isongraph-ext 0.3.0__py3-none-any.whl

isongraph_ext/__init__.py

@@ -0,0 +1,3 @@
+"""ISONGraphExt - extension bindings, provenance and datamatics over ISONGraph Core (IGX/1, IGPV/1, IGDM/1)."""
+
+__version__ = "0.3.0"

isongraph_ext/baselines/REGISTRY.ison

@@ -0,0 +1,3 @@
+table.baselines
+adopted core_commit retired
+2026-11-05 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 false

isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/MANIFEST.ison

@@ -0,0 +1,22 @@
+meta.baseline
+canonical_writer_dist canonical_writer_dist_version core_commit core_format core_runtime_dist core_runtime_dist_version core_semantic_spec core_vector_corpus_commit core_vector_corpus_digest core_vector_corpus_version core_version
+ison-py 1.2.0 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph ison-graph 1.4.1 ISONGraph-Semantic/2-draft f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 1.4.1
+
+table.core_runtime
+module sha256
+ison_graph/__init__.py 2a13a36d63d85e766df961aae2d52550c2e9c52f60a5ee46560ddce4a301ece4
+ison_graph/multigraph.py 6d4e874a75f43d8914422bf2006f995a6334bfe4fe9eb5552c0f2f31fb4ff3e6
+ison_graph/query.py d0c34fa8649de066049a1670ccc00f8af28029c2ed7374256b9fb9a978423cd4
+ison_graph/schema.py 06f82dc13eb02794b11d0386c8f8090b0f9a5d2f48be839e828703e2e5e2d1b4
+ison_graph/structural.py ffa53c3edd5dc76e6e7db20b74473f59bb6b329b09479445699eeba59e2232c7
+ison_graph/viz.py e62949eb91c9a3fe4be3972de94baddf7f41f034f5c61db51ceb8bcb4ca9b6d6
+
+table.files
+path sha256
+"domains.ison" 6d9db34ceedd5c1309060bc2dfeddcdd302b6664737bfe904c14391870254897
+receipts/cpp.ison b330dc23e4d882c71942d035d1848f03841f932345c823f93b560c86f40e83a8
+receipts/cs.ison f37d41566cf69c3e6b933483946bc8559c8ceb160c2d6d4ea36caab8f94ccfc7
+receipts/js.ison acbe2104736148bf19c0d93649781b9c142066bec4fe1ab0b6fdc116abc39ed6
+receipts/python.ison cece1259ac61172a1d519b5ad31cef8b29ff3e466f629f4cb72b4f34fdda9ac0
+receipts/rust.ison 6dd9c2dcf5407f598233f6c3f21bf831a02f141a509ff45b112729ae35690040
+receipts/ts.ison 393ba7e64e6c2be3606f2e8b03124dd2ff0cef33d069f38c6cb0b075dec268c4

isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/domains.ison

@@ -0,0 +1,8 @@
+table.domains
+port tag
+js binary64-inexact-int
+js integral-float-collapse
+js multigraph-document-accepted
+ts binary64-inexact-int
+ts integral-float-collapse
+ts multigraph-document-accepted

isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/cpp.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+0 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 0 0 0 cpp 1.4.1 PARTIAL 0 ISONGraph-Semantic/2-draft 32 32

isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/cs.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+0 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 0 0 0 cs 1.4.1 PARTIAL 0 ISONGraph-Semantic/2-draft 32 32

isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/js.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+6 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 1 4 16 js 1.4.1 KNOWN_DEFECT 5 ISONGraph-Semantic/2-draft 0 32

isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/python.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+7 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 0 0 19 python 1.4.1 FULL 6 ISONGraph-Semantic/2-draft 0 32

isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/rust.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+0 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 0 0 0 rust 1.4.1 PARTIAL 0 ISONGraph-Semantic/2-draft 32 32

isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/ts.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+6 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 1 4 16 ts 1.4.1 KNOWN_DEFECT 5 ISONGraph-Semantic/2-draft 0 32

