crovia-tacet-operator 0.3.0__tar.gz

crovia_tacet_operator-0.3.0/PKG-INFO

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: crovia-tacet-operator
+Version: 0.3.0
+Summary: Production operator for TACET: hourly epochs, signed surface snapshots, OTS anchoring, silence proofs as crovia.seal.v1
+Author-email: Crovia Trust <info@croviatrust.com>
+License: Apache-2.0
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: crovia-tacet>=0.3.0
+Requires-Dist: cryptography>=41.0.0
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+
+# TACET operator
+
+Runs the TACET log in production. The [reference](../reference/python) defines
+the objects; this package fetches, signs, anchors and publishes them.
+
+```
+every hour   tacet-operator run-epoch        drand round → observe surfaces → update map → sign sheet → OTS stamp
+every 6 h    tacet-operator refresh-anchors  upgrade OTS proofs; close sheets confirmed in Bitcoin
+daily        tacet-operator publish --proofs rebuild featured silence proofs (crovia.seal.v1)
+```
+
+## What one epoch does
+
+1. Fetches the current **drand** round (chain `8990e7…`, pinned in `trust_root.json`).
+   Nothing in the epoch could have existed before that round: lower time bound.
+2. Fetches the surfaces of the featured targets and of a rotating slice of the
+   target list (default 120 per hour, 0.6 s apart, `crovia-tacet-observer` user
+   agent). Surface = the raw model card `…/raw/main/README.md`; for gated
+   repositories (401/403) the rendered model page.
+3. Runs the public predicate `crovia.pred.hf-card-training-data 1.0.0`
+   ([source](tacet_operator/predicates/hf_card_training_data_v1.py), hashed
+   byte-for-byte into every snapshot) on the bytes and signs a **snapshot**
+   with the observer key. Non-200 responses produce no snapshot: a fetch failure
+   is indeterminate, never absence.
+4. Applies forward-only slot transitions: a positive snapshot for an empty slot
+   inserts a `disclosure` value; two consecutive negatives for a disclosed slot
+   insert a `retraction`. Every value is asserted by a `crovia.seal.v1` signed
+   with the Seal-issuer key (`values/<key>.json`).
+5. Signs the **epoch sheet** (root, size, `snapshots_root`, `opened` beacon,
+   `prev_sheet_hash`) with the operator key and stamps `sheet_hash` with
+   OpenTimestamps. When the calendar reaches Bitcoin, `refresh-anchors` fills
+   `closed` (block height, block time, proof URL): upper time bound.
+
+The operator is the only writer; all changes of an epoch are applied in one
+batch, so the sheet's root is the root at `epoch_end`. Missed hours are
+back-filled with empty sheets (historical drand round): the chain stays
+contiguous and those hours contribute no silence.
+
+## Silence proofs
+
+```
+tacet-operator prove mistralai/Mistral-7B-v0.1 --strength 2 -o proof.seal.json
+tacet-operator verify proof.seal.json --operator-pubkey <key_hex from trust_root.json>
+```
+
+A proof carries every sheet in the range, the delta-encoded non-inclusion
+path, the negative snapshots with their Merkle inclusion in each epoch's
+`snapshots_root`, and the `silence` block recomputed by the verifier:
+`silence_seconds` = sum of the durations of anchored epochs that hold a negative
+snapshot for the target. Unobserved, unanchored or unreachable hours count
+zero. The bundle is wrapped in an unmodified `crovia.seal.v1`.
+
+## Keys
+
+Three Ed25519 seeds in `state/keys/` (mode 0600), created on first run:
+`operator` (signs sheets), `observer` (signs snapshots), `issuer`
+(`urn:crovia:seal-issuer:tacet`, signs Seals: value assertions and proofs).
+Public keys are published in `trust_root.json`.
+
+## Install
+
+```bash
+pip install -e ../reference/python -e <crovia-seal>/reference/python -e .
+TACET_STATE=/opt/crovia/tacet/state TACET_PUBLIC=/var/www/registry/data/tacet tacet-operator keys
+```
+
+Tests: `pytest -q tests` (predicate vectors are real model cards; the epoch
+test uses a fake network, fake drand and fake OTS).

