nrdax 0.1.0__tar.gz

nrdax-0.1.0/.gitignore

@@ -0,0 +1,37 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+wheelhouse/
+.venv/
+venv/
+env/
+
+# Tooling caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+.coverage.*
+htmlcov/
+coverage.xml
+.tox/
+
+# Docs build
+site/
+
+# Editors / OS
+.idea/
+.vscode/
+*.swp
+.DS_Store
+
+# Local nrdax cache (never commit fetched snapshots)
+.nrdax-cache/
+
+# Dataset validation output is generated locally, not committed (assess separately)
+VALIDATION_REPORT.md
+VALIDATION_REPORT*.md

nrdax-0.1.0/CHANGELOG.md

@@ -0,0 +1,53 @@
+# Changelog
+
+All notable changes to `nrdax-python` are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the package version
+follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+Note: the *package* version tracked here is independent of the *NRDAX dataset*
+version and the *NRDAX schema* version. See `docs/data-model.md` for the
+compatibility policy.
+
+## [Unreleased]
+
+## [0.1.0] - 2026-07-13
+
+First public release: the standard open-source Python interface to NRDAX.
+
+### Added
+
+- **Library (`nrdax`)**: the `NRDAX` facade with `load`, `get`, `search`, `filter`,
+  `related`, `coverage`, `families`, `instances`, `by_reference`, and serialization
+  helpers. Typed dataclass models that mirror the canonical schema, preserve unknown
+  fields, and validate leniently (or strictly).
+- **Data sources**: bundled snapshot (offline default), static feed (directory or
+  URL), live read API (`api.nrdax.com`), local file (`.jsonl` / bundle / single
+  technique), STIX 2.1 bundle, and in-memory.
+- **CLI (`nrdax`)**: `search`, `get`, `list`, `related`, `export`, `cite`,
+  `changes`, `info`, `version`, `update`, `cache`, `schema`. Table / JSON / CSV /
+  STIX output where meaningful; stable exit codes and structured JSON errors.
+- **Deterministic search**: weighted, explainable field matching (no network, no
+  LLM).
+- **Exporters**: JSON and CSV (with field projection), and STIX 2.1 that is
+  **byte-identical** to the canonical NRDAX emitter (identity round-trips).
+- **Citations**: text, Markdown, BibTeX, and CSL-JSON. Never fabricates a DOI.
+- **Changes**: `--since` (from `first_seen`) and a real snapshot-diff engine.
+- **Offline / cache**: `nrdax update` writes a snapshot; `nrdax cache info|clear`.
+- **Bundled dataset snapshot**: NRDAX `v0.1-import` (381 techniques), captured
+  2026-07-13, for zero-config offline use.
+- Docs, runnable examples, a comprehensive test suite, CI, and release automation.
+
+### Known limitations (documented, not simulated)
+
+- NRDAX has no `implementation` or `surface` field; `--implementation` and related
+  search are derived text heuristics.
+- NRDAX has no asserted technique-to-technique relationships; `related` is derived
+  (shared family / chain / reference).
+- No historical versioned releases are published yet, so cross-version `changes`
+  requires two snapshots you supply; `--from-version/--to-version` is not available.
+- No DOI is minted upstream; citations omit it.
+- The static feed is not yet hosted at a stable public URL, so `nrdax update`
+  fetches from the live API by default.
+
+[Unreleased]: https://github.com/NullRabbitLabs/nrdax-python/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/NullRabbitLabs/nrdax-python/releases/tag/v0.1.0

