codapact 0.1.0__tar.gz

codapact-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+  workflow_call:
+permissions:
+  contents: read
+jobs:
+  title:
+    name: Conventional PR title
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check title
+        env:
+          TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          pattern='^(feat|fix|perf|docs|build|ci|refactor|test|chore|style|revert)(\([^)]+\))?!?: .+'
+          [[ "$TITLE" =~ $pattern ]]
+  check:
+    name: Python ${{ matrix.python }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python: ['3.13', '3.14']
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: ${{ matrix.python }}
+          enable-cache: false
+      - run: uv sync --locked
+      - run: uv run poe check
+      - run: uv build
+      - run: uv run twine check --strict dist/*
+  passed:
+    name: CI passed
+    if: always()
+    needs: [check, title]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require all checks
+        env:
+          RESULT: ${{ needs.check.result }}
+          TITLE_RESULT: ${{ needs.title.result }}
+        run: |
+          test "$RESULT" = success
+          test "$TITLE_RESULT" = success || test "$TITLE_RESULT" = skipped

codapact-0.1.0/.github/workflows/mutation-alerts.yml

@@ -0,0 +1,73 @@
+name: Mutation alerts
+on:
+  workflow_run: # zizmor: ignore[dangerous-triggers] -- only same-repo main push/schedule/manual evidence; fixed-main checkout; artifacts parsed as data, never executed
+    workflows: [Mutation]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      selftest:
+        description: Verify issue creation, update, deduplication, and recovery using an isolated test incident
+        type: boolean
+        required: true
+        default: true
+permissions:
+  contents: read
+concurrency:
+  group: mutation-alerts
+  cancel-in-progress: false
+jobs:
+  validate-ref:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reject non-default manual refs
+        run: test "$GITHUB_REF" = refs/heads/main
+  reconcile:
+    needs: validate-ref
+    # Only trusted main results; never a pull_request or fork write context.
+    if: >-
+      github.ref == 'refs/heads/main' &&
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event.workflow_run.head_repository.full_name == github.repository &&
+        github.event.workflow_run.head_branch == 'main' &&
+        contains(fromJSON('["push","schedule","workflow_dispatch"]'), github.event.workflow_run.event)))
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+      issues: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: main
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: '3.13'
+          enable-cache: false
+      - name: Download evidence from the trusted main run
+        if: github.event_name == 'workflow_run'
+        continue-on-error: true
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: mutation-report
+          path: mutation-report/
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+      - name: Reconcile durable production alerts
+        if: github.event_name == 'workflow_run'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MUTATION_SHA: ${{ github.event.workflow_run.head_sha }}
+          MUTATION_RUN_URL: ${{ github.event.workflow_run.html_url }}
+          MUTATION_CONCLUSION: ${{ github.event.workflow_run.conclusion }}
+          MUTATION_RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
+        run: uv run --no-project python scripts/mutation_alerts.py
+      - name: Verify hosted alert lifecycle
+        if: github.event_name == 'workflow_dispatch' && inputs.selftest
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MUTATION_SHA: ${{ github.sha }}
+          MUTATION_RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: uv run --no-project python scripts/mutation_alerts.py --selftest

