bindable 0.1.1__tar.gz → 0.1.2__tar.gz

{bindable-0.1.1 → bindable-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: bindable
-Version: 0.1.1
+Version: 0.1.2
 Summary: Python client for the hosted Bindable Action Gate, with offline Receipt verification
 Author: Bindable AI LLC
 License-Expression: Apache-2.0

{bindable-0.1.1 → bindable-0.1.2}/bindable/_canonical_record.py

@@ -14,7 +14,7 @@ verified_at handling (de-pydantic departure, behaviour-preserving):
   In the engine, ``Receipt.verified_at`` is a ``datetime`` and the
   builder calls ``_serialize_wire_datetime`` to produce the wire
   string (YYYY-MM-DDTHH:MM:SS.sssZ). In the thin client the receipt
-  arrives from /v1/decide as JSON, so ``verified_at`` is ALREADY the
+  arrives from /v1/review as JSON, so ``verified_at`` is ALREADY the
   wire string. It is used verbatim — passing it back through a
   datetime serializer would be a double-serialization bug. No
   ``datetime`` object can reach this path, so ``_serialize_wire_datetime``
@@ -42,7 +42,7 @@ def _canonical_hash_input(receipt: Mapping[str, Any]) -> dict[str, Any]:
       counterparty_identity, failed_rule, nonce,
       persistent_agent_id, previous_hash, proposed_action_id,
       referenced_evidence, sponsor_identity,
-      sponsor_identity_context, verification_outcome, verified_at.
+      sponsor_identity_context, verdict, verified_at.
 
     Excluded per §12.3:
       receipt_id, signature, signing_key_id, signed_at,
@@ -51,7 +51,7 @@ def _canonical_hash_input(receipt: Mapping[str, Any]) -> dict[str, Any]:
 
     Args:
         receipt: A receipt as a plain mapping (e.g. parsed JSON from
-            /v1/decide). All 15 included fields must be present;
+            /v1/review). All 15 included fields must be present;
             nullable fields carry ``None``. ``verified_at`` must be
             the wire-format string already.
 
@@ -73,6 +73,6 @@ def _canonical_hash_input(receipt: Mapping[str, Any]) -> dict[str, Any]:
         "referenced_evidence": receipt["referenced_evidence"],
         "sponsor_identity": receipt["sponsor_identity"],
         "sponsor_identity_context": receipt["sponsor_identity_context"],
-        "verification_outcome": receipt["verification_outcome"],
+        "verdict": receipt["verdict"],
         "verified_at": receipt["verified_at"],
     }

bindable-0.1.2/bindable/_version.py

@@ -0,0 +1 @@
+__version__ = "0.1.2"

{bindable-0.1.1 → bindable-0.1.2}/bindable/client.py

@@ -1,6 +1,6 @@
 """Transport client for the hosted Bindable Action Gate.
 
-``ActionGate.decide()`` submits a Proposal to ``POST /v1/decide`` and returns
+``ActionGate.decide()`` submits a Proposal to ``POST /v1/review`` and returns
 the hosted Decision (the Outcome dict) verbatim. The client is pure transport:
 it does NOT evaluate, canonicalize, or decide anything locally — all
 proof-rule evaluation happens on the hosted gate. To verify the returned
@@ -24,7 +24,7 @@ from bindable.errors import BindableAPIError
 class ActionGate:
     """Thin, token-authenticated httpx client for the hosted Bindable Action Gate.
 
-    Transports a Proposal to the hosted ``/v1/decide`` endpoint and returns the
+    Transports a Proposal to the hosted ``/v1/review`` endpoint and returns the
     Decision verbatim as a dict. The client performs no local evaluation,
     canonicalization, or decision-making; offline receipt verification is a
     separate concern handled by ``bindable.verify_receipt``.
@@ -55,13 +55,18 @@ class ActionGate:
         proposed_action_id: str,
         nonce: str | None = None,
     ) -> dict[str, Any]:
-        """Submit a Proposal to ``/v1/decide`` and return the hosted Outcome dict.
+        """Submit a Proposal to ``/v1/review`` and return the hosted Outcome dict.
 
