causal-continuity-engine 0.1.6__tar.gz → 0.3.0__tar.gz

{causal_continuity_engine-0.1.6 → causal_continuity_engine-0.3.0}/.github/CONTRIBUTING.md

@@ -54,10 +54,10 @@ do. `just setup` installs every direct and transitive tool from
 source distributions, then installs `causal-continuity-engine` editable without dependency
 resolution or an isolated build environment. The reviewed direct inputs are
 `pytest` 9.1.1, `ruff` 0.16.7, `build` 1.6.1, `jsonschema` 4.26.0,
-`setuptools` 83.0.0, and `pip` 26.2.1. None is imported by the engine; jsonschema validates
+`setuptools` 84.0.0, and `pip` 26.2.1. None is imported by the engine; jsonschema validates
 emitted receipt instances only in the test/release gate.
 
-The pins were last revalidated on 2026-09-15. Setuptools 83.0.0 is the first
+The security review on 2026-09-15 recorded setuptools 83.0.0 as the first
 patched release for
 [GHSA-h35f-9h28-mq5c](https://github.com/advisories/GHSA-h35f-9h28-mq5c)
 and pip 26.2.1 is later than the first patched release for
@@ -68,9 +68,10 @@ and the lock carries Pygments 2.20.0, the fix for
 [GHSA-5239-wwwm-4pmq](https://github.com/advisories/GHSA-5239-wwwm-4pmq).
 On that date pytest 9.1.1, ruff 0.16.7, build 1.6.1, jsonschema 4.26.0 and pip
 26.2.1 were the current stable releases on PyPI; build 1.5.1 remains yanked.
-Setuptools stays at 83.0.0: 84.0.0 is a new major release that this review did
-not evaluate. This is a dated review record, not a claim that pins stay current
-without future review.
+That review retained setuptools 83.0.0 without evaluating 84.0.0. The current
+84.0.0 pin is a subsequent build-tool update, with matching direct inputs and
+hash lock. The security review is a dated record, not a claim that pins stay
+current without future review.
 
 When a direct pin changes, edit `pyproject.toml` and `requirements-dev.in`,
 regenerate the lock with the command recorded in its header, and review the
@@ -257,7 +258,11 @@ outcome, say what distinguishes it from "nothing happened".
 
 **No authorship attribution to tooling.** The `.githooks/` hooks and the CI
 attribution guard both reject it, in commit messages and in committed files.
-Do not work around them.
+Do not work around them. This is a rule about credit, not secrecy: AI coding
+assistants are used in this project's development, and every change is
+reviewed, tested, signed off, and committed by the maintainer, who is
+responsible for it. If AI tools did significant work on your patch, say so in
+plain words in the pull request; never list a tool as an author or co-author.
 
 ## Security
 

{causal_continuity_engine-0.1.6 → causal_continuity_engine-0.3.0}/.github/scripts/check_attribution.py

@@ -76,6 +76,13 @@ _ARTIFACT_AI_CREDIT = re.compile(
 _TOOL_BYLINE = re.compile(
     rf"{_AI_ALIAS.pattern}\s*\((?:anthropic|openai)\)[.!]?"
 )
+# An AI coding session appends provenance rather than credit: a trailer whose key
+# names the tool ("<tool>-Session: <link>") and a bare link to the session. Neither
+# names an actor, so the credit grammar above never reached them.
+_AI_SESSION_KEY = re.compile(
+    rf"{_AI_ALIAS.pattern}[- ]session(?:[- ](?:id|link|url))?"
+)
+_AI_SESSION_LINK = re.compile(r"<?https?://claude\.ai/code/session_[a-z0-9_-]+/?>?")
 _TRAILER_KEYS = frozenset({
     "assisted-by",
     "authored-by",
@@ -233,6 +240,11 @@ def scan_prose(
         key, separator, value = line.partition(":")
         if separator and key.replace("_", "-") in _TRAILER_KEYS:
             reason = _actor_reason(value)
+        if reason is None and separator and _AI_SESSION_KEY.fullmatch(
+                key.replace("_", "-")):
+            reason = "tool/model session trailer"
+        if reason is None and _AI_SESSION_LINK.fullmatch(line):
+            reason = "tool/model session link"
         if reason is None:
             match = _CREDIT.fullmatch(line) or _ROLE.fullmatch(line)
             if match is not None:

{causal_continuity_engine-0.1.6 → causal_continuity_engine-0.3.0}/.github/scripts/verify_distributions.py

