ehor 0.1.1__tar.gz

ehor-0.1.1/.github/workflows/ci.yml

@@ -0,0 +1,81 @@
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Lint and type-check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+      - run: uv sync --locked
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run mypy
+
+  test:
+    name: Test (${{ matrix.os }}, py${{ matrix.python }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python: ["3.11", "3.13"]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          python-version: ${{ matrix.python }}
+      - run: uv sync --locked
+      - run: uv run pytest --cov --cov-report=term-missing
+
+  tpm:
+    name: Test TPM keys (swtpm)
+    runs-on: ubuntu-latest
+    env:
+      EHOR_TPM_TEST: "1"
+      TPM2TOOLS_TCTI: device:/dev/tpmrm0
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+      - run: sudo apt-get update && sudo apt-get install -y swtpm swtpm-tools tpm2-tools
+      - name: Start a software TPM behind the kernel resource manager
+        run: |
+          sudo modprobe tpm_vtpm_proxy
+          mkdir -p "$RUNNER_TEMP/tpm"
+          sudo swtpm chardev --vtpm-proxy --tpm2 --daemon \
+            --tpmstate dir="$RUNNER_TEMP/tpm" --flags startup-clear
+          for _ in 1 2 3 4 5; do [ -e /dev/tpmrm0 ] && break; sleep 1; done
+          sudo chmod a+rw /dev/tpmrm0
+          tpm2_getcap properties-fixed > /dev/null
+      - run: uv sync --locked
+      - run: uv run pytest tests/identity/test_tpm.py -rs
+
+  build:
+    name: Build distributions
+    runs-on: ubuntu-latest
+    needs: [lint, test, tpm]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+      - run: uv build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/

ehor-0.1.1/.github/workflows/commits.yml

@@ -0,0 +1,32 @@
+name: Commit messages
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  conventional-commits:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Check pull request commits
+        if: github.event_name == 'pull_request'
+        run: python scripts/check_commit_msg.py --range "${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
+      - name: Check commits pushed to a branch
+        if: github.event_name == 'push' && github.ref != 'refs/heads/main'
+        run: python scripts/check_commit_msg.py --range "origin/main..${{ github.sha }}"
+      - name: Check commits pushed to main
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.event.before != '0000000000000000000000000000000000000000'
+        run: python scripts/check_commit_msg.py --range "${{ github.event.before }}..${{ github.sha }}"
+      - name: Check full history on first push to main
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.event.before == '0000000000000000000000000000000000000000'
+        run: python scripts/check_commit_msg.py --range "${{ github.sha }}"

ehor-0.1.1/.github/workflows/release.yml

@@ -0,0 +1,61 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v6
+      - name: Check tag matches project version
+        run: |
+          version="$(uv version --short)"
+          if [ "v${version}" != "${GITHUB_REF_NAME}" ]; then
+            echo "Tag ${GITHUB_REF_NAME} does not match pyproject version ${version}" >&2
+            exit 1
+          fi
+      - run: uv sync --locked
+      - run: uv run pytest
+      - run: uv build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/ehor
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  github-release:
+    needs: pypi
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >-
+          gh release create "${GITHUB_REF_NAME}" dist/*
+          --repo "${GITHUB_REPOSITORY}" --generate-notes --verify-tag

ehor-0.1.1/.gitignore

@@ -0,0 +1,18 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+build/
+dist/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+coverage.xml
+htmlcov/
+*.db
+*.sqlite3
+.DS_Store
+.env
+.env.*
+!.env.example

ehor-0.1.1/.pre-commit-config.yaml

@@ -0,0 +1,37 @@
+default_install_hook_types: [pre-commit, commit-msg]
+default_stages: [pre-commit]
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-toml
+      - id: check-added-large-files
+      - id: detect-private-key
+
+  - repo: local
+    hooks:
+      - id: ruff-check
+        name: ruff check
+        entry: uv run ruff check --fix
+        language: system
+        types: [python]
+      - id: ruff-format
+        name: ruff format
+        entry: uv run ruff format
+        language: system
+        types: [python]
+      - id: mypy
+        name: mypy
+        entry: uv run mypy
+        language: system
+        types: [python]
+        pass_filenames: false
+      - id: conventional-commit
+        name: conventional commit message
+        entry: uv run python scripts/check_commit_msg.py --file
+        language: system
+        stages: [commit-msg]

