cleanlib-sdk 0.4.3__tar.gz → 0.4.4__tar.gz

cleanlib_sdk-0.4.4/CHANGELOG.md

@@ -0,0 +1,41 @@
+# cleanlib-sdk changelog
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.4.4] — 2026-06-04
+
+### Fixed
+
+- `cleanlib_sdk.__version__` synchronized with the package manifest version.
+  Previously the in-code `__version__` reported `0.4.2` while the published
+  artifact was `0.4.3` — telemetry that relied on `__version__` for User-Agent
+  composition was under-reporting deployment penetration.
+- Wheel + sdist now include `CHANGELOG.md`. Customers running `pip download`
+  + tar inspection (or browsing the PyPI release files page) see the version
+  history alongside the package code.
+
+## [0.4.3] — 2026-06-03
+
+### Fixed
+
+- `pyproject.toml` `[project.urls]` table sanitized: `Homepage`,
+  `Documentation`, and `Bug Tracker` now point at `cleanlibrary.clnstrt.dev`
+  rather than the internal source-of-truth URLs that previously rendered on
+  the PyPI listing page.
+- `README.md` cross-references brand-clean: repo-internal links replaced with
+  the customer-facing `cleanlibrary.clnstrt.dev` documentation site and
+  cross-language SDK registry pages (crates.io, pkg.clnstrt.dev, npmjs.com).
+
+### Notes
+
+- No runtime API or wire-protocol changes; this is a metadata + docs ship.
+- Verified via `python -m build` against the resulting `cleanlib_sdk-0.4.3-py3-none-any.whl`
+  `METADATA` + `cleanlib_sdk-0.4.3.tar.gz` `PKG-INFO`: zero
+  internal-source URL references.
+
+## 0.4.2 — enrich verb cascade + F4 default-flip to cleanlib-enrich
+
+## 0.4.1 — per-domain HTTP client split (HttpRemediationClient) + schema/reason-codes mirror + DeriveStatus + Client @deprecated
+
+## 0.4.0 — verb cascade + rich-data

{cleanlib_sdk-0.4.3 → cleanlib_sdk-0.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cleanlib-sdk
-Version: 0.4.3
+Version: 0.4.4
 Summary: CleanLibrary Python SDK — HttpVerdictClient + HttpRemediationClient + HttpEnrichClient triad (sister-shape with @cleanstart/cleanlib-sdk v0.4.4)
 Project-URL: Homepage, https://cleanlibrary.clnstrt.dev
 Project-URL: Documentation, https://cleanlibrary.clnstrt.dev/docs/sdk-python

{cleanlib_sdk-0.4.3 → cleanlib_sdk-0.4.4}/cleanlib_sdk/__init__.py

@@ -99,7 +99,7 @@ from cleanlib_sdk.types import (
     Verdict,
 )
 
-__version__ = "0.4.2"
+__version__ = "0.4.4"
 
 __all__ = [
     # v0.4.2 per-domain HTTP client triad (primary API)

{cleanlib_sdk-0.4.3 → cleanlib_sdk-0.4.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cleanlib-sdk"
-version = "0.4.3"
+version = "0.4.4"
 description = "CleanLibrary Python SDK — HttpVerdictClient + HttpRemediationClient + HttpEnrichClient triad (sister-shape with @cleanstart/cleanlib-sdk v0.4.4)"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -39,6 +39,21 @@ Documentation = "https://cleanlibrary.clnstrt.dev/docs/sdk-python"
 [tool.hatch.build.targets.wheel]
 packages = ["cleanlib_sdk"]
 
+# v0.4.4 CLEANLIB-49: ship CHANGELOG.md inside the package so customers
+# reading the PyPI listing (or running pip download + tar inspection) see
+# the version history.
+[tool.hatch.build.targets.wheel.force-include]
+"CHANGELOG.md" = "cleanlib_sdk/CHANGELOG.md"
+
+[tool.hatch.build.targets.sdist]
+include = [
+    "cleanlib_sdk/**",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "pyproject.toml",
+]
+
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
 testpaths = ["tests"]

