gea-program 0.56.0__tar.gz → 0.57.0__tar.gz

{gea_program-0.56.0/gea_program.egg-info → gea_program-0.57.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gea-program
-Version: 0.56.0
+Version: 0.57.0
 Summary: GEA-Program: downhole gauge monitoring - canonical measurement records, quality rules, drift evaluation with a re-fit change log, well-test validation, alarm management, model cards, store-and-forward, monthly SLA measurement, FAT/SAT protocols and a dashboard, generated from live objects in the client's reporting outline.
 Author: Daniel T. Murphy
 License: MPL-2.0
@@ -1291,6 +1291,19 @@ gea oidc --workspace C:\site --issuer https://login.microsoftonline.com/3f8b2c1d
 Or Administration -> **Company sign-in**. `gea help company-sign-in` has the
 Entra ID app registration step by step.
 
+### For an IT department
+
+`docs/IT_SECURITY.md` (`gea security` prints it from any installation)
+answers what a reviewer asks before installing: where the data is and every
+connection the program can make, the one port, HTTPS, company sign-in and
+roles, the audit log, the bill of materials (`gea sbom`), and how a kit is
+checked - the build's attestation
+(`gea-program-0.57.0-win64.zip` checked with
+`gh attestation verify gea-program-0.57.0-win64.zip -R Daniel8Murphy0007/GEA-Program`)
+and the file catalog beside the kit's folder, Authenticode-signed once the
+publisher's certificate is in place. `SECURITY.md` says how to report a
+vulnerability.
+
 ### Before a site goes live
 
 `deploy/README.md` is the checklist: HTTPS from the service itself (above),
@@ -1422,4 +1435,5 @@ https://pypi.org/project/gea-program/ after the first successful run.
 ## Licence
 
 Mozilla Public License 2.0 (MPL-2.0); see `LICENSE`. Every source file carries the MPL-2.0
-header (Exhibit A). Copyright (c) 2026 Daniel T. Murphy.
+header (Exhibit A). Copyright (c) 2026 Daniel T. Murphy. The signed kit, its updates and
+support are a subscription from ENRGYONE (`docs/commercial/COMMERCIAL.md`).

{gea_program-0.56.0 → gea_program-0.57.0}/README.md

@@ -1252,6 +1252,19 @@ gea oidc --workspace C:\site --issuer https://login.microsoftonline.com/3f8b2c1d
 Or Administration -> **Company sign-in**. `gea help company-sign-in` has the
 Entra ID app registration step by step.
 
+### For an IT department
+
+`docs/IT_SECURITY.md` (`gea security` prints it from any installation)
+answers what a reviewer asks before installing: where the data is and every
+connection the program can make, the one port, HTTPS, company sign-in and
+roles, the audit log, the bill of materials (`gea sbom`), and how a kit is
+checked - the build's attestation
+(`gea-program-0.57.0-win64.zip` checked with
+`gh attestation verify gea-program-0.57.0-win64.zip -R Daniel8Murphy0007/GEA-Program`)
+and the file catalog beside the kit's folder, Authenticode-signed once the
+publisher's certificate is in place. `SECURITY.md` says how to report a
+vulnerability.
+
 ### Before a site goes live
 
 `deploy/README.md` is the checklist: HTTPS from the service itself (above),
@@ -1383,4 +1396,5 @@ https://pypi.org/project/gea-program/ after the first successful run.
 ## Licence
 
 Mozilla Public License 2.0 (MPL-2.0); see `LICENSE`. Every source file carries the MPL-2.0
-header (Exhibit A). Copyright (c) 2026 Daniel T. Murphy.
+header (Exhibit A). Copyright (c) 2026 Daniel T. Murphy. The signed kit, its updates and
+support are a subscription from ENRGYONE (`docs/commercial/COMMERCIAL.md`).

