hypgraph 0.7.16__tar.gz → 0.7.17__tar.gz

{hypgraph-0.7.16 → hypgraph-0.7.17}/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.7.17 — 2026-10-31: a superseded node can't verify as active
+
+- **A superseded node can't verify as active.** A pre-launch audit of 0.7.16 found that the verifier accepted a node's
+  lifecycle under either the current rule or 0.3's, which counted only an active replacement: in a chain RS3
+  supersedes RS2 supersedes RS1, 0.3 calls RS1 active, so a bundle edited to show RS1 active verified with
+  `views: "checked"`, its chain, rows and head untouched; setting the bundle's `generator` (which the chain doesn't
+  cover) to 0.3 also turned `--standing` from a problem into "not checked". Now, in the Python and browser verifiers
+  alike, a lifecycle is checked against the current rule only. One that matches only 0.3's rule still verifies (a 0.3
+  export shows it so) but the result says `views: "historical"`, not `"checked"`, and the warning names each such node
+  and what the current rule makes it; `hypgraph verify` prints `views: NOT CHECKED`. The generator is never consulted.
+  Covered for `supersedes` and `corrects`, chains of three, withdrawn replacements, scoped bundles and a forged or
+  deleted generator, with the browser verifier held to the same verdict, warning and coverage
+  (`tests/test_verify_lifecycle.py`).
+- **The Explorer and the website speak Spanish, French, German and Simplified Chinese.** The UI's strings are in a
+  table (English, the source, in `hypgraph.js`; translations in `hypgraph.i18n.js`, loaded on demand or registered
+  with `HypGraph.addStrings`). The language comes from `?lang=`, the host page's `lang`, a saved choice, then the
+  browser's, else English; a switcher in the header changes it (`langSwitch: false` hides it in an embed). The main
+  site pages are built in each language under `site/<lang>/` by `dev/build_site.py` from `i18n/site/<lang>.json`,
+  with `hreflang` alternates, a language menu and a note that the English is authoritative. `i18n/glossary.json`
+  fixes how claim, standing, supersedes, withdrawn, head, bundle, scope … are rendered, and the tests hold every
+  table to it (`tests/test_i18n.py`). What the verifier, the engine and the CLI say stays English and byte-identical
+  in Python and JS: agents and audits parse it.
+
 ## 0.7.16 — 2026-10-31: a bundle's scope must be a real one
 
 - **A bundle's scope must be a real one.** A re-audit of 0.7.15 found that `scope.inv`, which the chain doesn't

{hypgraph-0.7.16 → hypgraph-0.7.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hypgraph
-Version: 0.7.16
+Version: 0.7.17
 Summary: The evidence layer for AI research agents: a hash-chained research record that checks every claim as it is written and derives how well each is known.
 Project-URL: Homepage, https://hypgraph.com
 Project-URL: Documentation, https://hypgraph.com/engineers/

{hypgraph-0.7.16 → hypgraph-0.7.17}/docs/PLAN.md

@@ -109,7 +109,7 @@ claim's derived standing.
 Multi-writer sync between graphs (bundles cover sharing), authentication (the host's job; the HTTP server binds to
 loopback and is read-only unless started with `--writable`), and a hosted service.
 
-## Status at 0.7.16 (2026-10-31)
+## Status at 0.7.17 (2026-10-31)
 
 All seven phases are done: the library, bundles, the server and UI, the MCP server, the website, Pegasus running on
 the package, and releases to PyPI from tags with trusted publishing. What came after the plan, by release, is in

{hypgraph-0.7.16 → hypgraph-0.7.17}/docs/RELEASE-READINESS.md

@@ -47,6 +47,17 @@ was taken from a changelog without being checked against the code.*
 > **Where that stands.** #72 is merged with green CI (17 of 17 checks); the suite is 412 passed, and hypswarm and
 > hypmesh pass on it. Released as 0.7.16.
 