nrdax-0.1.0/DATA_LICENSE.md

@@ -0,0 +1,44 @@
+# NRDAX data licensing
+
+**Short version:** the *code* in this repository is Apache-2.0 (see `LICENSE`). The
+*NRDAX dataset* is a separate NullRabbit product with its own terms, which this
+repository does not set and does not grant.
+
+## Why this file exists
+
+`nrdax-python` is open-source tooling that reads the public NRDAX dataset. Two
+different things are licensed differently:
+
+| Thing | License | Set by |
+| --- | --- | --- |
+| This library and CLI (the Python source) | Apache-2.0 | this repository (`LICENSE`) |
+| The NRDAX dataset (technique records, the bundled snapshot, API responses) | Determined by NullRabbit, separately | NullRabbit Labs |
+
+The bundled snapshot in `src/nrdax/data/snapshot/` is included purely as a
+convenience for offline and reproducible use. Its presence in an Apache-2.0 code
+repository does **not** place the NRDAX data under Apache-2.0.
+
+## Known limitation (please read)
+
+At the time of writing, NullRabbit has **not published an explicit public license
+for the NRDAX dataset**, and the sibling NullRabbit source repositories are marked
+`UNLICENSED`. This tool therefore makes no claim about how you may redistribute or
+reuse the *data*. If you intend to redistribute NRDAX records, build a derived
+dataset, or use the data commercially, confirm the dataset terms with NullRabbit
+first.
+
+Maintainers: this ambiguity should be resolved by publishing a clear dataset
+license (for example CC-BY-4.0 for attribution-required reuse) before the dataset
+is widely redistributed. Until then, treat the data as "all rights reserved by
+NullRabbit unless stated otherwise."
+
+## Citation
+
+Whatever the eventual data license, please cite NRDAX records you rely on. The CLI
+generates citations (`nrdax cite <id> --format bibtex|markdown|json`) using the
+canonical URL and the dataset version. No DOI is minted yet, so citations omit it
+rather than inventing one.
+
+## Contact
+
+Questions about dataset licensing: opensource@nullrabbit.ai / https://nullrabbit.ai.

nrdax-0.1.0/LICENSE

@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

nrdax-0.1.0/NOTICE

@@ -0,0 +1,25 @@
+nrdax-python
+Copyright 2026 NullRabbit Labs
+
+This product includes software developed at NullRabbit Labs (https://nullrabbit.ai).
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this software except in compliance with the License. You may obtain a copy of the
+License in the accompanying LICENSE file or at
+http://www.apache.org/licenses/LICENSE-2.0.
+
+---------------------------------------------------------------------------------
+Data licensing (separate from this source code)
+---------------------------------------------------------------------------------
+
+The Apache-2.0 license above covers the SOURCE CODE of this library and CLI only.
+
+NRDAX (the NullRabbit Decentralised Attack indeX) is a NullRabbit product. The
+NRDAX dataset - including the technique records distributed as a convenience
+snapshot in `src/nrdax/data/snapshot/` and any data retrieved from NRDAX services -
+is NOT licensed under Apache-2.0 and its terms are determined separately by
+NullRabbit. Installing or using this tool grants no rights to the NRDAX dataset.
+See DATA_LICENSE.md.
+
+"NRDAX", "NullRabbit", and related names and logos are trademarks of NullRabbit
+Labs. Trademark rights are not granted by the source-code license.

