falsify 0.3.4__tar.gz → 0.3.6__tar.gz

{falsify-0.3.4/falsify.egg-info → falsify-0.3.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: falsify
-Version: 0.3.4
+Version: 0.3.6
 Summary: PRML reference CLI — pre-register an ML evaluation claim as a SHA-256 manifest; verify PASS/FAIL/TAMPERED.
 Author: Cüneyt Öztürk
 License: MIT
@@ -75,7 +75,7 @@ No install? Verify any manifest in-browser at [registry.falsify.dev](https://reg
 
 **Try it without installing:** [`registry.falsify.dev`](https://registry.falsify.dev) — paste a PRML manifest, get a SHA-256 permalink and a README badge. No account, no server-side state beyond the hash.
 
-**Add it to your CI in five lines:** [`studio-11-co/prml-verify-action@v1`](https://github.com/studio-11-co/prml-verify-action) — composite GitHub Action wrapping the falsify CLI ([listed on the GitHub Marketplace](https://github.com/marketplace/actions/prml-verify)). Block merges on tampered or regressed eval claims. Optional public registry anchor.
+**Add it to your CI in five lines:** [`studio-11-co/prml-verify-action@v2`](https://github.com/studio-11-co/prml-verify-action) — composite GitHub Action wrapping the falsify CLI ([listed on the GitHub Marketplace](https://github.com/marketplace/actions/prml-verify)). Block merges on tampered or regressed eval claims. Optional public registry anchor.
 
 **Already on MLflow?** [`pip install mlflow-falsify`](https://pypi.org/project/mlflow-falsify/) — discoverable plugin that tags every MLflow run with the PRML manifest hash, version, metric, comparator, threshold, and dataset id. Zero code changes to your existing MLflow workflow. Source: [`studio-11-co/mlflow-falsify`](https://github.com/studio-11-co/mlflow-falsify).
 
@@ -128,7 +128,7 @@ See [docs/CASE_STUDIES.md](docs/CASE_STUDIES.md) for three concrete adoption sto
 
 ---
 
-**Current version:** falsify 0.3.4 (PRML CLI) · falsify-engine 0.3.4 — `falsify --version`.
+**Current version:** falsify 0.3.5 (PRML CLI) · falsify-engine 0.3.5 — `falsify --version`.
 **Working with Claude Code?** See [CLAUDE.md](CLAUDE.md).
 
 ---

{falsify-0.3.4 → falsify-0.3.6}/README.md

@@ -43,7 +43,7 @@ No install? Verify any manifest in-browser at [registry.falsify.dev](https://reg
 
 **Try it without installing:** [`registry.falsify.dev`](https://registry.falsify.dev) — paste a PRML manifest, get a SHA-256 permalink and a README badge. No account, no server-side state beyond the hash.
 
-**Add it to your CI in five lines:** [`studio-11-co/prml-verify-action@v1`](https://github.com/studio-11-co/prml-verify-action) — composite GitHub Action wrapping the falsify CLI ([listed on the GitHub Marketplace](https://github.com/marketplace/actions/prml-verify)). Block merges on tampered or regressed eval claims. Optional public registry anchor.
+**Add it to your CI in five lines:** [`studio-11-co/prml-verify-action@v2`](https://github.com/studio-11-co/prml-verify-action) — composite GitHub Action wrapping the falsify CLI ([listed on the GitHub Marketplace](https://github.com/marketplace/actions/prml-verify)). Block merges on tampered or regressed eval claims. Optional public registry anchor.
 
 **Already on MLflow?** [`pip install mlflow-falsify`](https://pypi.org/project/mlflow-falsify/) — discoverable plugin that tags every MLflow run with the PRML manifest hash, version, metric, comparator, threshold, and dataset id. Zero code changes to your existing MLflow workflow. Source: [`studio-11-co/mlflow-falsify`](https://github.com/studio-11-co/mlflow-falsify).
 
