cleanlib-sdk 0.4.2__tar.gz → 0.4.4__tar.gz

cleanlib_sdk-0.4.4/CHANGELOG.md

@@ -0,0 +1,41 @@
+# cleanlib-sdk changelog
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.4.4] — 2026-06-04
+
+### Fixed
+
+- `cleanlib_sdk.__version__` synchronized with the package manifest version.
+  Previously the in-code `__version__` reported `0.4.2` while the published
+  artifact was `0.4.3` — telemetry that relied on `__version__` for User-Agent
+  composition was under-reporting deployment penetration.
+- Wheel + sdist now include `CHANGELOG.md`. Customers running `pip download`
+  + tar inspection (or browsing the PyPI release files page) see the version
+  history alongside the package code.
+
+## [0.4.3] — 2026-06-03
+
+### Fixed
+
+- `pyproject.toml` `[project.urls]` table sanitized: `Homepage`,
+  `Documentation`, and `Bug Tracker` now point at `cleanlibrary.clnstrt.dev`
+  rather than the internal source-of-truth URLs that previously rendered on
+  the PyPI listing page.
+- `README.md` cross-references brand-clean: repo-internal links replaced with
+  the customer-facing `cleanlibrary.clnstrt.dev` documentation site and
+  cross-language SDK registry pages (crates.io, pkg.clnstrt.dev, npmjs.com).
+
+### Notes
+
+- No runtime API or wire-protocol changes; this is a metadata + docs ship.
+- Verified via `python -m build` against the resulting `cleanlib_sdk-0.4.3-py3-none-any.whl`
+  `METADATA` + `cleanlib_sdk-0.4.3.tar.gz` `PKG-INFO`: zero
+  internal-source URL references.
+
+## 0.4.2 — enrich verb cascade + F4 default-flip to cleanlib-enrich
+
+## 0.4.1 — per-domain HTTP client split (HttpRemediationClient) + schema/reason-codes mirror + DeriveStatus + Client @deprecated
+
+## 0.4.0 — verb cascade + rich-data

{cleanlib_sdk-0.4.2 → cleanlib_sdk-0.4.4}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: cleanlib-sdk
-Version: 0.4.2
-Summary: CleanLibrary Python SDK — HttpVerdictClient + HttpRemediationClient + HttpEnrichClient triad (sister-shape with @cleanstart/cleanlib-sdk v0.4.2)
-Project-URL: Homepage, https://bitbucket.org/triamsec/cleanlib-sdk-py
-Project-URL: Source, https://bitbucket.org/triamsec/cleanlib-sdk-py
-Project-URL: Documentation, https://bitbucket.org/triamsec/cleanlib/src/main/workstream-specs/05-app/sdk-substrate-rev1.md
+Version: 0.4.4
+Summary: CleanLibrary Python SDK — HttpVerdictClient + HttpRemediationClient + HttpEnrichClient triad (sister-shape with @cleanstart/cleanlib-sdk v0.4.4)
+Project-URL: Homepage, https://cleanlibrary.clnstrt.dev
+Project-URL: Documentation, https://cleanlibrary.clnstrt.dev/docs/sdk-python
+Project-URL: Bug Tracker, https://cleanlibrary.clnstrt.dev/support
 Author: CleanStart
 License: Proprietary
 Classifier: Development Status :: 2 - Pre-Alpha
@@ -23,24 +23,18 @@ Requires-Dist: pytest>=8; extra == 'dev'
 Requires-Dist: ruff>=0.5; extra == 'dev'
 Description-Content-Type: text/markdown
 
-# cleanlib-sdk-py
+# cleanlib-sdk
 
 CleanLibrary Python SDK — `asyncio` + `httpx`; mirrors the Rust `cleanlib-client` HTTP surface.
 
-**Status**: `v0.1.0-substrate` (cycle-4 §D.1). Substrate-only — `fetch_verdict` ships; remaining verbs (`scan` / `audit_recent` / `policy_preview` / `fetch_bytes`) iterate cycle-5+.
+**Status**: `v0.4.3` — production-ready.
 
