isongraph-ext 0.3.0__tar.gz

isongraph_ext-0.3.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mahesh Vaikri
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

isongraph_ext-0.3.0/PKG-INFO

@@ -0,0 +1,144 @@
+Metadata-Version: 2.4
+Name: isongraph-ext
+Version: 0.3.0
+Summary: ISONGraphExt - IGX/1 extension bindings, IGPV/1 provenance and IGDM/1 datamatics with verifiable identity claims over ISONGraph Core
+Author: Mahesh Vaikri
+License-Expression: MIT
+Project-URL: Repository, https://github.com/ISON-format/isongraph-ext
+Project-URL: Issues, https://github.com/ISON-format/isongraph-ext/issues
+Project-URL: Changelog, https://github.com/ISON-format/isongraph-ext/blob/main/CHANGELOG.md
+Project-URL: Specifications, https://github.com/ISON-format/isongraph-ext/tree/main/docs/blueprint
+Project-URL: ISONGraph Core, https://github.com/ISON-format/isongraph
+Keywords: isongraph,ison,graph,provenance,lineage,integrity,verification,conformance
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: ison-py==1.2.0
+Requires-Dist: ison-graph==1.4.1
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: build>=1.2; extra == "dev"
+Dynamic: license-file
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/ISON-format/isongraph-ext/main/assets/isongraph-banner.png" alt="ISONGraph" width="720">
+</p>
+
+<h1 align="center">isongraph-ext</h1>
+
+<p align="center">
+  <strong>Prove what a graph is, where it came from, and how to show it — without changing the graph.</strong>
+</p>
+
+<p align="center">
+  <a href="https://github.com/ISON-format/isongraph-ext/actions/workflows/ci.yml"><img src="https://github.com/ISON-format/isongraph-ext/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
+  <img src="https://img.shields.io/badge/license-MIT-yellow.svg" alt="MIT License">
+  <img src="https://img.shields.io/badge/python-3.12%2B-blue.svg" alt="Python 3.12+">
+  <img src="https://img.shields.io/badge/status-alpha-orange.svg" alt="Alpha">
+</p>
+
+[ISONGraph](https://github.com/ISON-format/isongraph) stores a graph as a compact, token-efficient file. That file deliberately says nothing about **who made it**, **where its facts came from**, or **how a viewer should draw it**. `isongraph-ext` answers those three questions with small **companion files that sit next to the graph** and are tied to its exact bytes by SHA-256. The graph itself is never modified, and everything works offline.
+
+```text
+graph.ison          the ordinary ISONGraph; Core reads it exactly as before
+  |-- graph.igx.ison    IGX/1   binding      "is this the graph I was promised?"
+  |-- graph.igpv.ison  IGPV/1  provenance   "where did this come from?"
+  `-- graph.igdm.ison  IGDM/1  datamatics   "how should a viewer present it?"
+```
+
+Each companion is optional and independent. A consumer that knows none of them still has the whole graph.
+
+## Install
+
+```bash
+pip install isongraph-ext
+```
+
+Python 3.12+. Pure Python. The only dependencies are `ison-graph==1.4.1` and `ison-py==1.2.0`, pinned exactly, because the package verifies against the Core baseline it was measured with.
+
+## Try it
+
+Bind a graph to its bytes, verify it, then change one byte:
+
+```python
+from ison_graph import ISONGraph
+from isongraph_ext import igx
+
+g = ISONGraph()
+g.add_node("person", "ada", name="Ada")
+g.add_node("person", "grace", name="Grace")
+g.add_edge("knows", ("person", "ada"), ("person", "grace"))
+data = g.to_ison().encode("utf-8")
+
+binding = igx.bind(data, serialization_profile="ison-v1", producer_port="python", identity_claim="artifact")
+result, decision = igx.verify_and_admit(binding, data)
+print("admitted:", decision.admitted, "| steps:", ", ".join(result.steps_passed))
+
+try:
+    igx.verify(binding, data + b"\n# edited")
+except igx.IGXError as e:
+    print("tampered:", e.code, "at", e.step)
+```
+
+```text
+admitted: True | steps: V0, V1, V2, V3, V4, V5
+tampered: SOURCE_BINDING_MISMATCH at V4
+```
+
+Verification is a fixed sequence of numbered steps, and every failure names the step and a stable error code.
+
+## Command line
+
+```bash
+python -m isongraph_ext.igx   verify graph.ison graph.igx.ison                  # exit 0 ok, 1 invalid, 64 usage
+python -m isongraph_ext.igx   admit  graph.ison graph.igx.ison                  # exit 0 admitted, 2 denied
+python -m isongraph_ext.igpv  verify graph.ison graph.igx.ison graph.igpv.ison [--source SHA256=PATH]
+python -m isongraph_ext.igpv  origins <graph-sha256> graph.igpv.ison --node person ada
+python -m isongraph_ext.igdm  verify graph.ison graph.igx.ison graph.igdm.ison
+```
+
+Output is itself ISON, so receipts can quote it verbatim.
+
+## What you get
+
+| Capability | What it does |
+|---|---|
+| **IGX/1** binding | Pins the exact bytes, the Core version they were written with and an identity claim (`none`, `artifact`, `producer_bound`). Unknown capabilities are reported or refused, never silently ignored. |
+| **IGPV/1** provenance | Attributes nodes and edges to source documents, with byte or line spans checked against the real bytes, and records derivation lineage: *this node stands for those nodes in an earlier graph*. |
+| **IGDM/1** datamatics | Renderer-neutral presentation **intent**: semantic roles, emphasis, badges, groups, layout hints and accessibility text. Never colours, fonts or coordinates. |
+
+## Built to be checked
+
+- **Byte-exact.** Companion files are canonical by construction: one graph, one companion, one set of bytes, one SHA-256.
+- **Specified before coded.** Frozen specifications for IGX/1, IGPV/1 and IGDM/1 live in the [repository](https://github.com/ISON-format/isongraph-ext/tree/main/docs/blueprint); the code follows them, never the reverse.
+- **Conformance vectors.** 156 byte-exact vectors and about 450 tests are replayed in CI on every change.
+- **Pinned to a measured Core.** The package embeds the Core baseline it was verified against, plus Core's conformance receipts, so identity claims are checkable rather than asserted.
+- **Hostile-input safe.** Parsing is bounded by explicit size and row budgets; verification reports the first failing step instead of guessing.
+
+## Examples
+
+Four runnable demonstrations (a non-software provenance graph, a supply-chain presentation graph, a minimal generic SVG adapter and a Core-only consumer) are in the [examples folder](https://github.com/ISON-format/isongraph-ext/tree/main/examples) of the repository.
+
+## Status and limits
+
+This is an **early-stage (alpha)** release. Know what it does not do:
+
+- A verified binding proves **reproducibility and consistency, not authorship**; `producer_port` is a checked claim, not authentication.
+- Provenance proves origin and lineage, **not that an extracted statement is true**.
+- The cross-port identity claim and lossy producer-bound admission are reserved. Revision, delta, projection and DAG capabilities are not implemented.
+- IGDM/1 carries presentation **intent only** and renders nothing.
+- Python reference implementation only. Verification is an offline cost: roughly 5 seconds for a 10,000-node graph with a capability.
+
+## Links
+
+[Source and issues](https://github.com/ISON-format/isongraph-ext) · [Changelog](https://github.com/ISON-format/isongraph-ext/blob/main/CHANGELOG.md) · [Security policy](https://github.com/ISON-format/isongraph-ext/blob/main/SECURITY.md) · [ISONGraph Core](https://github.com/ISON-format/isongraph)
+
+MIT — Copyright (c) 2026 Mahesh Vaikri.