cleanlib_sdk-0.4.3/bitbucket-pipelines.yml

@@ -1,55 +0,0 @@
-# CleanLibrary Python SDK CI — per workspace §C.5 + §C.6 + pen #16 forward fix.
-#
-# Mirrors the cleanlib repo's commit-prefix discipline + rebase-required
-# detector. Uses a separate CLEANLIB-N counter per sdk-substrate-rev1.md §8.
-
-image: python:3.12-slim
-
-pipelines:
-  default:
-    - step:
-        name: Validate commit message prefix
-        script:
-          # Each commit on the PR branch (since divergence from main) must start with
-          # a CLEANLIB-N prefix per workspace §6.9 discipline. --no-merges per pen #16
-          # avoids false-positives on BB-synthesized merge commits.
-          - |
-            apt-get update -qq && apt-get install -y -qq git >/dev/null
-            BASE_REF=${BITBUCKET_PR_DESTINATION_BRANCH:-main}
-            git fetch origin "$BASE_REF" || true
-            git log --no-merges "origin/$BASE_REF..HEAD" --pretty=format:"%H %s" | while read -r line; do
-              MSG=${line#* }
-              case "$MSG" in
-                CLEANLIB-*) ;;
-                *) echo "❌ commit missing CLEANLIB-N prefix: $line"; exit 1;;
-              esac
-            done
-            echo "✅ commit prefixes OK"
-
-    - step:
-        name: Rebase-required detector
-        script:
-          # Mirrors cleanlib repo §C.6: if merge-base is not on main's HEAD, ask for rebase.
-          - |
-            apt-get update -qq && apt-get install -y -qq git >/dev/null
-            BASE_REF=${BITBUCKET_PR_DESTINATION_BRANCH:-main}
-            git fetch origin "$BASE_REF"
-            MB=$(git merge-base "origin/$BASE_REF" HEAD)
-            HEAD_REMOTE=$(git rev-parse "origin/$BASE_REF")
-            if [ "$MB" != "$HEAD_REMOTE" ]; then
-              echo "❌ Branch is behind origin/$BASE_REF; rebase before merging."
-              echo "  merge-base: $MB"
-              echo "  origin/$BASE_REF: $HEAD_REMOTE"
-              exit 1
-            fi
-            echo "✅ branch current with origin/$BASE_REF"
-
-    - step:
-        name: Lint + test
-        caches:
-          - pip
-        script:
-          - pip install --quiet --upgrade pip
-          - pip install --quiet -e ".[dev]"
-          - ruff check .
-          - pytest -q