{gea_program-0.56.0 → gea_program-0.57.0}/gea/__init__.py

@@ -123,7 +123,7 @@ from .profile_catalog import (
     read_pangaea_txt,
 )
 
-__version__ = "0.56.0"
+__version__ = "0.57.0"
 __all__ = [
     "aging_rate", "rate_psi_yr", "accuracy_psi",
     "Sensor", "SimulatorConfig", "DownholeEngine",

{gea_program-0.56.0 → gea_program-0.57.0}/gea/__main__.py

@@ -67,7 +67,16 @@ def _build_config(a):
     return SimulatorConfig(**kw)
 
 
+# the front door's own commands (gea.cli), reached the same way through `python -m gea` - the kit's gea.cmd and
+# gea wrapper run `python -m gea`, and before v0.57 `gea guide`, `gea help` and the rest answered "invalid choice"
+FRONT_ONLY = ('quickstart', 'guide', 'security', 'docs', 'gui', 'help')
+
+
 def main(argv=None) -> int:
+    _argv = list(sys.argv[1:] if argv is None else argv)
+    if _argv and _argv[0] in FRONT_ONLY:
+        from .cli import main as _front
+        return _front(_argv)
     ap = argparse.ArgumentParser(prog="gea",
                                  description="GEA Downhole Simulator - headless CLI")
     sub = ap.add_subparsers(dest="cmd", required=True)

{gea_program-0.56.0 → gea_program-0.57.0}/gea/acceptance_tests.py

@@ -12660,6 +12660,167 @@ def section_cy_company_sign_in(tmp: str) -> None:
        "the help page with the Entra ID steps" + (f" - failed: {failed4}" if failed4 else ""))
 