isongraph_ext-0.3.0/README.md

@@ -0,0 +1,114 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/ISON-format/isongraph-ext/main/assets/isongraph-banner.png" alt="ISONGraph" width="720">
+</p>
+
+<h1 align="center">isongraph-ext</h1>
+
+<p align="center">
+  <strong>Prove what a graph is, where it came from, and how to show it — without changing the graph.</strong>
+</p>
+
+<p align="center">
+  <a href="https://github.com/ISON-format/isongraph-ext/actions/workflows/ci.yml"><img src="https://github.com/ISON-format/isongraph-ext/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
+  <img src="https://img.shields.io/badge/license-MIT-yellow.svg" alt="MIT License">
+  <img src="https://img.shields.io/badge/python-3.12%2B-blue.svg" alt="Python 3.12+">
+  <img src="https://img.shields.io/badge/status-alpha-orange.svg" alt="Alpha">
+</p>
+
+[ISONGraph](https://github.com/ISON-format/isongraph) stores a graph as a compact, token-efficient file. That file deliberately says nothing about **who made it**, **where its facts came from**, or **how a viewer should draw it**. `isongraph-ext` answers those three questions with small **companion files that sit next to the graph** and are tied to its exact bytes by SHA-256. The graph itself is never modified, and everything works offline.
+
+```text
+graph.ison          the ordinary ISONGraph; Core reads it exactly as before
+  |-- graph.igx.ison    IGX/1   binding      "is this the graph I was promised?"
+  |-- graph.igpv.ison  IGPV/1  provenance   "where did this come from?"
+  `-- graph.igdm.ison  IGDM/1  datamatics   "how should a viewer present it?"
+```
+
+Each companion is optional and independent. A consumer that knows none of them still has the whole graph.
+
+## Install
+
+```bash
+pip install isongraph-ext
+```
+
+Python 3.12+. Pure Python. The only dependencies are `ison-graph==1.4.1` and `ison-py==1.2.0`, pinned exactly, because the package verifies against the Core baseline it was measured with.
+
+## Try it
+
+Bind a graph to its bytes, verify it, then change one byte:
+
+```python
+from ison_graph import ISONGraph
+from isongraph_ext import igx
+
+g = ISONGraph()
+g.add_node("person", "ada", name="Ada")
+g.add_node("person", "grace", name="Grace")
+g.add_edge("knows", ("person", "ada"), ("person", "grace"))
+data = g.to_ison().encode("utf-8")
+
+binding = igx.bind(data, serialization_profile="ison-v1", producer_port="python", identity_claim="artifact")
+result, decision = igx.verify_and_admit(binding, data)
+print("admitted:", decision.admitted, "| steps:", ", ".join(result.steps_passed))
+
+try:
+    igx.verify(binding, data + b"\n# edited")
+except igx.IGXError as e:
+    print("tampered:", e.code, "at", e.step)
+```
+
+```text
+admitted: True | steps: V0, V1, V2, V3, V4, V5
+tampered: SOURCE_BINDING_MISMATCH at V4
+```
+
+Verification is a fixed sequence of numbered steps, and every failure names the step and a stable error code.
+
+## Command line
+
+```bash
+python -m isongraph_ext.igx   verify graph.ison graph.igx.ison                  # exit 0 ok, 1 invalid, 64 usage
+python -m isongraph_ext.igx   admit  graph.ison graph.igx.ison                  # exit 0 admitted, 2 denied
+python -m isongraph_ext.igpv  verify graph.ison graph.igx.ison graph.igpv.ison [--source SHA256=PATH]
+python -m isongraph_ext.igpv  origins <graph-sha256> graph.igpv.ison --node person ada
+python -m isongraph_ext.igdm  verify graph.ison graph.igx.ison graph.igdm.ison
+```
+
+Output is itself ISON, so receipts can quote it verbatim.
+
+## What you get
+
+| Capability | What it does |
+|---|---|
+| **IGX/1** binding | Pins the exact bytes, the Core version they were written with and an identity claim (`none`, `artifact`, `producer_bound`). Unknown capabilities are reported or refused, never silently ignored. |
+| **IGPV/1** provenance | Attributes nodes and edges to source documents, with byte or line spans checked against the real bytes, and records derivation lineage: *this node stands for those nodes in an earlier graph*. |
+| **IGDM/1** datamatics | Renderer-neutral presentation **intent**: semantic roles, emphasis, badges, groups, layout hints and accessibility text. Never colours, fonts or coordinates. |
+
+## Built to be checked
+
+- **Byte-exact.** Companion files are canonical by construction: one graph, one companion, one set of bytes, one SHA-256.
+- **Specified before coded.** Frozen specifications for IGX/1, IGPV/1 and IGDM/1 live in the [repository](https://github.com/ISON-format/isongraph-ext/tree/main/docs/blueprint); the code follows them, never the reverse.
+- **Conformance vectors.** 156 byte-exact vectors and about 450 tests are replayed in CI on every change.
+- **Pinned to a measured Core.** The package embeds the Core baseline it was verified against, plus Core's conformance receipts, so identity claims are checkable rather than asserted.
+- **Hostile-input safe.** Parsing is bounded by explicit size and row budgets; verification reports the first failing step instead of guessing.
+
+## Examples
+
+Four runnable demonstrations (a non-software provenance graph, a supply-chain presentation graph, a minimal generic SVG adapter and a Core-only consumer) are in the [examples folder](https://github.com/ISON-format/isongraph-ext/tree/main/examples) of the repository.
+
+## Status and limits
+
+This is an **early-stage (alpha)** release. Know what it does not do:
+
+- A verified binding proves **reproducibility and consistency, not authorship**; `producer_port` is a checked claim, not authentication.
+- Provenance proves origin and lineage, **not that an extracted statement is true**.
+- The cross-port identity claim and lossy producer-bound admission are reserved. Revision, delta, projection and DAG capabilities are not implemented.
+- IGDM/1 carries presentation **intent only** and renders nothing.
+- Python reference implementation only. Verification is an offline cost: roughly 5 seconds for a 10,000-node graph with a capability.
+
+## Links
+
+[Source and issues](https://github.com/ISON-format/isongraph-ext) · [Changelog](https://github.com/ISON-format/isongraph-ext/blob/main/CHANGELOG.md) · [Security policy](https://github.com/ISON-format/isongraph-ext/blob/main/SECURITY.md) · [ISONGraph Core](https://github.com/ISON-format/isongraph)
+
+MIT — Copyright (c) 2026 Mahesh Vaikri.

