headron-software 3.60.1__tar.gz

headron_software-3.60.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 HLIntel LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

headron_software-3.60.1/PKG-INFO

@@ -0,0 +1,224 @@
+Metadata-Version: 2.4
+Name: headron-software
+Version: 3.60.1
+Summary: AI coding-agent verification: tells agents which commands prove a change and fails the build when one was skipped. Polyglot; CLI, MCP server, git hooks, CI.
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/HLIntel/Headron
+Project-URL: Documentation, https://github.com/HLIntel/Headron/blob/main/llms.txt
+Project-URL: Issues, https://github.com/HLIntel/Headron/issues
+Project-URL: Source, https://github.com/HLIntel/Headron
+Project-URL: Agent entry, https://raw.githubusercontent.com/HLIntel/Headron/main/.agent/bootstrap.json
+Project-URL: LLM instructions, https://raw.githubusercontent.com/HLIntel/Headron/main/llms.txt
+Project-URL: Changelog, https://github.com/HLIntel/Headron/blob/main/docs/VERSIONING.md
+Keywords: headron,headron-software,headron-layer-intelligence,hlintel,engineering-atlas,polyglot,contract-verification,policy-as-code,ai-agents,ai-coding-agents,mcp,llm,agent-harness,code-verification,developer-tools,static-analysis,supply-chain-security,claude-code,codex,github-copilot,agents-md
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Testing
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pyyaml<7,>=6.0.3
+Requires-Dist: defusedxml<0.8,>=0.7.1
+Provides-Extra: quality
+Requires-Dist: ruff>=0.6; extra == "quality"
+Provides-Extra: crosscheck
+Requires-Dist: jsonschema>=4; extra == "crosscheck"
+Dynamic: license-file
+
+<!-- AGENTS: do not read this page breadth-first. Plug in: `python scripts/atlas.py port <file>`,
+     or parse .agent/bootstrap.json — one record back. -->
+<!-- mcp-name: io.github.HLIntel/headron -->
+<div align="center">
+  <h1>Headron Software</h1>
+  <img src="docs/media/headron-banner.png"
+       alt="Headron Software Development AI Agents."
+       width="992">
+</div>
+
+<p align="center">
+  <a href="https://github.com/HLIntel/Headron/actions/workflows/atlas-ci.yml"><img
+     src="https://github.com/HLIntel/Headron/actions/workflows/atlas-ci.yml/badge.svg?branch=main"
+     alt="Atlas CI"></a>
+  <a href="https://github.com/HLIntel/Headron/releases/latest"><img
+     src="https://img.shields.io/github/v/tag/HLIntel/Headron?label=contract"
+     alt="contract version"></a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/HLIntel/Headron"><img
+     src="https://api.securityscorecards.dev/projects/github.com/HLIntel/Headron/badge"
+     alt="OpenSSF Scorecard"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT License"></a>
+</p>
+
+<!-- BEGIN generated: headline (python scripts/atlas.py index --write) -->
+
+**Protocol:** a change maps to proof; Headron selects evidence and the build enforces the verdict ([evidence](#what-it-measurably-buys)). Agents: [llms.txt](llms.txt); chats: [CHAT.md](CHAT.md).
+
+<!-- END generated: headline -->
+
+**Start:** [install/use](#quickstart) · [architecture](#where-it-fits) · [enterprise](#enterprise-and-companion-runtimes) · [agents](llms.txt) · [chat](CHAT.md) · [adapters](models/README.md)
+
+## Why this exists
+
+An agent can report a change as done without running a single check. A check that never ran looks
+the same as a check that passed. Headron Software closes that gap:
+
+- **Every change maps to proof.** [`atlas.yaml`](atlas.yaml) lists the checks each kind of file owes,
+  and the gate runs them before the change is called finished.
+- **Refusal happens at commit, for any agent.** A git hook runs the same check-only command whether
+  an autonomous agent, an IDE extension, a chat assistant, or a developer made the commit.
+- **A skipped check is never a pass.** A missing tool is reported as `SKIP` and kept out
+  of the pass count. Gates report `PASS`, `FAIL` or `NOT RUN`.
+
+<!-- BEGIN generated: proof-flow (python scripts/atlas.py index --write) -->
+
+<p align="center">
+  <img src="docs/media/headron-proof-flow.svg" width="900"
+       alt="Headron Architecture: contract, targeted evidence, integrity audit, unified verdict.">
+</p>
+
+<!-- END generated: proof-flow -->
+
+<!-- BEGIN generated: gate-example (python scripts/atlas.py index --write) -->
+
+```console
+$ headron gate scripts/doctor.py
+1. formatter: ruff format --check scripts/doctor.py
+2. compiler_or_typechecker: python3 -c 'import ast,sys; [ast.parse(open(f, encoding="utf-8").read(), f) for f in sys.argv[1:]]' scripts/doctor.py
+3. unit_tests: pytest
+```
+
+<!-- END generated: gate-example -->
+
+## Quickstart
+
+<!-- BEGIN generated: install (python scripts/atlas.py index --write) -->
+
+```bash
+# editable
+git clone --depth 1 --branch v3.60.1 https://github.com/HLIntel/Headron ~/headron && uv tool install --editable ~/headron && headron doctor
+```
+
+<!-- END generated: install -->
+
+In your repository:
+
+```bash
+cd path/to/your-repo && headron init   # checks, universal multi-agent wiring, first run
+headron verify && headron report          # after a change: verdicts, then what is unverified
+```
+
+With an impact map, `headron verify --changed` runs planted groups with moved dependencies or no record.
+It speeds feedback; `headron verify` remains the final verdict.
+
+Agents reach Headron Software through Headron MCP; the current `headron-mcp` command is read-only.
+Enterprise execution gates and host approval hooks live in the companion runtime (HeadronOS).
+No-shell chat: [CHAT.md](CHAT.md). Add Headron Software to another repository:
+[CONSUMING](docs/CONSUMING.md).
+
+## Where it fits
+
+- **Any agent or runtime.** One sovereign contract across all agent architectures (Google Antigravity,