crovia_tacet_operator-0.3.0/README.md

@@ -0,0 +1,68 @@
+# TACET operator
+
+Runs the TACET log in production. The [reference](../reference/python) defines
+the objects; this package fetches, signs, anchors and publishes them.
+
+```
+every hour   tacet-operator run-epoch        drand round → observe surfaces → update map → sign sheet → OTS stamp
+every 6 h    tacet-operator refresh-anchors  upgrade OTS proofs; close sheets confirmed in Bitcoin
+daily        tacet-operator publish --proofs rebuild featured silence proofs (crovia.seal.v1)
+```
+
+## What one epoch does
+
+1. Fetches the current **drand** round (chain `8990e7…`, pinned in `trust_root.json`).
+   Nothing in the epoch could have existed before that round: lower time bound.
+2. Fetches the surfaces of the featured targets and of a rotating slice of the
+   target list (default 120 per hour, 0.6 s apart, `crovia-tacet-observer` user
+   agent). Surface = the raw model card `…/raw/main/README.md`; for gated
+   repositories (401/403) the rendered model page.
+3. Runs the public predicate `crovia.pred.hf-card-training-data 1.0.0`
+   ([source](tacet_operator/predicates/hf_card_training_data_v1.py), hashed
+   byte-for-byte into every snapshot) on the bytes and signs a **snapshot**
+   with the observer key. Non-200 responses produce no snapshot: a fetch failure
+   is indeterminate, never absence.
+4. Applies forward-only slot transitions: a positive snapshot for an empty slot
+   inserts a `disclosure` value; two consecutive negatives for a disclosed slot
+   insert a `retraction`. Every value is asserted by a `crovia.seal.v1` signed
+   with the Seal-issuer key (`values/<key>.json`).
+5. Signs the **epoch sheet** (root, size, `snapshots_root`, `opened` beacon,
+   `prev_sheet_hash`) with the operator key and stamps `sheet_hash` with
+   OpenTimestamps. When the calendar reaches Bitcoin, `refresh-anchors` fills
+   `closed` (block height, block time, proof URL): upper time bound.
+
+The operator is the only writer; all changes of an epoch are applied in one
+batch, so the sheet's root is the root at `epoch_end`. Missed hours are
+back-filled with empty sheets (historical drand round): the chain stays
+contiguous and those hours contribute no silence.
+
+## Silence proofs
+
+```
+tacet-operator prove mistralai/Mistral-7B-v0.1 --strength 2 -o proof.seal.json
+tacet-operator verify proof.seal.json --operator-pubkey <key_hex from trust_root.json>
+```
+
+A proof carries every sheet in the range, the delta-encoded non-inclusion
+path, the negative snapshots with their Merkle inclusion in each epoch's
+`snapshots_root`, and the `silence` block recomputed by the verifier:
+`silence_seconds` = sum of the durations of anchored epochs that hold a negative
+snapshot for the target. Unobserved, unanchored or unreachable hours count
+zero. The bundle is wrapped in an unmodified `crovia.seal.v1`.
+
+## Keys
+
+Three Ed25519 seeds in `state/keys/` (mode 0600), created on first run:
+`operator` (signs sheets), `observer` (signs snapshots), `issuer`
+(`urn:crovia:seal-issuer:tacet`, signs Seals: value assertions and proofs).
+Public keys are published in `trust_root.json`.
+
+## Install
+
+```bash
+pip install -e ../reference/python -e <crovia-seal>/reference/python -e .
+TACET_STATE=/opt/crovia/tacet/state TACET_PUBLIC=/var/www/registry/data/tacet tacet-operator keys
+```
+
+Tests: `pytest -q tests` (predicate vectors are real model cards; the epoch
+test uses a fake network, fake drand and fake OTS).

