causal-continuity-engine 0.1.3__tar.gz → 0.2.0__tar.gz

causal_continuity_engine-0.2.0/.githooks/commit-msg

@@ -0,0 +1,31 @@
+#!/bin/sh
+if command -v python3 >/dev/null 2>&1 &&
+    python3 -c 'import sys; raise SystemExit(sys.version_info < (3, 11))' \
+        >/dev/null 2>&1; then
+    python_command=python3
+elif command -v python >/dev/null 2>&1 &&
+    python -c 'import sys; raise SystemExit(sys.version_info < (3, 11))' \
+        >/dev/null 2>&1; then
+    python_command=python
+else
+    echo "ERROR: Python 3.11 or newer is required for repository policy checks." >&2
+    exit 1
+fi
+identity_input="$(mktemp)" || exit 1
+trap 'rm -f "$identity_input"' EXIT HUP INT TERM
+cat "$1" > "$identity_input" || exit 1
+git var GIT_AUTHOR_IDENT >> "$identity_input" || exit 1
+git var GIT_COMMITTER_IDENT >> "$identity_input" || exit 1
+"$python_command" .github/scripts/check_content_marks.py \
+    --stdin '<commit-message-and-identities>' < "$identity_input"
+content_status=$?
+if [ "$content_status" -ne 0 ]; then
+    echo "ERROR: commit metadata content-integrity scan did not pass." >&2
+    exit "$content_status"
+fi
+"$python_command" -I .github/scripts/check_attribution.py --message-file "$1"
+attribution_status=$?
+if [ "$attribution_status" -ne 0 ]; then
+    echo "ERROR: commit attribution scan did not pass." >&2
+    exit "$attribution_status"
+fi

{causal_continuity_engine-0.1.3 → causal_continuity_engine-0.2.0}/.githooks/pre-commit

@@ -1,6 +1,7 @@
 #!/bin/sh
-# Repository pre-commit gate. Attribution is blocking; gitleaks is blocking
-# when installed and emits an explicit warning when unavailable.
+# Repository pre-commit gate. Content integrity and attribution are blocking;
+# gitleaks is blocking when installed and emits an explicit warning when
+# unavailable.
 #
 # WHY BOTH LIVE HERE: git honours exactly one hook path. This repository sets
 # `core.hooksPath = .githooks`, and the pre-commit framework refuses to install
@@ -15,35 +16,47 @@
 # independently (.github/workflows/no-ai-attribution.yml), so a contributor who
 # runs neither hook path is still caught before merge.
 
+if command -v python3 >/dev/null 2>&1 &&
+    python3 -c 'import sys; raise SystemExit(sys.version_info < (3, 11))' \
+        >/dev/null 2>&1; then
+    python_command=python3
+elif command -v python >/dev/null 2>&1 &&
+    python -c 'import sys; raise SystemExit(sys.version_info < (3, 11))' \
+        >/dev/null 2>&1; then
+    python_command=python
+else
+    echo "ERROR: Python 3.11 or newer is required for repository policy checks." >&2
+    exit 1
+fi
+
+# ---------------------------------------------------------- content integrity
+# Scan the complete proposed index, including unchanged staged blobs. A diff or
+# working-tree scan can miss a marked blob that is already staged, and an
+# incomplete scan is not clean.
+"$python_command" .github/scripts/check_content_marks.py --index
+content_status=$?
+if [ "$content_status" -ne 0 ]; then
+    echo "ERROR: staged content-integrity scan did not pass." >&2
+    exit "$content_status"
+fi
+
 # ---------------------------------------------------------------- attribution
-# The three enforcement files necessarily contain the expression they search
-# for, so only those exact files are excluded. No directory is exempt.
-PATTERN='co-authored-by:.*(anthropic|chatgpt|claude|codex|copilot|gemini|openai)|noreply@(anthropic|openai)\.com|generated (with|by)[[:space:]]+\[?(chatgpt|claude|codex|copilot|gemini|openai)'
-# Search the proposed index tree rather than raw diff text. Deleted lines must
-# not prevent the commit that removes a violation.
-git_grep_status=0
-git grep --cached -nEi "$PATTERN" -- . \
-  ':(exclude).githooks/pre-commit' \
-  ':(exclude).githooks/commit-msg' \
-  ':(exclude).github/workflows/no-ai-attribution.yml' \
-  || git_grep_status=$?
-case "$git_grep_status" in
-    0)
-        echo "ERROR: AI attribution found in staged changes. Remove it before committing." >&2
-        exit 1
-        ;;
-    1) ;;
-    *)
-        echo "ERROR: git grep failed; attribution status is unknown." >&2
-        exit "$git_grep_status"
-        ;;
-esac
+# The policy scanner reads the complete proposed index as exact Git blobs. Its
+# lexical grammar keeps sentence-form product discussion and Markdown vendor
+# headings/lists legal; no path is exempt from the scan.
+"$python_command" -I .github/scripts/check_attribution.py --index
+attribution_status=$?
+if [ "$attribution_status" -ne 0 ]; then
+    echo "ERROR: staged attribution scan did not pass." >&2
+    exit "$attribution_status"
+fi
 