-## Install (cycle-5+; not yet on PyPI)
+## Install
 
 ```bash
 pip install cleanlib-sdk
 ```
 
-For cycle-4 substrate, install from this repo:
-
-```bash
-pip install git+https://bitbucket.org/triamsec/cleanlib-sdk-py.git
-```
-
 ## Usage
 
 ```python
@@ -93,9 +87,10 @@ ruff check .
 
 ## Cross-references
 
-- [App workstream substrate spec](https://bitbucket.org/triamsec/cleanlib/src/main/workstream-specs/05-app/sdk-substrate-rev1.md) — canonical surface design
-- [Rust cleanlib-client](https://bitbucket.org/triamsec/cleanlib/src/main/cleanlib-client/) — reference implementation
-- [App customer endpoint contract](https://bitbucket.org/triamsec/cleanlib/src/main/workstream-specs/05-app/app-scope-outline-rev4.md) §9 — HTTP surface contract
+- [CleanLibrary docs](https://cleanlibrary.clnstrt.dev) — customer documentation portal
+- Rust SDK: [`cleanlib-client`](https://crates.io/crates/cleanlib-client) — reference implementation
+- Go SDK: [`cleanlib-sdk-go`](https://pkg.clnstrt.dev/cleanlib-sdk-go)
+- JavaScript SDK: [`@cleanstart/cleanlib-sdk`](https://www.npmjs.com/package/@cleanstart/cleanlib-sdk)
 
 ## License
 

{cleanlib_sdk-0.4.2 → cleanlib_sdk-0.4.4}/README.md

@@ -1,21 +1,15 @@
-# cleanlib-sdk-py
+# cleanlib-sdk
 
 CleanLibrary Python SDK — `asyncio` + `httpx`; mirrors the Rust `cleanlib-client` HTTP surface.
 
-**Status**: `v0.1.0-substrate` (cycle-4 §D.1). Substrate-only — `fetch_verdict` ships; remaining verbs (`scan` / `audit_recent` / `policy_preview` / `fetch_bytes`) iterate cycle-5+.
+**Status**: `v0.4.3` — production-ready.
 
-## Install (cycle-5+; not yet on PyPI)
+## Install
 
 ```bash
 pip install cleanlib-sdk
 ```
 
-For cycle-4 substrate, install from this repo:
-
-```bash
-pip install git+https://bitbucket.org/triamsec/cleanlib-sdk-py.git
-```
-
 ## Usage
 
 ```python
@@ -68,9 +62,10 @@ ruff check .
 
 ## Cross-references
 
-- [App workstream substrate spec](https://bitbucket.org/triamsec/cleanlib/src/main/workstream-specs/05-app/sdk-substrate-rev1.md) — canonical surface design
-- [Rust cleanlib-client](https://bitbucket.org/triamsec/cleanlib/src/main/cleanlib-client/) — reference implementation
-- [App customer endpoint contract](https://bitbucket.org/triamsec/cleanlib/src/main/workstream-specs/05-app/app-scope-outline-rev4.md) §9 — HTTP surface contract
+- [CleanLibrary docs](https://cleanlibrary.clnstrt.dev) — customer documentation portal
+- Rust SDK: [`cleanlib-client`](https://crates.io/crates/cleanlib-client) — reference implementation
+- Go SDK: [`cleanlib-sdk-go`](https://pkg.clnstrt.dev/cleanlib-sdk-go)
+- JavaScript SDK: [`@cleanstart/cleanlib-sdk`](https://www.npmjs.com/package/@cleanstart/cleanlib-sdk)
 
 ## License
 

{cleanlib_sdk-0.4.2 → cleanlib_sdk-0.4.4}/cleanlib_sdk/__init__.py

@@ -99,7 +99,7 @@ from cleanlib_sdk.types import (
     Verdict,
 )
 
-__version__ = "0.4.2"
+__version__ = "0.4.4"
 
