interlock-fiduciary 1.0.0__tar.gz

interlock_fiduciary-1.0.0/.github/workflows/ci.yml

@@ -0,0 +1,159 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+  workflow_call: # release.yml runs every check before it builds
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: test (py${{ matrix.python-version }}, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+        os: [ubuntu-latest]
+        include:
+          # SQLite's file locking differs by platform, and the store claims a
+          # log's single writer with a lock beside the file.
+          - python-version: "3.12"
+            os: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Set up Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
+      # Interlock and AgentGov resolve from PyPI, pinned in uv.lock; --frozen
+      # fails a dependency edit that was not re-locked.
+      - name: Install the project
+        run: uv sync --frozen --python ${{ matrix.python-version }}
+      - name: Lint (ruff check)
+        run: uv run ruff check .
+      - name: Format (ruff format --check)
+        run: uv run ruff format --check .
+      - name: Type-check the package (mypy --strict)
+        run: uv run mypy src/
+      - name: Type-check the tests and scripts (mypy --strict)
+        run: uv run mypy --strict tests/ scripts/
+      - name: The golden vectors are what the generator writes
+        run: |
+          uv run python scripts/make_vectors.py
+          git diff --exit-code vectors/
+      - name: The spec's ILOK1 sizes are what interlock signs (F3-9)
+        run: uv run python scripts/ilok1_sizes.py --check
+      - name: Tests with coverage
+        run: uv run pytest -v --cov=fiduciary --cov-branch --cov-report=term-missing
+      # postgres.py runs only against a server, which this job has none of; the
+      # postgres job below measures everything against the higher floors.
+      - name: Enforce coverage floor
+        run: uv run coverage report --fail-under=90 --omit=src/fiduciary/postgres.py
+
+  postgres:
+    name: test against PostgreSQL ${{ matrix.postgres }} (py3.12)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        postgres: ["14", "16", "18"]
+    services:
+      postgres:
+        image: postgres:${{ matrix.postgres }}
+        env:
+          POSTGRES_USER: fiduciary_admin
+          POSTGRES_PASSWORD: fiduciary
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd "pg_isready -U fiduciary_admin"
+          --health-interval 2s --health-timeout 5s --health-retries 30
+    env:
+      UV_PYTHON: "3.12"
+      FIDUCIARY_TEST_POSTGRES_DSN: postgresql://fiduciary_admin:fiduciary@localhost:5432/postgres
+      FIDUCIARY_REQUIRE_POSTGRES: "1"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv python install 3.12
+      - run: uv sync --frozen --python 3.12
+      - name: Tests with coverage, both stores
+        run: uv run pytest -v --cov=fiduciary --cov-branch --cov-report=term-missing --cov-report=json
+      # The floors: 95% of lines and 90% of branches, measured apart.
+      - name: Enforce coverage floors
+        run: |
+          uv run python - <<'EOF'
+          import json, sys
+          totals = json.load(open("coverage.json"))["totals"]
+          lines = 100 * totals["covered_lines"] / totals["num_statements"]
+          branches = 100 * totals["covered_branches"] / totals["num_branches"]
+          print(f"lines {lines:.2f}%, branches {branches:.2f}%")
+          sys.exit(0 if lines >= 95 and branches >= 90 else 1)
+          EOF
+
+  upstream:
+    # The fixes of the spec's section 12 land on interlock's and AgentGov's main
+    # before a release. Here the tests that need them run, and those of each
+    # fallback skip: the jobs above hold the fallbacks, on the releases uv.lock pins.
+    name: test against interlock and AgentGov main (py3.12, PostgreSQL 16)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: fiduciary_admin
+          POSTGRES_PASSWORD: fiduciary
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd "pg_isready -U fiduciary_admin"
+          --health-interval 2s --health-timeout 5s --health-retries 30
+    env:
+      UV_PYTHON: "3.12"
+      FIDUCIARY_TEST_POSTGRES_DSN: postgresql://fiduciary_admin:fiduciary@localhost:5432/postgres
+      FIDUCIARY_REQUIRE_POSTGRES: "1"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv python install 3.12
+      - run: uv sync --frozen --python 3.12
+      - name: Install interlock and AgentGov from main
+        run: >-
+          uv pip install --python .venv/bin/python
+          "interlock-agentgov @ git+https://github.com/crimsondevil0929/agentgov@main"
+          "interlock-escrow @ git+https://github.com/crimsondevil0929/interlock@main"
+      - name: Type-check the package against them (mypy --strict)
+        run: uv run --no-sync mypy src/
+      - name: Tests, both stores
+        run: uv run --no-sync pytest -v
+
+  build:
+    name: build (wheel + sdist)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv build -o "${{ runner.temp }}/dist" > "${{ runner.temp }}/build.log" 2>&1 || (cat "${{ runner.temp }}/build.log"; exit 1)
+      - name: Install the wheel into a bare environment
+        run: |
+          uv venv "${{ runner.temp }}/bare" --python 3.12
+          uv pip install --python "${{ runner.temp }}/bare/bin/python" "${{ runner.temp }}"/dist/*.whl
+          "${{ runner.temp }}/bare/bin/fiduciary" --version
+          "${{ runner.temp }}/bare/bin/python" -W error -c "import fiduciary.cli, fiduciary.postgres, fiduciary.verify"