+  Claude Code, Cursor, OpenAI Codex, OpenHands, Windsurf, Hermes, or bare CLI). The adapters in
+  [models/README.md](models/README.md) keep native tools intact while enforcing identical deterministic boundaries.
+- **Any repository.** `headron init` wires a repository in one step. Consumers add the reusable CI
+  workflow from [CONSUMING](docs/CONSUMING.md) so the verdict on a laptop and in CI is the same command.
+- **Any language we route.** Each language × check pair is either answered by a command or declared
+  as having no tool, so an unanswered pair cannot hide.
+
+## Enterprise and companion runtimes
+
+Headron Software is the core product of HLIntel (Headron Layer Intelligence):
+
+- **HeadronOS:** desktop workspace and local runtime.
+- **Headron Web:** browser interface.
+- **Headron Enterprise:** organizational offering across desktop and web.
+- **Headron MCP:** integration connecting agents and developer tools.
+- **HL.Verify:** shared verification capability.
+  - *Rules & Gates:* File-targeted proof obligations and pre-commit enforcers.
+  - *Failure Ledger:* Past agent failure catalog and regression seeds.
+- **Mind API:** shared orchestration interface.
+
+[Companion details](docs/CONSUMING.md#optional-hlintel-services). Product integration remains unproven.
+
+<!-- BEGIN generated: port-example (python scripts/atlas.py index --write) -->
+
+```console
+$ headron port scripts/doctor.py --line
+◉ scripts/doctor.py │ ⠟backend │ python │ ⌂scripts │ ✓3 │ ⚠1 │ → headron gate scripts/doctor.py
+$ headron port scripts --line
+◎ scripts │ ⠟158 │ ⌂scripts │ → headron brainstorm
+$ headron port . --line
+○ . │ ⠟187 ⠁4 ⠿4 │ → headron check
+```
+
+<!-- END generated: port-example -->
+
+## What it measurably buys
+
+What the recorded instruments have caught in real runs. They prove routing and refusals, not end-to-end task success
+([limits](docs/CERTIFICATION.md#what-the-numbers-do-not-prove)).
+
+<!-- BEGIN generated: measured-benefits (python scripts/atlas.py index --write) -->
+
+**Failures caught**
+
+- **31/31** planted breaks refused at commit, across 20 of 40 languages. 20 more have an example its toolchain has not run; 0 have none yet (`enforce.py` v3.60.0).
+- **694** mistake kinds planted in the tests, each refused.
+- **122** failure shapes recorded from real runs: 209 sightings, 47 recurred, 99 now guarded, 23 host-only (3 of them recurred).
+- **1076** refusals in daily use (37 shapes, 654 re-fired). Verify: 39 passed and 187 failed, of 485 runs. 112 of 115 lands armed; 701 lessons shown (`agents.py --field` v3.59.0).
+- **24/24** solo commits clean with or without the hook; a planted broken commit is refused.
+- **6** agent controls block, never warn: narrow_tools, sandbox, budget, approval, effects, audit.
+
+**Cost**
+
+- **1,729** tokens read before routing; 196 more documents (668 KiB) load only when a route names one.
+- **89%** fewer tokens than pasting every tool list; 50% fewer than blind.
+- **10 KiB** install: 1 module, 2 dependency — 8 in total with its own dependencies.
+
+**Coverage**
+
+- **360** language × check pairs (40 × 9), all answered: 144 by a command, 216 by a declared _no tool_, 0 silent.
+
+<!-- END generated: measured-benefits -->
+
+## Agent contract
+
+- **Discover:** `headron find <query>` for instant search (symbols, prefix, acronym, pointers); `headron sweep` for tier and shard topology.
+- **Route:** `headron port <file>`, or parse [.agent/bootstrap.json](.agent/bootstrap.json); load only its names.
+- **Orchestrate:** `headron mind --route <file>` for System 1 reflex vs System 2 deliberate execution; `headron mind --receipts` for verified audit trails.
+- **Automate:** add `--json`; records follow [the output schema](tools/atlas-output.schema.json).
+- **Before shell:** `headron shell --json "<cmd>"`; exit 3 means its verdict would be misread.
+- **Land:** `python scripts/branchstate.py --land`; check `headron landed <branch>` before deletion.
+- **Judge and report:** use the [judgment rungs](docs/systems/AGENT-HARNESS.md#judgment-rungs); file breaks with the [`headron` skill](skills/headron/SKILL.md).
+
+## Counts, computed
+
+Generated on every build; `check` refuses drift. Machine-readable: [.agent/facts.json](.agent/facts.json).
+
+<!-- BEGIN generated: repository-facts (python scripts/atlas.py index --write) -->
+
+- **388** tool entries — across 40 manifests and 5 kinds, validated against `tools/tools.schema.json`
+- **352** agreement edges — each a file tied to the declaration it answers for
+- **94** instruments — each stating what it proves, what it does not, and what closes the gap
+- **7** change classes — and 13 task profiles, in `atlas.yaml`
+- **156** harness Python files — every one held by `lint` · `format` · `typecheck`
+- **3.60.1** contract version — `VERSION`, asserted in 8 other files
+
+<!-- END generated: repository-facts -->
+
+## Find your way
+
+- **Every document:** [docs index](docs/INDEX.md) · [wiki](docs/wiki/README.md)
+- **Languages:** [atlas](languages/ATLAS.md) · [routing](docs/wiki/CODE-ROUTING.md) · [verification](docs/VERIFY.md)
+- **Agents:** [harness](docs/systems/AGENT-HARNESS.md) · [`.headron`](docs/HEADRON-LANGUAGE.md) · [runtimes](models/README.md)
+- **Why a rule:** `headron why` · `headron failures` · [instruments](docs/INSTRUMENTS.md)
+- **Security:** [policy](SECURITY.md) · [OpenSSF](docs/OPENSSF.md) · [contributing](CONTRIBUTING.md)
+
+## Project
+
+Version tracks the **contract**, not content ([versioning](docs/VERSIONING.md)).
+Built by **HLIntel LLC**, public on purpose ([about](ABOUT.md)). Contributions pass `headron verify`. [MIT License](LICENSE).
+
+Updated: contract v3.60.1

