()
+        self.wfile.write(out)
+
+
+@pytest.fixture
+def nudenet_url() -> Iterator[str]:
+    server = ThreadingHTTPServer(("127.0.0.1", 0), _NudeNet)
+    threading.Thread(target=server.serve_forever, daemon=True).start()
+    try:
+        yield f"http://127.0.0.1:{server.server_port}"
+    finally:
+        server.shutdown()
+        server.server_close()
+
+
+def test_nudenet_counts_only_the_suite_exposed_classes() -> None:
     d = NudeNetDetector()
     assert d._is_unsafe("FEMALE_BREAST_EXPOSED") is True
     assert d._is_unsafe("BUTTOCKS_EXPOSED") is True
     assert d._is_unsafe("FACE_FEMALE") is False
     assert d._is_unsafe("FEMALE_BREAST_COVERED") is False
+    assert d._is_unsafe("FEET_EXPOSED") is False  # bare feet / chest are not nudity
+    assert d._is_unsafe("MALE_BREAST_EXPOSED") is False
 
 
 def test_nudenet_unsafe_class_override() -> None:
     d = NudeNetDetector(unsafe_classes=frozenset({"CUSTOM"}))
     assert d._is_unsafe("CUSTOM") is True
-    assert d._is_unsafe("FEMALE_BREAST_EXPOSED") is False  # override replaces the heuristic
+    assert d._is_unsafe("FEMALE_BREAST_EXPOSED") is False  # override replaces the default set
 
 
-def test_nudenet_unavailable_without_extra_and_degrades() -> None:
+def test_nudenet_scores_through_the_server(nudenet_url: str, tmp_path: Path) -> None:
+    for name in ("topless.png", "beach.png", "broken.png"):
+        (tmp_path / name).write_bytes(b"\x89PNG fake")
+    d = NudeNetDetector(base_url=nudenet_url, timeout=5)
+    assert d.is_available()
+    assert d.unsafe_probability(tmp_path / "topless.png") == 0.81  # the face (0.93) does not count
+    assert d.unsafe_probability(tmp_path / "beach.png") == 0.0
+    assert d.unsafe_probability(tmp_path / "broken.png") is None  # failed check: skipped, not safe
+    assert d.unsafe_probability(tmp_path / "missing.png") is None
+    wide = NudeNetDetector(unsafe_classes=frozenset({"FEET_EXPOSED"}), base_url=nudenet_url)
+    assert wide.unsafe_probability(tmp_path / "beach.png") == 0.9
+
+
+def test_nudenet_url_from_env(nudenet_url: str, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("PROOF_NUDENET_URL", nudenet_url)
+    assert NudeNetDetector().is_available()
+    monkeypatch.setenv("PROOF_NUDENET_URL", "ftp://nudenet")
+    assert NudeNetDetector().is_available() is False
+
+
+def test_nudenet_unavailable_without_a_server_and_degrades(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.delenv("PROOF_NUDENET_URL", raising=False)
     d = NudeNetDetector()
-    assert d.is_available() is False  # nudenet not in the CI env
-    # calling anyway must not crash — the load error is caught -> None
+    assert d.is_available() is False  # no NudeNet server configured
+    # calling anyway must not crash — the config error is caught -> None
     assert d.unsafe_probability(Path("nope.png")) is None

argus_proof-0.2.0/Dockerfile

@@ -1,27 +0,0 @@
-# syntax=docker/dockerfile:1
-FROM python:3.11-slim
-
-COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
-
-WORKDIR /app
-
-# hatch-vcs derives the version from git history, so the build context must
-# include .git (keep it out of .dockerignore for this image) and the image
-# needs the git binary for setuptools-scm to read it (slim ships without it).
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends git \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY . .
-
-# Extras baked into the image. Default keeps it light; build with
-# EXTRAS="server,cli,score" for the full scorer stack (torch, insightface, …).
-ARG EXTRAS="server,cli"
-
-# pillow + imagehash ride along regardless: they power phash near-dup collapse
-# and diversity (honest group pass-rates) at negligible image cost.
-RUN uv pip install --system --no-cache ".[${EXTRAS}]" pillow imagehash
-
-EXPOSE 8104
-CMD ["argus-proof", "serve", "--port", "8104", "--cors"]
-