 # --------------------------------------------------------------------- secrets
 # Load-bearing, not decoration. GitHub secret scanning and push protection are
-# unavailable here (private repository, personal Pro plan). When gitleaks is
-# installed and this hook is not bypassed, it is the only local scan before a
-# pasted credential reaches the remote; the server workflow runs after push.
+# enabled on this public repository and catch a pushed credential server side.
+# When gitleaks is installed and this hook is not bypassed, it is the only
+# scan that runs before a pasted credential reaches the remote at all; the
+# server workflow runs after push.
 # .gitleaks.toml allowlists the synthetic token the redaction tests need by
 # VALUE rather than by path, so a real secret in the same file is still caught.
 if command -v gitleaks >/dev/null 2>&1; then

{causal_continuity_engine-0.1.3 → causal_continuity_engine-0.2.0}/.github/CONTRIBUTING.md

@@ -53,21 +53,25 @@ do. `just setup` installs every direct and transitive tool from
 `requirements-dev.lock` in pip's all-or-nothing hash-checking mode, refuses
 source distributions, then installs `causal-continuity-engine` editable without dependency
 resolution or an isolated build environment. The reviewed direct inputs are
-`pytest` 9.1.1, `ruff` 0.16.1, `build` 1.5.0, `jsonschema` 4.26.0,
-`setuptools` 83.0.0, and `pip` 26.1.2. None is imported by the engine; jsonschema validates
+`pytest` 9.1.1, `ruff` 0.16.7, `build` 1.6.1, `jsonschema` 4.26.0,
+`setuptools` 84.0.0, and `pip` 26.2.1. None is imported by the engine; jsonschema validates
 emitted receipt instances only in the test/release gate.
 
-The pins were revalidated on 2026-08-04. Setuptools 83.0.0 and pip 26.1.2
-are the first patched releases for
+The security review on 2026-09-15 recorded setuptools 83.0.0 as the first
+patched release for
 [GHSA-h35f-9h28-mq5c](https://github.com/advisories/GHSA-h35f-9h28-mq5c)
-and [GHSA-wf93-45jw-7689](https://github.com/advisories/GHSA-wf93-45jw-7689);
+and pip 26.2.1 is later than the first patched release for
+[GHSA-wf93-45jw-7689](https://github.com/advisories/GHSA-wf93-45jw-7689);
 pytest 9.1.1 is newer than the 9.0.3 fix for
 [GHSA-6w46-j5rx-g56g](https://github.com/advisories/GHSA-6w46-j5rx-g56g),
 and the lock carries Pygments 2.20.0, the fix for
 [GHSA-5239-wwwm-4pmq](https://github.com/advisories/GHSA-5239-wwwm-4pmq).
-Build remains at 1.5.0 because PyPI marks 1.5.1 yanked; jsonschema 4.26.0 and
-ruff 0.16.1 were the current stable releases on that date. This is a dated
-review record, not a claim that pins stay current without future review.
+On that date pytest 9.1.1, ruff 0.16.7, build 1.6.1, jsonschema 4.26.0 and pip
+26.2.1 were the current stable releases on PyPI; build 1.5.1 remains yanked.
+That review retained setuptools 83.0.0 without evaluating 84.0.0. The current
+84.0.0 pin is a subsequent build-tool update, with matching direct inputs and
+hash lock. The security review is a dated record, not a claim that pins stay
+current without future review.
 