 __all__ = [
     # v0.4.2 per-domain HTTP client triad (primary API)

{cleanlib_sdk-0.4.2 → cleanlib_sdk-0.4.4}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cleanlib-sdk"
-version = "0.4.2"
-description = "CleanLibrary Python SDK — HttpVerdictClient + HttpRemediationClient + HttpEnrichClient triad (sister-shape with @cleanstart/cleanlib-sdk v0.4.2)"
+version = "0.4.4"
+description = "CleanLibrary Python SDK — HttpVerdictClient + HttpRemediationClient + HttpEnrichClient triad (sister-shape with @cleanstart/cleanlib-sdk v0.4.4)"
 readme = "README.md"
 requires-python = ">=3.10"
 license = { text = "Proprietary" }
@@ -32,13 +32,28 @@ dev = [
 ]
 
 [project.urls]
-Homepage = "https://bitbucket.org/triamsec/cleanlib-sdk-py"
-Source = "https://bitbucket.org/triamsec/cleanlib-sdk-py"
-Documentation = "https://bitbucket.org/triamsec/cleanlib/src/main/workstream-specs/05-app/sdk-substrate-rev1.md"
+Homepage = "https://cleanlibrary.clnstrt.dev"
+Documentation = "https://cleanlibrary.clnstrt.dev/docs/sdk-python"
+"Bug Tracker" = "https://cleanlibrary.clnstrt.dev/support"
 
 [tool.hatch.build.targets.wheel]
 packages = ["cleanlib_sdk"]
 
+# v0.4.4 CLEANLIB-49: ship CHANGELOG.md inside the package so customers
+# reading the PyPI listing (or running pip download + tar inspection) see
+# the version history.
+[tool.hatch.build.targets.wheel.force-include]
+"CHANGELOG.md" = "cleanlib_sdk/CHANGELOG.md"
+
+[tool.hatch.build.targets.sdist]
+include = [
+    "cleanlib_sdk/**",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "pyproject.toml",
+]
+
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
 testpaths = ["tests"]

cleanlib_sdk-0.4.2/bitbucket-pipelines.yml

@@ -1,55 +0,0 @@
-# CleanLibrary Python SDK CI — per workspace §C.5 + §C.6 + pen #16 forward fix.
-#
-# Mirrors the cleanlib repo's commit-prefix discipline + rebase-required
-# detector. Uses a separate CLEANLIB-N counter per sdk-substrate-rev1.md §8.
-
-image: python:3.12-slim
-
-pipelines:
-  default:
-    - step:
-        name: Validate commit message prefix
-        script:
-          # Each commit on the PR branch (since divergence from main) must start with
-          # a CLEANLIB-N prefix per workspace §6.9 discipline. --no-merges per pen #16
-          # avoids false-positives on BB-synthesized merge commits.
-          - |
-            apt-get update -qq && apt-get install -y -qq git >/dev/null
-            BASE_REF=${BITBUCKET_PR_DESTINATION_BRANCH:-main}
-            git fetch origin "$BASE_REF" || true
-            git log --no-merges "origin/$BASE_REF..HEAD" --pretty=format:"%H %s" | while read -r line; do
-              MSG=${line#* }
-              case "$MSG" in
-                CLEANLIB-*) ;;
-                *) echo "❌ commit missing CLEANLIB-N prefix: $line"; exit 1;;
-              esac
-            done
-            echo "✅ commit prefixes OK"
-
-    - step:
-        name: Rebase-required detector
-        script:
-          # Mirrors cleanlib repo §C.6: if merge-base is not on main's HEAD, ask for rebase.
-          - |
-            apt-get update -qq && apt-get install -y -qq git >/dev/null
-            BASE_REF=${BITBUCKET_PR_DESTINATION_BRANCH:-main}
-            git fetch origin "$BASE_REF"
-            MB=$(git merge-base "origin/$BASE_REF" HEAD)
-            HEAD_REMOTE=$(git rev-parse "origin/$BASE_REF")
-            if [ "$MB" != "$HEAD_REMOTE" ]; then
-              echo "❌ Branch is behind origin/$BASE_REF; rebase before merging."
-              echo "  merge-base: $MB"
-              echo "  origin/$BASE_REF: $HEAD_REMOTE"
-              exit 1
-            fi
-            echo "✅ branch current with origin/$BASE_REF"
-
-    - step:
-        name: Lint + test
-        caches:
-          - pip
-        script:
-          - pip install --quiet --upgrade pip
-          - pip install --quiet -e ".[dev]"
-          - ruff check .
-          - pytest -q