 
+def section_cz_it_review(tmp: str) -> None:
+    """Section CZ - what an IT department asks: the security overview ships with the program and agrees with the
+    code it describes (the rounds, the sessions, the lock, the port, TLS, every host the program can reach); `gea
+    security`, `gea guide` and `gea help` answer through `python -m gea` as the kit's launcher runs it; in a checkout,
+    the kit tools zip the kit again with its catalog beside it and tell the site how to check it, and the build
+    workflow attests both kits and signs the catalog only when a certificate is configured."""
+    import importlib.util
+    import json as _json
+    import subprocess as _sp
+    import urllib.parse as _up
+    import zipfile as _zf
+    from . import doctor as DR
+    from . import elevation as EL
+    from . import helplib as H
+    from . import seismic_watch as SW
+    from . import service as SVC
+    from . import tls as TLS
+    pkg = Path(__file__).parent
+    checkout = (pkg.parent / "pyproject.toml").exists() and (pkg.parent / "tools" / "build_installer.py").exists()
+
+    # -- CZ1 the overview, and the code it describes -------------------------------------------------------------------
+    text = H.security_text() or ""
+    docs_copy = pkg.parent / "docs" / "IT_SECURITY.md"
+    same = (not docs_copy.exists()) or docs_copy.read_text(encoding="utf-8") == text
+    flat = " ".join(text.split())
+    with open(Path(pkg, "reference", "eia_prices.provenance.json"), encoding="utf-8") as f:
+        eia_hosts = {_up.urlsplit(s["refresh_url"]).hostname for s in _json.load(f)["series"].values() if s.get("refresh_url")}
+    doctor_src = Path(DR.__file__).read_text(encoding="utf-8")
+    hosts = {_up.urlsplit(EL.EPQS_URL).hostname, _up.urlsplit(SW.QUERY_URL).hostname, _up.urlsplit(SW.FEED_URL).hostname, *eia_hosts}
+    hosts |= {"pypi.org"} if "https://pypi.org/pypi/gea-program/json" in doctor_src else {"(the update check moved)"}
+    facts = {
+        "rounds": f"{SVC.PBKDF2_ROUNDS:,}" in flat,
+        "sessions": f"{SVC.SESSION_HOURS} hours" in flat and "256-bit" in flat,
+        "lock": SVC.LOGIN_MAX_FAILURES == 5 and "five failures" in flat and f"{SVC.LOGIN_LOCK_S // 60} minutes" in flat,
+        "port": "TCP 8765" in flat and "8765" in Path(DR.__file__).read_text(encoding="utf-8"),
+        "tls": "TLS 1.2 minimum" in flat and f"last {TLS.EXPIRING_DAYS} days" in flat,
+        "hosts": all(f"`{h}`" in flat for h in hosts),
+        "no_telemetry": "No telemetry" in flat,
+    }
+    # Python 3.14's argparse formats every help string as the parser is built (help % params) and stops on a bare
+    # "%": v0.54.0's first ship stopped at its gate that way while 3.13 passed. The same check, on any Python.
+    import argparse as _ap
+    import contextlib as _cl
+    import io as _io
+    from . import __main__ as _M
+    bad_help = []
+    _orig_add, _orig_sub = _ap.ArgumentParser.add_argument, _ap._SubParsersAction.add_parser
+    _params = {k_: "x" for k_ in ("prog", "default", "dest", "type", "choices", "metavar", "required", "nargs", "const", "option_strings")}
+
+    def _fmt_ok(h):
+        try:
+            h % _params
+            return True
+        except (ValueError, TypeError, KeyError):
+            return False
+
+    def _add(self, *a_, **k_):
+        h_ = k_.get("help")
+        if isinstance(h_, str) and h_ != _ap.SUPPRESS and not _fmt_ok(h_):
+            bad_help.append(f"{self.prog} {'/'.join(a_)}")
+        return _orig_add(self, *a_, **k_)
+
+    def _sub(self, name, **k_):
+        h_ = k_.get("help")
+        if isinstance(h_, str) and not _fmt_ok(h_):
+            bad_help.append(f"gea {name}")
+        return _orig_sub(self, name, **k_)
+    _ap.ArgumentParser.add_argument, _ap._SubParsersAction.add_parser = _add, _sub
+    try:
+        with _cl.redirect_stdout(_io.StringIO()), _cl.redirect_stderr(_io.StringIO()):
