pebra 0.1.0__tar.gz

pebra-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,88 @@
+# Contributing To PEBRA
+
+PEBRA accepts focused contributions that preserve its deterministic decision core, explicit trust
+boundaries, and testable CLI behavior.
+
+## Contribution Terms
+
+PEBRA accepts contributions under the Apache License 2.0, without additional terms or conditions.
+Alternative terms require prior written agreement from a project maintainer. By submitting a
+contribution, you confirm that you have the **right to submit** it under the accepted terms.
+
+Apache License 2.0 permits commercial use, modification, and redistribution subject to its terms.
+Do not submit code, data, generated artifacts, or other material that you do not have the right to
+license. Identify copied or adapted third-party material and preserve its required notices.
+
+## Development Setup
+
+Use Python 3.11 or newer. A minimal Windows setup is:
+
+```powershell
+python -m venv .venv
+.\.venv\Scripts\python.exe -m pip install --upgrade pip
+.\.venv\Scripts\python.exe -m pip install -e .
+.\.venv\Scripts\python.exe -m pip install pytest pytest-cov hypothesis syrupy jsonschema ruff import-linter nox textual-dev pytest-textual-snapshot==1.1.0
+```
+
+Use the equivalent activation and executable paths on macOS or Linux.
+
+Run `nox -s tests lint e2e-fast` for the normal source checkout. Before release, run
+`nox -s dev-package` to build and verify the tracked source as a clean wheel and source distribution;
+use `nox -s dev-package -- --open` to open the installed wheel's dashboard.
+
+### Developing the Observatory TUI
+
+`pebra tui` is a Textual surface. To iterate with the Textual devtools, run the console in one terminal
+and the app in another:
+
+```powershell
+.\.venv\Scripts\textual.exe console
+.\.venv\Scripts\textual.exe run --dev -c "pebra tui --read-only --db path\to\pebra.db --repo-id <id>"
+```
+
+The `--dev` run hot-reloads `pebra/tui/theme.tcss`, and `self.log(...)` output routes to the console
+instead of corrupting the TUI. TUI diagnostics log identifiers, counts, timing, and error categories
+only — never source, tokens, candidate payloads, or sanction data (the TUI never handles those). After a
+deliberate visual change, regenerate the SVG baselines with
+`.\.venv\Scripts\python.exe -m pytest tests\snapshots --snapshot-update` and review them before
+committing.
+
+## Engineering Rules
+
+- Keep `pebra.core` deterministic and standard-library-only.
+- Respect the established core, application, port, adapter, composition, CLI, dashboard, and E2E
+  boundaries. Import contracts enforce these relationships.
+- Exercise production behavior through real public surfaces where an end-to-end test is intended.
+- Do not weaken fail-closed behavior, candidate hash binding, approval binding, or audit-chain
+  integrity to make a test pass.
+- Keep changes focused. Avoid unrelated refactors and generated metadata churn.
+- Add a regression test for every bug fix and focused coverage for new behavior.
+
+## Validation
+
+Run the smallest relevant tests while developing, then the repository checks before requesting
+review:
+
+```powershell
+.\.venv\Scripts\python.exe -m pytest -q
+.\.venv\Scripts\ruff.exe check .
+.\.venv\Scripts\lint-imports.exe
+.\.venv\Scripts\python.exe -m pytest e2e\test_boundary_discipline.py -q
+```
+
+Some external-engine, browser, and paid-model lanes are gated. State clearly which gated checks were
+not run and why; never report them as passing without evidence.
+
+## Pull Requests
+
+- Explain the user-visible or architectural problem and why the change is scoped correctly.
+- Include verification commands and results.
+- Call out behavior changes, trust-boundary changes, migration needs, and deferred work.
+- Keep commits reviewable and do not include local databases, credentials, paid-run artifacts, or
+  unrelated experiment output.
+- Address review findings with tests when the finding describes a reproducible failure mode.