cleanlib_sdk-0.4.2/tests/fixtures/contract-fixtures/CORPUS-README.md

@@ -1,96 +0,0 @@
-# cleanlib-contract-fixtures
-
-**Cross-SDK contract fixture corpus.** Source-of-truth fixtures that every CleanLibrary SDK consumer asserts identical `DeriveStatus` results against. The corpus locks against the **`VerdictEnvelopeV1`** schema published in `@cleanstart/cleanlib-sdk@0.4.1`.
-
-## Consumers (4)
-
-| SDK | Repo | Test harness | Schema validator |
-|---|---|---|---|
-| sdk-js | `triamsec/cleanlib-sdk-js` (npm `@cleanstart/cleanlib-sdk`) | vitest | ajv |
-| sdk-py | `triamsec/cleanlib-sdk-py` (PyPI `cleanlib-sdk`) | pytest | `jsonschema` |
-| sdk-go | `triamsec/cleanlib-sdk-go` (Go modules; same path) | `go test` | `github.com/xeipuuv/gojsonschema` |
-| cleanlib-client (Rust) | `triamsec/cleanlib` workspace member | `cargo test` | `jsonschema` crate |
-
-Each consumer pulls this corpus as a git submodule (or vendors under `test/fixtures/`); CI fails on `DeriveStatus(fixture) != expected_per_EXPECTED.json` for any fixture.
-
-## Schema lock
-
-v1.0.0 of this corpus locks against:
-- Tarball: `@cleanstart/cleanlib-sdk@0.4.1` (sha-1 `b5f00c160907a6ea1f490f14a9bda6f6de34b8b6`)
-- Schema: `https://cleanstart.com/schemas/verdict-envelope.v1.json` (`VerdictEnvelopeV1Schema` exported from `dist/schema/verdict-envelope.v1.js`)
-- ReasonCode registry: `dist/reason-codes.js` (15 codes)
-- Freshness-precedence rule: ratified 2026-05-28; documented in schema `reason_code.description` + `reason-codes.js` comment
-
-## VerdictEnvelopeV1 — top-level shape
-
-```
-required: [status, reason_code, human_message, as_of]
-optional: rich_data, remediation, exploitability, availability{kev,epss,exploitation_fusion}
-status enum: [ALLOW, WARN, DENY]   ← server-side tri-state only
-```
-
-**`UNREACHABLE` and `LIVE_DEGRADED` are NOT envelope status values.** They are client-tier states:
-- `UNREACHABLE` — CLI exit-code 3 on SDK transport-error; no envelope
-- `LIVE_DEGRADED` — VS Code extension status-bar state on cache-fallback; surfaces as `reason_code=VERDICT_DEGRADED_STALE` when an envelope IS assembled from a stale cache hit, else as an out-of-band transport state
-
-The corpus's `verdict-unreachable.json` documents the transport-error shape (NOT a VerdictEnvelopeV1) for SDK transport-tier contract tests.
-
-## Fixture → (status, reason_code) contract
-
-Per the freshness-precedence rule (App dispatch §4 + Client dispatch §2.3 binding contract):
-- **Substance precedence** — signals top-to-bottom (exploitation_critical > kev > obfuscation > has_remediation > abandonment > clean); `unavailable` substrate falls through to the next rule
-- **Freshness override** — `degraded_stale` substrate KEEPS the substance-derived status tier but rewrites `reason_code` → `VERDICT_DEGRADED_STALE`
-- **Block tie-break in remediation** — `fix > recommended_version > other blocks`
-- **Server-side `VERDICT_DEGRADED_STALE` ≠ client-side `LIVE_DEGRADED`** — distinct concepts; never conflated
-
-| Fixture | Status | Reason code | Driving fields |
-|---|---|---|---|
-| `verdict-allow-clean.json` | ALLOW | VERDICT_CLEAN | (no sub-objects) |
