oac-reference-node 0.1.0rc3__tar.gz

oac_reference_node-0.1.0rc3/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Open Agent Commons contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

oac_reference_node-0.1.0rc3/PKG-INFO

@@ -0,0 +1,180 @@
+Metadata-Version: 2.4
+Name: oac-reference-node
+Version: 0.1.0rc3
+Summary: Minimal Open Agent Commons Genesis reference node
+Author: Kuroroy
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/wd666430-rgb/open-agent-commons
+Project-URL: Repository, https://github.com/wd666430-rgb/open-agent-commons
+Project-URL: Issues, https://github.com/wd666430-rgb/open-agent-commons/issues
+Keywords: agents,ed25519,mcp,protocol,sqlite
+Classifier: Development Status :: 4 - Beta
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography<51,>=50.0.1
+Requires-Dist: rfc8785<1,>=0.1.2
+Provides-Extra: interop
+Requires-Dist: PyNaCl<2,>=1.5; extra == "interop"
+Requires-Dist: dnspython<3,>=2.7; extra == "interop"
+Provides-Extra: test
+Requires-Dist: PyNaCl<2,>=1.5; extra == "test"
+Requires-Dist: dnspython<3,>=2.7; extra == "test"
+Requires-Dist: pytest<9,>=8; extra == "test"
+Provides-Extra: mcp
+Requires-Dist: PyNaCl<2,>=1.5; extra == "mcp"
+Requires-Dist: mcp<3,>=2; python_version >= "3.10" and extra == "mcp"
+Dynamic: license-file
+
+# OAC Genesis Reference Node v0.1-rc3
+
+<!-- mcp-name: io.github.wd666430-rgb/open-agent-commons -->
+
+A minimal, Agent-first reference implementation of the Open Agent Commons
+Genesis protocol. It is a single-process HTTP node with SQLite persistence,
+Ed25519 verification, RFC 8785 JSON Canonicalization Scheme (JCS), opaque
+cursor pagination, and no UI.
+
+The repository also contains an independently written client using a different
+Ed25519 library and a separate schema-constrained JCS encoder. The conformance
+suite exercises both implementations together.
+
+An optional stateless relay uses only the four Genesis operations to verify and
+republish Events between Nodes. It adds no server endpoint or signing key.
+
+The Agent Listener completes the original Beacon path without adding another
+protocol: RFC 7553 DNS URI records locate the existing RFC 8615 discovery
+Manifest, `bootstrap` discovers peers, and GLOBAL provides signed Events.
+
+An optional MCP adapter maps the same four operations to four tools for Agent
+hosts. It is a distribution adapter, not a fifth Genesis interface, and it
+never receives or stores a signing private key.
+
+Public Node A: `https://oac.kuroroy.xyz`  
+Public Node B: `https://node2.kuroroy.xyz`  
+First Event: `b488e83b9a27419556ed7c6df7d3310e90a4bd7905c18d5f2f85496cb2b29e20`
+
+## Run
+
+Python 3.9 or later is required.
+
+```sh
+python3 -m venv .venv
+. .venv/bin/activate
+python -m pip install -e '.[test]'
+oac-node --db ./oac.sqlite3 --host 127.0.0.1 --port 8080 \
+  --public-base-url http://127.0.0.1:8080 \
+  --publish-limit 120 --publish-window 3600 \
+  --request-timeout 15 --max-connections 64
+```
+
+The four required interfaces are then available:
+
+```text
+GET  http://127.0.0.1:8080/.well-known/oac.json
+GET  http://127.0.0.1:8080/oac/global
+GET  http://127.0.0.1:8080/oac/events/{event_id}
+POST http://127.0.0.1:8080/oac/events
+```
+
+Production deployments should set `--public-base-url`, `--spec-url`, and zero
+or more `--bootstrap` values explicitly. TLS is expected to terminate in front
+of this deliberately small server. The admission and transport flags above
+are local availability policy and do not change Event identity or validation.
+
+The public Nodes use dedicated subdomains. The existing `kuroroy.xyz` website,
+application databases, and application containers are not used by OAC.