+
+## Security Reports
+
+Follow [SECURITY.md](SECURITY.md) for suspected vulnerabilities. **Do not open a public issue** for an
+undisclosed security problem.

pebra-0.1.0/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

pebra-0.1.0/MANIFEST.in

@@ -0,0 +1,10 @@
+include LICENSE
+include SECURITY.md
+include CONTRIBUTING.md
+include RELEASING.md
+include requirements-release.in
+include requirements-release.txt
+include README.md
+recursive-include pebra/dashboard/templates *.html
+recursive-include pebra/dashboard/static *.js *.css *.txt
+recursive-include pebra/tui *.tcss

pebra-0.1.0/PKG-INFO

@@ -0,0 +1,242 @@
+Metadata-Version: 2.4
+Name: pebra
+Version: 0.1.0
+Summary: Pre-Edit Benefit-Risk Assessment for coding agents — a deterministic, hexagonal decision controller.
+Author: PEBRA contributors
+License-Expression: Apache-2.0 AND MIT
+Project-URL: Homepage, https://github.com/Rajioba1/pebra
+Project-URL: Repository, https://github.com/Rajioba1/pebra
+Project-URL: Issues, https://github.com/Rajioba1/pebra/issues
+Project-URL: Releases, https://github.com/Rajioba1/pebra/releases
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: pebra/dashboard/static/vendor/uplot.LICENSE.txt
+Requires-Dist: numpy
+Requires-Dist: scikit-learn>=1.2
+Requires-Dist: cryptography
+Requires-Dist: mapie
+Requires-Dist: bandit
+Requires-Dist: pyyaml
+Requires-Dist: fastapi
+Requires-Dist: starlette
+Requires-Dist: uvicorn
+Requires-Dist: jinja2
+Requires-Dist: mcp<2,>=1.0
+Requires-Dist: textual<9,>=8.2
+Provides-Extra: bench
+Requires-Dist: pandas; extra == "bench"
+Requires-Dist: scipy; extra == "bench"
+Requires-Dist: matplotlib; extra == "bench"
+Requires-Dist: seaborn; extra == "bench"
+Provides-Extra: bench-szz
+Requires-Dist: pydriller; extra == "bench-szz"
+Provides-Extra: bench-agent
+Requires-Dist: swebench; extra == "bench-agent"
+Provides-Extra: bench-external
+Requires-Dist: datasets; extra == "bench-external"
+Provides-Extra: ui-e2e
+Requires-Dist: playwright; extra == "ui-e2e"
+Requires-Dist: pytest-playwright; extra == "ui-e2e"
+Provides-Extra: agent-ab
+Requires-Dist: anthropic>=0.30; extra == "agent-ab"
+Dynamic: license-file
+
+# PEBRA
+
+PEBRA is a **Pre-Edit Benefit-Risk Assessment** controller for coding agents.
+
+It evaluates a proposed code edit before the agent applies it, returns a deterministic decision and
+math packet, verifies the actual post-edit diff against the approved envelope, records outcomes, and
+uses measured calibration data to promote learned facts for future assessments.
+
+## Current Capabilities
+
+- Pre-edit `assess` with expected loss, expected utility, RAU, edit confidence, and ordered gates.
+- Post-edit `verify` against the approved safe scope and required checks.
+- Candidate-bound pre-edit enforcement: an impactful host edit must produce the same normalized file
+  contents as the patch that was assessed; same repository/HEAD/path alone is not sufficient.
+- Outcome recording, shadow learning, promotion, scorecards, and learned-fact reapplication.
+- Read-only local Risk Observatory dashboard for assessment, calibration, learning, and graph state.
+- Explicit graph-engine setup and diagnostics through `pebra setup-graph` and `pebra doctor`.