isongraph_ext-0.3.0/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["setuptools>=69", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "isongraph-ext"
+version = "0.3.0"
+description = "ISONGraphExt - IGX/1 extension bindings, IGPV/1 provenance and IGDM/1 datamatics with verifiable identity claims over ISONGraph Core"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{name = "Mahesh Vaikri"}]
+requires-python = ">=3.12"
+# Exact pins: the reference runtime IS the implementation the Core baseline was measured with (17 §3, §4 V0).
+dependencies = ["ison-py==1.2.0", "ison-graph==1.4.1"]
+keywords = ["isongraph", "ison", "graph", "provenance", "lineage", "integrity", "verification", "conformance"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Typing :: Typed",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "build>=1.2"]
+
+[project.urls]
+Repository = "https://github.com/ISON-format/isongraph-ext"
+Issues = "https://github.com/ISON-format/isongraph-ext/issues"
+Changelog = "https://github.com/ISON-format/isongraph-ext/blob/main/CHANGELOG.md"
+Specifications = "https://github.com/ISON-format/isongraph-ext/tree/main/docs/blueprint"
+"ISONGraph Core" = "https://github.com/ISON-format/isongraph"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+isongraph_ext = ["py.typed", "baselines/REGISTRY.ison", "baselines/*/MANIFEST.ison", "baselines/*/domains.ison", "baselines/*/receipts/*.ison"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-q --tb=short"
+pythonpath = ["src"]

isongraph_ext-0.3.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

isongraph_ext-0.3.0/src/isongraph_ext/__init__.py

@@ -0,0 +1,3 @@
+"""ISONGraphExt - extension bindings, provenance and datamatics over ISONGraph Core (IGX/1, IGPV/1, IGDM/1)."""
+
+__version__ = "0.3.0"

isongraph_ext-0.3.0/src/isongraph_ext/baselines/REGISTRY.ison

@@ -0,0 +1,3 @@
+table.baselines
+adopted core_commit retired
+2026-11-05 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 false

isongraph_ext-0.3.0/src/isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/MANIFEST.ison