isongraph_ext/igdm/__init__.py

@@ -0,0 +1,13 @@
+"""IGDM/1 Datamatics (19-IGDM1-DESIGN.md)."""
+
+from ..igpv.records import EdgeAddress, NodeRef
+from ..igx.registry import DEFAULT_REGISTRY
+from .bind import bind, verify_and_admit
+from .errors import IGDMError
+from .payload import DatamaticsPayload, check_references, unrecognized_roles
+from .records import DEFAULT_LIMITS, EdgeHints, Group, LayoutHints, Limits, Member, NodeHints
+from .verify import DatamaticsVerification, verify
+
+__all__ = ["IGDMError", "DEFAULT_LIMITS", "EdgeHints", "Group", "LayoutHints", "Limits", "Member", "NodeHints", "EdgeAddress", "NodeRef",
+           "DEFAULT_REGISTRY", "DatamaticsPayload", "check_references", "unrecognized_roles", "DatamaticsVerification", "verify",
+           "bind", "verify_and_admit"]

isongraph_ext/igdm/__main__.py

@@ -0,0 +1,92 @@
+"""CLI (19 §4): verify -> 0/1/2, 64 on usage; one canonical ISON document per response."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from collections.abc import Mapping
+from pathlib import Path
+
+from ison_parser import Block, Document, dumps_canonical
+
+from ..igx.admit import AdmissionPolicy
+from ..igx.binding import ExtensionBinding
+from ..igx.errors import IGXError
+from .bind import verify_and_admit
+from .errors import IGDMError
+
+EX_USAGE = 64   # BSD sysexits: never collides with 2 (admission denied) or 1 (invalid binding/payload)
+
+
+class _Parser(argparse.ArgumentParser):
+    def error(self, message: str) -> None:  # type: ignore[override]
+        self.print_usage(sys.stderr)
+        sys.stderr.write(f"error: {message}\n")
+        raise SystemExit(EX_USAGE)
+
+
+def _utf8_streams() -> None:
+    """Output is UTF-8, LF-terminated ISON regardless of console locale or platform (same rule as the igx CLI)."""
+    for stream in (sys.stdout, sys.stderr):
+        reconfigure = getattr(stream, "reconfigure", None)
+        if reconfigure is not None:
+            reconfigure(encoding="utf-8", errors="strict", newline="\n")
+
+
+def _meta(name: str, row: dict) -> Block:
+    return Block("meta", name, list(row), [row])
+
+
+def _emit(blocks: list[Block]) -> None:
+    sys.stdout.write(dumps_canonical(Document(blocks=blocks)) + "\n")
+
+
+def _joined(items) -> str | None:
+    items = list(items)
+    return ",".join(items) if items else None
+
+
+def _kv(m: Mapping) -> str | None:
+    return _joined(f"{k}={v}" for k, v in m.items())
+
+
+def main(argv: list[str]) -> int:
+    _utf8_streams()
+    ap = _Parser(prog="python -m isongraph_ext.igdm")
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    v = sub.add_parser("verify")
+    v.add_argument("graph", type=Path)
+    v.add_argument("binding", type=Path)
+    v.add_argument("payload", type=Path)
+    v.add_argument("--allow-retired", action="store_true")
+    a = ap.parse_args(argv)
+    try:
+        graph, binding_bytes, payload_bytes = a.graph.read_bytes(), a.binding.read_bytes(), a.payload.read_bytes()
+    except OSError as e:
+        ap.print_usage(sys.stderr)
+        sys.stderr.write(f"error: {e}\n")
+        return EX_USAGE
+    try:
+        binding = ExtensionBinding.from_ison(binding_bytes)
+        result, dm, decision = verify_and_admit(payload_bytes, binding, graph, policy=AdmissionPolicy(allow_retired_baselines=a.allow_retired))
+    except (IGXError, IGDMError) as e:
+        _emit([_meta("error", {"code": e.code, "field": e.field, "detail": e.detail, "step": e.step})])
+        return 1
+    _emit([
+        _meta("verification", {
+            "binding_digest": result.binding_digest, "semantic_verification": result.semantic_verification,
+            "source_canonical": result.source_canonical, "source_semantic_eligibility": result.source_semantic_eligibility,
+            "source_semantic_reason": result.source_semantic_reason, "steps_passed": _joined(result.steps_passed),
+            "unrecognized_optional": _joined(c.extension for c in result.unrecognized_optional)}),
+        _meta("datamatics", {
+            "payload_sha256": dm.payload_sha256, "binding_digest": dm.binding_digest, "target_artifact_sha256": dm.target_artifact_sha256,
+            "object_resolution": dm.object_resolution, "unrecognized_roles": _joined(dm.unrecognized_roles),
+            "counts": _kv(dm.counts), "steps_passed": _joined(dm.steps_passed)}),
+        _meta("admission", {"admitted": decision.admitted, "code": decision.code, "step": decision.step,
+                            "receipt_posture": decision.receipt_posture, "reasons": _joined(decision.reasons)}),
+    ])
+    return 0 if decision.admitted else 2
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