+> **Pre-launch audit of 0.7.16 (2026-10-31).** Confirmed and fixed for 0.7.17: the verifier accepted a lifecycle under
+> either the current rule or 0.3's, so the oldest node of a chain of two or more replacements could be shown active
+> and the bundle verified with `views: "checked"`, chain, rows and head untouched; a `generator` set to 0.3 (not
+> covered by the chain) also turned `--standing` into "not checked". A lifecycle is now checked against the current
+> rule only; one that matches only 0.3's verifies with `views: "historical"` and a warning naming each node, in
+> Python and the browser alike, whatever the generator says. Tests: `tests/test_verify_lifecycle.py` (five fail on
+> the 0.7.16 code). The required checks are now all 17 CI jobs, and the repository has its homepage and topics.
+>
+> **Where that stands.** #75 is merged with green CI (17 of 17 checks); from the 0.7.17 wheel in a fresh venv the
+> suite is 424 passed, and hypswarm (118 passed) and hypmesh (37 passed) pass on it. Released as 0.7.17.
+
 ## Recommendation: CONDITIONAL GO
 
 HypGraph is ready for a public developer preview once #59, #60 and #61 are merged with green CI and released as one

{hypgraph-0.7.16 → hypgraph-0.7.17}/src/hypgraph/__init__.py

@@ -16,7 +16,7 @@ Standing is derived on every read, never stored; every write is an event in a SH
 their numbers; reviews pin versions; independence is counted, not assumed. See https://hypgraph.com.
 """
 
-__version__ = "0.7.16"
+__version__ = "0.7.17"
 
 from .bundle import anchored, verify_bundle  # noqa: E402
 from .graph import Author, Graph, GraphError, file_sha256  # noqa: E402

{hypgraph-0.7.16 → hypgraph-0.7.17}/src/hypgraph/bundle.py

@@ -241,13 +241,14 @@ def _verify_bundle(b: dict, policy: dict | None = None) -> dict:
     problem = _scope_problem(b, tables, red)
     if problem:
         return {"ok": False, "problem": problem}
-    problem = _derived_problem(b, tables)
+    historical: list = []
+    problem = _derived_problem(b, tables, historical)
     if problem:
         return {"ok": False, "problem": f"the derived views contradict the verified record: {problem}"}
     out = {"ok": True, "checked": checked, "head": prev, "complete": red == 0, "redacted": red,
            "nodes": len(tables["nodes"]), "edges": len(tables["edges"]), "unchecked": rows["unchecked"],
            "coverage": "complete" if not rows["unchecked"] and not red else "partial",
-           "views": "none" if b.get("derived") is None else "checked",
+           "views": "none" if b.get("derived") is None else "historical" if historical else "checked",
            "policy": {"trusted": sorted(policy or {}), "importer": importer},
            "standing": {"checked": False, "note": STANDING_NOTE}}
     notes = []
@@ -259,11 +260,21 @@ def _verify_bundle(b: dict, policy: dict | None = None) -> dict:
     if stated != importer:
         notes.append(f"The bundle names {stated} as its importer; the chain doesn't cover that, so {importer} was "
                      "used.")
+    if historical:
+        notes.append(_historical_note(historical))
     if notes:
         out["warning"] = " ".join(notes)
     return out
 
 
+def _historical_note(historical: list) -> str:
+    shown = "; ".join(f"{name} shown {s}, the current rule makes it {w}" for name, s, w in historical[:8])
+    more = f"; and {len(historical) - 8} more" if len(historical) > 8 else ""
+    return (f"The views are not checked: {len(historical)} lifecycle(s) follow hypgraph 0.3's rule, not the current "
+            f"one ({shown}{more}). A bundle exported by 0.3 shows them so, but the chain doesn't record which version "
+            "exported a bundle, so this can't be told from an edited view. Go by the current rule.")
+
+
 def _j(v: Any) -> str:
     """A value in a problem, written as the browser's verifier writes it (JSON.stringify)."""
     return json.dumps(v, ensure_ascii=False, separators=(",", ":"))
@@ -316,12 +327,17 @@ def _eid(v: Any) -> int | None:
     return int(v)
 
