creed-space-cli 0.1.0__py3-none-any.whl

creed_cli/.gitignore

@@ -0,0 +1,316 @@
+# Local per-collaborator overrides (top of Scope Hierarchy; must not be committed)
+CLAUDE.local.md
+
+# Build artifacts
+bin/creed-crypto
+
+# Dependencies
+node_modules
+node_modules/
+.pnp
+.pnp.js
+venv/
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.Python
+.mypy_cache/
+env/
+build/
+dist/
+*.egg-info/
+
+# Testing
+coverage/
+*.lcov
+.nyc_output
+.coverage
+.coverage.*
+htmlcov/
+.pytest_cache/
+
+# Production
+/build
+/dist
+*/dist
+*/build
+
+# SvelteKit build artifacts
+.svelte-kit/
+*/.svelte-kit/
+
+# Logs and output files
+logs
+*.log
+*.out
+
+# Backup files
+*.bak
+*.backup
+*.old
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+# Environment (comprehensive — covers .env, .env.*, and *.env)
+.env
+.env.*
+*.env
+
+# IDE
+.vscode/*
+!.vscode/extensions.json
+!.vscode/settings.json.example
+.idea
+*.swp
+*.swo
+*~
+.DS_Store
+# macOS AppleDouble sidecars and archive metadata (non-UTF-8; crash py scans)
+._*
+__MACOSX/
+
+# Turborepo
+.turbo
+
+# Changesets
+.changeset/
+
+# Temporary
+tmp/
+temp/
+*.tmp
+
+# Production PostgreSQL configuration
+.env.production.postgresql
+.mypy_baseline.json
+
+# Test artifacts and reports
+test_artifacts/
+test-results/
+test_results/
+test_reports/
+reports/memory/
+reports/fagan/
+reports/performance/
+reports/qa/
+reports/qa-crawl/*/
+output/playwright/
+test*.db
+dump.rdb
+
+# Large regenerable artifacts — build output, research dumps (never in git history)
+superego-frontend/output/
+research/fablereconstruction/
+
+# SSL private material (never commit secrets)
+ssl/*.key
+ssl/*.srl
+ssl/*.csr
+
+# Temporary test files
+test-*.html
+test-*.js
+test_*.html
+test_*.js
+
+# Report files in root (should be in reports/)
+*_report*.json
+*_report*.md
+fagan*.json
+memory_leak*.json
+smart_memory*.json
+security-scan*.json
+# Re-assert env exclusions for nested paths
+config/*.env
+superego-frontend/.env*
+!.env.example
+!.env.template
+!.env.staging.example
+!superego-frontend/.env.example
+data/sessions/superego.db
+docs/UVC_CSM_EMOJI_DUMP.md
+*.db
+*.db-shm
+*.db-wal
+
+
+# Signing keys (never commit private key material)
+*.key
+data/constitutions/registry/.keys/signing.key
+data/attestation_keys/*.pem
+
+# Browser/session state
+cookies.txt
+**/cookies.txt
+
+# Secrets directory (salts, encrypted keys — never commit)
+data/secrets/
+# Local JWT/encryption key material (finding #6: .secrets/jwt_secret has no .key suffix
+# so *.key alone did not cover it). Rotate + untrack existing tracked copies separately.
+.secrets/
+
+# GPG keyring (contains private key)
+data/keys/.gnupg/
+.venv
+.venv_check/
+
+# Coverage reports
+coverage.xml
+
+# Test artifacts in registry
+data/constitutions/registry/test_safety_*.json
+
+# ML Model Cache
+.cache/
+# Hypothesis database (property-based testing)
+.hypothesis/
+.mcp.json
+
+# Runtime data (not source code)
+data/compliance_reports/
+data/gdpr_trust_states.json
+data/billing/dead_letters/
+data/audit_logs/
+services/data/audit_logs/
+profiling_data/
+memory/superego/welfare/
+:memory:
+
+# Flash Review Cache
+.flash_findings.json
+.flash_full_review_checkpoint.json
+.review_for_claude.diff
+reports/flash_full_review_*.json
+reports/flash_full_review_*.md