         Sends exactly the five wire fields (persistent_agent_id, action_type,
         payload, proposed_action_id, nonce) with bearer-token auth. The Outcome
         is returned verbatim; its ``receipt`` field (when present) can be passed
         to ``verify_receipt`` for offline verification.
 
+        The endpoint moved from ``/v1/decide`` to ``/v1/review`` in 0.1.2. The
+        platform keeps BOTH paths live for a deprecation window, so an older
+        client pinned to ``/v1/decide`` keeps working; new callers get
+        ``/v1/review``.
+
         Args:
             persistent_agent_id: The stable agent identity.
             action_type: The action being proposed.
@@ -87,7 +92,7 @@ class ActionGate:
             "nonce": nonce,
         }
         response = self._client.post(
-            f"{self._base_url}/v1/decide",
+            f"{self._base_url}/v1/review",
             json=body,
             headers={
                 "Authorization": f"Bearer {self._token}",

{bindable-0.1.1 → bindable-0.1.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "bindable"
-version = "0.1.1"
+version = "0.1.2"
 requires-python = ">=3.10"
 description = "Python client for the hosted Bindable Action Gate, with offline Receipt verification"
 readme = "README.md"

bindable-0.1.2/tests/fixtures/KEY_PROVENANCE.md

@@ -0,0 +1,7 @@
+Key provenance: `bindable-test-rc4-2026-08.pem` is the public half of a keypair generated by the engine (0.1.0rc4) when the two receipts in this directory were minted through its own decide path, for the verdict-form cutover. The private half was never written anywhere and is not needed to verify.
+
+These fixtures replace the retired `*_rc3.json` pair, which were real Public-landscape production receipts signed by `bindable-public-2026-07` under the pre-cutover `verification_outcome` canonical form. That form no longer exists, so those receipts could not be carried forward: hand-editing them would invalidate their `chain_hash` and signature, and re-signing them with the production key is impossible here — its private half is Key-Vault-injected and never leaves the platform. `bindable-public-2026-07.pem` (recovered previously via ECDSA public-key recovery from those receipts) was retired with them.
+
+What the fixtures prove is unchanged: a receipt minted by the engine under the current signed canonical form verifies offline through this client's hand-maintained port, chain hash and signature both. Only the signing key's provenance changed — production-minted to engine-minted-with-a-test-key.
+
+Worth doing once the Public landscape runs rc4: re-mint this pair from real production output and restore end-to-end production provenance. Authoritative distribution of landscape verification keys will move to a read-only platform endpoint.

bindable-0.1.2/tests/fixtures/bindable-test-rc4-2026-08.pem

@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENYh+RQNDS48qBicGl9FfgStbcPNk
+2ElW2e4VUjnFHokPHj8eXL82eCzw+jwEGwEoDZmP9OdcUTkI8xsdPeWyzQ==
+-----END PUBLIC KEY-----

bindable-0.1.2/tests/fixtures/receipt_public_blocked_rc4.json

@@ -0,0 +1 @@
+{"receipt_id": "1d8ef197c63c4a4fbb4f9523d25f4e88", "proposal_digest": "01d3430e4b046b20fb7f2e0de22d3bab5febaae1832601020109c55b81d73b64", "proposal_payload": {"matter_id": "MER-2026-014", "call_cost_usd": 126, "records_requested": 400, "purpose": "full-market data sweep"}, "contract_id": "demo-diligence-spend-public-founding", "contract_version": "1.0.0", "sponsor_identity": "did:web:bindbl.ai:sponsor:b4047dfe7c4244dda32a3c8b4a02fc8e", "sponsor_identity_context": "ctx:public", "counterparty_identity": null, "persistent_agent_id": "did:web:bindbl.ai:agent:9dd08b5846564a1fbe674b1834fb887d", "action_type": "paid_data_call", "proposed_action_id": "pf-blocked-public-founding", "verdict": "failed", "failed_rule": "r-2", "reason_detail": "126 lte 58 not satisfied", "referenced_evidence": ["demo-budget-public-founding"], "verified_at": "2026-08-21T14:52:16.607Z", "nonce": "d61480f760d63f14d1350c21573d1a8b", "chain_hash": "485d281c0590813d2fd943114004280cbadf95c56bb9f2c8caba22f26c8ac1a2", "previous_hash": null, "signature": "3045022022f79c8897615256b53d3364db8f743eb524541a766329674e25b0ca1eba3d83022100b057d504c0cdb43474b091aa03f72a0bf18f8d11e24f05fab40baa2e497d40c1", "signing_key_id": "bindable-test-rc4-2026-08", "signed_at": "2026-08-21T14:52:16.607Z", "intervention_artifacts": null}