@@ -0,0 +1,22 @@
+meta.baseline
+canonical_writer_dist canonical_writer_dist_version core_commit core_format core_runtime_dist core_runtime_dist_version core_semantic_spec core_vector_corpus_commit core_vector_corpus_digest core_vector_corpus_version core_version
+ison-py 1.2.0 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph ison-graph 1.4.1 ISONGraph-Semantic/2-draft f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 1.4.1
+
+table.core_runtime
+module sha256
+ison_graph/__init__.py 2a13a36d63d85e766df961aae2d52550c2e9c52f60a5ee46560ddce4a301ece4
+ison_graph/multigraph.py 6d4e874a75f43d8914422bf2006f995a6334bfe4fe9eb5552c0f2f31fb4ff3e6
+ison_graph/query.py d0c34fa8649de066049a1670ccc00f8af28029c2ed7374256b9fb9a978423cd4
+ison_graph/schema.py 06f82dc13eb02794b11d0386c8f8090b0f9a5d2f48be839e828703e2e5e2d1b4
+ison_graph/structural.py ffa53c3edd5dc76e6e7db20b74473f59bb6b329b09479445699eeba59e2232c7
+ison_graph/viz.py e62949eb91c9a3fe4be3972de94baddf7f41f034f5c61db51ceb8bcb4ca9b6d6
+
+table.files
+path sha256
+"domains.ison" 6d9db34ceedd5c1309060bc2dfeddcdd302b6664737bfe904c14391870254897
+receipts/cpp.ison b330dc23e4d882c71942d035d1848f03841f932345c823f93b560c86f40e83a8
+receipts/cs.ison f37d41566cf69c3e6b933483946bc8559c8ceb160c2d6d4ea36caab8f94ccfc7
+receipts/js.ison acbe2104736148bf19c0d93649781b9c142066bec4fe1ab0b6fdc116abc39ed6
+receipts/python.ison cece1259ac61172a1d519b5ad31cef8b29ff3e466f629f4cb72b4f34fdda9ac0
+receipts/rust.ison 6dd9c2dcf5407f598233f6c3f21bf831a02f141a509ff45b112729ae35690040
+receipts/ts.ison 393ba7e64e6c2be3606f2e8b03124dd2ff0cef33d069f38c6cb0b075dec268c4

isongraph_ext-0.3.0/src/isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/domains.ison

@@ -0,0 +1,8 @@
+table.domains
+port tag
+js binary64-inexact-int
+js integral-float-collapse
+js multigraph-document-accepted
+ts binary64-inexact-int
+ts integral-float-collapse
+ts multigraph-document-accepted

isongraph_ext-0.3.0/src/isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/cpp.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+0 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 0 0 0 cpp 1.4.1 PARTIAL 0 ISONGraph-Semantic/2-draft 32 32

isongraph_ext-0.3.0/src/isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/cs.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+0 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 0 0 0 cs 1.4.1 PARTIAL 0 ISONGraph-Semantic/2-draft 32 32

isongraph_ext-0.3.0/src/isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/js.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+6 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 1 4 16 js 1.4.1 KNOWN_DEFECT 5 ISONGraph-Semantic/2-draft 0 32

isongraph_ext-0.3.0/src/isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/python.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+7 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 0 0 19 python 1.4.1 FULL 6 ISONGraph-Semantic/2-draft 0 32

isongraph_ext-0.3.0/src/isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/rust.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+0 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 0 0 0 rust 1.4.1 PARTIAL 0 ISONGraph-Semantic/2-draft 32 32

isongraph_ext-0.3.0/src/isongraph_ext/baselines/ce9d3b78afd79cbdffdd67546bcb5278dc38be70/receipts/ts.ison

@@ -0,0 +1,3 @@
+meta.core_conformance_receipt
+canonicalized core_commit core_format core_version corpus_commit corpus_digest corpus_version defect lossy pass port port_version posture rejected_as_expected semantic_spec todo total
+6 ce9d3b78afd79cbdffdd67546bcb5278dc38be70 isongraph 1.4.1 f88af8bd29680e7b6e7716585be936d5738eb55f 1d1a6648abeeadece24b43a163949d02241911706866236cc32bd6b61745bcb0 1 1 4 16 ts 1.4.1 KNOWN_DEFECT 5 ISONGraph-Semantic/2-draft 0 32

isongraph_ext-0.3.0/src/isongraph_ext/igdm/__init__.py

@@ -0,0 +1,13 @@
+"""IGDM/1 Datamatics (19-IGDM1-DESIGN.md)."""
+
+from ..igpv.records import EdgeAddress, NodeRef
+from ..igx.registry import DEFAULT_REGISTRY
+from .bind import bind, verify_and_admit
+from .errors import IGDMError
+from .payload import DatamaticsPayload, check_references, unrecognized_roles
+from .records import DEFAULT_LIMITS, EdgeHints, Group, LayoutHints, Limits, Member, NodeHints
+from .verify import DatamaticsVerification, verify
+
+__all__ = ["IGDMError", "DEFAULT_LIMITS", "EdgeHints", "Group", "LayoutHints", "Limits", "Member", "NodeHints", "EdgeAddress", "NodeRef",
+           "DEFAULT_REGISTRY", "DatamaticsPayload", "check_references", "unrecognized_roles", "DatamaticsVerification", "verify",
+           "bind", "verify_and_admit"]