-| `verdict-allow-recommended.json` | ALLOW | VERDICT_RECOMMENDED_VERSION_NEWER | `rich_data.recommended_version` (benign upgrade hint, no remediation block) |
-| `verdict-warn-abandoned.json` | WARN | VERDICT_ABANDONED | `rich_data.abandonment_score >= 0.7` |
-| `verdict-warn-has-remediation.json` | WARN | VERDICT_HAS_REMEDIATION | `remediation.fix` or `remediation.recommended_version` (under `remediation`, NOT `rich_data`) |
-| `verdict-deny-kev.json` | DENY | VERDICT_KEV_LISTED | `exploitability.in_kev=true` + `availability.kev='available'` + `exploitability.exploit_risk_score >= 70` |
-| `verdict-deny-exploitation-critical.json` | DENY | VERDICT_EXPLOITATION_CRITICAL | `exploitability.exploitation_likelihood='CRITICAL'` |
-| `verdict-degraded-stale.json` | WARN | VERDICT_DEGRADED_STALE | substance: HAS_REMEDIATION; freshness override applies (`remediation.fix.availability='degraded_stale'`) |
-| `verdict-unreachable.json` | _(out-of-band)_ | _(out-of-band)_ | transport-error synthetic; not a VerdictEnvelopeV1; CLI exit-3 / extension LIVE_DEGRADED |
-
-See `EXPECTED.json` for the machine-readable lookup.
-
-## DeriveStatus precedence (canonical spec; SDKs implement independently)
-
-```
-if exploitability.exploitation_likelihood == "CRITICAL"  → DENY + VERDICT_EXPLOITATION_CRITICAL
-if exploitability.in_kev && availability.kev == "available" && exploit_risk_score >= 70  → DENY + VERDICT_KEV_LISTED
-if rich_data.has_obfuscation  → DENY + VERDICT_OBFUSCATED
-if remediation.fix != null || remediation.recommended_version != null  → WARN + VERDICT_HAS_REMEDIATION
-if rich_data.abandonment_score >= 0.7  → WARN + VERDICT_ABANDONED
-if rich_data.recommended_version != null  → ALLOW + VERDICT_RECOMMENDED_VERSION_NEWER
-default  → ALLOW + VERDICT_CLEAN
-
-# Then apply the freshness-precedence override:
-if the substance-driving signal's availability == "degraded_stale"
-  → status unchanged; reason_code := VERDICT_DEGRADED_STALE
-```
-
-`DeriveStatus` is **not exported from sdk-js** — each SDK implements this algorithm independently against the binding spec. The cross-SDK contract test verifies all 4 implementations agree byte-identically on every fixture's `(status, reason_code)`.
-
-## Drift handling
-
-Schema changes (new envelope field, renamed key, etc.) MUST land here first; then all 4 SDKs receive a coordinated PR pulling the updated corpus + adjusting derivation cases. Monthly cron CI in each SDK fetches the latest corpus + diffs locally (cycle-8 scope; for cycle-7, manual sync during S1+S2 publish events).
-
-## Layout
-
-```
-cleanlib-contract-fixtures/
-├── README.md                                        # this file
-├── EXPECTED.json                                    # machine-readable fixture → (status, reason_code) lookup
-└── fixtures/
-    ├── verdict-allow-clean.json
-    ├── verdict-allow-recommended.json
-    ├── verdict-warn-abandoned.json
-    ├── verdict-warn-has-remediation.json
-    ├── verdict-deny-kev.json
-    ├── verdict-deny-exploitation-critical.json
-    ├── verdict-degraded-stale.json
-    └── verdict-unreachable.json                     # OUT-OF-BAND transport-error; not a VerdictEnvelopeV1
-```