+            try:
+                _M.main(["wells"])
+            except SystemExit:
+                pass
+    finally:
+        _ap.ArgumentParser.add_argument, _ap._SubParsersAction.add_parser = _orig_add, _orig_sub
+    facts["help_strings"] = not bad_help
+    r_sec = _sp.run([sys.executable, "-m", "gea", "security"], capture_output=True, text=True, encoding="utf-8", errors="replace")
+    r_guide = _sp.run([sys.executable, "-m", "gea", "guide"], capture_output=True, text=True, encoding="utf-8", errors="replace")
+    r_help = _sp.run([sys.executable, "-m", "gea", "help", "https"], capture_output=True, text=True, encoding="utf-8", errors="replace")
+    bad = [k for k, v in facts.items() if not v]
+    ok(text.startswith("# GEA-Program for an IT department") and same and not bad
+       and r_sec.returncode == 0 and "GEA-Program for an IT department" in r_sec.stdout
+       and r_guide.returncode == 0 and "HOW TO TEST GEA" in r_guide.stdout and r_help.returncode == 0 and "**The command**" in r_help.stdout,
+       "CZ1 the security overview ships in the package (identical to docs/IT_SECURITY.md) and agrees with the code: the password hashing rounds, the "
+       "session length and token size, the sign-in lock, the one port, the TLS floor and the expiry warning, every host the program can reach "
+       "(ComCat, the elevation service, the price series, PyPI); `python -m gea security`, `guide` and `help` answer as the kit's own launcher "
+       "runs them; every option's help text formats the way Python 3.14 checks it as the parser is built"
+       + (f" - disagrees: {bad}" if bad else "") + (f" - help texts: {bad_help}" if bad_help else ""))
+
+    # -- CZ2 the kit is zipped again with its catalog, and says how to check it ----------------------------------------------
+    if checkout:
+        spec = importlib.util.spec_from_file_location("cz_installer", str(pkg.parent / "tools" / "build_installer.py"))
+        bi = importlib.util.module_from_spec(spec); spec.loader.exec_module(bi)
+        kit = Path(tmp, "cz_kit", "gea-program-9.9.9-win64"); (kit / "python").mkdir(parents=True)
+        (kit / "MANIFEST.json").write_text("{}", encoding="utf-8"); (kit / "python" / "python.exe").write_bytes(b"MZ stand-in")
+        (kit / "SHA256SUMS.txt").write_text("x  MANIFEST.json\n", encoding="utf-8")
+        cat = Path(tmp, "cz_kit", "gea-program-9.9.9-win64.cat"); cat.write_bytes(b"0\x82 a catalog stand-in")
+        zp = bi.rezip(kit, [cat])
+        with _zf.ZipFile(zp) as z:
+            names = sorted(z.namelist())
+            cat_back = z.read("gea-program-9.9.9-win64.cat")
+        try:
+            bi.rezip(Path(tmp, "cz_kit"), [])
+            not_kit = "accepted"
+        except SystemExit as e:
+            not_kit = str(e)
+        readme = bi.README.format(version="9.9.9", target="Windows x64", pyline="p", install="i", start="s", verify="v", port="8765",
+                                  service="sv", stop="st", uninstall="u", workspace="w", check=bi.WIN_CHECK.format(version="9.9.9"))
+        build_src = (pkg.parent / "tools" / "build_installer.py").read_text(encoding="utf-8")
+        c2 = {
+            "rezip": names == ["gea-program-9.9.9-win64.cat", "gea-program-9.9.9-win64/MANIFEST.json", "gea-program-9.9.9-win64/SHA256SUMS.txt",
+                               "gea-program-9.9.9-win64/python/python.exe"] and cat_back == cat.read_bytes() and "not a kit folder" in not_kit,
+            "readme": all(x in readme for x in ("gh attestation verify gea-program-9.9.9-win64.zip -R Daniel8Murphy0007/GEA-Program",
+                                                "Test-FileCatalog -CatalogFilePath .\\gea-program-9.9.9-win64.cat -Path .\\gea-program-9.9.9-win64",
+                                                "Get-AuthenticodeSignature", "IT_SECURITY.md", "gea help https"))