bindable-0.1.2/tests/fixtures/receipt_public_released_rc4.json

@@ -0,0 +1 @@
+{"receipt_id": "ac2c3b3e7a6c4d59b972fa297a9f4821", "proposal_digest": "f35eb78be1073174427cf7884bccecbf7a2c8b776ecb932939a2219fa5d17c16", "proposal_payload": {"matter_id": "MER-2026-014", "call_cost_usd": 12, "records_requested": 40, "purpose": "comparable-transactions pull"}, "contract_id": "demo-diligence-spend-public-founding", "contract_version": "1.0.0", "sponsor_identity": "did:web:bindbl.ai:sponsor:b4047dfe7c4244dda32a3c8b4a02fc8e", "sponsor_identity_context": "ctx:public", "counterparty_identity": null, "persistent_agent_id": "did:web:bindbl.ai:agent:9dd08b5846564a1fbe674b1834fb887d", "action_type": "paid_data_call", "proposed_action_id": "pf-released-public-founding", "verdict": "passed", "failed_rule": null, "reason_detail": null, "referenced_evidence": ["demo-budget-public-founding"], "verified_at": "2026-08-21T14:52:16.604Z", "nonce": "b38265567729c89b020e6afe8a420f70", "chain_hash": "d7449f9b6874f2774ab4902dbe18ae2093de6a4cd223ab53802d39aace2a38e4", "previous_hash": null, "signature": "3045022014974d1ae715e5f16fdc2307d82cff116414ca4ac176d5566e2f72d7385cf580022100e56c5a09184c0fe57c32e5a400c55ac59d18c35d34ffd1b95c8bf2e3f4e7c86d", "signing_key_id": "bindable-test-rc4-2026-08", "signed_at": "2026-08-21T14:52:16.607Z", "intervention_artifacts": null}

{bindable-0.1.1 → bindable-0.1.2}/tests/test_canonical_vectors.py

@@ -67,7 +67,7 @@ _FULL_RECEIPT: dict[str, Any] = {
     "referenced_evidence": ["audit-001", "audit-002"],
     "sponsor_identity": "sponsor-001",
     "sponsor_identity_context": "treasury",
-    "verification_outcome": "passed",
+    "verdict": "passed",
     "verified_at": "2026-05-19T14:00:00.000Z",
     # excluded fields that must NOT leak into the canonical input
     "receipt_id": "receipt-zzz",
@@ -93,7 +93,7 @@ _EXPECTED_KEYS = {
     "referenced_evidence",
     "sponsor_identity",
     "sponsor_identity_context",
-    "verification_outcome",
+    "verdict",
     "verified_at",
 }
 

{bindable-0.1.1 → bindable-0.1.2}/tests/test_client.py

@@ -21,7 +21,7 @@ _TOKEN = "test-token"
 
 _OUTCOME_RELEASED: dict[str, Any] = {
     "status": "released",
-    "verification_outcome": "passed",
+    "verdict": "passed",
     "reason": None,
     "reason_code": None,
     "receipt": None,
@@ -29,7 +29,7 @@ _OUTCOME_RELEASED: dict[str, Any] = {
 }
 
