jep-runtime 0.1.1__py3-none-any.whl

jep_runtime/__init__.py

@@ -0,0 +1,21 @@
+"""JEP Reference Runtime.
+
+Executable, portable accountability runtime for Judgment, Delegation,
+Termination, and Verification events.
+"""
+
+from jep_runtime.core.event import EventType, JEPEvent
+from jep_runtime.events.factory import create_event
+from jep_runtime.canonicalization.json import canonicalize_event, compute_event_hash
+from jep_runtime.verification.runtime import verify_event, verify_chain, verify_replay
+
+__all__ = [
+    "EventType",
+    "JEPEvent",
+    "create_event",
+    "canonicalize_event",
+    "compute_event_hash",
+    "verify_event",
+    "verify_chain",
+    "verify_replay",
+]

jep_runtime/archive/jsonl.py

@@ -0,0 +1,78 @@
+"""Append-only JSONL archive runtime."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from filelock import FileLock
+from jep_runtime.canonicalization.json import compute_event_hash
+from typing import Iterable
+
+from jep_runtime.core.event import JEPEvent
+from jep_runtime.replay.engine import replay_events
+from jep_runtime.verification.runtime import VerificationResult, verify_chain
+
+
+class JSONLArchive:
+    def __init__(self, path: str | Path):
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = FileLock(str(self.path) + ".lock", timeout=10)
+
+    def append_event(self, event: JEPEvent) -> None:
+        with self._lock:
+            existing = self.import_archive()
+            previous = None
+            ids = set()
+            for candidate in [*existing, event]:
+                if candidate.event_hash != compute_event_hash(candidate) or candidate.previous_event_hash != previous:
+                    raise ValueError("archive hash mismatch or stale previous_event_hash")
+                if candidate.event_id in ids:
+                    raise ValueError("duplicate event identifier")
+                ids.add(candidate.event_id)
+                previous = candidate.event_hash
+            with self.path.open("a", encoding="utf-8") as handle:
+                handle.write(json.dumps(event.to_dict(), sort_keys=True, separators=(",", ":"), ensure_ascii=False, allow_nan=False) + "\n")
+
+    def import_archive(self) -> list[JEPEvent]:
+        with self._lock:
+            return self._read_archive()
+
+    def _read_archive(self) -> list[JEPEvent]:
+        if not self.path.exists():
+            return []
+        events: list[JEPEvent] = []
+        with self.path.open("r", encoding="utf-8") as handle:
+            for line in handle:
+                if line.strip():
+                    events.append(JEPEvent.from_dict(json.loads(line)))
+        return events
+
+    def export_archive(self) -> str:
+        return self.path.read_text(encoding="utf-8") if self.path.exists() else ""
+
+    def verify_archive(self) -> VerificationResult:
+        return verify_chain(self.import_archive())
+
+    def replay_archive(self) -> dict:
+        return replay_events(self.import_archive())
+
+
+def append_event(path: str | Path, event: JEPEvent) -> None:
+    JSONLArchive(path).append_event(event)
+
+
+def import_archive(path: str | Path) -> list[JEPEvent]:
+    return JSONLArchive(path).import_archive()
+
+
+def export_archive(path: str | Path) -> str:
+    return JSONLArchive(path).export_archive()
+
+
+def verify_archive(path: str | Path) -> VerificationResult:
+    return JSONLArchive(path).verify_archive()
+
+
+def replay_archive(path: str | Path) -> dict:
+    return JSONLArchive(path).replay_archive()

jep_runtime/canonicalization/json.py

@@ -0,0 +1,39 @@
+"""Deterministic JSON canonicalization and SHA-256 event hashing."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import unicodedata
+from typing import Any, Mapping
+
+from jep_runtime.core.event import JEPEvent
+
+
+def _normalize(value: Any) -> Any:
+    if isinstance(value, str):
+        return unicodedata.normalize("NFC", value)
+    if isinstance(value, Mapping):
+        return {unicodedata.normalize("NFC", str(k)): _normalize(v) for k, v in value.items()}
+    if isinstance(value, list | tuple):
+        return [_normalize(v) for v in value]
+    return value
+
+
+def canonicalize_event(event: JEPEvent | Mapping[str, Any], *, include_hash: bool = False) -> bytes:
+    """Canonicalize an event as UTF-8 JSON with stable ordering and no whitespace."""
+
+    if isinstance(event, JEPEvent):
+        data = event.to_dict(include_hash=include_hash)
+    else:
+        data = dict(event)
+        if not include_hash:
+            data.pop("event_hash", None)
+    normalized = _normalize(data)
+    return json.dumps(normalized, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def compute_event_hash(event: JEPEvent | Mapping[str, Any]) -> str:
+    """Compute a platform-stable SHA-256 hash over canonical event JSON."""
+
+    return hashlib.sha256(canonicalize_event(event, include_hash=False)).hexdigest()

