decisionlock 0.2.0rc4__tar.gz

decisionlock-0.2.0rc4/.dockerignore

@@ -0,0 +1,19 @@
+.git
+.github
+.pytest_cache
+.mypy_cache
+.ruff_cache
+.coverage
+coverage.xml
+htmlcov
+__pycache__
+*.py[cod]
+.venv
+venv
+build
+dist
+*.egg-info
+.decisionlock
+*.sqlite*
+*.db
+.env*

decisionlock-0.2.0rc4/.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,38 @@
+# Code of Conduct
+
+## Scope
+
+This policy applies to repository issues, pull requests, reviews, discussions, and other project-managed communication spaces.
+
+## Expected behavior
+
+Participants must:
+
+- communicate precisely, respectfully, and in good faith;
+- distinguish verified evidence from assumptions;
+- review security-sensitive changes without personal attacks;
+- protect private data, credentials, vulnerability details, and affected users;
+- accept correction and revise claims when evidence changes.
+
+## Unacceptable behavior
+
+The following are not accepted:
+
+- harassment, discrimination, threats, or targeted intimidation;
+- publishing private information or live credentials;
+- reckless or coercive vulnerability disclosure;
+- deliberately misleading technical claims;
+- sustained disruption of reviews, issues, or incident response;
+- retaliation against a person who reports a security or conduct concern.
+
+## Reporting
+
+Do not place incident details, names, screenshots, private messages, or other sensitive evidence in a public issue.
+
+To request a private reporting channel, open a minimal issue titled `Private conduct report contact request` and include no incident details. The maintainer will provide a private channel before the report or evidence is shared, then close the public request.
+
+The private report should include the relevant links, dates, participants, and a factual description. Avoid speculation and unnecessary personal data.
+
+## Enforcement
+
+The maintainer may edit or remove content, restrict participation, close discussions, or block accounts when necessary to protect contributors, users, or the security process. Enforcement decisions should be proportional, documented, and based on available evidence.

decisionlock-0.2.0rc4/.github/CONTRIBUTING.md

@@ -0,0 +1,41 @@
+# Contributing
+
+DecisionLock is security-sensitive software. Small changes can alter authorization, replay, credential, and audit semantics.
+
+## Development setup
+
+Use Python 3.11 or newer.
+
+```bash
+python -m venv .venv
+. .venv/bin/activate
+python -m pip install -e '.[dev]'
+make check
+```
+
+`make check` is the minimum local gate before opening a pull request.
+
+## Pull-request requirements
+
+A pull request must:
+
+- describe the security or operational behavior being changed;
+- remain narrowly scoped;
+- include tests for the changed behavior;
+- preserve deterministic reason codes and fail-closed behavior;
+- update schemas and documentation when public contracts change;
+- avoid unrelated formatting, refactoring, or dependency churn;
+- pass the exact GitHub Actions checks for its final head commit.
+
+Security-sensitive changes should test applicable allow, deny, approval, replay, mutation, stale-state, concurrency, and failure paths.
+
+## Architecture rules
+
+- Domain and policy code must remain independent of transport, CLI, database, telemetry, and provider SDKs.
+- External systems must connect through typed ports and adapters.
+- An adapter must not silently weaken policy, credential ceilings, replay protection, or audit guarantees.
+- Provider-specific work requires an explicit, separately reviewed scope and must not become a core dependency.
+
+## Reporting vulnerabilities
+
+Do not open a public issue for a vulnerability. Follow [SECURITY.md](SECURITY.md).