isongraph_ext-0.3.0/src/isongraph_ext/igdm/__main__.py

@@ -0,0 +1,92 @@
+"""CLI (19 §4): verify -> 0/1/2, 64 on usage; one canonical ISON document per response."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from collections.abc import Mapping
+from pathlib import Path
+
+from ison_parser import Block, Document, dumps_canonical
+
+from ..igx.admit import AdmissionPolicy
+from ..igx.binding import ExtensionBinding
+from ..igx.errors import IGXError
+from .bind import verify_and_admit
+from .errors import IGDMError
+
+EX_USAGE = 64   # BSD sysexits: never collides with 2 (admission denied) or 1 (invalid binding/payload)
+
+
+class _Parser(argparse.ArgumentParser):
+    def error(self, message: str) -> None:  # type: ignore[override]
+        self.print_usage(sys.stderr)
+        sys.stderr.write(f"error: {message}\n")
+        raise SystemExit(EX_USAGE)
+
+
+def _utf8_streams() -> None:
+    """Output is UTF-8, LF-terminated ISON regardless of console locale or platform (same rule as the igx CLI)."""
+    for stream in (sys.stdout, sys.stderr):
+        reconfigure = getattr(stream, "reconfigure", None)
+        if reconfigure is not None:
+            reconfigure(encoding="utf-8", errors="strict", newline="\n")
+
+
+def _meta(name: str, row: dict) -> Block:
+    return Block("meta", name, list(row), [row])
+
+
+def _emit(blocks: list[Block]) -> None:
+    sys.stdout.write(dumps_canonical(Document(blocks=blocks)) + "\n")
+
+
+def _joined(items) -> str | None:
+    items = list(items)
+    return ",".join(items) if items else None
+
+
+def _kv(m: Mapping) -> str | None:
+    return _joined(f"{k}={v}" for k, v in m.items())
+
+
+def main(argv: list[str]) -> int:
+    _utf8_streams()
+    ap = _Parser(prog="python -m isongraph_ext.igdm")
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    v = sub.add_parser("verify")
+    v.add_argument("graph", type=Path)
+    v.add_argument("binding", type=Path)
+    v.add_argument("payload", type=Path)
+    v.add_argument("--allow-retired", action="store_true")
+    a = ap.parse_args(argv)
+    try:
+        graph, binding_bytes, payload_bytes = a.graph.read_bytes(), a.binding.read_bytes(), a.payload.read_bytes()
+    except OSError as e:
+        ap.print_usage(sys.stderr)
+        sys.stderr.write(f"error: {e}\n")
+        return EX_USAGE
+    try:
+        binding = ExtensionBinding.from_ison(binding_bytes)
+        result, dm, decision = verify_and_admit(payload_bytes, binding, graph, policy=AdmissionPolicy(allow_retired_baselines=a.allow_retired))
+    except (IGXError, IGDMError) as e:
+        _emit([_meta("error", {"code": e.code, "field": e.field, "detail": e.detail, "step": e.step})])
+        return 1
+    _emit([
+        _meta("verification", {
+            "binding_digest": result.binding_digest, "semantic_verification": result.semantic_verification,
+            "source_canonical": result.source_canonical, "source_semantic_eligibility": result.source_semantic_eligibility,
+            "source_semantic_reason": result.source_semantic_reason, "steps_passed": _joined(result.steps_passed),
+            "unrecognized_optional": _joined(c.extension for c in result.unrecognized_optional)}),
+        _meta("datamatics", {
+            "payload_sha256": dm.payload_sha256, "binding_digest": dm.binding_digest, "target_artifact_sha256": dm.target_artifact_sha256,
+            "object_resolution": dm.object_resolution, "unrecognized_roles": _joined(dm.unrecognized_roles),
+            "counts": _kv(dm.counts), "steps_passed": _joined(dm.steps_passed)}),
+        _meta("admission", {"admitted": decision.admitted, "code": decision.code, "step": decision.step,
+                            "receipt_posture": decision.receipt_posture, "reasons": _joined(decision.reasons)}),
+    ])
+    return 0 if decision.admitted else 2
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

