grundnorm 0.1.0__tar.gz

grundnorm-0.1.0/.gitignore

@@ -0,0 +1,96 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/versions
+
+# testing
+/coverage
+
+# Playwright
+/test-results/
+/playwright-report/
+/blob-report/
+/playwright/.cache/
+/tests/e2e/.auth/
+
+# next.js
+/.next/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-debug.log*
+
+# env files (can opt-in for committing if needed)
+.env*
+
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts
+
+# repomix output files
+repomix-output.*
+tools/mcp-dev/node_modules/
+tools/**/node_modules/
+
+# graphify knowledge graph (generated)
+# Ignoramos el grueso (cache/, obsidian/, html, ficheros internos .graphify_*)
+# pero VERSIONAMOS el mapa para que TODAS las instancias lo tengan vía git pull
+# (memoria permanente del repo, sin re-leer todo → ahorra tokens).
+graphify-out/*
+!graphify-out/GRAPH_REPORT.md
+!graphify-out/graph.json
+!graphify-out/manifest.json
+
+# MCP server build artifacts
+mcp-server/node_modules/
+mcp-server/dist/
+mcp-server/*.tsbuildinfo
+
+# Claude Code worktrees (local-only embedded repos)
+.claude/worktrees/
+
+# Documentos sensibles sueltos en raíz (cap tables, decks, etc.)
+Nexus-Legal-Cap-Table-*.pdf
+/*.pdf
+
+# Listas de contactos con PII (nombres/emails) — no deben versionarse.
+# El historial previo requiere un scrub aparte (BFG/git filter-repo).
+email-lists/*.csv
+# Artefactos operativos y de runtime
+scripts/*.log
+.gpu_enrich.txt
+# Artefactos de Python
+__pycache__/
+*.pyc
+*.pyo
+# Entornos virtuales de Python (locales)
+.venv-embed/
+.venv/
+
+# SDK build artifacts
+sdk/typescript/node_modules/
+sdk/typescript/dist/
+sdk/python/**/__pycache__/
+sdk/python/*.egg-info/
+sdk/python/build/
+sdk/python/dist/

grundnorm-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Quantum Nexus Ventures FZCO
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

grundnorm-0.1.0/PKG-INFO

@@ -0,0 +1,77 @@
+Metadata-Version: 2.4
+Name: grundnorm
+Version: 0.1.0
+Summary: Official SDK for the Grundnorm grounded source-of-law truth layer — resolve a legal norm by open identifier (ELI/ECLI) + date and verify its cryptographic seal locally.
+Project-URL: Homepage, https://grundnorm.nexusquantum.legal
+Project-URL: Repository, https://github.com/djtellado/nexus-grundnorm
+Project-URL: Issues, https://github.com/djtellado/nexus-grundnorm/issues
+Author-email: Quantum Nexus Ventures FZCO <support@nexusquantum.legal>
+License: MIT
+License-File: LICENSE
+Keywords: ecli,ed25519,eli,grundnorm,law,legal,source-of-law,verifiable
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Scientific/Engineering
+Classifier: Topic :: Software Development :: Libraries
+Requires-Python: >=3.9
+Requires-Dist: cryptography>=41.0
+Description-Content-Type: text/markdown
+
+# grundnorm (Python SDK)
+
+Resolve a legal norm by its **open identifier** (ELI/ECLI) and a **date**, and get back its canonical,
+sealed meaning as an **independently verifiable** signed object. The SDK recomputes the content hash and
+verifies every Ed25519 signature locally — **you never have to trust the server**.
+
+- Deterministic, zero-LLM read path. Honest `not_found` instead of a guess.
+- Point-in-time: `[validFrom, validUntil)`.
+- Python 3.9+. One dependency: `cryptography`.
+
+## Install
+
+```bash
+pip install grundnorm
+```
+
+## Use
+
+```python
+from grundnorm import GrundnormClient
+
+# Defaults to the public GDPR demonstrator. For a pilot:
+#   GrundnormClient(endpoint="https://.../api/grundnorm/resolve", api_key="nlk_...")
+client = GrundnormClient()
+
+r = client.resolve(
+    id="http://data.europa.eu/eli/reg/2016/679/art_5",
+    jurisdiction="EU",
+    at="2026-07-07",   # omit for "today"
+)
+
+if r.status == "found":
+    print(r.norm["atoms"])          # subject / modality / action / condition / exception / scope + evidence
+    print(r.verification["ok"])     # True only if hash recomputes AND all signatures verify
+```
+
+`resolve()` verifies the seal by default. Skip with `verify=False`, or verify a stored envelope later:
+
+```python
+from grundnorm import verify
+v = verify(norm)  # {"ok", "hash_ok", "recomputed_hash", "signatures", "quorum"}
+```
+
+## How verification works (no trust required)
+
+1. `sha256(canonicalize(norm["canonical"]["content"]))` must equal `norm["seal"]["contentHash"]`,
+   where `canonicalize` = JSON with object keys sorted recursively, no whitespace, hashed as UTF-8.
+2. Each `seal.signatures[].signatureHex` is an Ed25519 signature by that signer's `publicKeyHex`
+   over the UTF-8 bytes of the `seal.contentHash` hex string.
+
+## Errors
+
+- Nothing sealed for `(id, date)` → returns `NotFound` (a normal outcome).
+- Bad key, bad input, or server error → raises `GrundnormError` (`.status`, `.code`).
+
+> Demonstrator note: the demo corpus (GDPR sample) is signed by demo keys, not institutions, and its
+> accuracy is not yet jurist-graded. See the project's `DEMO-TRUTHFULNESS.md`.

