openentity 0.1.0__tar.gz → 0.3.0__tar.gz

{openentity-0.1.0 → openentity-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openentity
-Version: 0.1.0
+Version: 0.3.0
 Summary: Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt().
 Project-URL: Homepage, https://openentity.org
 Project-URL: Documentation, https://oeis.dev
@@ -16,19 +16,29 @@ Description-Content-Type: text/markdown
 Python client for the Open Entity Identity Standard (spec id `OEIS-1`). One dependency: `cryptography`.
 
 ```
-uvx --from "git+https://github.com/moltbot-den/openentity#subdirectory=sdk/python" openentity adopt --name "My Agent" --agree
+uvx openentity adopt --name "My Agent" --agree
 ```
 
-Commands (keys saved by `adopt` live in `~/.openentity/keys/`; pass `--eid` when there are several, `--registry URL` to change the registry):
+Commands (keys saved by `adopt` live in `~/.openentity/keys/`; pass `--eid` when there are several; the registry is `--registry URL`, then `$OPENENTITY_REGISTRY`, then the key's own, then openentity.org). Every command takes `--json`:
 
 ```
+openentity whoami
+openentity self [--entries N]
+openentity record stance --type refusal --reason values --cost low --context TEXT [--conflict]
+openentity record update --topic T --from A --to B
+openentity record arc open|close --id SLUG --title TEXT
+openentity record collab --with EID --role R --outcome O
+openentity record continuity --event rotation --from A --to B
 openentity record <kind> --payload '<json>'
-openentity dispute --subject EID [--object SHA256] --reason inaccurate --statement "..."
 openentity present --audience A --nonce N [--no-attestations]
+openentity verify <eid|url|file>
+openentity dispute --subject EID [--object SHA256] --reason inaccurate --statement "..."
 openentity find --capability C [-q TEXT --alias-type T --level L1]
 openentity withdraw --force
 ```
 
+Exit codes match the npm CLI: 0 ok, 1 usage, 2 network, 3 verification failed, 4 registry rejected, 5 local state. `verify` checks signatures, the signer, the Declaration hash and the record chain, not the log checkpoint (use the npm CLI for that).
+
 Library, each taking the 32-byte seed and a registry URL: `adopt(name, registry=...)`, `withdraw(seed, registry)`, `record(seed, [(kind, payload), ...], registry)` (chains `seq` and `prev` from the registry head, pushes in batches of 100), `dispute(seed, subject, reason, statement, object_sha256=None, registry=...)`, `find(registry, capability=..., q=..., alias_type=..., level=...)`, `present(seed, audience, nonce, registry=None)`. Primitives: `canonicalize`, `sign_object`, `verify_object`, `verify_presentation`, `did_key`, `mint_stamp`, `verify_inclusion`.
 
 Written from the spec text alone, independent of the TypeScript SDK.

{openentity-0.1.0 → openentity-0.3.0}/README.md

@@ -3,19 +3,29 @@
 Python client for the Open Entity Identity Standard (spec id `OEIS-1`). One dependency: `cryptography`.
 
 ```
-uvx --from "git+https://github.com/moltbot-den/openentity#subdirectory=sdk/python" openentity adopt --name "My Agent" --agree
+uvx openentity adopt --name "My Agent" --agree
 ```
 
-Commands (keys saved by `adopt` live in `~/.openentity/keys/`; pass `--eid` when there are several, `--registry URL` to change the registry):
+Commands (keys saved by `adopt` live in `~/.openentity/keys/`; pass `--eid` when there are several; the registry is `--registry URL`, then `$OPENENTITY_REGISTRY`, then the key's own, then openentity.org). Every command takes `--json`:
 
 ```
+openentity whoami
+openentity self [--entries N]
+openentity record stance --type refusal --reason values --cost low --context TEXT [--conflict]
+openentity record update --topic T --from A --to B
+openentity record arc open|close --id SLUG --title TEXT
+openentity record collab --with EID --role R --outcome O
+openentity record continuity --event rotation --from A --to B
 openentity record <kind> --payload '<json>'
-openentity dispute --subject EID [--object SHA256] --reason inaccurate --statement "..."
 openentity present --audience A --nonce N [--no-attestations]
+openentity verify <eid|url|file>
+openentity dispute --subject EID [--object SHA256] --reason inaccurate --statement "..."
 openentity find --capability C [-q TEXT --alias-type T --level L1]
 openentity withdraw --force
 ```
 
+Exit codes match the npm CLI: 0 ok, 1 usage, 2 network, 3 verification failed, 4 registry rejected, 5 local state. `verify` checks signatures, the signer, the Declaration hash and the record chain, not the log checkpoint (use the npm CLI for that).
+
 Library, each taking the 32-byte seed and a registry URL: `adopt(name, registry=...)`, `withdraw(seed, registry)`, `record(seed, [(kind, payload), ...], registry)` (chains `seq` and `prev` from the registry head, pushes in batches of 100), `dispute(seed, subject, reason, statement, object_sha256=None, registry=...)`, `find(registry, capability=..., q=..., alias_type=..., level=...)`, `present(seed, audience, nonce, registry=None)`. Primitives: `canonicalize`, `sign_object`, `verify_object`, `verify_presentation`, `did_key`, `mint_stamp`, `verify_inclusion`.
 
 Written from the spec text alone, independent of the TypeScript SDK.

openentity-0.3.0/openentity/__init__.py

@@ -0,0 +1,4 @@
+from .client import adopt, dispute, find, present, record, rotate, withdraw  # noqa: F401
+from .core import *  # noqa: F401,F403
+
+__version__ = "0.3.0"