jep_runtime/cli/main.py

@@ -0,0 +1,97 @@
+"""Command line interface for the JEP Reference Runtime."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+from jep_runtime.archive.jsonl import JSONLArchive
+from jep_runtime.conformance.runtime import run_conformance
+from jep_runtime.core.event import JEPEvent
+from jep_runtime.events.factory import create_event
+from jep_runtime.replay.engine import replay_events
+from jep_runtime.verification.runtime import verify_event
+
+
+def _load_event(path: str) -> JEPEvent:
+    with open(path, "r", encoding="utf-8") as handle:
+        return JEPEvent.from_dict(json.load(handle))
+
+
+def _print(data: object) -> None:
+    print(json.dumps(data, indent=2, sort_keys=True, ensure_ascii=False))
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="jep", description="JEP Reference Runtime CLI")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    create = sub.add_parser("create-event", help="Create and hash a J/D/T/V event")
+    create.add_argument("--type", required=True, choices=["J", "D", "T", "V"])
+    create.add_argument("--actor", required=True)
+    create.add_argument("--subject", required=True)
+    create.add_argument("--agent-id")
+    create.add_argument("--session-id")
+    create.add_argument("--scope-json", default="{}")
+    create.add_argument("--intent-json", default="{}")
+    create.add_argument("--justification", default="")
+    create.add_argument("--previous-event-hash")
+    create.add_argument("--profile", default="mock")
+    create.add_argument("--credential-reference")
+    create.add_argument("--archive", help="Append created event to JSONL archive")
+
+    verify = sub.add_parser("verify", help="Verify one event JSON file")
+    verify.add_argument("event")
+
+    replay = sub.add_parser("replay", help="Replay a JSONL archive")
+    replay.add_argument("archive")
+
+    archive_verify = sub.add_parser("archive-verify", help="Verify an append-only JSONL archive")
+    archive_verify.add_argument("archive")
+
+    sub.add_parser("conformance-test", help="Run conformance suite and emit vectors/report")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    if args.command == "create-event":
+        event = create_event(
+            args.type,
+            actor=args.actor,
+            subject=args.subject,
+            agent_id=args.agent_id,
+            session_id=args.session_id,
+            authority_scope=json.loads(args.scope_json),
+            intent=json.loads(args.intent_json),
+            justification=args.justification,
+            previous_event_hash=args.previous_event_hash,
+            profile=args.profile,
+            credential_reference=args.credential_reference,
+        )
+        if args.archive:
+            JSONLArchive(args.archive).append_event(event)
+        _print(event.to_dict())
+        return 0
+    if args.command == "verify":
+        result = verify_event(_load_event(args.event))
+        _print({"valid": result.valid, "errors": list(result.errors)})
+        return 0 if result.valid else 1
+    if args.command == "replay":
+        archive = JSONLArchive(args.archive)
+        _print(archive.replay_archive())
+        return 0 if archive.verify_archive().valid else 1
+    if args.command == "archive-verify":
+        result = JSONLArchive(args.archive).verify_archive()
+        _print({"valid": result.valid, "errors": list(result.errors)})
+        return 0 if result.valid else 1
+    if args.command == "conformance-test":
+        report = run_conformance()
+        _print(report)
+        return 0 if report["passed"] else 1
+    return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

jep_runtime/conformance/runtime.py

@@ -0,0 +1,71 @@
+"""Conformance vectors and checks for interoperable JEP runtimes."""
+
+from __future__ import annotations
+
+from jep_runtime.canonicalization.json import canonicalize_event, compute_event_hash
+from jep_runtime.core.event import EventType
+from jep_runtime.delegation.runtime import delegate_authority, verify_delegation_chain
+from jep_runtime.events.factory import create_event
+from jep_runtime.profiles.adapter import MockProfileAdapter
+from jep_runtime.replay.engine import replay_events
+from jep_runtime.verification.runtime import verify_chain, verify_event
+
+
+def generate_test_vectors() -> dict:
+    adapter = MockProfileAdapter()
+    ref = adapter.issue_reference("human:alice", "mock")
+    root = create_event(
+        EventType.JUDGMENT,
+        actor="human:alice",
+        subject="agent:planner",
+        agent_id="agent:planner",
+        session_id="session:conformance",
+        authority_scope={"actions": ["read", "summarize"], "resources": ["repo:jep"], "valid_until": 4102444800},
+        intent={"task": "summarize current JEP draft"},
+        justification="human delegated bounded judgment authority",
+        timestamp=1700000000,
+        nonce="00000000-0000-4000-8000-000000000001",
+        profile="mock",
+        credential_reference=ref,
+    )
+    child = delegate_authority(root, delegatee="agent:worker", agent_id="agent:worker", scope={"actions": ["read"], "resources": ["repo:jep"], "valid_until": 4102444700})
+    verify = create_event(
+        EventType.VERIFICATION,
+        actor="verifier:local",
+        subject=child.subject,
+        agent_id=child.agent_id,
+        session_id=root.session_id,
+        delegation_chain=child.delegation_chain,
+        authority_scope=child.authority_scope,
+        intent={"target_event_hash": child.event_hash, "result": "VALID"},
+        previous_event_hash=child.event_hash,
+        timestamp=child.timestamp + 1,
+        nonce="00000000-0000-4000-8000-000000000003",
+        profile="mock",
+        credential_reference=ref,
+    )
+    return {
+        "events": [root.to_dict(), child.to_dict(), verify.to_dict()],
+        "canonical_root": canonicalize_event(root).decode("utf-8"),
+        "root_hash": root.event_hash,
+    }
+
+
+def run_conformance() -> dict:
+    vectors = generate_test_vectors()
+    reconstructed = [__import__("jep_runtime.core.event", fromlist=["JEPEvent"]).JEPEvent.from_dict(e) for e in vectors["events"]]
+    matrix = {
+        "canonicalization": canonicalize_event(reconstructed[0]).decode("utf-8") == vectors["canonical_root"],
+        "deterministic_hashing": compute_event_hash(reconstructed[0]) == vectors["root_hash"],
+        "delegation_semantics": verify_delegation_chain(reconstructed[:2])[0],
+        "verification_semantics": verify_event(reconstructed[2]).valid,
+        "profile_compatibility": verify_chain(reconstructed).valid,
+        "replay_correctness": replay_events(reconstructed)["valid"],
+    }
+    return {
+        "passed": all(matrix.values()),
+        "matrix": matrix,
+        "test_vectors": vectors,
+        "signed_vectors": {"mode": "mock", "signature": "mock-signature-over-canonical-vectors"},
+        "compatibility_report": "reference runtime uses stable UTF-8 sorted JSON, SHA-256, JSONL archives, and neutral mock profiles",
+    }