headron_software-3.60.1/README.md

@@ -0,0 +1,194 @@
+<!-- AGENTS: do not read this page breadth-first. Plug in: `python scripts/atlas.py port <file>`,
+     or parse .agent/bootstrap.json — one record back. -->
+<!-- mcp-name: io.github.HLIntel/headron -->
+<div align="center">
+  <h1>Headron Software</h1>
+  <img src="docs/media/headron-banner.png"
+       alt="Headron Software Development AI Agents."
+       width="992">
+</div>
+
+<p align="center">
+  <a href="https://github.com/HLIntel/Headron/actions/workflows/atlas-ci.yml"><img
+     src="https://github.com/HLIntel/Headron/actions/workflows/atlas-ci.yml/badge.svg?branch=main"
+     alt="Atlas CI"></a>
+  <a href="https://github.com/HLIntel/Headron/releases/latest"><img
+     src="https://img.shields.io/github/v/tag/HLIntel/Headron?label=contract"
+     alt="contract version"></a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/HLIntel/Headron"><img
+     src="https://api.securityscorecards.dev/projects/github.com/HLIntel/Headron/badge"
+     alt="OpenSSF Scorecard"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT License"></a>
+</p>
+
+<!-- BEGIN generated: headline (python scripts/atlas.py index --write) -->
+
+**Protocol:** a change maps to proof; Headron selects evidence and the build enforces the verdict ([evidence](#what-it-measurably-buys)). Agents: [llms.txt](llms.txt); chats: [CHAT.md](CHAT.md).
+
+<!-- END generated: headline -->
+
+**Start:** [install/use](#quickstart) · [architecture](#where-it-fits) · [enterprise](#enterprise-and-companion-runtimes) · [agents](llms.txt) · [chat](CHAT.md) · [adapters](models/README.md)
+
+## Why this exists
+
+An agent can report a change as done without running a single check. A check that never ran looks
+the same as a check that passed. Headron Software closes that gap:
+
+- **Every change maps to proof.** [`atlas.yaml`](atlas.yaml) lists the checks each kind of file owes,
+  and the gate runs them before the change is called finished.
+- **Refusal happens at commit, for any agent.** A git hook runs the same check-only command whether
+  an autonomous agent, an IDE extension, a chat assistant, or a developer made the commit.
+- **A skipped check is never a pass.** A missing tool is reported as `SKIP` and kept out
+  of the pass count. Gates report `PASS`, `FAIL` or `NOT RUN`.
+
+<!-- BEGIN generated: proof-flow (python scripts/atlas.py index --write) -->
+
+<p align="center">
+  <img src="docs/media/headron-proof-flow.svg" width="900"
+       alt="Headron Architecture: contract, targeted evidence, integrity audit, unified verdict.">
+</p>
+
+<!-- END generated: proof-flow -->
+
+<!-- BEGIN generated: gate-example (python scripts/atlas.py index --write) -->
+
+```console
+$ headron gate scripts/doctor.py
+1. formatter: ruff format --check scripts/doctor.py
+2. compiler_or_typechecker: python3 -c 'import ast,sys; [ast.parse(open(f, encoding="utf-8").read(), f) for f in sys.argv[1:]]' scripts/doctor.py
+3. unit_tests: pytest
+```
+
+<!-- END generated: gate-example -->
+
+## Quickstart
+
+<!-- BEGIN generated: install (python scripts/atlas.py index --write) -->
+
+```bash
+# editable
+git clone --depth 1 --branch v3.60.1 https://github.com/HLIntel/Headron ~/headron && uv tool install --editable ~/headron && headron doctor
+```
+
+<!-- END generated: install -->
+
+In your repository:
+
+```bash
+cd path/to/your-repo && headron init   # checks, universal multi-agent wiring, first run
+headron verify && headron report          # after a change: verdicts, then what is unverified
+```
+
+With an impact map, `headron verify --changed` runs planted groups with moved dependencies or no record.
+It speeds feedback; `headron verify` remains the final verdict.
+
+Agents reach Headron Software through Headron MCP; the current `headron-mcp` command is read-only.
+Enterprise execution gates and host approval hooks live in the companion runtime (HeadronOS).
+No-shell chat: [CHAT.md](CHAT.md). Add Headron Software to another repository:
+[CONSUMING](docs/CONSUMING.md).
+
+## Where it fits
+
+- **Any agent or runtime.** One sovereign contract across all agent architectures (Google Antigravity,
+  Claude Code, Cursor, OpenAI Codex, OpenHands, Windsurf, Hermes, or bare CLI). The adapters in
+  [models/README.md](models/README.md) keep native tools intact while enforcing identical deterministic boundaries.
+- **Any repository.** `headron init` wires a repository in one step. Consumers add the reusable CI
+  workflow from [CONSUMING](docs/CONSUMING.md) so the verdict on a laptop and in CI is the same command.
+- **Any language we route.** Each language × check pair is either answered by a command or declared
+  as having no tool, so an unanswered pair cannot hide.
+
+## Enterprise and companion runtimes
+
+Headron Software is the core product of HLIntel (Headron Layer Intelligence):
+
+- **HeadronOS:** desktop workspace and local runtime.
+- **Headron Web:** browser interface.
+- **Headron Enterprise:** organizational offering across desktop and web.
+- **Headron MCP:** integration connecting agents and developer tools.
+- **HL.Verify:** shared verification capability.
+  - *Rules & Gates:* File-targeted proof obligations and pre-commit enforcers.
+  - *Failure Ledger:* Past agent failure catalog and regression seeds.
+- **Mind API:** shared orchestration interface.
+
+[Companion details](docs/CONSUMING.md#optional-hlintel-services). Product integration remains unproven.
+
+<!-- BEGIN generated: port-example (python scripts/atlas.py index --write) -->
+
+```console
+$ headron port scripts/doctor.py --line
+◉ scripts/doctor.py │ ⠟backend │ python │ ⌂scripts │ ✓3 │ ⚠1 │ → headron gate scripts/doctor.py
+$ headron port scripts --line
+◎ scripts │ ⠟158 │ ⌂scripts │ → headron brainstorm
+$ headron port . --line
+○ . │ ⠟187 ⠁4 ⠿4 │ → headron check
+```
+
+<!-- END generated: port-example -->
+
+## What it measurably buys
+
+What the recorded instruments have caught in real runs. They prove routing and refusals, not end-to-end task success
+([limits](docs/CERTIFICATION.md#what-the-numbers-do-not-prove)).
+
+<!-- BEGIN generated: measured-benefits (python scripts/atlas.py index --write) -->
+
+**Failures caught**
+
+- **31/31** planted breaks refused at commit, across 20 of 40 languages. 20 more have an example its toolchain has not run; 0 have none yet (`enforce.py` v3.60.0).
+- **694** mistake kinds planted in the tests, each refused.
+- **122** failure shapes recorded from real runs: 209 sightings, 47 recurred, 99 now guarded, 23 host-only (3 of them recurred).
+- **1076** refusals in daily use (37 shapes, 654 re-fired). Verify: 39 passed and 187 failed, of 485 runs. 112 of 115 lands armed; 701 lessons shown (`agents.py --field` v3.59.0).
+- **24/24** solo commits clean with or without the hook; a planted broken commit is refused.
+- **6** agent controls block, never warn: narrow_tools, sandbox, budget, approval, effects, audit.
+
+**Cost**
+
+- **1,729** tokens read before routing; 196 more documents (668 KiB) load only when a route names one.
+- **89%** fewer tokens than pasting every tool list; 50% fewer than blind.
+- **10 KiB** install: 1 module, 2 dependency — 8 in total with its own dependencies.
+
+**Coverage**
+
+- **360** language × check pairs (40 × 9), all answered: 144 by a command, 216 by a declared _no tool_, 0 silent.
+
+<!-- END generated: measured-benefits -->
+
+## Agent contract
+
+- **Discover:** `headron find <query>` for instant search (symbols, prefix, acronym, pointers); `headron sweep` for tier and shard topology.
+- **Route:** `headron port <file>`, or parse [.agent/bootstrap.json](.agent/bootstrap.json); load only its names.
+- **Orchestrate:** `headron mind --route <file>` for System 1 reflex vs System 2 deliberate execution; `headron mind --receipts` for verified audit trails.
+- **Automate:** add `--json`; records follow [the output schema](tools/atlas-output.schema.json).
+- **Before shell:** `headron shell --json "<cmd>"`; exit 3 means its verdict would be misread.
+- **Land:** `python scripts/branchstate.py --land`; check `headron landed <branch>` before deletion.
+- **Judge and report:** use the [judgment rungs](docs/systems/AGENT-HARNESS.md#judgment-rungs); file breaks with the [`headron` skill](skills/headron/SKILL.md).
+
+## Counts, computed
+
+Generated on every build; `check` refuses drift. Machine-readable: [.agent/facts.json](.agent/facts.json).
+
+<!-- BEGIN generated: repository-facts (python scripts/atlas.py index --write) -->
+
+- **388** tool entries — across 40 manifests and 5 kinds, validated against `tools/tools.schema.json`
+- **352** agreement edges — each a file tied to the declaration it answers for
+- **94** instruments — each stating what it proves, what it does not, and what closes the gap
+- **7** change classes — and 13 task profiles, in `atlas.yaml`
+- **156** harness Python files — every one held by `lint` · `format` · `typecheck`
+- **3.60.1** contract version — `VERSION`, asserted in 8 other files
+
+<!-- END generated: repository-facts -->
+
+## Find your way
+
+- **Every document:** [docs index](docs/INDEX.md) · [wiki](docs/wiki/README.md)
+- **Languages:** [atlas](languages/ATLAS.md) · [routing](docs/wiki/CODE-ROUTING.md) · [verification](docs/VERIFY.md)
+- **Agents:** [harness](docs/systems/AGENT-HARNESS.md) · [`.headron`](docs/HEADRON-LANGUAGE.md) · [runtimes](models/README.md)
+- **Why a rule:** `headron why` · `headron failures` · [instruments](docs/INSTRUMENTS.md)
+- **Security:** [policy](SECURITY.md) · [OpenSSF](docs/OPENSSF.md) · [contributing](CONTRIBUTING.md)
+
+## Project
+
+Version tracks the **contract**, not content ([versioning](docs/VERSIONING.md)).
+Built by **HLIntel LLC**, public on purpose ([about](ABOUT.md)). Contributions pass `headron verify`. [MIT License](LICENSE).
+
+Updated: contract v3.60.1

