dorian-vwp 1.0.0__tar.gz

dorian_vwp-1.0.0/.github/ISSUE_TEMPLATE/benchmark_submission.yml

@@ -0,0 +1,63 @@
+name: Benchmark / reproduction submission
+description: A reproducible public-repo case for the micro-benchmark (a real catch, a false alarm, or a clean case).
+labels: [benchmark, reproduction]
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        See docs/PUBLIC_BENCHMARK_PROTOCOL.md and bench/public/manifest.example.json.
+        Submissions must be reproducible from frozen inputs; results are scoped to
+        those inputs, never a broad real-world claim (docs/VALIDATION_HONESTY.md).
+  - type: input
+    id: repo
+    attributes:
+      label: Public repo URL
+    validations:
+      required: true
+  - type: input
+    id: base_sha
+    attributes:
+      label: Frozen base SHA
+    validations:
+      required: true
+  - type: input
+    id: head
+    attributes:
+      label: Head SHA or patch
+      description: A frozen head SHA, or a patch applied to base (preferred for injected mutations).
+    validations:
+      required: true
+  - type: textarea
+    id: claims
+    attributes:
+      label: claims.json
+      render: json
+    validations:
+      required: true
+  - type: dropdown
+    id: layer
+    attributes:
+      label: Which layer does this exercise?
+      options: ["trigger/selection", "truth/alarm", "both"]
+    validations:
+      required: true
+  - type: input
+    id: expected
+    attributes:
+      label: Expected outcome
+      description: e.g. "claim X selected and BROKEN" / "no claim selected"
+    validations:
+      required: true
+  - type: input
+    id: license
+    attributes:
+      label: Repo license
+    validations:
+      required: true
+  - type: dropdown
+    id: outcome
+    attributes:
+      label: What is this case
+      options: ["true catch", "false alarm", "miss", "partial (trigger only)", "clean (no break)"]
+    validations:
+      required: true

dorian_vwp-1.0.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,58 @@
+name: Bug report
+description: dorian crashed, errored, or did something other than its documented behavior.
+labels: [bug]
+body:
+  - type: input
+    id: version
+    attributes:
+      label: dorian version
+      description: Output of `dorian --version`.
+      placeholder: dorian 0.10.0
+    validations:
+      required: true
+  - type: input
+    id: command
+    attributes:
+      label: Exact command run
+      placeholder: dorian verify note.md --claims claims.json
+    validations:
+      required: true
+  - type: dropdown
+    id: checker
+    attributes:
+      label: Checker family involved
+      options: ["C1 span", "C3 path/symbol/string/regex", "C4 pytest", "C5 typed data", "C5 shell", "none / not sure"]
+    validations:
+      required: true
+  - type: dropdown
+    id: executable
+    attributes:
+      label: Were executable checkers (C4 pytest / C5 shell) involved?
+      options: ["No", "Yes", "Not sure"]
+    validations:
+      required: true
+  - type: dropdown
+    id: trust
+    attributes:
+      label: Context
+      options: ["Trusted/internal repo", "Untrusted claims (used --deny-exec)", "CI / GitHub Action", "Other"]
+    validations:
+      required: true
+  - type: textarea
+    id: expected_actual
+    attributes:
+      label: Expected vs. actual
+      description: What you expected, what happened, and the exit code.
+    validations:
+      required: true
+  - type: textarea
+    id: sidecar
+    attributes:
+      label: Relevant claim / sidecar excerpt
+      description: The claim or `.warrant` snippet. Redact anything sensitive.
+      render: json
+  - type: input
+    id: artifact
+    attributes:
+      label: Artifact path
+      placeholder: docs/changes/login.md

dorian_vwp-1.0.0/.github/ISSUE_TEMPLATE/checker_request.yml

@@ -0,0 +1,34 @@
+name: Checker request
+description: A kind of claim you want to make deterministically that no current checker can verify.
+labels: [checker-request, enhancement]
+body:
+  - type: textarea
+    id: claim_kind
+    attributes:
+      label: What claim do you want to hold true over time?
+      description: A concrete example sentence an agent or human would write.
+      placeholder: '"the /login route still requires the rate-limit decorator"'
+    validations:
+      required: true
+  - type: textarea
+    id: deterministic
+    attributes:
+      label: How could this be checked deterministically (no model at check time)?
+      description: dorian only adds checkers that are deterministic and, ideally, non-executing. What file would it read, and what would it look for?
+    validations:
+      required: true
+  - type: dropdown
+    id: closest
+    attributes:
+      label: Closest existing checker
+      options: ["C1 span", "C3 path/symbol/string/regex", "C4 pytest", "C5 typed data", "C5 shell", "none fit"]
+    validations:
+      required: true
+  - type: dropdown
+    id: executing
+    attributes:
+      label: Would it need to execute code?
+      description: Non-executing checkers are strongly preferred (deny-exec keeps them usable in untrusted contexts).
+      options: ["No — reads files only", "Yes — runs code", "Not sure"]
+    validations:
+      required: true

