ledgix-python 0.1.6__tar.gz → 0.1.7__tar.gz

{ledgix_python-0.1.6 → ledgix_python-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ledgix-python
-Version: 0.1.6
+Version: 0.1.7
 Summary: Agent-agnostic compliance shim for SOX 404 policy enforcement via the ALCV Vault
 Project-URL: Homepage, https://github.com/ledgix-dev/python-sdk
 Project-URL: Documentation, https://docs.ledgix.dev
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 
 # Ledgix ALCV — Python SDK
 
-[![PyPI](https://img.shields.io/badge/pypi-v0.1.6-blue)](https://pypi.org/project/ledgix-python/)
+[![PyPI](https://img.shields.io/badge/pypi-v0.1.7-blue)](https://pypi.org/project/ledgix-python/)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue)](https://python.org)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 

{ledgix_python-0.1.6 → ledgix_python-0.1.7}/README.md

@@ -1,6 +1,6 @@
 # Ledgix ALCV — Python SDK
 
-[![PyPI](https://img.shields.io/badge/pypi-v0.1.6-blue)](https://pypi.org/project/ledgix-python/)
+[![PyPI](https://img.shields.io/badge/pypi-v0.1.7-blue)](https://pypi.org/project/ledgix-python/)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue)](https://python.org)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 

{ledgix_python-0.1.6 → ledgix_python-0.1.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ledgix-python"
-version = "0.1.6"
+version = "0.1.7"
 description = "Agent-agnostic compliance shim for SOX 404 policy enforcement via the ALCV Vault"
 readme = "README.md"
 license = { text = "MIT" }

{ledgix_python-0.1.6 → ledgix_python-0.1.7}/src/ledgix_python/__init__.py

@@ -39,7 +39,7 @@ from .models import (
     PolicyRegistrationResponse,
 )
 
-__version__ = "0.1.6"
+__version__ = "0.1.7"
 
 __all__ = [
     # Core

{ledgix_python-0.1.6 → ledgix_python-0.1.7}/src/ledgix_python/client.py

@@ -612,11 +612,16 @@ class LedgixClient:
             )
 
             latest_leaf_hash: str | None = None
+            coverage_notes: list[str] = []
+            redacted_entry_count = 0
             for entry in sorted_entries:
-                expected_event_hash = self._build_event_hash(entry)
-                if expected_event_hash != entry.event_hash:
-                    raise TokenVerificationError(f"Ledger event hash mismatch at seq {entry.seq}")
-                expected_leaf_hash = self._hash_leaf(expected_event_hash)
+                if self._has_protected_event_fields(entry):
+                    expected_event_hash = self._build_event_hash(entry)
+                    if expected_event_hash != entry.event_hash:
+                        raise TokenVerificationError(f"Ledger event hash mismatch at seq {entry.seq}")
+                else:
+                    redacted_entry_count += 1
+                expected_leaf_hash = self._hash_leaf(entry.event_hash)
                 if expected_leaf_hash != entry.leaf_hash:
                     raise TokenVerificationError(f"Ledger leaf hash mismatch at seq {entry.seq}")
                 if entry.receipt_algorithm != "Ed25519":
@@ -634,6 +639,12 @@ class LedgixClient:
                     payload_bytes,
                 )
                 latest_leaf_hash = entry.leaf_hash
+            if redacted_entry_count > 0:
+                coverage_notes.append(
+                    "Event-body hash recomputation was skipped for "
+                    f"{redacted_entry_count} redacted public ledger entr"
+                    f"{'y' if redacted_entry_count == 1 else 'ies'}; receipt and checkpoint proofs still verified."
+                )
 
             sorted_checkpoints = sorted(checkpoints, key=lambda item: item.checkpoint_id)
             previous_checkpoint_hash = ""
@@ -682,10 +693,12 @@ class LedgixClient:
                             "Latest checkpoint root does not match sequenced leaf hashes"
                         )
                 else:
-                    coverage_note = (
+                    coverage_notes.append(
                         f"Provided {len(sequenced_entries)} sequenced entries for tree size "
                         f"{latest_checkpoint.tree_size}; full root verification requires the complete covered set."
                     )
+            if coverage_notes:
+                coverage_note = " ".join(coverage_notes)
             return LedgerVerificationResult(
                 intact=True,
                 verified_entries=len(sorted_entries),
@@ -816,6 +829,9 @@ class LedgixClient:
         )
         return self._hash_event_payload(payload)
 
