moca-reader 0.6.0__tar.gz

moca_reader-0.6.0/.gitattributes

@@ -0,0 +1,4 @@
+# Package digests and signatures cover exact bytes, so every checkout must
+# have the same line endings on every platform.
+* text=auto eol=lf
+*.zip binary

moca_reader-0.6.0/.github/dependabot.yml

@@ -0,0 +1,11 @@
+# Weekly update PRs, and immediate PRs for security advisories.
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

moca_reader-0.6.0/.github/workflows/test.yml

@@ -0,0 +1,169 @@
+name: Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+# The other MOCA repositories, at fixed refs: release tags, or commits while a Spec Change
+# Proposal is in flight; never a branch (moca-spec CONTRIBUTING.md).
+env:
+  MOCA_SPEC_REF: v0.6.0
+  MOCA_READER_TYPESCRIPT_REF: v0.6.0
+  MOCA_TOOLS_REF: v0.6.0
+
+jobs:
+  deps:
+    name: Public dependencies only
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: moca-reader-python
+      # The check lives in moca-spec, the one copy every open repository runs.
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ github.repository_owner }}/moca-spec
+          ref: ${{ env.MOCA_SPEC_REF }}
+          path: moca-spec
+          # Read access to the other MOCA repos while they are private.
+          token: ${{ secrets.MOCA_REPOS_TOKEN || github.token }}
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: node moca-spec/scripts/check-deps.mjs moca-reader-python
+
+  test:
+    name: Test (${{ matrix.os }}, Python ${{ matrix.python }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python: ['3.11', '3.14']
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: moca-reader-python
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ github.repository_owner }}/moca-spec
+          ref: ${{ env.MOCA_SPEC_REF }}
+          path: moca-spec
+          token: ${{ secrets.MOCA_REPOS_TOKEN || github.token }}
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: ${{ matrix.python }}
+      - run: uv sync --locked
+        working-directory: moca-reader-python
+      - run: uv run ruff check && uv run ruff format --check && uv run mypy
+        working-directory: moca-reader-python
+      - run: uv run pytest
+        working-directory: moca-reader-python
+
+  corpus:
+    name: Corpus and parity with the reference Reader
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: moca-reader-python
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ github.repository_owner }}/moca-spec
+          ref: ${{ env.MOCA_SPEC_REF }}
+          path: moca-spec
+          token: ${{ secrets.MOCA_REPOS_TOKEN || github.token }}
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ github.repository_owner }}/moca-reader-typescript
+          ref: ${{ env.MOCA_READER_TYPESCRIPT_REF }}
+          path: moca-reader-typescript
+          token: ${{ secrets.MOCA_REPOS_TOKEN || github.token }}
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ github.repository_owner }}/moca-tools
+          ref: ${{ env.MOCA_TOOLS_REF }}
+          path: moca-tools
+          token: ${{ secrets.MOCA_REPOS_TOKEN || github.token }}
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: '3.14'
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: uv sync --locked
+        working-directory: moca-reader-python
+      - run: npm ci
+        working-directory: moca-reader-typescript
+      - run: npm ci
+        working-directory: moca-tools
+      - run: npm ci
+        working-directory: moca-spec
+      - run: node scripts/run-conformance.mjs --reader "../moca-reader-python/.venv/bin/python -m moca_reader.conformance"
+        working-directory: moca-spec
+      # The corpus never compares ranking; this checks we return what the reference Reader returns, in its order.
+      - run: node tests/parity/parity.mjs
+        working-directory: moca-reader-python
+
+  # Phase 1's gate: the getting-started guide works as written (docs/getting-started.md).
+  guide:
+    name: Getting-started guide
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: moca-reader-python
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ github.repository_owner }}/moca-spec
+          ref: ${{ env.MOCA_SPEC_REF }}
+          path: moca-spec
+          token: ${{ secrets.MOCA_REPOS_TOKEN || github.token }}
+      # moca-spec's corpus runner links the reference Reader and moca-tools until they are on npm.
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ github.repository_owner }}/moca-reader-typescript
+          ref: ${{ env.MOCA_READER_TYPESCRIPT_REF }}
+          path: moca-reader-typescript
+          token: ${{ secrets.MOCA_REPOS_TOKEN || github.token }}
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ github.repository_owner }}/moca-tools
+          ref: ${{ env.MOCA_TOOLS_REF }}
+          path: moca-tools
+          token: ${{ secrets.MOCA_REPOS_TOKEN || github.token }}
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - uses: astral-sh/setup-uv@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm ci
+        working-directory: moca-reader-typescript
+      - run: npm ci
+        working-directory: moca-tools
+      - name: Example package from the moca-spec release
+        env:
+          GH_TOKEN: ${{ secrets.MOCA_REPOS_TOKEN || github.token }}
+        run: gh release download v0.6.0 -R ${{ github.repository_owner }}/moca-spec -p support-kb.moca -p example-trust-root.json -D "$RUNNER_TEMP/assets"
+      - run: uv build --out-dir "$RUNNER_TEMP/dist"
+        working-directory: moca-reader-python
+      # Until moca-reader is on PyPI and the repositories are public: install the wheel built from this
+      # commit, read the example from the private release, and use the moca-spec checkout. Drop each
+      # replacement when what it stands in for is public.
+      - run: >-
+          node ../moca-spec/scripts/run-guide.mjs docs/getting-started.md
+          --replace "pip install moca-reader=>pip install $RUNNER_TEMP/dist/moca_reader-*.whl"
+          --replace "https://github.com/openmoca/moca-spec/releases/download/v0.6.0/=>file://$RUNNER_TEMP/assets/"
+          --replace "git clone --depth 1 --branch v0.6.0 https://github.com/openmoca/moca-spec.git=>ln -s $GITHUB_WORKSPACE/moca-spec moca-spec"
+        working-directory: moca-reader-python