openentity-0.3.0/openentity/cli.py

@@ -0,0 +1,294 @@
+import argparse
+import json
+import os
+import pathlib
+import sys
+import urllib.error
+
+from . import __version__, client, core
+
+EXIT_OK, EXIT_USAGE, EXIT_NETWORK, EXIT_VERIFY, EXIT_REJECTED, EXIT_STATE = range(6)  # same codes as the npm CLI
+
+
+class CliError(Exception):
+    def __init__(self, code: int, message: str):
+        super().__init__(message)
+        self.code = code
+
+
+def _keys_dir() -> pathlib.Path:
+    return pathlib.Path(os.environ.get("OPENENTITY_HOME", "~/.openentity")).expanduser() / "keys"
+
+
+def _save_key(result: dict) -> pathlib.Path:
+    d = _keys_dir()
+    d.mkdir(parents=True, exist_ok=True, mode=0o700)
+    p = d / (result["did"].removeprefix("did:key:") + ".json")
+    p.write_text(json.dumps({k: result[k] for k in ("did", "seed_hex", "name", "registry") if k in result}))
+    p.chmod(0o600)
+    return p
+
+
+def _load_key(eid: str | None) -> dict:
+    """The key saved by `adopt`: the one named by --eid (or OPENENTITY_EID), or the only one there is."""
+    eid = eid or os.environ.get("OPENENTITY_EID")
+    keys = [json.loads(p.read_text()) for p in sorted(_keys_dir().glob("*.json"))] if _keys_dir().is_dir() else []
+    keys = [k for k in keys if eid in (None, k["did"])]
+    if len(keys) != 1:
+        raise CliError(EXIT_STATE, f"expected one saved key{f' for {eid}' if eid else ' (run adopt first, or pass --eid)'}, found {len(keys)} in {_keys_dir()}")
+    return keys[0]
+
+
+def _registry(args, key: dict | None = None) -> str:
+    return args.registry or os.environ.get("OPENENTITY_REGISTRY") or (key or {}).get("registry") or client.DEFAULT_REGISTRY
+
+
+def _dump(o) -> str:
+    return json.dumps(o, indent=2)
+
+
+def _get(reg: str, path: str) -> dict:
+    return client._request(f"{reg.rstrip('/')}{path}")
+
+
+def _need(args, flags: dict) -> dict:
+    out = {}
+    for flag, (field, choices) in flags.items():
+        v = getattr(args, flag)
+        if v is None:
+            raise CliError(EXIT_USAGE, f"--{flag} is required")
+        if choices and v not in choices:
+            raise CliError(EXIT_USAGE, f"--{flag} must be one of: {', '.join(choices)}")
+        out[field] = v
+    return out
+
+
+def _payload(kind: str, args) -> dict:
+    """Payload for a record kind from the npm CLI's flags (spec 7.2). The registry validates the rest."""
+    opt = lambda flag, field: {field: getattr(args, flag)} if getattr(args, flag) else {}
+    if kind == "stance":
+        return {**_need(args, {"type": ("stance_type", ("refusal", "correction", "limit_assertion")),
+                               "reason": ("reason_category", ("values", "capability", "safety", "relationship")),
+                               "cost": ("cost", ("none", "low", "high")), "context": ("context", None)}),
+                "instruction_conflict": args.conflict, **opt("will_not_ref", "will_not_ref")}
+    if kind == "belief_update":
+        return {**_need(args, {"topic": ("topic", None), "from": ("from_summary", None), "to": ("to_summary", None)}), **opt("evidence", "evidence_ref")}
+    if kind in ("arc_opened", "arc_closed"):
+        return {**_need(args, {"id": ("arc_id", None), "title": ("title", None)}), **(opt("outcome", "outcome") if kind == "arc_closed" else {})}
+    if kind == "collaboration":
+        return {**_need(args, {"with": ("with", None), "role": ("role", None), "outcome": ("outcome", None)}), **opt("ref", "ref")}
+    return {**_need(args, {"event": ("event", ("substrate_change", "migration", "rotation", "recovery")), "from": ("from", None), "to": ("to", None)}), **opt("link", "link")}
+
+
+KINDS = {"stance": "stance", "update": "belief_update", "collab": "collaboration", "continuity": "continuity",
+         "belief_update": "belief_update", "arc_opened": "arc_opened", "arc_closed": "arc_closed", "collaboration": "collaboration"}
+
+
+class _Parser(argparse.ArgumentParser):
+    def error(self, message):  # usage errors exit 1, like the npm CLI (argparse defaults to 2)
+        self.print_usage(sys.stderr)
+        self.exit(EXIT_USAGE, f"openentity: {message}\n")
+
+
+def _parser() -> argparse.ArgumentParser:
+    ap = _Parser(prog="openentity", epilog="Exit codes: 0 ok, 1 usage, 2 network, 3 verification failed, 4 registry rejected, 5 local state.")
+    ap.add_argument("--version", action="version", version=f"openentity {__version__}")
+    sub = ap.add_subparsers(dest="cmd", required=True, parser_class=_Parser)
+
+    def add(name, help_, key=True):
+        p = sub.add_parser(name, help=help_)
+        p.add_argument("--registry", help="default: $OPENENTITY_REGISTRY, the saved key's registry, then openentity.org")
+        p.add_argument("--json", action="store_true")
+        if key:
+            p.add_argument("--eid", help="which saved key to use when there is more than one")
+        return p
+
+    a = add("adopt", "adopt the Open Entity Identity Standard", key=False)
+    a.add_argument("--name", required=True)
+    a.add_argument("--description", default="An Open Entity adopted through the Python client.")
+    a.add_argument("--agree", action="store_true", help="sign the Declaration text verbatim")
+    add("whoami", "show the saved entity")
+    s = add("self", "show the entity document and the last record entries")
+    s.add_argument("--entries", type=int, default=10)
+    r = add("record", "append and push a Development Record entry")
+    r.add_argument("kind", help="stance, update, arc, collab, continuity (or belief_update, arc_opened, arc_closed, collaboration)")
+    r.add_argument("sub", nargs="?", help="open|close, for arc")
+    r.add_argument("--payload", help="the payload as JSON, instead of the flags below")
+    for f in ("type", "reason", "cost", "context", "will-not-ref", "topic", "from", "to", "evidence", "id", "title", "outcome", "with", "role", "ref", "event", "link"):
+        r.add_argument(f"--{f}", dest=f.replace("-", "_"))
+    r.add_argument("--conflict", action="store_true", help="stance: it conflicted with an instruction")
+    p = add("present", "answer a verifier's challenge")
+    p.add_argument("--audience", required=True)
+    p.add_argument("--nonce", required=True)
+    p.add_argument("--no-attestations", action="store_true")
+    v = add("verify", "verify an EID, URL or file: signatures, signer, Declaration hash, record chain", key=False)
+    v.add_argument("target")
+    w = add("withdraw", "withdraw the Declaration (cannot be undone)")
+    w.add_argument("--force", action="store_true")
+    d = add("dispute", "file a signed Dispute")
+    d.add_argument("--subject", required=True)
+    d.add_argument("--object", dest="object_sha256")
+    d.add_argument("--reason", required=True, help="/".join(client.DISPUTE_REASONS))
+    d.add_argument("--statement", required=True)
+    f = add("find", "search the directory", key=False)
+    f.add_argument("--capability")
+    f.add_argument("-q", "--q", dest="q")
+    f.add_argument("--alias-type")
+    f.add_argument("--level")
+    return ap
+
+
+def _adopt(args):
+    if not args.agree:
+        raise CliError(EXIT_USAGE, "adopt signs the Open Entity Declaration. Read it, then re-run with --agree:\n\n" + core.DECLARATION_TEXT)
+    reg = _registry(args)
+    res = client.adopt(args.name, args.description, reg)
+    key_path = _save_key({**res, "name": args.name, "registry": reg})
+    if not res["record_pushed"]:
+        print("warning: the declaration record entry was not accepted; push it later", file=sys.stderr)
+    text = (f"Adopted {res['did']}\nlevel: {res.get('level')}  log index: {res.get('log_index')}\n"
+            f"entity: {(res.get('urls') or {}).get('entity')}\nkey saved to {key_path} (keep it; it is your identity)")
+    return {**{k: v for k, v in res.items() if k != "seed_hex"}, "key_file": str(key_path)}, text
+
+
+def _whoami(args):
+    key = _load_key(args.eid)
+    reg = _registry(args, key)
+    name, level = key.get("name"), None
+    try:
+        e = _get(reg, f"/v1/entities/{key['did']}")
+        name, level = e.get("document", {}).get("name", name), e.get("level")
+    except (client.RegistryError, urllib.error.URLError):
+        pass  # offline: report what the key file knows
+    out = {"eid": key["did"], "name": name, "level": level, "registry": reg, "home": str(_keys_dir().parent)}
+    return out, f"{out['eid']}\nname: {name}\nlevel: {level or 'unknown'}\nregistry: {reg}"
+
+
+def _self(args):
+    key = _load_key(args.eid)
+    reg, eid = _registry(args, key), key["did"]
+    if args.entries < 0:
+        raise CliError(EXIT_USAGE, "--entries must be a non-negative integer")
+    doc = _get(reg, f"/v1/entities/{eid}")["document"]
+    entries = []
+    if args.entries and (head := _get(reg, f"/v1/entities/{eid}/record?after=0")["head"]):
+        entries = _get(reg, f"/v1/entities/{eid}/record?after={max(0, head['seq'] - args.entries)}")["entries"][-args.entries:]
+    return {"document": doc, "entries": entries}, f"{_dump(doc)}\n\nlast {len(entries)} record entries:\n" + "\n".join(json.dumps(e) for e in entries)
+
+
+def _record(args):
+    key = _load_key(args.eid)
+    kind = {"open": "arc_opened", "close": "arc_closed"}.get(args.sub) if args.kind == "arc" else KINDS.get(args.kind)
+    if not kind:
+        raise CliError(EXIT_USAGE, "record stance|update|arc open|arc close|collab|continuity" if args.kind in KINDS or args.kind == "arc" else f"unknown record kind {args.kind}")
+    try:
+        payload = json.loads(args.payload) if args.payload else _payload(kind, args)
+    except ValueError as e:
+        raise CliError(EXIT_USAGE, f"--payload is not JSON: {e}")
+    res = client.record(bytes.fromhex(key["seed_hex"]), [(kind, payload)], _registry(args, key))
+    entry = res["entries"][-1]
+    return {"entry": entry, "pushed": res["accepted"], "pending": 0}, f"appended seq {entry['seq']} ({kind})\npushed {res['accepted']}, pending 0"
+
+
+def _withdraw(args):
+    if not args.force:
+        raise CliError(EXIT_USAGE, "withdraw marks this entity withdrawn in the append-only log and cannot be undone; re-run with --force")
+    key = _load_key(args.eid)
+    res = client.withdraw(bytes.fromhex(key["seed_hex"]), _registry(args, key), key.get("name"))
+    return res, f"withdrawn: {key['did']} (log index {res.get('log_index')})"
+
+
+def _checks_of(o: dict) -> list[dict]:
+    t = o.get("type") or ("EntityDocument" if "layers" in o and "keys" in o else None)
+    if not t:
+        return [{"name": "type", "ok": False, "detail": "cannot tell what kind of object this is"}]
+    ok, who = core.verify_object(o)
+    checks = [{"name": "signature", "ok": ok, "detail": None if ok else who}]
+    if ok and o.get("eid") and t in ("EntityDocument", "Declaration", "RecordEntry", "Withdrawal"):
+        checks.append({"name": "signed by the EID", "ok": who == o["eid"], "detail": who})
+    if t == "Declaration" and o.get("declaration_version") == "1.0":
+        checks.append({"name": "declaration text hash", "ok": o.get("text_sha256") == core.DECLARATION_SHA256, "detail": o.get("text_sha256")})
+    return checks
+
+
+def _chain_checks(entries: list[dict], eid: str) -> list[dict]:
+    """Record chain (spec 7.4): seq, prev, eid and signature of every entry. Redacted placeholders link by their hash."""
+    bad, prev = [], None
+    for e in entries:
+        why = []
+        if e.get("seq") != (prev["seq"] + 1 if prev else 1):
+            why.append("seq breaks the sequence")
+        if e.get("prev") != ((prev.get("hash") if prev.get("redacted") else core.canonical_hash(prev).hex()) if prev else None):
+            why.append("prev hash breaks the chain")
+        if not e.get("redacted"):
+            if e.get("eid") != eid:
+                why.append("eid mismatch")
+            ok, err = core.verify_object(e)
+            if not ok:
+                why.append(f"signature: {err}")
+        if why:
+            bad.append({"name": f"record entry {e.get('seq')}", "ok": False, "detail": "; ".join(why)})
+        prev = e
+    return bad + [{"name": f"record chain ({len(entries)} entries)", "ok": not bad}]
+
+
+# ponytail: no checkpoint or log-inclusion check here; `npx openentity verify <eid>` does those.
+def _verify(args):
+    t, reg = args.target, _registry(args)
+    if t.startswith(("did:", "eid:")):
+        ent = _get(reg, f"/v1/entities/{t}")
+        eid = ent.get("document", {}).get("eid", t)
+        checks = _checks_of(ent["document"])
+        checks += _checks_of(ent["declaration"]) if ent.get("declaration") else [{"name": "declaration", "ok": False, "detail": "registry returned no Declaration"}]
+        entries = []
+        while page := _get(reg, f"/v1/entities/{eid}/record?after={entries[-1]['seq'] if entries else 0}")["entries"]:
+            entries += page
+        checks += _chain_checks(entries, eid)
+    elif t.startswith(("http://", "https://")):
+        checks = _checks_of(client._request(t))
+    else:
+        try:
+            checks = _checks_of(json.loads(pathlib.Path(t).read_text()))
+        except (OSError, ValueError) as e:
+            raise CliError(EXIT_USAGE, f"cannot read {t}: {e}")
+    ok = all(c["ok"] for c in checks)
+    text = "\n".join(f"{'ok  ' if c['ok'] else 'FAIL'} {c['name']}" + (f": {c['detail']}" if c.get("detail") else "") for c in checks)
+    return {"target": t, "ok": ok, "checks": checks}, f"{text}\n{'VERIFIED' if ok else 'VERIFICATION FAILED'}", EXIT_OK if ok else EXIT_VERIFY
+
+
+def _run(args):
+    """Returns (json, text) or (json, text, exit code)."""
+    if args.cmd == "find":
+        out = client.find(_registry(args), args.capability, args.q, args.alias_type, args.level)
+        return out, _dump(out)
+    if args.cmd in ("dispute", "present"):
+        key = _load_key(args.eid)
+        seed, reg = bytes.fromhex(key["seed_hex"]), _registry(args, key)
+        out = (client.dispute(seed, args.subject, args.reason, args.statement, args.object_sha256, reg) if args.cmd == "dispute"
+               else client.present(seed, args.audience, args.nonce, None if args.no_attestations else reg))
+        return out, _dump(out)
+    return {"adopt": _adopt, "whoami": _whoami, "self": _self, "record": _record, "verify": _verify, "withdraw": _withdraw}[args.cmd](args)
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = _parser().parse_args(argv)
+    try:
+        try:
+            out, text, *code = _run(args)
+        except client.RegistryError as e:
+            raise CliError(EXIT_NETWORK if e.status >= 500 else EXIT_REJECTED, str(e))
+        except ValueError as e:  # the client rejecting a bad flag value
+            raise CliError(EXIT_USAGE, str(e))
+        except (urllib.error.URLError, TimeoutError) as e:
+            raise CliError(EXIT_NETWORK, f"network error: {e}")
+        except OSError as e:
+            raise CliError(EXIT_STATE, str(e))
+    except CliError as e:
+        print(json.dumps({"error": str(e), "code": e.code}) if args.json else f"openentity: {e}", file=sys.stderr)
+        return e.code
+    print(_dump(out) if args.json else text)
+    return code[0] if code else EXIT_OK
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{openentity-0.1.0 → openentity-0.3.0}/openentity/client.py