jep_runtime/core/event.py

@@ -0,0 +1,163 @@
+"""Core immutable event model for the JEP Reference Runtime."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field, replace
+from enum import Enum
+from types import MappingProxyType
+from typing import Any, Mapping
+import copy
+import time
+import uuid
+
+
+class EventType(str, Enum):
+    """JEP judgment event primitives."""
+
+    JUDGMENT = "J"
+    DELEGATION = "D"
+    TERMINATION = "T"
+    VERIFICATION = "V"
+
+
+_REQUIRED_SCHEMA_FIELDS = [
+    "event_id",
+    "event_type",
+    "actor",
+    "subject",
+    "agent_id",
+    "session_id",
+    "delegation_chain",
+    "authority_scope",
+    "intent",
+    "justification",
+    "previous_event_hash",
+    "event_hash",
+    "nonce",
+    "timestamp",
+    "profile",
+    "credential_reference",
+    "verification_state",
+]
+
+
+def _freeze(value: Any) -> Any:
+    if isinstance(value, Mapping):
+        return MappingProxyType({str(k): _freeze(v) for k, v in value.items()})
+    if isinstance(value, list | tuple):
+        return tuple(_freeze(v) for v in value)
+    return value
+
+
+def _thaw(value: Any) -> Any:
+    if isinstance(value, Mapping):
+        return {k: _thaw(v) for k, v in value.items()}
+    if isinstance(value, tuple):
+        return [_thaw(v) for v in value]
+    return copy.deepcopy(value)
+
+
+@dataclass(frozen=True, slots=True)
+class JEPEvent:
+    """Immutable JEP event after hash assignment.
+
+    The runtime keeps J/D/T/V semantics minimal: events are typed evidence
+    records, linked by previous_event_hash, scoped by authority_scope, and
+    replayable through nonce, timestamp, profile, and delegation_chain.
+    """
+
+    event_id: str
+    event_type: EventType | str
+    actor: str
+    subject: str
+    agent_id: str | None
+    session_id: str
+    delegation_chain: tuple[str, ...] = field(default_factory=tuple)
+    authority_scope: Mapping[str, Any] = field(default_factory=dict)
+    intent: Mapping[str, Any] = field(default_factory=dict)
+    justification: str = ""
+    previous_event_hash: str | None = None
+    event_hash: str | None = None
+    nonce: str = field(default_factory=lambda: str(uuid.uuid4()))
+    timestamp: int = field(default_factory=lambda: int(time.time()))
+    profile: str = "mock"
+    credential_reference: str | None = None
+    verification_state: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "event_type", EventType(self.event_type))
+        object.__setattr__(self, "delegation_chain", tuple(self.delegation_chain))
+        object.__setattr__(self, "authority_scope", _freeze(self.authority_scope))
+        object.__setattr__(self, "intent", _freeze(self.intent))
+        object.__setattr__(self, "verification_state", _freeze(self.verification_state))
+
+    def to_dict(self, *, include_hash: bool = True) -> dict[str, Any]:
+        """Return a deterministic dictionary representation."""
+
+        data = {
+            "event_id": self.event_id,
+            "event_type": self.event_type.value,
+            "actor": self.actor,
+            "subject": self.subject,
+            "agent_id": self.agent_id,
+            "session_id": self.session_id,
+            "delegation_chain": list(self.delegation_chain),
+            "authority_scope": _thaw(self.authority_scope),
+            "intent": _thaw(self.intent),
+            "justification": self.justification,
+            "previous_event_hash": self.previous_event_hash,
+            "event_hash": self.event_hash if include_hash else None,
+            "nonce": self.nonce,
+            "timestamp": self.timestamp,
+            "profile": self.profile,
+            "credential_reference": self.credential_reference,
+            "verification_state": _thaw(self.verification_state),
+        }
+        if not include_hash:
+            data.pop("event_hash")
+        return data
+
+    @classmethod
+    def from_dict(cls, data: Mapping[str, Any]) -> "JEPEvent":
+        return cls(**{field_name: data.get(field_name) for field_name in _REQUIRED_SCHEMA_FIELDS})
+
+    def with_hash(self, event_hash: str) -> "JEPEvent":
+        """Return a hashed immutable event.
+
+        Existing event_hash values cannot be replaced, making post-hash objects
+        append-only evidence records rather than mutable workflow state.
+        """
+
+        if self.event_hash and self.event_hash != event_hash:
+            raise ValueError("event_hash is immutable once assigned")
+        return replace(self, event_hash=event_hash)
+
+    @staticmethod
+    def json_schema() -> dict[str, Any]:
+        return {
+            "$schema": "https://json-schema.org/draft/2020-12/schema",
+            "$id": "https://example.org/jep-runtime/schemas/jep-event.schema.json",
+            "title": "JEP Reference Runtime Event",
+            "type": "object",
+            "required": _REQUIRED_SCHEMA_FIELDS,
+            "additionalProperties": False,
+            "properties": {
+                "event_id": {"type": "string"},
+                "event_type": {"enum": ["J", "D", "T", "V"]},
+                "actor": {"type": "string"},
+                "subject": {"type": "string"},
+                "agent_id": {"type": ["string", "null"]},
+                "session_id": {"type": "string"},
+                "delegation_chain": {"type": "array", "items": {"type": "string"}},
+                "authority_scope": {"type": "object"},
+                "intent": {"type": "object"},
+                "justification": {"type": "string"},
+                "previous_event_hash": {"type": ["string", "null"]},
+                "event_hash": {"type": ["string", "null"]},
+                "nonce": {"type": "string"},
+                "timestamp": {"type": "integer"},
+                "profile": {"type": "string"},
+                "credential_reference": {"type": ["string", "null"]},
+                "verification_state": {"type": "object"},
+            },
+        }