headron_software-3.60.1/VERSION

@@ -0,0 +1 @@
+3.60.1

headron_software-3.60.1/pyproject.toml

@@ -0,0 +1,171 @@
+# Headron — Python project declaration.
+#
+# WHY THIS FILE EXISTS (added at contract v1.2.0). `.ruff_cache/` and `.pytest_cache/` were already at the repo
+# root: ruff and pytest have been RUN here for some time while nothing declared them, nothing
+# configured them, and no gate enforced them. That is an undeclared habit, and an undeclared habit
+# is the thing that silently changes. This file declares exactly what is true and REFUSES to
+# declare what is not — because a config that names a gate nobody runs is the same skeleton this
+# repo exists to prevent.
+#
+# MEASURED BEFORE WRITING ANY OF IT (instrument: `ruff check . --show-files`, `ruff format --check`,
+# `python3 -m pytest -q`, all run at v1.2.0):
+#   - ruff saw exactly SIX Python files then; re-measured at v1.3.0 after the harness was
+#     split into modules, it sees 8. The count is not typed into a document: README's
+#     generated facts block computes it from scripts/*.py on every run.
+#   - `ruff check .` -> All checks passed, exit 0. Safe to enforce at that version, and enforced since.
+#   - `ruff format --check` -> enforced at 3.50.0, after one reviewed reformat; see [tool.ruff.format].
+#   - `python3 -m pytest -q` -> "no tests ran". Not adopted; see [tool.pytest] below.
+
+# THIS FILE DESCRIBES THE HARNESS, NOT THE REPOSITORY.
+# The atlas is polyglot and is not a Python project; Python is simply what the contract
+# harness happens to be written in. A `pyproject.toml` at the root of a polyglot repository reads
+# as "this is a Python package" to both humans and tooling, so the name says otherwise explicitly.
+# The languages themselves declare their own authority in languages/<lang>/tools.yaml — that is
+# the roster, and it is not Python-shaped. Only the harness CLI installs (see [project.scripts]); the atlas is pointed at.
+
+[project]
+name = "headron-software"                # 3.53.0: the index name a stranger types; formerly headron-harness
+dynamic = ["version"]                 # READ FROM VERSION, never typed here: a second declaration goes
+                                      # stale first. The installed version is the release tag the CLI
+                                      # fetches its atlas from when no root is declared.
+description = "AI coding-agent verification: tells agents which commands prove a change and fails the build when one was skipped. Polyglot; CLI, MCP server, git hooks, CI."
+readme = "README.md"                   # the PyPI page; carries the registry ownership marker (server.json)
+license = "MIT"
+requires-python = ">=3.11"
+dependencies = ["pyyaml>=6.0.3,<7", "defusedxml>=0.7.1,<0.8"]  # runtime deps, mirrored from scripts/requirements.txt
+keywords = ["headron", "headron-software", "headron-layer-intelligence", "hlintel",
+            "engineering-atlas", "polyglot", "contract-verification", "policy-as-code", "ai-agents",
+            "ai-coding-agents", "mcp", "llm", "agent-harness", "code-verification", "developer-tools",
+            "static-analysis", "supply-chain-security", "claude-code", "codex", "github-copilot", "agents-md"]
+classifiers = ["Development Status :: 4 - Beta", "Intended Audience :: Developers",
+               "Programming Language :: Python :: 3", "Topic :: Software Development :: Quality Assurance",
+               "Topic :: Software Development :: Testing", "Topic :: Scientific/Engineering :: Artificial Intelligence"]
+
+# FOUND FROM AN INSTALL. Before 2.28.0 an installed package named no link at all, so an agent
+# handed only `pip show` had no route back to the atlas, its entry or its instructions.
+[project.urls]
+Homepage = "https://github.com/HLIntel/Headron"
+Documentation = "https://github.com/HLIntel/Headron/blob/main/llms.txt"
+Issues = "https://github.com/HLIntel/Headron/issues"
+Source = "https://github.com/HLIntel/Headron"
+"Agent entry" = "https://raw.githubusercontent.com/HLIntel/Headron/main/.agent/bootstrap.json"
+"LLM instructions" = "https://raw.githubusercontent.com/HLIntel/Headron/main/llms.txt"
+Changelog = "https://github.com/HLIntel/Headron/blob/main/docs/VERSIONING.md"
+
+[project.optional-dependencies]
+quality = ["ruff>=0.6"]
+crosscheck = ["jsonschema>=4"]       # optional: the reference validator atlas_test and doctor use when present
+
+# THE HARNESS IS INSTALLABLE; THE ATLAS IS POINTED AT. This is the whole external interface, and
+# the split is deliberate. Shipping the policy content inside the wheel would create a second copy
+# that ages exactly like a vendored tree — so the CLI resolves WHICH atlas it is running against
+# (--atlas-root, HEADRON_ROOT, or a pinned `atlas: root:` in a consumer's .atlas.yaml) and PRINTS
+# the rule that decided it. An explicit pin and a lucky fall-through are the same answer with very
+# different trust, and `atlas --where` is how a consumer tells them apart.
+[project.scripts]
+headron = "atlas_cli:main"
+headron-mcp = "atlas_cli:mcp_main"   # Headron's commands as MCP tools on stdio, read-only
+atlas = "atlas_cli:main"   # the pre-3.7 name, still answered
+
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.dynamic]
+version = {file = "VERSION"}
+
+[tool.setuptools]
+package-dir = {"" = "scripts"}
+# WHAT SHIPS: THE LAUNCHER, AND NOTHING THE ATLAS ALREADY HOLDS (3.7.0). Eleven harness modules used
+# to ship, and `atlas check` then died in an install with "No module named 'identity'": the wheel
+# carried a SECOND COPY of the harness, one version old or new against the pinned atlas it ran on,
+# and missing whatever the check needed next. The launcher now resolves the atlas and runs THAT
+# atlas's own scripts/, so a consumer's pinned ref governs the code as well as the data, and there
+# is no roster of shipped modules left to drift. `atlas.py check` refuses any module added here.
+py-modules = ["atlas_cli"]
+
+[tool.ruff]
+# benchmarks/agent holds DELIBERATELY broken task fixtures (a planted bug, a planted format fault): an agent
+# is scored on fixing them, so linting them would fail the tree for doing its job.
+extend-exclude = ["benchmarks/agent"]
+# AN EXPLICIT PATH STILL OBEYS THE EXCLUDES (3.50.0): `ruff format scripts/atlasgen.py` reflowed an
+# excluded file past the line cap, because ruff only applies excludes to paths it discovers.
+force-exclude = true
+# The harness and the Python examples. `languages/` holds prose and manifests, not a package.
+include = ["scripts/*.py", "examples/**/*.py"]
+line-length = 120                     # matches .editorconfig; column width is a rule of thumb, never a
+                                      # gate — see docs/ENGINEERING-CONCEPTS.md
+
+[tool.ruff.lint]
+# ENFORCED, because it passed clean on the real tree at the version it was added (exit 0, zero
+# findings), and the sweep is re-run on every change. A guard that
+# fires on correct code gets disabled, so nothing is enabled here that this repo does not already
+# satisfy. Widen deliberately, one rule family at a time, each with a clean sweep before it lands.
+select = ["E", "F", "I",              # pycodestyle errors, pyflakes, import sorting
+          # 2.28.0, each measured at ZERO findings first: comprehension idioms, a collapsed nested
+          # if, a returned condition, an any/all loop, a ternary over an if-block, and no else
+          # after return/raise/continue — guard clauses. PERF401 was measured too and REJECTED:
+          # 31 error-collecting loops with no safe fix, whose messages would hide in generators.
+          "C4", "SIM102", "SIM103", "SIM108", "SIM110", "RET505", "RET506", "RET508"]
+ignore = ["E501"]                     # line length is governed by line-length above, not by a lint error
+
+[tool.ruff.lint.isort]
+split-on-trailing-comma = false   # agrees with format.skip-magic-trailing-comma
+
+[tool.ruff.lint.per-file-ignores]
+# E402 is WRONG here, and the exemption carries its reason inline rather than being a snooze button.
+# atlas_test.py must `sys.path.insert(0, ROOT/"scripts")` BEFORE `import atlas`, because the module
+# it tests is not installed — you cannot import from a directory that is not yet on the path. Moving
+# that import to the top, as the rule asks, breaks the harness. Scoped to the one file so the rule
+# keeps protecting every other file.
+"scripts/atlas_test.py" = ["E402"]
+# Same reason, same shape: agent_test.py imports the three agent modules after putting
+# scripts/ on the path, because they are not installed either. Two files, one reason,
+# both scoped — never a repository-wide disable of a rule that is right everywhere else.
+"scripts/agent_test.py" = ["E402"]
+
+[tool.ruff.format]
+# ENFORCED: CI runs `ruff format --check .`; the reformat landed as ONE commit, listed in
+# .git-blame-ignore-revs so blame skips it. The exclusions below are files that formatting
+# would push past the code_shape line cap; the cap is never raised, so each leaves this list
+# only when a split brings it back under. The list only shrinks.
+exclude = [
+    "scripts/agent_test.py",
+    "scripts/agentpolicy.py",
+    "scripts/atlas.py",
+    "scripts/atlas_guards_test.py",
+    "scripts/atlas_rules_test.py",
+    "scripts/atlas_test.py",
+    "scripts/atlasgen.py",
+    "scripts/atlasinv.py",
+    "scripts/knowledge.py",
+]
+quote-style = "double"
+skip-magic-trailing-comma = true
+
+# [tool.pytest.ini_options] IS DELIBERATELY ABSENT.
+# A bare `python3 -m pytest -q` here would collect only the planted failing tests under
+# benchmarks/agent/ and read as broken code; the root conftest.py refuses it (exit 4) and names the
+# real commands. A path on the command line still runs that fixture. The contract's mutation tests
+# are a custom harness run directly:
+#
+#     python3 scripts/atlas_test.py     -> "atlas tests: N/N pass" with N asserted, exit 0
+#
+# declared in that file's own docblock and wired into .github/workflows/atlas-ci.yml. Declaring a
+# pytest section now would add a second, empty test surface whose green exit means nothing. When a
+# real pytest suite exists, configure it here and give it a failing case first.
+
+[tool.basedpyright]
+# THE PACK'S DECLARED TYPE CHECKER, RUN ON ITS OWN TREE (3.54.0): gate `typecheck`. Standard mode, the
+# same files the lint gate reads plus fuzz/. Zero errors, no baseline: fix the type, never silence it.
+include = ["scripts", "examples", "fuzz", "benchmarks"]
+pythonVersion = "3.12"
+typeCheckingMode = "standard"
+reportMissingModuleSource = false
+executionEnvironments = [
+    { root = "examples/python", extraPaths = ["examples/python", "scripts"] },
+    { root = "examples/webhooks", extraPaths = ["examples/webhooks", "scripts"] },
+    { root = "fuzz", extraPaths = ["fuzz", "scripts"] },
+    { root = "scripts", extraPaths = ["scripts"] },
+    { root = "benchmarks/agent/ratelimit", extraPaths = ["benchmarks/agent/ratelimit", "scripts"] },
+]

