eqiora 0.1.0a1__tar.gz

eqiora-0.1.0a1/.cargo/config.toml

@@ -0,0 +1,5 @@
+[alias]
+xtask = "run --quiet --package xtask --"
+
+[resolver]
+incompatible-rust-versions = "fallback"

eqiora-0.1.0a1/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,35 @@
+name: Bug report
+description: Report reproducible incorrect behavior
+title: "bug: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: Please do not report security vulnerabilities here; use SECURITY.md.
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Observed behavior
+      description: Include the engineering or semantic consequence.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include model, command, revision, and complete diagnostics.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      placeholder: OS, Rust version, target/backend
+    validations:
+      required: true

eqiora-0.1.0a1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security report
+    url: https://github.com/nkiyohara/eqiora/security/advisories/new
+    about: Report vulnerabilities through GitHub private vulnerability reporting.

eqiora-0.1.0a1/.github/ISSUE_TEMPLATE/design.yml

@@ -0,0 +1,33 @@
+name: Design proposal
+description: Propose or challenge an architectural or semantic decision
+title: "design: "
+labels: ["design"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: State the problem without assuming a particular solution.
+    validations:
+      required: true
+  - type: textarea
+    id: formulation
+    attributes:
+      label: Proposed formulation
+      description: Include invariants and ownership boundaries.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives
+      description: Compare at least two credible alternatives.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Falsifying evidence or experiment
+      description: What smallest test could change this decision?
+    validations:
+      required: true

eqiora-0.1.0a1/.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5
+  - package-ecosystem: cargo
+    directory: "/studio/src-tauri"
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 5

eqiora-0.1.0a1/.github/pull_request_template.md

@@ -0,0 +1,50 @@
+## Summary
+
+- Bounded claim:
+- Important non-claims:
+- Invariant or user outcome:
+
+## Design
+
+- Related issue/RFC:
+- Alternatives considered:
+- Compatibility impact:
+- Central contract touched (or `none`):
+
+## Evidence
+
+- Registered case(s):
+- Independent positive oracle:
+- Meaningful falsifier:
+- `case.toml` capability/claim-boundary change:
+
+## Abstraction budget
+
+- New crate/public type/enum/trait/wire field/registry (or `none`):
+- Two concrete consumers and invariant owner:
+- Existing branch/type removed or simplified:
+- Unknown/unsupported/stale value rejection:
+
+## Verification
+
+- [ ] Fast local gate (during development)
+- [ ] Affected local gate (before integration)
+- [ ] Formatting, tests, Clippy, and changed public Rustdoc
+- [ ] Dependency-layer check when manifests or layer ownership changed
+- [ ] Dependency policy when dependencies changed
+- [ ] New or updated registered evidence when semantics changed
+- [ ] Capability matrix synchronized to the exact bounded claim
+
+Exact commands and environment limitations:
+
+## Optional implementation-agent provenance
+
+Implementation-agent configuration: not-supplied
+
+When an exact configuration is attestable, replace `not-supplied` with its
+`agent-config-v1:<digest>` from the protected-base registry. A supplied
+identifier is validated locally; absence does not block integration.
+
+## Contributor certification
+
+- [ ] Every commit contains a valid DCO `Signed-off-by` trailer.

eqiora-0.1.0a1/.github/workflows/ci-definition-trust.yml

@@ -0,0 +1,33 @@
+name: CI definition trust
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: ci-definition-trust-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  trust:
+    name: CI definition trust
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out the exact protected base
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          persist-credentials: false
+      - name: Inspect changed-file metadata only
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: >-
+          python3 tools/ci/check_trust_boundary.py
+          --repository "$GITHUB_REPOSITORY"
+          --pull-number "${{ github.event.pull_request.number }}"
+          --expected-file-count "${{ github.event.pull_request.changed_files }}"