crovia_tacet_operator-0.3.0/crovia_tacet_operator.egg-info/PKG-INFO

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: crovia-tacet-operator
+Version: 0.3.0
+Summary: Production operator for TACET: hourly epochs, signed surface snapshots, OTS anchoring, silence proofs as crovia.seal.v1
+Author-email: Crovia Trust <info@croviatrust.com>
+License: Apache-2.0
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: crovia-tacet>=0.3.0
+Requires-Dist: cryptography>=41.0.0
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+
+# TACET operator
+
+Runs the TACET log in production. The [reference](../reference/python) defines
+the objects; this package fetches, signs, anchors and publishes them.
+
+```
+every hour   tacet-operator run-epoch        drand round → observe surfaces → update map → sign sheet → OTS stamp
+every 6 h    tacet-operator refresh-anchors  upgrade OTS proofs; close sheets confirmed in Bitcoin
+daily        tacet-operator publish --proofs rebuild featured silence proofs (crovia.seal.v1)
+```
+
+## What one epoch does
+
+1. Fetches the current **drand** round (chain `8990e7…`, pinned in `trust_root.json`).
+   Nothing in the epoch could have existed before that round: lower time bound.
+2. Fetches the surfaces of the featured targets and of a rotating slice of the
+   target list (default 120 per hour, 0.6 s apart, `crovia-tacet-observer` user
+   agent). Surface = the raw model card `…/raw/main/README.md`; for gated
+   repositories (401/403) the rendered model page.
+3. Runs the public predicate `crovia.pred.hf-card-training-data 1.0.0`
+   ([source](tacet_operator/predicates/hf_card_training_data_v1.py), hashed
+   byte-for-byte into every snapshot) on the bytes and signs a **snapshot**
+   with the observer key. Non-200 responses produce no snapshot: a fetch failure
+   is indeterminate, never absence.
+4. Applies forward-only slot transitions: a positive snapshot for an empty slot
+   inserts a `disclosure` value; two consecutive negatives for a disclosed slot
+   insert a `retraction`. Every value is asserted by a `crovia.seal.v1` signed
+   with the Seal-issuer key (`values/<key>.json`).
+5. Signs the **epoch sheet** (root, size, `snapshots_root`, `opened` beacon,
+   `prev_sheet_hash`) with the operator key and stamps `sheet_hash` with
+   OpenTimestamps. When the calendar reaches Bitcoin, `refresh-anchors` fills
+   `closed` (block height, block time, proof URL): upper time bound.
+
+The operator is the only writer; all changes of an epoch are applied in one
+batch, so the sheet's root is the root at `epoch_end`. Missed hours are
+back-filled with empty sheets (historical drand round): the chain stays
+contiguous and those hours contribute no silence.
+
+## Silence proofs
+
+```
+tacet-operator prove mistralai/Mistral-7B-v0.1 --strength 2 -o proof.seal.json
+tacet-operator verify proof.seal.json --operator-pubkey <key_hex from trust_root.json>
+```
+
+A proof carries every sheet in the range, the delta-encoded non-inclusion
+path, the negative snapshots with their Merkle inclusion in each epoch's
+`snapshots_root`, and the `silence` block recomputed by the verifier:
+`silence_seconds` = sum of the durations of anchored epochs that hold a negative
+snapshot for the target. Unobserved, unanchored or unreachable hours count
+zero. The bundle is wrapped in an unmodified `crovia.seal.v1`.
+
+## Keys
+
+Three Ed25519 seeds in `state/keys/` (mode 0600), created on first run:
+`operator` (signs sheets), `observer` (signs snapshots), `issuer`
+(`urn:crovia:seal-issuer:tacet`, signs Seals: value assertions and proofs).
+Public keys are published in `trust_root.json`.
+
+## Install
+
+```bash
+pip install -e ../reference/python -e <crovia-seal>/reference/python -e .
+TACET_STATE=/opt/crovia/tacet/state TACET_PUBLIC=/var/www/registry/data/tacet tacet-operator keys
+```
+
+Tests: `pytest -q tests` (predicate vectors are real model cards; the epoch
+test uses a fake network, fake drand and fake OTS).

crovia_tacet_operator-0.3.0/crovia_tacet_operator.egg-info/SOURCES.txt

@@ -0,0 +1,24 @@
+README.md
+pyproject.toml
+crovia_tacet_operator.egg-info/PKG-INFO
+crovia_tacet_operator.egg-info/SOURCES.txt
+crovia_tacet_operator.egg-info/dependency_links.txt
+crovia_tacet_operator.egg-info/entry_points.txt
+crovia_tacet_operator.egg-info/requires.txt
+crovia_tacet_operator.egg-info/top_level.txt
+tacet_operator/__init__.py
+tacet_operator/cli.py
+tacet_operator/config.py
+tacet_operator/drand.py
+tacet_operator/fetch.py
+tacet_operator/keys.py
+tacet_operator/ots.py
+tacet_operator/prove.py
+tacet_operator/publish.py
+tacet_operator/runner.py
+tacet_operator/state.py
+tacet_operator/targets.py
+tacet_operator/predicates/__init__.py
+tacet_operator/predicates/hf_card_training_data_v1.py
+tests/test_epoch_end_to_end.py
+tests/test_predicate.py