+- CodeGraph-backed evidence:
+  - per-symbol fan-in;
+  - DELETE file fan-in roll-up;
+  - MODIFY graph-wide blast over callers/references/implementers/subclasses;
+  - contract-surface metadata for interface/base-class edits;
+  - containing class/namespace/module hierarchy roll-up;
+  - file metadata / parse-error confidence penalties;
+  - bounded revised-candidate refinement: cheap deterministic ranking first, then one materialized
+    before/after graph by default. Structural continuity adjusts only the exact owner-scoped risk
+    event; RAU remains authoritative. Set `PEBRA_GRAPH_REFINEMENT=0` to disable this path.
+- Benchmark harnesses for math-oracle validation and deterministic learning-loop wiring proof.
+- True CLI-boundary e2e lanes, including a gated external C# repo lane.
+
+## Install For Development
+
+```powershell
+python -m venv .venv
+.\.venv\Scripts\python.exe -m pip install --upgrade pip
+.\.venv\Scripts\python.exe -m pip install -e .
+```
+
+The graph engine is explicit, not a pip dependency:
+
+```powershell
+pebra setup-graph --fix
+pebra doctor
+```
+
+`assess` never silently installs external binaries.
+
+The **benefit signal** (multi-language complexity + maintainability index) is likewise an explicit
+external binary — [`rust-code-analysis`](https://github.com/mozilla/rust-code-analysis) (MPL-2.0),
+invoked as a subprocess. Build it from git (crates.io's release does not compile against current
+tree-sitter):
+
+```powershell
+cargo install --git https://github.com/mozilla/rust-code-analysis `
+  --rev 37e5d83c056c8cbf827223d5814a93c5218df1a9 rust-code-analysis-cli
+```
+
+Point PEBRA at it via `PEBRA_RCA_BIN` or ensure it is on `PATH`. PEBRA accepts runtime version
+`0.0.25` when Cargo install metadata identifies the pinned source revision. For a copied or packaged
+binary without Cargo metadata, set `PEBRA_RCA_SHA256` to its expected lowercase SHA-256. Live experiment
+metadata records the executable SHA-256 and refuses to resume a run with a different fingerprint.
+Cargo metadata is install provenance, not tamper-proof byte attestation. For copied binaries, shared
+machines, or any environment where local binary replacement is in scope, set `PEBRA_RCA_SHA256`; an
+explicit hash is authoritative and a mismatch disables RCA benefit evidence even when Cargo metadata
+matches.
+When absent or version-mismatched, benefit evidence fails
+safe to *projected* (no maintainability credit) — it never blocks an assessment and never affects risk.
+Supported languages: Python, JavaScript/JSX, TypeScript/TSX, Java, Rust, C/C++.
+
+## Basic Workflow
+
+```text
+assess proposed edit -> agent decides -> apply edit -> verify actual diff ->
+finalize trusted outcome -> future assess uses promoted learned snapshot
+```
+
+Example command surface:
+
+```powershell
+pebra assess request.json --json
+pebra verify --assessment-id <assessment_id> --json
+pebra record-outcome --assessment-id <assessment_id> --status completed --detail '{"actual_success": true}'
+pebra learn --assessment-id <assessment_id>
+pebra promote --repo-root <repo_root>
+# Preferred host path: one idempotent record + measure + gated-promotion operation.
+pebra finalize-outcome --trusted-outcome-file outcome.json --repo-root <repo_root> --json
+pebra scorecard --repo-root <repo_root>
+pebra dashboard --port 4500 --open
+pebra capabilities --repo-root <repo_root>
+```
+
+`outcome.json` contains `assessment_id`, terminal `status`, and an optional `detail` object. The
+`finalize-outcome` command is host-only: MCP outcome reports are retained for lifecycle telemetry but
+their self-reported learning labels are censored. The legacy three-command sequence remains available
+for diagnosis and manual operation.
+
+## Agent Enforcement
+
+Install the repository protocol for either host. Add `--with-hook` when you want pre-edit interception,
+not only instructions:
+
+```powershell
+pebra agent-init --target claude --repo-root . --with-hook
+pebra agent-init --target codex --repo-root . --with-hook
+pebra capabilities --repo-root .