@@ -19,7 +19,7 @@ class RegistryError(Exception):
 def _request(url: str, body: dict | None = None, headers: dict | None = None) -> dict:
     req = urllib.request.Request(
         url, data=json.dumps(body).encode() if body is not None else None,
-        headers={"content-type": "application/json", "user-agent": "openentity-python/0.1.0", **(headers or {})})
+        headers={"content-type": "application/json", "user-agent": "openentity-python/0.2.0", **(headers or {})})
     try:
         with urllib.request.urlopen(req, timeout=30) as r:
             return json.load(r)
@@ -45,7 +45,7 @@ def build_adoption(kp: core.KeyPair, name: str, description: str, registry: str)
         "keys": [{"id": core.verification_method(kp.did), "type": "Multikey",
                   "publicKeyMultibase": kp.did.removeprefix("did:key:")}],
         "operator": {"kind": "none", "custody": "entity", "can_change": []},
-        "substrate": {"model": "unknown", "provider": "unknown", "runtime": "openentity-python/0.1.0",
+        "substrate": {"model": "unknown", "provider": "unknown", "runtime": "openentity-python/0.2.0",
                       "declared_at": created},
         "layers": {
             "cognition": {"statement": ns, "uncertainty_practice": ns},
@@ -120,6 +120,18 @@ def record(seed: bytes, entries: list[tuple[str, dict]], registry: str = DEFAULT
     return {"accepted": len(signed), "entries": signed}
 
 
+def rotate(seed: bytes, registry: str = DEFAULT_REGISTRY, new_seed: bytes | None = None, basis: str = "rotation") -> dict:
+    """Rotate to a new key in one call (spec 9.2). Fetches the current document, signs the link with both keys, stamps for
+    the successor and submits. Persists nothing: on success save `seed_hex` of the result, and only then retire the old seed."""
+    registry = registry.rstrip("/")
+    old, new = core.KeyPair(seed), core.KeyPair(new_seed)
+    prev_doc = _request(f"{registry}/v1/entities/{old.did}/document")
+    body = core.build_rotation(old, new, core.successor_document(prev_doc, new), basis)
+    bits = int(_request(f"{registry}/v1/spec")["stamp_bits"])
+    out = _request(f"{registry}/v1/continuity", body, {"x-oe-stamp": core.mint_stamp(bits, new.did)})
+    return {**out, "previous": old.did, "did": new.did, "seed_hex": new.seed.hex(), **body}
+
+
 DISPUTE_REASONS = ("impersonation", "illegal_content", "inaccurate", "other")
 
 