cleanlib_sdk-0.4.3/tests/fixtures/contract-fixtures/CORPUS-README.md

@@ -1,96 +0,0 @@
-# cleanlib-contract-fixtures
-
-**Cross-SDK contract fixture corpus.** Source-of-truth fixtures that every CleanLibrary SDK consumer asserts identical `DeriveStatus` results against. The corpus locks against the **`VerdictEnvelopeV1`** schema published in `@cleanstart/cleanlib-sdk@0.4.1`.
-
-## Consumers (4)
-
-| SDK | Repo | Test harness | Schema validator |
-|---|---|---|---|
-| sdk-js | `triamsec/cleanlib-sdk-js` (npm `@cleanstart/cleanlib-sdk`) | vitest | ajv |
-| sdk-py | `triamsec/cleanlib-sdk-py` (PyPI `cleanlib-sdk`) | pytest | `jsonschema` |
-| sdk-go | `triamsec/cleanlib-sdk-go` (Go modules; same path) | `go test` | `github.com/xeipuuv/gojsonschema` |
-| cleanlib-client (Rust) | `triamsec/cleanlib` workspace member | `cargo test` | `jsonschema` crate |
-
-Each consumer pulls this corpus as a git submodule (or vendors under `test/fixtures/`); CI fails on `DeriveStatus(fixture) != expected_per_EXPECTED.json` for any fixture.
-
-## Schema lock
-
-v1.0.0 of this corpus locks against:
-- Tarball: `@cleanstart/cleanlib-sdk@0.4.1` (sha-1 `b5f00c160907a6ea1f490f14a9bda6f6de34b8b6`)
-- Schema: `https://cleanstart.com/schemas/verdict-envelope.v1.json` (`VerdictEnvelopeV1Schema` exported from `dist/schema/verdict-envelope.v1.js`)
-- ReasonCode registry: `dist/reason-codes.js` (15 codes)
-- Freshness-precedence rule: ratified 2026-05-28; documented in schema `reason_code.description` + `reason-codes.js` comment
-
-## VerdictEnvelopeV1 — top-level shape
-
-```
-required: [status, reason_code, human_message, as_of]
-optional: rich_data, remediation, exploitability, availability{kev,epss,exploitation_fusion}
-status enum: [ALLOW, WARN, DENY]   ← server-side tri-state only
-```
-
-**`UNREACHABLE` and `LIVE_DEGRADED` are NOT envelope status values.** They are client-tier states:
-- `UNREACHABLE` — CLI exit-code 3 on SDK transport-error; no envelope
-- `LIVE_DEGRADED` — VS Code extension status-bar state on cache-fallback; surfaces as `reason_code=VERDICT_DEGRADED_STALE` when an envelope IS assembled from a stale cache hit, else as an out-of-band transport state
-
-The corpus's `verdict-unreachable.json` documents the transport-error shape (NOT a VerdictEnvelopeV1) for SDK transport-tier contract tests.
-
-## Fixture → (status, reason_code) contract
-
-Per the freshness-precedence rule (App dispatch §4 + Client dispatch §2.3 binding contract):
-- **Substance precedence** — signals top-to-bottom (exploitation_critical > kev > obfuscation > has_remediation > abandonment > clean); `unavailable` substrate falls through to the next rule
-- **Freshness override** — `degraded_stale` substrate KEEPS the substance-derived status tier but rewrites `reason_code` → `VERDICT_DEGRADED_STALE`
-- **Block tie-break in remediation** — `fix > recommended_version > other blocks`
-- **Server-side `VERDICT_DEGRADED_STALE` ≠ client-side `LIVE_DEGRADED`** — distinct concepts; never conflated
-
-| Fixture | Status | Reason code | Driving fields |
-|---|---|---|---|
-| `verdict-allow-clean.json` | ALLOW | VERDICT_CLEAN | (no sub-objects) |
-| `verdict-allow-recommended.json` | ALLOW | VERDICT_RECOMMENDED_VERSION_NEWER | `rich_data.recommended_version` (benign upgrade hint, no remediation block) |
-| `verdict-warn-abandoned.json` | WARN | VERDICT_ABANDONED | `rich_data.abandonment_score >= 0.7` |
-| `verdict-warn-has-remediation.json` | WARN | VERDICT_HAS_REMEDIATION | `remediation.fix` or `remediation.recommended_version` (under `remediation`, NOT `rich_data`) |
-| `verdict-deny-kev.json` | DENY | VERDICT_KEV_LISTED | `exploitability.in_kev=true` + `availability.kev='available'` + `exploitability.exploit_risk_score >= 70` |
-| `verdict-deny-exploitation-critical.json` | DENY | VERDICT_EXPLOITATION_CRITICAL | `exploitability.exploitation_likelihood='CRITICAL'` |
-| `verdict-degraded-stale.json` | WARN | VERDICT_DEGRADED_STALE | substance: HAS_REMEDIATION; freshness override applies (`remediation.fix.availability='degraded_stale'`) |
-| `verdict-unreachable.json` | _(out-of-band)_ | _(out-of-band)_ | transport-error synthetic; not a VerdictEnvelopeV1; CLI exit-3 / extension LIVE_DEGRADED |
-
-See `EXPECTED.json` for the machine-readable lookup.
-
-## DeriveStatus precedence (canonical spec; SDKs implement independently)
-
-```
-if exploitability.exploitation_likelihood == "CRITICAL"  → DENY + VERDICT_EXPLOITATION_CRITICAL
-if exploitability.in_kev && availability.kev == "available" && exploit_risk_score >= 70  → DENY + VERDICT_KEV_LISTED
-if rich_data.has_obfuscation  → DENY + VERDICT_OBFUSCATED
-if remediation.fix != null || remediation.recommended_version != null  → WARN + VERDICT_HAS_REMEDIATION
-if rich_data.abandonment_score >= 0.7  → WARN + VERDICT_ABANDONED
-if rich_data.recommended_version != null  → ALLOW + VERDICT_RECOMMENDED_VERSION_NEWER
-default  → ALLOW + VERDICT_CLEAN
-
-# Then apply the freshness-precedence override:
-if the substance-driving signal's availability == "degraded_stale"
-  → status unchanged; reason_code := VERDICT_DEGRADED_STALE
-```
-
-`DeriveStatus` is **not exported from sdk-js** — each SDK implements this algorithm independently against the binding spec. The cross-SDK contract test verifies all 4 implementations agree byte-identically on every fixture's `(status, reason_code)`.
-
-## Drift handling
-
-Schema changes (new envelope field, renamed key, etc.) MUST land here first; then all 4 SDKs receive a coordinated PR pulling the updated corpus + adjusting derivation cases. Monthly cron CI in each SDK fetches the latest corpus + diffs locally (cycle-8 scope; for cycle-7, manual sync during S1+S2 publish events).
-
-## Layout
-
-```
-cleanlib-contract-fixtures/
-├── README.md                                        # this file
-├── EXPECTED.json                                    # machine-readable fixture → (status, reason_code) lookup
-└── fixtures/
-    ├── verdict-allow-clean.json
-    ├── verdict-allow-recommended.json
-    ├── verdict-warn-abandoned.json
-    ├── verdict-warn-has-remediation.json
-    ├── verdict-deny-kev.json
-    ├── verdict-deny-exploitation-critical.json
-    ├── verdict-degraded-stale.json
-    └── verdict-unreachable.json                     # OUT-OF-BAND transport-error; not a VerdictEnvelopeV1
-```

