mcp-server-taxcode 0.7.2__tar.gz → 1.0.0__tar.gz

{mcp_server_taxcode-0.7.2 → mcp_server_taxcode-1.0.0}/.github/workflows/ci.yml

@@ -35,9 +35,11 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
-          version: "latest"
+          # Newest uv that meets pyproject.toml's [tool.uv] required-version (>=0.13.4, from
+          # FastMCP's October 2026 certificate authority incident notice).
+          version-file: "pyproject.toml"
           enable-cache: true
 
       - name: Set up Python
@@ -63,7 +65,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
@@ -71,9 +73,11 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
-          version: "latest"
+          # Newest uv that meets pyproject.toml's [tool.uv] required-version (>=0.13.4, from
+          # FastMCP's October 2026 certificate authority incident notice).
+          version-file: "pyproject.toml"
           enable-cache: true
 
       - name: Set up Python ${{ matrix.python-version }}
@@ -101,9 +105,11 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
-          version: "latest"
+          # Newest uv that meets pyproject.toml's [tool.uv] required-version (>=0.13.4, from
+          # FastMCP's October 2026 certificate authority incident notice).
+          version-file: "pyproject.toml"
           enable-cache: true
 
       - name: Set up Python
@@ -120,6 +126,11 @@ jobs:
       - name: Verify OpenAPI drift
         run: uv run python scripts/check_openapi_drift.py
 
+      - name: Verify data files, source manifest and generated docs
+        # Fails when a data file breaks the schema or canonical form, a manifest entry is
+        # missing or disagrees with its row, or docs/ differs from the regenerated output.
+        run: uv run python scripts/build_catalog.py --check
+
       - name: Set up Node.js 22
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
@@ -138,9 +149,11 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
-          version: "latest"
+          # Newest uv that meets pyproject.toml's [tool.uv] required-version (>=0.13.4, from
+          # FastMCP's October 2026 certificate authority incident notice).
+          version-file: "pyproject.toml"
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
@@ -184,3 +197,29 @@ jobs:
             exit 1
           fi
           echo "Image label matches ${EXPECTED}"
+
+      - name: Builder fails below the ca-certificates floor
+        # Raising CA_CERTIFICATES_FLOOR above any real Debian version makes the installed
+        # package older than the floor, whatever version the base image or trixie-security
+        # ships, so this is deterministic. The build must fail at the builder's floor check,
+        # with its message, and before the pip bootstrap step starts.
+        run: |
+          set +e
+          docker build --target builder --progress=plain \
+            --build-arg CA_CERTIFICATES_FLOOR=99991231 . > ca-floor.log 2>&1
+          status=$?
+          set -e
+          cat ca-floor.log
+          if [ "$status" -eq 0 ]; then
+            echo "::error::builder built with a ca-certificates floor above the installed version"
+            exit 1
+          fi
+          if ! grep -q "is older than the floor 99991231" ca-floor.log; then
+            echo "::error::builder failed, but not at the ca-certificates floor check"
+            exit 1
+          fi
+          if grep -q -- "--require-hashes" ca-floor.log; then
+            echo "::error::the pip bootstrap step started before the ca-certificates floor check failed"
+            exit 1
+          fi
+          echo "Builder stops at the ca-certificates floor check before any pip step"

{mcp_server_taxcode-0.7.2 → mcp_server_taxcode-1.0.0}/.github/workflows/dependabot-automerge.yml

@@ -28,11 +28,25 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
+      # Docker base image updates never auto-merge. The docker ecosystem can move the tag
+      # (python:3.12-slim -> 3.14-slim is a Python runtime upgrade that Dependabot labels
+      # semver-minor), so these PRs stay open for a human review.
+      - name: Leave Docker base image updates for review
+        if: steps.metadata.outputs.package-ecosystem == 'docker'
+        run: echo "::notice title=Not auto-merged::Docker base image update ($DEPS $PREV -> $NEW). Docker updates always wait for a human review."
+        env:
+          DEPS: ${{ steps.metadata.outputs.dependency-names }}
+          PREV: ${{ steps.metadata.outputs.previous-version }}
+          NEW: ${{ steps.metadata.outputs.new-version }}
+
       # Allowlist, not a major-version denylist: update-type is the highest change in the PR
       # (a grouped PR with one major is skipped), and it is empty when the PR carries a
       # non-Dependabot commit, so only minor and patch updates are auto-merged.
       - name: Enable auto-merge for semver-minor and semver-patch updates
-        if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        if: >-
+          steps.metadata.outputs.package-ecosystem != 'docker' &&
+          (steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-patch')
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}

{mcp_server_taxcode-0.7.2 → mcp_server_taxcode-1.0.0}/.github/workflows/drift-monitor.yml

@@ -28,9 +28,11 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
-          version: "latest"
+          # Newest uv that meets pyproject.toml's [tool.uv] required-version (>=0.13.4, from
+          # FastMCP's October 2026 certificate authority incident notice).
+          version-file: "pyproject.toml"
           enable-cache: true
 
       - name: Set up Python

{mcp_server_taxcode-0.7.2 → mcp_server_taxcode-1.0.0}/.github/workflows/release.yml

@@ -28,7 +28,9 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
         with:
-          version: "latest"
+          # Newest uv that meets pyproject.toml's [tool.uv] required-version (>=0.13.4, from
+          # FastMCP's October 2026 certificate authority incident notice).
+          version-file: "pyproject.toml"
           enable-cache: false
 