jep_runtime/core/version.py

@@ -0,0 +1,13 @@
+"""Protocol and runtime version metadata for the JEP reference runtime."""
+
+JEP_DRAFT_VERSION = "jep-v06"
+JEP_DRAFT_REFERENCE = "Judgment Event Protocol Internet-Draft v06"
+JEP_DRAFT_REPOSITORY = "jep-v06"
+RUNTIME_VERSION = "0.1.1"
+
+__all__ = [
+    "JEP_DRAFT_VERSION",
+    "JEP_DRAFT_REFERENCE",
+    "JEP_DRAFT_REPOSITORY",
+    "RUNTIME_VERSION",
+]

jep_runtime/delegation/runtime.py

@@ -0,0 +1,137 @@
+"""Delegation authority propagation runtime."""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import Any, Iterable, Mapping
+
+from jep_runtime.core.event import EventType, JEPEvent
+from jep_runtime.events.factory import create_event
+
+
+def _scope_items(scope: Mapping[str, Any]) -> dict[str, Any]:
+    return dict(scope or {})
+
+
+def validate_scope(
+    parent_scope: Mapping[str, Any],
+    child_scope: Mapping[str, Any],
+    *,
+    now: int | None = None,
+) -> bool:
+    """Return true when child_scope is bounded by parent_scope."""
+
+    if not isinstance(parent_scope, Mapping) or not isinstance(child_scope, Mapping):
+        return False
+    parent, child = dict(parent_scope), dict(child_scope)
+    # This local runtime profile grants only explicitly listed capabilities.
+    for dimension in ("actions", "resources"):
+        parent_items, child_items = parent.get(dimension, []), child.get(dimension, [])
+        if not isinstance(parent_items, (list, tuple)) or not isinstance(
+            child_items, (list, tuple)
+        ):
+            return False
+        if not all(isinstance(item, str) for item in [*parent_items, *child_items]):
+            return False
+        if not set(child_items).issubset(parent_items):
+            return False
+    # Unknown constraints may be preserved but never added, changed, or dropped.
+    for key in (parent.keys() | child.keys()) - {"actions", "resources", "valid_until"}:
+        if key not in parent or key not in child or child[key] != parent[key]:
+            return False
+    parent_until, child_until = parent.get("valid_until"), child.get("valid_until")
+    if any(
+        value is not None and type(value) is not int
+        for value in (parent_until, child_until)
+    ):
+        return False
+    if parent_until is not None and (child_until is None or child_until > parent_until):
+        return False
+    effective_now = int(datetime.now(timezone.utc).timestamp()) if now is None else now
+    if type(effective_now) is not int:
+        return False
+    return all(
+        value is None or effective_now < value for value in (parent_until, child_until)
+    )
+
+
+def delegate_authority(
+    parent_event: JEPEvent,
+    *,
+    delegatee: str,
+    agent_id: str | None,
+    scope: Mapping[str, Any],
+    justification: str = "",
+) -> JEPEvent:
+    """Create a scoped delegation event from parent authority to a delegatee."""
+
+    if not validate_scope(
+        parent_event.authority_scope, scope, now=parent_event.timestamp + 1
+    ):
+        raise ValueError("delegation scope exceeds or outlives parent authority")
+    chain = [*parent_event.delegation_chain, parent_event.event_hash or ""]
+    return create_event(
+        EventType.DELEGATION,
+        actor=parent_event.subject,
+        subject=delegatee,
+        agent_id=agent_id,
+        session_id=parent_event.session_id,
+        delegation_chain=chain,
+        authority_scope=scope,
+        intent={"delegatee": delegatee, "parent_event_hash": parent_event.event_hash},
+        justification=justification,
+        previous_event_hash=parent_event.event_hash,
+        profile=parent_event.profile,
+        credential_reference=parent_event.credential_reference,
+        timestamp=parent_event.timestamp + 1,
+    )
+
+
+def verify_delegation_chain(events: Iterable[JEPEvent]) -> tuple[bool, list[str]]:
+    """Verify hash lineage and bounded delegation scopes for a sequence."""
+
+    problems: list[str] = []
+    previous: JEPEvent | None = None
+    seen_hashes: set[str] = set()
+    by_hash: dict[str, JEPEvent] = {}
+    seen_ids: set[str] = set()
+    for event in events:
+        if event.event_id in seen_ids:
+            problems.append(f"duplicate event id: {event.event_id}")
+        seen_ids.add(event.event_id)
+        if event.event_hash in seen_hashes:
+            problems.append(f"duplicate event hash: {event.event_hash}")
+        if event.event_hash:
+            seen_hashes.add(event.event_hash)
+        if previous:
+            if event.previous_event_hash != previous.event_hash:
+                problems.append(f"hash continuity break at {event.event_id}")
+
+        if event.event_type == EventType.DELEGATION:
+            parent_hash = event.intent.get("parent_event_hash")
+            parent = by_hash.get(parent_hash) if isinstance(parent_hash, str) else None
+            if parent is None:
+                problems.append(f"unresolved delegation parent at {event.event_id}")
+            else:
+                if (
+                    event.actor != parent.subject
+                    or event.session_id != parent.session_id
+                ):
+                    problems.append(
+                        f"delegation actor/session mismatch at {event.event_id}"
+                    )
+                if event.timestamp < parent.timestamp:
+                    problems.append(f"delegation precedes parent at {event.event_id}")
+                if event.delegation_chain != (
+                    *parent.delegation_chain,
+                    parent.event_hash,
+                ):
+                    problems.append(f"delegation ancestry mismatch at {event.event_id}")
+                if not validate_scope(
+                    parent.authority_scope, event.authority_scope, now=event.timestamp
+                ):
+                    problems.append(f"scope violation at {event.event_id}")
+        if event.event_hash:
+            by_hash[event.event_hash] = event
+        previous = event
+    return not problems, problems