cleanlib_sdk-0.4.3/tests/fixtures/contract-fixtures/EXPECTED.json

@@ -1,50 +0,0 @@
-{
-  "_doc": "Machine-readable fixture → (status, reason_code) lookup, schema-locked against sdk-js v0.4.1 published surface (VerdictEnvelopeV1Schema + ReasonCode registry). Each SDK consumer (sdk-js, sdk-py, sdk-go, cleanlib-client Rust) loads this and asserts DeriveStatus(fixtures[N]) == EXPECTED[N] for every fixture. v1.0.0 of this corpus locks against sdk-js v0.4.1.",
-  "_schema_lock": {
-    "sdk_js_version": "@cleanstart/cleanlib-sdk@0.4.1",
-    "tarball_sha1": "b5f00c160907a6ea1f490f14a9bda6f6de34b8b6",
-    "schema_id": "https://cleanstart.com/schemas/verdict-envelope.v1.json",
-    "envelope_status_enum": ["ALLOW", "WARN", "DENY"],
-    "freshness_precedence_rule_ratified": "2026-05-28"
-  },
-  "fixtures": {
-    "verdict-allow-clean.json": {
-      "status": "ALLOW",
-      "reason_code": "VERDICT_CLEAN"
-    },
-    "verdict-allow-recommended.json": {
-      "status": "ALLOW",
-      "reason_code": "VERDICT_RECOMMENDED_VERSION_NEWER"
-    },
-    "verdict-warn-abandoned.json": {
-      "status": "WARN",
-      "reason_code": "VERDICT_ABANDONED"
-    },
-    "verdict-warn-has-remediation.json": {
-      "status": "WARN",
-      "reason_code": "VERDICT_HAS_REMEDIATION"
-    },
-    "verdict-deny-kev.json": {
-      "status": "DENY",
-      "reason_code": "VERDICT_KEV_LISTED"
-    },
-    "verdict-deny-exploitation-critical.json": {
-      "status": "DENY",
-      "reason_code": "VERDICT_EXPLOITATION_CRITICAL"
-    },
-    "verdict-degraded-stale.json": {
-      "status": "WARN",
-      "reason_code": "VERDICT_DEGRADED_STALE",
-      "_note": "substance:HAS_REMEDIATION + freshness:degraded_stale → status preserved (WARN), reason_code overridden (VERDICT_DEGRADED_STALE) per freshness-precedence rule"
-    }
-  },
-  "_out_of_band": {
-    "verdict-unreachable.json": {
-      "_kind": "transport_error_synthetic",
-      "_note": "NOT a VerdictEnvelopeV1. SDK transport-failure result; CLI maps to UNREACHABLE+exit3; extension maps to LIVE_DEGRADED status-bar (client-tier). No envelope status assigned (schema enum is [ALLOW,WARN,DENY] only).",
-      "cli_exit_code": 3,
-      "cli_status_label": "UNREACHABLE",
-      "extension_status_bar": "LIVE_DEGRADED"
-    }
-  }
-}

cleanlib_sdk-0.4.3/tests/fixtures/contract-fixtures/fixtures/verdict-allow-clean.json