headron_software-3.60.1/scripts/atlas_cli.py

@@ -0,0 +1,240 @@
+#!/usr/bin/env python3
+"""Resolve WHICH atlas, then run the contract's CLI against it.
+
+A SEPARATE MODULE (2.11.0) because `atlascore` fixes the root at IMPORT time: this resolves it first,
+exports it, then imports the harness. IT PRINTS THE RULE THAT DECIDED THE ROOT: a flag and a lucky
+fall-through give one answer, trusted unequally. A CONSUMER PINS A REF, NEVER
+`main`, in `.atlas.yaml`: its own diff reviews the pin.
+WITH NO ROOT AND NO CHECKOUT (3.53.0) it fetches its own version's release, sha256-checked; else refuses.
+THAT TREE IS LOCKED (3.54.0): read-only, re-hashed on every run; an edit refuses.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import io
+import os
+import re
+import shutil
+import sys
+import tarfile
+import tempfile
+from pathlib import Path
+
+import yaml
+
+CONSUMER_CONFIG = ".atlas.yaml"
+FLAG = "--atlas-root"
+RELEASES = "https://github.com/HLIntel/Headron/releases/download"
+INSTALLED_FROM = "the checkout this entry point was installed from"
+MARKER = ".headron-release.sha256"  # written last: an unmarked cache is never used
+# REFUSE RATHER THAN INVENT (3.47.0): a key not known by name is refused at its file:line.
+SECTIONS, PIN = ("atlas", "stack_tiers", "markdown_policy"), ("ref", "root", "task", "change_class", "process")
+
+
+class ConfigError(ValueError):
+    """A root flag or consumer config this entry point refuses to guess about."""
+
+
+def _keys(path: Path, node, what: str, allowed=()) -> dict:
+    if not isinstance(node, yaml.MappingNode):
+        raise ConfigError(f"{path}:{node.start_mark.line + 1}: {what} must be a mapping")
+    out = {}
+    for key, value in node.value:
+        name, line = key.value, key.start_mark.line + 1
+        if not isinstance(name, str) or name in out or allowed and name not in allowed:
+            raise ConfigError(f"{path}:{line}: bad or repeated key {name!r} in {what}; allowed: {allowed}")
+        out[name] = value
+    return out
+
+
+def _pin(path: Path) -> dict[str, str]:
+    """The `atlas:` mapping of one config file, every key checked by name."""
+    try:
+        doc = yaml.compose(path.read_text(encoding="utf-8"))
+    except yaml.YAMLError as exc:
+        mark = getattr(exc, "problem_mark", None)
+        raise ConfigError(f"{path}:{mark.line + 1 if mark else 1}: not parseable YAML") from None
+    sections = _keys(path, doc, CONSUMER_CONFIG, SECTIONS) if doc else {}
+    pins = {name: _keys(path, node, name) for name, node in sections.items()}.get("atlas", {})
+    for name, value in pins.items():
+        if name not in PIN or value.tag != "tag:yaml.org,2002:str" or not value.value.strip():
+            raise ConfigError(f"{path}:{value.start_mark.line + 1}: atlas.{name}: want a string in {PIN}")
+    return {name: value.value for name, value in pins.items()}
+
+
+def _config(start: Path) -> tuple[dict, Path | None]:
+    """The pin of the nearest .atlas.yaml at or above `start`; ConfigError on any doubt."""
+    for path in (d / CONSUMER_CONFIG for d in [start, *start.parents]):
+        if path.exists():
+            return _pin(path), path
+    return {}, None
+
+
+def root_flag(argv: list[str]) -> tuple[str | None, int, int]:
+    """(value, index, width) of the root flag, or (None, -1, 0); refused with no value (3.47.0)."""
+    hits = [i for i, arg in enumerate(argv) if arg == FLAG or arg.startswith(FLAG + "=")]
+    if not hits:
+        return None, -1, 0
+    i, eq = hits[0], argv[hits[0]] != FLAG
+    value = argv[i].partition("=")[2] if eq else (argv[i + 1 :] or [""])[0]
+    if len(hits) > 1 or not value.strip() or value.startswith("-") and not eq:
+        raise ConfigError(f"{FLAG} needs one directory, given once; got {value!r}")
+    return value, i, 1 if eq else 2
+
+
+CALLER_ENV = dict(os.environ)
+
+
+def resolve_root(argv: list[str], cwd: Path) -> tuple[Path, str]:
+    """The atlas this invocation runs against, and the rule that decided it. In declared order."""
+    value = root_flag(argv)[0]
+    if value is not None:
+        return Path(value).expanduser().resolve(), f"explicit {FLAG}"
+    for var in ("HEADRON_ROOT", "CODE_DEVELOPMENT_ROOT"):  # the second is the pre-3.0 name
+        if os.environ.get(var):
+            return Path(os.environ[var]).resolve(), f"{var} in the environment"
+    config, where = _config(cwd)
+    if where and config.get("root"):
+        base = (where.parent / config["root"]).resolve()
+        return base, f"root declared in {where.name} (ref {config.get('ref', 'unpinned')})"
+    return Path(__file__).resolve().parents[1], INSTALLED_FROM
+
+
+class FetchError(RuntimeError):
+    """A release atlas refused: unreachable, unverified, or another version."""
+
+
+def _get(url: str) -> bytes:
+    import urllib.request  # noqa: PLC0415
+
+    try:
+        with urllib.request.urlopen(url, timeout=60) as r:  # noqa: S310 — a fixed https base
+            return r.read()
+    except (OSError, ValueError) as exc:
+        raise FetchError(f"cannot download {url}: {exc}") from None
+
+
+def _manifest(tree: Path) -> list[str]:
+    """`sha256sum` lines for every file under `tree` but the marker: `sha256sum -c` re-checks it by hand."""
+    files = sorted(p for p in tree.rglob("*") if p.is_file() and p.name != MARKER)
+    return [f"{hashlib.sha256(p.read_bytes()).hexdigest()}  {p.relative_to(tree).as_posix()}" for p in files]