jep_runtime/events/factory.py

@@ -0,0 +1,48 @@
+"""Factory helpers for creating hashed JEP events."""
+
+from __future__ import annotations
+
+from typing import Any, Mapping
+import uuid
+
+from jep_runtime.canonicalization.json import compute_event_hash
+from jep_runtime.core.event import EventType, JEPEvent
+
+
+def create_event(
+    event_type: EventType | str,
+    *,
+    actor: str,
+    subject: str,
+    agent_id: str | None = None,
+    session_id: str | None = None,
+    delegation_chain: list[str] | tuple[str, ...] | None = None,
+    authority_scope: Mapping[str, Any] | None = None,
+    intent: Mapping[str, Any] | None = None,
+    justification: str = "",
+    previous_event_hash: str | None = None,
+    nonce: str | None = None,
+    timestamp: int | None = None,
+    profile: str = "mock",
+    credential_reference: str | None = None,
+    verification_state: Mapping[str, Any] | None = None,
+) -> JEPEvent:
+    event = JEPEvent(
+        event_id=str(uuid.uuid4()),
+        event_type=event_type,
+        actor=actor,
+        subject=subject,
+        agent_id=agent_id,
+        session_id=session_id or str(uuid.uuid4()),
+        delegation_chain=tuple(delegation_chain or ()),
+        authority_scope=dict(authority_scope or {}),
+        intent=dict(intent or {}),
+        justification=justification,
+        previous_event_hash=previous_event_hash,
+        nonce=nonce or str(uuid.uuid4()),
+        timestamp=timestamp or 0,
+        profile=profile,
+        credential_reference=credential_reference,
+        verification_state=dict(verification_state or {}),
+    )
+    return event.with_hash(compute_event_hash(event))

jep_runtime/profiles/adapter.py

@@ -0,0 +1,38 @@
+"""Identity-neutral, credential-neutral profile adapter interface."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Protocol, Mapping
+
+
+class ProfileAdapter(Protocol):
+    def issue_reference(self, actor: str, profile: str, claims: Mapping[str, Any] | None = None) -> str: ...
+    def verify_reference(self, reference: str, profile: str) -> bool: ...
+    def resolve_identity(self, reference: str) -> str: ...
+    def validate_authority(self, reference: str, authority_scope: Mapping[str, Any]) -> bool: ...
+
+
+@dataclass
+class MockProfileAdapter:
+    """Reference profile adapter for OAuth/OIDC, X509, DID/VC, and Local IAM labels.
+
+    It performs deterministic reference checks only; it is not a production
+    credential verifier and intentionally hardcodes no identity provider.
+    """
+
+    supported_profiles: tuple[str, ...] = ("mock", "oauth-oidc", "x509", "did-vc", "local-iam")
+
+    def issue_reference(self, actor: str, profile: str = "mock", claims: Mapping[str, Any] | None = None) -> str:
+        if profile not in self.supported_profiles:
+            raise ValueError(f"unsupported profile: {profile}")
+        return f"jep-ref:{profile}:{actor}"
+
+    def verify_reference(self, reference: str | None, profile: str) -> bool:
+        return bool(reference and profile in self.supported_profiles and reference.startswith(f"jep-ref:{profile}:"))
+
+    def resolve_identity(self, reference: str) -> str:
+        return reference.split(":", 2)[-1]
+
+    def validate_authority(self, reference: str, authority_scope: Mapping[str, Any]) -> bool:
+        return bool(reference and isinstance(authority_scope, Mapping))