@@ -1,7 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: no remediation/exploitability/rich-data alerts → status=ALLOW, reason_code=VERDICT_CLEAN. Minimum required envelope shape per VerdictEnvelopeV1Schema. All optional sub-objects omitted.",
-  "status": "ALLOW",
-  "reason_code": "VERDICT_CLEAN",
-  "human_message": "left-pad 1.3.0 — no findings. Allowed.",
-  "as_of": "2026-05-28"
-}

cleanlib_sdk-0.4.3/tests/fixtures/contract-fixtures/fixtures/verdict-allow-recommended.json

@@ -1,17 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: benign envelope with recommended_version under rich_data only (NOT under remediation.recommended_version or remediation.fix) → status=ALLOW, reason_code=VERDICT_RECOMMENDED_VERSION_NEWER (specific reason from published ReasonCode registry; F2 ratification supersedes the earlier draft VERDICT_CLEAN mapping). Sister of the cycle-6 cors clean-shape probe.",
-  "status": "ALLOW",
-  "reason_code": "VERDICT_RECOMMENDED_VERSION_NEWER",
-  "human_message": "cors 2.8.4 — clean, but a newer recommended version (2.8.6) is available.",
-  "as_of": "2026-05-28",
-  "rich_data": {
-    "recommended_version": {
-      "version": "2.8.6",
-      "source": "l1_package_master",
-      "detected_at": "",
-      "total_versions": 0
-    },
-    "verdict_source": "llm_anthropic",
-    "terminal_state": "completed"
-  }
-}

cleanlib_sdk-0.4.3/tests/fixtures/contract-fixtures/fixtures/verdict-degraded-stale.json

@@ -1,18 +0,0 @@
-{
-  "_doc": "DeriveStatus contract (freshness-precedence rule ratified 2026-05-28 + binding via App dispatch §4 + Client dispatch §2.3 + verdict-envelope.v1 schema reason_code doc-comment): when underlying substrate availability='degraded_stale' on a block driving a substance-derived reason, the substance-derived tier is PRESERVED and the reason_code OVERRIDES to VERDICT_DEGRADED_STALE. This fixture's substance signal is HAS_REMEDIATION (remediation.fix present); freshness=degraded_stale → status=WARN (preserved) + reason_code=VERDICT_DEGRADED_STALE (overridden). Server-side VERDICT_DEGRADED_STALE is architecturally distinct from client-side LIVE_DEGRADED cache-fallback state.",
-  "status": "WARN",
-  "reason_code": "VERDICT_DEGRADED_STALE",
-  "human_message": "stale-cache-fixture 1.0.0 — remediation data is stale (since 2026-05-21); WARN preserved, reason overridden to freshness.",
-  "as_of": "2026-05-28",
-  "remediation": {
-    "fix": {
-      "availability": "degraded_stale",
-      "as_of": "2026-05-21"
-    }
-  },
-  "availability": {
-    "kev": "available",
-    "epss": "available",
-    "exploitation_fusion": "available"
-  }
-}

cleanlib_sdk-0.4.3/tests/fixtures/contract-fixtures/fixtures/verdict-deny-exploitation-critical.json

@@ -1,21 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: exploitability.exploitation_likelihood='CRITICAL' → status=DENY, reason_code=VERDICT_EXPLOITATION_CRITICAL. Highest substance precedence — fires before KEV / obfuscation / remediation / abandonment checks.",
-  "status": "DENY",
-  "reason_code": "VERDICT_EXPLOITATION_CRITICAL",
-  "human_message": "log4j-style-fixture 2.14.0 — CRITICAL active exploitation; immediate action required.",
-  "as_of": "2026-05-28",
-  "exploitability": {
-    "exploitation_likelihood": "CRITICAL",
-    "in_kev": true,
-    "exploit_risk_score": 99,
-    "kev": {
-      "cve_id": "CVE-2021-FIXTURE",
-      "date_added": "2021-12-15"
-    }
-  },
-  "availability": {
-    "kev": "available",
-    "epss": "available",
-    "exploitation_fusion": "available"
-  }
-}

cleanlib_sdk-0.4.3/tests/fixtures/contract-fixtures/fixtures/verdict-deny-kev.json