grundnorm-0.1.0/README.md

@@ -0,0 +1,57 @@
+# grundnorm (Python SDK)
+
+Resolve a legal norm by its **open identifier** (ELI/ECLI) and a **date**, and get back its canonical,
+sealed meaning as an **independently verifiable** signed object. The SDK recomputes the content hash and
+verifies every Ed25519 signature locally — **you never have to trust the server**.
+
+- Deterministic, zero-LLM read path. Honest `not_found` instead of a guess.
+- Point-in-time: `[validFrom, validUntil)`.
+- Python 3.9+. One dependency: `cryptography`.
+
+## Install
+
+```bash
+pip install grundnorm
+```
+
+## Use
+
+```python
+from grundnorm import GrundnormClient
+
+# Defaults to the public GDPR demonstrator. For a pilot:
+#   GrundnormClient(endpoint="https://.../api/grundnorm/resolve", api_key="nlk_...")
+client = GrundnormClient()
+
+r = client.resolve(
+    id="http://data.europa.eu/eli/reg/2016/679/art_5",
+    jurisdiction="EU",
+    at="2026-07-07",   # omit for "today"
+)
+
+if r.status == "found":
+    print(r.norm["atoms"])          # subject / modality / action / condition / exception / scope + evidence
+    print(r.verification["ok"])     # True only if hash recomputes AND all signatures verify
+```
+
+`resolve()` verifies the seal by default. Skip with `verify=False`, or verify a stored envelope later:
+
+```python
+from grundnorm import verify
+v = verify(norm)  # {"ok", "hash_ok", "recomputed_hash", "signatures", "quorum"}
+```
+
+## How verification works (no trust required)
+
+1. `sha256(canonicalize(norm["canonical"]["content"]))` must equal `norm["seal"]["contentHash"]`,
+   where `canonicalize` = JSON with object keys sorted recursively, no whitespace, hashed as UTF-8.
+2. Each `seal.signatures[].signatureHex` is an Ed25519 signature by that signer's `publicKeyHex`
+   over the UTF-8 bytes of the `seal.contentHash` hex string.
+
+## Errors
+
+- Nothing sealed for `(id, date)` → returns `NotFound` (a normal outcome).
+- Bad key, bad input, or server error → raises `GrundnormError` (`.status`, `.code`).
+
+> Demonstrator note: the demo corpus (GDPR sample) is signed by demo keys, not institutions, and its
+> accuracy is not yet jurist-graded. See the project's `DEMO-TRUTHFULNESS.md`.