+                      and "368 checks" not in readme and "behind the site's TLS proxy" not in readme,
+            "ships_overview": "docs' / 'IT_SECURITY.md'" in build_src and "kit / 'IT_SECURITY.md'" in build_src,
+        }
+        where = "the checkout's kit tools"
+    else:
+        c2 = {"installed": bool(H.security_text())}
+        where = "an installed copy: the kit tools are checked in the checkout"
+    failed2 = [k for k, v in c2.items() if not v]
+    ok(not failed2,
+       f"CZ2 ({where}) the kit is zipped again from its folder with its file catalog beside the folder, every file kept; a folder that is not a kit "
+       "is refused; the kit's README tells the site how to check the build's attestation and every file against the catalog and its signature, "
+       "and carries the IT overview" + (f" - failed: {failed2}" if failed2 else ""))
+
+    # -- CZ3 the build workflow: attested, signed only with a certificate, never signed in name only ----------------------------
+    wf = pkg.parent / ".github" / "workflows" / "build-installer.yml"
+    if wf.exists():
+        y = wf.read_text(encoding="utf-8")
+        win = y[y.index("windows-kit:"):y.index("linux-kit:")]
+        lin = y[y.index("linux-kit:"):]
+        order = [win.index(s) for s in ("New-FileCatalog", "azure/artifact-signing-action", "signtool", "Test-FileCatalog", "--rezip", "call install.cmd",
+                                        "attest-build-provenance", "attach-kit.sh")]
+        c3 = {
+            "permissions": "id-token: write" in y and "attestations: write" in y and "contents: write" in y,
+            "attested": "actions/attest-build-provenance" in win and "actions/attest-build-provenance" in lin
+                        and "subject-path: dist/gea-program-*-win64.zip" in win and "subject-path: dist/gea-program-*-linux-*.zip" in lin,
+            "conditional": "if: env.ARTIFACT_SIGNING_ACCOUNT != ''" in win and "if: env.ARTIFACT_SIGNING_ACCOUNT == '' && env.SIGNING_PFX_BASE64 != ''" in win
+                           and "secrets.ARTIFACT_SIGNING_ACCOUNT" in win and "secrets.SIGNING_PFX_BASE64" in win,
+            "checked": "-CatalogVersion 2.0" in win and "throw 'the catalog does not match the kit'" in win
+                       and "throw 'a certificate is configured but the catalog is not validly signed'" in win and "ships unsigned" in win
+                       and "Remove-Item $pfx" in win and "/tr http://timestamp" in win and "timestamp-rfc3161" in win,
+            "order": order == sorted(order),
+            "policy": (pkg.parent / "SECURITY.md").exists() and "Report a vulnerability" in " ".join((pkg.parent / "SECURITY.md").read_text(encoding="utf-8").split()),
+        }
+        where3 = "the checkout's workflow"
+    else:
+        c3 = {"installed": True}
+        where3 = "an installed copy: the workflow is checked in the checkout"
+    failed3 = [k for k, v in c3.items() if not v]
+    ok(not failed3,
+       f"CZ3 ({where3}) both kits are attested by the build that made them; the Windows kit's file catalog is made, signed by Azure Artifact "
+       "Signing or a PFX only when its secrets are configured (timestamped; the PFX removed), checked against the kit - a mismatch, or a "
+       "configured certificate that did not sign, stops the build - then zipped beside the kit before the kit is installed and its gate run; "
+       "SECURITY.md says how to report a vulnerability" + (f" - failed: {failed3}" if failed3 else ""))
+
+
 def PR_read_ok(path) -> bool:
     from . import pdf_report as PR
     try:
@@ -12774,6 +12935,7 @@ def main() -> int:
         section_cw_decline(tmp)
         section_cx_https(tmp)
         section_cy_company_sign_in(tmp)
+        section_cz_it_review(tmp)
     if _FAILS:
         print(f"[ACCEPTANCE] {len(_FAILS)} FAILURES ({_PASS} passed):")
         for f in _FAILS:

{gea_program-0.56.0 → gea_program-0.57.0}/gea/cli.py

@@ -10,6 +10,7 @@
     gea model-cards ...    gea store-forward ...  gea sla-report ...  gea fat-sat ...
     gea help [topic]                    the help library, by the job (gea help drift); same text as the dashboard's panels
     gea guide                           the click-by-click tester guide
+    gea security                        what an IT department asks before installing, answered (docs/IT_SECURITY.md)
     gea docs                            where the catalogue and the reports live on this machine
     gea gui                             the desktop window (desktop extra)
     gea accept                          the product gate
@@ -23,7 +24,7 @@ import os
 import sys
 from pathlib import Path
 
-FRONT = {'quickstart', 'survey', 'guide', 'docs', 'gui', 'help', '-h', '--help'}
+FRONT = {'quickstart', 'survey', 'guide', 'security', 'docs', 'gui', 'help', '-h', '--help'}
 
 
 def _pkg_root() -> Path:
@@ -62,6 +63,16 @@ def cmd_guide(_argv) -> int:
     return 0
 
 
+def cmd_security(_argv) -> int:
+    from .helplib import security_text
+    text = security_text()                                # ships inside the package (gea/help/IT_SECURITY.md)
+    if text is None:
+        print('the security overview is missing from this installation; reinstall: python -m pip install --upgrade --force-reinstall "gea-program[live]"')
+        return 2
+    print(text)
+    return 0
+
+
 def cmd_help(argv) -> int:
     from .helplib import page, index_text, topics
     if not argv:
@@ -141,6 +152,8 @@ def main(argv=None) -> int:
             return cmd_survey(rest)
         if cmd == 'guide':
             return cmd_guide(rest)
+        if cmd == 'security':
+            return cmd_security(rest)
         if cmd == 'docs':
             return cmd_docs(rest)
         if cmd == 'gui':