codapact-0.1.0/.github/workflows/mutation.yml

@@ -0,0 +1,55 @@
+name: Mutation
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '23 6 * * 1'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: mutation-main
+  cancel-in-progress: false
+jobs:
+  validate-ref:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reject non-default manual refs
+        run: test "$GITHUB_REF" = refs/heads/main
+  scan:
+    needs: validate-ref
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: '3.13'
+          enable-cache: false
+      - run: uv sync --locked --group mutation
+      - name: Run bounded asynchronous mutation analysis
+        run: |
+          mkdir -p mutation-report
+          set +e
+          timeout --signal=TERM --kill-after=10s 18m uv run --group mutation mutmut run --max-children 2 > mutation-report/run.log 2>&1
+          code=$?
+          uv run --group mutation mutmut export-cicd-stats >> mutation-report/run.log 2>&1
+          uv run --group mutation mutmut results --all true > mutation-report/results.txt 2>&1
+          results_code=$?
+          tar -czf mutation-report/mutants.tar.gz -C mutants/src codapact
+          archive_code=$?
+          if test "$code" -eq 0 && { test "$results_code" -ne 0 || test "$archive_code" -ne 0; }; then
+            code=1
+          fi
+          uv run python scripts/mutation_report.py --exit-code "$code" --stats mutants/mutmut-cicd-stats.json --output mutation-report/report.json
+      - name: Preserve evidence on failure or incomplete run
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: mutation-report
+          path: mutation-report/
+          if-no-files-found: warn
+          retention-days: 30

codapact-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,88 @@
+name: Release
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: release
+  cancel-in-progress: false
+jobs:
+  version:
+    # Repository and publisher setup must be completed before enabling releases.
+    if: vars.RELEASES_ENABLED == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      actions: write
+      pull-requests: write
+      issues: write
+    outputs:
+      created: ${{ steps.release.outputs.release_created }}
+      tag: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - id: release
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+      - name: Start CI for release pull request
+        if: steps.release.outputs.prs_created == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_JSON: ${{ steps.release.outputs.pr }}
+        run: |
+          branch=$(jq -r '.headBranchName' <<< "$PR_JSON")
+          gh workflow run ci.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
+  ci:
+    needs: version
+    if: needs.version.outputs.created == 'true'
+    uses: ./.github/workflows/ci.yml # zizmor: ignore[self-repository] -- portable local reuse, matching VerdiClip
+    permissions:
+      contents: read
+  build:
+    needs: [version, ci]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ needs.version.outputs.tag }}
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          enable-cache: false
+      - run: uv sync --locked
+      - run: uv build
+      - run: uv run twine check --strict dist/*
+      - name: Verify distribution and tag versions
+        env:
+          RELEASE_TAG: ${{ needs.version.outputs.tag }}
+        run: uv run python scripts/verify_dist.py
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist/
+  publish:
+    needs: [version, build]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+      attestations: write
+      contents: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist/
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/*
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+      - name: Attach distributions
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ needs.version.outputs.tag }}
+        run: gh release upload "$TAG" dist/* --repo "$GITHUB_REPOSITORY"

codapact-0.1.0/.release-please-manifest.json

@@ -0,0 +1 @@
+{".":"0.1.0"}

codapact-0.1.0/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## 0.1.0 (2026-10-29)
+
+### Features
+
+* add generation manifests and XDG runtime profiles ([cd0e6a2](https://github.com/mikejhill/codapact/commit/cd0e6a20e813423d3b33ca5ba277a036c482dd8c))
+* initialize codapact ([7daa7e2](https://github.com/mikejhill/codapact/commit/7daa7e2534bdd59bcd555dc90ec2e97a002f130c))
+
+### Bug Fixes
+
+* document generated commands and release handoff ([9ea472c](https://github.com/mikejhill/codapact/commit/9ea472ca5e3cfe9fdf4bbc94bb22511d87eece22))
+* harden contracts and add mutation alerts ([b4b1a06](https://github.com/mikejhill/codapact/commit/b4b1a06d2029a53fa68783f6ecd1c0dedb7854e2))
+* reconcile asynchronous mutation alerts ([ba1737d](https://github.com/mikejhill/codapact/commit/ba1737d33f9e6157a7d9fe6f6c8b1d2878917dec))

codapact-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mike Hill
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