+```
+
+The guarantees are deliberately different:
+
+| Host surface | Reported mode | Guarantee |
+|---|---|---|
+| Claude Code PreToolUse hook | `configured_enforcing` | Exact enabled hook config, matching gate capability handshake, graph, and Git HEAD were observed. Candidate-bound checks deny or ask before supported structured edits; this does not prove the host invoked every event. |
+| Codex repo-local hook | `best_effort` | Candidate-bound gate logic is installed, but repo-local hook loading remains host-dependent. |
+| MCP tools | `advisory_only` | Assess/verify tools are available, but MCP alone does not intercept another host's writes. |
+
+If graph or Git HEAD evidence is unavailable, an installed gate remains fail-open by policy and
+`capabilities` reports `degraded_fail_open`. The Claude hook also emits the degradation warning as a
+non-blocking system message. Repository-local and user-level `disableAllHooks` settings also degrade
+the reported posture. This is observable configuration, not proof that a host or managed policy invoked
+every event.
+
+`trusted_actor_required` is a protocol boundary, not OS-level identity authentication. PEBRA does
+not expose risk acceptance through MCP, and interactive acceptance requires a terminal. A process
+with arbitrary shell access under the same OS account can still invoke local trusted-host surfaces
+or simulate a terminal. Use a separately privileged host or operator account when resistance to an
+adversarial agent is required.
+
+For a candidate that changes multiple files, enforcement requires one complete `apply_patch` event containing
+the complete assessed candidate. Structured single-file edits must be assessed as separate single-file
+candidates; one file cannot reuse approval for part of a multi-file candidate.
+
+The dashboard is read-only. On a loopback bind (`localhost`, `127.0.0.1`, `::1`) the default is
+token-free for local convenience; `--auth token` forces a bearer token when you want the old locked
+path. Any non-loopback bind requires a token.
+
+```powershell
+# normal local browser UX
+pebra dashboard --port 4500 --open
+
+# venv-safe form if the `pebra` console script is not on PATH yet
+python -m pebra dashboard --port 4500 --open
+
+# force bearer auth even on loopback
+pebra dashboard --port 4500 --auth token
+
+# expose beyond loopback only with a token
+pebra dashboard --host 0.0.0.0 --port 4500 --auth token
+```
+
+It exposes five browser views: overview, score history, calibration, learned facts, and CodeGraph
+hotspots. Graph views are fail-soft when no trusted graph index is bound to the launched repo, and
+graph routes are repo-scoped to avoid replaying one repo's graph under another repo id.
+
+## Validation
+
+```powershell
+.\.venv\Scripts\nox.exe -s tests lint e2e-fast
+```
+
+Dashboard/e2e lanes:
+
+```powershell
+.\.venv\Scripts\python.exe -m pytest tests/integration/test_dashboard_server.py tests/integration/test_dashboard_cli.py -q
+.\.venv\Scripts\python.exe -m pytest e2e/features/dashboard/test_dashboard_metrics_visual.py -q
+.\.venv\Scripts\nox.exe -s e2e-learning
+.\.venv\Scripts\nox.exe -s e2e-ui
+```
+
+External real-repo graph lane:
+
+```powershell
+$env:E2E_EXTERNAL='1'
+$env:E2E_TEMPLATE_BLUEPRINT_REPO='C:\Users\RajLord_new\Desktop\avalonia_template'
+.\.venv\Scripts\nox.exe -s e2e-external
+```
+
+Benchmark lanes:
+
+```powershell
+.\.venv\Scripts\nox.exe -s bench-math
+.\.venv\Scripts\nox.exe -s bench-flow
+```
+
+## More Docs
+
+- [Contributing and development setup](CONTRIBUTING.md)
+- [True e2e suite](e2e/README.md)
+- [Benchmarks](benchmarks/README.md)
+- [Learning-loop wiring benchmark](benchmarks/flow/wiring/README.md)