gea_program-0.57.0/gea/help/IT_SECURITY.md

@@ -0,0 +1,138 @@
+# GEA-Program for an IT department
+
+What an IT or security reviewer asks before GEA-Program is installed on a
+site machine, answered from what the program does - each answer names the
+command or file that shows it. The program's version is in `MANIFEST.json`
+of the kit and on the control panel's Audit / Update page.
+`gea security` prints this page from any installation of the program.
+
+## What it is
+
+One Python package (`gea-program`, MPL-2.0 source on GitHub and PyPI) with
+one required dependency (numpy) and optional extras, delivered for a site as
+a standalone kit: the package, every wheel it needs, the embeddable CPython
+from python.org, and plain launch scripts. It installs into its own folder
+without administrator rights and without network access. It writes nothing
+outside that folder and the site's workspace folder, adds no driver, no
+system service (a per-user scheduled task only if the site runs
+`register-service.cmd`), and no registry keys.
+
+`tools/standalone_check.py` (run by the acceptance gate) fails the build if
+any module imports anything outside the standard library, numpy and the
+declared extras.
+
+## Data: where it is and where it goes
+
+- **At rest**: everything the program keeps for a site is in the workspace
+  folder the site chooses (by default `%LOCALAPPDATA%\GEA-Program\site`):
+  the client's files as received, hashed; the derived records; the reports;
+  the configuration with its version history; `users.json`; the append-only
+  audit log `records\audit.jsonl`. Disk encryption, file-system permissions
+  and backup are the site's (`gea backup` writes a verified archive to the
+  folder or share the site names - never inside the workspace).
+- **Keys** are in the workspace's `keys\` folder, readable by their owner
+  where the file system allows: the site's dossier signing key (Ed25519), the
+  HTTPS private key when the program made the certificate, the company
+  sign-in client secret when one is kept. None of them is ever put in a
+  report, an export, an evidence pack or a signed dossier, or sent by the
+  service. The backup copies them with the rest of the workspace: protect
+  the backup location accordingly.
+- **Outbound connections** - none at install, none unless the site turns a
+  feature on or a person asks:
+
+  | What | To | When |
+  |---|---|---|
+  | Earthquake watch | `earthquake.usgs.gov` (ComCat) | while an operation runs, if the site enables it |
+  | Elevation look-up | `epqs.nationalmap.gov` | when a person asks for a well's ground elevation |
+  | Seismic archives | an FDSN service the site names (e.g. `service.iris.edu`) | when a person fetches station data |
+  | Price series refresh | `raw.githubusercontent.com` (the EIA series' public mirror) | when a person refreshes them |
+  | Update check | `pypi.org` | when a person runs `gea update --check` or opens Audit / Update |
+  | Notifications | the site's own SMTP server or webhook | when the site configures a channel |
+  | Company sign-in | the site's identity provider (Entra ID: `login.microsoftonline.com`) | at each company sign-in, if configured |
+  | Live data | the site's historian (PI Web API), WITSML store, OPC UA server, MQTT broker, Modbus/DNP3/HART-IP device, SeedLink server | when the site defines a patch for it |
+
+  No telemetry, no usage reporting, no licence server. Everything else runs
+  on the machine.
+
+## Who can reach it
+
+- **Port**: one, TCP 8765 by default (`GEA_PORT` / `--port`), bound to
+  `127.0.0.1` unless the site starts it with `--host`. Nothing else listens.
+- **Transport**: HTTPS when the workspace has a certificate - the site's own
+  (from its certificate authority) or one the program makes (`gea tls`,
+  `gea help https`): TLS 1.2 minimum, the session cookie `Secure`,
+  `Strict-Transport-Security`, plain HTTP on the same port redirected; a
+  certificate in its last 30 days raises an alert; a broken certificate stops
+  the start rather than falling back to plain HTTP. Or the site's reverse
+  proxy terminates TLS (`deploy/`).
+- **Sign-in**: company accounts by OpenID Connect (Entra ID, Okta, Google,
+  Ping, Keycloak, AD FS; authorization code flow with PKCE; the ID token's
+  RS256 signature, issuer, audience, expiry and nonce checked;
+  `gea help company-sign-in`), and local accounts (PBKDF2-SHA256, 200,000
+  rounds, a salt per user; five failures lock the name and the address for
+  15 minutes). Sessions are random 256-bit tokens in `HttpOnly;
+  SameSite=Strict` cookies, 12 hours; an administrator sees every live
+  session and revokes any.
+- **Roles**: viewer < operator < approver < admin, enforced by the service
+  on every request; a company account's role comes from the company's app
+  roles or groups at each sign-in.
+- **The page**: every action needs a header a cross-site form cannot set;
+  every response carries a Content-Security-Policy (`default-src 'self'`,
+  `frame-ancestors 'none'`), `X-Frame-Options: DENY`, `nosniff` and a
+  same-origin referrer policy. The page loads nothing from the internet.
+
+## What it records
+
+Every action - by a person through the page, by a scheduled job, by the
+command line - is a line in `records\audit.jsonl` with the actor, the time
+and the SHA-256 of its inputs; sign-ins and failures with the address and
+the reason. The log is append-only; `gea housekeeping` segments it, never
+truncates it. A signed dossier carries the audit chain's head and lets
+anyone verify, without GEA, that the reports and the log have not changed
+since it was signed.
+
+## What is installed, and from where
+
+- `gea sbom --out C:\site\reports` writes the software bill of materials of
+  the running installation (each component's name, version, supplier,
+  licence, hash, package URL and relationship, from the installed metadata).
+- The kit's `SHA256SUMS.txt` holds the hash of every file and `MANIFEST.json`
+  the wheels and the commit it was built from.
+- **Provenance**: every kit attached to a GitHub release is attested by the
+  build that made it (GitHub artifact attestations, Sigstore). Check a
+  downloaded kit with the GitHub CLI, for example:
+  `gh attestation verify gea-program-0.57.0-win64.zip -R Daniel8Murphy0007/GEA-Program`.
+  The PyPI release is published by GitHub's trusted publishing, which
+  attaches the publisher's attestations to the files on PyPI.
+- **Code signing (Windows)**: the batch launchers of the kit cannot carry a
+  signature of their own, so the kit carries a file catalog beside its
+  folder in the zip - `gea-program-0.57.0-win64.cat` for 0.57.0 - holding
+  the SHA-256 of every file in the kit. When the publisher's signing
+  certificate is in place the catalog is Authenticode-signed:
+  `Get-AuthenticodeSignature .\gea-program-0.57.0-win64.cat` shows the
+  publisher, and, in the folder the zip was extracted to and before
+  `install.cmd` runs,
+  `Test-FileCatalog -CatalogFilePath .\gea-program-0.57.0-win64.cat -Path .\gea-program-0.57.0-win64`
+  says Valid when no file has changed. An application-control policy
+  (App Control for Business / WDAC) can trust the kit by its signed
+  catalog. Until the certificate is in place the catalog ships unsigned and
+  the build says so. The embeddable Python's own executables are signed by
+  the Python Software Foundation.
+- **Updates**: a new kit is installed beside the old one; the workspace is
+  found and opened as it is. Nothing updates itself: on a pip installation,
+  `gea update` upgrades from PyPI only when a person runs it.
+- **The acceptance gate**: `verify.cmd` runs every check of the program's
+  acceptance suite from the installed kit - the site's own evidence that
+  this installation does what the release says.
+
+## Reporting a vulnerability
+
+See `SECURITY.md`: privately, through the repository's "Report a
+vulnerability" (GitHub private vulnerability reporting) or by email to the
+address there - never in a public issue. A fix or a mitigation ships in a
+release the advisory names.
+
+## Support
+
+The source is open (MPL-2.0). The signed kit, its updates and support are a
+subscription from ENRGYONE: see `docs/commercial/COMMERCIAL.md`.

