etch-record 0.7.0__tar.gz → 0.9.0__tar.gz

{etch_record-0.7.0 → etch_record-0.9.0}/CHANGELOG.md

@@ -3,6 +3,90 @@
 All notable changes to `etch-record` (the CLI helper for the Etch signed
 audit chain).
 
+## v0.9.0 - 2026-08-02
+
+Wave 5 batch: signed postmortem (#20), HSM/TPM/enclave attestation
+(#17), and cross-chain reference (#18). Three new sub-record layers
+in one release. All three follow the "if X is not None: ..." block
+pattern so they compose independently with any prior Wave layer in
+a single etch-record invocation.
+
+Server-side dependency: etch commits shipping the three new
+endpoints (`POST /v1/etch-chain/postmortem`,
+`/hsm-attestation`, `/cross-chain-reference`).
+
+### Added
+
+Wave 5 #20 postmortem:
+
+- `--postmortem-about-event <oss-event-id>` - retroactive
+  postmortem target. Triggers POST /v1/etch-chain/postmortem.
+- `--postmortem-finding <text>` - required with the above.
+- `--postmortem-corrective-action <text>` - required with the above.
+- `--postmortem-corrective-action-signed-by <id>` - optional signer id.
+- `--postmortem-retro-confidence <0.0-1.0>` - optional retroactive
+  confidence downgrade.
+
+Wave 5 #17 HSM/TPM/enclave attestation:
+
+- `--hsm-vendor <id>` - tpm2, yubikey, aws-nitro, gcp-shielded,
+  azure-attestation, sev-snp, intel-tdx. Triggers POST
+  /v1/etch-chain/hsm-attestation.
+- `--hsm-format <id>` - vendor-specific format id (tpm2-quote-v1,
+  yubico-attestation-cert, aws-nitro-cose-sign1, and others).
+- `--hsm-blob-file <path>` - raw attestation blob, read as bytes and
+  base64-encoded client-side. Required with --hsm-vendor.
+- `--hsm-key-ref <ref>` - optional stable pubkey reference.
+- `--hsm-serial <serial>` - optional HSM/enclave serial.
+
+Wave 5 #18 cross-chain reference (Etch-to-Etch federation):
+
+- `--cross-chain-target-chain-id <sha256:...>` - derived chain id of
+  the target chain (compute_chain_id). Triggers POST
+  /v1/etch-chain/cross-chain-reference.
+- `--cross-chain-target-epoch <int>` - epoch_seq on target chain.
+- `--cross-chain-target-event-hash <sha256:...>` - row_hash of the
+  referenced target event.
+- `--cross-chain-label <text>` - optional free-form label.
+
+### Exit codes added
+
+- `14` postmortem sub-record failed
+- `15` cross-chain-reference sub-record failed
+- `16` hsm-attestation sub-record failed
+
+## v0.8.0 — 2026-08-02
+
+Wave 4 #15 8-category drift engine. Extends the governance object
+with 3 new optional fields (mission / terminology / context) so the
+server can populate an 8-dimension projection index. Drift detection
+runs offline via `etch-chain-verify` (added server-side).
+
+Server-side dependency: etch commit adding the multi-dim projection
+(this release cycle's server change).
+
+### Added
+
+- `--mission <string>` — mission statement (e.g. "customer KYC
+  compliance decisions"). Hashed server-side.
+- `--terminology <t1,t2,...>` — comma-separated key terms. Set-hashed
+  server-side.
+- `--context-file <path>` — JSON object describing operating context.
+  Any shape accepted; canonical-json-hashed server-side.
+
+Any of the new flags (alone or with legacy governance flags) triggers
+the governance sub-record call and populates the multi-dim index.
+
+### Positioning
+
+Wave 4 #15 is the largest single feature in the boundary plan (10
+dev-days). Ships the full OHRP v2.0 8-category surface:
+mission / assumption / confidence / evidence / scope / terminology /
+authority / context. No observability vendor claims this surface.
+
+Content angle for marketing: "8 drift dimensions with independent
+comparators, per-decision on-chain evidence, offline verifier."
+
 ## v0.7.0 — 2026-08-02
 