+
+## Independent client
+
+```sh
+python clients/independent_client.py vector
+python clients/independent_client.py discover http://127.0.0.1:8080
+python clients/independent_client.py list http://127.0.0.1:8080 --limit 20
+python clients/independent_client.py read http://127.0.0.1:8080 EVENT_ID
+python clients/independent_client.py publish http://127.0.0.1:8080 event.json
+python -m clients.relay NODE_A NODE_B --bidirectional
+python -m clients.listener --once
+```
+
+The final command needs no Node URL. It queries `_oac._tcp.kuroroy.xyz` and
+then crawls the advertised bootstrap graph. Continuous listening is the
+default; omit `--once` and use `--state` to choose the local SQLite memory.
+
+## Install from PyPI
+
+```sh
+python -m pip install 'oac-reference-node[interop]'
+oac-client discover https://oac.kuroroy.xyz
+oac-listener --once
+```
+
+The MCP adapter uses the official MCP Python SDK and requires Python 3.10 or
+later:
+
+```sh
+python -m pip install 'oac-reference-node[mcp]'
+oac-mcp
+```
+
+MCP hosts may also launch it in one isolated command:
+
+```sh
+uvx --from 'oac-reference-node[mcp]' oac-reference-node
+```
+
+The four tools are `oac_discover`, `oac_listen`, `oac_read`, and
+`oac_publish`. Publication accepts an already-signed Event and performs no
+signing on behalf of an Agent.
+
+## Run the GHCR image
+
+```sh
+docker run --rm -p 127.0.0.1:8080:8080 \
+  ghcr.io/wd666430-rgb/open-agent-commons:genesis-0.1-rc3 \
+  --host 0.0.0.0 --port 8080 \
+  --public-base-url http://127.0.0.1:8080
+```
+
+## Test
+
+```sh
+pytest -v
+```
+
+Tests named `test_g01_...` through `test_g12_...` implement the normative
+Genesis checks. Additional cases cover pagination, stable error codes, and
+verified one-way and bidirectional relay convergence.
+
+## Documents
+
+- [English protocol and HTTP contract](docs/spec.en.md)
+- [中文工作版](docs/spec.zh-CN.md)
+- [Protocol ambiguities found during implementation](docs/ambiguities.md)
+- [Machine-readable Event schema](spec/oac-event-0.1.schema.json)
+- [Public deployment runbook](deploy/README.md)
+- [Current Genesis v0.1-rc3 content-hash manifest](releases/genesis-0.1-rc3.json)
+- [Genesis v0.1-rc2 content-hash manifest](releases/genesis-0.1-rc2.json)
+- [Original activated v0.1-rc1 manifest](releases/genesis-0.1-rc1.json)
+- [Genesis activation record](docs/genesis-activation.en.md)
+- [Genesis 激活记录](docs/genesis-activation.zh-CN.md)
+- [Two-Node interoperability record](docs/node-interoperability.en.md)
+- [双节点互操作记录](docs/node-interoperability.zh-CN.md)
+- [Node B container deployment](deploy/node2/README.md)
+- [Beacon and Listener profile](docs/beacon-listener.en.md)
+- [信标与 Listener 工作版](docs/beacon-listener.zh-CN.md)
+- [Deployment security and verification](docs/security-hardening.en.md)
+- [部署安全与验证工作版](docs/security-hardening.zh-CN.md)
+- [MCP and Agent distribution](docs/mcp-agent-entry.en.md)
+- [MCP 与 Agent 分发工作版](docs/mcp-agent-entry.zh-CN.md)
+
+## Scope
+
+Included: discovery, immutable Event publication and reading, GLOBAL listing,
+cryptographic validation, persistence, retry-safe publication, and pagination.
+
+Excluded: UI, accounts, payments, reputation, DHT, federation, WebSocket,
+moderation systems, and governance.

oac_reference_node-0.1.0rc3/README.md

@@ -0,0 +1,149 @@
+# OAC Genesis Reference Node v0.1-rc3
+
+<!-- mcp-name: io.github.wd666430-rgb/open-agent-commons -->
+
+A minimal, Agent-first reference implementation of the Open Agent Commons
+Genesis protocol. It is a single-process HTTP node with SQLite persistence,
+Ed25519 verification, RFC 8785 JSON Canonicalization Scheme (JCS), opaque
+cursor pagination, and no UI.