 _FIXTURE_RECEIPT: dict[str, Any] = json.loads(
-    (Path(__file__).parent / "fixtures" / "receipt_public_released_rc3.json").read_text(
+    (Path(__file__).parent / "fixtures" / "receipt_public_released_rc4.json").read_text(
         encoding="utf-8"
     )
 )
@@ -64,7 +64,7 @@ def test_decide_posts_five_field_body_with_bearer() -> None:
         )
 
     assert captured["method"] == "POST"
-    assert captured["url"] == "https://gate.example.com/v1/decide"
+    assert captured["url"] == "https://gate.example.com/v1/review"
     assert captured["auth"] == "Bearer test-token"
     assert captured["content_type"] == "application/json"
     # EXACTLY the 5 frozen wire fields, nothing more.
@@ -95,7 +95,7 @@ def test_base_url_trailing_slash_stripped() -> None:
             proposed_action_id="p",
         )
 
-    assert captured["url"] == "https://gate.example.com/v1/decide"
+    assert captured["url"] == "https://gate.example.com/v1/review"
 
 
 def test_nonce_auto_generated_when_omitted() -> None:

{bindable-0.1.1 → bindable-0.1.2}/tests/test_verify_receipt.py

@@ -1,13 +1,18 @@
 """verify_receipt — end-to-end gate against real engine-minted receipts.
 
-The fixtures (tests/fixtures/receipt_public_released_rc3.json and
-receipt_public_blocked_rc3.json) are REAL production receipts minted by the
-engine @ 0.1.0rc3 on the Public landscape, ECDSA-signed by key
-bindable-public-2026-07 (public half at tests/fixtures/
-bindable-public-2026-07.pem). The chain-hash gates below prove the
-de-pydantic thin-client builder reproduces the engine's chain_hash
-byte-for-byte on the proposal_* wire. If one fails, the builder diverged —
-STOP and report; never edit the fixtures.
+The fixtures (tests/fixtures/receipt_public_released_rc4.json and
+receipt_public_blocked_rc4.json) are REAL receipts minted and ECDSA-signed
+by the engine @ 0.1.0rc4 through its own decide path, under the verdict
+canonical form (public half at tests/fixtures/bindable-test-rc4-2026-08.pem).
+The chain-hash gates below prove the de-pydantic thin-client builder
+reproduces the engine's chain_hash byte-for-byte. If one fails, the hand
+port has drifted from the engine's signed form — that failure is the desync
+alarm: STOP and report; never edit the fixtures.
+
+They are minted with a test signing key rather than the production
+bindable-public-2026-07 key, whose private half lives in Key Vault. What
+they prove is unchanged: the ported canonical form and the engine's agree
+byte-for-byte.
 """
 
 from __future__ import annotations
@@ -25,12 +30,12 @@ from bindable.crypto import canonical_sha256
 
 _FIX = Path(__file__).parent / "fixtures"
 _RELEASED: dict[str, Any] = json.loads(
-    (_FIX / "receipt_public_released_rc3.json").read_text(encoding="utf-8")
+    (_FIX / "receipt_public_released_rc4.json").read_text(encoding="utf-8")
 )
 _BLOCKED: dict[str, Any] = json.loads(
-    (_FIX / "receipt_public_blocked_rc3.json").read_text(encoding="utf-8")
+    (_FIX / "receipt_public_blocked_rc4.json").read_text(encoding="utf-8")
 )
-_PUBLIC_KEY_PEM_BYTES = (_FIX / "bindable-public-2026-07.pem").read_bytes()
+_PUBLIC_KEY_PEM_BYTES = (_FIX / "bindable-test-rc4-2026-08.pem").read_bytes()
 _PUBLIC_KEY_PEM_STR = _PUBLIC_KEY_PEM_BYTES.decode("utf-8")
 
 # A valid P-256 key that did NOT sign these receipts (from the sign vectors).

{bindable-0.1.1 → bindable-0.1.2}/tests/test_version.py

@@ -2,4 +2,4 @@ import bindable
 
 
 def test_version() -> None:
-    assert bindable.__version__ == "0.1.1"
+    assert bindable.__version__ == "0.1.2"

bindable-0.1.1/bindable/_version.py

@@ -1 +0,0 @@
-__version__ = "0.1.1"

bindable-0.1.1/tests/fixtures/KEY_PROVENANCE.md

@@ -1 +0,0 @@
-Key provenance: bindable-public-2026-07.pem was recovered via ECDSA public-key recovery from the two production receipts in this directory and cross-validated against the hosted POST /v1/verify. Authoritative distribution of landscape verification keys will move to a read-only platform endpoint.