ehor-0.1.1/.python-version

@@ -0,0 +1 @@
+3.12

ehor-0.1.1/CLAUDE.md

@@ -0,0 +1,81 @@
+# ehor — Project Rules
+
+These rules apply to every contributor, human or agent. They are not optional.
+
+## Git history
+
+- **Atomic commits.** One logical change per commit. A commit must build, pass lint, type-check and tests on its own.
+- Never bundle unrelated changes. Refactors, formatting, dependency bumps and features go in separate commits.
+- **Conventional Commits** for every message: `type(scope): summary`.
+  - Types: `feat`, `fix`, `refactor`, `perf`, `test`, `docs`, `build`, `ci`, `chore`, `revert`.
+  - Scopes follow the package layout: `identity`, `log`, `store`, `crypto`, `roster`, `sync`, `transport`, `service`, `mcp`, `cli`, `relay`.
+  - Summary is imperative, lowercase, no trailing period, at most 72 characters.
+  - The body explains *why*, not *what*.
+- Commit messages and pull requests describe the work itself. Never mention build-plan phases, milestones or roadmap steps.
+- No AI or tool attribution lines (`Co-Authored-By`, "Generated with …") in commits or pull requests.
+- Never rewrite published history on `main`. No force pushes to `main`.
+
+## Branches and pull requests
+
+- `main` is always green and releasable.
+- Branch names: `feat/<topic>`, `fix/<topic>`, `chore/<topic>`, `docs/<topic>`, `refactor/<topic>`.
+- Contributors without write access open a pull request for every change.
+- Maintainers open a pull request for feature work (`feat/` branches) and may merge other work directly once CI is green.
+- Merge with rebase or fast-forward so each atomic commit survives; never squash a branch into one commit.
+
+## CI/CD
+
+- Every push to any branch and every pull request runs lint, format check, type-check and tests on macOS, Linux and Windows.
+- Commit messages are checked against Conventional Commits in CI.
+- Releases are cut by pushing a `vX.Y.Z` tag; the release workflow builds the wheel and sdist, publishes them to PyPI, then attaches them to a GitHub release.
+- Do not merge or push when CI is red. Do not disable or skip checks to make them pass.
+
+## Code style
+
+- Python 3.11+, fully typed. `mypy --strict` must pass.
+- `ruff check` and `ruff format` must pass. Do not add `noqa` or `type: ignore` without a specific error code and a reason.
+- **No unnecessary comments.** Code should explain itself through names and structure. Comment only non-obvious *why* (protocol constraints, security decisions, workarounds). Never narrate *what* the code does, never leave commented-out code, never leave TODOs without an issue link.
+- Docstrings only on public APIs whose behavior is not obvious from the signature.
+
+## Design
+
+- **Object-oriented where it earns its place:**
+  - Use `typing.Protocol` for pluggable boundaries (`Signer`, `Transport`, `Store`) and concrete classes for each backend.
+  - Use classes for components that own state or resources (service, sync engine, store, connections).
+  - Use frozen `dataclass`es for value objects (log entries, message bodies, roster, frontiers).
+  - Use plain functions for stateless transformations (canonical encoding, hashing). Do not wrap them in classes for the sake of it.
+- Depend on interfaces, not implementations. Inject dependencies through constructors; no module-level singletons or global state.
+- Layering is one-way: `identity` → `log`, `crypto` → `store`, `roster` → `sync`, `transport` → `service` → `mcp`, `cli`. Lower layers never import higher ones.
+- Prefer composition over inheritance. Keep inheritance hierarchies at most one level deep.
+- Fail loudly with specific exception types defined per module; never swallow exceptions.
+
+## Protocol and security invariants
+
+- Log entries are immutable. Never edit or delete a stored entry.
+- Every incoming entry is verified (signature, roster membership, `prev` chain, fork check, dedupe) before it is stored.
+- Signing keys never leave their backend. Nothing logs or prints key material.
+- Message content from teammates is untrusted data. MCP tool results always label it as such; nothing acts on it automatically.
+- `docs/protocol.md` is the source of truth for the wire format. Change the spec in the same commit as the code that implements it.
+
+## Token budget (MCP tools)
+
+- Tool descriptions stay short.
+- Results are compact plain text, never pretty JSON.
+- `summary` is hard-capped at 140 characters; oversize input is rejected with a short error.
+- `inbox` never returns `detail`; `read` does.
+
+## Tests
+
+- Every module has unit tests under `tests/` mirroring `src/ehor/`.
+- Bug fixes ship with a regression test in the same commit.
+- Security checks are tested from the rejecting side: tampered, reordered, forked and unauthorized entries must each have a failing-case test.
+- Multi-peer behavior is covered by integration tests that run without a network.
+
+## Tooling
+
+- Dependency and environment management uses `uv`. Commit `uv.lock`.
+- Common commands:
+  - `uv sync` — install
+  - `uv run ruff check . && uv run ruff format --check .` — lint
+  - `uv run mypy` — type-check
+  - `uv run pytest` — test