codapact-0.1.0/PKG-INFO

@@ -0,0 +1,62 @@
+Metadata-Version: 2.4
+Name: codapact
+Version: 0.1.0
+Summary: Contracts into callable tools: pluggable API client and CLI generation.
+License-Expression: MIT
+License-File: LICENSE
+Requires-Dist: pyyaml>=6.0.3,<7
+Requires-Dist: jsonschema>=4.25.1,<5
+Requires-Python: >=3.13
+Project-URL: Homepage, https://github.com/mikejhill/codapact
+Project-URL: Documentation, https://github.com/mikejhill/codapact#readme
+Project-URL: Changelog, https://github.com/mikejhill/codapact/blob/main/CHANGELOG.md
+Project-URL: Issues, https://github.com/mikejhill/codapact/issues
+Description-Content-Type: text/markdown
+
+# CodaPact
+
+![CodaPact wordmark](branding/wordmark.svg)
+
+**Contracts into callable tools.**
+
+This first iteration generates an installable, typed Python client and a
+scriptable CLI from a local or remote OpenAPI contract. The package, module, and
+generator CLI are named `codapact`. Install a published release with
+`uv tool install codapact`, or use the source workflow below.
+
+```powershell
+uv sync
+uv run codapact generate examples/pets.yaml --output .tmp/pets-client --package pets_client
+uv build
+uv pip install --no-deps .tmp/pets-client
+uv run pets-client --config examples/runtime.json get-pet --arg-pet-id 7
+```
+
+The example server address is intentionally inert. Override `base_url` with your
+own trusted endpoint and set the environment variable referenced by the runtime
+configuration. Tests use isolated loopback HTTP servers and synthetic credentials.
+
+```python
+from pets_client import Client
+
+client = Client(settings={"auth": {"token": {"env": "PETS_TOKEN"}}})
+pet = client.get_pet(parameters={"pet_id": 7})
+```
+
+Reusable generation values are supported with `uv run codapact generate
+--manifest examples/pets.codapact.yaml`. The resulting `pets` command discovers
+`config.json` and `auth.json` in `$XDG_CONFIG_HOME/pets` or `~/.config/pets`.
+Override its directory with `pets --config-dir PATH ...`. See the configuration
+guide for precedence, credential-file permissions, and every generation override.
+
+- [Architecture and extension contracts](docs/architecture.md)
+- [Supported features and safety boundaries](docs/support.md)
+- [CLI definition and runtime configuration](docs/configuration.md)
+- [Release process](docs/releasing.md)
+- [Verification evidence and limits](docs/verification.md)
+- [Asynchronous mutation testing and open alerts](docs/mutation.md)
+
+Run `uv run poe check` for formatting, lint, type checking, and tests. Generated
+packages depend on this runtime at the exact generator version. For unreleased
+source changes, install the local runtime wheel and generated wheel together.
+The end-to-end test proves that workflow in a fresh environment.

codapact-0.1.0/README.md

@@ -0,0 +1,47 @@
+# CodaPact
+
+![CodaPact wordmark](branding/wordmark.svg)
+
+**Contracts into callable tools.**
+
+This first iteration generates an installable, typed Python client and a
+scriptable CLI from a local or remote OpenAPI contract. The package, module, and
+generator CLI are named `codapact`. Install a published release with
+`uv tool install codapact`, or use the source workflow below.
+
+```powershell
+uv sync
+uv run codapact generate examples/pets.yaml --output .tmp/pets-client --package pets_client
+uv build
+uv pip install --no-deps .tmp/pets-client
+uv run pets-client --config examples/runtime.json get-pet --arg-pet-id 7
+```
+
+The example server address is intentionally inert. Override `base_url` with your
+own trusted endpoint and set the environment variable referenced by the runtime
+configuration. Tests use isolated loopback HTTP servers and synthetic credentials.
+
+```python
+from pets_client import Client
+
+client = Client(settings={"auth": {"token": {"env": "PETS_TOKEN"}}})
+pet = client.get_pet(parameters={"pet_id": 7})
+```
+
+Reusable generation values are supported with `uv run codapact generate
+--manifest examples/pets.codapact.yaml`. The resulting `pets` command discovers
+`config.json` and `auth.json` in `$XDG_CONFIG_HOME/pets` or `~/.config/pets`.
+Override its directory with `pets --config-dir PATH ...`. See the configuration
+guide for precedence, credential-file permissions, and every generation override.
+
+- [Architecture and extension contracts](docs/architecture.md)
+- [Supported features and safety boundaries](docs/support.md)
+- [CLI definition and runtime configuration](docs/configuration.md)
+- [Release process](docs/releasing.md)
+- [Verification evidence and limits](docs/verification.md)
+- [Asynchronous mutation testing and open alerts](docs/mutation.md)
+
+Run `uv run poe check` for formatting, lint, type checking, and tests. Generated
+packages depend on this runtime at the exact generator version. For unreleased
+source changes, install the local runtime wheel and generated wheel together.
+The end-to-end test proves that workflow in a fresh environment.