       - name: Set up Python

{mcp_server_taxcode-0.7.2 → mcp_server_taxcode-1.0.0}/AGENTS.md

@@ -44,6 +44,9 @@ Host configuration JSON for these doc servers (`mcp_config.json` and other deskt
 - `src/<name>_mcp/auth.py` — `SharedTokenVerifier` (FastMCP `TokenVerifier`) for `<NAME>_MCP_AUTH_TOKEN` and the HTTP bind policy; the verifier is attached at server build, so `fastmcp run` and `http_app()` enforce the token too (`COOKBOOK.md` Recipe 8).
 - `src/<name>_mcp/tools/<domain>.py` — domain sub-servers (template ships `system.py`, `items.py`); re-exported from `tools/__init__.py`.
 - `src/<name>_mcp/client.py` — async HTTP client; `ssrf.py` — SSRF / DNS-rebinding guard; `errors.py` — exceptions and secret redaction; `middleware.py` — parent and child middleware; `config.py` — settings.
+- `src/taxcode_mcp/data/` — the single source of truth for statute and publication rows: `jurisdictions.json` (catalog order), `statutes/<code>.json`, `publications/<code>.json`, `manifest/<code>.json` (one source record per row), and `rates/<code>.json` (the compliance tools' rate tables, one per state in `RATE_TABLE_MODELS`). `src/taxcode_mcp/catalog.py` loads and validates them; `db.py` seeds DuckDB from the rows, and `tools/compliance.py` reads every rate from the rate tables. Row layout, manifest fields and how to add a row: `CONTRIBUTING.md` (Adding or changing a row).
+- `scripts/build_catalog.py` — rewrites the data files in canonical form and generates `docs/<code>/*.md`, `docs/<code>/llms-full.txt` (one jurisdiction's full text), `docs/llms.txt` and `docs/llms-full.txt` (the index of the per-jurisdiction files) from them; `--check` (run in CI and by `tests/test_catalog.py`) fails on a schema or canonical-form error (rate tables included, and a missing or stray rate table), an incomplete or mismatched manifest entry, or docs that differ from the generated output. Never edit generated docs by hand.
+- `src/taxcode_mcp/paging.py` — hard response cap (32,000 characters of JSON) and paging for the statutes tools: `statutes_lookup_statute` pages long text (`page_cursor` / `next_cursor`), search and publications clamp `limit` to 1..25 items per call (`offset` / `next_offset`), and the `taxcode://statutes/{jurisdiction}/{section}{?page_cursor}` resource returns the same 8,000-character pages, ending a non-final page with the full URI of the next one (`...?page_cursor=`). The template has no `statutes/` segment of its own: the `statutes` mount namespace supplies it.
 - `scripts/check_tool_contract.py` — source of truth for the expected tool set and annotations. Do not hard-code tool counts elsewhere.
 - `scripts/check_openapi_drift.py`, `scripts/check_conformance.sh` + `conformance-baseline.yml` — drift and protocol conformance.
 - `tests/` — offline unit, layered-composition, and protocol tests; `test_e2e_live.py` is opt-in (`-m e2e`).
@@ -136,7 +139,10 @@ When translating an API documentation page, `llm.txt`, or OpenAPI specification
    - Tool execution errors reach the client as `tools/call` results with `isError: true` and the redacted message (`tool_error`, raised `from None` after the `except` block ends, so neither `__cause__` nor `__context__` holds the original exception); `ParentAuditMiddleware` logs the same redacted message. A batch tool's per-item errors and its `batch_failed` error (`tool_failure`, raised `from None` outside any `except` block) carry redacted messages too.
    - An unknown tool stays FastMCP 4.0.11's tool result (`isError: true`). The spec's JSON-RPC `-32602` (`Unknown tool: invalid_tool_name`) is a known gap; do not change the wire format. See `COOKBOOK.md` Recipe 12.
 3. **Multi-Stage Non-Root Containers**:
-   - The `Dockerfile` must use a multi-stage build (`python:3.12-slim AS builder` $\rightarrow$ runtime, pulled from Docker Hub by tag) creating and executing under non-root `USER mcp` with virtual environment `/opt/venv`. The runtime stage carries `LABEL io.modelcontextprotocol.server.name` equal to the `server.json` `name` (MCP Registry OCI ownership check), and the default command stays stdio.
+   - The `Dockerfile` must use a multi-stage build (`python:3.14-slim AS builder` $\rightarrow$ runtime, pulled from Docker Hub and pinned by digest) creating and executing under non-root `USER mcp` with virtual environment `/opt/venv`. The runtime stage carries `LABEL io.modelcontextprotocol.server.name` equal to the `server.json` `name` (MCP Registry OCI ownership check), and the default command stays stdio.
+   - Trust stores follow FastMCP's [certificate authority incident notice (October 2026)](https://github.com/PrefectHQ/fastmcp/blob/main/SECURITY.md#certificate-authority-incident-october-2026): both stages upgrade the OS `ca-certificates` package and fail the build below the patched Debian version (`ARG CA_CERTIFICATES_FLOOR`, declared once), the builder does so before any pip runs because pip trusts the OS store as well as its bundled certifi, the builder bootstraps pip 26.2.2, and `certifi>=2026.10.19` is a direct dependency. `tests/test_dockerfile.py` and CI's `docker-build` job enforce the order and the floor.
+   - The pip bootstrap is hash-pinned in `docker/pip-bootstrap.txt` and installed with `--require-hashes`, so it does not depend on the TLS trust of the base image's older pip and certifi; whoever raises the pip floor updates that pin and its sha256 from PyPI (`https://pypi.org/pypi/pip/<version>/json`, the `py3-none-any` wheel's `digests.sha256`), because Dependabot does not track the file.
+   - Lowering `CA_CERTIFICATES_FLOOR` with `--build-arg` is unsupported; the build-arg exists only so CI can raise it for the negative floor check, and CI and the release workflow never pass it otherwise.
 4. **Registry Metadata Constraint**:
    - In `server.json`, the root `description` must be **strictly $\le$ 100 characters** to pass MCP Registry schema validation (longer strings trigger HTTP 422 errors).
    - The default package transport is `stdio`, and packages must specify `"runtimeHint": "uvx"`.
@@ -144,7 +150,7 @@ When translating an API documentation page, `llm.txt`, or OpenAPI specification
    - `<NAME>_MCP_AUTH_TOKEN` is read with `.strip()`; empty or whitespace-only means no auth plus a warning. When set, every HTTP entry point (`main()`, `fastmcp run`, `http_app()`) requires `Authorization: Bearer <token>` (`SharedTokenVerifier`: constant-time compare, token hidden from `repr`, blank tokens refused).
    - An HTTP transport on a host other than `127.0.0.1`, `::1` or `localhost` refuses to start without a token unless `<NAME>_MCP_ALLOW_UNAUTHENTICATED_BIND=1`. Stdio is unaffected and stays the image default (`COOKBOOK.md` Recipe 8).
 6. **SSRF & DNS Rebinding Defense**:
-   - Outbound requests must enforce HTTPS, disallow loopback/private/internal IP addresses, and offload DNS hostname verification to worker threads via `asyncio.to_thread` in `SSRFSafeAsyncTransport` to protect event loop responsiveness.
+   - Outbound requests must enforce HTTPS, disallow loopback/private/internal IP addresses, and offload DNS hostname verification to worker threads via `asyncio.to_thread` in `SSRFSafeAsyncTransport` to protect event loop responsiveness. The transport then connects only to an address it checked, trying the next checked address if a connect fails, and keeps the hostname in the URL for the Host header, TLS SNI, certificate verification and per-hostname connection pooling, so the name is never looked up a second time. The client, the drift fetch (`--spec-url`) and `ingest_statutes.py --check-upstream` all use it, and none follows redirects. httpx ignores env proxies whenever a transport is passed (`allow_env_proxies = trust_env and transport is None`), so connections always go direct through the pin; egress-proxy deployments need a proxy-aware transport, which isn't provided; `trust_env=False` on the drift fetch and the `--check-upstream` probe is belt-and-braces.
 7. **Defensive API Contracts & Payload Hardening**:
    - Guard against polymorphic nulls and missing keys with typed extraction helpers (`extract_dict`, `extract_list`); never chain naked `.get()` calls without type assertions. Status-classification and selection-loop patterns are in **`COOKBOOK.md`** Recipe 10.
 8. **Git Safety & Streamlined Releases**:
@@ -163,6 +169,8 @@ When translating an API documentation page, `llm.txt`, or OpenAPI specification
 