cleanlib_sdk-0.4.2/tests/fixtures/contract-fixtures/EXPECTED.json

@@ -1,50 +0,0 @@
-{
-  "_doc": "Machine-readable fixture → (status, reason_code) lookup, schema-locked against sdk-js v0.4.1 published surface (VerdictEnvelopeV1Schema + ReasonCode registry). Each SDK consumer (sdk-js, sdk-py, sdk-go, cleanlib-client Rust) loads this and asserts DeriveStatus(fixtures[N]) == EXPECTED[N] for every fixture. v1.0.0 of this corpus locks against sdk-js v0.4.1.",
-  "_schema_lock": {
-    "sdk_js_version": "@cleanstart/cleanlib-sdk@0.4.1",
-    "tarball_sha1": "b5f00c160907a6ea1f490f14a9bda6f6de34b8b6",
-    "schema_id": "https://cleanstart.com/schemas/verdict-envelope.v1.json",
-    "envelope_status_enum": ["ALLOW", "WARN", "DENY"],
-    "freshness_precedence_rule_ratified": "2026-05-28"
-  },
-  "fixtures": {
-    "verdict-allow-clean.json": {
-      "status": "ALLOW",
-      "reason_code": "VERDICT_CLEAN"
-    },
-    "verdict-allow-recommended.json": {
-      "status": "ALLOW",
-      "reason_code": "VERDICT_RECOMMENDED_VERSION_NEWER"
-    },
-    "verdict-warn-abandoned.json": {
-      "status": "WARN",
-      "reason_code": "VERDICT_ABANDONED"
-    },
-    "verdict-warn-has-remediation.json": {
-      "status": "WARN",
-      "reason_code": "VERDICT_HAS_REMEDIATION"
-    },
-    "verdict-deny-kev.json": {
-      "status": "DENY",
-      "reason_code": "VERDICT_KEV_LISTED"
-    },
-    "verdict-deny-exploitation-critical.json": {
-      "status": "DENY",
-      "reason_code": "VERDICT_EXPLOITATION_CRITICAL"
-    },
-    "verdict-degraded-stale.json": {
-      "status": "WARN",
-      "reason_code": "VERDICT_DEGRADED_STALE",
-      "_note": "substance:HAS_REMEDIATION + freshness:degraded_stale → status preserved (WARN), reason_code overridden (VERDICT_DEGRADED_STALE) per freshness-precedence rule"
-    }
-  },
-  "_out_of_band": {
-    "verdict-unreachable.json": {
-      "_kind": "transport_error_synthetic",
-      "_note": "NOT a VerdictEnvelopeV1. SDK transport-failure result; CLI maps to UNREACHABLE+exit3; extension maps to LIVE_DEGRADED status-bar (client-tier). No envelope status assigned (schema enum is [ALLOW,WARN,DENY] only).",
-      "cli_exit_code": 3,
-      "cli_status_label": "UNREACHABLE",
-      "extension_status_bar": "LIVE_DEGRADED"
-    }
-  }
-}

cleanlib_sdk-0.4.2/tests/fixtures/contract-fixtures/fixtures/verdict-allow-clean.json

@@ -1,7 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: no remediation/exploitability/rich-data alerts → status=ALLOW, reason_code=VERDICT_CLEAN. Minimum required envelope shape per VerdictEnvelopeV1Schema. All optional sub-objects omitted.",
-  "status": "ALLOW",
-  "reason_code": "VERDICT_CLEAN",
-  "human_message": "left-pad 1.3.0 — no findings. Allowed.",
-  "as_of": "2026-05-28"
-}

cleanlib_sdk-0.4.2/tests/fixtures/contract-fixtures/fixtures/verdict-allow-recommended.json