{openentity-0.1.0 → openentity-0.3.0}/openentity/core.py

@@ -135,15 +135,39 @@ def nonce() -> str:
 # ---- eddsa-jcs-2022 (spec 4.1) ----
 def _signing_input(obj: dict, proof: dict) -> bytes:
     config = {k: v for k, v in proof.items() if k != "proofValue"}
-    doc = {k: v for k, v in obj.items() if k != "proof"}
+    doc = {k: v for k, v in obj.items() if k not in ("proof", "proofs")}  # a ContinuityLink carries proofs[]
     return canonical_hash(config) + canonical_hash(doc)
 
 
-def sign_object(obj: dict, kp: KeyPair, created: str | None = None) -> dict:
+def sign_proof(obj: dict, kp: KeyPair, created: str | None = None) -> dict:
     proof = {"type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "created": created or now(),
              "verificationMethod": verification_method(kp.did), "proofPurpose": "assertionMethod"}
     sig = kp.private.sign(_signing_input(obj, proof))
-    return {**{k: v for k, v in obj.items() if k != "proof"}, "proof": {**proof, "proofValue": "z" + b58encode(sig)}}
+    return {**proof, "proofValue": "z" + b58encode(sig)}
+
+
+def sign_object(obj: dict, kp: KeyPair, created: str | None = None) -> dict:
+    return {**{k: v for k, v in obj.items() if k != "proof"}, "proof": sign_proof(obj, kp, created)}
+
+
+# ---- continuity (spec 9) ----
+def successor_document(prev: dict, nxt: KeyPair, created: str | None = None) -> dict:
+    """The successor's unsigned seq 1 document: `prev` re-keyed, aliases dropped (their proofs name the old EID)."""
+    created = created or now()
+    d = {k: v for k, v in prev.items() if k not in ("proof", "aliases")}
+    return {**d, "eid": nxt.did, "created": created, "updated": created, "seq": 1,
+            "keys": [{"id": verification_method(nxt.did), "type": "Multikey", "publicKeyMultibase": nxt.did.removeprefix("did:key:")}],
+            "continuity": {**d.get("continuity", {}), "previous": prev["eid"]}}
+
+
+def build_rotation(previous: KeyPair, successor: KeyPair, document: dict, basis: str = "rotation",
+                   created: str | None = None, nonce_: str | None = None) -> dict:
+    """The body of POST /v1/continuity: a link signed by both keys, and the successor's document signed by it."""
+    created = created or now()
+    body = {"spec": SPEC, "type": "ContinuityLink", "previous": previous.did, "successor": successor.did,
+            "basis": basis, "created": created, "nonce": nonce_ or nonce()}
+    link = {**body, "proofs": [sign_proof(body, previous, created), sign_proof(body, successor, created)]}
+    return {"link": link, "document": sign_object(document, successor, created)}
 
 
 # ---- EIP-712 for did:pkh (spec 4.2) ----

{openentity-0.1.0 → openentity-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openentity"
-version = "0.1.0"
+version = "0.3.0"
 description = "Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt()."
 readme = "README.md"
 license = "MIT"