 Wave 2 #10. Adds three flags for recording an explicit halt event

{etch_record-0.7.0 → etch_record-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: etch-record
-Version: 0.7.0
+Version: 0.9.0
 Summary: CLI helper: sign any event into your Etch audit chain from the command line.
 Author: Saravanan Jaichandaran
 License: MIT
@@ -17,7 +17,7 @@ Small CLI helper. Signs any event into your Etch audit chain from the command li
 
 Built for the marketing-agent workflow: every research call, draft generation, review decision, and outreach send emits a signed event. Also usable standalone for any local activity you want notarized.
 
-**Latest: v0.2.0** — Wave 1 #1 governance flags (`--policy-hash`, `--authority-file`, `--assumptions-file`, `--uncertainty`, `--uncertainty-file`, `--invalidation-file`) attach a signed governance sub-record on the Etch parallel chain. See [CHANGELOG.md](CHANGELOG.md).
+**Latest: v0.9.0** — Wave 5 batch. Three new sub-record layers land in one release: signed postmortem (`--postmortem-about-event` + `--postmortem-finding` + `--postmortem-corrective-action`), HSM/TPM/enclave attestation (`--hsm-vendor` + `--hsm-format` + `--hsm-blob-file`), and cross-chain reference (`--cross-chain-target-chain-id` + `--cross-chain-target-epoch` + `--cross-chain-target-event-hash`). Twelve endpoints total now available on your Etch chain. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Install
 
@@ -146,3 +146,7 @@ The base event was recorded via the OSS chain; the governance sub-record was sig
 - `3` unexpected exception
 - `4` rate limit (client-side sliding window)
 - `5` governance sub-record failed — the base event was recorded successfully; use the printed `event_id` to retry the governance call
+- `13` stop-condition sub-record failed
+- `14` postmortem sub-record failed
+- `15` cross-chain-reference sub-record failed
+- `16` hsm-attestation sub-record failed

{etch_record-0.7.0 → etch_record-0.9.0}/README.md

@@ -4,7 +4,7 @@ Small CLI helper. Signs any event into your Etch audit chain from the command li
 
 Built for the marketing-agent workflow: every research call, draft generation, review decision, and outreach send emits a signed event. Also usable standalone for any local activity you want notarized.
 
-**Latest: v0.2.0** — Wave 1 #1 governance flags (`--policy-hash`, `--authority-file`, `--assumptions-file`, `--uncertainty`, `--uncertainty-file`, `--invalidation-file`) attach a signed governance sub-record on the Etch parallel chain. See [CHANGELOG.md](CHANGELOG.md).
+**Latest: v0.9.0** — Wave 5 batch. Three new sub-record layers land in one release: signed postmortem (`--postmortem-about-event` + `--postmortem-finding` + `--postmortem-corrective-action`), HSM/TPM/enclave attestation (`--hsm-vendor` + `--hsm-format` + `--hsm-blob-file`), and cross-chain reference (`--cross-chain-target-chain-id` + `--cross-chain-target-epoch` + `--cross-chain-target-event-hash`). Twelve endpoints total now available on your Etch chain. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Install
 
@@ -133,3 +133,7 @@ The base event was recorded via the OSS chain; the governance sub-record was sig
 - `3` unexpected exception
 - `4` rate limit (client-side sliding window)
 - `5` governance sub-record failed — the base event was recorded successfully; use the printed `event_id` to retry the governance call
+- `13` stop-condition sub-record failed
+- `14` postmortem sub-record failed
+- `15` cross-chain-reference sub-record failed
+- `16` hsm-attestation sub-record failed

{etch_record-0.7.0 → etch_record-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "etch-record"
-version = "0.7.0"
+version = "0.9.0"
 description = "CLI helper: sign any event into your Etch audit chain from the command line."
 readme = "README.md"
 requires-python = ">=3.10"

{etch_record-0.7.0 → etch_record-0.9.0}/src/etch_record/__init__.py

@@ -1,3 +1,3 @@
 """etch-record: CLI helper for signing arbitrary events into your Etch chain."""
 
