hypgraph 0.7.16__tar.gz → 0.7.18__tar.gz

{hypgraph-0.7.16 → hypgraph-0.7.18}/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 0.7.18 — 2026-10-31: a scoped bundle can't call an active node superseded
+
+- **A scoped bundle can't show an active node as superseded and still say its views are checked.** A re-audit of
+  0.7.17 found that a bundle naming a `scope.inv` (which the chain doesn't cover) could show any node, an active claim
+  or the investigation itself, as superseded, and verify against its published head with `views: "checked"` and
+  coverage complete: the verifier let a scoped bundle call any non-withdrawn node superseded, because links from
+  other investigations are left out. Now, in the Python and browser verifiers alike, that allowance applies only
+  when events really are redacted (without them every link is in the bundle, so the lifecycle fails) and only to a
+  type a `supersedes` or `corrects` link can point at (never an investigation or a review), and even then the views
+  are `"unconfirmed"`, not `"checked"`, with a warning naming each node; `hypgraph verify` prints
+  `views: NOT CHECKED`. The Explorer header shows a *views not checked* pill for `historical` and `unconfirmed`
+  views, and the verify page names both instead of calling them checked (`tests/test_verify_scoped_views.py`).
+- **The spec says what a verifier does with lifecycles.** `docs/spec.md` and `docs/verification.md` no longer say a
+  verifier accepts the value either rule gives: the current rule is authoritative, a 0.3-only lifecycle is
+  `historical`, a scoped one superseded from outside is `unconfirmed`, anything else fails.
+
+## 0.7.17 — 2026-10-31: a superseded node can't verify as active
+
+- **A superseded node can't verify as active.** A pre-launch audit of 0.7.16 found that the verifier accepted a node's
+  lifecycle under either the current rule or 0.3's, which counted only an active replacement: in a chain RS3
+  supersedes RS2 supersedes RS1, 0.3 calls RS1 active, so a bundle edited to show RS1 active verified with
+  `views: "checked"`, its chain, rows and head untouched; setting the bundle's `generator` (which the chain doesn't
+  cover) to 0.3 also turned `--standing` from a problem into "not checked". Now, in the Python and browser verifiers
+  alike, a lifecycle is checked against the current rule only. One that matches only 0.3's rule still verifies (a 0.3
+  export shows it so) but the result says `views: "historical"`, not `"checked"`, and the warning names each such node
+  and what the current rule makes it; `hypgraph verify` prints `views: NOT CHECKED`. The generator is never consulted.
+  Covered for `supersedes` and `corrects`, chains of three, withdrawn replacements, scoped bundles and a forged or
+  deleted generator, with the browser verifier held to the same verdict, warning and coverage
+  (`tests/test_verify_lifecycle.py`).
+- **The Explorer and the website speak Spanish, French, German and Simplified Chinese.** The UI's strings are in a
+  table (English, the source, in `hypgraph.js`; translations in `hypgraph.i18n.js`, loaded on demand or registered
+  with `HypGraph.addStrings`). The language comes from `?lang=`, the host page's `lang`, a saved choice, then the
+  browser's, else English; a switcher in the header changes it (`langSwitch: false` hides it in an embed). The main
+  site pages are built in each language under `site/<lang>/` by `dev/build_site.py` from `i18n/site/<lang>.json`,
+  with `hreflang` alternates, a language menu and a note that the English is authoritative. `i18n/glossary.json`
+  fixes how claim, standing, supersedes, withdrawn, head, bundle, scope … are rendered, and the tests hold every
+  table to it (`tests/test_i18n.py`). What the verifier, the engine and the CLI say stays English and byte-identical
+  in Python and JS: agents and audits parse it.
+
 ## 0.7.16 — 2026-10-31: a bundle's scope must be a real one
 
 - **A bundle's scope must be a real one.** A re-audit of 0.7.15 found that `scope.inv`, which the chain doesn't

{hypgraph-0.7.16 → hypgraph-0.7.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hypgraph
-Version: 0.7.16
+Version: 0.7.18
 Summary: The evidence layer for AI research agents: a hash-chained research record that checks every claim as it is written and derives how well each is known.
 Project-URL: Homepage, https://hypgraph.com
 Project-URL: Documentation, https://hypgraph.com/engineers/

{hypgraph-0.7.16 → hypgraph-0.7.18}/docs/PLAN.md

@@ -109,7 +109,7 @@ claim's derived standing.
 Multi-writer sync between graphs (bundles cover sharing), authentication (the host's job; the HTTP server binds to
 loopback and is read-only unless started with `--writable`), and a hosted service.
 