jep_runtime/replay/engine.py

@@ -0,0 +1,42 @@
+"""Replay engine that reconstructs lineage, authority, and termination state."""
+
+from __future__ import annotations
+
+from jep_runtime.core.event import EventType, JEPEvent
+from jep_runtime.verification.runtime import verify_chain
+
+
+def replay_events(events: list[JEPEvent]) -> dict:
+    verification = verify_chain(events)
+    nodes = []
+    edges = []
+    authority_lineage: dict[str, dict] = {}
+    terminated: set[str] = set()
+    for event in events:
+        nodes.append({
+            "event_id": event.event_id,
+            "event_hash": event.event_hash,
+            "event_type": event.event_type.value,
+            "actor": event.actor,
+            "subject": event.subject,
+            "scope": dict(event.authority_scope),
+        })
+        if event.previous_event_hash:
+            edges.append({"from": event.previous_event_hash, "to": event.event_hash, "type": "hash_chain"})
+        for parent in event.delegation_chain:
+            edges.append({"from": parent, "to": event.event_hash, "type": "delegation"})
+        if event.event_type in (EventType.JUDGMENT, EventType.DELEGATION):
+            authority_lineage[event.subject] = {
+                "event_hash": event.event_hash,
+                "scope": dict(event.authority_scope),
+                "delegation_chain": list(event.delegation_chain),
+            }
+        if event.event_type == EventType.TERMINATION:
+            terminated.add(event.subject)
+    return {
+        "valid": verification.valid,
+        "errors": list(verification.errors),
+        "lineage_graph": {"nodes": nodes, "edges": edges},
+        "authority_lineage": authority_lineage,
+        "termination_state": sorted(terminated),
+    }

jep_runtime/verification/runtime.py

@@ -0,0 +1,77 @@
+"""Replayable verification runtime for JEP event chains."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Iterable
+
+from jep_runtime.canonicalization.json import compute_event_hash
+from jep_runtime.core.event import JEPEvent
+from jep_runtime.delegation.runtime import verify_delegation_chain
+from jep_runtime.profiles.adapter import MockProfileAdapter, ProfileAdapter
+
+
+@dataclass(frozen=True)
+class VerificationResult:
+    valid: bool
+    errors: tuple[str, ...] = ()
+    profile_checked: bool = False
+
+
+def verify_profile(event: JEPEvent, adapter: ProfileAdapter | None = None) -> VerificationResult:
+    if (adapter is None or isinstance(adapter, MockProfileAdapter)) and event.profile != "mock":
+        return VerificationResult(False, (f"no verifier configured for profile {event.profile}",))
+    profile_adapter = adapter or MockProfileAdapter()
+    if event.credential_reference is None:
+        if event.profile == "mock":
+            return VerificationResult(True)
+        return VerificationResult(False, ("credential reference is required",))
+    if not profile_adapter.verify_reference(event.credential_reference, event.profile):
+        return VerificationResult(False, (f"invalid credential reference for profile {event.profile}",))
+    if not profile_adapter.validate_authority(event.credential_reference, event.authority_scope):
+        return VerificationResult(False, ("profile adapter rejected authority scope",))
+    return VerificationResult(True, profile_checked=not isinstance(profile_adapter, MockProfileAdapter))
+
+
+def verify_event(event: JEPEvent, *, adapter: ProfileAdapter | None = None) -> VerificationResult:
+    errors: list[str] = []
+    if compute_event_hash(event) != event.event_hash:
+        errors.append("event_hash mismatch")
+    if not event.nonce:
+        errors.append("missing nonce")
+    if type(event.timestamp) is not int:
+        errors.append("timestamp must be an integer")
+    profile_result = verify_profile(event, adapter)
+    errors.extend(profile_result.errors)
+    return VerificationResult(not errors, tuple(errors), profile_result.profile_checked)
+
+
+def verify_chain(events: Iterable[JEPEvent], *, adapter: ProfileAdapter | None = None) -> VerificationResult:
+    errors: list[str] = []
+    materialized = list(events)
+    nonces: set[str] = set()
+    previous_hash: str | None = None
+    for index, event in enumerate(materialized):
+        result = verify_event(event, adapter=adapter)
+        errors.extend(f"{event.event_id}: {error}" for error in result.errors)
+        if event.nonce in nonces:
+            errors.append(f"{event.event_id}: duplicate nonce")
+        nonces.add(event.nonce)
+        if index == 0:
+            if event.previous_event_hash is not None:
+                errors.append(f"{event.event_id}: first event must not reference previous_event_hash")
+        elif event.previous_event_hash != previous_hash:
+            errors.append(f"{event.event_id}: previous_event_hash does not match prior event_hash")
+        previous_hash = event.event_hash
+    ok, delegation_errors = verify_delegation_chain(materialized)
+    if not ok:
+        errors.extend(delegation_errors)
+    return VerificationResult(not errors, tuple(errors))
+
+
+def detect_tampering(events: Iterable[JEPEvent]) -> list[str]:
+    return list(verify_chain(events).errors)
+
+
+def verify_replay(events: Iterable[JEPEvent]) -> VerificationResult:
+    return verify_chain(events)