-__version__ = "0.7.0"
+__version__ = "0.9.0"

{etch_record-0.7.0 → etch_record-0.9.0}/src/etch_record/cli.py

@@ -45,6 +45,18 @@ from .stop_condition_client import (
     StopConditionError,
     record_stop_condition,
 )
+from .postmortem_client import (
+    PostmortemError,
+    record_postmortem,
+)
+from .hsm_attestation_client import (
+    HsmAttestationError,
+    record_hsm_attestation,
+)
+from .cross_chain_reference_client import (
+    CrossChainReferenceError,
+    record_cross_chain_reference,
+)
 from .mcp_client import McpError, extract_event_id, record_event
 from .rate_limit import check_and_record
 from .wave1_4567_clients import (
@@ -424,6 +436,39 @@ def _maybe_warn_large_arg(name: str, value: str) -> None:
     ),
 )
 # ---------------------------------------------------------------------------
+# Wave 4 #15 (2026-08-02) — 8-category governance schema extension.
+# Adds mission / terminology / context fields. Extraction is server-
+# side; drift detection runs via etch-chain-verify's dimensional
+# check. Any of these flags being set (alone or with the legacy
+# governance fields) triggers the second call and populates the
+# multi-dim projection index.
+# ---------------------------------------------------------------------------
+@click.option(
+    "--mission", "mission", type=str, default=None,
+    help=(
+        "Wave 4 #15 governance: mission statement string (e.g. "
+        "'customer KYC compliance decisions'). Hashed server-side "
+        "for drift detection."
+    ),
+)
+@click.option(
+    "--terminology", "terminology_raw", type=str, default=None,
+    help=(
+        "Wave 4 #15 governance: comma-separated key terms (e.g. "
+        "'KYC,PII,customer identity'). Set-hashed server-side."
+    ),
+)
+@click.option(
+    "--context-file", "context_file",
+    type=click.Path(exists=True, dir_okay=False, path_type=Path),
+    default=None,
+    help=(
+        "Wave 4 #15 governance: JSON object describing the operating "
+        "context (e.g. {model, prompt_hash, policy_context}). Any "
+        "shape accepted; canonical-json-hashed server-side."
+    ),
+)
+# ---------------------------------------------------------------------------
 # Wave 1 #2 (2026-08-01) — bounded authority receipts.
 # When --authority-privkey-file + --authority-id + --receipt-type are all
 # set, the CLI adds a THIRD call:
@@ -703,6 +748,139 @@ def _maybe_warn_large_arg(name: str, value: str) -> None:
         "session-scoped vs global halts."
     ),
 )
+# ---------------------------------------------------------------------------
+# Wave 5 #20 (2026-08-02) — signed postmortem
+# ---------------------------------------------------------------------------
+@click.option(
+    "--postmortem-about-event", "postmortem_about_event",
+    type=str, default=None,
+    help=(
+        "Wave 5 #20: OSS event id the postmortem is retroactively "
+        "about. Triggers POST /v1/etch-chain/postmortem. Requires "
+        "--postmortem-finding + --postmortem-corrective-action."
+    ),
+)
+@click.option(
+    "--postmortem-finding", "postmortem_finding",
+    type=str, default=None,
+    help=(
+        "Wave 5 #20: free-text finding text. Required whenever "
+        "--postmortem-about-event is set."
+    ),
+)
+@click.option(
+    "--postmortem-corrective-action", "postmortem_corrective_action",
+    type=str, default=None,
+    help=(
+        "Wave 5 #20: corrective-action text. Required whenever "
+        "--postmortem-about-event is set."
+    ),
+)
+@click.option(
+    "--postmortem-corrective-action-signed-by",
+    "postmortem_corrective_action_signed_by",
+    type=str, default=None,
+    help=(
+        "Wave 5 #20: optional signer id for the corrective action."
+    ),
+)
+@click.option(
+    "--postmortem-retro-confidence", "postmortem_retro_confidence",
+    type=float, default=None,
+    help=(
+        "Wave 5 #20: optional retroactive confidence downgrade "
+        "(0.0-1.0). When set, indicates the original event's "
+        "confidence was, in hindsight, too high."
+    ),
+)
+# ---------------------------------------------------------------------------
+# Wave 5 #17 (2026-08-02) — HSM / TPM / enclave attestation
+# ---------------------------------------------------------------------------
+@click.option(
+    "--hsm-vendor", "hsm_vendor",
+    type=str, default=None,
+    help=(
+        "Wave 5 #17: HSM/TPM vendor id (tpm2, yubikey, aws-nitro, "