codapact-0.1.0/branding/mark.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" role="img" aria-labelledby="title desc">
+  <title id="title">CodaPact</title>
+  <desc id="desc">A coda-inspired open ring with a shared vertical axis and two balanced horizontal strokes.</desc>
+  <path d="M50 29a37 37 0 0 0 0 70M78 29a37 37 0 0 1 0 70" fill="none" stroke="#15a99b" stroke-width="12" stroke-linecap="round"/>
+  <path d="M64 12v104" fill="none" stroke="#18283e" stroke-width="10" stroke-linecap="round"/>
+  <path d="M13 64h38m26 0h38" fill="none" stroke="#18283e" stroke-width="10" stroke-linecap="round"/>
+  <circle cx="64" cy="64" r="7" fill="#d99732"/>
+</svg>

codapact-0.1.0/branding/wordmark.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="500" height="166" viewBox="0 0 500 166" role="img" aria-labelledby="title desc">
+  <title id="title">CodaPact — Contracts into callable tools</title>
+  <desc id="desc">A teal coda mark and navy wordmark, with an amber central accent.</desc>
+  <g transform="translate(10 19)">
+    <path d="M50 29a37 37 0 0 0 0 70M78 29a37 37 0 0 1 0 70" fill="none" stroke="#15a99b" stroke-width="12" stroke-linecap="round"/>
+    <path d="M64 12v104M13 64h38m26 0h38" fill="none" stroke="#18283e" stroke-width="10" stroke-linecap="round"/>
+    <circle cx="64" cy="64" r="7" fill="#d99732"/>
+  </g>
+  <text x="166" y="88" fill="#18283e" font-family="Segoe UI,Inter,Arial,sans-serif" font-size="67" font-weight="650" letter-spacing="-2">CodaPact</text>
+  <text x="170" y="125" fill="#52627a" font-family="Segoe UI,Inter,Arial,sans-serif" font-size="22">Contracts into callable tools.</text>
+</svg>