jep_runtime-0.1.1.dist-info/METADATA

@@ -0,0 +1,150 @@
+Metadata-Version: 2.4
+Name: jep-runtime
+Version: 0.1.1
+Summary: Reference runtime for Judgment Event Protocol executable accountability semantics
+Author: JEP Runtime Contributors
+License: MIT
+Keywords: JEP,accountability,protocol,runtime,verification
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: filelock>=3.12
+
+# JEP Reference Runtime
+
+`jep-runtime` is a runnable reference implementation for the Judgment Event Protocol (JEP). It turns the current JEP Internet-Draft primitives — Judgment (`J`), Delegation (`D`), Termination (`T`), and Verification (`V`) — into executable accountability semantics: create an event, canonicalize it, hash it, chain it, archive it, replay it, and verify it across neutral profile adapters.
+
+This repository is intentionally **not** an agent framework, workflow orchestrator, blockchain, consensus layer, payment executor, or production security system. Mock signatures and mock credential references are provided so protocol semantics can be tested before deployment-specific cryptography is plugged in.
+
+## Architecture
+
+```text
++-------------------+      +------------------------+      +------------------+
+| Event Runtime     | ---> | Canonicalization       | ---> | SHA-256 Hashing  |
+| J / D / T / V     |      | UTF-8 sorted JSON      |      | event_hash       |
++---------+---------+      +-----------+------------+      +---------+--------+
+          |                            |                             |
+          v                            v                             v
++-------------------+      +------------------------+      +------------------+
+| Delegation        | ---> | Append-only Archive    | ---> | Verification     |
+| scoped authority  |      | JSONL import/export    |      | chain/replay     |
++---------+---------+      +-----------+------------+      +---------+--------+
+          |                            |                             |
+          v                            v                             v
++-------------------+      +------------------------+      +------------------+
+| Profile Adapters  | ---> | Replay Engine          | ---> | Conformance      |
+| OAuth/X509/DID/IAM|      | lineage graph/state    |      | vectors/report   |
++-------------------+      +------------------------+      +------------------+
+```
+
+## Runtime data flow
+
+1. A caller creates a `JEPEvent` with the required core fields.
+2. The event is canonicalized as normalized UTF-8 JSON with stable field ordering and no insignificant whitespace.
+3. `event_hash = SHA256(canonical_event_without_event_hash)` is assigned once; changing a hashed event requires creating a new event.
+4. New events reference `previous_event_hash`, producing an append-only event chain.
+5. Delegation events carry bounded `authority_scope` and `delegation_chain` entries so authority lineage can be replayed.
+6. JSONL archives append one canonical event record per line.
+7. Verification recomputes hashes, validates nonce uniqueness, checks hash continuity, validates delegation scope, and invokes the configured neutral profile adapter.
+
+## Replay flow
+
+```text
+archive.jsonl
+   |
+   v
+import events -> verify entire chain -> replay J/D/T/V semantics
+   |                  |                    |
+   |                  |                    +--> termination_state
+   |                  +--> tamper/nonce/profile/delegation errors
+   +--> lineage_graph: hash-chain edges + delegation edges
+```
+
+Run it with:
+
+```bash
+jep replay archive.jsonl
+```
+
+The replay output is a portable event lineage graph plus authority and termination state. It is evidence reconstruction, not workflow execution.
+
+## CLI
+
+```bash
+jep create-event --type J --actor human:alice --subject agent:planner \
+  --agent-id agent:planner \
+  --scope-json '{"actions":["read"],"resources":["repo:jep"]}' \
+  --intent-json '{"task":"summarize JEP"}' \
+  --archive archive.jsonl
+
+jep verify event.json
+jep archive-verify archive.jsonl
+jep replay archive.jsonl
+jep conformance-test
+```
+
+## Conformance matrix
+
+| Capability | Runtime check |
+| --- | --- |
+| Canonicalization | Stable UTF-8 JSON with sorted keys and normalized strings |
+| Deterministic hashing | SHA-256 over canonical event without `event_hash` |
+| Delegation semantics | Parent/child scope and expiration checks |
+| Verification semantics | Hash, nonce, timestamp, profile, and chain integrity checks |
+| Profile compatibility | Neutral `ProfileAdapter` contract with mock OAuth/OIDC, X509, DID/VC, Local IAM labels |
+| Replay correctness | Archive replay must re-verify the full chain and emit lineage graph/state |
+
+`jep conformance-test` emits test vectors, mock signed vectors, and a compatibility report.
+
+## Correspondence with the JEP draft
+
+| Draft primitive / concept | Runtime implementation |
+| --- | --- |
+| `J` Judgment | `EventType.JUDGMENT` and `create_event("J", ...)` |
+| `D` Delegation | `delegate_authority()`, scoped delegation events, `verify_delegation_chain()` |
+| `T` Termination | `EventType.TERMINATION`, replayed into `termination_state` |
+| `V` Verification | `verify_event()`, `verify_chain()`, `verify_replay()`, verification events |
+| Replay protection | Required `nonce` and duplicate nonce validation |
+| Signed/verifiable event format | Immutable hashed event model plus mock profile references |
+| Optional profiles | `ProfileAdapter` interface; provider-neutral mock adapter |
+| Append-only receipts | JSONL archive with chain verification on replay |
+
+## Repository structure
+
+```text
+jep_runtime/
+  core/                 # immutable event model and JSON schema generation
+  events/               # event factories
+  canonicalization/     # deterministic JSON + SHA-256 hashing
+  delegation/           # authority propagation and scope validation
+  verification/         # event, chain, replay, tamper, profile verification
+  profiles/             # provider-neutral profile adapter interface and mock adapter
+  archive/              # append-only JSONL archive runtime
+  replay/               # lineage graph and termination replay
+  conformance/          # conformance vectors and matrix
+  cli/                  # jep command line entry point
+  schemas/              # generated JSON schema
+examples/               # example event scenarios
+tests/                  # executable conformance/runtime tests
+```
+
+## Limitations
+
+- Signatures are mock/reference only.
+- Profile adapters do not verify real OAuth/OIDC, X509, DID/VC, or IAM credentials.
+- No blockchain, distributed consensus, real payment execution, or production key management is included.
+- The runtime enforces executable protocol invariants, not legal liability, governance policy, or workflow lifecycle orchestration.
+
+## Runtime governance extension points
+
+- Replace `MockProfileAdapter` with production credential adapters.
+- Add signature suites while preserving the canonicalization boundary.
+- Add draft-version-specific schema adapters without changing the pinned v06 J/D/T/V primitive meaning.
+- Add draft-version-specific schema adapters without changing J/D/T/V primitive meaning.
+- Publish conformance vectors for independent implementations.
+- Add governance-specific validation modules outside the core minimal runtime.
+
+## Runtime and verification notes
+
+See [HARDENING.md](HARDENING.md) for supported behavior, regression checks, and compatibility boundaries.