dorian_vwp-1.0.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,10 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability (private)
+    url: https://github.com/ajaysurya1221/dorian/security/advisories/new
+    about: >-
+      Report a vulnerability privately via a GitHub security advisory. Do NOT
+      open a public issue with working exploit details. See SECURITY.md.
+  - name: Question / discussion
+    url: https://github.com/ajaysurya1221/dorian/discussions
+    about: Open-ended questions about claims, checkers, or the trust model.

dorian_vwp-1.0.0/.github/ISSUE_TEMPLATE/false_alarm.yml

@@ -0,0 +1,34 @@
+name: False alarm
+description: dorian flipped a claim to BROKEN/REVOKED but the claim was actually still true.
+labels: [false-alarm, accuracy]
+body:
+  - type: input
+    id: version
+    attributes:
+      label: dorian version
+    validations:
+      required: true
+  - type: textarea
+    id: claim
+    attributes:
+      label: The claim and its checker(s)
+      render: json
+    validations:
+      required: true
+  - type: textarea
+    id: still_true
+    attributes:
+      label: Why the claim is still true
+      description: Show that the fact still holds despite the BROKEN verdict (e.g. the value moved but the checker was brittle).
+    validations:
+      required: true
+  - type: input
+    id: change
+    attributes:
+      label: Change that triggered the false alarm
+      placeholder: reformatted the constant; renamed the file; etc.
+  - type: input
+    id: command
+    attributes:
+      label: Command + exit code
+      placeholder: dorian revalidate --since main  (exit 4)

dorian_vwp-1.0.0/.github/ISSUE_TEMPLATE/false_pass.yml

@@ -0,0 +1,44 @@
+name: False pass / false confidence
+description: A claim stayed TRUSTED (or sealed) when the underlying fact was actually false or unverified.
+labels: [false-pass, accuracy]
+body:
+  - type: markdown
+    attributes:
+      value: >-
+        This is the most important report dorian can get: a verdict that said
+        "true" when it wasn't. It usually means a **weak binding** (the watched
+        source didn't include the file that defines the fact) or a **checker too
+        weak** to see the change (the trigger-vs-truth ceiling).
+  - type: input
+    id: version
+    attributes:
+      label: dorian version
+    validations:
+      required: true
+  - type: textarea
+    id: claim
+    attributes:
+      label: The claim and its checker(s)
+      description: The natural-language claim plus the `type:program` of each checker.
+      render: json
+    validations:
+      required: true
+  - type: textarea
+    id: why_false
+    attributes:
+      label: Why the fact was actually false / unverified
+      description: What changed in the source that the verdict missed.
+    validations:
+      required: true
+  - type: dropdown
+    id: suspected
+    attributes:
+      label: Suspected cause
+      options: ["Weak binding (watched file didn't define the fact)", "Checker too weak (e.g. symbol exists but behavior changed)", "Not sure"]
+    validations:
+      required: true
+  - type: input
+    id: command
+    attributes:
+      label: Command + exit code
+      placeholder: dorian revalidate --since HEAD~1  (exit 0)

dorian_vwp-1.0.0/.github/workflows/ci.yml

@@ -0,0 +1,22 @@
+name: ci
+on:
+  push: { branches: [main] }
+  pull_request:
+# Least privilege: CI only reads the repo. No write scopes, so a malicious PR
+# cannot use the default GITHUB_TOKEN to mutate the repo or releases.
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v6.0.3
+      - uses: astral-sh/setup-uv@v8.2.0
+        with: { python-version: "${{ matrix.python }}" }
+      - run: uv sync --all-extras
+      - run: uv run ruff check src tests bench
+      - run: uv run ruff format --check src tests bench
+      - run: uv run pytest