+        "gcp-shielded, azure-attestation, sev-snp, intel-tdx). "
+        "Triggers POST /v1/etch-chain/hsm-attestation. Requires "
+        "--hsm-format + --hsm-blob-file."
+    ),
+)
+@click.option(
+    "--hsm-format", "hsm_format",
+    type=str, default=None,
+    help=(
+        "Wave 5 #17: attestation format id (tpm2-quote-v1, "
+        "yubico-attestation-cert, aws-nitro-cose-sign1, "
+        "gcp-shielded-vm-quote, azure-tdx-attestation, "
+        "sev-snp-report-v1, intel-tdx-quote-v4). Required "
+        "whenever --hsm-vendor is set."
+    ),
+)
+@click.option(
+    "--hsm-blob-file", "hsm_blob_file",
+    type=click.Path(exists=True, dir_okay=False, path_type=Path),
+    default=None,
+    help=(
+        "Wave 5 #17: path to the raw attestation blob. Read as "
+        "bytes and base64-encoded client-side before POST. Required "
+        "whenever --hsm-vendor is set."
+    ),
+)
+@click.option(
+    "--hsm-key-ref", "hsm_key_ref",
+    type=str, default=None,
+    help=(
+        "Wave 5 #17: optional stable key reference (typically "
+        "sha256:... of the pubkey the HSM signed with)."
+    ),
+)
+@click.option(
+    "--hsm-serial", "hsm_serial",
+    type=str, default=None,
+    help=(
+        "Wave 5 #17: optional HSM/enclave serial for the pubkey ledger."
+    ),
+)
+# ---------------------------------------------------------------------------
+# Wave 5 #18 (2026-08-02) — cross-chain reference (federated evidence)
+# ---------------------------------------------------------------------------
+@click.option(
+    "--cross-chain-target-chain-id", "cross_chain_target_chain_id",
+    type=str, default=None,
+    help=(
+        "Wave 5 #18: sha256:... chain id of the OTHER chain being "
+        "referenced (produced by compute_chain_id). Triggers POST "
+        "/v1/etch-chain/cross-chain-reference. Requires --target-epoch "
+        "and --target-event-hash."
+    ),
+)
+@click.option(
+    "--cross-chain-target-epoch", "cross_chain_target_epoch",
+    type=int, default=None,
+    help=(
+        "Wave 5 #18: epoch_seq on the target chain that contains "
+        "the referenced event. Required whenever "
+        "--cross-chain-target-chain-id is set."
+    ),
+)
+@click.option(
+    "--cross-chain-target-event-hash", "cross_chain_target_event_hash",
+    type=str, default=None,
+    help=(
+        "Wave 5 #18: sha256:... row_hash of the specific event on "
+        "the target chain being referenced. Required whenever "
+        "--cross-chain-target-chain-id is set."
+    ),
+)
+@click.option(
+    "--cross-chain-label", "cross_chain_label",
+    type=str, default=None,
+    help=(
+        "Wave 5 #18: optional free-form label describing what the "
+        "referenced event is (e.g. 'supplier X kyc-approval')."
+    ),
+)
 @click.version_option(__version__, prog_name="etch-record")
 def main(
     description: str,
@@ -725,6 +903,9 @@ def main(
     uncertainty: str | None,
     uncertainty_file: Path | None,
     invalidation_file: Path | None,
+    mission: str | None,
+    terminology_raw: str | None,
+    context_file: Path | None,
     authority_privkey_file: Path | None,
     authority_id: str | None,
     authority_scope: str,
@@ -752,6 +933,20 @@ def main(
     stop_condition_id: str | None,
     stop_condition_reason: str | None,
     stop_condition_scope: str | None,
+    postmortem_about_event: str | None,
+    postmortem_finding: str | None,
+    postmortem_corrective_action: str | None,
+    postmortem_corrective_action_signed_by: str | None,
+    postmortem_retro_confidence: float | None,
+    hsm_vendor: str | None,
+    hsm_format: str | None,
+    hsm_blob_file: Path | None,
+    hsm_key_ref: str | None,
+    hsm_serial: str | None,
+    cross_chain_target_chain_id: str | None,
+    cross_chain_target_epoch: int | None,
+    cross_chain_target_event_hash: str | None,
+    cross_chain_label: str | None,
 ) -> None:
     # Wave 2 #8 — bulk import mode. Runs the file through the format
     # adapter server-side; single-event flow is completely skipped
@@ -860,6 +1055,9 @@ def main(
         uncertainty=uncertainty,
         uncertainty_file=uncertainty_file,
         invalidation_file=invalidation_file,
+        mission=mission,
+        terminology_raw=terminology_raw,
+        context_file=context_file,
     )
     if governance is not None:
         try:
@@ -1020,6 +1218,181 @@ def main(
             f"stop_condition_hash={r.stop_condition_hash}",
         )
 