decisionlock-0.2.0rc4/.github/SECURITY.md

@@ -0,0 +1,37 @@
+# Security Policy
+
+DecisionLock is prerelease security software. It is not production-certified and must be deployed behind independent identity, secret-management, network, process, and operating-system controls.
+
+## Supported versions
+
+Security fixes are evaluated for the current `main` branch and the latest maintained prerelease. Older prereleases and the v0.1 compatibility surface may receive fixes only when the issue affects the maintained code path.
+
+## Report a vulnerability
+
+Do not open a public issue containing vulnerability details.
+
+Use GitHub private vulnerability reporting:
+
+1. Open the repository's **Security** tab.
+2. Select **Advisories**.
+3. Select **Report a vulnerability** and submit the report privately.
+
+If the private-reporting button is unavailable, open a minimal public issue titled `Private security contact request` without technical details, affected versions, reproduction steps, names, credentials, or evidence. The maintainer will provide a private channel before any sensitive information is shared.
+
+Include in the private report:
+
+- affected version or commit;
+- reproduction steps or a minimal proof of concept;
+- expected and observed behavior;
+- security impact and realistic attack conditions;
+- suggested remediation, when known.
+
+Do not include live credentials, private keys, personal data, customer data, or production secrets. Use synthetic test data.
+
+## Response expectations
+
+There is no commercial support or response-time SLA. Reports will be triaged according to reproducibility, exploitability, affected trust boundary, and potential impact. Public disclosure should occur only after a remediation and release plan is agreed.
+
+## Deployment responsibility
+
+DecisionLock does not replace process isolation, network egress controls, secret-manager policy, identity proofing, centralized transactional state, or an independent audit/checkpoint store.

decisionlock-0.2.0rc4/.github/SUPPORT.md

@@ -0,0 +1,14 @@
+# Support
+
+DecisionLock is a prerelease open-source project. It has no uptime, incident-response, compatibility, or production-support SLA.
+
+Use GitHub issues for:
+
+- reproducible non-security defects;
+- documentation errors;
+- narrowly scoped feature proposals;
+- design discussions grounded in a concrete use case.
+
+Include the DecisionLock version or commit, operating system, Python version, command, minimal configuration, expected behavior, observed behavior, and relevant redacted logs.
+
+Do not use public issues for vulnerabilities, credentials, private data, or production incident details. Follow [SECURITY.md](SECURITY.md) for security reports.

decisionlock-0.2.0rc4/.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+updates:
+  # Version-update pull requests are enabled. They were paused for the RC2
+  # demonstration; the pause is lifted as part of the Phase 0 supply-chain
+  # stabilization. Every PR is validated by the same `make check` gate as any
+  # other change, and direct runtime constraints live in
+  # requirements/runtime-validated.txt.
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      python-runtime:
+        dependency-type: production
+      python-development:
+        dependency-type: development
+    reviewers:
+      - TensorScholar
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    reviewers:
+      - TensorScholar