-## Status at 0.7.16 (2026-10-31)
+## Status at 0.7.18 (2026-10-31)
 
 All seven phases are done: the library, bundles, the server and UI, the MCP server, the website, Pegasus running on
 the package, and releases to PyPI from tags with trusted publishing. What came after the plan, by release, is in

{hypgraph-0.7.16 → hypgraph-0.7.18}/docs/RELEASE-READINESS.md

@@ -47,6 +47,29 @@ was taken from a changelog without being checked against the code.*
 > **Where that stands.** #72 is merged with green CI (17 of 17 checks); the suite is 412 passed, and hypswarm and
 > hypmesh pass on it. Released as 0.7.16.
 
+> **Pre-launch audit of 0.7.16 (2026-10-31).** Confirmed and fixed for 0.7.17: the verifier accepted a lifecycle under
+> either the current rule or 0.3's, so the oldest node of a chain of two or more replacements could be shown active
+> and the bundle verified with `views: "checked"`, chain, rows and head untouched; a `generator` set to 0.3 (not
+> covered by the chain) also turned `--standing` into "not checked". A lifecycle is now checked against the current
+> rule only; one that matches only 0.3's verifies with `views: "historical"` and a warning naming each node, in
+> Python and the browser alike, whatever the generator says. Tests: `tests/test_verify_lifecycle.py` (five fail on
+> the 0.7.16 code). The required checks are now all 17 CI jobs, and the repository has its homepage and topics.
+>
+> **Where that stands.** #75 is merged with green CI (17 of 17 checks); from the 0.7.17 wheel in a fresh venv the
+> suite is 424 passed, and hypswarm (118 passed) and hypmesh (37 passed) pass on it. Released as 0.7.17.
+
+> **Re-audit of 0.7.17 (2026-10-31).** Confirmed and fixed for 0.7.18: a bundle naming a `scope.inv` (not covered by
+> the chain) could show any non-withdrawn node, an active claim or the investigation itself, as superseded and verify
+> against its published head with `views: "checked"` and coverage complete; the published Broad Street bundle, which
+> has no redacted events, was enough. The scoped allowance now needs redacted events and a type a `supersedes` /
+> `corrects` link can reach (never an investigation or a review), and even then the views are `"unconfirmed"`, with
+> each node named, in Python and the browser alike. The verify page and the Explorer header now say *views not
+> checked* for `historical` and `unconfirmed` views, and the spec no longer says a verifier accepts either rule.
+> Tests: `tests/test_verify_scoped_views.py`.
+>
+> **Where that stands.** #77 is merged with green CI (17 of 17 checks); from the 0.7.18 wheel in a fresh venv the
+> suite is 431 passed, and hypswarm (118 passed) and hypmesh (37 passed) pass on it. Released as 0.7.18.
+
 ## Recommendation: CONDITIONAL GO
 
 HypGraph is ready for a public developer preview once #59, #60 and #61 are merged with green CI and released as one

{hypgraph-0.7.16 → hypgraph-0.7.18}/docs/spec.md

@@ -153,7 +153,9 @@ out a change hidden among them. `scope.title` is a label; a viewer names the sco
 **What a verifier vouches for.** `ok` means the chain links and every row and event agree, both ways. `coverage:
 complete` means every row field was vouched for by its event and nothing is redacted (`partial` otherwise). `views:
 checked` means every fact the derived views show that the rows fix is present and agrees with the rows, and the
-scope is a real one; `views: none` means the bundle carries no views. None of them vouches for standing, the report,
+scope is a real one; `views: none` means the bundle carries no views. `views: historical` and `views: unconfirmed`
+mean the views verify but some lifecycles in them couldn't be checked (below), and the warning names each one: a
+viewer must not present them as checked. None of them vouches for standing, the report,
 stages or work orders (as exported), for who an author really is, or that the head was published.
 