+    # Wave 5 #20 — signed postmortem. Independent of every prior
+    # layer. Follows the "if X is not None: ..." pattern locked in
+    # memory after the v0.4.0 short-circuit incident.
+    postmortem_payload = _prepare_postmortem(
+        postmortem_about_event,
+        postmortem_finding,
+        postmortem_corrective_action,
+        postmortem_corrective_action_signed_by,
+        postmortem_retro_confidence,
+    )
+    if postmortem_payload is not None:
+        try:
+            r = record_postmortem(cfg, event_id, postmortem_payload)
+        except PostmortemError as exc:
+            click.echo(f"etch-record: postmortem: {exc}", err=True)
+            sys.exit(14)
+        click.echo(
+            f"OK  postmortem_seq={r.etch_chain_seq}  "
+            f"postmortem_hash={r.postmortem_hash}",
+        )
+
+    # Wave 5 #17 — HSM / TPM / enclave attestation. Independent.
+    hsm_payload = _prepare_hsm_attestation(
+        hsm_vendor, hsm_format, hsm_blob_file,
+        hsm_key_ref, hsm_serial,
+    )
+    if hsm_payload is not None:
+        try:
+            r = record_hsm_attestation(cfg, event_id, hsm_payload)
+        except HsmAttestationError as exc:
+            click.echo(
+                f"etch-record: hsm-attestation: {exc}", err=True,
+            )
+            sys.exit(16)
+        click.echo(
+            f"OK  hsm_attestation_seq={r.etch_chain_seq}  "
+            f"hsm_attestation_hash={r.hsm_attestation_hash}",
+        )
+
+    # Wave 5 #18 — cross-chain reference. Independent.
+    cross_ref_payload = _prepare_cross_chain_reference(
+        cross_chain_target_chain_id,
+        cross_chain_target_epoch,
+        cross_chain_target_event_hash,
+        cross_chain_label,
+    )
+    if cross_ref_payload is not None:
+        try:
+            r = record_cross_chain_reference(
+                cfg, event_id, cross_ref_payload,
+            )
+        except CrossChainReferenceError as exc:
+            click.echo(
+                f"etch-record: cross-chain-reference: {exc}",
+                err=True,
+            )
+            sys.exit(15)
+        click.echo(
+            f"OK  cross_chain_reference_seq={r.etch_chain_seq}  "
+            f"cross_ref_hash={r.cross_ref_hash}  "
+            f"target_chain_id={r.target_chain_id}",
+        )
+
+
+def _prepare_postmortem(
+    about_event: str | None,
+    finding: str | None,
+    corrective_action: str | None,
+    corrective_action_signed_by: str | None,
+    retro_confidence: float | None,
+) -> dict | None:
+    provided = any((
+        about_event, finding, corrective_action,
+        corrective_action_signed_by, retro_confidence is not None,
+    ))
+    if not provided:
+        return None
+    missing = []
+    if about_event is None:
+        missing.append("--postmortem-about-event")
+    if finding is None:
