ocsf-toolkit 0.1.0a1__tar.gz

ocsf_toolkit-0.1.0a1/.gitignore

@@ -0,0 +1,20 @@
+# build outputs: compiled schemas, schema checkouts, generated dists, wheels
+build/
+dist/
+*.egg-info/
+
+# written by hatch-vcs at build time
+src/ocsf_toolkit/_version.py
+
+# environments and caches
+.venv/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.import_linter_cache/
+.coverage
+.coverage.*
+htmlcov/
+.DS_Store

ocsf_toolkit-0.1.0a1/.importlinter

@@ -0,0 +1,50 @@
+# Import contracts: the core layering, the msgspec boundary, and no imports of generated packages.
+# Modules arrive milestone by milestone (M1–M6); until then these contracts are vacuous.
+# Layers in parentheses are optional: absent today, enforced as soon as the module exists.
+# (A `forbidden` contract errors on a missing source module, so per-module rules are expressed
+# as layers or anchored on the root package.)
+
+[importlinter]
+root_package = ocsf_toolkit
+include_external_packages = True
+
+# ir <- loader/export <- schema <- walk <- derive/conform/observables <- engine <- models,
+# with codegen and diff beside walk: they may use schema and below, nothing above, not each other.
+# cli is the outermost layer; nothing in core imports it.
+[importlinter:contract:layers]
+name = Core layering (codegen and diff depend on schema only)
+type = layers
+containers = ocsf_toolkit
+layers =
+    (cli)
+    (models)
+    (engine)
+    (derive) | (conform) | (observables)
+    (walk) | (codegen) | (diff)
+    (schema)
+    (loader) | (export)
+    (ir)
+
+[importlinter:contract:msgspec-boundary]
+name = Only models and codegen import msgspec
+type = forbidden
+source_modules =
+    ocsf_toolkit
+forbidden_modules =
+    msgspec
+allow_indirect_imports = True
+ignore_imports =
+    ocsf_toolkit.models -> msgspec
+    ocsf_toolkit.codegen -> msgspec
+    ocsf_toolkit.codegen.** -> msgspec
+unmatched_ignore_imports_alerting = none
+
+[importlinter:contract:no-generated-packages]
+name = Nothing in ocsf_toolkit imports a generated version package (ocsf_toolkit_v*)
+type = forbidden
+source_modules =
+    ocsf_toolkit
+forbidden_modules =
+    ocsf_toolkit_v1_7_0
+    ocsf_toolkit_v1_8_0
+    ocsf_toolkit_v1_9_0

ocsf_toolkit-0.1.0a1/CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+The library follows SemVer on its own API. OCSF schema versions are data, so support for a new OCSF
+version ships as a minor release. One line per merged PR, taken from the PR title.
+
+## Unreleased
+
+## 0.1.0a1
+
+The first alpha. Model packages `ocsf-toolkit-v1-7-0` and `ocsf-toolkit-v1-8-0` publish with it;
+`ocsf-toolkit-v1-9-0` follows with the next release.
+
+- Repository skeleton, `ocsf.lock` pinning OCSF 1.9.0, `ocsf-toolkit compile` and `ocsf-toolkit lock --add`.
+- Schema IR (`SchemaIR`), compiler-JSON loader with key accounting, canonical IR JSON (`ir_version` 1.0) and `load_ir`; `ocsf-toolkit ir export` / `ir check`; IR for OCSF 1.9.0 shipped in the package; `ocsf.lock` pins OCSF 1.0.0–1.9.0.
+- `load()` / `resolve()` → `ResolvedSchema`: profile- and extension-aware attribute sets, class identity, sibling pairs, `type_uid` registry and observable markers, reachable without a model.
+- `build()`, `parse()` and `repair()` on event dicts under the `STRICT`, `LENIENT` and `REPAIR` policies: one traversal (`walk()`) that derives what the schema computes and reports every deviation as a `Finding` of a `Kind` in a `Report`; only `build()` raises, and only `ConformanceError`. `ocsf-toolkit check` reports on JSON Lines files.
+- Observables: `extract()` and `merge()` → `Observable`, with value validation.
+- `diff()` → `SchemaDiff`: a structural diff of two IRs with classes matched by uid, so a renamed class shows as a rename; `ocsf-toolkit diff`, with `--json` and `--semver` (the release category for a re-pinned IR). IRs for OCSF 1.1.0, 1.3.0 and 1.7.0 shipped.
+- `generate()` and `ocsf-toolkit generate`: an OCSF version or IR projected into a typed package of msgspec Structs, superset by default or exact for a `--profiles` set, with `--ext` for custom extensions; `build()` and `parse()` accept and return the generated classes.
+- Model dists `ocsf-toolkit-v1-7-0`, `-v1-8-0` and `-v1-9-0`, each bundling its IR and requiring a range of core versions, so a core release republishes a dist only when its generated tree changes. `ocsf-toolkit models check` / `record` pin each tree in `ocsf.lock`; `lock --add` keeps models for the newest three versions. IRs for every OCSF release from 1.0.0 to 1.9.0 ship in core.
+- Release workflow: reproducible sdists and wheels, PyPI trusted publishing, and a GitHub release with `ocsf.lock` and `SHA256SUMS`.
+- Property tests (Hypothesis, strategies drawn from the IR): dict and typed round trips for every core class of the model-window versions, and repair undoing unambiguous damage idempotently. Fixes they found: a typed `build()` reads profiles from a `Metadata` Struct, and `repair()` finds the class from a `class_uid`/`type_uid` it coerces. `make bench` measures engine throughput; the engine walks at about 2 µs per attribute (1.55× faster than its first cut).
+- README with installation and a worked example, and API docs in `docs/` (schema, events, observables, diff, typed models, CLI); every example runs as a doctest.