 ## 🛠️ Development & Verification Commands
 
+uv 0.13.4 or later is required (`[tool.uv] required-version` in `pyproject.toml`, from FastMCP's certificate authority incident notice); older uv refuses to run, and CI's `setup-uv` installs from that setting.
+
 ```bash
 # Install editable with dev dependencies
 uv sync --locked --extra dev
@@ -182,6 +190,9 @@ uv run python scripts/check_tool_contract.py
 # Upstream OpenAPI / route drift check
 uv run python scripts/check_openapi_drift.py
 
+# Data files, source manifest and generated docs are current
+uv run python scripts/build_catalog.py --check
+
 # Protocol integration tests (stdio handshake & stateless streamable HTTP)
 uv run pytest tests/test_protocol.py
 
@@ -199,6 +210,6 @@ coderabbit review --agent --uncommitted
 
 ## 🔄 CI & Releases
 
-CI is defined in `.github/workflows/ci.yml` (jobs: `lint-and-types`, `test` on Python 3.10–3.13, `tool-contract`, `build-check`, `docker-build` (builds the image without pushing and checks its MCP server-name label against `server.json`)). It runs on pushes and pull requests to `main`, daily on `main` at 09:29 UTC (`schedule`), and on manual dispatch (`workflow_dispatch`); the daily run exists because merges by `dependabot-automerge.yml` use `GITHUB_TOKEN`, and pushes made with `GITHUB_TOKEN` don't trigger push workflows, so those merges get no `push` run. Run the commands above before opening a PR. Scheduled upstream drift runs in `drift-monitor.yml`. `dependabot-automerge.yml` turns on squash auto-merge only for Dependabot PRs whose highest update is minor or patch; major updates wait for a human review.
+CI is defined in `.github/workflows/ci.yml` (jobs: `lint-and-types`, `test` on Python 3.10–3.14, `tool-contract`, `build-check`, `docker-build` (builds the image without pushing, checks its MCP server-name label against `server.json`, and checks that the builder stage fails at its `ca-certificates` floor check, before any pip step, when the floor is above the installed version)). It runs on pushes and pull requests to `main`, daily on `main` at 09:29 UTC (`schedule`), and on manual dispatch (`workflow_dispatch`); the daily run exists because merges by `dependabot-automerge.yml` use `GITHUB_TOKEN`, and pushes made with `GITHUB_TOKEN` don't trigger push workflows, so those merges get no `push` run. Run the commands above before opening a PR. Scheduled upstream drift runs in `drift-monitor.yml`. `dependabot-automerge.yml` turns on squash auto-merge only for Dependabot PRs whose highest update is minor or patch; major updates wait for a human review. Docker base image updates (`package-ecosystem` `docker`) never auto-merge and always wait for a human review: Dependabot's docker ecosystem can move the image tag, not just its digest (for example `python:3.12-slim` to `python:3.14-slim`, a Python runtime upgrade that Dependabot labels a minor update), so the job logs a notice and leaves the PR open.
 
 `release.yml` runs on `v*` tag pushes only: it creates the GitHub Release, then builds the container image, pushes it to GHCR, attests it, and publishes to the MCP Registry. In the template repo the image is built only (no push), and the attest and registry jobs skip. Release procedure (tag-based versioning, release notes, pre-tag checks): **`COOKBOOK.md`** Recipes 1–2; product-repo migration steps: Recipe 9.

mcp_server_taxcode-1.0.0/CONTRIBUTING.md

@@ -0,0 +1,59 @@
+# Contributing Guidelines
+
+Thank you for your interest in contributing!
+
+1. Fork or branch from `main`: `git checkout -b feat/your-feature`.
+2. Ensure strict static typing: `mypy --strict src/`.
+3. Ensure the test suite passes: `pytest` (coverage threshold configured in `pyproject.toml`).
+4. Validate tool contracts: `python scripts/check_tool_contract.py`.
+5. Open a Pull Request. Merges are performed via **Squash Merge** with Conventional Commit titles (`feat:`, `fix:`, `docs:`, `chore:`).
+6. Changing statute or publication rows? Follow "Adding or changing a row" below and run `uv run python scripts/build_catalog.py --check`.
+7. Do not edit version numbers or `CHANGELOG.md`: the git tag is the version, and GitHub Releases are the changelog. The squash commit message is the PR body, so a breaking (`feat!:` / `fix!:`) PR ends its body with one `BREAKING CHANGE:` final paragraph that lists the breaking items, with no migration steps.
+
+## Adding or changing a row
+
+Statute and publication rows live only in the data files under `src/taxcode_mcp/data/`. The server seeds its database from them, and `scripts/ingest_statutes.py` and the docs read them too. Never add rows as Python literals.
+
+| File | Holds |
+| --- | --- |
+| `jurisdictions.json` | Jurisdiction codes in catalog order. Rows load in this order, then in file order. |
+| `statutes/<code>.json` | One jurisdiction's statute rows (`us.json`, `pr.json`, `ga.json`, ...). `text_en` and `text_es` are lists of lines, joined with a newline when loaded. |
+| `publications/<code>.json` | Publications whose `id` starts with `<code>-`. |
+| `manifest/<code>.json` | One source record per statute and publication row and per rate table of that jurisdiction. |