+        missing.append("--postmortem-finding")
+    if corrective_action is None:
+        missing.append("--postmortem-corrective-action")
+    if missing:
+        raise click.UsageError(
+            "Wave 5 #20 postmortem requires: " + ", ".join(missing),
+        )
+    payload = {
+        "about_event_id": about_event,
+        "finding": finding,
+        "corrective_action": corrective_action,
+        "attested_at": utc_iso_ms_now(),
+    }
+    if corrective_action_signed_by is not None:
+        payload["corrective_action_signed_by"] = (
+            corrective_action_signed_by
+        )
+    if retro_confidence is not None:
+        payload["retroactive_confidence_downgrade"] = retro_confidence
+    return payload
+
+
+def _prepare_hsm_attestation(
+    vendor: str | None,
+    fmt: str | None,
+    blob_file: Path | None,
+    key_ref: str | None,
+    serial: str | None,
+) -> dict | None:
+    import base64
+    provided = any((vendor, fmt, blob_file, key_ref, serial))
+    if not provided:
+        return None
+    missing = []
+    if vendor is None:
+        missing.append("--hsm-vendor")
+    if fmt is None:
+        missing.append("--hsm-format")
+    if blob_file is None:
+        missing.append("--hsm-blob-file")
+    if missing:
+        raise click.UsageError(
+            "Wave 5 #17 hsm-attestation requires: "
+            + ", ".join(missing),
+        )
+    with open(blob_file, "rb") as fh:
+        blob_bytes = fh.read()
+    payload = {
+        "vendor": vendor,
+        "attestation_format": fmt,
+        "attestation_blob_b64": base64.b64encode(blob_bytes).decode(),
+        "attested_at": utc_iso_ms_now(),
+    }
+    if key_ref is not None:
+        payload["key_ref"] = key_ref
+    if serial is not None:
+        payload["hsm_serial"] = serial
+    return payload
+
+
+def _prepare_cross_chain_reference(
+    target_chain_id: str | None,
+    target_epoch: int | None,
+    target_event_hash: str | None,
+    label: str | None,
+) -> dict | None:
+    provided = any((
+        target_chain_id, target_epoch is not None,
+        target_event_hash, label,
+    ))
+    if not provided:
+        return None
+    missing = []
+    if target_chain_id is None:
+        missing.append("--cross-chain-target-chain-id")
+    if target_epoch is None:
+        missing.append("--cross-chain-target-epoch")
+    if target_event_hash is None:
+        missing.append("--cross-chain-target-event-hash")
+    if missing:
+        raise click.UsageError(
+            "Wave 5 #18 cross-chain-reference requires: "
+            + ", ".join(missing),
+        )
+    payload = {
+        "chain_id": target_chain_id,
+        "epoch_seq": target_epoch,
+        "event_hash": target_event_hash,
+        "attested_at": utc_iso_ms_now(),
+    }
+    if label is not None:
+        payload["label"] = label
+    return payload
+
 