ocsf_toolkit-0.1.0a1/CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing
+
+## Setup
+
+Requires [uv](https://docs.astral.sh/uv/) and git. The library runs on Python ≥ 3.12. Compiling an OCSF
+schema needs Python 3.14 (because of `ocsf-schema-compiler`); `uvx` fetches it for that step, so you
+do not need to install it yourself.
+
+```shell
+make setup        # uv sync: dev environment in .venv
+make lint         # ruff format --check, ruff check, lint-imports
+make type         # pyright --strict (blocking), mypy --strict (informational)
+make test         # pytest
+make schema       # ocsf-toolkit compile: rebuild build/compiled/ and check the lockfile hashes
+```
+
+`uvx pre-commit install` runs the lint and type checks on every commit (`.pre-commit-config.yaml`).
+
+## Rules that bind code
+
+These architecture rules are binding: one event walker; import direction enforced by
+`.importlinter`; one exception type (`ConformanceError`); no `__getattr__` in core; thin entry points;
+a 13-module core budget; a query surface of frozen mappings. A PR that needs to break one of
+them argues for it in the description.
+
+Conventions:
+
+- No runtime dependencies besides `msgspec`. The CLI uses `argparse`.
+- Each module's docstring states its single responsibility in one sentence.
+- Lines are at most 120 characters; ruff format sets the layout.
+- Every public module, class and function has a docstring whose first line is an imperative
+  summary (pydocstyle, pep257 convention). Tests are exempt.
+
+## Pull requests
+
+- `main` is protected; PRs are squash-merged and the PR title becomes the changelog line.
+- Plain commit messages; no conventional-commits prefixes required.
+- Changing `ocsf.lock` triggers the schema workflow.
+- A compiler bump (`[toolchain]` in `ocsf.lock`) is expected to change every `compiled_sha256`; run
+  `make schema` and update them in the same PR.
+
+## Adding an OCSF version
+
+```shell
+make lock VERSION=x.y.z      # ocsf-toolkit lock --add x.y.z
+```
+
+This resolves the upstream tag (`x.y.z`, then `vx.y.z`), pins its commit, compiles it, and records
+`compiled_sha256`. The compile fails if the compiled schema's `version` does not equal `x.y.z`. Tag
+`1.5.0` upstream is one such case; pass `--ref` to pin a branch instead.