crovia_tacet_operator-0.3.0/crovia_tacet_operator.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

crovia_tacet_operator-0.3.0/crovia_tacet_operator.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+tacet-operator = tacet_operator.cli:main

crovia_tacet_operator-0.3.0/crovia_tacet_operator.egg-info/requires.txt

@@ -0,0 +1,5 @@
+crovia-tacet>=0.3.0
+cryptography>=41.0.0
+
+[test]
+pytest>=7

crovia_tacet_operator-0.3.0/crovia_tacet_operator.egg-info/top_level.txt

@@ -0,0 +1 @@
+tacet_operator

crovia_tacet_operator-0.3.0/pyproject.toml

@@ -0,0 +1,22 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "crovia-tacet-operator"
+version = "0.3.0"
+description = "Production operator for TACET: hourly epochs, signed surface snapshots, OTS anchoring, silence proofs as crovia.seal.v1"
+readme = "README.md"
+license = { text = "Apache-2.0" }
+authors = [{ name = "Crovia Trust", email = "info@croviatrust.com" }]
+requires-python = ">=3.10"
+dependencies = ["crovia-tacet>=0.3.0", "cryptography>=41.0.0"]
+
+[project.optional-dependencies]
+test = ["pytest>=7"]
+
+[project.scripts]
+tacet-operator = "tacet_operator.cli:main"
+
+[tool.setuptools]
+packages = ["tacet_operator", "tacet_operator.predicates"]

crovia_tacet_operator-0.3.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

crovia_tacet_operator-0.3.0/tacet_operator/__init__.py

@@ -0,0 +1,20 @@
+"""TACET operator: turns the reference primitives into a running log.
+
+Layout (SPEC §12):
+
+    state/                      private, on the operator host
+      keys/                     32-byte Ed25519 seeds (operator, observer, issuer)
+      map.json                  {key_hex: value_hash_hex} current map
+      values/<key_hex>.json     slot value objects (kind disclosure/retraction)
+      cursor.json               rotation cursor over the target list
+    public/                     served at /registry/data/tacet/
+      trust_root.json           map_id, genesis, keys, drand chain, predicates
+      sheets/<epoch>.json       signed epoch sheets (closed once OTS confirms)
+      snapshots/<epoch>.jsonl   signed surface snapshots taken in the epoch
+      changes/<epoch>.json      [[key_hex, value_hash_hex], ...] applied in the epoch
+      ots/<epoch>.ots           OpenTimestamps proof of the sheet hash
+      proofs/<slug>.seal.json   featured silence proofs wrapped in crovia.seal.v1
+      latest.json, index.json   discovery
+"""
+
+__version__ = "0.1.0"