grundnorm-0.1.0/examples/resolve.py

@@ -0,0 +1,27 @@
+"""Resolve GDPR Article 5 against the public demonstrator and verify its seal locally.
+
+Run:  pip install -e .  &&  python examples/resolve.py
+"""
+from grundnorm import GrundnormClient
+
+client = GrundnormClient()  # defaults to the public GDPR demonstrator
+
+r = client.resolve(
+    id="http://data.europa.eu/eli/reg/2016/679/art_5",
+    jurisdiction="EU",
+    at="2026-07-07",  # omit for "today"
+)
+
+if r.status == "not_found":
+    print("not_found:", r.note)
+else:
+    print(f'{r.norm["articleLabel"]} — {len(r.norm["atoms"])} atoms, provenance {r.norm["provenance"]}')
+    for a in r.norm["atoms"]:
+        print(f'  · [{a["modality"]}/{a["status"]}] {a["subject"]} — {a["action"]}')
+    v = r.verification
+    print(
+        f'\nseal verified locally: {"YES" if v["ok"] else "NO"}  '
+        f'(hash {"ok" if v["hash_ok"] else "MISMATCH"}, '
+        f'{v["quorum"]["valid_signatures"]}/{len(v["signatures"])} signatures, '
+        f'sovereign: {v["quorum"]["has_sovereign"]})'
+    )

grundnorm-0.1.0/grundnorm/__init__.py

@@ -0,0 +1,15 @@
+"""Official Python SDK for the Grundnorm grounded source-of-law truth layer."""
+from .client import DEFAULT_ENDPOINT, DEMO_KEY, GrundnormClient, GrundnormError, NotFound, Resolved
+from .verify import canonicalize, verify
+
+__all__ = [
+    "GrundnormClient",
+    "GrundnormError",
+    "Resolved",
+    "NotFound",
+    "verify",
+    "canonicalize",
+    "DEFAULT_ENDPOINT",
+    "DEMO_KEY",
+]
+__version__ = "0.1.0"

grundnorm-0.1.0/grundnorm/client.py

@@ -0,0 +1,85 @@
+"""Grundnorm Python SDK — resolve a legal norm by open identifier + date, verify the seal locally."""
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass
+from typing import Any, Dict, Optional, Union
+
+from .verify import verify as _verify
+
+DEFAULT_ENDPOINT = "https://ptqvvfnnnfltiwuvkxxw.supabase.co/functions/v1/grundnorm-resolve"
+DEMO_KEY = "nlk_demo_grundnorm_2026"
+
+
+class GrundnormError(Exception):
+    """Auth / validation / server error from the resolve endpoint."""
+
+    def __init__(self, message: str, status: int, code: Optional[str] = None):
+        super().__init__(message)
+        self.status = status
+        self.code = code
+
+
+@dataclass
+class NotFound:
+    """Nothing sealed for (id, date) — a normal outcome, not an error."""
+
+    identifier: str
+    at: str
+    note: str
+    status: str = "not_found"
+
+
+@dataclass
+class Resolved:
+    """A resolved, sealed norm plus its local verification (None if verify=False)."""
+
+    norm: Dict[str, Any]
+    verification: Optional[Dict[str, Any]]
+    status: str = "found"
+
+
+class GrundnormClient:
+    def __init__(self, endpoint: str = DEFAULT_ENDPOINT, api_key: str = DEMO_KEY, timeout: float = 30.0):
+        self.endpoint = endpoint
+        self.api_key = api_key
+        self.timeout = timeout
+
+    def resolve(
+        self,
+        id: str,
+        jurisdiction: str,
+        at: Optional[str] = None,
+        domain: Optional[str] = None,
+        verify: bool = True,
+    ) -> Union[Resolved, NotFound]:
+        """Resolve a norm's sealed canonical meaning by identifier + date. Deterministic, zero-LLM.
+
+        Returns ``Resolved`` on success (with a local seal ``verification`` unless ``verify=False``),
+        ``NotFound`` when nothing is sealed for (id, date), and raises ``GrundnormError`` otherwise.
+        """
+        params = {"id": id, "jurisdiction": jurisdiction}
+        if at:
+            params["at"] = at
+        if domain:
+            params["domain"] = domain
+        url = self.endpoint + "?" + urllib.parse.urlencode(params)
+        req = urllib.request.Request(url, headers={"Authorization": f"Bearer {self.api_key}"})
+
+        try:
+            with urllib.request.urlopen(req, timeout=self.timeout) as r:
+                body = json.loads(r.read().decode("utf-8"))
+        except urllib.error.HTTPError as e:
+            body = {}
+            try:
+                body = json.loads(e.read().decode("utf-8"))
+            except Exception:
+                pass
+            if e.code == 404 and body.get("status") == "not_found":
+                return NotFound(body.get("identifier"), body.get("at"), body.get("note"))
+            raise GrundnormError(body.get("error", f"HTTP {e.code}"), e.code, body.get("code")) from None
+
+        return Resolved(body, _verify(body) if verify else None)