@@ -1,17 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: benign envelope with recommended_version under rich_data only (NOT under remediation.recommended_version or remediation.fix) → status=ALLOW, reason_code=VERDICT_RECOMMENDED_VERSION_NEWER (specific reason from published ReasonCode registry; F2 ratification supersedes the earlier draft VERDICT_CLEAN mapping). Sister of the cycle-6 cors clean-shape probe.",
-  "status": "ALLOW",
-  "reason_code": "VERDICT_RECOMMENDED_VERSION_NEWER",
-  "human_message": "cors 2.8.4 — clean, but a newer recommended version (2.8.6) is available.",
-  "as_of": "2026-05-28",
-  "rich_data": {
-    "recommended_version": {
-      "version": "2.8.6",
-      "source": "l1_package_master",
-      "detected_at": "",
-      "total_versions": 0
-    },
-    "verdict_source": "llm_anthropic",
-    "terminal_state": "completed"
-  }
-}

cleanlib_sdk-0.4.2/tests/fixtures/contract-fixtures/fixtures/verdict-degraded-stale.json

@@ -1,18 +0,0 @@
-{
-  "_doc": "DeriveStatus contract (freshness-precedence rule ratified 2026-05-28 + binding via App dispatch §4 + Client dispatch §2.3 + verdict-envelope.v1 schema reason_code doc-comment): when underlying substrate availability='degraded_stale' on a block driving a substance-derived reason, the substance-derived tier is PRESERVED and the reason_code OVERRIDES to VERDICT_DEGRADED_STALE. This fixture's substance signal is HAS_REMEDIATION (remediation.fix present); freshness=degraded_stale → status=WARN (preserved) + reason_code=VERDICT_DEGRADED_STALE (overridden). Server-side VERDICT_DEGRADED_STALE is architecturally distinct from client-side LIVE_DEGRADED cache-fallback state.",
-  "status": "WARN",
-  "reason_code": "VERDICT_DEGRADED_STALE",
-  "human_message": "stale-cache-fixture 1.0.0 — remediation data is stale (since 2026-05-21); WARN preserved, reason overridden to freshness.",
-  "as_of": "2026-05-28",
-  "remediation": {
-    "fix": {
-      "availability": "degraded_stale",
-      "as_of": "2026-05-21"
-    }
-  },
-  "availability": {
-    "kev": "available",
-    "epss": "available",
-    "exploitation_fusion": "available"
-  }
-}

cleanlib_sdk-0.4.2/tests/fixtures/contract-fixtures/fixtures/verdict-deny-exploitation-critical.json

@@ -1,21 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: exploitability.exploitation_likelihood='CRITICAL' → status=DENY, reason_code=VERDICT_EXPLOITATION_CRITICAL. Highest substance precedence — fires before KEV / obfuscation / remediation / abandonment checks.",
-  "status": "DENY",
-  "reason_code": "VERDICT_EXPLOITATION_CRITICAL",
-  "human_message": "log4j-style-fixture 2.14.0 — CRITICAL active exploitation; immediate action required.",
-  "as_of": "2026-05-28",
-  "exploitability": {
-    "exploitation_likelihood": "CRITICAL",
-    "in_kev": true,
-    "exploit_risk_score": 99,
-    "kev": {
-      "cve_id": "CVE-2021-FIXTURE",
-      "date_added": "2021-12-15"
-    }
-  },
-  "availability": {
-    "kev": "available",
-    "epss": "available",
-    "exploitation_fusion": "available"
-  }
-}

cleanlib_sdk-0.4.2/tests/fixtures/contract-fixtures/fixtures/verdict-deny-kev.json

