mfx-sdk 0.0.0__tar.gz

mfx_sdk-0.0.0/.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{json,yml,yaml,ts,tsx,js,jsx,md}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

mfx_sdk-0.0.0/.gitattributes

@@ -0,0 +1,6 @@
+* text=auto eol=lf
+*.png binary
+*.jpg binary
+*.ico binary
+*.docx binary
+*.zip binary

mfx_sdk-0.0.0/.github/CODEOWNERS

@@ -0,0 +1,6 @@
+# CODEOWNERS — mfx-sdk-python
+# The SDK is the tenant-facing contract (MFX-CLAUDE.md §9.6).
+*                                   @kudmani
+/src/mfx/errors.py                  @kudmani
+/src/mfx/execution.py               @kudmani
+/tests/conformance/                 @kudmani

mfx_sdk-0.0.0/.github/workflows/ci.yml

@@ -0,0 +1,23 @@
+# CI for mfx-sdk-python — ADR-18: PRs target develop; develop and main are protected.
+# Reusable workflow is pinned BY TAG, never @develop.
+name: ci
+
+on:
+  push:
+    branches: [develop, main]
+  pull_request:
+    branches: [develop, main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    uses: mfx-platform/mfx-infra/.github/workflows/_python-ci.yml@v1
+    with:
+      package-path: src/mfx
+      run-import-linter: false

mfx_sdk-0.0.0/.github/workflows/release.yml

@@ -0,0 +1,85 @@
+# Publish mfx-sdk to PyPI — no API token, ever (AB#5626, DEC-97).
+#
+# Authentication is PyPI's trusted publishing: GitHub mints a short-lived OIDC token for this
+# workflow, and PyPI accepts it because the project names this repository, this workflow file and
+# this environment as its publisher. Nothing to store, nothing to rotate, nothing to leak — which
+# is the same reason the platform signs with Ed25519 rather than a shared secret (DEC-84).
+#
+# Two ways in:
+#   * "Reserve the name"  — one manual run with the default 0.0.0, which claims `mfx-sdk` on PyPI.
+#     PyPI reserves nothing without an upload, so the placeholder IS the reservation.
+#   * A tag `v*`          — the real releases, from the version in pyproject.toml.
+#
+# A version can never be re-uploaded to PyPI, so 0.0.0 is spent on the placeholder and the first
+# real release is 0.1.0.
+name: release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version to publish (0.0.0 reserves the name)
+        type: string
+        default: "0.0.0"
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    # The environment PyPI's pending publisher names. Keep the two in step.
+    environment: pypi
+    permissions:
+      # Both, because a job's permissions REPLACE the workflow's rather than adding to them:
+      # id-token alone leaves the token unable to read a private repository, and checkout then
+      # fails with "Repository not found", which reads like the repo is gone.
+      contents: read
+      # The OIDC token trusted publishing exchanges for an upload. This is the whole credential.
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Set the version for a placeholder run
+        if: github.event_name == 'workflow_dispatch'
+        shell: bash
+        run: |
+          set -euo pipefail
+          version='${{ inputs.version }}'
+          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+([ab.rc0-9]*)?$ ]] || {
+            echo "::error::'$version' is not a version"; exit 1; }
+          # The only line that may change: the project's own version, never a dependency's.
+          python - "$version" <<'PY'
+          import re, sys
+          from pathlib import Path
+
+          version = sys.argv[1]
+          path = Path("pyproject.toml")
+          before = path.read_text(encoding="utf-8")
+          after, count = re.subn(r'(?m)^version = "[^"]+"$', f'version = "{version}"', before, count=1)
+          if count != 1:
+              raise SystemExit("pyproject.toml has no project version line to set")
+          path.write_text(after, encoding="utf-8")
+          print(f"building {version}")
+          PY
+
+      - name: Build the sdist and wheel
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+
+      - name: What is about to be published
+        run: |
+          python -m pip install --upgrade twine
+          twine check dist/*
+          ls -l dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        # No `password:` — the OIDC token above is the credential.