crovia_tacet_operator-0.3.0/tacet_operator/cli.py

@@ -0,0 +1,134 @@
+"""tacet-operator: run-epoch | refresh-anchors | publish | prove | verify | build-targets | keys"""
+from __future__ import annotations
+
+import argparse
+import json
+import logging
+import sys
+from pathlib import Path
+
+from .config import Settings
+from .keys import load_all
+
+
+def _settings(args) -> Settings:
+    s = Settings.from_env()
+    if args.state:
+        s.paths.state = Path(args.state)
+    if args.public:
+        s.paths.public = Path(args.public)
+    if getattr(args, "targets", None):
+        s.targets_file = Path(args.targets)
+    if getattr(args, "budget", None):
+        s.per_epoch_budget = args.budget
+    s.paths.ensure()
+    return s
+
+
+def main(argv=None) -> int:
+    p = argparse.ArgumentParser(prog="tacet-operator")
+    p.add_argument("--state", help="state directory (default $TACET_STATE or /opt/crovia/tacet/state)")
+    p.add_argument("--public", help="public directory (default $TACET_PUBLIC or /var/www/registry/data/tacet)")
+    p.add_argument("-v", "--verbose", action="store_true")
+    sub = p.add_subparsers(dest="cmd", required=True)
+
+    r = sub.add_parser("run-epoch", help="emit the current epoch (and back-fill missed ones)")
+    r.add_argument("--targets", help="newline-separated target ids")
+    r.add_argument("--budget", type=int)
+    r.add_argument("--no-ots", action="store_true", help="do not stamp (tests)")
+
+    sub.add_parser("refresh-anchors", help="stamp missing proofs; close sheets confirmed in Bitcoin")
+
+    pb = sub.add_parser("publish", help="rewrite trust_root/index/latest/targets (+ featured proofs)")
+    pb.add_argument("--proofs", action="store_true")
+
+    pr = sub.add_parser("prove", help="build a silence proof for one target, wrapped in crovia.seal.v1")
+    pr.add_argument("target")
+    pr.add_argument("--from-epoch", type=int, default=0)
+    pr.add_argument("--to-epoch", type=int)
+    pr.add_argument("--strength", type=int, default=2, choices=(1, 2))
+    pr.add_argument("-o", "--out")
+
+    vf = sub.add_parser("verify", help="verify a wrapped silence proof offline")
+    vf.add_argument("file")
+    vf.add_argument("--operator-pubkey", help="expected operator key_hex (from trust_root.json)")
+    vf.add_argument("--no-beacon", action="store_true")
+    vf.add_argument("--no-ots", action="store_true")
+
+    bt = sub.add_parser("build-targets", help="derive the target list from public registry files")
+    bt.add_argument("--candidates", required=True)
+    bt.add_argument("--silence")
+    bt.add_argument("-o", "--out", required=True)
+
+    sub.add_parser("keys", help="print public keys (creating seeds if absent)")
+
+    args = p.parse_args(argv)
+    logging.basicConfig(level=logging.DEBUG if args.verbose else logging.INFO,
+                        format="%(asctime)s %(levelname)s %(message)s", stream=sys.stderr)
+
+    if args.cmd == "verify":
+        # Third parties run this on any machine: it must not touch operator state or keys.
+        from .prove import verify_file
+        res = verify_file(Path(args.file), expected_operator_pubkey_hex=args.operator_pubkey,
+                          check_beacon=not args.no_beacon, check_ots=not args.no_ots)
+        print(json.dumps(res, indent=1))
+        return 0 if res["ok"] else 1
+
+    s = _settings(args)
+
+    if args.cmd == "keys":
+        keys = load_all(s.paths.keys)
+        print(json.dumps({r: {"id": k.id, "pubkey": k.pubkey_json()} for r, k in keys.items()}, indent=1))
+        return 0
+
+    if args.cmd == "run-epoch":
+        from .publish import publish_all
+        from .runner import EpochRunner
+        keys = load_all(s.paths.keys)
+        runner = EpochRunner(s, keys)
+        if args.no_ots:
+            runner.ots_stamp = None
+        sheet = runner.run()
+        publish_all(s, keys)
+        print(json.dumps({"emitted": sheet["epoch"] if sheet else None}))
+        return 0
+
+    if args.cmd == "refresh-anchors":
+        from .publish import publish_all
+        from .runner import refresh_anchors
+        counts = refresh_anchors(s)
+        # A newly closed sheet changes every silence figure; re-issue the featured proofs at once.
+        publish_all(s, load_all(s.paths.keys), with_proofs=counts.get("closed", 0) > 0)
+        print(json.dumps(counts))
+        return 0
+
+    if args.cmd == "publish":
+        from .publish import publish_all
+        latest = publish_all(s, load_all(s.paths.keys), with_proofs=args.proofs)
+        print(json.dumps(latest, indent=1))
+        return 0
+
+    if args.cmd == "prove":
+        from .prove import build
+        keys = load_all(s.paths.keys)
+        bundle = build(s, keys["issuer"], args.target, from_epoch=args.from_epoch, to_epoch=args.to_epoch, strength=args.strength)
+        text = json.dumps(bundle, indent=1, sort_keys=True)
+        if args.out:
+            Path(args.out).write_text(text + "\n")
+            print(json.dumps({"out": args.out, "silence": bundle["proof"]["silence"], "seal_id": bundle["seal"]["seal_id"]}))
+        else:
+            print(text)
+        return 0
+
+    if args.cmd == "build-targets":
+        from .targets import build_from_public
+        ids = build_from_public(Path(args.candidates), Path(args.silence) if args.silence else None)
+        Path(args.out).write_text("\n".join(ids) + "\n")
+        print(json.dumps({"targets": len(ids), "out": args.out}))
+        return 0
+
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