@@ -1,21 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: exploitability.in_kev=true AND exploitability.availability.kev='available' AND exploitability.exploit_risk_score>=70 → status=DENY, reason_code=VERDICT_KEV_LISTED. All three conditions required; ablating any one drops to lower precedence.",
-  "status": "DENY",
-  "reason_code": "VERDICT_KEV_LISTED",
-  "human_message": "kev-listed-fixture 1.0.0 — listed in CISA KEV (CVE-2024-FIXTURE); high exploit-risk.",
-  "as_of": "2026-05-28",
-  "exploitability": {
-    "in_kev": true,
-    "exploit_risk_score": 85,
-    "exploitation_likelihood": "HIGH",
-    "kev": {
-      "cve_id": "CVE-2024-FIXTURE",
-      "date_added": "2024-08-15"
-    }
-  },
-  "availability": {
-    "kev": "available",
-    "epss": "available",
-    "exploitation_fusion": "available"
-  }
-}

cleanlib_sdk-0.4.3/tests/fixtures/contract-fixtures/fixtures/verdict-unreachable.json

@@ -1,16 +0,0 @@
-{
-  "_doc": "OUT-OF-BAND transport-error result — NOT a VerdictEnvelopeV1. This fixture documents the SDK's transport-failure shape (`HttpRemediationClient.getRemediation → {kind:'transient', error}` per sdk-js types/remediation.d.ts). The CLI maps this to UNREACHABLE + exit 3; the VS Code extension maps to its client-tier LIVE_DEGRADED status-bar state (architecturally distinct from server-side VERDICT_DEGRADED_STALE per dispatch §2.3 ratification + verdict-envelope.v1 schema doc-comment). The envelope schema's status enum is [ALLOW, WARN, DENY] only — UNREACHABLE has no envelope; it is by definition the absence-of-envelope path.",
-  "_kind": "transport_error_synthetic",
-  "_envelope": null,
-  "transport_error": {
-    "kind": "transient",
-    "message": "connection refused / DNS NXDOMAIN / 5xx after retry budget exhausted",
-    "endpoint": "https://cleanlib-enrich.clnstrt.dev"
-  },
-  "_expected_client_state": {
-    "cli_exit_code": 3,
-    "cli_status_label": "UNREACHABLE",
-    "extension_status_bar": "LIVE_DEGRADED",
-    "reason_code_when_envelope_assembled_from_cache_hit": "CLIENT_NETWORK_UNREACHABLE"
-  }
-}

cleanlib_sdk-0.4.3/tests/fixtures/contract-fixtures/fixtures/verdict-warn-abandoned.json

@@ -1,14 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: rich_data.abandonment_score >= 0.7 → status=WARN, reason_code=VERDICT_ABANDONED. Score field MUST drive the derivation; reason text is descriptive only.",
-  "status": "WARN",
-  "reason_code": "VERDICT_ABANDONED",
-  "human_message": "stale-lib-fixture 0.9.0 — abandoned (no commits since 2022; 0 active maintainers).",
-  "as_of": "2026-05-28",
-  "rich_data": {
-    "abandonment_score": 0.85,
-    "repo_health": {
-      "last_commit_at": "2022-01-15T00:00:00Z",
-      "maintainer_count": 0
-    }
-  }
-}

cleanlib_sdk-0.4.3/tests/fixtures/contract-fixtures/fixtures/verdict-warn-has-remediation.json

@@ -1,17 +0,0 @@
-{
-  "_doc": "DeriveStatus contract: remediation.fix OR remediation.recommended_version present (under remediation block, not rich_data) → status=WARN, reason_code=VERDICT_HAS_REMEDIATION. Distinction vs verdict-allow-recommended: this fixture's recommended_version sits under remediation (signals active vuln with fix path); the allow-recommended fixture has rich_data.recommended_version (benign upgrade hint, no active vuln). Per dispatch §3.2 block tie-break: fix > recommended_version > other blocks.",
-  "status": "WARN",
-  "reason_code": "VERDICT_HAS_REMEDIATION",
-  "human_message": "vuln-with-fix-fixture 1.0.0 — vulnerable; upgrade available.",
-  "as_of": "2026-05-28",
-  "remediation": {
-    "fix": {
-      "availability": "available",
-      "as_of": "2026-05-20"
-    },
-    "recommended_version": {
-      "availability": "available",
-      "as_of": "2026-05-20"
-    }
-  }
-}