+
+
+KEPT_RELEASES = 3  # a pruned release re-fetches
+
+
+def _prune_releases(cache: Path) -> None:
+    for mark in sorted(cache.glob(f"atlas-*/{MARKER}"), key=os.path.getmtime)[:-KEPT_RELEASES]:
+        shutil.rmtree(mark.parent, ignore_errors=True)
+    shutil.rmtree(cache / "pycache", ignore_errors=True)  # bytecode: rebuilt on import
+
+
+def release_cache() -> Path:
+    return Path(os.environ.get("XDG_CACHE_HOME") or Path.home() / ".cache", "headron")
+
+
+def fetch_atlas(version: str) -> Path:
+    """Release v<version>'s tree, cached or downloaded and sha256-checked; else FetchError."""
+    dest = release_cache() / f"atlas-{version}"
+    if (dest / MARKER).is_file():
+        changed = set((dest / MARKER).read_text().splitlines()[1:]) ^ set(_manifest(dest))
+        if changed:
+            path = min(changed).partition("  ")[2]
+            raise FetchError(f"{dest}: {path} changed after download; remove {dest} to fetch v{version} again")
+        return dest
+    name = f"headron-v{version}.tar.gz"
+    url = f"{RELEASES}/v{version}/{name}"
+    want = re.findall(
+        rf"^([0-9a-f]{{64}}) [ *]{re.escape(name)}$", _get(url + ".sha256").decode(errors="replace"), re.M
+    )
+    blob = _get(url)
+    if len(want) != 1 or hashlib.sha256(blob).hexdigest() != want[0]:
+        raise FetchError(f"{name}: sha256 is not its release's one digest {want}")
+    dest.parent.mkdir(parents=True, exist_ok=True)
+    work = Path(tempfile.mkdtemp(dir=dest.parent))
+    try:
+        with tarfile.open(fileobj=io.BytesIO(blob)) as tar:
+            tops = {m.name.split("/")[0] for m in tar}
+            tar.extractall(work, filter="data")  # refuses absolute, climbing and escaping links
+        tree = work / tops.pop()
+        if tops or (tree / "VERSION").read_text().strip() != version:
+            raise FetchError(f"{name} is not one tree of contract {version}")
+        (tree / MARKER).write_text("".join(f"{line}\n" for line in [f"{want[0]}  {name}", *_manifest(tree)]))
+        for path in tree.rglob("*"):
+            if path.is_file():
+                path.chmod(path.stat().st_mode & ~0o222)  # read-only, marker too: an edit fails where it is made
+        shutil.rmtree(dest, ignore_errors=True)  # an unmarked, interrupted unpack
+        os.replace(tree, dest)
+        _prune_releases(dest.parent)
+    except (tarfile.TarError, OSError, TypeError) as exc:  # TypeError: no data filter before 3.11.4
+        raise FetchError(f"{name} could not be unpacked: {exc}") from None
+    finally:
+        shutil.rmtree(work, ignore_errors=True)
+    return dest
+
+
+def _resolved(argv: list[str]) -> tuple:
+    try:
+        root, rule = resolve_root(argv, Path.cwd())
+        if rule != INSTALLED_FROM or (root / "atlas.yaml").exists():
+            return root, rule
+        if os.environ.get("HEADRON_NO_FETCH") == "1":
+            return root, rule + "; HEADRON_NO_FETCH=1"
+        from importlib.metadata import version  # noqa: PLC0415
+
+        root = fetch_atlas(version("headron-software"))
+        # Bytecode goes beside the locked tree, never into it, here and in every child process.
+        os.environ["PYTHONPYCACHEPREFIX"] = sys.pycache_prefix = str(root.parent / "pycache")
+        return root, "its own release, sha256-checked and locked"
+    except (ConfigError, FetchError, ImportError) as exc:
+        print(f"refused: {exc}", file=sys.stderr)
+        return None, None
+
+
+def _enter(argv: list[str], script: str) -> tuple:
+    """Resolve, export, put scripts/ first on the path; (None, None) if refused."""
+    root, rule = _resolved(argv)
+    if root is None:
+        return None, None
+    # THE HARNESS COMES FROM THE ATLAS, NEVER THE WHEEL (3.7.0): a bundled copy is a second implementation.
+    if not (root / "atlas.yaml").exists() or not (root / "scripts" / script).exists():
+        hint = f"point at a checkout with {FLAG}, HEADRON_ROOT, or `atlas: root:` in {CONSUMER_CONFIG}"
+        print(f"no atlas with scripts/{script} at {root} (resolved by: {rule})\n{hint}", file=sys.stderr)
+        return None, None
+    os.environ["HEADRON_ROOT"] = os.environ["CODE_DEVELOPMENT_ROOT"] = str(root)
+    sys.path.insert(0, str(root / "scripts"))
+    return root, rule
+
+
+def main(argv: list[str] | None = None) -> int:
+    argv = list(sys.argv[1:] if argv is None else argv)
+    root, rule = _enter(argv, "atlas.py")
+    if root is None:
+        return 2
+    _, index, width = root_flag(argv)
+    del argv[index : index + width]
+    if "--where" in argv:
+        print(f"atlas root: {root}\nresolved by: {rule}")
+        # an agent handed only an install still finds where to start
+        print(f"agent entry: {root / '.agent' / 'bootstrap.json'}  (then: headron gate <file>)")
+        return 0
+    import atlas  # noqa: PLC0415 — deliberate: the root must be exported before this import
+
+    return atlas.main(argv or ["check"])
+
+
+def mcp_main() -> int:
+    """`headron-mcp`: the same root resolution, then serve the resolved atlas's MCP route on stdio."""
+    argv = sys.argv[1:]
+    if "--where" in argv:
+        return main(argv)
+    if _enter(argv, "headron_mcp.py")[0] is None:
+        return 2
+    import headron_mcp  # noqa: PLC0415 — as in main
+
+    return headron_mcp.serve()
+
+
+if __name__ == "__main__":
+    sys.exit(main())