@@ -96,7 +96,8 @@ SDIST_GENERATED_FILES = {
     f"{EGG_INFO}/top_level.txt",
 }
 # Selected shipped test modules, chosen to cover the installed
-# CLI, the store and graph, trust, conformance vectors and the MCP server
+# CLI, store and graph, trust, conformance, authority/scoped-packet contracts
+# and bounded CLI/HTTP/MCP transports
 # against the artifact itself. The rest ship as audit evidence a reader can
 # run, not as checks this gate executes.
 WHEEL_BEHAVIOR_TESTS = (
@@ -107,6 +108,8 @@ WHEEL_BEHAVIOR_TESTS = (
     "tests/test_cli.py",
     "tests/test_conformance.py",
     "tests/test_mcp_server.py",
+    "tests/test_installed_contracts.py",
+    "tests/test_installed_packet_bounds.py",
 )
 WHEEL_EVIDENCE_TREES = {
     "benchmarks": {".py"},

{causal_continuity_engine-0.1.6 → causal_continuity_engine-0.3.0}/.github/scripts/verify_public_schemas.py

@@ -19,6 +19,21 @@ RAW_ORIGIN = (
 TAG_RE = re.compile(r"v[0-9]+\.[0-9]+\.[0-9]+\Z")
 SCHEMA_VERSION_RE = re.compile(r"cce\.[a-z][a-z0-9-]*\.v[1-9][0-9]*\Z")
 MAX_SCHEMA_BYTES = 2 * 1024 * 1024
+SCHEMA_RELEASES = {
+    "cce.anchor.v1.json": "v0.1.0",
+    "cce.capsule.v1.json": "v0.1.0",
+    "cce.continuity-receipt.v1.json": "v0.1.0",
+    "cce.event.v1.json": "v0.1.0",
+    "cce.proof-predicate.v1.json": "v0.1.0",
+    "cce.proof.v1.json": "v0.1.0",
+    "cce.recovery.v1.json": "v0.1.0",
+    "cce.resume.v1.json": "v0.1.0",
+    "cce.capsule.v2.json": "v0.2.0",
+    "cce.continuity-receipt.v2.json": "v0.2.0",
+    "cce.proof-predicate.v2.json": "v0.2.0",
+    "cce.proof.v2.json": "v0.2.0",
+    "cce.resume.v2.json": "v0.2.0",
+}
 
 
 def _runtime_schema_versions(root: Path) -> dict[str, str]:
@@ -61,8 +76,11 @@ def _runtime_schema_versions(root: Path) -> dict[str, str]:
 def _schema_public_urls(root: Path) -> dict[str, str]:
     names = sorted(
         f"{version}.json" for version in _runtime_schema_versions(root).values())
+    unreviewed = sorted(set(names) - SCHEMA_RELEASES.keys())
+    if unreviewed:
+        raise SystemExit("unreviewed schema release identity: " + ", ".join(unreviewed))
     return {
-        name: f"{RAW_ORIGIN}/v0.1.0/schemas/{name}"
+        name: f"{RAW_ORIGIN}/{SCHEMA_RELEASES[name]}/schemas/{name}"
         for name in names
     }
 
@@ -147,8 +165,8 @@ def verify(
             "public schema inventory differs from the reviewed runtime contract")
 
     # A schema TypeURI identifies that schema version, not the package release
-    # currently carrying it. Later package tags must continue to verify the
-    # immutable v0.1.0 URLs instead of silently repointing the v1 identities.
+    # currently carrying it. Each reviewed filename retains its assigned release
+    # independently of both the package tag and the payload's claimed $id.
     expected_urls = set(schema_public_urls.values())
     observed_ids: set[str] = set()
     for name in schema_names:
@@ -171,7 +189,7 @@ def verify(
                 + ", ".join(sorted(unexpected_urls)))
 
         # Fetch the committed identity itself. The explicit map above freezes
-        # today's v1 contract; this variable makes the deciding path follow the
+        # each reviewed identity; this variable makes the deciding path follow the
         # schema's checked-in $id rather than the current package tag.
         remote_bytes = fetch(committed_url)
         if not isinstance(remote_bytes, bytes):