 
-def _derived_problem(b: dict, tables: dict) -> str:
+def _derived_problem(b: dict, tables: dict, historical: list | None = None) -> str:
     """The derived views are presentation, but a viewer shows them beside a verified chain: every fact in them that
     the rows fix — which investigations there are, which nodes and live links each has, each node's type, code,
     author, time, version, title and lifecycle, each link's ends and fields — must be present and agree with the
     verified rows. A view that leaves a fact out fails: a viewer would fill the gap with a default (a withdrawn claim
-    shown as active). The rest of standing can't be checked this way."""
+    shown as active). The rest of standing can't be checked this way.
+
+    A lifecycle is checked against the current rule only. One that matches only 0.3's rule (the end of a chain of
+    replacements shown active) is no problem — a 0.3 export shows it so — but it isn't checked either: the chain
+    doesn't record which version exported a bundle, so it can't be told from an edited view. Each such node goes on
+    ``historical`` as (name, shown, current), and the bundle's views are reported as historical, not checked."""
     d = b.get("derived")
     if d is None:
         return ""
@@ -373,13 +389,16 @@ def _derived_problem(b: dict, tables: dict) -> str:
         st = x.get("state")
         if not isinstance(st, dict) or "lifecycle" not in st:
             return f"{where} shows {name} without its lifecycle"
-        w = lifecycle(n["id"], True)
-        allowed = {w, lifecycle(n["id"], False)}
-        if scope and n["id"] not in withdrawn:
-            allowed.add("superseded")   # a scoped bundle leaves out links to other investigations: one may replace it
-        if st["lifecycle"] not in allowed:
-            return f"{where} shows {name} as {_j(st['lifecycle'])}; the record makes it {_j(w)}"
-        return ""
+        w, shown = lifecycle(n["id"], True), st["lifecycle"]
+        if shown == w:
+            return ""
+        if scope and n["id"] not in withdrawn and shown == "superseded":
+            return ""   # a scoped bundle leaves out links to other investigations: one may replace it
+        if shown == lifecycle(n["id"], False):
+            if historical is not None and (name, shown, w) not in historical:
+                historical.append((name, shown, w))
+            return ""
+        return f"{where} shows {name} as {_j(shown)}; the record makes it {_j(w)}"
     by_inv = d.get("by_inv")
     if not isinstance(by_inv, dict) or set(by_inv) != invs:
         return "the views don't cover the record's investigations"

{hypgraph-0.7.16 → hypgraph-0.7.17}/src/hypgraph/cli.py

@@ -297,6 +297,8 @@ def cmd_verify(args) -> int:
         text += "\n  coverage: PARTIAL — not every row field is vouched for by its event (see below)"
     if ok and res.get("views") == "none":
         text += "\n  no derived views: exported without them, so a viewer has nothing to show beyond the rows"
+    if ok and res.get("views") == "historical":
+        text += "\n  views: NOT CHECKED — some lifecycles follow hypgraph 0.3's rule, not the current one (see the note)"
     if ok and res.get("unchecked"):
         text += ("\n  not covered (written before events hashed these fields): "
                  + ", ".join(f"{f} ×{n}" for f, n in sorted(res["unchecked"].items())))

{hypgraph-0.7.16 → hypgraph-0.7.17}/src/hypgraph/ui/hypgraph.css

@@ -48,6 +48,7 @@
 .hg .hg-search { display: flex; align-items: center; gap: 8px; width: 260px; padding: 6px 10px; border: 1px solid var(--line);
   border-radius: 8px; background: var(--surface2); color: var(--ink3); cursor: pointer; }
 .hg .hg-search kbd { margin-left: auto; font: 11px var(--mono); padding: 1px 6px; border: 1px solid var(--line2); border-radius: 4px; }
+.hg .hg-lang { padding: 5px 6px; font-size: 12.5px; max-width: 112px; cursor: pointer; }   /* the language menu */
 .hg .btn { border: 1px solid var(--line); background: var(--surface); border-radius: 8px; padding: 6px 10px; cursor: pointer;
   display: inline-flex; gap: 6px; align-items: center; white-space: nowrap; }
 .hg .btn:hover { background: var(--sunken); } .hg .btn:disabled { opacity: .5; cursor: default; background: var(--surface); } .hg .btn.primary { background: var(--accent); border-color: var(--accent); color: #fff; }
@@ -117,6 +118,7 @@
 .hg .note { display: flex; gap: 10px; align-items: flex-start; padding: 9px 14px; border-radius: 9px; margin-bottom: 14px;
   background: var(--accent-soft); color: var(--accent-ink); font-size: 12.5px; }
 .hg .note.warn { background: var(--warn-soft); color: var(--warn); }
+.hg .note[data-exported] { display: block; }                    /* one sentence with inline code: keep it one paragraph */
 
 /* stages and gates */
 .hg .bar { display: flex; gap: 3px; }