grundnorm-0.1.0/grundnorm/verify.py

@@ -0,0 +1,64 @@
+"""Canonicalization + Ed25519 verification. Must match the Grundnorm server byte-for-byte."""
+from __future__ import annotations
+
+import hashlib
+import json
+from typing import Any, Dict
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+
+def canonicalize(value: Any) -> str:
+    """Deterministic JSON: object keys sorted recursively, no insignificant whitespace.
+
+    Mirrors the server's canonicalize(): objects -> sorted keys, arrays -> in order, primitives ->
+    json.dumps. Output is hashed as UTF-8.
+    """
+    if value is None or not isinstance(value, (dict, list)):
+        return json.dumps(value, ensure_ascii=False, separators=(",", ":"))
+    if isinstance(value, list):
+        return "[" + ",".join(canonicalize(v) for v in value) + "]"
+    keys = sorted(value.keys())
+    return "{" + ",".join(json.dumps(k, ensure_ascii=False) + ":" + canonicalize(value[k]) for k in keys) + "}"
+
+
+def _sha256_hex(s: str) -> str:
+    return hashlib.sha256(s.encode("utf-8")).hexdigest()
+
+
+def _verify_signature(content_hash_hex: str, signature_hex: str, public_key_hex: str) -> bool:
+    try:
+        pk = Ed25519PublicKey.from_public_bytes(bytes.fromhex(public_key_hex))
+        # The message signed is the UTF-8 bytes of the content-hash HEX STRING (not the raw hash bytes).
+        pk.verify(bytes.fromhex(signature_hex), content_hash_hex.encode("utf-8"))
+        return True
+    except (InvalidSignature, ValueError):
+        return False
+
+
+def verify(norm: Dict[str, Any]) -> Dict[str, Any]:
+    """Verify a resolved norm WITHOUT trusting the server.
+
+    Recomputes the content hash from the exposed canonical preimage and checks every Ed25519
+    signature against the public keys in the response. Returns a dict with ``ok`` True iff the hash
+    recomputes AND every signature verifies (at least one signature present).
+    """
+    seal = norm["seal"]
+    recomputed = _sha256_hex(canonicalize(norm["canonical"]["content"]))
+    hash_ok = recomputed == seal["contentHash"]
+
+    signatures = []
+    for s in seal["signatures"]:
+        ok = _verify_signature(seal["contentHash"], s["signatureHex"], s["publicKeyHex"])
+        signatures.append({"signerId": s["signerId"], "signerName": s["signerName"], "role": s["role"], "ok": ok})
+
+    valid = sum(1 for s in signatures if s["ok"])
+    has_sovereign = any(s["ok"] and s["role"] == "N2_sovereign" for s in signatures)
+    return {
+        "ok": hash_ok and len(signatures) > 0 and all(s["ok"] for s in signatures),
+        "hash_ok": hash_ok,
+        "recomputed_hash": recomputed,
+        "signatures": signatures,
+        "quorum": {"valid_signatures": valid, "has_sovereign": has_sovereign},
+    }

