matrx-orm 3.1.209__tar.gz → 3.1.210__tar.gz

{matrx_orm-3.1.209 → matrx_orm-3.1.210}/CLAUDE.md

@@ -1,6 +1,6 @@
 # CLAUDE.md — matrx-orm
 
-> 🟢 **RETIREMENT DECIDED 2026-08-22:** this package is being replaced by SQLAlchemy 2 + Alembic under a thin opinion layer and extracted to its own repo. Cross-repo system-of-record: /Users/armanisadeghi/code/common-docs/projects/orm-switch/PLAN.md — read it before touching this feature in ANY repo.
+> 🟢 **RETIREMENT DECIDED 2026-08-22:** this package is being replaced by SQLAlchemy 2 + Alembic under a thin opinion layer and extracted to its own repo. Cross-repo system-of-record: /Users/armanisadeghi/code/common-docs/systems/architecture/database/orm-persistence/projects/orm-switch/PLAN.md — read it before touching this feature in ANY repo.
 
 > **Operating Principle: Build the platform, not the artifact.** Every task is a probe that exposes a missing capability — build it, then consume it. Code that only serves one artifact is forbidden. Full doctrine: [/PRINCIPLES.md](../../PRINCIPLES.md).
 

{matrx_orm-3.1.209 → matrx_orm-3.1.210}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: matrx-orm
-Version: 3.1.209
+Version: 3.1.210
 Summary: Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching
 Project-URL: Homepage, https://github.com/AI-Matrix-Engine/aidream-current
 Project-URL: Repository, https://github.com/AI-Matrix-Engine/aidream-current

{matrx_orm-3.1.209 → matrx_orm-3.1.210}/matrx_orm/secrets_battery/FEATURE.md

@@ -1,6 +1,6 @@
 # matrx-orm secrets battery — the ONE credential vault
 
-> Cross-repo plan (implementation authority): `/Users/armanisadeghi/code/common-docs/projects/unified-credential-vault/PLAN.md` — read it before expanding credential storage or package resolution in any repository. Phase 1 (schema) + Phase 2 (this battery's item layer, rotation script, unified aidream service) are live.
+> Cross-repo plan (implementation authority): `/Users/armanisadeghi/code/common-docs/systems/account/vault-secrets/FEATURE.md` — read it before expanding credential storage or package resolution in any repository. Phase 1 (schema) + Phase 2 (this battery's item layer, rotation script, unified aidream service) are live.
 
 **One table, one key, everywhere.** Every platform credential — personal AND
 organizational — lives in `users.user_secrets` (Fernet-encrypted). Every package
@@ -84,7 +84,7 @@ ownership/shape helper and does not decrypt.
 
 **Native source admission (`native_source.py`).** `validate_native_source` is the server reader of the provider's exact source-v1 byte format; Rust remains the encoder and authenticator. It requires an explicit positive source-size limit, preserves nullable names and bytes, rejects duplicate/noncanonical JSON and COSE, and derives public metadata only after maintained P-256 key-pair validation. The result is provider-custody data, never a response model or generic field. `repr` and fixed failures omit material. `scripts/check_native_source_parity.py --rust-core <native-vault-provider/core>` compares the real compiled Rust reader against the server corpus; no mocked oracle. This prerequisite adds no creator, materializer, database row or native readiness. Verified September19 against132 focused tests and525 cross-language cases.
 
-**Native lifecycle component (`native_lifecycle.py`).** The shared coordinator must supply locked parent/child projections from the exported field constants, current host management authority and its active transaction. Inspection locks the exact native metadata child; component delete/restore mutate only that child's tombstone and lifecycle. Deletion accepts active and restored-quarantined sources; recovery compares aware ISO manifest timestamps to database timestamps, then parses the already-validated manifest instant only at the typed native restore mutation boundary. Personal metadata provenance is enforced by the database guard, never inferred from the request scope. Coordinator/preview integration and actual aggregate database acceptance remain pending; these helpers alone do not enable protected recovery. Contract: [native lifecycle](../../../../../common-docs/projects/credential-sharing-browser-login/NATIVE-LIFECYCLE.md).
+**Native lifecycle component (`native_lifecycle.py`).** The shared coordinator must supply locked parent/child projections from the exported field constants, current host management authority and its active transaction. Inspection locks the exact native metadata child; component delete/restore mutate only that child's tombstone and lifecycle. Deletion accepts active and restored-quarantined sources; recovery compares aware ISO manifest timestamps to database timestamps, then parses the already-validated manifest instant only at the typed native restore mutation boundary. Personal metadata provenance is enforced by the database guard, never inferred from the request scope. Coordinator/preview integration and actual aggregate database acceptance remain pending; these helpers alone do not enable protected recovery. Contract: [native lifecycle](../../../../../common-docs/projects/credential-sharing-browser-login/REGISTER.md).
 
 **`inject_into_sandbox=true` REQUIRES an env alias — refused otherwise.** A
 container environment is a NAME→value map, so a field with `key IS NULL` has

{matrx_orm-3.1.209 → matrx_orm-3.1.210}/matrx_orm/secrets_battery/items.py

@@ -55,7 +55,7 @@ copied into a fork.
 A field lands here when possessing it MINTS future access rather than merely
 holding a value someone already gave you — an authenticator seed generates
 every future code for the account, forever, with nothing recording it. D-15
-(``common-docs/projects/persistent-cloud-browser/DECISIONS.md``) ruled that a
+(``common-docs/systems/architecture/persistent-cloud-browser/VISION.md``) ruled that a
 seed does not travel with an account handover: the new owner enrols again.
 
 🚨 This is deliberately NOT "every ``sealed`` field". Sealed also covers OAuth

{matrx_orm-3.1.209 → matrx_orm-3.1.210}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "matrx-orm"
-version = "3.1.209"
+version = "3.1.210"
 description = "Async-first PostgreSQL ORM with bidirectional migrations, schema introspection, many-to-many relationships, and built-in state caching"
 readme = "README.md"
 license = { text = "MIT" }

{matrx_orm-3.1.209 → matrx_orm-3.1.210}/tests/test_secrets_minting_keys.py

@@ -1,6 +1,6 @@
 """Minting keys never change hands — D-15, enforced in the battery (no DB).
 
-``common-docs/projects/persistent-cloud-browser/DECISIONS.md`` D-15: *"A seed
+``common-docs/systems/architecture/persistent-cloud-browser/VISION.md`` D-15: *"A seed
 does NOT transfer with an account handover — the new owner enrolls again.
 Otherwise two people generate valid codes forever with nothing recording it."*