@@ -96,7 +96,7 @@ See [docs/CASE_STUDIES.md](docs/CASE_STUDIES.md) for three concrete adoption sto
 
 ---
 
-**Current version:** falsify 0.3.4 (PRML CLI) · falsify-engine 0.3.4 — `falsify --version`.
+**Current version:** falsify 0.3.5 (PRML CLI) · falsify-engine 0.3.5 — `falsify --version`.
 **Working with Claude Code?** See [CLAUDE.md](CLAUDE.md).
 
 ---

{falsify-0.3.4 → falsify-0.3.6/falsify.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: falsify
-Version: 0.3.4
+Version: 0.3.6
 Summary: PRML reference CLI — pre-register an ML evaluation claim as a SHA-256 manifest; verify PASS/FAIL/TAMPERED.
 Author: Cüneyt Öztürk
 License: MIT
@@ -75,7 +75,7 @@ No install? Verify any manifest in-browser at [registry.falsify.dev](https://reg
 
 **Try it without installing:** [`registry.falsify.dev`](https://registry.falsify.dev) — paste a PRML manifest, get a SHA-256 permalink and a README badge. No account, no server-side state beyond the hash.
 
-**Add it to your CI in five lines:** [`studio-11-co/prml-verify-action@v1`](https://github.com/studio-11-co/prml-verify-action) — composite GitHub Action wrapping the falsify CLI ([listed on the GitHub Marketplace](https://github.com/marketplace/actions/prml-verify)). Block merges on tampered or regressed eval claims. Optional public registry anchor.
+**Add it to your CI in five lines:** [`studio-11-co/prml-verify-action@v2`](https://github.com/studio-11-co/prml-verify-action) — composite GitHub Action wrapping the falsify CLI ([listed on the GitHub Marketplace](https://github.com/marketplace/actions/prml-verify)). Block merges on tampered or regressed eval claims. Optional public registry anchor.
 
 **Already on MLflow?** [`pip install mlflow-falsify`](https://pypi.org/project/mlflow-falsify/) — discoverable plugin that tags every MLflow run with the PRML manifest hash, version, metric, comparator, threshold, and dataset id. Zero code changes to your existing MLflow workflow. Source: [`studio-11-co/mlflow-falsify`](https://github.com/studio-11-co/mlflow-falsify).
 
@@ -128,7 +128,7 @@ See [docs/CASE_STUDIES.md](docs/CASE_STUDIES.md) for three concrete adoption sto
 
 ---
 
-**Current version:** falsify 0.3.4 (PRML CLI) · falsify-engine 0.3.4 — `falsify --version`.
+**Current version:** falsify 0.3.5 (PRML CLI) · falsify-engine 0.3.5 — `falsify --version`.
 **Working with Claude Code?** See [CLAUDE.md](CLAUDE.md).
 
 ---

{falsify-0.3.4 → falsify-0.3.6}/falsify.py

@@ -25,7 +25,7 @@ from typing import Any, Callable
 
 import yaml
 
-__version__ = "0.3.4"
+__version__ = "0.3.6"
 
 EXIT_PASS = 0
 EXIT_FAIL = 10

{falsify-0.3.4 → falsify-0.3.6}/falsify_prml.py

@@ -8,7 +8,7 @@ anyone; edit the manifest after locking and the hash no longer matches.
 Canonicalisation (PRML v0.1 §4): keys recursively sorted, block style, LF,
 trailing whitespace stripped, exactly one trailing newline, UTF-8. This is the
 same rule the Go / JS / Rust reference implementations use; all four produce
-byte-identical canonical bytes on the 20 published conformance vectors.
+byte-identical canonical bytes on the 21 published conformance vectors.
 