+reports/red_team_audit/
+data/deployment_snapshots/snapshot_*/
+archives/reports/untracked/
+
+# Runtime audit logs (regenerated, can contain sensitive session metadata)
+data/audit/*.jsonl
+
+# Security audit reports (regenerable, large files)
+archives/docs/security/security_audit_*.json
+archives/docs/security/security_audit_*.txt
+archives/docs/security/type_safety_report.json
+**/security_audit_*.json
+**/security_audit_*.txt
+
+# Gitleaks and security scan reports (regenerable)
+gitleaks-report.json
+bandit_report.json
+
+# UVC debug dumps (keep UVC_CSM_EMOJI_COMPLETE_DUMP.json - it's conversation history)
+
+# Playwright MCP artifacts
+.playwright-mcp/
+
+# LibreOffice lock files
+.~lock.*
+
+# Claude Code agent execution logs
+.code/agents/*/exec-call_*.txt
+# Claude Code agent worktrees (isolated agent copies)
+.claude/worktrees/
+.flash_costs.json
+
+# Large benchmark results (use Git LFS or external storage)
+benchmarks/results/*.jsonl
+logs/flash_review.log
+
+# Archived audit logs (local reference only)
+archives/audit_logs/
+
+# Mutation Testing
+reports/mutation/*.html
+reports/mutation/*.json
+reports/mutation/*.sqlite
+reports/mutation/*.toml
+superego-frontend/mutation-report/
+superego-frontend/mutation-report.json
+superego-frontend/.stryker-tmp/
+superego-frontend/.stryker-tmp-*/
+.stryker-tmp/
+.stryker-tmp-*/
+
+# Performance benchmark baselines
+.benchmarks/
+# Rust build artifacts
+crates/*/target/
+/target/
+
+# Session diaries and retrospectives (PRIVATE - never commit)
+memory/diary/
+memory/retrospective/
+scripts/test_api_keys.py
+
+# Vector stores (too large for GitHub)
+memory/vector_stores/
+
+# Session transcript backups (local only)
+memory/transcript_backups/
+mettle-api/
+
+# Screenshots (use archives/ or external storage)
+*.png
+*.jpg
+*.jpeg
+!superego-frontend/static/**/*.png
+!superego-frontend/static/**/*.jpg
+!docs/**/*.png
+# public/ is the served static-asset dir — its brand images are deliberate app
+# assets, not screenshots. Without this, *.png assets there 404 in every deploy
+# (e.g. creed-logo.png → blank hero wave) while .webp siblings ship fine.
+!superego-frontend/public/**/*.png
+!superego-frontend/public/**/*.jpg
+!superego-frontend/public/**/*.jpeg
+~$lue Context Protocol MDPI I3D1.docx
+
+# Runtime state (process IDs, lock files)
+.backend.pid
+.frontend.pid
+.claude/scheduled_tasks.lock
+
+# Playwright CLI local snapshots (distinct from .playwright-mcp)
+.playwright-cli/
+creed_guardian/models/
+
+# Model weights (large binaries)
+weights/
+*.gguf
+
+# Paper preparation scripts (moved to _papers/scripts/)
+apply_i3d8_*.py
+diag_*.py
+fix_narrative*.py
+restore_*.py
+validate_docx.py
+deep_validate.py
+compare_structure.py
+check_ordering.py
+minimal_edit.py
+test_repack.py
+test_minimal_edit.py
+diff_parts.py
+probe_refs.py
+strip_numpr_refs.py
+find_*.py
+
+# VCP concordance debug artifacts (binary, not source)
+*.docx
+
+# Fagan reports and audit artifacts
+fagan_*.md
+*_fagan_report*.md
+*_audit_report*.md
+
+# design-sync upload staging (regenerable; source of truth is the claude.ai/design project + .design-sync/)
+ds-bundle/
+fleet-server/target/
+
+# freeze skill session config (per-checkout, not shared)
+.claude/skills/freeze/.active-freeze.json