mfx_sdk-0.0.0/.gitignore

@@ -0,0 +1,37 @@
+# Python
+__pycache__/
+*.py[cod]
+.venv/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+dist/
+build/
+*.egg-info/
+
+# Node
+node_modules/
+.next/
+out/
+*.tsbuildinfo
+
+# Secrets — nothing credential-shaped is ever committed (guardrail #2)
+.env
+.env.*
+*.pem
+*.pfx
+*.key
+*.publishsettings
+azureauth.json
+
+# Local
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
+!.vscode/extensions.json
+.claude/
+reports/
+tc-manifest.json

mfx_sdk-0.0.0/PKG-INFO

@@ -0,0 +1,39 @@
+Metadata-Version: 2.5
+Name: mfx-sdk
+Version: 0.0.0
+Summary: Typed client for the MFX API — the only way a tenant talks to MFX (MFX-CLAUDE §9.6)
+License: Proprietary
+Keywords: market-data,mfx,mt5,trading
+Requires-Python: >=3.12
+Requires-Dist: anyio>=4.6
+Requires-Dist: httpx>=0.28
+Requires-Dist: pydantic>=2.9
+Requires-Dist: structlog>=24.4
+Description-Content-Type: text/markdown
+
+# mfx-sdk-python
+
+The typed Python client for the MFX v1 API. **This is the contract** — FabricX and every other
+tenant consume MFX only through this library.
+
+> **MFX is hard-isolated from FabricX (ADR-02).** No code here imports or references anything
+> named `fabricx*`. FabricX is Tenant 0 and consumes the public API like any other tenant.
+> Governance: [`mfx-docs/MFX-CLAUDE.md`](https://github.com/mfx-platform/mfx-docs/blob/develop/MFX-CLAUDE.md)
+
+## Design rules (MFX-CLAUDE.md §9.6 — binding)
+
+1. Total coverage of §9.1 — if a tenant needs `httpx` to call MFX, the SDK is incomplete.
+2. **Execution methods never raise.** Transport faults, timeouts and broker rejections are all *results*.
+3. Granular MT5 reasons, not buckets — `{mt5_retcode, retcode_text, reason, comment_raw}`.
+4. Structured JSON logging; credentials unloggable by type.
+5. `idempotency_key` is mandatory on every write — no silent defaults.
+6. `broker_latency_ms` and `agent_latency_ms` reported separately, always.
+7. Pydantic v2, `py.typed`, mypy --strict, generated from `openapi.yaml`.
+8. Async-first; thin sync facade for scripts only.
+9. SDK semver independent of API version.
+10. The conformance suite is the spec.
+
+## Completeness gate
+
+`MFX-MetaAPI-Consumption-Inventory.md` §2 — every row needs a typed method before G1.
+

mfx_sdk-0.0.0/README.md

@@ -0,0 +1,26 @@
+# mfx-sdk-python
+
+The typed Python client for the MFX v1 API. **This is the contract** — FabricX and every other
+tenant consume MFX only through this library.
+
+> **MFX is hard-isolated from FabricX (ADR-02).** No code here imports or references anything
+> named `fabricx*`. FabricX is Tenant 0 and consumes the public API like any other tenant.
+> Governance: [`mfx-docs/MFX-CLAUDE.md`](https://github.com/mfx-platform/mfx-docs/blob/develop/MFX-CLAUDE.md)
+
+## Design rules (MFX-CLAUDE.md §9.6 — binding)
+
+1. Total coverage of §9.1 — if a tenant needs `httpx` to call MFX, the SDK is incomplete.
+2. **Execution methods never raise.** Transport faults, timeouts and broker rejections are all *results*.
+3. Granular MT5 reasons, not buckets — `{mt5_retcode, retcode_text, reason, comment_raw}`.
+4. Structured JSON logging; credentials unloggable by type.
+5. `idempotency_key` is mandatory on every write — no silent defaults.
+6. `broker_latency_ms` and `agent_latency_ms` reported separately, always.
+7. Pydantic v2, `py.typed`, mypy --strict, generated from `openapi.yaml`.
+8. Async-first; thin sync facade for scripts only.
+9. SDK semver independent of API version.
+10. The conformance suite is the spec.
+
+## Completeness gate
+
+`MFX-MetaAPI-Consumption-Inventory.md` §2 — every row needs a typed method before G1.
+