 When a direct pin changes, edit `pyproject.toml` and `requirements-dev.in`,
 regenerate the lock with the command recorded in its header, and review the
@@ -104,9 +108,10 @@ the same file is still caught.
 `.pre-commit-config.yaml` remains supported for contributors who prefer the
 framework, with one constraint: git honours exactly one hook path, and
 pre-commit refuses to install while `core.hooksPath` is set. Unset it first
-(`git config --unset core.hooksPath`). That path covers gitleaks, `ruff check` (the same
-lint gate as `just lint` and CI) and file hygiene, but not the attribution
-scan. It deliberately carries no `ruff-format` hook — see the `fmt-check` note
+(`git config --unset core.hooksPath`). That path covers the complete staged
+content-integrity scan, gitleaks, `ruff check` (the same lint gate as `just
+lint` and CI), and file hygiene, but not the attribution scan. It deliberately
+carries no `ruff-format` hook — see the `fmt-check` note
 in the `justfile`. CI enforces the attribution rule independently either way
 (`.github/workflows/no-ai-attribution.yml`), so nothing that reaches a pull
 request depends on which hook path you chose.
@@ -130,12 +135,13 @@ wheel. The `ci` job fans all those paths into one context.
 | Recipe | Direct equivalent | What it establishes |
 |---|---|---|
 | `just setup` | `python -m pip install --force-reinstall --require-hashes --only-binary=:all: -r requirements-dev.lock`, then `python -m pip check`, then `python -m pip install --no-deps --no-build-isolation -e .` | Nothing on its own. It installs the reviewed, hash-locked tool closure, checks dependency consistency, and installs the local package without undeclared resolution. |
+| `just content-integrity` | `python .github/scripts/check_content_marks.py --index` | Every staged Git blob was inspected completely and contains no recognized carrier or repository-disallowed hidden control. It does not detect an unpublished statistical text mark. |
 | `just lint` | `python -m ruff check .` | Ruff passes under the rule set pinned in `pyproject.toml` `[tool.ruff.lint]` — `E`, `F`, `W`, `I`, line length 100. That set, and nothing wider: it is not passed on the command line, so widening the gate means editing `pyproject.toml`. |
 | `just deps` | `python .github/scripts/check_stdlib.py` | `causal_continuity_engine/` imports nothing outside the standard library. It parses the AST instead of importing, so a lazy, guarded, or function-local import is caught too. This is the gate behind the zero-runtime-dependency claim. |
 | `just test` | `python -m pytest tests/ -q` | The complete regression suite and planted instrument-validation cases pass. |
 | `just corpus` | `python vectors/generate.py --check` | The reference implementation still reaches every committed verdict. Cross-implementation agreement is established by `just test`, not here. |
 | `just caps` | `python -m causal_continuity_engine.capabilities --write` then `git diff --exit-code -- docs/CAPABILITIES.md` | Every capability claim resolves to real symbols, files, and tests, and the committed `docs/CAPABILITIES.md` is identical to what the audit generates. |
-| `just bench` | `python -m benchmarks.continuitybench.run` | All ten ContinuityBench scenarios still pass and all six metrics are still at their gates. |
+| `just bench` | `python -m benchmarks.continuitybench.run` | All eleven ContinuityBench scenarios still pass and all six metrics are still at their gates. |
 | `just build` | the scripts under `.github/scripts/` | Each pass first binds physical source bytes without Git filters to the exact `HEAD`/index blobs, stages only those bytes in an empty disposable source directory, validates a canonical closed-manifest sdist before materializing it, and builds the wheel only from that exact normalized payload; two passes are byte-identical under the locked backend, backend execution leaves source unchanged, the checksum manifest is exact, shipped bytes equal the source tree, the audit surface is present, and an isolated installed wheel passes dependency-free import/CLI probes before exact locked tools run capability and behavioral checks. |
 
 Attribution is not one of these, and it is not a lint rule. It is enforced by

{causal_continuity_engine-0.1.3 → causal_continuity_engine-0.2.0}/.github/pull_request_template.md

@@ -12,11 +12,11 @@
 - [ ] `just test` passes.
 - [ ] `just lint` passes.
 - [ ] `just deps` passes — `causal_continuity_engine/` still imports nothing outside the standard library.
-- [ ] `just bench` passes — all ten ContinuityBench scenarios, every metric at target.
+- [ ] `just bench` passes — all eleven ContinuityBench scenarios, every metric at target.
 - [ ] `just corpus` passes — the reference still agrees with the committed vectors in `vectors/`.
 - [ ] `just caps` passes — every capability claim still resolves to real symbols, files, and tests. If the claims changed, `docs/CAPABILITIES.md` was regenerated with `python -m causal_continuity_engine.capabilities --write` rather than hand-edited.
 - [ ] `just build` passes if packaging, generated assets, or release machinery changed — both builds match and the clean-installed wheel audits successfully.
-- [ ] Every commit carries a `Signed-off-by` trailer (`git commit -s`). Asked for, not enforced — nothing blocks a PR without it today.
+- [ ] Every commit carries a `Signed-off-by` trailer (`git commit -s`). Enforced: the `DCO` check is a required status on `main`, so a pull request with any commit missing the trailer cannot merge.
 - [ ] No gate was weakened, skipped, or made conditional in order to get a test to pass. If a gate had to change, that change is the subject of this PR and is argued for above.
 - [ ] No AI attribution anywhere in the diff, commit messages, or PR title or body.
 