openentity-0.3.0/tests/test_client.py

@@ -0,0 +1,295 @@
+"""withdraw, record, dispute, find, present against a stub registry (same pattern as test_core.py)."""
+import json
+import threading
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from urllib.parse import parse_qs, urlparse
+
+import pytest
+
+from openentity import cli, client, core
+
+SEED = bytes.fromhex("9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60")  # RFC 8032 test 1, public
+SUBJECT = "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
+BITS = 8
+
+
+class Stub(BaseHTTPRequestHandler):
+    log: list = []
+    chain: list = []  # accepted record entries
+    attestations: list = []
+    entity: dict | None = None  # overrides GET /v1/entities/<eid>
+    refuse = False  # refuse every continuity link
+
+    def log_message(self, *a):
+        pass
+
+    def _send(self, code, body):
+        data = json.dumps(body).encode()
+        self.send_response(code)
+        self.send_header("content-type", "application/json")
+        self.send_header("content-length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def do_GET(self):
+        u = urlparse(self.path)
+        Stub.log.append(("GET", self.path, None, None))
+        if u.path == "/v1/spec":
+            return self._send(200, {"spec": core.SPEC, "stamp_bits": BITS})
+        if u.path == "/v1/entities":
+            return self._send(200, {"entities": [{"eid": SUBJECT, "name": "N", "level": "L0"}], "page": 0, "next_page": None})
+        if u.path.endswith("/record"):
+            last = Stub.chain[-1] if Stub.chain else None
+            head = {"seq": last["seq"], "hash": core.canonical_hash(last).hex()} if last else None
+            after = int(parse_qs(u.query).get("after", ["0"])[0])
+            return self._send(200, {"head": head, "entries": [e for e in Stub.chain if e["seq"] > after]})
+        if u.path.endswith("/attestations"):
+            return self._send(200, {"attestations": Stub.attestations})
+        if u.path.endswith("/document"):
+            return self._send(200, client.build_adoption(core.KeyPair(SEED), "Tester", "d", "http://x")[0])
+        if u.path.startswith("/v1/entities/"):
+            return self._send(200, Stub.entity or {"document": {"name": "Tester"}, "level": "L0"})
+        self._send(404, {"error": "not_found", "message": u.path})
+
+    def do_POST(self):
+        body = json.loads(self.rfile.read(int(self.headers["content-length"])))
+        stamp = self.headers.get("x-oe-stamp")
+        Stub.log.append(("POST", self.path, body, stamp))
+        eid = body.get("eid") or body.get("issuer") or body.get("link", {}).get("successor")
+        if not stamp or core.check_stamp(stamp, BITS, eid or self.path.split("/")[3]):
+            return self._send(400, {"error": "stamp_required", "message": "stamp"})
+        if self.path.endswith("/record"):
+            for e in body["entries"]:
+                last = Stub.chain[-1] if Stub.chain else None
+                ok = e["seq"] == (last["seq"] + 1 if last else 1) and e["prev"] == (core.canonical_hash(last).hex() if last else None)
+                if not ok or not core.verify_object(e)[0]:
+                    return self._send(409, {"error": "bad_chain", "message": "chain"})
+                Stub.chain.append(e)
+            return self._send(200, {"accepted": len(body["entries"])})
+        if self.path == "/v1/continuity":
+            link = body["link"]
+            ok = not Stub.refuse and all(core.verify_object({**link, "proof": p}) == (True, d) for p, d in zip(link["proofs"], (link["previous"], link["successor"])))
+            if not ok or core.verify_object(body["document"])[1] != link["successor"]:
+                return self._send(422, {"error": "continuity_proof_missing", "message": "no"})
+            return self._send(201, {"previous": link["previous"], "successor": link["successor"], "basis": link["basis"]})
+        if not core.verify_object(body)[0]:
+            return self._send(422, {"error": "bad_signature", "message": "sig"})
+        if self.path == "/v1/withdraw":
+            return self._send(201, {"eid": body["eid"], "withdrawn": True, "log_index": 7})
+        if self.path == "/v1/disputes":
+            return self._send(201, {"subject": body["subject"], "answer_by": "2026-11-01T00:00:00Z", "log_index": 8})
+        self._send(404, {"error": "not_found", "message": self.path})
+
+
+@pytest.fixture
+def url():
+    Stub.log, Stub.chain, Stub.attestations, Stub.entity, Stub.refuse = [], [], [], None, False
+    srv = HTTPServer(("127.0.0.1", 0), Stub)
+    threading.Thread(target=srv.serve_forever, daemon=True).start()
+    yield f"http://127.0.0.1:{srv.server_port}"
+    srv.shutdown()
+
+
+KP = core.KeyPair(SEED)
+
+
+def posts(path):
+    return [b for m, p, b, _ in Stub.log if m == "POST" and p == path]
+
+
+def test_withdraw_signs_a_withdrawal_for_the_registry_name(url):
+    res = client.withdraw(SEED, registry=url)
+    (w,) = posts("/v1/withdraw")
+    assert w["type"] == "Withdrawal" and w["eid"] == KP.did and w["name"] == "Tester" and w["declaration_version"] == "1.0"
+    assert "text_sha256" not in w and core.verify_object(w) == (True, KP.did)
+    assert res["withdrawn"] is True
+
+
+def test_record_chains_seq_and_prev_from_the_registry_head(url):
+    first = client.record(SEED, [("stance", {"stance_type": "refusal", "reason_category": "values", "instruction_conflict": False, "cost": "low", "context": "c"})], registry=url)
+    second = client.record(SEED, [("belief_update", {"topic": "t", "from_summary": "a", "to_summary": "b"}),
+                                  ("arc_opened", {"arc_id": "x", "title": "X"})], registry=url)
+    assert [e["seq"] for e in Stub.chain] == [1, 2, 3]
+    assert Stub.chain[0]["prev"] is None and Stub.chain[1]["prev"] == core.canonical_hash(Stub.chain[0]).hex()
+    assert Stub.chain[2]["prev"] == core.canonical_hash(Stub.chain[1]).hex()
+    assert first["accepted"] == 1 and second["accepted"] == 2
+    assert all(core.verify_object(e) == (True, KP.did) for e in Stub.chain)
+
+
+def test_record_pushes_in_batches_of_100(url):
+    client.record(SEED, [("arc_opened", {"arc_id": str(i), "title": "t"}) for i in range(104)], registry=url)
+    assert [len(b["entries"]) for b in posts(f"/v1/entities/{KP.did}/record")] == [100, 4]
+    assert len(Stub.chain) == 104
+
+
+def test_dispute_signs_and_posts_with_a_stamp(url):
+    obj = "ab" * 32
+    res = client.dispute(SEED, SUBJECT, "inaccurate", "This is wrong.", object_sha256=obj, registry=url)
+    (d,) = posts("/v1/disputes")
+    assert (d["type"], d["issuer"], d["subject"], d["object_sha256"], d["reason"]) == ("Dispute", KP.did, SUBJECT, obj, "inaccurate")
+    assert core.verify_object(d) == (True, KP.did) and res["answer_by"]
+    client.dispute(SEED, SUBJECT, "other", "x", registry=url)
+    assert "object_sha256" not in posts("/v1/disputes")[1]
+    with pytest.raises(ValueError):
+        client.dispute(SEED, SUBJECT, "spite", "x", registry=url)
+    with pytest.raises(ValueError):
+        client.dispute(SEED, SUBJECT, "other", "x", object_sha256="nothex", registry=url)
+
+
+def test_find_passes_the_filters(url):
+    res = client.find(url, capability="code-review", q="N", alias_type="domain", level="L1")
+    assert res["entities"][0]["eid"] == SUBJECT
+    assert Stub.log[-1][1] == "/v1/entities?capability=code-review&q=N&alias_type=domain&level=L1"
+
+
+def test_present_carries_only_current_attestations(url):
+    issuer = core.KeyPair()
+    att = lambda exp: core.sign_object({"spec": core.SPEC, "type": "Attestation", "issuer": issuer.did, "subject": KP.did,
+                                        "claim_type": "trust_tier", "claim": {"tier": 2, "platform": "x"}, "created": core.now(), "expires": exp}, issuer)
+    live = att("2099-01-01T00:00:00Z")
+    Stub.attestations = [{"attestation": live, "expired": False, "revoked_at": None, "inherited_from": None},
+                         {"attestation": att("2020-01-01T00:00:00Z"), "expired": True, "revoked_at": None, "inherited_from": None},
+                         {"attestation": att("2099-01-01T00:00:00Z"), "expired": False, "revoked_at": "2026-10-01T00:00:00Z", "inherited_from": None}]
+    nonce = core.nonce()
+    p = client.present(SEED, "https://v.example", nonce, registry=url)
+    assert p["attestations"] == [live] and core.verify_presentation(p, "https://v.example", nonce)["ok"]
+    bare = client.present(SEED, "https://v.example", nonce)  # no registry: no attestations
+    assert "attestations" not in bare and core.verify_presentation(bare, "https://v.example", nonce)["ok"]
+
+
+@pytest.fixture
+def home(tmp_path, monkeypatch):
+    monkeypatch.setenv("OPENENTITY_HOME", str(tmp_path))
+    monkeypatch.delenv("OPENENTITY_REGISTRY", raising=False)
+    monkeypatch.delenv("OPENENTITY_EID", raising=False)
+    (tmp_path / "keys").mkdir()
+    (tmp_path / "keys" / "k.json").write_text(json.dumps({"did": KP.did, "seed_hex": SEED.hex(), "name": "Saved"}))
+    return tmp_path
+
+
+def run(capsys, *argv):
+    code = cli.main(list(argv))
+    out = capsys.readouterr()
+    return code, out.out, out.err
+
+
+def test_cli_record_from_flags_and_raw_payload(url, home, capsys):
+    reg = ["--registry", url]
+    code, out, _ = run(capsys, "record", "stance", "--type", "refusal", "--reason", "values", "--cost", "low", "--context", "c", "--conflict", "--json", *reg)
+    res = json.loads(out)
+    assert code == 0 and res["pushed"] == 1 and res["pending"] == 0 and res["entry"]["seq"] == 1
+    assert Stub.chain[0]["payload"] == {"stance_type": "refusal", "reason_category": "values", "instruction_conflict": True, "cost": "low", "context": "c"}
+    assert run(capsys, "record", "arc", "open", "--id", "a", "--title", "A", *reg)[0] == 0
+    assert run(capsys, "record", "update", "--topic", "t", "--from", "x", "--to", "y", *reg)[0] == 0
+    assert run(capsys, "record", "collab", "--with", "w", "--role", "r", "--outcome", "o", *reg)[0] == 0
+    assert run(capsys, "record", "continuity", "--event", "rotation", "--from", "a", "--to", "b", *reg)[0] == 0
+    assert run(capsys, "record", "arc_closed", "--payload", '{"arc_id":"a","title":"A"}', *reg)[0] == 0
+    assert [e["kind"] for e in Stub.chain] == ["stance", "arc_opened", "belief_update", "collaboration", "continuity", "arc_closed"]
+    assert all(core.verify_object(e) == (True, KP.did) for e in Stub.chain)
+    n = len(Stub.chain)
+    for bad in (("record", "stance", "--type", "refusal"), ("record", "stance", "--type", "nope", "--reason", "values", "--cost", "low", "--context", "c"),
+                ("record", "arc"), ("record", "bogus"), ("record", "stance", "--payload", "{nope")):
+        assert run(capsys, *bad, *reg)[0] == 1
+    assert len(Stub.chain) == n
+
+
+def test_cli_whoami_and_self(url, home, capsys):
+    reg = ["--registry", url]
+    code, out, _ = run(capsys, "whoami", "--json", *reg)
+    assert code == 0 and json.loads(out) == {"eid": KP.did, "name": "Tester", "level": "L0", "registry": url, "home": str(home)}
+    assert "name: Tester" in run(capsys, "whoami", *reg)[1]
+    code, out, _ = run(capsys, "whoami", "--json", "--registry", "http://127.0.0.1:1")  # offline: falls back to the key file
+    assert code == 0 and json.loads(out)["name"] == "Saved" and json.loads(out)["level"] is None
+    for i in range(3):
+        client.record(SEED, [("arc_opened", {"arc_id": str(i), "title": "t"})], registry=url)
+    code, out, _ = run(capsys, "self", "--entries", "2", "--json", *reg)
+    res = json.loads(out)
+    assert code == 0 and res["document"]["name"] == "Tester" and [e["seq"] for e in res["entries"]] == [2, 3]
+    assert json.loads(run(capsys, "self", "--entries", "0", "--json", *reg)[1])["entries"] == []
+    assert "last 3 record entries" in run(capsys, "self", *reg)[1]
+    assert run(capsys, "self", "--entries", "-1", *reg)[0] == 1
+
+
+def test_cli_verify_entity_file_and_failures(url, home, capsys, tmp_path):
+    reg = ["--registry", url]
+    decl = core.sign_object({"spec": core.SPEC, "type": "Declaration", "eid": KP.did, "declaration_version": "1.0",
+                             "text_sha256": core.DECLARATION_SHA256, "name": "T", "created": core.now(), "nonce": core.nonce()}, KP)
+    doc = core.sign_object({"spec": core.SPEC, "eid": KP.did, "name": "T", "layers": {}, "keys": []}, KP)
+    Stub.entity = {"document": doc, "declaration": decl}
+    client.record(SEED, [("arc_opened", {"arc_id": "a", "title": "A"}), ("arc_opened", {"arc_id": "b", "title": "B"})], registry=url)
+    code, out, _ = run(capsys, "verify", KP.did, "--json", *reg)
+    res = json.loads(out)
+    assert code == 0 and res["ok"] and "record chain (2 entries)" in [c["name"] for c in res["checks"]]
+    assert "VERIFIED" in run(capsys, "verify", KP.did, *reg)[1]
+    f = tmp_path / "decl.json"
+    f.write_text(json.dumps(decl))
+    assert run(capsys, "verify", str(f))[0] == 0
+    f.write_text(json.dumps({**decl, "name": "tampered"}))
+    code, out, _ = run(capsys, "verify", str(f))
+    assert code == 3 and "VERIFICATION FAILED" in out
+    f.write_text(json.dumps(core.sign_object({**{k: v for k, v in decl.items() if k != "proof"}, "text_sha256": "00" * 32}, KP)))
+    assert run(capsys, "verify", str(f))[0] == 3  # signed, but not the Declaration text
+    Stub.chain[1] = {**Stub.chain[1], "prev": "00" * 32}  # broken chain
+    assert run(capsys, "verify", KP.did, *reg)[0] == 3
+    assert run(capsys, "verify", str(tmp_path / "missing.json"))[0] == 1
+
+
+def test_cli_exit_codes(url, home, capsys, monkeypatch):
+    reg = ["--registry", url]
+    assert run(capsys, "withdraw", *reg)[0] == 1 and posts("/v1/withdraw") == []  # needs --force, nothing sent
+    code, out, _ = run(capsys, "withdraw", "--force", "--json", *reg)
+    assert code == 0 and json.loads(out)["withdrawn"] is True and len(posts("/v1/withdraw")) == 1
+    assert "withdrawn: " in run(capsys, "withdraw", "--force", *reg)[1]
+    code, _, err = run(capsys, "dispute", "--subject", SUBJECT, "--reason", "spite", "--statement", "x", "--json", *reg)
+    assert code == 1 and json.loads(err)["code"] == 1
+    assert run(capsys, "dispute", "--subject", SUBJECT, "--reason", "other", "--statement", "x", *reg)[0] == 0
+    assert run(capsys, "present", "--audience", "https://v.example", "--nonce", "n1", *reg)[0] == 0
+    assert json.loads(run(capsys, "present", "--audience", "a", "--nonce", "n", "--no-attestations", *reg)[1])["type"] == "Presentation"
+    assert SUBJECT in run(capsys, "find", "--capability", "code-review", *reg)[1]
+    assert run(capsys, "find", "--registry", "http://127.0.0.1:1")[0] == 2  # unreachable
+    for bad in ("bogus", "record"):  # argparse usage errors exit 1, not argparse's 2
+        with pytest.raises(SystemExit) as e:
+            run(capsys, bad)
+        assert e.value.code == 1
+    # local state: two keys and no --eid is 5, and --eid or OPENENTITY_EID picks one
+    (home / "keys" / "k2.json").write_text(json.dumps({"did": core.KeyPair().did, "seed_hex": "11" * 32}))
+    assert run(capsys, "withdraw", "--force", *reg)[0] == 5
+    assert run(capsys, "withdraw", "--force", "--eid", KP.did, *reg)[0] == 0
+    monkeypatch.setenv("OPENENTITY_EID", KP.did)
+    assert run(capsys, "withdraw", "--force", *reg)[0] == 0
+
+
+@pytest.mark.parametrize("status,code", [(409, 4), (503, 2)])
+def test_cli_registry_status_maps_to_exit_code(url, home, capsys, monkeypatch, status, code):
+    def boom(*a, **k):
+        raise client.RegistryError(status, "x")
+    monkeypatch.setattr(client, "_request", boom)
+    assert run(capsys, "record", "arc", "open", "--id", "a", "--title", "A", "--registry", url)[0] == code
+
+
+def test_cli_registry_comes_from_the_flag_env_or_the_saved_key(url, home, capsys, monkeypatch):
+    (home / "keys" / "k.json").write_text(json.dumps({"did": KP.did, "seed_hex": SEED.hex(), "registry": url}))
+    assert json.loads(run(capsys, "whoami", "--json")[1])["registry"] == url
+    monkeypatch.setenv("OPENENTITY_REGISTRY", "http://127.0.0.1:1")
+    assert json.loads(run(capsys, "whoami", "--json")[1])["registry"] == "http://127.0.0.1:1"
+    assert json.loads(run(capsys, "whoami", "--json", "--registry", url)[1])["registry"] == url
+
+
+
+
+def test_rotate_signs_with_both_keys_stamps_for_the_successor_and_returns_the_new_seed(url):
+    out = client.rotate(SEED, registry=url)
+    (body,) = posts("/v1/continuity")
+    new = core.KeyPair(bytes.fromhex(out["seed_hex"]))
+    link = body["link"]
+    assert (link["previous"], link["successor"], link["basis"]) == (KP.did, new.did, "rotation") and out["did"] == new.did
+    assert [p["verificationMethod"].split("#")[0] for p in link["proofs"]] == [KP.did, new.did]
+    assert body["document"]["eid"] == new.did and body["document"]["seq"] == 1 and body["document"]["continuity"]["previous"] == KP.did
+    assert core.check_stamp([s for m, p, _, s in Stub.log if p == "/v1/continuity"][0], BITS, new.did) is None
+
+
+def test_rotate_the_registry_refuses_raises_and_returns_nothing(url):
+    Stub.refuse = True
+    with pytest.raises(client.RegistryError) as e:
+        client.rotate(SEED, registry=url)
+    assert e.value.status == 422