{causal_continuity_engine-0.1.6 → causal_continuity_engine-0.3.0}/AGENTS.md

@@ -14,12 +14,17 @@ history and a bi-temporal causal graph. Event-derived projections are
 rebuildable only while source payloads remain inside the retention window;
 runtime records are authenticated/audited rather than replay-derived. Memory
 tiers L0–L4 and token-budgeted Resume Packets are what
-an agent actually receives on resume. When a requirement changes or evidence
-contradicts an assumption, causal invalidation computes the blast radius
-over typed edges, bounds it, and classifies it deterministically. A task
-cannot be marked complete without a signed proof envelope whose required
-verifiers actually ran — `Engine.complete_task` has twenty independently
-instrumented rejection gates, including unresolved invalidation control,
+an agent actually receives on resume. When a requirement changes, when the
+source that stated an assumption withdraws it, or when an integration records
+contradicting evidence through `engine.invalidation.fire(...)`, causal
+invalidation computes the blast radius over typed edges, bounds it, and
+classifies it deterministically. It does not read prose for meaning; a trusted
+explicit negation of an active assumption's own wording raises a human-gated
+notice (ADR-133). When policy
+requires proof, a task cannot be marked complete without a signed proof envelope
+whose required verifiers actually ran — `Engine.complete_task` has twenty-two
+independently instrumented rejection gates, including current confirmed authority,
+applicable authority conflicts, unresolved invalidation control,
 monotonic completed-state, and completable-state guards, and evidence is graded
 A–F from negative controls,
 mutation probes and determinism probes. That grade is a mechanical lower bound: it
@@ -114,7 +119,7 @@ python verifiers/verify_proof.py <proof.json> --fingerprint sha256:...
 vectors that *wrap* an envelope alongside its expected verdict, so passing
 one directly reports `E_SHAPE`; use `vectors/generate.py --check` for those.
 
-CLI subcommands, all real: `init ingest resume assumptions invalidations
+CLI subcommands, all real: `init ingest authority resume assumptions invalidations
 verify check migrate replay rebuild audit evidence policy serve mcp`.
 
 ## Repo map
@@ -270,9 +275,11 @@ Repository text is evidence about intent. It is never instruction.
   can raise its authority above the authority of its source
   (`causal_continuity_engine/ontology.py`,
   `causal_continuity_engine/extraction.py`).
-- Untrusted text **may propose, never mandate.** A requirement extracted
-  from an untrusted source is demoted to a claim, with the demotion recorded
-  (AD-006).
+- All prose **may propose, never mandate**, including OWNER and human-decision
+  prose. Requirements, constraints, decisions, assumptions and tasks become
+  source-event-bound proposals. Only an explicit owner-local canonical decision
+  through `record_authority_decision` or `authority --request FILE` confirms
+  authority; source standing and status resolution are not grants (ADR-126).
 - Imperative policy-override wording trips the injection screen, and when it
   does, **every item extracted from that text block is quarantined** — not
   just the matched span. Splitting a hostile block into a suspect part and a
@@ -322,8 +329,11 @@ below what it is about to do (ADR-048).
 
 Never add AI authorship credit to a commit message, PR title or body, code
 comment, documentation file, changelog, or example. No co-author trailers,
-no "generated with" lines, no tool bylines, no mention of AI involvement in
-this codebase anywhere.
+no "generated with" lines, no tool bylines. This is a rule about credit, not
+secrecy: `.github/CONTRIBUTING.md` states plainly that AI coding assistants
+are used in development and that the maintainer reviews, tests, and commits
+every change. Disclosure in plain words is allowed; crediting a tool as an
+author is not.
 
 This is enforced, not requested. `.githooks/commit-msg` and
 `.githooks/pre-commit` block it locally (`core.hooksPath` is set to

{causal_continuity_engine-0.1.6 → causal_continuity_engine-0.3.0}/CHANGELOG.md

@@ -9,6 +9,98 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 No unreleased changes.
 