eqiora-0.1.0a1/.github/workflows/ci.yml

@@ -0,0 +1,333 @@
+name: CI
+
+run-name: CI / ${{ github.event_name }} / ${{ github.event.pull_request.head.sha || inputs.commit }}
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: Full 40-character commit SHA to verify
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || inputs.commit }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  CARGO_BUILD_WARNINGS: deny
+
+jobs:
+  changes:
+    name: Change ownership
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      target_sha: ${{ steps.classify.outputs.target_sha }}
+      full: ${{ steps.classify.outputs.full }}
+      rust: ${{ steps.classify.outputs.rust }}
+      msrv: ${{ steps.classify.outputs.msrv }}
+      python: ${{ steps.classify.outputs.python }}
+      studio: ${{ steps.classify.outputs.studio }}
+      dependency_policy: ${{ steps.classify.outputs.dependency_policy }}
+      cubecl_experiment: ${{ steps.classify.outputs.cubecl_experiment }}
+      python_versions: ${{ steps.classify.outputs.python_versions }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || inputs.commit }}
+          persist-credentials: false
+      - name: Test CI ownership and aggregate contracts
+        run: python3 -m unittest discover -s tools/ci/tests -v
+      - name: Classify exact change surface
+        id: classify
+        env:
+          CI_EVENT_NAME: ${{ github.event_name }}
+          CI_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          CI_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          CI_REQUESTED_COMMIT: ${{ inputs.commit }}
+        run: |
+          python3 tools/ci/classify_changes.py \
+            --event "$CI_EVENT_NAME" \
+            --base "$CI_BASE_SHA" \
+            --head "$CI_HEAD_SHA" \
+            --requested-commit "$CI_REQUESTED_COMMIT" >> "$GITHUB_OUTPUT"
+
+  documentation:
+    name: Documentation contract
+    needs: changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.changes.outputs.target_sha }}
+          persist-credentials: false
+      - name: Check local links and required entry points
+        run: |
+          python3 tools/ci/check_docs.py .
+          python3 tools/ci/check_public_release_tree.py .
+
+  quality:
+    name: Stable quality gate
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.changes.outputs.target_sha }}
+          persist-credentials: false
+      - name: Install MPI build and runtime dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends --yes libopenmpi-dev openmpi-bin libclang-dev libffi-dev
+          mpirun --version
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Install the declared NumPy test floor
+        run: |
+          requirement="$(
+            python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["tool"]["eqiora-distribution"]["tested-numpy-floor"])'
+          )"
+          python -m pip install --only-binary=:all: "$requirement"
+      - name: Install stable Rust
+        run: rustup toolchain install stable --profile minimal --component rustfmt,clippy
+      - name: Formatting
+        run: cargo +stable fmt --all -- --check
+      - name: Clippy
+        run: cargo +stable clippy --workspace --all-targets --all-features --keep-going -- -D warnings
+      - name: Tests
+        run: cargo +stable test --workspace --all-targets --locked
+      - name: Full feature tests
+        if: needs.changes.outputs.full == 'true'
+        run: cargo +stable test --workspace --all-targets --all-features --locked
+      - name: Dependency layers
+        run: cargo +stable xtask check-layers
+      - name: Public facade
+        run: cargo +stable xtask check-facade
+      - name: Documentation
+        env:
+          RUSTDOCFLAGS: -D warnings
+        run: cargo +stable doc --workspace --no-deps --locked
+
+  host_evidence:
+    name: Host-CPU verification evidence
+    needs: changes
+    if: needs.changes.outputs.rust == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.changes.outputs.target_sha }}
+          persist-credentials: false
+      - name: Install evidence build and runtime dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends --yes libopenmpi-dev openmpi-bin libclang-dev libffi-dev
+          mpirun --version
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+      - name: Install the declared NumPy test floor
+        run: |
+          requirement="$(
+            python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["tool"]["eqiora-distribution"]["tested-numpy-floor"])'
+          )"
+          python -m pip install --only-binary=:all: "$requirement"
+      - name: Install the declared Python candidate builder
+        run: |
+          requirement="$(
+            python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["tool"]["eqiora-distribution"]["uv"])'
+          )"
+          python -m pip install --only-binary=:all: "$requirement"
+          uv --version
+      - name: Install stable Rust
+        run: rustup toolchain install stable --profile minimal
+      - name: Run registered host evidence
+        run: cargo +stable run --locked -p eqiora-verify -- run --environment host-cpu
+
+  msrv:
+    name: MSRV 1.89
+    needs: changes
+    if: needs.changes.outputs.msrv == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.changes.outputs.target_sha }}
+          persist-credentials: false
+      - name: Install optional-adapter build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends --yes libopenmpi-dev openmpi-bin libclang-dev libffi-dev
+      - name: Install MSRV
+        run: rustup toolchain install 1.89.0 --profile minimal
+      - name: Check every production feature and target
+        run: cargo +1.89.0 check --workspace --all-targets --all-features --locked
+
+  dependency_policy:
+    name: Dependency policy
+    needs: changes
+    if: needs.changes.outputs.dependency_policy == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.changes.outputs.target_sha }}
+          persist-credentials: false
+      - name: Check root dependency policy
+        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
+        with:
+          arguments: --all-features --locked
+          command: check
+      - name: Check Studio dependency policy
+        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
+        with:
+          manifest-path: studio/src-tauri/Cargo.toml
+          arguments: --all-features --locked --config studio/src-tauri/deny.toml
+          command: check
+
+  cubecl_experiment:
+    name: Isolated CubeCL contract experiment
+    needs: changes
+    if: needs.changes.outputs.cubecl_experiment == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.changes.outputs.target_sha }}
+          persist-credentials: false
+      - name: Install latest stable Rust
+        run: rustup toolchain install stable --profile minimal --component rustfmt,clippy
+      - name: Formatting
+        run: cargo +stable fmt --manifest-path experiments/cubecl-local-action/Cargo.toml -- --check
+      - name: Clippy
+        run: cargo +stable clippy --manifest-path experiments/cubecl-local-action/Cargo.toml --locked --all-targets -- -D warnings
+      - name: Device-independent contract tests
+        run: cargo +stable test --manifest-path experiments/cubecl-local-action/Cargo.toml --locked
+
+  python_wheel:
+    name: Python ${{ matrix.python }} installed wheel
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ${{ fromJSON(needs.changes.outputs.python_versions) }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.changes.outputs.target_sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install stable Rust
+        run: rustup toolchain install stable --profile minimal
+      - name: Test installed wheel
+        run: python tools/ci/python_package_gate.py
+
+  studio:
+    name: Studio projection and native boundary
+    needs: changes
+    if: needs.changes.outputs.studio == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.changes.outputs.target_sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24.18.0
+          cache: npm
+          cache-dependency-path: studio/package-lock.json
+      - name: Install native WebView dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends --yes libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev
+      - name: Install stable Rust
+        run: |
+          rustup toolchain install stable --profile minimal --component rustfmt,clippy
+          rustup toolchain install 1.89.0 --profile minimal
+      - name: Install locked frontend dependencies
+        working-directory: studio
+        run: npm ci
+      - name: Frontend quality and unit tests
+        working-directory: studio
+        run: |
+          npm run check
+          npm test
+          npm run build
+      - name: Accessible interaction tests
+        working-directory: studio
+        run: npm run test:e2e
+      - name: Native adapter formatting
+        run: cargo +stable fmt --manifest-path studio/src-tauri/Cargo.toml -- --check
+      - name: Native adapter MSRV
+        run: cargo +1.89.0 check --manifest-path studio/src-tauri/Cargo.toml --locked --all-targets
+      - name: Native adapter Clippy
+        run: cargo +stable clippy --manifest-path studio/src-tauri/Cargo.toml --locked --all-targets -- -D warnings
+      - name: Native adapter tests
+        run: cargo +stable test --manifest-path studio/src-tauri/Cargo.toml --locked
+      - name: Production shell build
+        working-directory: studio
+        run: npm run tauri build -- --no-bundle
+
+  gate:
+    name: CI gate
+    if: always()
+    needs:
+      - changes
+      - documentation
+      - quality
+      - host_evidence
+      - msrv
+      - dependency_policy
+      - cubecl_experiment
+      - python_wheel
+      - studio
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.changes.outputs.target_sha || github.sha }}
+          persist-credentials: false
+      - name: Require every relevant result
+        env:
+          CI_RELEVANCE: >-
+            {"rust":"${{ needs.changes.outputs.rust }}",
+             "msrv":"${{ needs.changes.outputs.msrv }}",
+             "python":"${{ needs.changes.outputs.python }}",
+             "studio":"${{ needs.changes.outputs.studio }}",
+             "dependency_policy":"${{ needs.changes.outputs.dependency_policy }}",
+             "cubecl_experiment":"${{ needs.changes.outputs.cubecl_experiment }}"}
+          CI_RESULTS: >-
+            {"changes":"${{ needs.changes.result }}",
+             "documentation":"${{ needs.documentation.result }}",
+             "quality":"${{ needs.quality.result }}",
+             "host_evidence":"${{ needs.host_evidence.result }}",
+             "msrv":"${{ needs.msrv.result }}",
+             "dependency_policy":"${{ needs.dependency_policy.result }}",
+             "cubecl_experiment":"${{ needs.cubecl_experiment.result }}",
+             "python_wheel":"${{ needs.python_wheel.result }}",
+             "studio":"${{ needs.studio.result }}"}
+        run: python3 tools/ci/check_gate.py