crovia_tacet_operator-0.3.0/tacet_operator/config.py

@@ -0,0 +1,113 @@
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from pathlib import Path
+
+MAP_ID = "urn:crovia:tacet:map:disclosure"
+OPERATOR_ID = "urn:crovia:tacet:operator:crovia-trust"
+OBSERVER_ID = "urn:crovia:observer:hetzner-1"
+ISSUER_ID = "urn:crovia:seal-issuer:tacet"  # Seal issuer ids are constrained by the Seal spec
+
+# Epoch 0 starts here; epoch e covers [GENESIS + e*EPOCH_SECONDS, GENESIS + (e+1)*EPOCH_SECONDS).
+GENESIS = datetime(2026, 9, 19, 18, 0, 0, tzinfo=timezone.utc)
+EPOCH_SECONDS = 3600
+
+DRAND_CHAIN_HASH = "8990e7a9aaed2ffed73dbd7092123d6f289930540d7651336225dc172e51b2ce"
+DRAND_URLS = (
+    "https://api.drand.sh",
+    "https://drand.cloudflare.com",
+    "https://api2.drand.sh",
+)
+
+PUBLIC_BASE_URL = "https://croviatrust.com/registry/data/tacet"
+USER_AGENT = "crovia-tacet-observer/0.1 (+https://croviatrust.com/registry/tacet/)"
+
+
+@dataclass
+class Paths:
+    state: Path
+    public: Path
+
+    @property
+    def keys(self) -> Path:
+        return self.state / "keys"
+
+    @property
+    def map_file(self) -> Path:
+        return self.state / "map.json"
+
+    @property
+    def values(self) -> Path:
+        return self.state / "values"
+
+    @property
+    def cursor(self) -> Path:
+        return self.state / "cursor.json"
+
+    @property
+    def fetch_log(self) -> Path:
+        return self.state / "fetch_log"
+
+    @property
+    def sheets(self) -> Path:
+        return self.public / "sheets"
+
+    @property
+    def snapshots(self) -> Path:
+        return self.public / "snapshots"
+
+    @property
+    def changes(self) -> Path:
+        return self.public / "changes"
+
+    @property
+    def ots(self) -> Path:
+        return self.public / "ots"
+
+    @property
+    def proofs(self) -> Path:
+        return self.public / "proofs"
+
+    def ensure(self) -> None:
+        for d in (self.state, self.keys, self.values, self.fetch_log,
+                  self.public, self.sheets, self.snapshots, self.changes, self.ots, self.proofs):
+            d.mkdir(parents=True, exist_ok=True)
+
+
+@dataclass
+class Settings:
+    paths: Paths
+    per_epoch_budget: int = 120          # surfaces fetched per epoch (HF-friendly: 2/min)
+    featured_every_epoch: int = 40       # featured targets observed in every epoch
+    request_delay_s: float = 0.6
+    request_timeout_s: float = 25.0
+    featured: list = field(default_factory=list)
+    targets_file: Path | None = None     # newline-separated org/model ids
+
+    @classmethod
+    def from_env(cls) -> "Settings":
+        state = Path(os.environ.get("TACET_STATE", "/opt/crovia/tacet/state"))
+        public = Path(os.environ.get("TACET_PUBLIC", "/var/www/registry/data/tacet"))
+        s = cls(paths=Paths(state, public))
+        if os.environ.get("TACET_BUDGET"):
+            s.per_epoch_budget = int(os.environ["TACET_BUDGET"])
+        if os.environ.get("TACET_TARGETS"):
+            s.targets_file = Path(os.environ["TACET_TARGETS"])
+        return s
+
+
+def epoch_of(ts: datetime) -> int:
+    return int((ts - GENESIS).total_seconds() // EPOCH_SECONDS)
+
+
+def epoch_bounds(epoch: int) -> tuple[str, str]:
+    start = GENESIS.timestamp() + epoch * EPOCH_SECONDS
+    end = start + EPOCH_SECONDS
+    f = lambda t: datetime.fromtimestamp(t, tz=timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")  # noqa: E731
+    return f(start), f(end)
+
+
+def now_iso() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")