+| `rates/<code>.json` | The rate table the compliance tools compute a state's tax from. See "Changing a rate table" below. |
+
+Every manifest entry has every field below. A value we don't have is the explicit string `"not_recorded"`, never a missing key and never a guess.
+
+| Field | Meaning |
+| --- | --- |
+| `kind`, `id` | `statute` or `publication` and the row's `id`, or `rate_table` and `<code>-rates`. |
+| `url` | Must equal the row's (or rate table's) `source_url`. |
+| `edition` | Which text the source at `url` is: `as_enacted` (the law as passed), `amended_compilation` (a compilation with later amendments folded in, such as an OGP "según enmendada" text), or `"not_recorded"`. |
+| `official` | `true` when the URL is on the issuing government body's own site, `false` for a third-party site, or `"not_recorded"`. It says nothing about whether the stored text is official. |
+| `licence` | Reuse terms of the source, or `"not_recorded"`. |
+| `retrieved` | Date the source was fetched (`YYYY-MM-DD`), or `"not_recorded"`. |
+| `content_sha256` | SHA-256 of the fetched source artifact, or `"not_recorded"`. |
+| `enacting_law` | Law that enacted or last amended the text, or `"not_recorded"`. |
+| `effective_date` | Date the text took effect (`YYYY-MM-DD`), or `"not_recorded"`. |
+| `verification` | `verified_verbatim` (checked word for word against the fetched source; needs `retrieved` and `content_sha256`), `summary` (the stored text is a summary, not a copy), or `"not_recorded"`. |
+
+To add or change a row:
+
+1. Edit the row in `statutes/<code>.json` or `publications/<code>.json`. A new prior-year version is a new row with its own `id` and `effective_year`; set `superseded_year` on the version it replaces. Never copy current text into an earlier year.
+2. Add or update its entry in `manifest/<code>.json`.
+3. Run `uv run python scripts/build_catalog.py`. It rewrites the data files in canonical form and regenerates `docs/<code>/*.md`, `docs/<code>/llms-full.txt` (that jurisdiction's full text), `docs/llms.txt` and `docs/llms-full.txt` (an index of the per-jurisdiction files), so a content PR only changes the full-text file of the jurisdictions it touches.
+4. Run `uv run python scripts/build_catalog.py --check` and the test suite. CI runs the same check and fails if a data file, a manifest entry or a generated docs file is out of step.
+
+A new jurisdiction also needs its code in `jurisdictions.json` and, for its name to resolve, in `JURISDICTION_NAMES` (`src/taxcode_mcp/db.py`). Content-only PRs touch just the data files, the manifest and the generated docs; keep code changes in their own PR.
+
+## Changing a rate table
+
+Every deduction, exemption, bracket, rate and per-year value the compliance tools use lives in `src/taxcode_mcp/data/rates/<code>.json`, one file per state that has one (`RATE_TABLE_MODELS` in `src/taxcode_mcp/catalog.py`). FL and TX have none. Never add a rate as a Python literal.
+
+- `model` names the shape of `params` and which formula reads it. It must match `RATE_TABLE_MODELS`.
+- Amounts and rates are floats (`1000.0`, not `1000`), because tool output prints them as stored.
+- `brackets` and `rates` are lists tried in order: the first step whose `over` the taxable income exceeds (or whose `from_year` the tax year has reached) applies, and the last step's `over` or `from_year` is `null`. Filing-status values are `{"single": ..., "mfj": ...}`.
+- Each table has a `source_url` and a `rate_table` entry in `manifest/<code>.json` with the same `url`. No table cites a source yet, so both are `"not_recorded"`. Record a source only once it has been checked.
+- `registry` tables keep their original keys. A `_YYYY` suffix holds the value from that tax year on, and the unsuffixed key covers the years before. Never copy a current value into an earlier year.
+
+The files load and are validated when the server starts. `tests/test_compliance_golden.py` pins the exact output of every compliance tool over a wide input grid, so a rate change also updates those files (`uv run python tests/golden_compliance.py --write`) and the diff shows which answers moved.

mcp_server_taxcode-1.0.0/Dockerfile

@@ -0,0 +1,83 @@
+# Multi-stage build for mcp-server-taxcode
+# Produces a minimal runtime image (~150MB) with no dev tooling.
+#
+# The base image is the Docker Official python image pulled from Docker Hub,
+# pinned by its multi-arch index digest. Dependabot's docker ecosystem keeps the
+# digest current.
+# No `# syntax=` line: the Dockerfile uses only features of BuildKit's built-in
+# frontend, so no frontend image is pulled.
+
+# FastMCP's October 2026 certificate authority incident notice says to update the
+# container's OS trust store: older base images ship a ca-certificates that predates the fix.
+# Debian shipped 20250419+deb13u1 in trixie-security. Both stages upgrade the package and
+# fail the build if the installed version is older than this floor, so a base image change
+# cannot drop the fix. The builder does it before any pip runs, because pip trusts the OS
+# store as well as its bundled certifi.
+# https://github.com/PrefectHQ/fastmcp/pull/5945 (notice) and
+# https://security-tracker.debian.org/tracker/DSA-6572-1 (Debian floor)