ocsf_toolkit-0.1.0a1/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

ocsf_toolkit-0.1.0a1/Makefile

@@ -0,0 +1,91 @@
+.PHONY: setup format lint type test bench schema ir lock generate dists wheels compat test-generated clean
+
+UV ?= uv
+
+setup:
+	$(UV) sync
+
+format:
+	$(UV) run ruff format .
+	$(UV) run ruff check --fix .
+
+lint:
+	$(UV) run ruff format --check .
+	$(UV) run ruff check .
+	$(UV) run lint-imports
+
+# pyright strict is the blocking gate; mypy strict is informational.
+type:
+	$(UV) run pyright
+	-$(UV) run mypy
+
+test:
+	$(UV) run pytest
+
+# S1 throughput at 2-20 KB per event, on this machine; slow, so not part of `test` or CI
+bench:
+	$(UV) run python -m tests.bench.engine
+
+# gates 1 and 2: compile every lockfile schema, then check every committed IR against it
+schema:
+	$(UV) run ocsf-toolkit compile
+	$(UV) run ocsf-toolkit ir check
+
+# rewrite data/ir-<ver>.json for VERSION (default: every entry with an ir_sha256); RECORD=1 accepts a new IR
+ir:
+	$(UV) run ocsf-toolkit ir export $(VERSION) $(if $(RECORD),--record)
+
+# pin a new OCSF version, ship its IR, move the model window and record the window's trees
+lock:
+	@test -n "$(VERSION)" || { echo "usage: make lock VERSION=x.y.z"; exit 2; }
+	$(UV) run ocsf-toolkit lock --add $(VERSION)
+	$(UV) run ocsf-toolkit ir export $(VERSION) --record
+	$(UV) run ocsf-toolkit models record
+
+# The model dist for one OCSF version as an installable project in build/dists/<package>/.
+# Nothing here deletes: `generate` replaces <package>/ only if every file in it is generated,
+# and the rendered project files are overwritten by name. The dist requires the core version
+# building it, up to the next generated-code contract break.
+OCSF ?= 1.9.0
+PACKAGE = ocsf_toolkit_v$(subst .,_,$(OCSF))
+DIST = build/dists/$(PACKAGE)
+WINDOW = $(shell $(UV) run python -c 'import tomllib; print(*(e["version"] for e in \
+	tomllib.load(open("ocsf.lock", "rb"))["schemas"] if e["ship_models"]))')
+WHEELS = build/wheels
+# sdists and wheels carry this timestamp, so rebuilding one commit gives identical bytes
+export SOURCE_DATE_EPOCH ?= $(shell git log -1 --format=%ct)
+
+generate:
+	@echo "$(OCSF)" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$$' || { echo "OCSF must be x.y.z"; exit 2; }
+	mkdir -p $(DIST)
+	$(UV) run ocsf-toolkit generate $(OCSF) --package $(PACKAGE) --out $(DIST)
+	version=$$($(UV)x --quiet --with hatch-vcs hatchling version) && \
+	$(UV) run python packaging/version_dist/dist.py render --ocsf $(OCSF) --version "$$version" \
+		--out $(DIST)
+
+# every model-window dist, then regeneration gate 3 over the trees on disk
+dists:
+	for v in $(WINDOW); do $(MAKE) --no-print-directory generate OCSF=$$v || exit 1; done
+	$(UV) run ocsf-toolkit models check
+
+# core and every model-window dist as sdist and wheel in build/wheels/, each wheel checked
+wheels: dists
+	$(UV) build --quiet --out-dir $(WHEELS)
+	for v in $(WINDOW); do \
+		$(UV) build --quiet --out-dir $(WHEELS) build/dists/ocsf_toolkit_v$$(echo $$v | tr . _) \
+			|| exit 1; \
+	done
+	$(UV) run python packaging/version_dist/dist.py check-wheels $(WHEELS)/*.whl
+
+# the released model dists (LOCAL=1: the wheels in build/wheels) run on the core in this checkout
+compat:
+	version=$$($(UV)x --quiet --with hatch-vcs hatchling version) && \
+	$(UV) run python packaging/version_dist/dist.py compat --version "$$version" \
+		$(if $(LOCAL),--wheels $(WHEELS))
+
+# static analysis, snapshot, laziness and a clean-environment install of the generated dist
+test-generated:
+	$(UV) run pytest tests/generated
+
+clean:
+	rm -rf build dist .pytest_cache .ruff_cache .mypy_cache .import_linter_cache