codapact-0.1.0/docs/architecture.md

@@ -0,0 +1,74 @@
+# Architecture
+
+Python 3.13 is the initial implementation and generated language. It fits the
+existing uv-based release process and supports typed dictionaries without a
+large code generation framework. Runtime schemas validate data independently
+of static annotations. TypeScript remains a future target.
+
+```mermaid
+flowchart LR
+  A[Bounded JSON/YAML loader] --> B[Contract translator plugin]
+  B --> C[Version 1 shared IR]
+  C --> D[Python generator plugin]
+  C --> E[CLI generator plugin]
+  D --> F[Ownership manifest]
+  E --> F
+  F --> G[Generated client and CLI]
+  G --> H[Authorization policy]
+  H --> I[Authentication provider]
+  I --> J[Transport]
+```
+
+## Layer contracts
+
+| Layer | Initial implementation | Extension boundary |
+| --- | --- | --- |
+| Loading | Bounded JSON/YAML; local files and HTTP(S) | Explicit transport injection |
+| Translation | OpenAPI 3.0 JSON HTTP subset | `Translator.translate(document) -> Contract` |
+| Shared model | Frozen contract and operation records; schema dictionaries | IR major version, metadata, capability identifiers |
+| Library generation | Typed dictionaries, typed methods, JSON IR resource | `Generator.generate(contract, package) -> files` |
+| CLI generation | Version 1 definition, argparse commands | Independent generator and CLI runtime |
+| Execution | Schema validation and JSON serialization | Generated client inherits `ClientBase` |
+| Authentication | Environment-backed bearer, basic, header API key | `AuthProvider.headers(name, scheme)` |
+| Policy | Operation allow/deny lists | `AuthorizationPolicy.authorize(operation)` |
+| Transport | Pinned DNS, bounded HTTP, verified TLS | `Transport.send(...) -> Response` |
+| Orchestration | Explicit registry, capability negotiation, ownership checks | Registry supplied to `generate` |
+
+Plugin API version 1 and IR version 1 are separate contracts. Registration rejects
+duplicate names and incompatible API versions. Targets declare required
+capabilities; translators declare capabilities they can produce. Plugins are
+trusted Python objects registered by the host application, never imported from
+contract or configuration strings. A fixture translator and operation-index
+generator exercise a complete alternate plugin path in tests.
+
+The normalized IR records operations, parameter schemas, JSON request bodies,
+successful and error response schemas, named component types, security OR/AND
+requirements, and extensible metadata. OAuth2, GraphQL, Turbo-Stream, gRPC,
+streaming transports, other languages, and other CLI styles are future plugins.
+They are not implemented or advertised as supported.
+
+## Custom runtime hooks
+
+Pass `auth=`, `policy=`, and `transport=` objects to a generated `Client`. Hooks
+are explicit application code. An auth provider returns headers or raises
+`AuthError` when credentials are unavailable. A policy raises `PolicyError`
+before credentials are resolved and before network activity. Transport plugins
+must preserve redirect, credential, timeout, and response-size guarantees.
+
+The generated CLI uses the declarative built-in hooks. Applications needing
+custom hooks can call `run_cli` with their own client factory. No configuration
+option dynamically imports code or executes shell commands.
+
+## Regeneration
+
+Generators return relative paths and Unicode file contents. The writer checks
+all planned writes and removals before mutation, verifies SHA-256 ownership,
+refuses modified/unowned files, rejects traversal and symlinks/junctions, and
+preserves unrelated files. Obsolete owned files are removed. The manifest is
+deterministic and written last; each file replacement is atomic.
+
+A multi-file update is not an atomic filesystem transaction. If interrupted,
+the next run fails closed on mismatched ownership. Preserve edited files and
+generate into a new directory to recover. Concurrent generation into the same
+directory is unsupported. Local plugins and users able to race filesystem
+mutations are trusted; this is not an operating-system sandbox.

codapact-0.1.0/docs/branding.md

@@ -0,0 +1,25 @@
+# CodaPact identity
+
+**CodaPact** joins a musical coda, code, a contract, and the idea of impact.
+The tagline is **Contracts into callable tools.**
+
+The original mark takes the coda's circle and axes and opens the ring into two
+balanced boundaries. It suggests a shared contract between interchangeable
+implementations. The amber center marks the point where a definition becomes
+an executable call. The identity uses a single symbol, without a collage of
+music notes, terminal windows, and paperwork.
+
+| Role | Color |
+| --- | --- |
+| Wordmark and axes | Navy `#18283e` |
+| Open ring | Teal `#15a99b` |
+| Execution point | Amber `#d99732` |
+| Supporting text | Slate `#52627a` |
+
+Use [the wordmark](../branding/wordmark.svg) on light backgrounds and
+[the standalone mark](../branding/mark.svg) where space is limited. SVGs use
+system fonts and contain no scripts, external resources, or embedded images.
+
+Mike selected the name on 2026-10-29. Preliminary exact-name repository and
+registry searches found no obvious collisions. This is not a reservation or
+legal clearance; recheck before publication.