+ARG CA_CERTIFICATES_FLOOR=20250419+deb13u1
+
+# ─── Stage 1: Builder ─────────────────────────────────────────────────────────
+FROM python:3.14-slim@sha256:fbecd461fc72d21b2143c6eaba25143738079154a6d0ea3da3aec724f50eed4a AS builder
+
+ARG CA_CERTIFICATES_FLOOR
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends --only-upgrade ca-certificates && \
+    rm -rf /var/lib/apt/lists/* && \
+    installed="$(dpkg-query -W -f='${Version}' ca-certificates)" && \
+    { dpkg --compare-versions "$installed" ge "$CA_CERTIFICATES_FLOOR" || \
+      { echo "ca-certificates $installed is older than the floor $CA_CERTIFICATES_FLOOR" >&2; exit 1; }; }
+
+WORKDIR /app
+
+# Install build deps in a virtualenv so we can copy it cleanly
+RUN python -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+COPY docker/pip-bootstrap.txt /tmp/pip-bootstrap.txt
+COPY pyproject.toml README.md LICENSE ./
+COPY src/ src/
+
+# The build context has no .git, so uv-dynamic-versioning cannot read the tag and
+# falls back to 0.0.0. Release builds pass the tag version, for example
+# --build-arg UV_DYNAMIC_VERSIONING_BYPASS=1.3.1 (an unset or empty value keeps 0.0.0).
+ARG UV_DYNAMIC_VERSIONING_BYPASS
+ENV UV_DYNAMIC_VERSIONING_BYPASS=${UV_DYNAMIC_VERSIONING_BYPASS}
+
+# pip 26.2.2 updates the certificates pip bundles, per FastMCP's October 2026 certificate
+# authority incident notice. This image builds with pip, not uv, so pip carries the floor.
+# https://github.com/PrefectHQ/fastmcp/blob/main/SECURITY.md#certificate-authority-incident-october-2026
+# The bootstrap installs pip from a hash-pinned wheel (docker/pip-bootstrap.txt, --require-hashes),
+# so it does not depend on the TLS trust of the base image's older pip and certifi; the maintainer
+# who raises the pip floor updates that pin and its sha256 (Dependabot does not track the file).
+RUN pip install --no-cache-dir --require-hashes --only-binary=:all: -r /tmp/pip-bootstrap.txt && \
+    pip install --no-cache-dir .
+
+# ─── Stage 2: Runtime ─────────────────────────────────────────────────────────
+FROM python:3.14-slim@sha256:fbecd461fc72d21b2143c6eaba25143738079154a6d0ea3da3aec724f50eed4a AS runtime
+
+# MCP Registry ownership check for the OCI package: must equal server.json "name".
+# https://modelcontextprotocol.io/registry/package-types#docker%2Foci-images
+LABEL io.modelcontextprotocol.server.name="io.github.christianclaudio/taxcode"
+
+# OS trust store update and floor check, the same as the builder (see CA_CERTIFICATES_FLOOR).
+ARG CA_CERTIFICATES_FLOOR
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends --only-upgrade ca-certificates && \
+    rm -rf /var/lib/apt/lists/* && \
+    installed="$(dpkg-query -W -f='${Version}' ca-certificates)" && \
+    { dpkg --compare-versions "$installed" ge "$CA_CERTIFICATES_FLOOR" || \
+      { echo "ca-certificates $installed is older than the floor $CA_CERTIFICATES_FLOOR" >&2; exit 1; }; }
+
+# Security: run as non-root
+RUN useradd --create-home --shell /bin/bash mcp
+USER mcp
+WORKDIR /home/mcp
+
+# Copy the pre-built virtualenv from builder
+COPY --from=builder /opt/venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# Default transport is stdio, so no port is exposed
+ENTRYPOINT ["taxcode-mcp"]
+

{mcp_server_taxcode-0.7.2 → mcp_server_taxcode-1.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcp-server-taxcode
-Version: 0.7.2
+Version: 1.0.0
 Summary: Enterprise Model Context Protocol (MCP) server for Tax Code
 Project-URL: Homepage, https://github.com/christianclaudio/mcp-server-taxcode
 Project-URL: Documentation, https://github.com/christianclaudio/mcp-server-taxcode#readme
@@ -20,18 +20,20 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: duckdb>=1.5.6
-Requires-Dist: fastmcp>=4.1.1
+Requires-Dist: fastmcp>=4.1.3
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: mcp>=2.3.0
 Requires-Dist: pydantic-settings>=2.15.0
 Requires-Dist: pydantic>=2.13.5
 Provides-Extra: code-mode
-Requires-Dist: fastmcp[code-mode]>=4.1.1; extra == 'code-mode'
+Requires-Dist: fastmcp[code-mode]>=4.1.3; extra == 'code-mode'
 Provides-Extra: dev
-Requires-Dist: fastmcp[code-mode]>=4.1.1; extra == 'dev'
+Requires-Dist: fastmcp[code-mode]>=4.1.3; extra == 'dev'
 Requires-Dist: mypy>=2.4.0; extra == 'dev'
 Requires-Dist: opentelemetry-sdk>=1.45.1; extra == 'dev'
 Requires-Dist: pytest-asyncio>=1.4.0; extra == 'dev'
@@ -68,7 +70,7 @@ graph TD
     Gateway["FastMCP Root Gateway<br>(stdio / streamable-http)"]
     ParentMW["Parent Middleware<br>(Audit Logging, Timing, Secret Redaction, ReadOnly Gate)"]
     SysSub["System Sub-server (mount: 'system')<br>• system_get_health_status<br>• taxcode://system/reference/capabilities"]
-    StatSub["Statutes Sub-server (mount: 'statutes')<br>• statutes_lookup_statute<br>• statutes_search_tax_code<br>• statutes_list_publications"]
+    StatSub["Statutes Sub-server (mount: 'statutes')<br>• statutes_lookup_statute<br>• statutes_search_tax_code<br>• statutes_list_publications<br>• taxcode://statutes/{jurisdiction}/{section}"]
     CompSub["Compliance Sub-server (mount: 'compliance')<br>• compliance_evaluate_pr_bona_fide_residency<br>• compliance_calculate_built_in_gain_sourcing<br>• compliance_evaluate_georgia_residency<br>• compliance_evaluate_state_residency"]