moca_reader-0.6.0/.gitignore

@@ -0,0 +1,8 @@
+.venv/
+__pycache__/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+dist/
+.DS_Store
+.claude/

moca_reader-0.6.0/CHANGELOG.md

@@ -0,0 +1,228 @@
+# Changelog
+
+All notable changes to `moca-reader`. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [0.6.0] - 2026-11-11
+
+### Added (Sigstore, offline)
+
+- With the `sigstore` extra, Sigstore bundles are verified offline against the
+  host's `sigstore.trustedRoot`, through sigstore-python 4.x. Without the extra
+  or a trusted root they stay A003; identities listed but none for the role is
+  A002, as in the reference Reader. There is no online mode. The corpus's
+  `sigstore-*` cases pass.
+
+### Fixed (attestations §5)
+
+- Strict Ed25519 checks before verifying: A and R are canonical points of
+  prime order, S < L. Before, a trusted small-order key verified a signature
+  of any message.
+
+### Fixed (frontmatter line ends)
+
+- Only LF or CRLF ends a line in the frontmatter block, in every Reader. The
+  reference Reader also ended lines at a lone CR, U+2028 and U+2029.
+
+### Fixed (edge cases)
+
+- Regular expressions and trimming follow package spec §2: ASCII digits,
+  ECMAScript white space, and an absolute end of string. Before, a date in
+  non-ASCII digits parsed, and a trailing newline passed several checks.
+- An archive entry with a bad CRC-32 raised `BadZipFile`; it is now P002, as
+  is a stored entry whose size does not match its header.
+- M007 knows every IANA formal URN namespace and informal ones.
+- A leading byte order mark is not part of an evidence source.
+
+### Changed (conformance adapter)
+
+- The adapter passes the corpus option `strict`.
+
+### Added (versioning, package spec §14)
+
+- `M009_MOCA_VERSION_NEWER` (warning) for a package written for a newer
+  `mocaVersion` than `MOCA_VERSION` (`0.6`). Versions compare numerically, without
+  overflow. The `mocaVersion` check uses a full match, so a trailing newline no longer counts. The vendored schemas have portable patterns.
+
+### Added (composition limits, package spec §7.1.1)
+
+- Member resolution is bounded: `limits={"maxMemberDepth": …, "maxMembers": …}` (defaults 8 and 256, across every
+  depth of one read). A member past either limit is not resolved, and
+  `R001_MEMBER_UNRESOLVED` says why.
+
+### Removed (structure.json, moca-spec ADR-0019)
+
+- The Reader no longer reads or checks `structure.json`, and
+  `O004_STRUCTURE_VIEW_MISMATCH` is retired. A package that ships the file
+  stays valid and gets `structured` from `structure.ttl` alone. `structure_view` stays.
+
+### Changed (sidecars and search)
+
+- A sidecar item's `text` must equal the package's bytes at its span, which
+  must lie in the body (`S004`); lexical search reads the package's bytes, never
+  the sidecar's text, so a sidecar cannot stuff keywords into a node.
+- A prefix declared by only the index or only the embedder is `S006`.
+- The gate keeps one result per node representation and span: the English and
+  French pages of one node are no longer merged.
+
+### Changed (determinism)
+
+- `moca.json` and attestation statements that repeat a member name are `M001`
+  and `A001` (they were read with the last value).
+- Locale fallback: exact, then the longest tag the request starts with, then the
+  lowest tag starting with the request, all case-insensitive.
+- Evidence: Markdown and HTML quotes are normalised like their sources, and a
+  `TextPositionSelector` on its own is no longer checked (`matched` absent).
+
+### Changed (limits and archives, review B9 and M6)
+
+- Evidence work is bounded per package (`maxEvidenceChecksPerPackage`, 10,000;
+  `maxEvidenceBytesPerPackage`, 256 MiB scanned), each source is normalised once,
+  and a quote is matched in one pass. A package of 200 nodes with 256 quotes each