creed_cli/PKG-INFO

@@ -0,0 +1,179 @@
+Metadata-Version: 2.4
+Name: creed-space-cli
+Version: 0.1.0
+Summary: Creed Space CLI — validate creeds, constitutions, and VCP tokens
+Project-URL: Homepage, https://valuecontextprotocol.org
+Project-URL: Repository, https://github.com/Creed-Space/creedspace
+Author-email: Creed Space <hello@creed.space>
+License-Expression: Apache-2.0
+Keywords: ai,alignment,cli,creed,ethics,safety,values,vcp
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Requires-Dist: jsonschema>=4
+Requires-Dist: pyyaml>=6
+Requires-Dist: vcp-sdk>=0.3
+Provides-Extra: guardian
+Requires-Dist: creed-guardian>=2.0; extra == 'guardian'
+Description-Content-Type: text/markdown
+
+# creed-space-cli
+
+`creed` is a command-line validator for [Creed Space](https://creed.space)
+artifacts: **creeds**, **constitutions**, and **VCP** tokens. It runs locally and
+in CI, needs no authentication, and speaks JSON for machine consumption. Think
+`terraform validate` or `gh`, but for values declarations.
+
+## Install
+
+```bash
+pip install creed-space-cli
+
+# With the optional guardian passthrough (pulls in the creed-guardian runtime):
+pip install creed-space-cli[guardian]
+```
+
+Requires Python 3.10+. Inside the Creed Space monorepo it is available as
+`python -m creed_cli` (or `poetry run creed`) without a separate install; from
+a source checkout, `pip install ./vcp-sdk-python ./creed_cli`.
+
+## Command surface
+
+```
+creed --version
+creed --help
+creed validate <path|dir|string>...  [--type auto|creed|constitution|vcp-lite|vcp-token|csm1]
+                                      [--format text|json] [--strict] [--quiet]
+creed score <creed-file>...          [--min-score N] [--format text|json]
+creed vcp validate <token-or-file>   # VCP token / CSM1 code / VCP-Lite JSON (auto-detected)
+creed vcp parse <token-or-csm1>      # pretty-print the parsed structure
+creed constitution lint <path|dir>... [--format text|json]
+creed guardian <argv...>             # passthrough to the creed-guardian runtime
+```
+
+`validate` is the umbrella command. It auto-detects artifact type:
+
+- `*.creed.md` / `*.creed` → **creed**
+- `.json` / `.yaml` matching the constitution shape, or files under a
+  `constitutions/` directory → **constitution**
+- `vcp:`-prefixed or CSM1-patterned strings, and `.vcp` files → **VCP**
+
+Directories recurse over known extensions. Unknown inputs are reported as
+`skipped` (and become findings under `--strict`). Pass `--type` to override
+detection.
+
+### Exit codes
+
+Every command uses the same convention (also printed in `creed --help`):
+
+| Code | Meaning |
+|------|---------|
+| `0`  | all inputs valid |
+| `1`  | validation findings (at least one artifact failed) |
+| `2`  | usage error / missing input |
+| `3`  | internal error |
+
+`creed guardian` **preserves the exit code** of the underlying `creed-guardian`
+process, so guardian's own status codes propagate unchanged.
+
+## JSON output contract
+
+`--format json` emits a stable, versioned document (schema version `"1"`):
+
+```json
+{
+  "schema_version": "1",
+  "results": [
+    {
+      "path": "data/constitutions/_source/example.yaml",
+      "artifact_type": "constitution",
+      "status": "failed",
+      "findings": [
+        {"severity": "error", "code": "SCHEMA",
+         "message": "...", "location": "$.rules[3]"}
+      ]
+    }
+  ],
+  "summary": {"checked": 12, "passed": 11, "failed": 1, "skipped": 0}
+}
+```
+
+- `status` is one of `passed`, `failed`, `skipped`.
+- `severity` is `error` or `warning`; `code` is a stable machine token.
+- Parse the top-level `summary` for a quick pass/fail count; drive gating logic
+  off the process exit code.
+
+## Guardian passthrough
+
+`creed guardian <argv...>` forwards every argument verbatim to the
+[`creed-guardian`](https://pypi.org/project/creed-guardian/) runtime:
+
+```bash
+creed guardian --help          # prints creed-guardian's help
+creed guardian proxy --port 9090
+creed guardian serve
+creed guardian mcp
+```
+
+If `creed-guardian` is not installed, `creed guardian` prints an install hint
+(`pip install creed-space-cli[guardian]`) and exits `2` rather than crashing.
+
+## CI recipes
+
+### GitHub Actions
+
+```yaml
+# .github/workflows/creed-validate.yml
+name: creed validate
+on: [push, pull_request]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install creed-space-cli
+      - name: Validate constitutions
+        run: creed constitution lint data/constitutions/_source --format json
+      - name: Gate creed quality
+        run: creed score creeds/*.creed.md --min-score 70
+```
+
+The step fails the job automatically when `creed` exits non-zero.
+
+### pre-commit
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: local
+    hooks:
+      - id: creed-validate
+        name: creed validate
+        entry: creed validate
+        language: python
+        additional_dependencies: ["creed-space-cli"]
+        files: '\.(creed\.md|creed)$|constitutions/.*\.(json|ya?ml)$'
+        pass_filenames: true
+```
+
+`pass_filenames: true` hands the staged, matching files to `creed validate`;
+the commit is blocked when validation reports findings.
+
+## Related
+
+- `docs/CREED_CLI.md` — architecture and design overview.
+- [Creed Guardian Quick Start](../docs/CREED_GUARDIAN_QUICKSTART.md) — the
+  local safety runtime behind `creed guardian`.