interlock_fiduciary-1.0.0/.github/workflows/release.yml

@@ -0,0 +1,128 @@
+name: Release
+
+# On a version tag: every check of ci.yml, then the wheel and the sdist, built
+# once, published to PyPI by trusted publishing: no API token exists anywhere,
+# PyPI exchanges this workflow's OIDC identity for a short-lived one. Every
+# distribution carries a PEP 740 attestation (PyPI shows and verifies it) and a
+# GitHub build provenance attestation (`gh attestation verify`), and the GitHub
+# release carries a CycloneDX SBOM of everything the package and its extras
+# install: the pipeline of interlock-escrow and interlock-agentgov.
+#
+# Before the first release, register this repository, this workflow
+# (release.yml) and the `pypi` environment as a trusted publisher of
+# interlock-fiduciary on PyPI, and give the environment required reviewers.
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    name: every check
+    uses: ./.github/workflows/ci.yml
+
+  build:
+    name: build the distributions and their SBOM
+    needs: checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: The tag names the version in pyproject.toml and fiduciary.__version__
+        run: |
+          declared=$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
+          module=$(python3 -c "import ast; tree = ast.parse(open('src/fiduciary/__init__.py').read()); print(next(n.value.value for n in tree.body if isinstance(n, ast.Assign) and any(getattr(t, 'id', '') == '__version__' for t in n.targets)))")
+          if [ "v$declared" != "$GITHUB_REF_NAME" ] || [ "$module" != "$declared" ]; then
+            echo "::error::tag $GITHUB_REF_NAME, pyproject.toml $declared, fiduciary.__version__ $module"
+            exit 1
+          fi
+
+      - name: Build, failing on packaging warnings
+        run: |
+          set -o pipefail
+          # The log goes outside the checkout: the sdist packs the source tree.
+          uv build 2>&1 | tee "${{ runner.temp }}/build.log"
+          if grep -i '^warning' "${{ runner.temp }}/build.log"; then
+            echo "::error::uv build emitted packaging warnings"
+            exit 1
+          fi
+
+      - name: The wheel installs into a bare environment and runs
+        run: |
+          uv venv "${{ runner.temp }}/bare" --python 3.12
+          uv pip install --python "${{ runner.temp }}/bare/bin/python" dist/*.whl
+          "${{ runner.temp }}/bare/bin/fiduciary" --version
+
+      # Every package `pip install 'interlock-fiduciary[...]'` can bring in, at
+      # the versions this release was tested with (uv.lock).
+      - name: Describe the dependencies (CycloneDX)
+        run: |
+          mkdir sbom
+          uv export --frozen --no-dev --all-extras --no-emit-project --no-hashes \
+            --format requirements-txt --output-file sbom/requirements.txt
+          uvx --from cyclonedx-bom==7.4.0 cyclonedx-py requirements sbom/requirements.txt \
+            --output-format JSON --output-file "sbom/interlock-fiduciary-${GITHUB_REF_NAME#v}.cdx.json"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: sbom/
+
+  publish:
+    name: publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/interlock-fiduciary/
+    permissions:
+      id-token: write # trusted publishing, and signing the attestations
+      attestations: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Attest the distributions' build provenance
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: dist/*
+
+      - name: Publish, with a PEP 740 attestation for each file
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true
+
+  github-release:
+    name: GitHub release, with the SBOM
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          path: assets/
+
+      - name: Create the release from the tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          prerelease=""
+          if [[ "$GITHUB_REF_NAME" =~ (a|b|rc)[0-9]+$ ]]; then prerelease="--prerelease"; fi
+          gh release create "$GITHUB_REF_NAME" --verify-tag --generate-notes $prerelease \
+            --title "interlock-fiduciary ${GITHUB_REF_NAME#v}" assets/dist/* assets/sbom/*.cdx.json

interlock_fiduciary-1.0.0/.gitignore

@@ -0,0 +1,38 @@
+# Python build and bytecode
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv/
+
+# Tooling caches
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+.coverage.*
+htmlcov/
+.hypothesis/
+
+# Logs, such as a build's: the sdist packs whatever is not ignored
+*.log
+
+# Stores and keys made by hand while trying the command line
+*.db
+*.db-wal
+*.db-shm
+*.key
+
+# OS metadata
+.DS_Store
+
+# The live acceptance suite's key, and its runs: never committed, never packed
+.env.benchmark
+live-run/
+
+# The soak's runs (scripts/live_stress_test.py --out): never committed, never packed
+soak/