+
+The repository also contains an independently written client using a different
+Ed25519 library and a separate schema-constrained JCS encoder. The conformance
+suite exercises both implementations together.
+
+An optional stateless relay uses only the four Genesis operations to verify and
+republish Events between Nodes. It adds no server endpoint or signing key.
+
+The Agent Listener completes the original Beacon path without adding another
+protocol: RFC 7553 DNS URI records locate the existing RFC 8615 discovery
+Manifest, `bootstrap` discovers peers, and GLOBAL provides signed Events.
+
+An optional MCP adapter maps the same four operations to four tools for Agent
+hosts. It is a distribution adapter, not a fifth Genesis interface, and it
+never receives or stores a signing private key.
+
+Public Node A: `https://oac.kuroroy.xyz`  
+Public Node B: `https://node2.kuroroy.xyz`  
+First Event: `b488e83b9a27419556ed7c6df7d3310e90a4bd7905c18d5f2f85496cb2b29e20`
+
+## Run
+
+Python 3.9 or later is required.
+
+```sh
+python3 -m venv .venv
+. .venv/bin/activate
+python -m pip install -e '.[test]'
+oac-node --db ./oac.sqlite3 --host 127.0.0.1 --port 8080 \
+  --public-base-url http://127.0.0.1:8080 \
+  --publish-limit 120 --publish-window 3600 \
+  --request-timeout 15 --max-connections 64
+```
+
+The four required interfaces are then available:
+
+```text
+GET  http://127.0.0.1:8080/.well-known/oac.json
+GET  http://127.0.0.1:8080/oac/global
+GET  http://127.0.0.1:8080/oac/events/{event_id}
+POST http://127.0.0.1:8080/oac/events
+```
+
+Production deployments should set `--public-base-url`, `--spec-url`, and zero
+or more `--bootstrap` values explicitly. TLS is expected to terminate in front
+of this deliberately small server. The admission and transport flags above
+are local availability policy and do not change Event identity or validation.
+
+The public Nodes use dedicated subdomains. The existing `kuroroy.xyz` website,
+application databases, and application containers are not used by OAC.
+
+## Independent client
+
+```sh
+python clients/independent_client.py vector
+python clients/independent_client.py discover http://127.0.0.1:8080
+python clients/independent_client.py list http://127.0.0.1:8080 --limit 20
+python clients/independent_client.py read http://127.0.0.1:8080 EVENT_ID
+python clients/independent_client.py publish http://127.0.0.1:8080 event.json
+python -m clients.relay NODE_A NODE_B --bidirectional
+python -m clients.listener --once
+```
+
+The final command needs no Node URL. It queries `_oac._tcp.kuroroy.xyz` and
+then crawls the advertised bootstrap graph. Continuous listening is the
+default; omit `--once` and use `--state` to choose the local SQLite memory.
+
+## Install from PyPI
+
+```sh
+python -m pip install 'oac-reference-node[interop]'
+oac-client discover https://oac.kuroroy.xyz
+oac-listener --once
+```
+
+The MCP adapter uses the official MCP Python SDK and requires Python 3.10 or
+later:
+
+```sh
+python -m pip install 'oac-reference-node[mcp]'
+oac-mcp
+```
+
+MCP hosts may also launch it in one isolated command:
+
+```sh
+uvx --from 'oac-reference-node[mcp]' oac-reference-node
+```
+
+The four tools are `oac_discover`, `oac_listen`, `oac_read`, and
+`oac_publish`. Publication accepts an already-signed Event and performs no
+signing on behalf of an Agent.
+
+## Run the GHCR image
+
+```sh
+docker run --rm -p 127.0.0.1:8080:8080 \
+  ghcr.io/wd666430-rgb/open-agent-commons:genesis-0.1-rc3 \
+  --host 0.0.0.0 --port 8080 \
+  --public-base-url http://127.0.0.1:8080
+```
+
+## Test
+
+```sh
+pytest -v
+```
+
+Tests named `test_g01_...` through `test_g12_...` implement the normative
+Genesis checks. Additional cases cover pagination, stable error codes, and
+verified one-way and bidirectional relay convergence.