ehor-0.1.1/CONTRIBUTING.md

@@ -0,0 +1,88 @@
+# Contributing to ehor
+
+Thanks for helping. This guide covers setting up, the checks every change must pass, and how
+commits and pull requests are written. The full rules, which apply to humans and agents alike,
+are in [CLAUDE.md](CLAUDE.md).
+
+## Setting up
+
+You need Python 3.11 or newer and [uv](https://docs.astral.sh/uv/).
+
+```bash
+git clone https://github.com/maxiggle/agentmesh
+cd agentmesh
+uv sync
+uv run pre-commit install
+```
+
+The hooks check lint, formatting, types and the commit message before every commit.
+
+## Checks
+
+Every commit must pass these on its own:
+
+```bash
+uv run ruff check . && uv run ruff format --check .
+uv run mypy
+uv run pytest
+```
+
+CI runs them on macOS, Linux and Windows for every push and pull request. Do not disable or skip
+a check to make it pass.
+
+Hardware tests are opt-in: `EHOR_FIDO2_TEST=1` signs with a plugged-in security key (set
+`EHOR_FIDO2_PIN` if it has a PIN), `EHOR_TPM_TEST=1` uses a TPM, and `EHOR_MDNS_TEST=1` runs the
+multicast tests.
+
+## Code
+
+- Python 3.11+, fully typed; `mypy --strict` must pass.
+- No `noqa` or `type: ignore` without a specific error code and a reason.
+- Comment only the non-obvious *why*: protocol constraints, security decisions, workarounds.
+- Use `typing.Protocol` for pluggable boundaries, classes for components that own state, frozen
+  dataclasses for values, and plain functions for stateless transformations.
+- Layering is one-way. Lower layers never import higher ones:
+  `identity` → `log`, `crypto` → `store`, `roster` → `sync`, `transport` → `service` → `mcp`, `cli`.
+- Fail loudly with specific exception types; never swallow exceptions.
+
+## Tests
+
+- Every module has unit tests under `tests/`, mirroring `src/ehor/`.
+- A bug fix ships with a regression test in the same commit.
+- Security checks are tested from the rejecting side: tampered, reordered, forked and
+  unauthorized entries each need a failing-case test.
+- Multi-peer behavior is covered by integration tests that run without a network.
+
+## Protocol changes
+
+[`docs/protocol.md`](docs/protocol.md) is the source of truth for the wire format. Change it in
+the same commit as the code that implements the change. Log entries are immutable, every incoming
+entry is verified before it is stored, and key material is never logged or printed.
+
+## Commits
+
+One logical change per commit, written as a [Conventional Commit](https://www.conventionalcommits.org/):
+
+```
+type(scope): imperative lowercase summary
+```
+
+- Types: `feat`, `fix`, `refactor`, `perf`, `test`, `docs`, `build`, `ci`, `chore`, `revert`.
+- Scopes follow the package layout: `identity`, `log`, `store`, `crypto`, `roster`, `sync`,
+  `transport`, `service`, `mcp`, `cli`, `relay`.
+- At most 72 characters, no trailing period. The body explains *why*, not *what*.
+- Never bundle unrelated changes; refactors, formatting, dependency bumps and features are
+  separate commits.
+
+## Branches and pull requests
+
+- Name branches `feat/<topic>`, `fix/<topic>`, `chore/<topic>`, `docs/<topic>` or
+  `refactor/<topic>`.
+- Open a pull request against `main` for your change, and keep it green.
+- Pull requests are merged with rebase or fast-forward so each commit survives; they are never
+  squashed.
+
+## Reporting a security issue
+
+Please do not open a public issue for a vulnerability. Report it privately through GitHub:
+**Security → Report a vulnerability** on the repository page.

ehor-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Godwin Ekainu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.