{causal_continuity_engine-0.1.3 → causal_continuity_engine-0.2.0}/.github/scripts/bootstrap_tools.py

@@ -17,7 +17,11 @@ ENSUREPIP_TIMEOUT_SECONDS = 300
 TOOL_INSTALL_TIMEOUT_SECONDS = 600
 TOOL_CHECK_TIMEOUT_SECONDS = 120
 LOCAL_INSTALL_TIMEOUT_SECONDS = 300
-GATE_RUNNER_TIMEOUT_SECONDS = 1500
+# The slowest child (pytest) has a 30-minute ceiling. Reserve another 15
+# minutes for the gates around it, output collection and descendant cleanup.
+# Hosted jobs that run this complete sequence reserve a further 20 minutes for
+# checkout, interpreter setup, this isolated bootstrap and final reporting.
+GATE_RUNNER_TIMEOUT_SECONDS = 45 * 60
 
 _CLOSURE_PROBE = r"""
 import importlib.metadata
@@ -183,7 +187,8 @@ def _run_checked(
         print(result.stderr, end="", file=sys.stderr)
 
 
-def _install_toolchain(python: Path, environment: dict[str, str]) -> None:
+def _install_toolchain(
+        python: Path, environment: dict[str, str], *, install_project: bool = True) -> None:
     _run_checked(
         [
             str(python),
@@ -212,21 +217,22 @@ def _install_toolchain(python: Path, environment: dict[str, str]) -> None:
         label="exact tool-closure verification",
         timeout_seconds=TOOL_CHECK_TIMEOUT_SECONDS,
     )
-    _run_checked(
-        [
-            str(python),
-            "-m",
-            "pip",
-            "install",
-            "--no-deps",
-            "--no-build-isolation",
-            "-e",
-            str(ROOT),
-        ],
-        environment=environment,
-        label="local package installation",
-        timeout_seconds=LOCAL_INSTALL_TIMEOUT_SECONDS,
-    )
+    if install_project:
+        _run_checked(
+            [
+                str(python),
+                "-m",
+                "pip",
+                "install",
+                "--no-deps",
+                "--no-build-isolation",
+                "-e",
+                str(ROOT),
+            ],
+            environment=environment,
+            label="local package installation",
+            timeout_seconds=LOCAL_INSTALL_TIMEOUT_SECONDS,
+        )
 
 
 def _bootstrap_pip(python: Path, environment: dict[str, str]) -> None:
@@ -243,8 +249,20 @@ def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser()
     mode = parser.add_mutually_exclusive_group()
     mode.add_argument("--release", action="store_true")
-    mode.add_argument("--artifacts-only", action="store_true")
+    mode.add_argument("--release-build", action="store_true")
+    mode.add_argument("--artifacts-structural", action="store_true")
+    mode.add_argument("--structure-only", action="store_true")
+    mode.add_argument("--behavior-only", action="store_true")
+    parser.add_argument("--portable-semantic", action="store_true")
+    parser.add_argument("--source-epoch", type=int)
+    parser.add_argument("--dist", type=Path)
     args = parser.parse_args(argv)
+    if args.dist is not None and not (args.structure_only or args.behavior_only):
+        parser.error("--dist requires --structure-only or --behavior-only")
+    if args.portable_semantic != (args.source_epoch is not None):
+        parser.error("--portable-semantic and --source-epoch must be supplied together")
+    if args.portable_semantic and not args.structure_only:
+        parser.error("portable structural options require --structure-only")
 
     with tempfile.TemporaryDirectory(prefix="cce-tools-") as temp:
         environment_root = Path(temp) / "venv"
@@ -253,12 +271,30 @@ def main(argv: list[str] | None = None) -> int:
         environment = _clean_environment(
             Path(temp) / "process-environment", python.parent)
         _bootstrap_pip(python, environment)
-        _install_toolchain(python, environment)
+        _install_toolchain(
+            python, environment,
+            install_project=not (args.structure_only or args.behavior_only))
         command = [str(python), str(ROOT / ".github/scripts/run_gates.py")]
         if args.release:
             command.append("--release")
-        elif args.artifacts_only:
-            command.append("--artifacts-only")
+        elif args.release_build:
+            command.append("--release-build")
+        elif args.artifacts_structural:
+            command.append("--artifacts-structural")
+        elif args.structure_only:
+            command.append("--structure-only")
+            if args.portable_semantic:
+                command.extend([
+                    "--portable-semantic",
+                    "--source-epoch",
+                    str(args.source_epoch),
+                ])
+            if args.dist is not None:
+                command.extend(["--dist", str(args.dist)])
+        elif args.behavior_only:
+            command.append("--behavior-only")
+            if args.dist is not None:
+                command.extend(["--dist", str(args.dist)])
         _run_checked(
             command,
             environment=environment,