headron_software-3.60.1/scripts/headron_software.egg-info/PKG-INFO

@@ -0,0 +1,224 @@
+Metadata-Version: 2.4
+Name: headron-software
+Version: 3.60.1
+Summary: AI coding-agent verification: tells agents which commands prove a change and fails the build when one was skipped. Polyglot; CLI, MCP server, git hooks, CI.
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/HLIntel/Headron
+Project-URL: Documentation, https://github.com/HLIntel/Headron/blob/main/llms.txt
+Project-URL: Issues, https://github.com/HLIntel/Headron/issues
+Project-URL: Source, https://github.com/HLIntel/Headron
+Project-URL: Agent entry, https://raw.githubusercontent.com/HLIntel/Headron/main/.agent/bootstrap.json
+Project-URL: LLM instructions, https://raw.githubusercontent.com/HLIntel/Headron/main/llms.txt
+Project-URL: Changelog, https://github.com/HLIntel/Headron/blob/main/docs/VERSIONING.md
+Keywords: headron,headron-software,headron-layer-intelligence,hlintel,engineering-atlas,polyglot,contract-verification,policy-as-code,ai-agents,ai-coding-agents,mcp,llm,agent-harness,code-verification,developer-tools,static-analysis,supply-chain-security,claude-code,codex,github-copilot,agents-md
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: Software Development :: Testing
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pyyaml<7,>=6.0.3
+Requires-Dist: defusedxml<0.8,>=0.7.1
+Provides-Extra: quality
+Requires-Dist: ruff>=0.6; extra == "quality"
+Provides-Extra: crosscheck
+Requires-Dist: jsonschema>=4; extra == "crosscheck"
+Dynamic: license-file
+
+<!-- AGENTS: do not read this page breadth-first. Plug in: `python scripts/atlas.py port <file>`,
+     or parse .agent/bootstrap.json — one record back. -->
+<!-- mcp-name: io.github.HLIntel/headron -->
+<div align="center">
+  <h1>Headron Software</h1>
+  <img src="docs/media/headron-banner.png"
+       alt="Headron Software Development AI Agents."
+       width="992">
+</div>
+
+<p align="center">
+  <a href="https://github.com/HLIntel/Headron/actions/workflows/atlas-ci.yml"><img
+     src="https://github.com/HLIntel/Headron/actions/workflows/atlas-ci.yml/badge.svg?branch=main"
+     alt="Atlas CI"></a>
+  <a href="https://github.com/HLIntel/Headron/releases/latest"><img
+     src="https://img.shields.io/github/v/tag/HLIntel/Headron?label=contract"
+     alt="contract version"></a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/HLIntel/Headron"><img
+     src="https://api.securityscorecards.dev/projects/github.com/HLIntel/Headron/badge"
+     alt="OpenSSF Scorecard"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT License"></a>
+</p>
+
+<!-- BEGIN generated: headline (python scripts/atlas.py index --write) -->
+
+**Protocol:** a change maps to proof; Headron selects evidence and the build enforces the verdict ([evidence](#what-it-measurably-buys)). Agents: [llms.txt](llms.txt); chats: [CHAT.md](CHAT.md).
+
+<!-- END generated: headline -->
+
+**Start:** [install/use](#quickstart) · [architecture](#where-it-fits) · [enterprise](#enterprise-and-companion-runtimes) · [agents](llms.txt) · [chat](CHAT.md) · [adapters](models/README.md)
+
+## Why this exists
+
+An agent can report a change as done without running a single check. A check that never ran looks
+the same as a check that passed. Headron Software closes that gap:
+
+- **Every change maps to proof.** [`atlas.yaml`](atlas.yaml) lists the checks each kind of file owes,
+  and the gate runs them before the change is called finished.
+- **Refusal happens at commit, for any agent.** A git hook runs the same check-only command whether
+  an autonomous agent, an IDE extension, a chat assistant, or a developer made the commit.
+- **A skipped check is never a pass.** A missing tool is reported as `SKIP` and kept out
+  of the pass count. Gates report `PASS`, `FAIL` or `NOT RUN`.
+
+<!-- BEGIN generated: proof-flow (python scripts/atlas.py index --write) -->
+
+<p align="center">
+  <img src="docs/media/headron-proof-flow.svg" width="900"
+       alt="Headron Architecture: contract, targeted evidence, integrity audit, unified verdict.">
+</p>
+
+<!-- END generated: proof-flow -->
+
+<!-- BEGIN generated: gate-example (python scripts/atlas.py index --write) -->
+
+```console
+$ headron gate scripts/doctor.py
+1. formatter: ruff format --check scripts/doctor.py
+2. compiler_or_typechecker: python3 -c 'import ast,sys; [ast.parse(open(f, encoding="utf-8").read(), f) for f in sys.argv[1:]]' scripts/doctor.py
+3. unit_tests: pytest
+```
+
+<!-- END generated: gate-example -->
+
+## Quickstart
+
+<!-- BEGIN generated: install (python scripts/atlas.py index --write) -->
+
+```bash
+# editable
+git clone --depth 1 --branch v3.60.1 https://github.com/HLIntel/Headron ~/headron && uv tool install --editable ~/headron && headron doctor
+```
+
+<!-- END generated: install -->
+
+In your repository:
+
+```bash
+cd path/to/your-repo && headron init   # checks, universal multi-agent wiring, first run
+headron verify && headron report          # after a change: verdicts, then what is unverified
+```
+
+With an impact map, `headron verify --changed` runs planted groups with moved dependencies or no record.
+It speeds feedback; `headron verify` remains the final verdict.
+
+Agents reach Headron Software through Headron MCP; the current `headron-mcp` command is read-only.
+Enterprise execution gates and host approval hooks live in the companion runtime (HeadronOS).
+No-shell chat: [CHAT.md](CHAT.md). Add Headron Software to another repository:
+[CONSUMING](docs/CONSUMING.md).
+
+## Where it fits
+
+- **Any agent or runtime.** One sovereign contract across all agent architectures (Google Antigravity,
+  Claude Code, Cursor, OpenAI Codex, OpenHands, Windsurf, Hermes, or bare CLI). The adapters in
+  [models/README.md](models/README.md) keep native tools intact while enforcing identical deterministic boundaries.
+- **Any repository.** `headron init` wires a repository in one step. Consumers add the reusable CI
+  workflow from [CONSUMING](docs/CONSUMING.md) so the verdict on a laptop and in CI is the same command.
+- **Any language we route.** Each language × check pair is either answered by a command or declared
+  as having no tool, so an unanswered pair cannot hide.