+  against an 8 MiB source now reads in well under a second.
+- Directories have the entry and byte limits, and a file replaced by a link
+  after listing is unreadable.
+- Archives: names must be UTF-8 (flag set) with no NUL, empty or `.` segments;
+  duplicate entries are `P003`; only stored and deflated entries are read
+  (others `P002`), and an unreadable entry stops the read.
+
+### Changed (identity and tampering, review M2 and M3)
+
+- A library refuses a second package with the same `id@version` and a different
+  digest, and reports `L001_IDENTITY_CONFLICT` (it was dropped silently).
+- A package attestation naming this `id@version` with another digest is
+  `A008_PACKAGE_DIGEST_MISMATCH`, not `A002`.
+- A resolved member whose `id` or `version` differs from its pin is `R002`.
+- `read_package(target, require_signature=True)` makes a package without a valid package attestation invalid
+  (`A009_SIGNATURE_REQUIRED`).
+
+### Changed (store search, review B2)
+
+- A store search takes the loaded packages' states (`package_state(result)`; `StoreScope(states, clock)`) instead of bare
+  digests, and recomputes `superseded`, `contested`, `signed`, `signers`,
+  `attestedReviews` and `reviewStatus` at query time (contract §9.4). A package
+  superseded after ingest, or a key removed from the trust root, is reflected
+  at once.
+
+### Changed (reviews, moca-spec ADR-0017)
+
+- `reviewed` needs a signed package with every reviewed file approved.
+  Citation records gain `trust.reviewStatus` (`approved`, `disputed`,
+  `unverified`, `none`) and each review's `packageVerified`. The latest review
+  from each signer counts; a review dated after the clock is ignored
+  (`A007_REVIEW_DATE_FUTURE`); a trust-root entry's `reviewers` list limits whom
+  its key may sign as.
+
+### Changed (audience, moca-spec ADR-0016)
+
+- Under a host audience set, content with no audience label is left out unless
+  the host allows it (`Search(..., allow_unlabelled=True)`, off by default), and a malformed label never
+  matches; citation records mark it `audienceInvalid`. A translation with no
+  label has its default representation's. The gate, the backends and the store
+  backend apply the same rule.
+
+### Changed (relations, moca-spec ADR-0015)
+
+- `supersedes` and `conflictsWith` take effect only when the declaring package
+  has a valid package attestation from a key or Sigstore identity whose new
+  trust-root `ids` cover the target's id (package spec §7.2). Otherwise the
+  Reader reports `R004_RELATION_UNAUTHORISED` (info) and the relation has no
+  effect. `Library(allow_unsigned_relations=True)` (off by default) applies unsigned relations, for a library
+  of the host's own packages.
+
+### Changed
+
+Dates follow package spec §4.4:
+
+- A full date means 00:00Z; a date-time needs an offset, and one without is
+  ignored (it already has a diagnostic) rather than read as UTC.
+- A node's validity window is the intersection with its package's: a node can
+  no longer stay in force after the package's `validUntil`. An inverted window
+  is ignored.
+- A trust-root key is not trusted from the instant of `expires`, checked
+  against the host clock, which `read_package` now takes (`clock`, a callable returning a `datetime`). A key whose `expires`
+  does not parse is not trusted.
+
+Attestation verification follows the numbered algorithm now in attestations §7
+(0.6.0):
+
+- DSSE payloads and signatures are decoded strictly: base64 or base64url, with
+  or without padding. Anything else makes the payload malformed (`A001`) or the
+  signature not verify.
+- A trust root is refused if it repeats a `keyid` or has a key or identity
+  without `roles`. An empty `roles` list trusts the entry for nothing.
+
+### Fixed
+
+Fixes from the 10 November 2026 specification review, each with a new case