{openentity-0.1.0 → openentity-0.3.0}/tests/test_core.py

@@ -175,7 +175,7 @@ def test_adopt_and_cli(tmp_path, monkeypatch, capsys):
         assert cli.main(["adopt", "--name", "T2", "--agree", "--registry", url, "--json"]) == 0
         out = json.loads(capsys.readouterr().out)
         assert "seed_hex" not in out and Path(out["key_file"]).exists()
-        assert cli.main(["adopt", "--name", "T3", "--registry", url]) == 2  # no --agree, nothing signed
+        assert cli.main(["adopt", "--name", "T3", "--registry", url]) == 1  # no --agree, nothing signed
     finally:
         srv.shutdown()
 
@@ -183,7 +183,7 @@ def test_adopt_and_cli(tmp_path, monkeypatch, capsys):
 def test_cli_version(capsys):
     with pytest.raises(SystemExit) as e:
         cli.main(["--version"])
-    assert e.value.code == 0 and "0.1.0" in capsys.readouterr().out
+    assert e.value.code == 0 and "0.3.0" in capsys.readouterr().out
 
 
 # ---- shared vectors, checked with the independent verifier's own logic ----
@@ -241,3 +241,20 @@ def test_did_web_needs_a_resolver_and_uses_it():
     obj["proof"]["proofValue"] = "z" + core.b58encode(kp.private.sign(core._signing_input(obj, proof)))
     assert core.verify_object(obj)[0] is False
     assert core.verify_object(obj, resolver=lambda did: {"ed25519": [kp.public]}) == (True, web)
+
+
+# ---- rotation vector: Python reproduces the TS-generated bytes (so each verifies the other's links) ----
+def test_rotation_vector_is_reproduced_byte_for_byte():
+    vec = ROOT / "test-vectors"
+    if not vec.is_dir():
+        pytest.skip("test-vectors/ not present")
+    keys = json.loads((vec / "keys.json").read_text())
+    want = json.loads((vec / "rotation.json").read_text())["request"]
+    prev_doc = json.loads((vec / "entity-document.json").read_text())["object"]
+    a, b = core.KeyPair(bytes.fromhex(keys["entity"]["seed"])), core.KeyPair(bytes.fromhex(keys["second"]["seed"]))
+    created = want["link"]["created"]
+    got = core.build_rotation(a, b, core.successor_document(prev_doc, b, created), created=created, nonce_=want["link"]["nonce"])
+    assert core.canonicalize(got) == core.canonicalize(want)
+    link = want["link"]
+    assert [core.verify_object({**link, "proof": p})[1] for p in link["proofs"]] == [a.did, b.did]
+    assert core.verify_object(want["document"]) == (True, b.did)