dorian_vwp-1.0.0/.github/workflows/public-microbench.yml

@@ -0,0 +1,62 @@
+# Public real-repo micro-benchmark — MANUAL dispatch only, read-only, fail-closed.
+#
+# Safe by design: workflow_dispatch only (never auto/PR-triggered), read-only token, NO
+# pull_request_target, clones cached by frozen SHA, results uploaded as artifacts. The harness
+# runs with --deny-exec by default (a fail-closed re-check policy, NOT a sandbox): C4/C5 checkers
+# are blocked and fold to ERRORED. While claims are draft/human-review-required the run reports
+# NO_CLAIMS — no numbers are produced. Do NOT add this to branch protection.
+name: public-microbench
+
+on:
+  workflow_dispatch:
+    inputs:
+      repo:
+        description: "limit to one manifest repo (blank = all eligible)"
+        required: false
+        default: ""
+      deny_exec:
+        description: "block C4/C5 at re-check (fail-closed; not a sandbox)"
+        type: boolean
+        required: false
+        default: true
+
+permissions:
+  contents: read
+
+jobs:
+  microbench:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6.0.3
+      - uses: astral-sh/setup-uv@v8.2.0
+        with: { python-version: "3.12" }
+      - run: uv sync --all-extras
+
+      # Cache cloned public subjects keyed by the manifest's frozen SHAs, so a re-run is offline.
+      - name: Cache frozen subject checkouts
+        uses: actions/cache@v4
+        with:
+          path: .bench/public-work/checkouts
+          key: public-microbench-checkouts-${{ hashFiles('bench/public/manifest.v1.yaml') }}
+
+      - name: Plan (dry-run — no clone, no seal, no results)
+        run: >-
+          uv run python -m dorian.cli bench public-repos
+          --manifest bench/public/manifest.v1.yaml
+          --out bench/public/results --dry-run
+
+      - name: Run harness (fail-closed re-check)
+        run: >-
+          uv run python -m dorian.cli bench public-repos
+          --manifest bench/public/manifest.v1.yaml
+          --out bench/public/results --workdir .bench/public-work
+          ${{ inputs.repo != '' && format('--repo {0}', inputs.repo) || '' }}
+          ${{ inputs.deny_exec && '--deny-exec' || '' }}
+
+      - name: Upload results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: public-microbench-results
+          path: bench/public/results/
+          if-no-files-found: ignore

dorian_vwp-1.0.0/.github/workflows/publish-testpypi.yml

@@ -0,0 +1,61 @@
+# TestPyPI dry-run via Trusted Publishing (OIDC) — MANUAL ONLY.
+#
+# A rehearsal of the real publish (publish.yml) against TestPyPI. It exists so the
+# Trusted-Publisher / OIDC path is verified BEFORE a real release, and it never
+# touches production PyPI. Like publish.yml it:
+#   - runs only on workflow_dispatch (never push/PR/fork),
+#   - uses OIDC (id-token: write) — NO stored API token, no long-lived secret,
+#   - is gated behind a GitHub Environment with required reviewers.
+#
+# Prerequisite (one-time, off-CI): create a TestPyPI Trusted Publisher for
+# project `dorian-vwp` pointing at this repo + workflow `publish-testpypi.yml` +
+# environment `testpypi`. Until then the upload step has no credentials and is a
+# no-op rehearsal of the wiring. The real publish to pypi.org stays in publish.yml.
+name: publish-testpypi
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Tag to build and dry-run-publish to TestPyPI (e.g. v1.0.0rc2)
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6.0.3
+        with:
+          ref: ${{ inputs.ref }}
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+          python -m twine check dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  testpypi:
+    needs: build
+    runs-on: ubuntu-latest
+    # the environment gates the dry-run behind required reviewers and is the
+    # subject the TestPyPI Trusted Publisher is bound to
+    environment: testpypi
+    permissions:
+      id-token: write  # OIDC: mint a short-lived token, no stored secret
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to TestPyPI (Trusted Publishing dry-run)
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/