     DuckDB["DuckDB In-Memory & File Engine<br>(117 Statutes, 18 Publications, Full-Text Search, Temporal Versions)"]
 
@@ -90,6 +92,8 @@ graph TD
   * **Puerto Rico (`PR`)**: Act 60-2019 (Resident Individual Investors, Export Services & Opportunity Zone definitions, Sec. 6020.10 annual reports), Ley 1-2011 (including Sec. 1031.02 exemptions and Sec. 1062.01 wage withholding and Sec. 1062.03 withholding on payments for services), Act 22-2012 predecessor versions, and administrative publications (CC RI 21-10, CC RI 25-12, CC RI 26-13, DA 21-04, DA 23-04, BI RI 26-02).
   * **All 50 US States + District of Columbia**: Comprehensive statutory definitions and tax computations covering no-income-tax states (AK, FL, NV, NH, SD, TN, TX, WA, WY), flat-tax regimes (AZ, CO, GA, ID, IL, IN, IA, KS, KY, MI, MS, NC, PA, UT), and graduated/surtax jurisdictions (AL, AR, CA, CT, DE, DC, HI, LA, ME, MD, MA, MN, MO, MT, NE, NJ, NM, NY, ND, OH, OK, OR, RI, SC, VT, VA, WV, WI) including Convenience of the Employer rules (NY, PA, NJ, CT, DE, NE) and local piggyback taxes (MD, IN, OH, NY).
 * **Snippet Search, Full Text by Id**: `statutes_search_tax_code` matches and ranks on the full text but returns a short snippet (up to 300 characters around the first matched term) plus each result's `id`, citation, title, jurisdiction, year, validity and content labels. Pass an `id` to `statutes_lookup_statute` as `citation_or_section` for the full text.
+* **Bounded Responses with Paging**: Every statutes tool result stays under 32,000 characters of JSON. `statutes_lookup_statute` returns long text in pages of up to 8,000 characters per text field (`text_page` gives the offset and full lengths; pass `next_cursor` back as `page_cursor` for the next page). `statutes_search_tax_code` and `statutes_list_publications` clamp `limit` to 1..25 items per call, with `offset` and `next_offset` for the next page. The `taxcode://statutes/{jurisdiction}/{section}` resource (for example `taxcode://statutes/US/933`) uses the same 8,000-character pages and cap: a page that is not the last ends with the URI of the next one, which carries a `?page_cursor=` query.
+* **Versioned Data Files**: Every statute and publication row lives in per-jurisdiction JSON under `src/taxcode_mcp/data/` with a source record per row, and the docs under `docs/` are generated from them (see [`CONTRIBUTING.md`](CONTRIBUTING.md)).
 * **Temporal Statutory Versioning**: Point-in-time statutory lookup with `superseded_year` filtering and descending historical ordering (`tax_year` parameter).
 * **Deterministic Compliance Engines**:
   * `evaluate_pr_bona_fide_residency`: Evaluates IRC § 937 presence (183-day, 549-day 3-year, 90-day US), tax home, and closer connection tests.
@@ -304,6 +308,7 @@ uv run ruff format --check .
 # 4. Tool contract, protocol & drift assertions
 uv run python scripts/check_tool_contract.py
 uv run python scripts/check_openapi_drift.py
+uv run python scripts/build_catalog.py --check   # data files, source manifest, generated docs
 uv run pytest tests/test_protocol.py
 uv run pytest tests/test_e2e_live.py -m e2e   # on demand; default CI uses -m 'not e2e'
 ./scripts/check_conformance.sh

{mcp_server_taxcode-0.7.2 → mcp_server_taxcode-1.0.0}/README.md

@@ -25,7 +25,7 @@ graph TD
     Gateway["FastMCP Root Gateway<br>(stdio / streamable-http)"]
     ParentMW["Parent Middleware<br>(Audit Logging, Timing, Secret Redaction, ReadOnly Gate)"]
     SysSub["System Sub-server (mount: 'system')<br>• system_get_health_status<br>• taxcode://system/reference/capabilities"]
-    StatSub["Statutes Sub-server (mount: 'statutes')<br>• statutes_lookup_statute<br>• statutes_search_tax_code<br>• statutes_list_publications"]
+    StatSub["Statutes Sub-server (mount: 'statutes')<br>• statutes_lookup_statute<br>• statutes_search_tax_code<br>• statutes_list_publications<br>• taxcode://statutes/{jurisdiction}/{section}"]
     CompSub["Compliance Sub-server (mount: 'compliance')<br>• compliance_evaluate_pr_bona_fide_residency<br>• compliance_calculate_built_in_gain_sourcing<br>• compliance_evaluate_georgia_residency<br>• compliance_evaluate_state_residency"]
     DuckDB["DuckDB In-Memory & File Engine<br>(117 Statutes, 18 Publications, Full-Text Search, Temporal Versions)"]
 
@@ -47,6 +47,8 @@ graph TD
   * **Puerto Rico (`PR`)**: Act 60-2019 (Resident Individual Investors, Export Services & Opportunity Zone definitions, Sec. 6020.10 annual reports), Ley 1-2011 (including Sec. 1031.02 exemptions and Sec. 1062.01 wage withholding and Sec. 1062.03 withholding on payments for services), Act 22-2012 predecessor versions, and administrative publications (CC RI 21-10, CC RI 25-12, CC RI 26-13, DA 21-04, DA 23-04, BI RI 26-02).
   * **All 50 US States + District of Columbia**: Comprehensive statutory definitions and tax computations covering no-income-tax states (AK, FL, NV, NH, SD, TN, TX, WA, WY), flat-tax regimes (AZ, CO, GA, ID, IL, IN, IA, KS, KY, MI, MS, NC, PA, UT), and graduated/surtax jurisdictions (AL, AR, CA, CT, DE, DC, HI, LA, ME, MD, MA, MN, MO, MT, NE, NJ, NM, NY, ND, OH, OK, OR, RI, SC, VT, VA, WV, WI) including Convenience of the Employer rules (NY, PA, NJ, CT, DE, NE) and local piggyback taxes (MD, IN, OH, NY).