creed_cli/README.md

@@ -0,0 +1,151 @@
+# creed-space-cli
+
+`creed` is a command-line validator for [Creed Space](https://creed.space)
+artifacts: **creeds**, **constitutions**, and **VCP** tokens. It runs locally and
+in CI, needs no authentication, and speaks JSON for machine consumption. Think
+`terraform validate` or `gh`, but for values declarations.
+
+## Install
+
+```bash
+pip install creed-space-cli
+
+# With the optional guardian passthrough (pulls in the creed-guardian runtime):
+pip install creed-space-cli[guardian]
+```
+
+Requires Python 3.10+. Inside the Creed Space monorepo it is available as
+`python -m creed_cli` (or `poetry run creed`) without a separate install; from
+a source checkout, `pip install ./vcp-sdk-python ./creed_cli`.
+
+## Command surface
+
+```
+creed --version
+creed --help
+creed validate <path|dir|string>...  [--type auto|creed|constitution|vcp-lite|vcp-token|csm1]
+                                      [--format text|json] [--strict] [--quiet]
+creed score <creed-file>...          [--min-score N] [--format text|json]
+creed vcp validate <token-or-file>   # VCP token / CSM1 code / VCP-Lite JSON (auto-detected)
+creed vcp parse <token-or-csm1>      # pretty-print the parsed structure
+creed constitution lint <path|dir>... [--format text|json]
+creed guardian <argv...>             # passthrough to the creed-guardian runtime
+```
+
+`validate` is the umbrella command. It auto-detects artifact type:
+
+- `*.creed.md` / `*.creed` → **creed**
+- `.json` / `.yaml` matching the constitution shape, or files under a
+  `constitutions/` directory → **constitution**
+- `vcp:`-prefixed or CSM1-patterned strings, and `.vcp` files → **VCP**
+
+Directories recurse over known extensions. Unknown inputs are reported as
+`skipped` (and become findings under `--strict`). Pass `--type` to override
+detection.
+
+### Exit codes
+
+Every command uses the same convention (also printed in `creed --help`):
+
+| Code | Meaning |
+|------|---------|
+| `0`  | all inputs valid |
+| `1`  | validation findings (at least one artifact failed) |
+| `2`  | usage error / missing input |
+| `3`  | internal error |
+
+`creed guardian` **preserves the exit code** of the underlying `creed-guardian`
+process, so guardian's own status codes propagate unchanged.
+
+## JSON output contract
+
+`--format json` emits a stable, versioned document (schema version `"1"`):
+
+```json
+{
+  "schema_version": "1",
+  "results": [
+    {
+      "path": "data/constitutions/_source/example.yaml",
+      "artifact_type": "constitution",
+      "status": "failed",
+      "findings": [
+        {"severity": "error", "code": "SCHEMA",
+         "message": "...", "location": "$.rules[3]"}
+      ]
+    }
+  ],
+  "summary": {"checked": 12, "passed": 11, "failed": 1, "skipped": 0}
+}
+```
+
+- `status` is one of `passed`, `failed`, `skipped`.
+- `severity` is `error` or `warning`; `code` is a stable machine token.
+- Parse the top-level `summary` for a quick pass/fail count; drive gating logic
+  off the process exit code.
+
+## Guardian passthrough
+
+`creed guardian <argv...>` forwards every argument verbatim to the
+[`creed-guardian`](https://pypi.org/project/creed-guardian/) runtime:
+
+```bash
+creed guardian --help          # prints creed-guardian's help
+creed guardian proxy --port 9090
+creed guardian serve
+creed guardian mcp
+```
+
+If `creed-guardian` is not installed, `creed guardian` prints an install hint
+(`pip install creed-space-cli[guardian]`) and exits `2` rather than crashing.
+
+## CI recipes
+
+### GitHub Actions
+
+```yaml
+# .github/workflows/creed-validate.yml
+name: creed validate
+on: [push, pull_request]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install creed-space-cli
+      - name: Validate constitutions
+        run: creed constitution lint data/constitutions/_source --format json
+      - name: Gate creed quality
+        run: creed score creeds/*.creed.md --min-score 70
+```
+
+The step fails the job automatically when `creed` exits non-zero.
+
+### pre-commit
+
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: local
+    hooks:
+      - id: creed-validate
+        name: creed validate
+        entry: creed validate
+        language: python
+        additional_dependencies: ["creed-space-cli"]
+        files: '\.(creed\.md|creed)$|constitutions/.*\.(json|ya?ml)$'
+        pass_filenames: true
+```
+
+`pass_filenames: true` hands the staged, matching files to `creed validate`;
+the commit is blocked when validation reports findings.
+
+## Related
+
+- `docs/CREED_CLI.md` — architecture and design overview.
+- [Creed Guardian Quick Start](../docs/CREED_GUARDIAN_QUICKSTART.md) — the
+  local safety runtime behind `creed guardian`.

creed_cli/__init__.py

@@ -0,0 +1,8 @@
+"""Creed Space command-line interface (``creed``).
+
+A lint-style validator for creeds, constitutions, and VCP tokens. Runs locally
+and in CI with no auth. See :mod:`creed_cli.main` for the command surface and
+exit-code contract.
+"""
+
+__version__ = "0.1.0"

creed_cli/__main__.py

@@ -0,0 +1,8 @@
+"""Enable ``python -m creed_cli``."""
+
+import sys
+
+from creed_cli.main import main
+
+if __name__ == "__main__":
+    sys.exit(main())