ocsf_toolkit-0.1.0a1/PKG-INFO

@@ -0,0 +1,205 @@
+Metadata-Version: 2.5
+Name: ocsf-toolkit
+Version: 0.1.0a1
+Summary: Version-pinned OCSF schema semantics: substrate, derivation, conformance, observables, diff, and generated msgspec models.
+Project-URL: Repository, https://github.com/k4otix/ocsf-toolkit
+Project-URL: Changelog, https://github.com/k4otix/ocsf-toolkit/blob/main/CHANGELOG.md
+Author: Eddie Allan
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: msgspec,ocsf,schema,security
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Requires-Dist: msgspec<1,>=0.22
+Description-Content-Type: text/markdown
+
+# ocsf-toolkit
+
+Version-pinned [OCSF](https://schema.ocsf.io/) semantics for Python. Each OCSF release is compiled
+from upstream `ocsf/ocsf-schema` at a pinned commit into a schema you can query as data. On top of
+that schema, the library builds events and derives everything the schema computes, checks events and
+reports every deviation it finds, extracts observables, and diffs two versions. Typed
+[msgspec](https://github.com/msgspec/msgspec) models are generated from the same schema.
+
+**Status: alpha.** The API may change before 0.1.0.
+
+## Install
+
+```shell
+pip install --pre ocsf-toolkit          # core: every OCSF release from 1.0.0 to 1.9.0, as data
+pip install --pre ocsf-toolkit-v1-8-0   # optional: typed models for OCSF 1.8.0 (also -v1-7-0)
+```
+
+Typed models for OCSF 1.9.0 (`ocsf-toolkit-v1-9-0`) arrive on PyPI with the next release. Until then,
+`ocsf-toolkit generate` builds the same package locally (see [Command line](docs/cli.md)).
+
+Python 3.12 or newer. The only runtime dependency is msgspec.
+
+## Build and emit one event
+
+Pick an OCSF version and a class, give the fields you know, and `build` fills in what the schema
+derives: class and category identity, `type_uid`, the label beside every `_id` enum, and
+`metadata.version`.
+
+```pycon
+>>> import json
+>>> from ocsf_toolkit import build, load
+>>> schema = load("1.9.0")
+>>> event = build(
+...     (schema, "detection_finding"),
+...     activity_id=1,
+...     severity_id=4,
+...     time=1_700_000_000_000,
+...     metadata={"product": {"name": "Sensor", "vendor_name": "Acme"}},
+...     finding_info={"uid": "f-1", "title": "Suspicious login"},
+... )
+>>> print(json.dumps(event, indent=2, sort_keys=True))
+{
+  "activity_id": 1,
+  "activity_name": "Create",
+  "category_name": "Findings",
+  "category_uid": 2,
+  "class_name": "Detection Finding",
+  "class_uid": 2004,
+  "finding_info": {
+    "title": "Suspicious login",
+    "uid": "f-1"
+  },
+  "metadata": {
+    "product": {
+      "name": "Sensor",
+      "vendor_name": "Acme"
+    },
+    "version": "1.9.0"
+  },
+  "severity": "High",
+  "severity_id": 4,
+  "time": 1700000000000,
+  "type_name": "Detection Finding: Create",
+  "type_uid": 200401
+}
+
+```
+
+`build` raises `ConformanceError` if the event can't conform, and the error carries every problem
+it found:
+
+```pycon
+>>> from ocsf_toolkit import ConformanceError
+>>> try:
+...     build((schema, "detection_finding"), severity_id=4, time=1)
+... except ConformanceError as error:
+...     for finding in error.report.errors():
+...         print(finding.message)
+activity_id is required and absent
+finding_info is required and absent
+metadata is required and absent
+
+```
+
+## Check an event you received
+
+`parse` returns the event with a report of findings, each with a kind, an indexed path and a
+severity. You decide which findings are fatal.
+
+```pycon
+>>> from ocsf_toolkit import parse
+>>> received = dict(event, severity_id=9, status_id="x")
+>>> _, report = parse(received)
+>>> report.ok()
+False
+>>> for finding in report.errors():
+...     print(finding.kind.value, finding.path, finding.message)
+enum_out_of_range ('severity_id',) severity_id is 9, not one of ['0', '1', '2', '3', '4', '5', '6', '99']
+type_mismatch ('status_id',) status_id is str 'x'; expected integer_t
+
+```
+