crovia_tacet_operator-0.3.0/tacet_operator/drand.py

@@ -0,0 +1,98 @@
+"""drand League of Entropy beacon: the epoch's lower time bound (SPEC §6).
+
+The default chain (pedersen-bls-chained, 30 s period, genesis 1595431050) is
+pinned by hash. `fetch_latest` tries the public relays in order and returns the
+`opened` object for an epoch sheet. `round_time` lets verifiers check that the
+round could not have existed before `epoch_start`.
+"""
+from __future__ import annotations
+
+import json
+import urllib.request
+from typing import Any, Dict
+
+from .config import DRAND_CHAIN_HASH, DRAND_URLS, USER_AGENT
+
+PERIOD = 30
+GENESIS_TIME = 1595431050
+
+
+class DrandError(RuntimeError):
+    pass
+
+
+def _get(url: str, timeout: float) -> Dict[str, Any]:
+    req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT, "Accept": "application/json"})
+    with urllib.request.urlopen(req, timeout=timeout) as r:
+        return json.loads(r.read().decode("utf-8"))
+
+
+def fetch_latest(timeout: float = 10.0) -> Dict[str, Any]:
+    last = None
+    for base in DRAND_URLS:
+        try:
+            d = _get(f"{base}/{DRAND_CHAIN_HASH}/public/latest", timeout)
+            for k in ("round", "randomness", "signature"):
+                if k not in d:
+                    raise DrandError(f"{base}: missing {k}")
+            return {
+                "kind": "drand",
+                "chain_hash": DRAND_CHAIN_HASH,
+                "round": int(d["round"]),
+                "randomness": d["randomness"],
+                "signature": d["signature"],
+            }
+        except Exception as e:  # noqa: BLE001 - try next relay
+            last = e
+    raise DrandError(f"all drand relays failed: {last}")
+
+
+def fetch_info(timeout: float = 10.0) -> Dict[str, Any]:
+    last = None
+    for base in DRAND_URLS:
+        try:
+            d = _get(f"{base}/{DRAND_CHAIN_HASH}/info", timeout)
+            if d.get("hash") != DRAND_CHAIN_HASH:
+                raise DrandError("chain hash mismatch")
+            return {"chain_hash": d["hash"], "public_key": d["public_key"], "period": d["period"],
+                    "genesis_time": d["genesis_time"], "scheme": d.get("schemeID")}
+        except Exception as e:  # noqa: BLE001
+            last = e
+    raise DrandError(f"all drand relays failed: {last}")
+
+
+def fetch_round(round_no: int, timeout: float = 10.0) -> Dict[str, Any]:
+    """Historical round (used only to back-fill empty epochs after downtime)."""
+    last = None
+    for base in DRAND_URLS:
+        try:
+            d = _get(f"{base}/{DRAND_CHAIN_HASH}/public/{round_no}", timeout)
+            if int(d["round"]) != round_no:
+                raise DrandError("round mismatch")
+            return {"kind": "drand", "chain_hash": DRAND_CHAIN_HASH, "round": round_no,
+                    "randomness": d["randomness"], "signature": d["signature"]}
+        except Exception as e:  # noqa: BLE001
+            last = e
+    raise DrandError(f"all drand relays failed for round {round_no}: {last}")
+
+
+def round_time(round_no: int) -> int:
+    """Unix time at which `round_no` became available."""
+    return GENESIS_TIME + (round_no - 1) * PERIOD
+
+
+def round_at(unix_time: int) -> int:
+    """First round available at or after `unix_time`."""
+    if unix_time <= GENESIS_TIME:
+        return 1
+    return (unix_time - GENESIS_TIME + PERIOD - 1) // PERIOD + 1
+
+
+def beacon_check(opened: Dict[str, Any], epoch_start: str, tolerance_s: int = 1800) -> bool:
+    """SPEC §8.5 step 2: the round must belong to the pinned chain and sit at the epoch start."""
+    from datetime import datetime, timezone
+    if opened.get("chain_hash") != DRAND_CHAIN_HASH:
+        return False
+    start = int(datetime.strptime(epoch_start, "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=timezone.utc).timestamp())
+    t = round_time(int(opened["round"]))
+    return start - PERIOD <= t <= start + tolerance_s