 * **Snippet Search, Full Text by Id**: `statutes_search_tax_code` matches and ranks on the full text but returns a short snippet (up to 300 characters around the first matched term) plus each result's `id`, citation, title, jurisdiction, year, validity and content labels. Pass an `id` to `statutes_lookup_statute` as `citation_or_section` for the full text.
+* **Bounded Responses with Paging**: Every statutes tool result stays under 32,000 characters of JSON. `statutes_lookup_statute` returns long text in pages of up to 8,000 characters per text field (`text_page` gives the offset and full lengths; pass `next_cursor` back as `page_cursor` for the next page). `statutes_search_tax_code` and `statutes_list_publications` clamp `limit` to 1..25 items per call, with `offset` and `next_offset` for the next page. The `taxcode://statutes/{jurisdiction}/{section}` resource (for example `taxcode://statutes/US/933`) uses the same 8,000-character pages and cap: a page that is not the last ends with the URI of the next one, which carries a `?page_cursor=` query.
+* **Versioned Data Files**: Every statute and publication row lives in per-jurisdiction JSON under `src/taxcode_mcp/data/` with a source record per row, and the docs under `docs/` are generated from them (see [`CONTRIBUTING.md`](CONTRIBUTING.md)).
 * **Temporal Statutory Versioning**: Point-in-time statutory lookup with `superseded_year` filtering and descending historical ordering (`tax_year` parameter).
 * **Deterministic Compliance Engines**:
   * `evaluate_pr_bona_fide_residency`: Evaluates IRC § 937 presence (183-day, 549-day 3-year, 90-day US), tax home, and closer connection tests.
@@ -261,6 +263,7 @@ uv run ruff format --check .
 # 4. Tool contract, protocol & drift assertions
 uv run python scripts/check_tool_contract.py
 uv run python scripts/check_openapi_drift.py
+uv run python scripts/build_catalog.py --check   # data files, source manifest, generated docs
 uv run pytest tests/test_protocol.py
 uv run pytest tests/test_e2e_live.py -m e2e   # on demand; default CI uses -m 'not e2e'
 ./scripts/check_conformance.sh

mcp_server_taxcode-1.0.0/SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release receives security fixes. Upgrade to the newest version on [Releases](https://github.com/christianclaudio/mcp-server-taxcode/releases).
+
+## Outbound Connections and Proxies
+
+Every outbound request (the upstream API client, the drift monitor's `--spec-url` fetch and `ingest_statutes.py --check-upstream`) goes through `SSRFSafeAsyncTransport`. It looks the host up once per request, checks every address against the private, loopback, link-local, reserved and metadata ranges, and connects only to a checked address, keeping the hostname for the Host header, TLS SNI and certificate verification. Redirects are not followed. httpx ignores env proxies whenever a transport is passed (httpx `AsyncClient`: `allow_env_proxies = trust_env and transport is None`), so connections always go direct through the pin; egress-proxy deployments need a proxy-aware transport, which isn't provided. `trust_env=False` on the drift fetch and the `--check-upstream` probe is belt-and-braces.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please do NOT open a public GitHub issue.
+
+Please report vulnerabilities directly to the maintainer:
+* **Email**: `christianclaudio@mail.com`
+
+All reports will be acknowledged within 24 hours, and patches will be published with high priority.

mcp_server_taxcode-1.0.0/docker/pip-bootstrap.txt

@@ -0,0 +1,5 @@
+# pip for the Dockerfile builder's bootstrap, installed with --require-hashes so the install
+# does not depend on TLS trust. Hash of pip-26.2.2-py3-none-any.whl from PyPI's JSON API
+# (digests.sha256). Bump this pin and hash together with the pip floor; Dependabot does not.
+pip==26.2.2 \
+    --hash=sha256:fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70

mcp_server_taxcode-1.0.0/docs/ak/llms-full.txt

@@ -0,0 +1,10 @@
+# Full Statutory Corpus: AK
+
+## Alaska Stat. § 43.05.080: Revenue Administration and Absence of Individual Income Tax
+`Alaska Stat. > Title 43 > Chapter 05 > § 43.05.080`
+
+### English
+Empowers the Department of Revenue to administer tax laws, operating alongside the historic repeal of former AS 43.20 individual income tax by Ch. 1, SLA 1980.
+
+### Español
+Faculta al Departamento de Ingresos a reglamentar la administración tributaria estatal, tras la histórica derogación del impuesto individual por el Cap. 1, SLA 1980.

mcp_server_taxcode-1.0.0/docs/al/llms-full.txt

@@ -0,0 +1,10 @@
+# Full Statutory Corpus: AL
+
+## Ala. Code § 40-18-2: Tax on Individuals
+`Ala. Code > Title 40 > Chapter 18 > § 40-18-2`
+
+### English
+Imposes graduated individual income tax rates of 2%, 4%, and 5% on taxable net income of individuals in Alabama.
+
+### Español
+Impone tasas impositivas individuales graduadas del 2%, 4% y 5% sobre el ingreso neto gravable de individuos en Alabama.

mcp_server_taxcode-1.0.0/docs/ar/llms-full.txt

@@ -0,0 +1,10 @@