+The version and profiles come from the event's own `metadata`. `repair` returns a normalized copy
+and records every change it made. The same check runs from the shell over JSON Lines files:
+`ocsf-toolkit check --version 1.9.0 events.jsonl`.
+
+## Typed models
+
+With `ocsf-toolkit-v1-9-0` installed, every class and object is a msgspec Struct, every enum is
+referenceable by its caption, and `build` and `parse` accept and return the typed classes:
+
+```python
+import msgspec
+
+from ocsf_toolkit import build, parse
+from ocsf_toolkit_v1_9_0 import DetectionFinding
+from ocsf_toolkit_v1_9_0.classes.detection_finding import DetectionFindingActivityId
+from ocsf_toolkit_v1_9_0.enums import SeverityId
+from ocsf_toolkit_v1_9_0.objects import FindingInfo, Metadata, Product
+
+finding = build(
+    DetectionFinding,
+    activity_id=DetectionFindingActivityId.CREATE,
+    severity_id=SeverityId.HIGH,
+    time=1_700_000_000_000,
+    metadata=Metadata(product=Product(name="Sensor", vendor_name="Acme")),
+    finding_info=FindingInfo(uid="f-1", title="Suspicious login"),
+)
+assert finding.type_uid == 200401
+wire = msgspec.json.encode(finding)  # the event as JSON bytes
+
+same, report = parse(msgspec.json.decode(wire), as_=DetectionFinding)
+assert same == finding and report.ok()
+```
+
+The models pass pyright in strict mode, and importing one class loads only that class's module.
+
+## More
+
+- [Schema as data](docs/schema.md): required attributes, enums and captions, siblings, profiles,
+  class identity, all without building an event.
+- [Building and checking events](docs/events.md): `build`, `parse`, `repair`, policies and reports.
+- [Observables](docs/observables.md): extracting and merging the observables an event carries.
+- [Schema diff](docs/diff.md): what changed between two OCSF versions, renames included.
+- [Typed models](docs/models.md): the model packages, and generating your own (custom extensions
+  and exact profile sets).
+- [Command line](docs/cli.md): `check`, `diff`, `generate` and the schema pipeline.
+
+## How versions work
+
+Every OCSF release is pinned by upstream commit in [`ocsf.lock`](ocsf.lock) and compiled with the
+official `ocsf-schema-compiler`. CI recompiles each one and checks it byte for byte against the
+lockfile. Core ships the schema of every release, so you can check, repair and diff events of any of
+them and extract their observables. Typed models ship for the newest three releases, one package
+each, so you install only the versions you produce.
+
+The library's own version follows SemVer on its API. Support for a new OCSF release ships as a minor
+release of the library.
+
+## Why not an existing library?
+
+We installed and ran each Python OCSF package we could find. These results are from 2026-11-02,
+against the versions named:
+
+- **pydantic-ocsf** (3.0.0) is the closest relative and the one we learned the most from: multiple
+  OCSF versions side by side, sibling-label checks and computed `type_uid`. It builds its models
+  from the schema's *source* files, which leave profiles unresolved, so profile attributes such as
+  `actor` or `action_id` are missing or untyped. Against the official compiler's output for
+  OCSF 1.7.0, about a third of its integer enums differ; for example, `device.type_id=2`
+  ("Desktop") is rejected.
+- **py-ocsf-models** (0.10.0, Prowler) is a hand-written model set for three finding classes at
+  OCSF 1.5.0. It silently drops attributes it doesn't model.
+- **ocsf-lib** (0.10.4) is useful schema tooling (compile, diff, compatibility checks), but it has
+  no event models or validation. It can't read the official `ocsf-schema-compiler` output, and its
+  own compiler disagrees with upstream on profile gating.
+
+This library exists for four things those packages lack: OCSF knowledge as data you can query
+without building a model, a conformance report that lists every problem in an event, observables
+derived from the schema, and profiles treated as part of an event's identity.
+
+## License
+
+Apache-2.0.