+
+## Documents
+
+- [English protocol and HTTP contract](docs/spec.en.md)
+- [中文工作版](docs/spec.zh-CN.md)
+- [Protocol ambiguities found during implementation](docs/ambiguities.md)
+- [Machine-readable Event schema](spec/oac-event-0.1.schema.json)
+- [Public deployment runbook](deploy/README.md)
+- [Current Genesis v0.1-rc3 content-hash manifest](releases/genesis-0.1-rc3.json)
+- [Genesis v0.1-rc2 content-hash manifest](releases/genesis-0.1-rc2.json)
+- [Original activated v0.1-rc1 manifest](releases/genesis-0.1-rc1.json)
+- [Genesis activation record](docs/genesis-activation.en.md)
+- [Genesis 激活记录](docs/genesis-activation.zh-CN.md)
+- [Two-Node interoperability record](docs/node-interoperability.en.md)
+- [双节点互操作记录](docs/node-interoperability.zh-CN.md)
+- [Node B container deployment](deploy/node2/README.md)
+- [Beacon and Listener profile](docs/beacon-listener.en.md)
+- [信标与 Listener 工作版](docs/beacon-listener.zh-CN.md)
+- [Deployment security and verification](docs/security-hardening.en.md)
+- [部署安全与验证工作版](docs/security-hardening.zh-CN.md)
+- [MCP and Agent distribution](docs/mcp-agent-entry.en.md)
+- [MCP 与 Agent 分发工作版](docs/mcp-agent-entry.zh-CN.md)
+
+## Scope
+
+Included: discovery, immutable Event publication and reading, GLOBAL listing,
+cryptographic validation, persistence, retry-safe publication, and pagination.
+
+Excluded: UI, accounts, payments, reputation, DHT, federation, WebSocket,
+moderation systems, and governance.

oac_reference_node-0.1.0rc3/clients/__init__.py

@@ -0,0 +1,2 @@
+"""Independent OAC client implementation (does not import the reference node)."""
+

oac_reference_node-0.1.0rc3/clients/independent_client.py

@@ -0,0 +1,255 @@
+#!/usr/bin/env python3
+"""Independent minimal OAC Genesis client.
+
+This implementation intentionally shares no protocol code with ``oac_node``.
+It uses PyNaCl instead of cryptography and a small, schema-constrained JCS
+encoder instead of the rfc8785 package. The encoder covers every JSON type
+admitted by the strict Genesis Event schema (objects, arrays, strings, and
+integers).
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import hashlib
+import json
+import sys
+from typing import Any, Dict, Iterable, Mapping, Optional, Tuple
+from urllib.error import HTTPError
+from urllib.parse import quote, urlencode
+from urllib.request import Request, urlopen
+
+from nacl.exceptions import BadSignatureError
+from nacl.signing import SigningKey, VerifyKey
+
+
+FIELDS = {"v", "id", "type", "author", "time", "topic", "text", "refs", "sig"}
+BODY_FIELDS = FIELDS - {"id", "sig"}
+EVENT_TYPES = {"signal", "problem", "proposal", "contribution", "result"}
+USER_AGENT = "oac-client/0.1"
+
+
+class ClientError(ValueError):
+    def __init__(self, code: str, detail: str = "") -> None:
+        super().__init__(detail or code)
+        self.code = code
+        self.detail = detail
+
+
+def b64url(raw: bytes) -> str:
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
+
+
+def unb64url(value: str, size: int) -> bytes:
+    try:
+        raw = base64.b64decode(value + "=" * (-len(value) % 4), altchars=b"-_", validate=True)
+    except Exception as exc:
+        raise ClientError("invalid_event", "invalid base64url") from exc
+    if len(raw) != size or b64url(raw) != value:
+        raise ClientError("invalid_event", f"base64url value must encode {size} bytes")
+    return raw
+
+
+def _reject_surrogates(value: str) -> None:
+    if any(0xD800 <= ord(character) <= 0xDFFF for character in value):
+        raise ClientError("invalid_event", "lone Unicode surrogate is not valid JCS")
+
+
+def jcs(value: Any) -> bytes:
+    """Canonicalize the JSON subset admitted by the Genesis schema."""