cleanlib_sdk-0.4.3/tests/test_attestation.py

@@ -1,117 +0,0 @@
-"""Cycle-5 SDK ripple — typed attestation field deserialization tests.
-
-Asserts that the new `Verdict.attestation: Optional[SignedAttestation]` field
-deserializes correctly from:
-1. Live cleanapp.clnstrt.dev prod response (PR #87 / prod-v0.1.9 shape)
-2. cycle-4 + cycle-5 pre-PR-#87 responses that omit the field (backwards-compat)
-"""
-
-from __future__ import annotations
-
-from cleanlib_sdk import Attestation, SignedAttestation, Verdict
-
-# Empirical wire-shape captured from cleanapp.clnstrt.dev 2026-05-25 against
-# /v1/customer/verdicts/npm/cors/2.8.4 (PR #87 / prod-v0.1.9 deployed shape).
-LIVE_PROD_RESPONSE = {
-    "verdict_id": "01KDVDNA0000000000000001YK",
-    "verdict": "VECTOR_VERDICT",
-    "source": "VECTOR_VERDICT",
-    "confidence": 0.98,
-    "composite_score": 78,
-    "severity": "HIGH",
-    "reasoning": "Prototype pollution vulnerability in cors 2.8.4; upgrade to 2.8.5 patched release",
-    "similar_to": [],
-    "evidence_gaps": [],
-    "suggested_actions": [
-        "Upgrade to cors@2.8.5 or later",
-        "Audit downstream consumers for prototype pollution exposure",
-    ],
-    "data_freshness_at": "2026-05-20T10:00:00Z",
-    "data_oldest_signal_at": "2026-05-19T10:00:00Z",
-    "stale_since_at": None,
-    "staleness_reason": None,
-    "previous_verdict": None,
-    "computed_at": "2026-05-20T10:30:00Z",
-    "attestation": {
-        "attestation": {
-            "artifact_hash": "8d7c47dc708c15e9ca9a2b1ab9f7360bad7876a3d67cf8d6757d9d652d8176db",
-            "verdict_id": "01KDVDNA0000000000000001YK",
-            "verdict_source": "VECTOR_VERDICT",
-            "verdict_evaluated_at": "2026-05-20T10:30:00Z",
-            "policy_decision": "ALLOW",
-            "policy_rule_id_matched": "",
-            "risk_acceptance_status": "none",
-            "organization_id": "org_dev_anonymous",
-            "app_version": "0.1.0",
-            "served_at": "2026-05-25T02:54:28.199721580Z",
-        },
-        "signature_b64": "MEUCIQDyz1ImG33JyKRfmtYD8BuEqxuVm0eNR7WFx+lqq/vNXAIgKokBPl58yWYScWXaGzaaRW9VFrYUeRVCodI7WBD047g=",
-        "key_id": "local-ecdsa-p256-test",
-    },
-}
-
-
-def test_verdict_deserializes_attestation_field_from_live_prod_response():
-    v = Verdict.model_validate(LIVE_PROD_RESPONSE)
-    assert v.attestation is not None
-    assert isinstance(v.attestation, SignedAttestation)
-    assert v.attestation.key_id == "local-ecdsa-p256-test"
-    assert v.attestation.signature_b64.startswith("MEUCI")
-
-
-def test_attestation_inner_payload_binds_to_verdict_id():
-    """Per PR #87 verdict-id binding correctness test mirror."""
-    v = Verdict.model_validate(LIVE_PROD_RESPONSE)
-    inner = v.attestation.attestation
-    assert isinstance(inner, Attestation)
-    assert inner.verdict_id == v.verdict_id
-    assert inner.verdict_source == "VECTOR_VERDICT"
-
-
-def test_attestation_artifact_hash_is_64_char_hex():
-    """Sha256 hex shape — sister-assertion to PR #87 test layer."""
-    v = Verdict.model_validate(LIVE_PROD_RESPONSE)
-    h = v.attestation.attestation.artifact_hash
-    assert len(h) == 64
-    assert all(c in "0123456789abcdef" for c in h.lower())
-
-
-def test_attestation_policy_decision_is_allow_for_verdict_attestation_layer():
-    """Per PR #87 Path β Option (a): verdict-attestation layer is
-    policy-agnostic; policy_decision = ALLOW (neutral) is the canonical
-    marker that this is a verdict-attestation, NOT a byte-serve attestation."""
-    v = Verdict.model_validate(LIVE_PROD_RESPONSE)
-    assert v.attestation.attestation.policy_decision == "ALLOW"
-    assert v.attestation.attestation.policy_rule_id_matched == ""
-
-
-def test_verdict_backwards_compat_when_attestation_absent():
-    """cycle-4 mock fixtures + cycle-5-pre-PR-#87 responses omitted the field.
-    SDK MUST deserialize cleanly without it (Optional[...] default None)."""
-    response_without_attestation = {k: v for k, v in LIVE_PROD_RESPONSE.items() if k != "attestation"}
-    v = Verdict.model_validate(response_without_attestation)
-    assert v.attestation is None
-    # All other fields still parse correctly
-    assert v.verdict_id == "01KDVDNA0000000000000001YK"
-    assert v.confidence == 0.98
-
-
-def test_verdict_handles_null_attestation_value_gracefully():
-    """If App ships an explicit null (e.g. signing failure with explicit None
-    on the wire instead of skip_serializing_if), SDK still deserializes."""
-    response_with_null = dict(LIVE_PROD_RESPONSE)
-    response_with_null["attestation"] = None
-    v = Verdict.model_validate(response_with_null)
-    assert v.attestation is None
-
-
-def test_signed_attestation_roundtrips_through_model_dump():
-    """Verify the SDK can serialize the attestation back to wire shape.
-    Useful for SDK consumers that want to forward or store the attestation."""
-    v = Verdict.model_validate(LIVE_PROD_RESPONSE)
-    dumped = v.model_dump(mode="json", exclude_none=True)
-    assert dumped["attestation"]["signature_b64"] == LIVE_PROD_RESPONSE["attestation"]["signature_b64"]
-    assert (
-        dumped["attestation"]["attestation"]["artifact_hash"]
-        == LIVE_PROD_RESPONSE["attestation"]["attestation"]["artifact_hash"]
-    )