isongraph_ext-0.3.0/src/isongraph_ext/igdm/bind.py

@@ -0,0 +1,49 @@
+"""Producer path and trustworthy consumer path (19 §4), mirroring igpv.bind."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping, Sequence
+
+from ..igx.admit import DEFAULT_POLICY, AdmissionPolicy, AdmissionResult, admit
+from ..igx.baselines import BASELINES, DEFAULT_BASELINE, Baseline
+from ..igx.bind import bind as igx_bind
+from ..igx.binding import Capability, Consumer, ExtensionBinding
+from ..igx.digest import sha256_hex
+from ..igx.registry import DEFAULT_REGISTRY, CapabilityRegistry
+from ..igx.source import as_bytes
+from ..igx.verify import VerificationResult
+from . import records as R
+from .errors import IGDMError
+from .payload import DatamaticsPayload
+from .verify import DatamaticsVerification, verify
+
+
+def bind(target: str | bytes, payload: DatamaticsPayload, *, requirement: str = "REQUIRED", serialization_profile: str,
+         producer_port: str, identity_claim: str, capabilities: Sequence[Capability] = (), consumer: Consumer | None = None,
+         baseline: Baseline = DEFAULT_BASELINE, registry: CapabilityRegistry = DEFAULT_REGISTRY,
+         policy: AdmissionPolicy = DEFAULT_POLICY, limits: R.Limits = R.DEFAULT_LIMITS) -> ExtensionBinding:
+    if requirement not in ("REQUIRED", "OPTIONAL"):
+        raise IGDMError("MALFORMED_DATAMATICS", "table.capabilities.igdm.requirement", "REQUIRED or OPTIONAL", "D1")
+    if any(c.extension == R.CAPABILITY for c in capabilities):
+        raise IGDMError("MALFORMED_DATAMATICS", "table.capabilities.igdm", "bind() adds the igdm row itself; do not pass one", "D1")
+    payload.check()
+    data = as_bytes(target)
+    actual = sha256_hex(data)
+    if payload.target_artifact_sha256 != actual:
+        raise IGDMError("TARGET_BINDING_MISMATCH", "meta.igdm.target_artifact_sha256", f"target bytes hash to {actual}", "D2")
+    if payload.target_serialization_profile != serialization_profile:
+        raise IGDMError("TARGET_BINDING_MISMATCH", "meta.igdm.target_serialization_profile",
+                        f"{payload.target_serialization_profile} != {serialization_profile}", "D2")
+    caps = tuple(capabilities) + (Capability(R.CAPABILITY, R.CAPABILITY_RANGE, requirement, payload.digest),)
+    binding = igx_bind(data, serialization_profile=serialization_profile, producer_port=producer_port, identity_claim=identity_claim,
+                       capabilities=caps, consumer=consumer, baseline=baseline, registry=registry, policy=policy)
+    verify(payload, binding, data, limits=limits, baselines={**BASELINES, baseline.core_commit: baseline}, registry=registry)
+    return binding
+
+
+def verify_and_admit(payload: str | bytes | DatamaticsPayload, binding: ExtensionBinding, target: str | bytes, *,
+                     limits: R.Limits = R.DEFAULT_LIMITS, baselines: Mapping[str, Baseline] = BASELINES,
+                     registry: CapabilityRegistry = DEFAULT_REGISTRY, policy: AdmissionPolicy = DEFAULT_POLICY
+                     ) -> tuple[VerificationResult, DatamaticsVerification, AdmissionResult]:
+    result, dm = verify(payload, binding, target, limits=limits, baselines=baselines, registry=registry)
+    return result, dm, admit(binding, result, policy=policy, baselines=baselines)

isongraph_ext-0.3.0/src/isongraph_ext/igdm/errors.py

@@ -0,0 +1,12 @@
+"""The one exception type IGDM/1 raises (19 §3.1). Admission denials are the binding's results, not exceptions."""
+
+from __future__ import annotations
+
+
+class IGDMError(Exception):
+    def __init__(self, code: str, field: str, detail: str, step: str) -> None:
+        super().__init__(f"{step} {code} {field}: {detail}")
+        self.code = code
+        self.field = field
+        self.detail = detail
+        self.step = step