dorian_vwp-1.0.0/.github/workflows/publish.yml

@@ -0,0 +1,70 @@
+# PyPI publish via Trusted Publishing (OIDC) — MANUAL ONLY.
+#
+# This workflow does NOT run on push or tag. It runs only when a maintainer
+# triggers it by hand (workflow_dispatch) against a tag, and only after the PyPI
+# side is configured:
+#   1. Create a PyPI Trusted Publisher for project `dorian-vwp` pointing at this
+#      repo + workflow `publish.yml` + environment `pypi` (no API token anywhere).
+#   2. Create a GitHub Environment named `pypi` with required-reviewer protection.
+# Until both exist, the publish step has no credentials and cannot upload.
+#
+# It deliberately uses OIDC (id-token: write) instead of a stored token, and
+# never triggers from an arbitrary branch — see docs/RELEASE_CHECKLIST.md.
+name: publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Tag to build and publish (e.g. v0.10.0)
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+          python -m twine check dist/*
+      - name: Verify the built version matches the tag
+        run: |
+          python - <<'PY'
+          import os, pathlib, tomllib
+          tag = os.environ["REF"].lstrip("v")
+          ver = tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"]
+          assert ver == tag, f"tag {tag!r} != pyproject version {ver!r}"
+          print(f"ok: building {ver}")
+          PY
+        env:
+          REF: ${{ inputs.ref }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    # the environment gates publishing behind required reviewers and is the
+    # subject the PyPI Trusted Publisher is bound to
+    environment: pypi
+    permissions:
+      id-token: write  # OIDC: mint a short-lived token, no stored secret
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to PyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1

dorian_vwp-1.0.0/.github/workflows/release-gate.yml

@@ -0,0 +1,87 @@
+# Release gate — build, test-matrix, hash, and ATTEST PROVENANCE for a tag.
+#
+# Build + verification automation for the 1.0.0 line. It does NOT publish to PyPI
+# (that is publish.yml / publish-testpypi.yml, manual + OIDC). It runs only on a
+# manual dispatch against a tag or on a pushed tag — never on a fork PR — so the
+# id-token / attestations write scopes are never exposed to untrusted code.
+#
+# Provenance lane: GitHub artifact attestations (actions/attest-build-provenance),
+# an in-toto/SLSA build-provenance statement signed via Sigstore and recorded in
+# the public transparency log. This is the accepted GA provenance lane when a
+# signed git tag is not available (see docs/RELEASE_GATE_1_0.md).
+name: release-gate
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Tag to build, verify, and attest (e.g. v1.0.0rc2)
+        required: true
+  push:
+    tags: ["v*"]
+
+# Default to read-only; elevate per-job only where strictly required.
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v6.0.3
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v8.2.0
+        with: { python-version: "${{ matrix.python }}" }
+      - run: uv sync --all-extras
+      - run: uv run ruff check src tests bench
+      - run: uv run ruff format --check src tests bench
+      - run: uv run pytest -m "not slow"
+
+  build-attest:
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write       # OIDC for Sigstore signing — short-lived, no stored secret
+      attestations: write   # write the build-provenance attestation
+    steps:
+      - uses: actions/checkout@v6.0.3
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+          python -m twine check dist/*
+      - name: Verify the built version matches the tag
+        if: ${{ inputs.ref != '' || startsWith(github.ref, 'refs/tags/') }}
+        run: |
+          python - <<'PY'
+          import os, pathlib, re, tomllib
+          ref = os.environ.get("REF") or os.environ.get("GITHUB_REF", "")
+          tag = re.sub(r"^refs/tags/", "", ref).lstrip("v")
+          ver = tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"]
+          assert ver == tag, f"tag {tag!r} != pyproject version {ver!r}"
+          print(f"ok: building {ver}")
+          PY
+        env:
+          REF: ${{ inputs.ref }}
+      - name: SHA-256 of artifacts
+        run: |
+          cd dist && sha256sum * | tee SHA256SUMS
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: "dist/*.whl, dist/*.tar.gz"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/

dorian_vwp-1.0.0/.gitignore

@@ -0,0 +1,31 @@
+__pycache__/
+*.pyc
+.venv/
+dist/
+.warrant/index.sqlite
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+bench/workspace/
+bench/cache/
+.claims_cache/
+bench/results/
+bench/real/
+.DS_Store
+/assets/
+.env
+
+# tool working dirs (not release content)
+.claude/
+.gitnexus/
+
+# internal program/audit working docs — provenance only, never shipped in the release
+/RESEARCH_REPORT_DORIAN_0_11_0.md
+/V1_IMPLEMENTATION_TRACKER.md
+/V1_ALIGNMENT_REPORT.md
+/AUDIT_RELEASE_GATE.md
+/GITHUB_RELEASE_NOTES.md
+research/
+.bench/
+.release/

dorian_vwp-1.0.0/.python-version

@@ -0,0 +1 @@
+3.12

dorian_vwp-1.0.0/.warrant/.gitignore

@@ -0,0 +1,2 @@
+index.sqlite
+index.sqlite-*