cleanlib_sdk-0.4.3/tests/test_client_construct.py

@@ -1,46 +0,0 @@
-"""Construction smoke tests — verify Client + endpoint validation behavior."""
-
-from __future__ import annotations
-
-import pytest
-
-from cleanlib_sdk import Client
-from cleanlib_sdk.errors import TransportError
-
-
-def test_client_constructs_with_https_endpoint():
-    c = Client(endpoint="https://cleanapp.clnstrt.dev", api_key="clk_test")
-    assert c.base_url == "https://cleanapp.clnstrt.dev"
-    assert c.api_version == "v1"
-    assert c.api_key == "clk_test"
-
-
-def test_client_strips_trailing_slash_from_endpoint():
-    c = Client(endpoint="https://cleanapp.clnstrt.dev/", api_key="clk_test")
-    assert c.base_url == "https://cleanapp.clnstrt.dev"
-
-
-def test_client_rejects_http_remote_endpoint():
-    with pytest.raises(TransportError, match="TLS required"):
-        Client(endpoint="http://cleanapp.clnstrt.dev", api_key="clk_test")
-
-
-def test_client_allows_http_localhost():
-    c = Client(endpoint="http://localhost:8080", api_key="clk_test")
-    assert "localhost" in c.base_url
-
-
-def test_client_allows_http_127_loopback():
-    c = Client(endpoint="http://127.0.0.1:8080", api_key="clk_test")
-    assert c.base_url == "http://127.0.0.1:8080"
-
-
-def test_client_constructs_without_api_key():
-    """API key optional at construction; unauthenticated calls will fail server-side."""
-    c = Client(endpoint="https://cleanapp.clnstrt.dev")
-    assert c.api_key is None
-
-
-def test_client_custom_api_version():
-    c = Client(endpoint="https://cleanapp.clnstrt.dev", api_key="k", api_version="v2")
-    assert c.api_version == "v2"