 Commands:
     falsify lock <spec.yaml|spec.json>            canonicalize, hash, write sidecar
@@ -33,7 +33,7 @@ import os
 import re
 import sys
 
-__version__ = "0.3.4"
+__version__ = "0.3.6"
 
 EXIT_PASS = 0
 EXIT_BAD = 2
@@ -50,6 +50,32 @@ REQUIRED_PRODUCER = ["id"]
 VALID_COMPARATORS = {">=", "<=", ">", "<", "=="}
 _HEX64 = re.compile(r"^[0-9a-f]{64}$")
 
+# Characters that break canonical-byte portability across the reference impls:
+# C0/C1 control chars (incl. U+0085 NEL, which PyYAML does not round-trip),
+# U+007F DEL, the Unicode line/paragraph separators U+2028/U+2029, and U+FEFF
+# (BOM / zero-width no-break space). These have no legitimate place in a PRML
+# string field (metric, ids, etc.); a manifest containing them would canonicalize
+# to different bytes — or fail to round-trip — across Python/JS/Go/Rust, so it is
+# rejected at validation rather than silently producing a non-portable hash.
+# Rejecting them is additive: no conformance vector contains these, so no valid
+# manifest's hash changes. Printable Unicode (emoji, CJK, accents) is unaffected.
+_FORBIDDEN_CHARS = re.compile(r"[\x00-\x1f\x7f-\x9f

]")
+
+
+def _bad_char_fields(obj, path="") -> list[str]:
+    """Return field paths whose string value contains a portability-breaking char."""
+    out = []
+    if isinstance(obj, str):
+        if _FORBIDDEN_CHARS.search(obj):
+            out.append(path or "(value)")
+    elif isinstance(obj, dict):
+        for k, v in obj.items():
+            out.extend(_bad_char_fields(v, f"{path}.{k}" if path else str(k)))
+    elif isinstance(obj, (list, tuple)):
+        for i, v in enumerate(obj):
+            out.extend(_bad_char_fields(v, f"{path}[{i}]"))
+    return out
+
 
 def _require_yaml():
     try:
@@ -133,6 +159,9 @@ def validate_manifest(m: dict) -> list[str]:
         for f in REQUIRED_PRODUCER:
             if f not in prod:
                 errors.append(f"missing required field: producer.{f}")
+    for fld in _bad_char_fields(m):
+        errors.append(f"{fld}: contains a control / non-portable character "
+                      f"(C0/C1, U+007F, U+2028/U+2029, or U+FEFF) — not allowed in a PRML string field")
     return errors
 
 

{falsify-0.3.4 → falsify-0.3.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "falsify"
-version = "0.3.4"
+version = "0.3.6"
 description = "PRML reference CLI — pre-register an ML evaluation claim as a SHA-256 manifest; verify PASS/FAIL/TAMPERED."
 readme = "README.md"
 license = { text = "MIT" }

{falsify-0.3.4 → falsify-0.3.6}/tests/test_version.py

@@ -15,6 +15,18 @@ REPO_ROOT = Path(__file__).resolve().parent.parent
 FALSIFY = REPO_ROOT / "falsify.py"
 
 
+def _version() -> str:
+    """The version under test, read from falsify.py — never hardcode it here."""
+    spec = importlib.util.spec_from_file_location("_falsify_ver", FALSIFY)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module.__version__
+
+
+VERSION = _version()
+
+
 def _run(args: list[str], cwd: Path) -> subprocess.CompletedProcess:
     return subprocess.run(
         [sys.executable, str(FALSIFY), *args],
@@ -35,14 +47,14 @@ class VersionTests(unittest.TestCase):
     def test_version_subcommand_prints_version(self) -> None:
         result = _run(["version"], cwd=self.cwd)
         self.assertEqual(result.returncode, 0, msg=result.stderr)
-        self.assertIn("0.3.4", result.stdout)
+        self.assertIn(VERSION, result.stdout)
         self.assertIn("falsify", result.stdout)
 
     def test_version_flag_prints_version(self) -> None:
         result = _run(["--version"], cwd=self.cwd)
         self.assertEqual(result.returncode, 0, msg=result.stderr)
         # argparse's `action='version'` writes to stdout on Python 3.11+.
-        self.assertIn("0.3.4", result.stdout)
+        self.assertIn(VERSION, result.stdout)
 
     def test_version_subcommand_json_mode(self) -> None:
         result = _run(["version", "--json"], cwd=self.cwd)