 **Anchoring.** A bundle proves only its own consistency. To prove it wasn't rebuilt from scratch, publish its `head`
@@ -171,10 +173,16 @@ investigation node), which investigations the list shows (each once), which node
 `by` and `why`. Every one of these must be **present**, not only equal where present: a viewer fills a missing fact
 with a default, and a withdrawn claim without its lifecycle would read as active. The lifecycle is derived from the
 verified rows (withdrawn when a withdrawal exists; superseded when a live `supersedes` or `corrects` replacement is
-active or, since 0.4, itself superseded; an investigation's own `state` otherwise), and a verifier accepts the value
-either rule gives. A scoped bundle leaves out links to other investigations, so it may also call a node superseded
-(never a withdrawn node anything but withdrawn). A bundle exported without derived views verifies, and a verifier says
-it has none (`views: none`). **Standing** (review state, support, at-risk, the sentence) can't
+active or, since 0.4, itself superseded; an investigation's own `state` otherwise). A verifier checks the
+lifecycle against the current rule. A lifecycle that only 0.3's rule gives (it counted an active replacement only)
+verifies, since a 0.3 export shows it so, but the chain doesn't record which version exported a bundle, so the views
+are `historical`, not `checked`. A scoped bundle with redacted events leaves out links from other investigations, and
+one of them may replace a node: a node shown superseded with no replacement in the rows verifies only if its type can
+be replaced at all (every type but `investigation` and `review`) and it isn't withdrawn, and the views are
+`unconfirmed`, since that replacement is among the redacted events. A bundle with no redacted events holds every link,
+scoped or not, so any other lifecycle the rows don't give fails. `scope` isn't covered by the chain, so naming one
+never loosens a check on its own. A bundle exported without derived views verifies, and a verifier says it has none
+(`views: none`). **Standing** (review state, support, at-risk, the sentence) can't
 be checked from the rows alone: it is what the exporting engine derived, and so are the report, the workflow stages,
 completion, the question board and work-order status. A verifier reports them as not checked, or re-derives them with
 the same engine version (`hypgraph verify FILE --standing`, under the caller's policy with `--policy`) and compares.

{hypgraph-0.7.16 → hypgraph-0.7.18}/docs/verification.md

@@ -90,6 +90,11 @@ separate implementation.
   title and lifecycle, each link's ends and fields, the full investigation list — must be present in the derived
   views, not only right where present: a view that drops a withdrawn claim's lifecycle fails, rather than being shown
   as active. A bundle exported without derived views (`export(derived=False)`) verifies and says `views: none`.
+- **A lifecycle that can't be checked isn't called checked.** One only hypgraph 0.3's rule gives verifies with
+  `views: historical`. In a scoped bundle with redacted events, a node shown superseded with no replacement in the
+  rows (a replacement in another investigation would be redacted) verifies with `views: unconfirmed`, and only if its
+  type can be superseded at all; investigations and reviews can't. Without redacted events every link is in the
+  bundle, so such a node fails. The warning names each node; the Explorer and the verify page say *views not checked*.
 
 ## Scoped bundles and references
 

{hypgraph-0.7.16 → hypgraph-0.7.18}/src/hypgraph/__init__.py

@@ -16,7 +16,7 @@ Standing is derived on every read, never stored; every write is an event in a SH
 their numbers; reviews pin versions; independence is counted, not assumed. See https://hypgraph.com.
 """
 
-__version__ = "0.7.16"
+__version__ = "0.7.18"
 
 from .bundle import anchored, verify_bundle  # noqa: E402
 from .graph import Author, Graph, GraphError, file_sha256  # noqa: E402

{hypgraph-0.7.16 → hypgraph-0.7.18}/src/hypgraph/bundle.py

@@ -34,7 +34,7 @@ from pathlib import Path
 from typing import TYPE_CHECKING, Any
 
 from . import __version__
-from .schema import SAME_TYPE
+from .schema import RELS, SAME_TYPE
 from .store import GENESIS, ROW_TABLES, check_rows, event_body, now
 