nrdax-0.1.0/PKG-INFO

@@ -0,0 +1,229 @@
+Metadata-Version: 2.4
+Name: nrdax
+Version: 0.1.0
+Summary: Programmatic and command-line access to NRDAX, the NullRabbit Decentralised Attack indeX.
+Project-URL: Homepage, https://nrdax.com
+Project-URL: Documentation, https://github.com/NullRabbitLabs/nrdax-python/tree/main/docs
+Project-URL: Repository, https://github.com/NullRabbitLabs/nrdax-python
+Project-URL: Issues, https://github.com/NullRabbitLabs/nrdax-python/issues
+Project-URL: Changelog, https://github.com/NullRabbitLabs/nrdax-python/blob/main/CHANGELOG.md
+Author-email: NullRabbit Labs <opensource@nullrabbit.ai>
+Maintainer-email: NullRabbit Labs <opensource@nullrabbit.ai>
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Keywords: attack-techniques,blockchain,decentralised-infrastructure,nrdax,nullrabbit,security,stix,threat-intelligence
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: Science/Research
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-cov>=5; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.5; extra == 'dev'
+Requires-Dist: twine>=5; extra == 'dev'
+Provides-Extra: docs
+Requires-Dist: mkdocs-material>=9.5; extra == 'docs'
+Requires-Dist: mkdocs>=1.6; extra == 'docs'
+Provides-Extra: stix
+Requires-Dist: stix2>=3.0; extra == 'stix'
+Description-Content-Type: text/markdown
+
+# nrdax-python
+
+**Programmatic and command-line access to NRDAX - the NullRabbit Decentralised
+Attack indeX.**
+
+[![CI](https://github.com/NullRabbitLabs/nrdax-python/actions/workflows/ci.yml/badge.svg)](https://github.com/NullRabbitLabs/nrdax-python/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/nrdax.svg)](https://pypi.org/project/nrdax/)
+[![Python](https://img.shields.io/pypi/pyversions/nrdax.svg)](https://pypi.org/project/nrdax/)
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
+
+`nrdax` is the standard open-source Python interface to NRDAX. If you have used
+MITRE's `mitreattack-python`, this will feel familiar - but it is designed for the
+NRDAX schema and semantics, not forced into an ATT&CK model.
+
+- **Reusable library** with typed models and a small, predictable API.
+- **Practical CLI** (`nrdax`) for search, retrieval, filtering, relationships,
+  export, citation, change inspection, and offline use.
+- **Zero required runtime dependencies** - the core library and CLI use only the
+  Python standard library, so it installs cleanly and starts fast.
+- **Works offline out of the box** via a bundled dataset snapshot; refresh to the
+  live data when you want it.
+
+## What is NRDAX?
+
+NRDAX is NullRabbit's canonical, chain-agnostic registry of **techniques for attacks
+on decentralised infrastructure** - validators, nodes, RPC services, networking and
+gossip layers, consensus implementations, and related systems. Each technique has a
+permanent id (`NRDAX-Tnnnn`), a mechanism description, a family, and evidence in the
+form of chain-specific *instances*, plus links to advisories, CVEs, and research.
+
+The public website (https://nrdax.com) is for human exploration. This package is for
+**machines and researchers**: retrieve, search, filter, compare, cite, export, and
+monitor NRDAX data programmatically.
+
+## Install
+
+```bash
+pip install nrdax
+```
+
+Development version:
+
+```bash
+git clone https://github.com/NullRabbitLabs/nrdax-python
+cd nrdax-python
+pip install -e ".[dev]"
+```
+
+Python 3.10+ is supported.
+
+## Quick start (CLI)
+
+```bash
+pip install nrdax
+nrdax update                                  # fetch the latest dataset into the cache
+nrdax search "rpc resource exhaustion"
+nrdax get NRDAX-T0006
+nrdax related NRDAX-T0006
+nrdax cite NRDAX-T0006 --format bibtex
+nrdax export --implementation agave --format json --output agave-attacks.json
+```
+
+Every command works offline against the bundled snapshot even before you run
+`nrdax update`.
+
+## Quick start (Python)
+
+```python
+from nrdax import NRDAX
+
+registry = NRDAX.load()                    # bundled snapshot, offline, zero-config
+technique = registry.get("NRDAX-T0006")
+print(technique.display, technique.family, technique.chains)
+
+results = registry.search("rpc exhaustion")
+for r in results[:5]:
+    print(r.score, r.technique.id, r.technique.display)
+
+related = registry.related("NRDAX-T0006")  # derived: family, chain, shared refs
+coverage = registry.coverage               # technique x chain matrix
+```
+
+## Core CLI commands
+
+| Command | Purpose |
+| --- | --- |
+| `nrdax search <query>` | Deterministic, explainable search across id/name/mechanism/chain/family/reference. |
+| `nrdax get <id>` | One technique with instances, references, provenance (table / JSON / STIX). |
+| `nrdax list [filters]` | Filter and list techniques (composable filters). |