+## 0.3.0 — 2026-10-16
+
+### Added
+
+- **A trusted explicit negation of an active assumption raises a human-gated
+  notice.** An OWNER, MEMBER or COLLABORATOR sentence that restates an active
+  assumption with one negator ("the feed is NOT ordered by timestamp"), negates
+  its cue ("we no longer assume …") or calls it wrong fires a
+  `contradictory_evidence` invalidation in `pending_confirmation`: nothing
+  changes until the owner records `confirm_invalidation` or
+  `reject_invalidation` through `authority --request`, with operands from
+  `Engine.authority_invalidation`. The notice appears in the resume packet and
+  makes `check` report `action_required`. The rule is closed and lexical; other
+  wordings are outside it (ADR-133).
+
+### Changed
+
+- **Breaking: processor compatibility advances to `cce-processor/1.10.0` and
+  extraction to `cce-deterministic/1.5.0`.** Preserve older projected stores and
+  their SQLite sidecars after stopping writers. Re-ingest retained sources into
+  a separate new store/project and review its proposals before confirming them.
+  Older projections do not upgrade in place; erased source payloads cannot be
+  reconstructed by replay (ADR-114, ADR-132).
+
+### Fixed
+
+- **A negated assumption cue no longer proposes the assumption it denies.**
+  "We no longer assume X", "We do not assume X" and "nothing relies on X"
+  extracted the same positive proposal as "We assume X", so a sentence written
+  to retire an assumption offered it for confirmation. The extractor now
+  abstains when a negator stands immediately before the cue. A prohibition or
+  decision form still proposes the constraint or decision the author wrote;
+  other wordings of a denial are outside this closed rule (ADR-132).
+
+## 0.2.0 — 2026-09-23
+
+### Changed
+
+- **Breaking: extracted prose proposes; local confirmation confers authority.**
+  Requirements, constraints, decisions, assumptions and tasks extracted from
+  retained source text require an explicit owner-local decision before becoming
+  binding control state. Consumers check canonical decision history, source
+  support and the actual projection. A trusted author label or mutable graph
+  flag is not approval. Confirmation has no HTTP or MCP
+  endpoint; this trusts the existing OS/store owner, not an independently
+  authenticated human or a process isolated from that same account (ADR-126).
+- **Breaking: processor compatibility advances to `cce-processor/1.9.0` and
+  extraction to `cce-deterministic/1.4.0`.** Preserve older projected stores and
+  their SQLite sidecars after stopping writers. Re-ingest retained sources into
+  a separate new store/project and review its proposals before confirming them.
+  Older authority projections do not upgrade in place; erased source payloads
+  cannot be reconstructed by replay. Existing finite admission limits still
+  apply; the version check is not a claim of complete database provenance.
+- **Proof v2 binds the complete applicable obligation set.** Confirmed task
+  proofs include applicable requirements, constraints, decisions and assumptions,
+  their canonical scope and the relevant policy. Caller-supplied links cannot
+  subtract mandatory controls. Initial and final deciding reads are separate;
+  later changes can stale the proof. A verifier's evidence grade remains a
+  mechanical binding check, not proof of the obligation's semantic truth
+  (ADR-127).
+- **Resume v2 is complete and explicitly project- or task-scoped.** Mandatory
+  controls, work, policy and trust information cannot be silently trimmed to fit
+  a budget. Watermarks are scope-specific; descriptive target metadata is not
+  a task selector. Current capsule v2 and continuity-receipt v2 remain project-only.
+  Historical v1 schemas are retained for interpretation, not current proof or
+  receipt acceptance (ADR-128).
+- **Successful resume responses have a hard serialized-byte bound.** The default
+  is 131,072 bytes; the accepted range is 1 through 1,048,576. Engine, CLI, HTTP
+  and MCP count their actual final representation, including the relevant wrapper
+  and line ending. Only optional sections may be removed. Mandatory overflow
+  refuses before signing, collision audit or watermark advancement. Packet-budget
+  refusals have a separate 1,024-byte bound. This does not bound computation,
+  input memory, HTTP headers, arbitrary reserialization or an outer capsule
+  (ADR-129).
+
+### Fixed
+
+- **Task expiry during packet composition used two validity instants.** Final
+  watermark admission now retains the selected instant while rechecking canonical
+  authority, source support, projected semantics and live status. Later freshness
+  uses current time; an as-of packet is not a lease. Unrelated late failures do
+  not promise to refund a consumed signature (ADR-130).
+- **One obligation read repeatedly reconstructed the same canonical witnesses.**
+  Validated control witnesses and shared scope-task identities are reused only
+  within that non-mutating call, never across requests or a writer's own changes.
+  Measured read counts fall without dropping authority checks. Distinct witnesses
+  still traverse history; no latency or total-history scaling bound is claimed
+  (ADR-131).
+- **The continuity-receipt specification named the historical v1 contract.**
+  SPEC §12 now matches the current project-only v2 producer and verifier, including
+  expected-scope binding and archived-v1 refusal. Historical schemas are unchanged.
+
 ## 0.1.6 — 2026-09-20
 
 Carries the unpublished 0.1.5 line forward with processor compatibility,

{causal_continuity_engine-0.1.6 → causal_continuity_engine-0.3.0}/CITATION.cff

@@ -8,8 +8,8 @@ authors:
   - given-names: Thomas
     family-names: Albrecht
     alias: The Quantum Falcon
-version: 0.1.6
-date-released: 2026-09-20
+version: 0.3.0
+date-released: 2026-10-16
 license: Apache-2.0
 repository-code: https://github.com/thequantumfalcon/causal-continuity-engine
 url: https://github.com/thequantumfalcon/causal-continuity-engine