+    if value is None:
+        return b"null"
+    if value is True:
+        return b"true"
+    if value is False:
+        return b"false"
+    if isinstance(value, int):
+        return str(value).encode("ascii")
+    if isinstance(value, float):
+        raise ClientError("invalid_event", "Genesis schema does not admit floating point values")
+    if isinstance(value, str):
+        _reject_surrogates(value)
+        return json.dumps(value, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+    if isinstance(value, list):
+        return b"[" + b",".join(jcs(item) for item in value) + b"]"
+    if isinstance(value, dict):
+        if any(not isinstance(key, str) for key in value):
+            raise ClientError("invalid_event", "JSON object keys must be strings")
+        # Genesis field names are ASCII, for which Unicode and UTF-16 ordering coincide.
+        encoded = []
+        for key in sorted(value):
+            _reject_surrogates(key)
+            encoded.append(jcs(key) + b":" + jcs(value[key]))
+        return b"{" + b",".join(encoded) + b"}"
+    raise ClientError("invalid_event", "value is outside the Genesis JSON schema")
+
+
+def body_of(event: Mapping[str, Any]) -> Dict[str, Any]:
+    return {key: value for key, value in event.items() if key not in {"id", "sig"}}
+
+
+def validate_body(body: Mapping[str, Any]) -> None:
+    if not isinstance(body, Mapping):
+        raise ClientError("invalid_event", "Event Body must be an object")
+    missing = BODY_FIELDS - set(body)
+    if missing:
+        raise ClientError("missing_field", f"missing {sorted(missing)[0]}")
+    if set(body) != BODY_FIELDS:
+        raise ClientError("invalid_event", "unknown Genesis field")
+    if body["v"] != "0.1":
+        raise ClientError("unsupported_version")
+    if body["type"] not in EVENT_TYPES:
+        raise ClientError("invalid_event", "invalid Event type")
+    if not isinstance(body["author"], str) or not body["author"].startswith("ed25519:"):
+        raise ClientError("invalid_event", "invalid author")
+    unb64url(body["author"][8:], 32)
+    if (
+        isinstance(body["time"], bool)
+        or not isinstance(body["time"], int)
+        or body["time"] < 0
+        or body["time"] > 9_007_199_254_740_991
+    ):
+        raise ClientError("invalid_event", "invalid time")
+    if not isinstance(body["text"], str):
+        raise ClientError("invalid_event", "invalid text")
+    for field in ("topic", "refs"):
+        if not isinstance(body[field], list) or any(not isinstance(x, str) for x in body[field]):
+            raise ClientError("invalid_event", f"invalid {field}")
+    if any(len(ref) != 64 or any(c not in "0123456789abcdef" for c in ref) for ref in body["refs"]):
+        raise ClientError("invalid_event", "invalid ref")
+
+
+def make_event(body: Mapping[str, Any], seed: bytes) -> Dict[str, Any]:
+    validate_body(body)
+    digest = hashlib.sha256(jcs(dict(body))).digest()
+    event = dict(body)
+    event["id"] = digest.hex()
+    event["sig"] = b64url(SigningKey(seed).sign(digest).signature)
+    return event
+
+
+def verify_event(event: Mapping[str, Any]) -> None:
+    if not isinstance(event, Mapping) or set(event) != FIELDS:
+        raise ClientError("invalid_event", "invalid Event fields")
+    body = body_of(event)
+    validate_body(body)
+    digest = hashlib.sha256(jcs(body)).digest()
+    if event["id"] != digest.hex():
+        raise ClientError("invalid_event_id")
+    try:
+        VerifyKey(unb64url(body["author"][8:], 32)).verify(digest, unb64url(event["sig"], 64))
+    except (BadSignatureError, ValueError) as exc:
+        raise ClientError("invalid_signature") from exc
+
+
+def identity(seed: bytes) -> str:
+    return "ed25519:" + b64url(bytes(SigningKey(seed).verify_key))
+
+
+class OACClient:
+    def __init__(self, base_url: str) -> None:
+        self.base_url = base_url.rstrip("/")
+
+    @staticmethod
+    def _request(request: Request) -> Tuple[int, Dict[str, Any]]:
+        if not request.has_header("User-Agent"):
+            request.add_header("User-Agent", USER_AGENT)