 if TYPE_CHECKING:
@@ -241,13 +241,16 @@ def _verify_bundle(b: dict, policy: dict | None = None) -> dict:
     problem = _scope_problem(b, tables, red)
     if problem:
         return {"ok": False, "problem": problem}
-    problem = _derived_problem(b, tables)
+    historical: list = []
+    unconfirmed: list = []
+    problem = _derived_problem(b, tables, historical, unconfirmed, red)
     if problem:
         return {"ok": False, "problem": f"the derived views contradict the verified record: {problem}"}
     out = {"ok": True, "checked": checked, "head": prev, "complete": red == 0, "redacted": red,
            "nodes": len(tables["nodes"]), "edges": len(tables["edges"]), "unchecked": rows["unchecked"],
            "coverage": "complete" if not rows["unchecked"] and not red else "partial",
-           "views": "none" if b.get("derived") is None else "checked",
+           "views": ("none" if b.get("derived") is None else "historical" if historical
+                     else "unconfirmed" if unconfirmed else "checked"),
            "policy": {"trusted": sorted(policy or {}), "importer": importer},
            "standing": {"checked": False, "note": STANDING_NOTE}}
     notes = []
@@ -259,11 +262,33 @@ def _verify_bundle(b: dict, policy: dict | None = None) -> dict:
     if stated != importer:
         notes.append(f"The bundle names {stated} as its importer; the chain doesn't cover that, so {importer} was "
                      "used.")
+    if historical:
+        notes.append(_historical_note(historical))
+    if unconfirmed:
+        notes.append(_unconfirmed_note(unconfirmed))
     if notes:
         out["warning"] = " ".join(notes)
     return out
 
 
+def _listed(names: list) -> str:
+    return "; ".join(names[:8]) + (f"; and {len(names) - 8} more" if len(names) > 8 else "")
+
+
+def _historical_note(historical: list) -> str:
+    shown = _listed([f"{name} shown {s}, the current rule makes it {w}" for name, s, w in historical])
+    return (f"The views are not checked: {len(historical)} lifecycle(s) follow hypgraph 0.3's rule, not the current "
+            f"one ({shown}). A bundle exported by 0.3 shows them so, but the chain doesn't record which version "
+            "exported a bundle, so this can't be told from an edited view. Go by the current rule.")
+
+
+def _unconfirmed_note(unconfirmed: list) -> str:
+    return (f"The views are not checked: {len(unconfirmed)} node(s) are shown superseded with no replacement in this "
+            f"bundle ({_listed(unconfirmed)}). A replacement in another investigation would be among the redacted "
+            "events, which keep only their hashes, so this can't be confirmed here: the rows make them active. Only "
+            "the full record, verified against the published head, settles it.")
+
+
 def _j(v: Any) -> str:
     """A value in a problem, written as the browser's verifier writes it (JSON.stringify)."""
     return json.dumps(v, ensure_ascii=False, separators=(",", ":"))
@@ -309,6 +334,10 @@ def _scope_problem(b: dict, tables: dict, redacted: int) -> str:
     return ""
 
 
+# the node types a supersedes or corrects link can point at: no other type can be superseded
+REPLACEABLE = frozenset().union(*(RELS[r][1] for r in SAME_TYPE))
+
+
 def _eid(v: Any) -> int | None:
     """A link id as the browser's verifier reads one (Number.isInteger): 7 and 7.0, not true or "7"."""
     if isinstance(v, bool) or not isinstance(v, (int, float)) or not float(v).is_integer():
@@ -316,12 +345,24 @@ def _eid(v: Any) -> int | None:
     return int(v)
 