+    def _has_protected_event_fields(self, entry: LedgerEntry) -> bool:
+        return isinstance(entry.intent_hash, str) and len(entry.intent_hash) > 0
+
     def _build_receipt_payload(self, entry: LedgerEntry) -> bytes:
         return self._encode_deterministic_cbor(
             {

{ledgix_python-0.1.6 → ledgix_python-0.1.7}/tests/test_client.py

@@ -579,6 +579,86 @@ class TestLedgerProofVerification:
         assert result.verified_manifests == 1
         assert result.latest_leaf_hash == entry["leaf_hash"]
 
+    @respx.mock
+    def test_verify_ledger_proof_with_redacted_public_entry(
+        self,
+        client: LedgixClient,
+        ed25519_private_key,
+        jwks_response: dict,
+    ):
+        full_entry = {
+            "seq": 1,
+            "event_uuid": "evt-1",
+            "request_id": "req-1",
+            "agent_id": "agent-1",
+            "policy_id": "policy-1",
+            "intent_hash": "intent-1",
+            "tool_name": "stripe_refund",
+            "tool_args": {"amount": 45},
+            "reason": "ok",
+            "citations": [],
+            "evidence_chunks": [],
+            "confidence": 0.91,
+            "approved": True,
+            "accepted_at": "2026-03-15T12:00:00Z",
+            "canonical_version": 1,
+            "event_hash": "",
+            "leaf_hash": "",
+            "leaf_index": 0,
+            "checkpoint_id": 1,
+            "receipt_algorithm": "Ed25519",
+            "receipt_key_id": "test-key-001",
+            "receipt_signature": "",
+            "receipt_payload": "",
+        }
+        full_entry["event_hash"] = self._build_event_hash(full_entry)
+        full_entry["leaf_hash"] = self._hash_leaf(full_entry["event_hash"])
+        receipt_payload = self._build_receipt_payload(full_entry)
+        full_entry["receipt_payload"] = self._b64url(receipt_payload)
+        full_entry["receipt_signature"] = self._b64url(ed25519_private_key.sign(receipt_payload))
+
+        public_entry = {
+            **full_entry,
+            "intent_hash": "",
+            "tool_args": {},
+        }
+
+        checkpoint = {
+            "checkpoint_id": 1,
+            "microblock_id": 1,
+            "tree_size": 1,
+            "root_hash": full_entry["leaf_hash"],
+            "checkpoint_hash": "",
+            "prev_checkpoint_hash": "",
+            "signature_algorithm": "Ed25519",
+            "signer_key_id": "test-key-001",
+            "checkpoint_signature": "",
+            "checkpoint_payload": "",
+            "signed_at": "2026-03-15T13:00:00Z",
+            "mmd_seconds": 30,
+            "export_target": "",
+            "export_uri": "",
+            "export_status": "",
+        }
+        checkpoint_payload = self._build_checkpoint_payload(checkpoint)
+        checkpoint["checkpoint_hash"] = self._hash_checkpoint_payload(checkpoint_payload)
+        checkpoint["checkpoint_payload"] = self._b64url(checkpoint_payload)
+        checkpoint["checkpoint_signature"] = self._b64url(ed25519_private_key.sign(checkpoint_payload))
+
+        respx.get("https://vault.test/.well-known/jwks.json").mock(
+            return_value=Response(200, json=jwks_response)
+        )
+
+        result = client.verify_ledger_proof(
+            entries=[public_entry],
+            manifests=[checkpoint],
+        )
+
+        assert result.intact is True
+        assert result.verified_entries == 1
+        assert result.coverage_note is not None
+        assert "redacted public ledger entry" in result.coverage_note
+
     @respx.mock
     @pytest.mark.asyncio
     async def test_verify_ledger_proof_async(