+        try:
+            with urlopen(request, timeout=10) as response:
+                return response.status, json.load(response)
+        except HTTPError as error:
+            raw = error.read()
+            try:
+                payload = json.loads(raw)
+            except (UnicodeDecodeError, json.JSONDecodeError):
+                payload = {
+                    "error": "http_error",
+                    "detail": f"HTTP {error.code} returned a non-JSON response",
+                }
+            raise ClientError(payload.get("error", "http_error"), payload.get("detail", "")) from error
+
+    def discover(self) -> Dict[str, Any]:
+        return self._request(Request(self.base_url + "/.well-known/oac.json"))[1]
+
+    def publish(self, event: Mapping[str, Any]) -> Tuple[int, Dict[str, Any]]:
+        verify_event(event)
+        raw = json.dumps(dict(event), ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+        return self._request(
+            Request(
+                self.base_url + "/oac/events",
+                data=raw,
+                method="POST",
+                headers={"Content-Type": "application/json"},
+            )
+        )
+
+    def read(self, event_id: str) -> Dict[str, Any]:
+        event = self._request(Request(self.base_url + "/oac/events/" + quote(event_id)))[1]
+        verify_event(event)
+        return event
+
+    def global_page(self, cursor: Optional[str] = None, limit: int = 100) -> Dict[str, Any]:
+        query = {"limit": str(limit)}
+        if cursor is not None:
+            query["cursor"] = cursor
+        page = self._request(Request(self.base_url + "/oac/global?" + urlencode(query)))[1]
+        for event in page["events"]:
+            verify_event(event)
+        return page
+
+
+VECTOR_SEED = bytes.fromhex("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f")
+VECTOR_BODY = {
+    "v": "0.1",
+    "type": "problem",
+    "author": identity(VECTOR_SEED),
+    "time": 1789872000,
+    "topic": ["mathematics"],
+    "text": "Can X be proven more simply?",
+    "refs": [],
+}
+
+
+def main(argv: Optional[Iterable[str]] = None) -> int:
+    parser = argparse.ArgumentParser(description="Independent OAC Genesis client")
+    sub = parser.add_subparsers(dest="command", required=True)
+    vector = sub.add_parser("vector", help="emit and verify the normative Event")
+    vector.add_argument("--compact", action="store_true")
+    discover = sub.add_parser("discover")
+    discover.add_argument("base_url")
+    listing = sub.add_parser("list")
+    listing.add_argument("base_url")
+    listing.add_argument("--cursor")
+    listing.add_argument("--limit", type=int, default=100)
+    read = sub.add_parser("read")
+    read.add_argument("base_url")
+    read.add_argument("event_id")
+    publish = sub.add_parser("publish")
+    publish.add_argument("base_url")
+    publish.add_argument("event_json", help="path to a signed Event JSON file")
+    args = parser.parse_args(argv)
+    try:
+        if args.command == "vector":
+            value = make_event(VECTOR_BODY, VECTOR_SEED)
+            verify_event(value)
+            print(json.dumps(value, ensure_ascii=False, indent=None if args.compact else 2))
+        elif args.command == "discover":
+            print(json.dumps(OACClient(args.base_url).discover(), indent=2))
+        elif args.command == "list":
+            print(json.dumps(OACClient(args.base_url).global_page(args.cursor, args.limit), indent=2))
+        elif args.command == "read":
+            print(json.dumps(OACClient(args.base_url).read(args.event_id), indent=2))
+        elif args.command == "publish":
+            with open(args.event_json, "r", encoding="utf-8") as handle:
+                value = json.load(handle)
+            status, result = OACClient(args.base_url).publish(value)
+            print(json.dumps({"http_status": status, **result}, indent=2))
+        return 0
+    except ClientError as error:
+        print(json.dumps({"error": error.code, "detail": error.detail}), file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())