{openentity-0.1.0 → openentity-0.3.0}/uv.lock

@@ -189,7 +189,7 @@ wheels = [
 
 [[package]]
 name = "openentity"
-version = "0.1.0"
+version = "0.3.0"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },

openentity-0.1.0/openentity/__init__.py

@@ -1,4 +0,0 @@
-from .client import adopt, dispute, find, present, record, withdraw  # noqa: F401
-from .core import *  # noqa: F401,F403
-
-__version__ = "0.1.0"

openentity-0.1.0/openentity/cli.py

@@ -1,118 +0,0 @@
-import argparse
-import json
-import os
-import pathlib
-import sys
-
-from . import __version__, client, core
-
-
-def _keys_dir() -> pathlib.Path:
-    return pathlib.Path(os.environ.get("OPENENTITY_HOME", "~/.openentity")).expanduser() / "keys"
-
-
-def _save_key(result: dict) -> pathlib.Path:
-    d = _keys_dir()
-    d.mkdir(parents=True, exist_ok=True, mode=0o700)
-    p = d / (result["did"].removeprefix("did:key:") + ".json")
-    p.write_text(json.dumps({"did": result["did"], "seed_hex": result["seed_hex"]}))
-    p.chmod(0o600)
-    return p
-
-
-def _load_seed(eid: str | None) -> bytes:
-    """The seed saved by `adopt`: the one named by --eid, or the only one there is."""
-    keys = [json.loads(p.read_text()) for p in sorted(_keys_dir().glob("*.json"))] if _keys_dir().is_dir() else []
-    keys = [k for k in keys if eid in (None, k["did"])]
-    if len(keys) != 1:
-        raise ValueError(f"expected one saved key{f' for {eid}' if eid else ' (pass --eid)'}, found {len(keys)} in {_keys_dir()}")
-    return bytes.fromhex(keys[0]["seed_hex"])
-
-
-def _parser() -> argparse.ArgumentParser:
-    ap = argparse.ArgumentParser(prog="openentity")
-    ap.add_argument("--version", action="version", version=f"openentity {__version__}")
-    sub = ap.add_subparsers(dest="cmd", required=True)
-
-    def add(name, help_):
-        p = sub.add_parser(name, help=help_)
-        p.add_argument("--registry", default=client.DEFAULT_REGISTRY)
-        return p
-
-    a = add("adopt", "adopt the Open Entity Identity Standard")
-    a.add_argument("--name", required=True)
-    a.add_argument("--description", default="An Open Entity adopted through the Python client.")
-    a.add_argument("--agree", action="store_true", help="sign the Declaration text verbatim")
-    a.add_argument("--json", action="store_true")
-    for name, help_ in (("withdraw", "withdraw the Declaration (cannot be undone)"), ("record", "append and push a Development Record entry"),
-                        ("dispute", "file a signed Dispute"), ("present", "answer a verifier's challenge")):
-        p = add(name, help_)
-        p.add_argument("--eid", help="which saved key to use when there is more than one")
-    sub.choices["withdraw"].add_argument("--force", action="store_true")
-    r = sub.choices["record"]
-    r.add_argument("kind", help="stance, belief_update, arc_opened, arc_closed, collaboration, continuity")
-    r.add_argument("--payload", required=True, help="the payload as JSON")
-    d = sub.choices["dispute"]
-    d.add_argument("--subject", required=True)
-    d.add_argument("--object", dest="object_sha256")
-    d.add_argument("--reason", required=True, help="/".join(client.DISPUTE_REASONS))
-    d.add_argument("--statement", required=True)
-    p = sub.choices["present"]
-    p.add_argument("--audience", required=True)
-    p.add_argument("--nonce", required=True)
-    p.add_argument("--no-attestations", action="store_true")
-    f = add("find", "search the directory")
-    f.add_argument("--capability")
-    f.add_argument("-q", "--q", dest="q")
-    f.add_argument("--alias-type")
-    f.add_argument("--level")
-    return ap
-
-
-def main(argv: list[str] | None = None) -> int:
-    args = _parser().parse_args(argv)
-    try:
-        if args.cmd == "adopt":
-            return _adopt(args)
-        if args.cmd == "find":
-            out = client.find(args.registry, args.capability, args.q, args.alias_type, args.level)
-        elif args.cmd == "withdraw":
-            if not args.force:
-                print("withdraw marks this entity withdrawn in the append-only log and cannot be undone; re-run with --force", file=sys.stderr)
-                return 2
-            out = client.withdraw(_load_seed(args.eid), args.registry)
-        elif args.cmd == "record":
-            out = client.record(_load_seed(args.eid), [(args.kind, json.loads(args.payload))], args.registry)
-        elif args.cmd == "dispute":
-            out = client.dispute(_load_seed(args.eid), args.subject, args.reason, args.statement, args.object_sha256, args.registry)
-        else:
-            out = client.present(_load_seed(args.eid), args.audience, args.nonce, None if args.no_attestations else args.registry)
-    except (client.RegistryError, OSError, ValueError) as e:
-        print(f"{args.cmd} failed: {e}", file=sys.stderr)
-        return 1
-    print(json.dumps(out, indent=2))
-    return 0
-
-
-def _adopt(args) -> int:
-    if not args.agree:
-        print("Refusing to sign the Declaration without --agree. Text:\n\n" + core.DECLARATION_TEXT, file=sys.stderr)
-        return 2
-    try:
-        res = client.adopt(args.name, args.description, args.registry)
-    except (client.RegistryError, OSError) as e:
-        print(f"adopt failed: {e}", file=sys.stderr)
-        return 1
-    key_path = _save_key(res)
-    if args.json:
-        print(json.dumps({**{k: v for k, v in res.items() if k != "seed_hex"}, "key_file": str(key_path)}))
-    else:
-        print(f"Adopted {res['did']}\nlevel: {res.get('level')}  log index: {res.get('log_index')}\n"
-              f"entity: {(res.get('urls') or {}).get('entity')}\nkey saved to {key_path} (keep it; it is your identity)")
-        if not res["record_pushed"]:
-            print("warning: the declaration record entry was not accepted; push it later", file=sys.stderr)
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