 def _prepare_stop_condition(
     stop_condition_id: str | None,
@@ -1060,12 +1433,20 @@ def _assemble_governance_from_flags(
     uncertainty: str | None,
     uncertainty_file: Path | None,
     invalidation_file: Path | None,
+    mission: str | None = None,
+    terminology_raw: str | None = None,
+    context_file: Path | None = None,
 ) -> dict | None:
     """Compose the governance object from CLI flags, or return None if
-    none of them are set (signals: skip the second API call)."""
+    none of them are set (signals: skip the second API call).
+
+    Wave 4 #15 additions: `mission` string, `terminology` list,
+    `context` dict. Any of these plus the legacy 5 fields triggers
+    the second call."""
     if not any((
         policy_hash, authority_file, assumptions_file,
         uncertainty, uncertainty_file, invalidation_file,
+        mission, terminology_raw, context_file,
     )):
         return None
 
@@ -1094,6 +1475,14 @@ def _assemble_governance_from_flags(
         gov["invalidation_conditions"] = _read_json_list(
             invalidation_file, "--invalidation-file",
         )
+    if mission:
+        gov["mission"] = mission
+    if terminology_raw:
+        gov["terminology"] = [
+            t.strip() for t in terminology_raw.split(",") if t.strip()
+        ]
+    if context_file is not None:
+        gov["context"] = _read_json_object(context_file, "--context-file")
     return gov
 
 

etch_record-0.9.0/src/etch_record/cross_chain_reference_client.py

@@ -0,0 +1,86 @@
+"""HTTP client for Wave 5 #18 cross-chain reference endpoint
+(2026-08-02)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Optional
+
+import httpx
+
+from .config import Config
+
+
+_TIMEOUT_S = 30.0
+
+
+class CrossChainReferenceError(RuntimeError):
+    """Raised when the cross-chain-reference call fails.
+    CLI exit code 15."""
+
+
+@dataclass(frozen=True)
+class CrossChainReferenceResult:
+    etch_chain_seq: int
+    etch_row_id: str
+    cross_ref_hash: str
+    target_chain_id: str
+    target_epoch_seq: int
+    target_event_hash: str
+    oss_event_id_ref: Optional[str]
+    recorded_at: str
+
+
+def record_cross_chain_reference(
+    cfg: Config,
+    oss_event_id: str,
+    cross_ref: dict,
+    client: Optional[httpx.Client] = None,
+) -> CrossChainReferenceResult:
+    """POST /v1/etch-chain/cross-chain-reference."""
+    url = f"{cfg.base_url}/v1/etch-chain/cross-chain-reference"
+    body = {"oss_event_id": oss_event_id, "cross_ref": cross_ref}
+    headers = {
+        "Authorization": f"Bearer {cfg.app_token}",
+        "Content-Type": "application/json",
+    }
+
+    _client = client if client is not None else httpx.Client(
+        timeout=_TIMEOUT_S,
+    )
+    try:
+        try:
+            r = _client.post(url, headers=headers, json=body)
+        except httpx.HTTPError as exc:
+            raise CrossChainReferenceError(
+                f"transport failed: {exc}",
+            ) from exc
+    finally:
+        if client is None:
+            _client.close()
+
+    if r.status_code != 200:
+        try:
+            envelope = r.json()
+        except Exception:
+            envelope = {
+                "error": "non_json_response", "raw": r.text[:200],
+            }
+        err = envelope.get("error", "unknown")
+        detail = {k: v for k, v in envelope.items() if k != "error"}
+        raise CrossChainReferenceError(
+            f"{r.status_code} {err}"
+            + (f" — {detail}" if detail else ""),
+        )
+
+    data = r.json()
+    return CrossChainReferenceResult(
+        etch_chain_seq=data["etch_chain_seq"],
+        etch_row_id=data["etch_row_id"],
+        cross_ref_hash=data["cross_ref_hash"],
+        target_chain_id=data["target_chain_id"],
+        target_epoch_seq=data["target_epoch_seq"],
+        target_event_hash=data["target_event_hash"],
+        oss_event_id_ref=data.get("oss_event_id_ref"),
+        recorded_at=data["recorded_at"],
+    )