@@ -1,21 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: exploitability.in_kev=true AND exploitability.availability.kev='available' AND exploitability.exploit_risk_score>=70 → status=DENY, reason_code=VERDICT_KEV_LISTED. All three conditions required; ablating any one drops to lower precedence.",
-  "status": "DENY",
-  "reason_code": "VERDICT_KEV_LISTED",
-  "human_message": "kev-listed-fixture 1.0.0 — listed in CISA KEV (CVE-2024-FIXTURE); high exploit-risk.",
-  "as_of": "2026-05-28",
-  "exploitability": {
-    "in_kev": true,
-    "exploit_risk_score": 85,
-    "exploitation_likelihood": "HIGH",
-    "kev": {
-      "cve_id": "CVE-2024-FIXTURE",
-      "date_added": "2024-08-15"
-    }
-  },
-  "availability": {
-    "kev": "available",
-    "epss": "available",
-    "exploitation_fusion": "available"
-  }
-}

cleanlib_sdk-0.4.2/tests/fixtures/contract-fixtures/fixtures/verdict-unreachable.json

@@ -1,16 +0,0 @@
-{
-  "_doc": "OUT-OF-BAND transport-error result — NOT a VerdictEnvelopeV1. This fixture documents the SDK's transport-failure shape (`HttpRemediationClient.getRemediation → {kind:'transient', error}` per sdk-js types/remediation.d.ts). The CLI maps this to UNREACHABLE + exit 3; the VS Code extension maps to its client-tier LIVE_DEGRADED status-bar state (architecturally distinct from server-side VERDICT_DEGRADED_STALE per dispatch §2.3 ratification + verdict-envelope.v1 schema doc-comment). The envelope schema's status enum is [ALLOW, WARN, DENY] only — UNREACHABLE has no envelope; it is by definition the absence-of-envelope path.",
-  "_kind": "transport_error_synthetic",
-  "_envelope": null,
-  "transport_error": {
-    "kind": "transient",
-    "message": "connection refused / DNS NXDOMAIN / 5xx after retry budget exhausted",
-    "endpoint": "https://cleanlib-enrich.clnstrt.dev"
-  },
-  "_expected_client_state": {
-    "cli_exit_code": 3,
-    "cli_status_label": "UNREACHABLE",
-    "extension_status_bar": "LIVE_DEGRADED",
-    "reason_code_when_envelope_assembled_from_cache_hit": "CLIENT_NETWORK_UNREACHABLE"
-  }
-}

cleanlib_sdk-0.4.2/tests/fixtures/contract-fixtures/fixtures/verdict-warn-abandoned.json

@@ -1,14 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: rich_data.abandonment_score >= 0.7 → status=WARN, reason_code=VERDICT_ABANDONED. Score field MUST drive the derivation; reason text is descriptive only.",
-  "status": "WARN",
-  "reason_code": "VERDICT_ABANDONED",
-  "human_message": "stale-lib-fixture 0.9.0 — abandoned (no commits since 2022; 0 active maintainers).",
-  "as_of": "2026-05-28",
-  "rich_data": {
-    "abandonment_score": 0.85,
-    "repo_health": {
-      "last_commit_at": "2022-01-15T00:00:00Z",
-      "maintainer_count": 0
-    }
-  }
-}

cleanlib_sdk-0.4.2/tests/fixtures/contract-fixtures/fixtures/verdict-warn-has-remediation.json

@@ -1,17 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: remediation.fix OR remediation.recommended_version present (under remediation block, not rich_data) → status=WARN, reason_code=VERDICT_HAS_REMEDIATION. Distinction vs verdict-allow-recommended: this fixture's recommended_version sits under remediation (signals active vuln with fix path); the allow-recommended fixture has rich_data.recommended_version (benign upgrade hint, no active vuln). Per dispatch §3.2 block tie-break: fix > recommended_version > other blocks.",
-  "status": "WARN",
-  "reason_code": "VERDICT_HAS_REMEDIATION",
-  "human_message": "vuln-with-fix-fixture 1.0.0 — vulnerable; upgrade available.",
-  "as_of": "2026-05-28",
-  "remediation": {
-    "fix": {
-      "availability": "available",
-      "as_of": "2026-05-20"
-    },
-    "recommended_version": {
-      "availability": "available",
-      "as_of": "2026-05-20"
-    }
-  }
-}