+# Full Statutory Corpus: AR
+
+## Ark. Code Ann. § 26-51-201: Tax on Individuals, Trusts, and Estates
+`A.C.A. > Title 26 > Subtitle 5 > Chapter 51 > Subchapter 2 > § 26-51-201`
+
+### English
+Imposes individual income tax with graduated brackets and top rate of 3.90% under Arkansas Act 1 of 2024.
+
+### Español
+Impone impuesto sobre el ingreso individual con tramos graduados y tasa máxima de 3.90% bajo la Ley 1 de 2024 de Arkansas.

mcp_server_taxcode-1.0.0/docs/az/llms-full.txt

@@ -0,0 +1,19 @@
+# Full Statutory Corpus: AZ
+
+## A.R.S. § 43-1011: Taxes and Tax Rates - Individuals
+`A.R.S. > Title 43 > Chapter 10 > Article 1 > § 43-1011`
+
+### English
+Imposes a flat individual income tax rate of 2.50% on Arizona taxable income, enacted by SB 1828 to replace graduated individual tax brackets.
+
+### Español
+Impone una tasa impositiva fija del 2.50% sobre el ingreso gravable de Arizona de individuos, promulgada bajo SB 1828 eliminando tramos graduales anteriores.
+
+## A.R.S. § 43-104: Definitions - Resident and Presumption of Residency
+`A.R.S. > Title 43 > Chapter 1 > Article 1 > § 43-104`
+
+### English
+Defines resident as every individual in Arizona for other than a temporary or transitory purpose; individuals spending in the aggregate more than nine months (270 days) of the tax year in state are presumed residents.
+
+### Español
+Define residente como todo individuo en Arizona para fines no temporales ni transitorios; quien pase en agregado más de nueve meses (270 días) en el estado se presume residente.

mcp_server_taxcode-1.0.0/docs/ca/llms-full.txt

@@ -0,0 +1,37 @@
+# Full Statutory Corpus: CA
+
+## Cal. Rev. & Tax Code § 17014: Definition of Resident (Non-Temporary Purpose Test)
+`Cal. Rev. & Tax Code > Part 10 > Chapter 1 > § 17014`
+
+### English
+Defines resident as every individual who is in California for other than a temporary or transitory purpose, and every individual domiciled in California who is outside the state for a temporary or transitory purpose. Presumption under § 17016 at 9 months.
+
+### Español
+Define residente como todo individuo que permanezca en California para fines que no sean temporales o transitorios, y todo domiciliado que esté fuera del estado de forma temporal. Aplica el criterio de conexión más cercana.
+
+## Cal. Rev. & Tax Code § 17041: Individual Income Tax Rates and Brackets
+`Cal. Rev. & Tax Code > Part 10 > Chapter 2 > § 17041`
+
+### English
+Imposes graduated income tax rates on California taxable income ranging from 1% to 12.3%, plus a 1% Mental Health Services Tax surcharge on taxable income exceeding $1,000,000, creating a top marginal individual rate of 13.3%.
+
+### Español
+Grava el ingreso tributable de California con tasas escalonadas del 1% al 12.3%, más 1% de recargo para servicios de salud mental sobre ingresos mayores a $1M (Proposición 63), para una tasa marginal máxima de 13.3%.
+
+## Cal. Rev. & Tax Code § 17951: Gross Income of Nonresidents and Sourcing
+`Cal. Rev. & Tax Code > Part 10 > Chapter 9 > § 17951`
+
+### English
+In the case of nonresidents, gross income includes only gross income from sources within California, including income from a business, trade, or profession conducted in the state, and compensation for personal services performed in California.
+
+### Español
+Para no residentes, el ingreso bruto comprende únicamente ingresos derivados de fuentes en California, incluyendo negocios, profesiones y servicios personales realizados dentro del estado.
+
+## 18 CCR § 17014: FTB Residence and Domicile Guidelines
+`18 CCR > Division 3 > Chapter 2.5 > Subchapter 1 > § 17014`
+
+### English
+FTB regulation detailing domicile and residence determination. A person may have multiple residences but only one domicile. Applies the closest connection test evaluating real property, family, bank accounts, business affiliations, and licenses.
+
+### Español
+Reglamento de la FTB sobre residencia y domicilio. Aplica el criterio de conexión más cercana evaluando propiedades inmuebles, familia, cuentas bancarias, licencias profesionales y afiliaciones comerciales.

mcp_server_taxcode-1.0.0/docs/co/llms-full.txt

@@ -0,0 +1,19 @@
+# Full Statutory Corpus: CO
+
+## Colo. Rev. Stat. § 39-22-104: Levy of Tax - Single Rate for Individuals
+`C.R.S. > Title 39 > Article 22 > Part 1 > § 39-22-104`
+
+### English
+Imposes a flat tax of 4.40% on Colorado modified federal taxable income of individuals pursuant to voter-approved Proposition 121 (reduced from 4.55%).
+
+### Español
+Impone una tasa uniforme del 4.40% sobre el ingreso federal tributable modificado de individuos de Colorado bajo la Proposición 121 aprobada por los electores.
+
+## Colo. Rev. Stat. § 39-22-103: Definitions - Resident Individual
+`C.R.S. > Title 39 > Article 22 > Part 1 > § 39-22-103`
+
+### English
+Defines a resident individual as one domiciled in Colorado, or who maintains a permanent place of abode in Colorado and spends in the aggregate more than six months of the taxable year in Colorado.
+
+### Español
+Define individuo residente como quien tiene domicilio en Colorado, o mantiene morada permanente y pasa en agregado más de seis meses del año contributivo en Colorado.