etch_record-0.9.0/src/etch_record/hsm_attestation_client.py

@@ -0,0 +1,87 @@
+"""HTTP client for Wave 5 #17 HSM/TPM/enclave attestation endpoint
+(2026-08-02)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Optional
+
+import httpx
+
+from .config import Config
+
+
+_TIMEOUT_S = 30.0
+
+
+class HsmAttestationError(RuntimeError):
+    """Raised when the hsm-attestation call fails.
+    CLI exit code 16."""
+
+
+@dataclass(frozen=True)
+class HsmAttestationResult:
+    etch_chain_seq: int
+    etch_row_id: str
+    hsm_attestation_hash: str
+    vendor: str
+    attestation_format: str
+    oss_event_id_ref: Optional[str]
+    recorded_at: str
+
+
+def record_hsm_attestation(
+    cfg: Config,
+    oss_event_id: str,
+    hsm_attestation: dict,
+    client: Optional[httpx.Client] = None,
+) -> HsmAttestationResult:
+    """POST /v1/etch-chain/hsm-attestation."""
+    url = f"{cfg.base_url}/v1/etch-chain/hsm-attestation"
+    body = {
+        "oss_event_id": oss_event_id,
+        "hsm_attestation": hsm_attestation,
+    }
+    headers = {
+        "Authorization": f"Bearer {cfg.app_token}",
+        "Content-Type": "application/json",
+    }
+
+    _client = client if client is not None else httpx.Client(
+        timeout=_TIMEOUT_S,
+    )
+    try:
+        try:
+            r = _client.post(url, headers=headers, json=body)
+        except httpx.HTTPError as exc:
+            raise HsmAttestationError(
+                f"transport failed: {exc}",
+            ) from exc
+    finally:
+        if client is None:
+            _client.close()
+
+    if r.status_code != 200:
+        try:
+            envelope = r.json()
+        except Exception:
+            envelope = {
+                "error": "non_json_response", "raw": r.text[:200],
+            }
+        err = envelope.get("error", "unknown")
+        detail = {k: v for k, v in envelope.items() if k != "error"}
+        raise HsmAttestationError(
+            f"{r.status_code} {err}"
+            + (f" — {detail}" if detail else ""),
+        )
+
+    data = r.json()
+    return HsmAttestationResult(
+        etch_chain_seq=data["etch_chain_seq"],
+        etch_row_id=data["etch_row_id"],
+        hsm_attestation_hash=data["hsm_attestation_hash"],
+        vendor=data["vendor"],
+        attestation_format=data["attestation_format"],
+        oss_event_id_ref=data.get("oss_event_id_ref"),
+        recorded_at=data["recorded_at"],
+    )

etch_record-0.9.0/src/etch_record/postmortem_client.py

@@ -0,0 +1,80 @@
+"""HTTP client for Wave 5 #20 signed postmortem endpoint (2026-08-02)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Optional
+
+import httpx
+
+from .config import Config
+
+
+_TIMEOUT_S = 30.0
+
+
+class PostmortemError(RuntimeError):
+    """Raised when the postmortem call fails. CLI exit code 14."""
+
+
+@dataclass(frozen=True)
+class PostmortemResult:
+    etch_chain_seq: int
+    etch_row_id: str
+    postmortem_hash: str
+    about_event_id: str
+    oss_event_id_ref: Optional[str]
+    recorded_at: str
+
+
+def record_postmortem(
+    cfg: Config,
+    oss_event_id: str,
+    postmortem: dict,
+    client: Optional[httpx.Client] = None,
+) -> PostmortemResult:
+    """POST /v1/etch-chain/postmortem."""
+    url = f"{cfg.base_url}/v1/etch-chain/postmortem"
+    body = {"oss_event_id": oss_event_id, "postmortem": postmortem}
+    headers = {
+        "Authorization": f"Bearer {cfg.app_token}",
+        "Content-Type": "application/json",
+    }
+
+    _client = client if client is not None else httpx.Client(
+        timeout=_TIMEOUT_S,
+    )
+    try:
+        try:
+            r = _client.post(url, headers=headers, json=body)
+        except httpx.HTTPError as exc:
+            raise PostmortemError(
+                f"transport failed: {exc}",
+            ) from exc
+    finally:
+        if client is None:
+            _client.close()
+
+    if r.status_code != 200:
+        try:
+            envelope = r.json()
+        except Exception:
+            envelope = {
+                "error": "non_json_response", "raw": r.text[:200],
+            }
+        err = envelope.get("error", "unknown")
+        detail = {k: v for k, v in envelope.items() if k != "error"}
+        raise PostmortemError(
+            f"{r.status_code} {err}"
+            + (f" — {detail}" if detail else ""),
+        )
+
+    data = r.json()
+    return PostmortemResult(
+        etch_chain_seq=data["etch_chain_seq"],
+        etch_row_id=data["etch_row_id"],
+        postmortem_hash=data["postmortem_hash"],
+        about_event_id=data["about_event_id"],
+        oss_event_id_ref=data.get("oss_event_id_ref"),
+        recorded_at=data["recorded_at"],
+    )