decisionlock-0.2.0rc4/.github/workflows/ci.yml

@@ -0,0 +1,184 @@
+name: CI
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    name: Python ${{ matrix.python-version }} quality
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -c requirements/runtime-validated.txt -e '.[http]'
+          python -m pip install -r requirements/validation.txt
+      - name: Verify
+        run: make check
+
+  compatibility:
+    name: ${{ matrix.os }} / Python 3.13
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+          cache: pip
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -c requirements/runtime-validated.txt -e '.[http]'
+          python -m pip install -r requirements/validation.txt
+      - name: Compile
+        run: python -m compileall -q src tests
+      - name: Test
+        run: python -m pytest
+
+  package:
+    name: Package, reproducibility and clean-install smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+          cache: pip
+      - name: Verify hash-pinned build backend
+        shell: bash
+        run: |
+          set -euo pipefail
+          # The build backend is fetched from the network during the build. Pin it
+          # by hash so the build does not depend on whatever the index serves.
+          python -m venv /tmp/decisionlock-build-venv
+          /tmp/decisionlock-build-venv/bin/python -m pip install --upgrade pip
+          /tmp/decisionlock-build-venv/bin/python -m pip install \
+            --require-hashes -r requirements/build-hashed.txt
+          # The pinned backend must be the one pyproject declares.
+          /tmp/decisionlock-build-venv/bin/python - <<'PY'
+          import pathlib, re, tomllib
+          import setuptools
+          spec = tomllib.loads(pathlib.Path("pyproject.toml").read_text())
+          declared = spec["build-system"]["requires"]
+          expected = re.match(r"setuptools==([0-9.]+)", next(d for d in declared if "setuptools" in d))
+          assert expected, f"build-system must pin setuptools exactly, got {declared!r}"
+          installed = setuptools.__version__
+          assert installed == expected.group(1), (
+              f"build backend version mismatch: pyproject pins {expected.group(1)}, "
+              f"hash-pinned toolchain installed {installed}"
+          )
+          print(f"build backend hash-pinned and version-matched: setuptools=={installed}")
+          PY
+      - name: Build reproducibly with the hash-pinned backend
+        shell: bash
+        run: |
+          set -euo pipefail
+          /tmp/decisionlock-build-venv/bin/python -m pip install build twine
+          export SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)"
+          rm -rf dist dist-a dist-b release
+          /tmp/decisionlock-build-venv/bin/python -m build --no-isolation --outdir dist-a
+          /tmp/decisionlock-build-venv/bin/python -m build --no-isolation --outdir dist-b
+
+          WHEEL_A="$(find dist-a -maxdepth 1 -name '*.whl' -print -quit)"
+          WHEEL_B="$(find dist-b -maxdepth 1 -name '*.whl' -print -quit)"
+          SDIST_A="$(find dist-a -maxdepth 1 -name '*.tar.gz' -print -quit)"
+          SDIST_B="$(find dist-b -maxdepth 1 -name '*.tar.gz' -print -quit)"
+          test -n "$WHEEL_A" && test -n "$WHEEL_B" && test -n "$SDIST_A" && test -n "$SDIST_B"
+
+          cmp "$WHEEL_A" "$WHEEL_B"
+          python scripts/normalize_sdist.py "$SDIST_A" /tmp/decisionlock-sdist-a.tar.gz
+          python scripts/normalize_sdist.py "$SDIST_B" /tmp/decisionlock-sdist-b.tar.gz
+          cmp /tmp/decisionlock-sdist-a.tar.gz /tmp/decisionlock-sdist-b.tar.gz
+
+          mkdir -p dist release
+          cp "$WHEEL_A" dist/
+          cp /tmp/decisionlock-sdist-a.tar.gz "dist/$(basename "$SDIST_A")"
+          python -m twine check dist/*
+          python scripts/generate_sbom.py --output release/decisionlock.cdx.json
+          python scripts/generate_release_manifest.py \
+            --dist dist \
+            --commit "$GITHUB_SHA" \
+            --output release/release-manifest.json
+          sha256sum dist/* release/decisionlock.cdx.json release/release-manifest.json \
+            > release/SHA256SUMS
+      - name: Base-wheel clean-install smoke
+        shell: bash
+        run: |
+          set -euo pipefail
+          WHEEL="$(realpath "$(find dist -maxdepth 1 -name '*.whl' -print -quit)")"
+          python -m venv /tmp/decisionlock-wheel-smoke
+          /tmp/decisionlock-wheel-smoke/bin/python -m pip install "$WHEEL"
+          /tmp/decisionlock-wheel-smoke/bin/decisionlock --version
+          /tmp/decisionlock-wheel-smoke/bin/decisionlock --help >/dev/null
+          /tmp/decisionlock-wheel-smoke/bin/decisionlock-mcp-http --help >/dev/null
+          /tmp/decisionlock-wheel-smoke/bin/decisionlock-reconcile --help >/dev/null
+          /tmp/decisionlock-wheel-smoke/bin/decisionlock-reconcile-worker --help >/dev/null
+          /tmp/decisionlock-wheel-smoke/bin/decisionlock demo --output /tmp/decisionlock-demo
+          /tmp/decisionlock-wheel-smoke/bin/decisionlock evidence-verify /tmp/decisionlock-demo/evidence
+          /tmp/decisionlock-wheel-smoke/bin/python -m pip check
+      - name: HTTP-extra wheel smoke
+        shell: bash
+        run: |
+          set -euo pipefail
+          WHEEL="$(realpath "$(find dist -maxdepth 1 -name '*.whl' -print -quit)")"
+          python -m venv /tmp/decisionlock-http-wheel-smoke
+          /tmp/decisionlock-http-wheel-smoke/bin/python -m pip install "decisionlock[http] @ file://$WHEEL"
+          /tmp/decisionlock-http-wheel-smoke/bin/decisionlock-mcp-http --help >/dev/null
+          /tmp/decisionlock-http-wheel-smoke/bin/decisionlock-reconcile --help >/dev/null
+          /tmp/decisionlock-http-wheel-smoke/bin/decisionlock-reconcile-worker --help >/dev/null
+          /tmp/decisionlock-http-wheel-smoke/bin/python -m decisionlock.http_cli --help >/dev/null
+          /tmp/decisionlock-http-wheel-smoke/bin/python -m pip check
+      - name: Container smoke
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker build --tag decisionlock-ci .
+          test "$(docker run --rm --entrypoint id decisionlock-ci -u)" = "10001"
+          docker run --rm decisionlock-ci --version
+          docker run --rm --entrypoint decisionlock-mcp-http decisionlock-ci --help >/dev/null
+          docker run --rm --entrypoint python decisionlock-ci \
+            -c 'import httpx, starlette, uvicorn; import decisionlock; print(decisionlock.__version__)'
+      - name: Upload release-candidate artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: decisionlock-release-candidate
+          path: |
+            dist/*
+            release/*
+          if-no-files-found: error