grundnorm-0.1.0/pyproject.toml

@@ -0,0 +1,29 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "grundnorm"
+version = "0.1.0"
+description = "Official SDK for the Grundnorm grounded source-of-law truth layer — resolve a legal norm by open identifier (ELI/ECLI) + date and verify its cryptographic seal locally."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "Quantum Nexus Ventures FZCO", email = "support@nexusquantum.legal" }]
+keywords = ["grundnorm", "legal", "law", "eli", "ecli", "verifiable", "ed25519", "source-of-law"]
+dependencies = ["cryptography>=41.0"]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "License :: OSI Approved :: MIT License",
+  "Operating System :: OS Independent",
+  "Topic :: Software Development :: Libraries",
+  "Topic :: Scientific/Engineering",
+]
+
+[project.urls]
+Homepage = "https://grundnorm.nexusquantum.legal"
+Repository = "https://github.com/djtellado/nexus-grundnorm"
+Issues = "https://github.com/djtellado/nexus-grundnorm/issues"
+
+[tool.hatch.build.targets.wheel]
+packages = ["grundnorm"]

grundnorm-0.1.0/tests/fixtures/gdpr-art5.json

@@ -0,0 +1,170 @@
+{
+  "@context": "https://grundnorm.nexusquantum.legal/ns/v1",
+  "@type": "GroundedNorm",
+  "identifier": "http://data.europa.eu/eli/reg/2016/679/art_5",
+  "scheme": "eli",
+  "at": "2026-07-07",
+  "jurisdiction": "EU",
+  "domain": "legislation",
+  "articleLabel": "GDPR — Article 5 (Principles relating to processing of personal data) · DEMO",
+  "status": "sealed",
+  "legalForce": "official_reference",
+  "provenance": "N2_sovereign",
+  "validFrom": "2018-05-25",
+  "validUntil": null,
+  "version": 1,
+  "supersedesHash": null,
+  "atoms": [
+    {
+      "id": "a1",
+      "statement": "the controller — must process personal data lawfully, fairly and in a transparent manner in relation to the data subject.",
+      "subject": "the controller",
+      "modality": "obligation",
+      "action": "process personal data lawfully, fairly and in a transparent manner in relation to the data subject",
+      "condition": null,
+      "exception": null,
+      "scope": "for the purposes of this Regulation",
+      "evidence": "Personal data shall be: processed lawfully, fairly and in a transparent manner in relation to the data subject",
+      "inverse": "the controller may process personal data unlawfully, unfairly or opaquely",
+      "consensus": {
+        "agree": 3,
+        "reads": 3,
+        "independence": "multi"
+      },
+      "status": "fixed"
+    },
+    {
+      "id": "a2",
+      "statement": "the controller — must limit personal data to what is adequate, relevant and necessary for the purposes for which they are processed.",
+      "subject": "the controller",
+      "modality": "obligation",
+      "action": "limit personal data to what is adequate, relevant and necessary for the purposes for which they are processed",
+      "condition": null,
+      "exception": null,
+      "scope": "for the purposes of this Regulation",
+      "evidence": "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed",
+      "inverse": "the controller may collect personal data beyond what is necessary for the purpose",
+      "consensus": {
+        "agree": 3,
+        "reads": 3,
+        "independence": "multi"
+      },
+      "status": "fixed"
+    }
+  ],
+  "purpose": {
+    "aim": "Establish the core principles that govern all processing of personal data",
+    "problem": "Unbounded, opaque or excessive processing of personal data",
+    "protectedInterest": "The fundamental right to the protection of personal data",
+    "protectedParty": "The data subject (natural person)",
+    "evidence": "Personal data shall be: processed lawfully, fairly and in a transparent manner",
+    "consensus": {
+      "agree": 3,
+      "reads": 3,
+      "independence": "multi"
+    }
+  },
+  "canonical": {
+    "hashAlgorithm": "sha256",
+    "canonicalization": "json-sorted-keys-v1",
+    "recipe": "1) contentHash: sha256(canonicalize(canonical.content)) must equal seal.contentHash, where canonicalize = JSON with object keys sorted recursively (lexicographic by UTF-16 code unit), no insignificant whitespace, hashed as UTF-8. 2) signatures: each seal.signatures[].signatureHex is an Ed25519 signature by that signer's publicKeyHex over the UTF-8 bytes of the seal.contentHash hex string.",
+    "content": {
+      "atoms": [
+        {
+          "id": "a1",