isongraph_ext/igdm/bind.py

@@ -0,0 +1,49 @@
+"""Producer path and trustworthy consumer path (19 §4), mirroring igpv.bind."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping, Sequence
+
+from ..igx.admit import DEFAULT_POLICY, AdmissionPolicy, AdmissionResult, admit
+from ..igx.baselines import BASELINES, DEFAULT_BASELINE, Baseline
+from ..igx.bind import bind as igx_bind
+from ..igx.binding import Capability, Consumer, ExtensionBinding
+from ..igx.digest import sha256_hex
+from ..igx.registry import DEFAULT_REGISTRY, CapabilityRegistry
+from ..igx.source import as_bytes
+from ..igx.verify import VerificationResult
+from . import records as R
+from .errors import IGDMError
+from .payload import DatamaticsPayload
+from .verify import DatamaticsVerification, verify
+
+
+def bind(target: str | bytes, payload: DatamaticsPayload, *, requirement: str = "REQUIRED", serialization_profile: str,
+         producer_port: str, identity_claim: str, capabilities: Sequence[Capability] = (), consumer: Consumer | None = None,
+         baseline: Baseline = DEFAULT_BASELINE, registry: CapabilityRegistry = DEFAULT_REGISTRY,
+         policy: AdmissionPolicy = DEFAULT_POLICY, limits: R.Limits = R.DEFAULT_LIMITS) -> ExtensionBinding:
+    if requirement not in ("REQUIRED", "OPTIONAL"):
+        raise IGDMError("MALFORMED_DATAMATICS", "table.capabilities.igdm.requirement", "REQUIRED or OPTIONAL", "D1")
+    if any(c.extension == R.CAPABILITY for c in capabilities):
+        raise IGDMError("MALFORMED_DATAMATICS", "table.capabilities.igdm", "bind() adds the igdm row itself; do not pass one", "D1")
+    payload.check()
+    data = as_bytes(target)
+    actual = sha256_hex(data)
+    if payload.target_artifact_sha256 != actual:
+        raise IGDMError("TARGET_BINDING_MISMATCH", "meta.igdm.target_artifact_sha256", f"target bytes hash to {actual}", "D2")
+    if payload.target_serialization_profile != serialization_profile:
+        raise IGDMError("TARGET_BINDING_MISMATCH", "meta.igdm.target_serialization_profile",
+                        f"{payload.target_serialization_profile} != {serialization_profile}", "D2")
+    caps = tuple(capabilities) + (Capability(R.CAPABILITY, R.CAPABILITY_RANGE, requirement, payload.digest),)
+    binding = igx_bind(data, serialization_profile=serialization_profile, producer_port=producer_port, identity_claim=identity_claim,
+                       capabilities=caps, consumer=consumer, baseline=baseline, registry=registry, policy=policy)
+    verify(payload, binding, data, limits=limits, baselines={**BASELINES, baseline.core_commit: baseline}, registry=registry)
+    return binding
+
+
+def verify_and_admit(payload: str | bytes | DatamaticsPayload, binding: ExtensionBinding, target: str | bytes, *,
+                     limits: R.Limits = R.DEFAULT_LIMITS, baselines: Mapping[str, Baseline] = BASELINES,
+                     registry: CapabilityRegistry = DEFAULT_REGISTRY, policy: AdmissionPolicy = DEFAULT_POLICY
+                     ) -> tuple[VerificationResult, DatamaticsVerification, AdmissionResult]:
+    result, dm = verify(payload, binding, target, limits=limits, baselines=baselines, registry=registry)
+    return result, dm, admit(binding, result, policy=policy, baselines=baselines)

isongraph_ext/igdm/errors.py

@@ -0,0 +1,12 @@
+"""The one exception type IGDM/1 raises (19 §3.1). Admission denials are the binding's results, not exceptions."""
+
+from __future__ import annotations
+
+
+class IGDMError(Exception):
+    def __init__(self, code: str, field: str, detail: str, step: str) -> None:
+        super().__init__(f"{step} {code} {field}: {detail}")
+        self.code = code
+        self.field = field
+        self.detail = detail
+        self.step = step