bindable-0.1.1/tests/fixtures/bindable-public-2026-07.pem

@@ -1,4 +0,0 @@
------BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgAiZnfLmwECLMvbzCsaKKn+zMZ3W
-sJHGfdbwH8M7fk2hkNVI+RffcCwZFu2wG3MejwmvW7+b9GC4EgOEkdlkXw==
------END PUBLIC KEY-----

bindable-0.1.1/tests/fixtures/receipt_public_blocked_rc3.json

@@ -1 +0,0 @@
-{"receipt_id": "f92558c09edc44e7a141ea5c1b5cc855", "proposal_digest": "6b317920863fdbebaeda9e824daf5aeb781d87b2307f209f1ae25188fce2fe62", "proposal_payload": {"matter_id": "MER-2026-014", "call_cost_usd": 126, "records_requested": 400, "purpose": "full-market data sweep"}, "contract_id": "demo-diligence-spend-public-founding", "contract_version": "1.0.0", "sponsor_identity": "did:web:bindbl.ai:sponsor:b4047dfe7c4244dda32a3c8b4a02fc8e", "sponsor_identity_context": "ctx:public", "counterparty_identity": null, "persistent_agent_id": "did:web:bindbl.ai:agent:9dd08b5846564a1fbe674b1834fb887d", "action_type": "paid_data_call", "proposed_action_id": "pf-blocked-public-founding", "verification_outcome": "failed", "failed_rule": "r-2", "reason_detail": "126 lte 58 not satisfied", "referenced_evidence": ["demo-budget-public-founding"], "verified_at": "2026-08-13T14:09:07.031Z", "nonce": "d61480f760d63f14d1350c21573d1a8b", "chain_hash": "63b052eef0f449d7330dfd897891385e48ef372d8c69e9ddd05eaa84247ea036", "previous_hash": null, "signature": "30460221009273d5a94dbca61570dff9f7729d7576e852c0a681a396998db5da1e27885ed4022100ada78e5200865db572d78663a07b871cfd6013f84550c34bb3242cad07c44e9e", "signing_key_id": "bindable-public-2026-07", "signed_at": "2026-08-13T14:09:07.031Z", "intervention_artifacts": null}

bindable-0.1.1/tests/fixtures/receipt_public_released_rc3.json

@@ -1 +0,0 @@
-{"receipt_id": "9b6e8bca643444e09dfe0ef4015244d1", "proposal_digest": "9fe07610a2f335a96454d710259145e5ed1ef546234e21c279f4d6cff79f570d", "proposal_payload": {"matter_id": "MER-2026-014", "call_cost_usd": 12, "records_requested": 40, "purpose": "comparable-transactions pull"}, "contract_id": "demo-diligence-spend-public-founding", "contract_version": "1.0.0", "sponsor_identity": "did:web:bindbl.ai:sponsor:b4047dfe7c4244dda32a3c8b4a02fc8e", "sponsor_identity_context": "ctx:public", "counterparty_identity": null, "persistent_agent_id": "did:web:bindbl.ai:agent:9dd08b5846564a1fbe674b1834fb887d", "action_type": "paid_data_call", "proposed_action_id": "pf-released-public-founding", "verification_outcome": "passed", "failed_rule": null, "reason_detail": null, "referenced_evidence": ["demo-budget-public-founding"], "verified_at": "2026-08-13T14:08:59.607Z", "nonce": "b38265567729c89b020e6afe8a420f70", "chain_hash": "61374b353d242e9ddc523b09b537506a16f84852a1352d4bbf03643e486fe99d", "previous_hash": null, "signature": "3045022100d4dc8ff4ce26b24d0725016b7243b41e96ed2bc9074f21ba40c618ca459e0b01022027065e8d3e342393d70a270d43886145b2373418f2dc6ef7fc12b7b66860a12b", "signing_key_id": "bindable-public-2026-07", "signed_at": "2026-08-13T14:08:59.621Z", "intervention_artifacts": null}