+in the moca-spec 0.6.0 conformance corpus:
+
+- A malformed percent-encoding in a source `resource` or a link is reported as
+  `C008_UNSAFE_PATH` instead of being silently skipped.
+- An absolute reference (a leading `/` or `\`, or a drive prefix such as `C:/`)
+  is `C008_UNSAFE_PATH`, as the Reader contract says. It was resolved under
+  `content/`.
+- Structure traversal is iterative: a 30,000-concept `requires` chain no longer
+  risks the recursion limit.
+- A validity bound or `stale_after` that does not parse as a date is treated as
+  absent; it no longer takes a node out of force.
+- A `generated` or `verified` entry with no `by` is dropped; it was reported
+  with the actor `"undefined"`.
+- `log.md` and `index.md` frontmatter gets the frontmatter size limit, and a
+  level-two heading (`##`) inside a fenced code block in `log.md` is no longer a C004 error.
+- `moca.json` that is not valid UTF-8 is `M001`; it was read with replacement
+  characters.
+- Only entries under `attestations/` are left out of the digest; a top-level
+  file named `attestations` is digested.
+- Member cycles are detected by `id@version`, so a package can compose another
+  version of itself.
+- A host source's byte limit is also enforced on the bytes it returns, and a
+  limit broken while reading is one `T003`, not a `P002` per file. An existing
+  file that is not a directory or a `.moca`/`.zip` archive is `T002`.
+- Archive bytes are accepted as a target.
+- A trust-root key or identity with an empty `roles` list is trusted for
+  nothing. It was trusted for both roles: a key a host disabled by emptying its
+  roles stayed live.
+
+## [0.5.0] - Not published
+
+The first release. It implements moca-spec 0.5 (0.5.0), passes all 93
+cases of the 0.5.0 conformance corpus, both as pytest cases and
+through the runner protocol, and returns the same ranked results as the
+reference Reader in all 87 parity queries.
+
+
+### Performance
+
+- **Lexical search keeps each document's term counts** after its first search,
+  per package digest, and drops them when the package leaves the library.
+  Later searches only score: at 5,000 pages, about 21 ms a search after the
+  first. Scores and order are unchanged (the corpus and the parity check
+  against the reference Reader pass).
+
+### Added
+
+- `moca_reader.embedders`, with the `onnx` extra: MOCA's four standard embedding
+  models (`bge-small-en-v1.5`, `nomic-embed-text-v1.5`, `all-MiniLM-L6-v2`,
+  `multilingual-e5-small`) run locally, pinned by commit and SHA-256, checked
+  before loading. Vectors match `moca-index --model`, the .NET Reader's ONNX
+  binding and the MCP server exactly.
+### Added
+
+- `read_package`: directories, `.moca` archives and host sources; the
+  moca-digest-v2 digest; DSSE package and review attestations against a host
+  trust root, with Ed25519 keys only (attestations §5); members through a host resolver; content, evidence checks,
+  structure and capabilities. Sigstore bundles are reported as unverifiable
+  (`A003`).
+- `Library`, `Search` and the gate; `LexicalBackend` (BM25 with the shared
+  tokeniser), `DenseBackend` over sidecar vectors (`S006`, `S007`,
+  `model.distance`, compared embedder prefixes), `MemoryStoreBackend`,
+  `HybridBackend` (Reciprocal Rank Fusion); `ontology_guided` and `diversify`
+  hooks; structure operations.
+- `bind_sidecar` for `moca-jsonl-v1` sidecars, with float32 vectors.
+- `python -m moca_reader.conformance`: the runner protocol adapter, shipped
+  with the package.
+- `flat_metadata(record)` and `FLAT_FIELDS`: the consuming guide's flat
+  `moca_*` fields for a citation record.
+- `moca-reader-langchain` and `moca-reader-llamaindex`: `MocaRetriever` for
+  each framework, over a host-built `Search`, carrying the whole citation
+  record and the flat fields in each result's metadata (ADR-0002).