decisionlock-0.2.0rc4/.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: CodeQL
+
+on:
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  # Required for the analyze step to publish results and for findings to fail
+  # the check. Without this the previous configuration published no results at
+  # all and nothing could fail.
+  security-events: write
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@adfda868f108ac4222129de456ea554034a27db7 # v4
+        with:
+          languages: python
+      - name: Analyze
+        # Results are uploaded to code scanning so that an alert fails this
+        # check. This step must not be continue-on-error: a CodeQL failure is a
+        # build failure.
+        uses: github/codeql-action/analyze@adfda868f108ac4222129de456ea554034a27db7 # v4
+        with:
+          category: "/language:python"
+          output: codeql-results
+      - name: Retain CodeQL SARIF as build evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: codeql-sarif
+          path: codeql-results/*.sarif
+          retention-days: 30
+          if-no-files-found: error

decisionlock-0.2.0rc4/.github/workflows/decisionlock.yml

@@ -0,0 +1,70 @@
+name: DecisionLock
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  mcp-security-gate:
+    name: MCP security gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install DecisionLock
+        run: python -m pip install -c requirements/runtime-validated.txt -e .
+
+      - name: Run changed-config gate
+        shell: bash
+        run: |
+          set +e
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            BASE_REF="${{ github.event.pull_request.base.sha }}"
+          else
+            BASE_REF="${{ github.event.before }}"
+          fi
+
+          if [[ "$BASE_REF" =~ ^0+$ ]]; then
+            python -m decisionlock.cli scan \
+              --format findings-json \
+              --output decisionlock-findings.json \
+              --summary-output decisionlock-summary.md
+            STATUS=$?
+          else
+            python -m decisionlock.cli gate \
+              --changed-from "$BASE_REF" \
+              --fail-on-risk high \
+              --format findings-json \
+              --output decisionlock-findings.json \
+              --summary-output decisionlock-summary.md
+            STATUS=$?
+          fi
+
+          if [ -n "${GITHUB_STEP_SUMMARY:-}" ] && [ -f decisionlock-summary.md ]; then
+            cat decisionlock-summary.md >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+          exit "$STATUS"
+
+      - name: Upload DecisionLock report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: decisionlock-scan
+          path: |
+            decisionlock-findings.json
+            decisionlock-summary.md
+          if-no-files-found: error

decisionlock-0.2.0rc4/.github/workflows/security.yml

@@ -0,0 +1,42 @@
+name: Security
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+          cache: pip
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -c requirements/runtime-validated.txt -e '.[http]'
+          python -m pip install -r requirements/validation.txt
+      - name: Architecture boundary
+        run: python scripts/check_architecture.py
+      - name: Repository secret scan
+        run: python scripts/check_secrets.py
+      - name: Static security scan
+        run: python scripts/security_scan.py
+      - name: Dependency audit
+        run: |
+          python -m pip_audit \
+            --progress-spinner off \
+            --timeout 60