+          "accion": "process personal data lawfully, fairly and in a transparent manner in relation to the data subject",
+          "status": "fijado",
+          "sujeto": "the controller",
+          "alcance": "for the purposes of this Regulation",
+          "inverse": "the controller may process personal data unlawfully, unfairly or opaquely",
+          "evidence": "Personal data shall be: processed lawfully, fairly and in a transparent manner in relation to the data subject",
+          "condicion": null,
+          "consensus": {
+            "agree": 3,
+            "reads": 3,
+            "independence": "multi"
+          },
+          "excepcion": null,
+          "modalidad": "obligacion",
+          "statement": "the controller — must process personal data lawfully, fairly and in a transparent manner in relation to the data subject."
+        },
+        {
+          "id": "a2",
+          "accion": "limit personal data to what is adequate, relevant and necessary for the purposes for which they are processed",
+          "status": "fijado",
+          "sujeto": "the controller",
+          "alcance": "for the purposes of this Regulation",
+          "inverse": "the controller may collect personal data beyond what is necessary for the purpose",
+          "evidence": "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed",
+          "condicion": null,
+          "consensus": {
+            "agree": 3,
+            "reads": 3,
+            "independence": "multi"
+          },
+          "excepcion": null,
+          "modalidad": "obligacion",
+          "statement": "the controller — must limit personal data to what is adequate, relevant and necessary for the purposes for which they are processed."
+        }
+      ],
+      "domain": "legislation",
+      "purpose": {
+        "evidence": "Personal data shall be: processed lawfully, fairly and in a transparent manner",
+        "problema": "Unbounded, opaque or excessive processing of personal data",
+        "consensus": {
+          "agree": 3,
+          "reads": 3,
+          "independence": "multi"
+        },
+        "finalidad": "Establish the core principles that govern all processing of personal data",
+        "bienJuridico": "The fundamental right to the protection of personal data",
+        "sujetoProtegido": "The data subject (natural person)"
+      },
+      "sourceRef": {
+        "uri": "http://data.europa.eu/eli/reg/2016/679/art_5",
+        "scheme": "eli",
+        "validFrom": "2018-05-25",
+        "validUntil": null,
+        "jurisdiction": "EU"
+      },
+      "legalForce": "official_reference",
+      "articleLabel": "GDPR — Article 5 (Principles relating to processing of personal data) · DEMO",
+      "jurisdiction": "EU"
+    }
+  },
+  "seal": {
+    "contentHash": "d5eba87825e051ac1e2634ca197f36d07843aaf99462dbf669c530947f1b4ba9",
+    "merkleRoot": "3ef510f2cadc7d6a769f0d83a2576d07d4455f370fdaf56233d1ed00b9d01000",
+    "ledgerBlockHash": "1a5348646b242cd206eeac6b6ed68c52b55c326f2e34de4034910ee505f8dd03",
+    "blockIndex": 0,
+    "anchoredBackend": "mock",
+    "anchoredRef": "demo-tx-d5eba87825e0",
+    "anchoredUrl": null,
+    "signatures": [
+      {
+        "signerId": "EU-LEG-parliament",
+        "signerName": "European Parliament · DEMO",
+        "role": "N2_sovereign",
+        "publicKeyHex": "87a00dd91e92fc623f08540140dca4f88d0b2048cca34cb612de5738acb8145c",
+        "signatureHex": "a2db7c0ddf9def43c63986207a3cd019d6be88235f7469e0a582ea90812a47b671e3c7e5e94b2ea8841c21bda61e8440301a0e0671c46141bf3dab33d25b530e",
+        "signedAt": "2026-07-07T10:00:00+00:00"
+      },
+      {
+        "signerId": "EU-LEG-council",
+        "signerName": "Council of the EU · DEMO",
+        "role": "N2_sovereign",
+        "publicKeyHex": "95960c1b509792befdea49870040d856061f88b2f78c8b40363fff4d9b8d36e2",
+        "signatureHex": "5dd05925f2641f6252b8e22c43df8e4a5825bb9bad3d9cf8b19d5a3c8bc009a7b154c4da7f790589640103c20cac89459b55e823ff307113a66edf9dbe950f0b",
+        "signedAt": "2026-07-07T10:00:00+00:00"
+      },
+      {
+        "signerId": "EU-LEG-jurist",
+        "signerName": "Legal reviewer · DEMO",
+        "role": "N1_expert",
+        "publicKeyHex": "25c80d8fa40894c89e31f232cc1dd49bc2bc3b3b1f0e651a0201d569aa6224f4",
+        "signatureHex": "ba4c0837aff57a24984b81345a317da420265f0cf56ec4698900f82ebec39cca269e2d464bf4bdcc3468cc076229852b730df773c85491892040fd992acbe70f",
+        "signedAt": "2026-07-07T10:00:00+00:00"
+      }
+    ]
+  }
+}