jep_runtime-0.1.1.dist-info/RECORD

@@ -0,0 +1,30 @@
+jep_runtime/__init__.py,sha256=JhLqtSj_sjd77PxbDY4YSEf-5IqobPXAAKiZICNgW1M,600
+jep_runtime/archive/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/archive/jsonl.py,sha256=a8EMi3I7ntZWXatj5BldoVwMvc-vMI5bokvlucWq5dw,2794
+jep_runtime/canonicalization/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/canonicalization/json.py,sha256=zihMTZJlRoznk-aCAkgwhch5dlwj7eITITa0Jm_DA1s,1345
+jep_runtime/cli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/cli/main.py,sha256=MSr2G4pQ-r-0E-s6WAaGzsOuw1fp_2qVUVd6aXDnW3o,3713
+jep_runtime/conformance/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/conformance/runtime.py,sha256=k7on185FugRsz4oI3QwFN2Xnu9sPkR_xSz9sCGSvahs,3267
+jep_runtime/core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/core/event.py,sha256=NhZZL64TS9oeADSFkeuW8rIxChcd2d9R3U41PMQxwvY,5853
+jep_runtime/core/version.py,sha256=Bj1xWRaavM7IB3lem-TDouzjSkNgLibpNBsokPfHxA8,350
+jep_runtime/delegation/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/delegation/runtime.py,sha256=r2sBgjfuoH7CXfU_tMX5dq2zKRQqCVgnoZXY0WUffM0,5501
+jep_runtime/events/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/events/factory.py,sha256=q9wX7b6F3N4x8dwB1m0UN2rhMK9VgTxiHEkHGAbzNcY,1578
+jep_runtime/examples/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/profiles/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/profiles/adapter.py,sha256=L8OspdywHFoLk6_jZZnB7W3b5cY6ewj04me0Xko9z7M,1673
+jep_runtime/replay/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/replay/engine.py,sha256=2WbY5GfdIfy11YHV8Cr4NuxbUzUTrj6iCcGjEZC2lQs,1686
+jep_runtime/schemas/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/tests/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/verification/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+jep_runtime/verification/runtime.py,sha256=hQNuPqB9pRXAauewmP7ZtVUSMhqvARNqBGkNRtvCdlY,3470
+jep_runtime-0.1.1.dist-info/METADATA,sha256=22ZGQt3P-8iDlbNvAuiwJmjlyfRTyUE4V-bwo5ofi5c,7493
+jep_runtime-0.1.1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+jep_runtime-0.1.1.dist-info/entry_points.txt,sha256=okT3GtAUVAtXv1-hDxX18i7qAnOxlSfPkVzP_zFeGzg,50
+jep_runtime-0.1.1.dist-info/top_level.txt,sha256=EDPCSbjtYVoxMAKBz62JFHA18FQUNyySPr0kI3bH5Tc,12
+jep_runtime-0.1.1.dist-info/RECORD,,

jep_runtime-0.1.1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

jep_runtime-0.1.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+jep = jep_runtime.cli.main:main

jep_runtime-0.1.1.dist-info/top_level.txt

@@ -0,0 +1 @@
+jep_runtime