+| `nrdax related <id>` | Derived relationships (family siblings, shared chains, shared references). |
+| `nrdax export [filters]` | Export a subset as JSON, CSV, or STIX 2.1. |
+| `nrdax cite <id>` | Citation in text, Markdown, BibTeX, or CSL-JSON. |
+| `nrdax changes` | Techniques since a date, or a diff between two dataset snapshots. |
+| `nrdax info` | Dataset, source, and cache information. |
+| `nrdax version` | CLI, library, and schema versions. |
+| `nrdax update` | Fetch the latest dataset into the local cache. |
+| `nrdax cache info|clear` | Inspect or clear the offline cache. |
+| `nrdax schema` | The NRDAX vocabularies and field set. |
+
+Full reference: [`docs/cli.md`](docs/cli.md).
+
+## Supported data sources
+
+Domain operations are independent of where the data came from. Select a source with
+`--source` (CLI) or a classmethod (library):
+
+| Source | CLI | Library | Notes |
+| --- | --- | --- | --- |
+| Bundled snapshot | `--source bundled` | `NRDAX.bundled()` | Ships with the package; offline default. |
+| Local cache | `--source cache` | `NRDAX.from_cache()` | Written by `nrdax update`. |
+| Live API | `--source api[:URL]` | `NRDAX.from_api()` | `https://api.nrdax.com`. |
+| Static feed | `--source feed:LOC` | `NRDAX.from_feed(loc)` | A directory or base URL of feed files. |
+| Local file | `--source file:PATH` | `NRDAX.from_file(path)` | `registry.jsonl`, a bundle, or one technique. |
+| STIX bundle | `--source stix:PATH` | `NRDAX.from_stix(path=...)` | Parses NRDAX STIX (lossy; see data-model). |
+| In-memory | - | `NRDAX.from_memory([...])` | For tests and scripting. |
+
+With no `--source`, the CLI uses the cached snapshot if present, otherwise the
+bundled one. `nrdax info` always shows which source and version you are using.
+
+## Output formats
+
+- **Terminal** tables and detail views (default).
+- **JSON** (`--format json`) with stable field names.
+- **CSV** (`--format csv`) where tabular output is meaningful.
+- **STIX 2.1** (`--format stix`) for supported exports - byte-identical to the
+  canonical NRDAX emitter, so identities round-trip.
+
+## Versioning
+
+Four versions are tracked independently:
+
+- **Package version** (this repo, e.g. `0.1.0`).
+- **CLI version** (equals the package version).
+- **Dataset version** (from the loaded data, e.g. `v0.1-import`).
+- **Schema version** (the NRDAX contract this client targets, e.g. `1.4`).
+
+A package release does not imply the dataset changed, and vice versa. Pin an exact
+dataset for reproducible research by keeping a feed snapshot and loading it with
+`--source feed:/path`. See [`docs/data-model.md`](docs/data-model.md).
+
+## Honest limitations
+
+This client never invents fields or fabricates data. Where NRDAX lacks a capability,
+the limitation is isolated and documented:
+
+- No `implementation` or `surface` field exists in NRDAX; `--implementation` and
+  surface search are **derived text heuristics**, clearly labelled as such.
+- No asserted technique-to-technique relationships exist; `related` returns
+  **derived** links (shared family / chain / reference).
+- No DOI is minted yet; citations omit it rather than inventing one.
+- No historical versioned releases are published; cross-version `changes` needs two
+  snapshots you supply (`--from`/`--to`). `--since` works from `first_seen`.
+- The static feed is not yet hosted at a stable public URL, so `nrdax update` pulls
+  from the live API by default.
+
+You can validate any dataset yourself: loading reports schema and integrity issues
+(`nrdax info` shows the count, `--strict` fails on the first), so problems in the
+underlying data can be found and corrected separately - the client never fabricates
+or silently normalises data.
+
+## Documentation
+
+- [CLI reference](docs/cli.md)
+- [Python API reference](docs/api.md)
+- [Data-model guide](docs/data-model.md)
+- Task guides: [`docs/guides/`](docs/guides/) - map a finding, retrieve by
+  implementation, build a research dataset, export for a paper, cite, compare
+  changes, import into another tool, work offline.
+- Runnable [examples](examples/).
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md), [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), and
+[GOVERNANCE.md](GOVERNANCE.md). Security issues: [SECURITY.md](SECURITY.md).
+
+## License
+
+The **source code** in this repository is licensed under **Apache-2.0** (see
+[LICENSE](LICENSE)).
+
+The **NRDAX dataset** - including the bundled snapshot and any data retrieved from
+NRDAX services - is a separate NullRabbit product with its own terms; this tool
+grants no rights to the data. See [DATA_LICENSE.md](DATA_LICENSE.md) and
+[NOTICE](NOTICE). "NRDAX" and "NullRabbit" are trademarks of NullRabbit Labs.
+
+Maintained by [NullRabbit Labs](https://nullrabbit.ai).