grundnorm-0.1.0/tests/test_canonicalize.py

@@ -0,0 +1,28 @@
+import unittest
+
+from grundnorm import canonicalize
+
+
+# These vectors are IDENTICAL to the TypeScript SDK's canonicalize.test.mjs — cross-language parity is
+# the whole point: the same content must produce the same hash on the server, in TS, and in Python.
+class TestCanonicalize(unittest.TestCase):
+    def test_sorts_keys_recursively(self):
+        self.assertEqual(canonicalize({"b": 1, "a": 2}), '{"a":2,"b":1}')
+        self.assertEqual(
+            canonicalize({"z": {"y": 1, "x": 2}, "a": [1, {"c": 3, "b": 4}]}),
+            '{"a":[1,{"b":4,"c":3}],"z":{"x":2,"y":1}}',
+        )
+
+    def test_array_order(self):
+        self.assertEqual(canonicalize([3, 1, 2]), "[3,1,2]")
+
+    def test_primitives_and_escaping(self):
+        self.assertEqual(canonicalize(None), "null")
+        self.assertEqual(canonicalize(True), "true")
+        self.assertEqual(canonicalize(5), "5")
+        self.assertEqual(canonicalize("café"), '"café"')  # non-ASCII is NOT escaped
+        self.assertEqual(canonicalize('a"b\\c'), '"a\\"b\\\\c"')  # quote + backslash escaped
+
+
+if __name__ == "__main__":
+    unittest.main()

grundnorm-0.1.0/tests/test_verify.py

@@ -0,0 +1,42 @@
+import copy
+import json
+import os
+import unittest
+
+from grundnorm import verify
+
+FIXTURE = os.path.join(os.path.dirname(__file__), "fixtures", "gdpr-art5.json")
+
+
+# Fixture = a real sealed record captured from the live endpoint (GDPR Art. 5, demo signers).
+class TestVerify(unittest.TestCase):
+    def setUp(self):
+        with open(FIXTURE, encoding="utf-8") as f:
+            self.norm = json.load(f)
+
+    def test_verifies_real_record(self):
+        v = verify(self.norm)
+        self.assertTrue(v["hash_ok"])
+        self.assertTrue(v["ok"])
+        self.assertGreaterEqual(len(v["signatures"]), 1)
+        self.assertTrue(all(s["ok"] for s in v["signatures"]))
+        self.assertEqual(v["recomputed_hash"], self.norm["seal"]["contentHash"])
+
+    def test_detects_tampered_content(self):
+        t = copy.deepcopy(self.norm)
+        t["canonical"]["content"]["atoms"][0]["statement"] += " TAMPERED"
+        v = verify(t)
+        self.assertFalse(v["hash_ok"])
+        self.assertFalse(v["ok"])
+
+    def test_detects_corrupted_signature(self):
+        t = copy.deepcopy(self.norm)
+        sig = t["seal"]["signatures"][0]["signatureHex"]
+        t["seal"]["signatures"][0]["signatureHex"] = ("1" if sig[0] == "0" else "0") + sig[1:]
+        v = verify(t)
+        self.assertFalse(v["signatures"][0]["ok"])
+        self.assertFalse(v["ok"])
+
+
+if __name__ == "__main__":
+    unittest.main()