 
-def _derived_problem(b: dict, tables: dict) -> str:
+def _derived_problem(b: dict, tables: dict, historical: list | None = None, unconfirmed: list | None = None,
+                     redacted: int = 0) -> str:
     """The derived views are presentation, but a viewer shows them beside a verified chain: every fact in them that
     the rows fix — which investigations there are, which nodes and live links each has, each node's type, code,
     author, time, version, title and lifecycle, each link's ends and fields — must be present and agree with the
     verified rows. A view that leaves a fact out fails: a viewer would fill the gap with a default (a withdrawn claim
-    shown as active). The rest of standing can't be checked this way."""
+    shown as active). The rest of standing can't be checked this way.
+
+    A lifecycle is checked against the current rule only. One that matches only 0.3's rule (the end of a chain of
+    replacements shown active) is no problem — a 0.3 export shows it so — but it isn't checked either: the chain
+    doesn't record which version exported a bundle, so it can't be told from an edited view. Each such node goes on
+    ``historical`` as (name, shown, current), and the bundle's views are reported as historical, not checked.
+
+    A bundle with no redacted events holds every link, scoped or not, so a lifecycle the rows don't give fails. A
+    scoped bundle with redacted events leaves out links from other investigations, and one of them may replace a node:
+    a node of a type that can be replaced (``REPLACEABLE``) shown superseded with no replacement in the rows goes on
+    ``unconfirmed`` by name, and the views are reported as unconfirmed, not checked. ``scope`` isn't covered by the
+    chain, so naming one never loosens anything on its own."""
     d = b.get("derived")
     if d is None:
         return ""
@@ -373,13 +414,20 @@ def _derived_problem(b: dict, tables: dict) -> str:
         st = x.get("state")
         if not isinstance(st, dict) or "lifecycle" not in st:
             return f"{where} shows {name} without its lifecycle"
-        w = lifecycle(n["id"], True)
-        allowed = {w, lifecycle(n["id"], False)}
-        if scope and n["id"] not in withdrawn:
-            allowed.add("superseded")   # a scoped bundle leaves out links to other investigations: one may replace it
-        if st["lifecycle"] not in allowed:
-            return f"{where} shows {name} as {_j(st['lifecycle'])}; the record makes it {_j(w)}"
-        return ""
+        w, shown = lifecycle(n["id"], True), st["lifecycle"]
+        if shown == w:
+            return ""
+        if (shown == "superseded" and scope and redacted and n["id"] not in withdrawn
+                and n["type"] in REPLACEABLE):
+            # a replacement in another investigation is among the redacted events: possible, not confirmable
+            if unconfirmed is not None and name not in unconfirmed:
+                unconfirmed.append(name)
+            return ""
+        if shown == lifecycle(n["id"], False):
+            if historical is not None and (name, shown, w) not in historical:
+                historical.append((name, shown, w))
+            return ""
+        return f"{where} shows {name} as {_j(shown)}; the record makes it {_j(w)}"
     by_inv = d.get("by_inv")
     if not isinstance(by_inv, dict) or set(by_inv) != invs:
         return "the views don't cover the record's investigations"

{hypgraph-0.7.16 → hypgraph-0.7.18}/src/hypgraph/cli.py

@@ -297,6 +297,11 @@ def cmd_verify(args) -> int:
         text += "\n  coverage: PARTIAL — not every row field is vouched for by its event (see below)"
     if ok and res.get("views") == "none":
         text += "\n  no derived views: exported without them, so a viewer has nothing to show beyond the rows"
+    if ok and res.get("views") == "historical":
+        text += "\n  views: NOT CHECKED — some lifecycles follow hypgraph 0.3's rule, not the current one (see the note)"
+    if ok and res.get("views") == "unconfirmed":
+        text += ("\n  views: NOT CHECKED — some nodes are shown superseded by something outside this bundle, which "
+                 "can't be confirmed here (see the note)")
     if ok and res.get("unchecked"):
         text += ("\n  not covered (written before events hashed these fields): "
                  + ", ".join(f"{f} ×{n}" for f, n in sorted(res["unchecked"].items())))

{hypgraph-0.7.16 → hypgraph-0.7.18}/src/hypgraph/ui/hypgraph.css

@@ -48,6 +48,7 @@
 .hg .hg-search { display: flex; align-items: center; gap: 8px; width: 260px; padding: 6px 10px; border: 1px solid var(--line);
   border-radius: 8px; background: var(--surface2); color: var(--ink3); cursor: pointer; }
 .hg .hg-search kbd { margin-left: auto; font: 11px var(--mono); padding: 1px 6px; border: 1px solid var(--line2); border-radius: 4px; }
+.hg .hg-lang { padding: 5px 6px; font-size: 12.5px; max-width: 112px; cursor: pointer; }   /* the language menu */
 .hg .btn { border: 1px solid var(--line); background: var(--surface); border-radius: 8px; padding: 6px 10px; cursor: pointer;
   display: inline-flex; gap: 6px; align-items: center; white-space: nowrap; }
 .hg .btn:hover { background: var(--sunken); } .hg .btn:disabled { opacity: .5; cursor: default; background: var(--surface); } .hg .btn.primary { background: var(--accent); border-color: var(--accent); color: #fff; }
@@ -117,6 +118,7 @@
 .hg .note { display: flex; gap: 10px; align-items: flex-start; padding: 9px 14px; border-radius: 9px; margin-bottom: 14px;
   background: var(--accent-soft); color: var(--accent-ink); font-size: 12.5px; }
 .hg .note.warn { background: var(--warn-soft); color: var(--warn); }
+.hg .note[data-exported] { display: block; }                    /* one sentence with inline code: keep it one paragraph */
 
 /* stages and gates */
 .hg .bar { display: flex; gap: 3px; }