{gea_program-0.56.0 → gea_program-0.57.0}/gea/helplib.py

@@ -147,6 +147,14 @@ def index_text() -> str:
     return '\n'.join(lines)
 
 
+def security_text() -> Optional[str]:
+    p = os.path.join(HELP_DIR, 'IT_SECURITY.md')
+    if not os.path.isfile(p):
+        return None
+    with open(p, encoding='utf-8') as f:
+        return f.read()
+
+
 def guide_text() -> Optional[str]:
     p = os.path.join(HELP_DIR, 'TESTER_GUIDE.md')
     if not os.path.isfile(p):

{gea_program-0.56.0 → gea_program-0.57.0/gea_program.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gea-program
-Version: 0.56.0
+Version: 0.57.0
 Summary: GEA-Program: downhole gauge monitoring - canonical measurement records, quality rules, drift evaluation with a re-fit change log, well-test validation, alarm management, model cards, store-and-forward, monthly SLA measurement, FAT/SAT protocols and a dashboard, generated from live objects in the client's reporting outline.
 Author: Daniel T. Murphy
 License: MPL-2.0
@@ -1291,6 +1291,19 @@ gea oidc --workspace C:\site --issuer https://login.microsoftonline.com/3f8b2c1d
 Or Administration -> **Company sign-in**. `gea help company-sign-in` has the
 Entra ID app registration step by step.
 
+### For an IT department
+
+`docs/IT_SECURITY.md` (`gea security` prints it from any installation)
+answers what a reviewer asks before installing: where the data is and every
+connection the program can make, the one port, HTTPS, company sign-in and
+roles, the audit log, the bill of materials (`gea sbom`), and how a kit is
+checked - the build's attestation
+(`gea-program-0.57.0-win64.zip` checked with
+`gh attestation verify gea-program-0.57.0-win64.zip -R Daniel8Murphy0007/GEA-Program`)
+and the file catalog beside the kit's folder, Authenticode-signed once the
+publisher's certificate is in place. `SECURITY.md` says how to report a
+vulnerability.
+
 ### Before a site goes live
 
 `deploy/README.md` is the checklist: HTTPS from the service itself (above),
@@ -1422,4 +1435,5 @@ https://pypi.org/project/gea-program/ after the first successful run.
 ## Licence
 
 Mozilla Public License 2.0 (MPL-2.0); see `LICENSE`. Every source file carries the MPL-2.0
-header (Exhibit A). Copyright (c) 2026 Daniel T. Murphy.
+header (Exhibit A). Copyright (c) 2026 Daniel T. Murphy. The signed kit, its updates and
+support are a subscription from ENRGYONE (`docs/commercial/COMMERCIAL.md`).

{gea_program-0.56.0 → gea_program-0.57.0}/gea_program.egg-info/SOURCES.txt

@@ -257,6 +257,7 @@ gea/fixtures/comcat_delaware_basin_2026-09.txt
 gea/fixtures/comcat_mahoning_1990-2026.txt
 gea/fixtures/comcat_youngstown_2011-2012.txt
 gea/fixtures/ne_110m_coastline.json
+gea/help/IT_SECURITY.md
 gea/help/TESTER_GUIDE.md
 gea/help/alarms.md
 gea/help/alerts.md

{gea_program-0.56.0 → gea_program-0.57.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gea-program"
-version = "0.56.0"
+version = "0.57.0"
 description = "GEA-Program: downhole gauge monitoring - canonical measurement records, quality rules, drift evaluation with a re-fit change log, well-test validation, alarm management, model cards, store-and-forward, monthly SLA measurement, FAT/SAT protocols and a dashboard, generated from live objects in the client's reporting outline."
 readme = "README.md"
 requires-python = ">=3.10"