eqiora-0.1.0a1/.github/workflows/pages.yml

@@ -0,0 +1,84 @@
+name: Documentation site
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/pages.yml"
+      - "crates/eqiora-verify/**"
+      - "docs/site/**"
+      - "mkdocs.yml"
+      - "tools/site/**"
+      - "verify/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/pages.yml"
+      - "crates/eqiora-verify/**"
+      - "docs/site/**"
+      - "mkdocs.yml"
+      - "tools/site/**"
+      - "verify/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pages-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build static documentation
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out exact source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: docs/site/requirements.txt
+      - name: Configure GitHub Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - name: Install site toolchain
+        run: python -m pip install --disable-pip-version-check --requirement docs/site/requirements.txt
+      - name: Project validated evidence catalog
+        run: |
+          cargo run --locked --quiet -p eqiora-verify -- index --format json > "$RUNNER_TEMP/capability-index.json"
+          python tools/site/generate_evidence_catalog.py \
+            --input "$RUNNER_TEMP/capability-index.json" \
+            --output docs/site/evidence/index.md
+      - name: Check site source and tooling
+        run: |
+          python tools/site/check_site.py .
+          python -m unittest discover -s tools/site/tests -v
+      - name: Build strict static site
+        run: mkdocs build --strict
+      - name: Upload GitHub Pages artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: build/site
+
+  deploy:
+    name: Deploy static documentation
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy GitHub Pages artifact
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0