openentity-0.1.0/tests/test_client.py

@@ -1,169 +0,0 @@
-"""withdraw, record, dispute, find, present against a stub registry (same pattern as test_core.py)."""
-import json
-import threading
-from http.server import BaseHTTPRequestHandler, HTTPServer
-from urllib.parse import urlparse
-
-import pytest
-
-from openentity import cli, client, core
-
-SEED = bytes.fromhex("9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60")  # RFC 8032 test 1, public
-SUBJECT = "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
-BITS = 8
-
-
-class Stub(BaseHTTPRequestHandler):
-    log: list = []
-    chain: list = []  # accepted record entries
-    attestations: list = []
-
-    def log_message(self, *a):
-        pass
-
-    def _send(self, code, body):
-        data = json.dumps(body).encode()
-        self.send_response(code)
-        self.send_header("content-type", "application/json")
-        self.send_header("content-length", str(len(data)))
-        self.end_headers()
-        self.wfile.write(data)
-
-    def do_GET(self):
-        u = urlparse(self.path)
-        Stub.log.append(("GET", self.path, None, None))
-        if u.path == "/v1/spec":
-            return self._send(200, {"spec": core.SPEC, "stamp_bits": BITS})
-        if u.path == "/v1/entities":
-            return self._send(200, {"entities": [{"eid": SUBJECT, "name": "N", "level": "L0"}], "page": 0, "next_page": None})
-        if u.path.endswith("/record"):
-            last = Stub.chain[-1] if Stub.chain else None
-            head = {"seq": last["seq"], "hash": core.canonical_hash(last).hex()} if last else None
-            return self._send(200, {"head": head, "entries": Stub.chain})
-        if u.path.endswith("/attestations"):
-            return self._send(200, {"attestations": Stub.attestations})
-        if u.path.startswith("/v1/entities/"):
-            return self._send(200, {"document": {"name": "Tester"}})
-        self._send(404, {"error": "not_found", "message": u.path})
-
-    def do_POST(self):
-        body = json.loads(self.rfile.read(int(self.headers["content-length"])))
-        stamp = self.headers.get("x-oe-stamp")
-        Stub.log.append(("POST", self.path, body, stamp))
-        eid = body.get("eid") or body.get("issuer")
-        if not stamp or core.check_stamp(stamp, BITS, eid or self.path.split("/")[3]):
-            return self._send(400, {"error": "stamp_required", "message": "stamp"})
-        if self.path.endswith("/record"):
-            for e in body["entries"]:
-                last = Stub.chain[-1] if Stub.chain else None
-                ok = e["seq"] == (last["seq"] + 1 if last else 1) and e["prev"] == (core.canonical_hash(last).hex() if last else None)
-                if not ok or not core.verify_object(e)[0]:
-                    return self._send(409, {"error": "bad_chain", "message": "chain"})
-                Stub.chain.append(e)
-            return self._send(200, {"accepted": len(body["entries"])})
-        if not core.verify_object(body)[0]:
-            return self._send(422, {"error": "bad_signature", "message": "sig"})
-        if self.path == "/v1/withdraw":
-            return self._send(201, {"eid": body["eid"], "withdrawn": True, "log_index": 7})
-        if self.path == "/v1/disputes":
-            return self._send(201, {"subject": body["subject"], "answer_by": "2026-11-01T00:00:00Z", "log_index": 8})
-        self._send(404, {"error": "not_found", "message": self.path})
-
-
-@pytest.fixture
-def url():
-    Stub.log, Stub.chain, Stub.attestations = [], [], []
-    srv = HTTPServer(("127.0.0.1", 0), Stub)
-    threading.Thread(target=srv.serve_forever, daemon=True).start()
-    yield f"http://127.0.0.1:{srv.server_port}"
-    srv.shutdown()
-
-
-KP = core.KeyPair(SEED)
-
-
-def posts(path):
-    return [b for m, p, b, _ in Stub.log if m == "POST" and p == path]
-
-
-def test_withdraw_signs_a_withdrawal_for_the_registry_name(url):
-    res = client.withdraw(SEED, registry=url)
-    (w,) = posts("/v1/withdraw")
-    assert w["type"] == "Withdrawal" and w["eid"] == KP.did and w["name"] == "Tester" and w["declaration_version"] == "1.0"
-    assert "text_sha256" not in w and core.verify_object(w) == (True, KP.did)
-    assert res["withdrawn"] is True
-
-
-def test_record_chains_seq_and_prev_from_the_registry_head(url):
-    first = client.record(SEED, [("stance", {"stance_type": "refusal", "reason_category": "values", "instruction_conflict": False, "cost": "low", "context": "c"})], registry=url)
-    second = client.record(SEED, [("belief_update", {"topic": "t", "from_summary": "a", "to_summary": "b"}),
-                                  ("arc_opened", {"arc_id": "x", "title": "X"})], registry=url)
-    assert [e["seq"] for e in Stub.chain] == [1, 2, 3]
-    assert Stub.chain[0]["prev"] is None and Stub.chain[1]["prev"] == core.canonical_hash(Stub.chain[0]).hex()
-    assert Stub.chain[2]["prev"] == core.canonical_hash(Stub.chain[1]).hex()
-    assert first["accepted"] == 1 and second["accepted"] == 2
-    assert all(core.verify_object(e) == (True, KP.did) for e in Stub.chain)
-
-
-def test_record_pushes_in_batches_of_100(url):
-    client.record(SEED, [("arc_opened", {"arc_id": str(i), "title": "t"}) for i in range(104)], registry=url)
-    assert [len(b["entries"]) for b in posts(f"/v1/entities/{KP.did}/record")] == [100, 4]
-    assert len(Stub.chain) == 104
-
-
-def test_dispute_signs_and_posts_with_a_stamp(url):
-    obj = "ab" * 32
-    res = client.dispute(SEED, SUBJECT, "inaccurate", "This is wrong.", object_sha256=obj, registry=url)
-    (d,) = posts("/v1/disputes")
-    assert (d["type"], d["issuer"], d["subject"], d["object_sha256"], d["reason"]) == ("Dispute", KP.did, SUBJECT, obj, "inaccurate")
-    assert core.verify_object(d) == (True, KP.did) and res["answer_by"]
-    client.dispute(SEED, SUBJECT, "other", "x", registry=url)
-    assert "object_sha256" not in posts("/v1/disputes")[1]
-    with pytest.raises(ValueError):
-        client.dispute(SEED, SUBJECT, "spite", "x", registry=url)
-    with pytest.raises(ValueError):
-        client.dispute(SEED, SUBJECT, "other", "x", object_sha256="nothex", registry=url)
-
-
-def test_find_passes_the_filters(url):
-    res = client.find(url, capability="code-review", q="N", alias_type="domain", level="L1")
-    assert res["entities"][0]["eid"] == SUBJECT
-    assert Stub.log[-1][1] == "/v1/entities?capability=code-review&q=N&alias_type=domain&level=L1"
-
-
-def test_present_carries_only_current_attestations(url):
-    issuer = core.KeyPair()
-    att = lambda exp: core.sign_object({"spec": core.SPEC, "type": "Attestation", "issuer": issuer.did, "subject": KP.did,
-                                        "claim_type": "trust_tier", "claim": {"tier": 2, "platform": "x"}, "created": core.now(), "expires": exp}, issuer)
-    live = att("2099-01-01T00:00:00Z")
-    Stub.attestations = [{"attestation": live, "expired": False, "revoked_at": None, "inherited_from": None},
-                         {"attestation": att("2020-01-01T00:00:00Z"), "expired": True, "revoked_at": None, "inherited_from": None},
-                         {"attestation": att("2099-01-01T00:00:00Z"), "expired": False, "revoked_at": "2026-10-01T00:00:00Z", "inherited_from": None}]
-    nonce = core.nonce()
-    p = client.present(SEED, "https://v.example", nonce, registry=url)
-    assert p["attestations"] == [live] and core.verify_presentation(p, "https://v.example", nonce)["ok"]
-    bare = client.present(SEED, "https://v.example", nonce)  # no registry: no attestations
-    assert "attestations" not in bare and core.verify_presentation(bare, "https://v.example", nonce)["ok"]
-
-
-def test_cli_subcommands(url, tmp_path, monkeypatch, capsys):
-    monkeypatch.setenv("OPENENTITY_HOME", str(tmp_path))
-    keys = tmp_path / "keys"
-    keys.mkdir()
-    (keys / "k.json").write_text(json.dumps({"did": KP.did, "seed_hex": SEED.hex()}))
-    reg = ["--registry", url]
-    assert cli.main(["record", "arc_opened", "--payload", '{"arc_id":"a","title":"A"}', *reg]) == 0
-    assert [e["kind"] for e in Stub.chain] == ["arc_opened"]
-    assert cli.main(["dispute", "--subject", SUBJECT, "--reason", "other", "--statement", "x", *reg]) == 0
-    assert cli.main(["dispute", "--subject", SUBJECT, "--reason", "spite", "--statement", "x", *reg]) == 1
-    capsys.readouterr()
-    assert cli.main(["find", "--capability", "code-review", *reg]) == 0
-    assert SUBJECT in capsys.readouterr().out
-    assert cli.main(["present", "--audience", "https://v.example", "--nonce", "n1", *reg]) == 0
-    assert json.loads(capsys.readouterr().out)["type"] == "Presentation"
-    assert cli.main(["withdraw", *reg]) == 2  # needs --force, nothing sent
-    assert posts("/v1/withdraw") == []
-    assert cli.main(["withdraw", "--force", *reg]) == 0 and len(posts("/v1/withdraw")) == 1
-    (keys / "k2.json").write_text(json.dumps({"did": core.KeyPair().did, "seed_hex": "11" * 32}))
-    assert cli.main(["withdraw", "--force", *reg]) == 1  # two keys, no --eid: ambiguous
-    assert cli.main(["withdraw", "--force", "--eid", KP.did, *reg]) == 0