moca_reader-0.6.0/CLAUDE.md

@@ -0,0 +1,11 @@
+# moca-reader-python
+
+The Python MOCA Reader, `moca-reader` / `moca_reader` ([ADR-0001](docs/adr/0001-reader-library-with-no-host-dependencies.md)).
+
+- **No host dependencies.** Only the runtime dependencies in `pyproject.toml`; no web framework, no network clients.
+- **The spec is the contract.** Normative sources in `../moca-spec/spec/`. The reference Reader (TypeScript) is `../moca-reader-typescript/lib/`; this Reader's modules map one-to-one onto it. When they disagree, the spec wins; raise the difference as an issue in moca-spec.
+- **Match the reference exactly where Python differs from JavaScript**: `_js.py` holds those behaviours (UTF-16 sort order, `Math.round`, `Date.parse`, lenient base64, `JSON.stringify`, truthiness). Use it rather than Python's defaults.
+- **Never raise for a malformed package.** Report diagnostics. Raise only for programmer errors.
+- **Never reach the network or the host filesystem outside the package** because a package names something.
+- Name things as the spec does, in Python's style; comment each rule with its section (`# Contract §3.2`).
+- Checks: `uv run pytest`, `uv run ruff check`, `uv run ruff format --check`, `uv run mypy` (strict), the corpus through the runner, and `node tests/parity/parity.mjs`.

moca_reader-0.6.0/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Modular Ontology & Content Assembly (MOCA) Standard Contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

moca_reader-0.6.0/NOTICE

@@ -0,0 +1,15 @@
+MOCA — Modular Ontology, Content & Attestation
+Copyright 2026 MOCA Standard Contributors
+
+This product includes software developed by the MOCA Standard Contributors
+(https://github.com/openmoca).
+
+Licensed under the Apache License, Version 2.0. You may obtain a copy of the
+License in the LICENSE file in this repository, or at
+http://www.apache.org/licenses/LICENSE-2.0
+
+---
+
+The MOCA Reader for Python and its framework bindings (the files under src/,
+packages/ and tests/). All of it is licensed under the Apache License,
+Version 2.0.