mfx_sdk-0.0.0/pyproject.toml

@@ -0,0 +1,83 @@
+[project]
+name = "mfx-sdk"
+version = "0.0.0"
+description = "Typed client for the MFX API — the only way a tenant talks to MFX (MFX-CLAUDE §9.6)"
+requires-python = ">=3.12"
+readme = "README.md"
+license = { text = "Proprietary" }
+keywords = ["mfx", "mt5", "trading", "market-data"]
+
+dependencies = [
+    "httpx>=0.28",
+    "pydantic>=2.9",
+    "anyio>=4.6",
+    "structlog>=24.4",
+]
+
+[dependency-groups]
+dev = [
+    "pytest>=8.3",
+    "pytest-asyncio>=0.24",
+    "pytest-cov>=6.0",
+    "mypy>=1.13",
+    "ruff>=0.8",
+    "respx>=0.22",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/mfx"]
+
+# ---------------------------------------------------------------------------
+# Quality gates — MFX-CLAUDE.md §15 and §9.6 rule 7 (typed end to end)
+# ---------------------------------------------------------------------------
+
+[tool.ruff]
+line-length = 100
+target-version = "py312"
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "N", "UP", "B", "A", "C4", "T20", "SIM", "ARG", "ASYNC", "S"]
+ignore = ["S101"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["ARG", "S105", "S106"]
+# Generated from openapi.yaml — never hand-edited, so never hand-linted (§9.6 rule 7).
+"src/mfx/_generated/**" = ["ALL"]
+
+[tool.mypy]
+python_version = "3.12"
+strict = true
+warn_unreachable = true
+disallow_any_explicit = false
+plugins = ["pydantic.mypy"]
+
+[[tool.mypy.overrides]]
+module = "tests.*"
+disallow_untyped_defs = false
+
+[[tool.mypy.overrides]]
+module = "mfx._generated.*"
+ignore_errors = true
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+testpaths = ["tests"]
+addopts = "--cov=src/mfx --cov-report=term-missing --cov-fail-under=100"
+markers = [
+    "tc(case_id): Azure Test Plans case id, e.g. tc('TC-S1-W4-004') — ADR-25 §2.5",
+    "integration: needs external services",
+    "sit: runs against a deployed MFX environment",
+    "conformance: the contract suite every MFX deployment must pass (§9.6 rule 10)",
+    "severity(level): severity for an auto-raised bug when this case fails (default 3)",
+]
+
+[tool.coverage.report]
+exclude_also = ["if TYPE_CHECKING:", "raise NotImplementedError", "\\.\\.\\."]
+
+[tool.coverage.run]
+omit = ["src/mfx/_generated/*"]

mfx_sdk-0.0.0/src/mfx/__init__.py

@@ -0,0 +1,6 @@
+"""MFX client library — the only way a tenant talks to MFX (MFX-CLAUDE §9.6).
+
+Execution methods never raise across the boundary; read methods raise the typed hierarchy.
+"""
+
+__version__ = "0.1.0"

mfx_sdk-0.0.0/tests/unit/test_repo_shape.py

@@ -0,0 +1,27 @@
+"""Repository hygiene for the SDK.
+
+Given a fresh checkout / When the package is imported / Then it is typed, versioned and locked,
+which is what ``uv sync --locked`` and ``mypy --strict`` need before W4 fills in the client.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import mfx
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+PACKAGE = REPO_ROOT / "src" / "mfx"
+
+
+def test_package_exposes_a_version() -> None:
+    assert mfx.__version__
+
+
+def test_package_ships_py_typed() -> None:
+    """§9.6 rule 7 — typed end to end, so consumers get the types from the wheel."""
+    assert (PACKAGE / "py.typed").is_file()
+
+
+def test_lockfile_is_committed() -> None:
+    assert (REPO_ROOT / "uv.lock").is_file()