+
+## Enterprise and companion runtimes
+
+Headron Software is the core product of HLIntel (Headron Layer Intelligence):
+
+- **HeadronOS:** desktop workspace and local runtime.
+- **Headron Web:** browser interface.
+- **Headron Enterprise:** organizational offering across desktop and web.
+- **Headron MCP:** integration connecting agents and developer tools.
+- **HL.Verify:** shared verification capability.
+  - *Rules & Gates:* File-targeted proof obligations and pre-commit enforcers.
+  - *Failure Ledger:* Past agent failure catalog and regression seeds.
+- **Mind API:** shared orchestration interface.
+
+[Companion details](docs/CONSUMING.md#optional-hlintel-services). Product integration remains unproven.
+
+<!-- BEGIN generated: port-example (python scripts/atlas.py index --write) -->
+
+```console
+$ headron port scripts/doctor.py --line
+◉ scripts/doctor.py │ ⠟backend │ python │ ⌂scripts │ ✓3 │ ⚠1 │ → headron gate scripts/doctor.py
+$ headron port scripts --line
+◎ scripts │ ⠟158 │ ⌂scripts │ → headron brainstorm
+$ headron port . --line
+○ . │ ⠟187 ⠁4 ⠿4 │ → headron check
+```
+
+<!-- END generated: port-example -->
+
+## What it measurably buys
+
+What the recorded instruments have caught in real runs. They prove routing and refusals, not end-to-end task success
+([limits](docs/CERTIFICATION.md#what-the-numbers-do-not-prove)).
+
+<!-- BEGIN generated: measured-benefits (python scripts/atlas.py index --write) -->
+
+**Failures caught**
+
+- **31/31** planted breaks refused at commit, across 20 of 40 languages. 20 more have an example its toolchain has not run; 0 have none yet (`enforce.py` v3.60.0).
+- **694** mistake kinds planted in the tests, each refused.
+- **122** failure shapes recorded from real runs: 209 sightings, 47 recurred, 99 now guarded, 23 host-only (3 of them recurred).
+- **1076** refusals in daily use (37 shapes, 654 re-fired). Verify: 39 passed and 187 failed, of 485 runs. 112 of 115 lands armed; 701 lessons shown (`agents.py --field` v3.59.0).
+- **24/24** solo commits clean with or without the hook; a planted broken commit is refused.
+- **6** agent controls block, never warn: narrow_tools, sandbox, budget, approval, effects, audit.
+
+**Cost**
+
+- **1,729** tokens read before routing; 196 more documents (668 KiB) load only when a route names one.
+- **89%** fewer tokens than pasting every tool list; 50% fewer than blind.
+- **10 KiB** install: 1 module, 2 dependency — 8 in total with its own dependencies.
+
+**Coverage**
+
+- **360** language × check pairs (40 × 9), all answered: 144 by a command, 216 by a declared _no tool_, 0 silent.
+
+<!-- END generated: measured-benefits -->
+
+## Agent contract
+
+- **Discover:** `headron find <query>` for instant search (symbols, prefix, acronym, pointers); `headron sweep` for tier and shard topology.
+- **Route:** `headron port <file>`, or parse [.agent/bootstrap.json](.agent/bootstrap.json); load only its names.
+- **Orchestrate:** `headron mind --route <file>` for System 1 reflex vs System 2 deliberate execution; `headron mind --receipts` for verified audit trails.
+- **Automate:** add `--json`; records follow [the output schema](tools/atlas-output.schema.json).
+- **Before shell:** `headron shell --json "<cmd>"`; exit 3 means its verdict would be misread.
+- **Land:** `python scripts/branchstate.py --land`; check `headron landed <branch>` before deletion.
+- **Judge and report:** use the [judgment rungs](docs/systems/AGENT-HARNESS.md#judgment-rungs); file breaks with the [`headron` skill](skills/headron/SKILL.md).
+
+## Counts, computed
+
+Generated on every build; `check` refuses drift. Machine-readable: [.agent/facts.json](.agent/facts.json).
+
+<!-- BEGIN generated: repository-facts (python scripts/atlas.py index --write) -->
+
+- **388** tool entries — across 40 manifests and 5 kinds, validated against `tools/tools.schema.json`
+- **352** agreement edges — each a file tied to the declaration it answers for
+- **94** instruments — each stating what it proves, what it does not, and what closes the gap
+- **7** change classes — and 13 task profiles, in `atlas.yaml`
+- **156** harness Python files — every one held by `lint` · `format` · `typecheck`
+- **3.60.1** contract version — `VERSION`, asserted in 8 other files
+
+<!-- END generated: repository-facts -->
+
+## Find your way
+
+- **Every document:** [docs index](docs/INDEX.md) · [wiki](docs/wiki/README.md)
+- **Languages:** [atlas](languages/ATLAS.md) · [routing](docs/wiki/CODE-ROUTING.md) · [verification](docs/VERIFY.md)
+- **Agents:** [harness](docs/systems/AGENT-HARNESS.md) · [`.headron`](docs/HEADRON-LANGUAGE.md) · [runtimes](models/README.md)
+- **Why a rule:** `headron why` · `headron failures` · [instruments](docs/INSTRUMENTS.md)
+- **Security:** [policy](SECURITY.md) · [OpenSSF](docs/OPENSSF.md) · [contributing](CONTRIBUTING.md)
+
+## Project
+
+Version tracks the **contract**, not content ([versioning](docs/VERSIONING.md)).
+Built by **HLIntel LLC**, public on purpose ([about](ABOUT.md)). Contributions pass `headron verify`. [MIT License](LICENSE).
+
+Updated: contract v3.60.1

headron_software-3.60.1/scripts/headron_software.egg-info/SOURCES.txt

@@ -0,0 +1,11 @@
+LICENSE
+README.md
+VERSION
+pyproject.toml
+scripts/atlas_cli.py
+scripts/headron_software.egg-info/PKG-INFO
+scripts/headron_software.egg-info/SOURCES.txt
+scripts/headron_software.egg-info/dependency_links.txt
+scripts/headron_software.egg-info/entry_points.txt
+scripts/headron_software.egg-info/requires.txt
+scripts/headron_software.egg-info/top_level.txt

headron_software-3.60.1/scripts/headron_software.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

headron_software-3.60.1/scripts/headron_software.egg-info/entry_points.txt

@@ -0,0 +1,4 @@
+[console_scripts]
+atlas = atlas_cli:main
+headron = atlas_cli:main
+headron-mcp = atlas_cli:mcp_main

headron_software-3.60.1/scripts/headron_software.egg-info/requires.txt

@@ -0,0 +1,8 @@
+pyyaml<7,>=6.0.3
+defusedxml<0.8,>=0.7.1
+
+[crosscheck]
+jsonschema>=4
+
+[quality]
+ruff>=0.6

headron_software-3.60.1/scripts/headron_software.egg-info/top_level.txt

@@ -0,0 +1 @@
+atlas_cli

headron_software-3.60.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+