pgc-assembler 2.0.0__tar.gz

pgc_assembler-2.0.0/LICENSE

@@ -0,0 +1,67 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+Copyright 2026 Bhash Ganti aka Bachi
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
+------------------------
+FULL LICENSE TEXT BELOW
+------------------------
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+   "Licensor" shall mean the copyright owner.
+   "Legal Entity" shall mean the union of the acting entity and all other
+   entities that control, are controlled by, or are under common control.
+   "You" shall mean an individual or Legal Entity exercising permissions.
+   "Source" form shall mean the preferred form for making modifications.
+   "Object" form shall mean any form resulting from mechanical transformation.
+   "Work" shall mean the work of authorship.
+   "Derivative Works" shall mean any work based on the Work.
+   "Contribution" shall mean any work intentionally submitted.
+   "Contributor" shall mean Licensor and any individual submitting Contributions.
+
+2. Grant of Copyright License.
+   Each Contributor grants You a perpetual, worldwide, non-exclusive,
+   no-charge, royalty-free copyright license.
+
+3. Grant of Patent License.
+   Each Contributor grants a patent license to make, use, sell, etc.
+
+4. Redistribution.
+   You may reproduce and distribute copies provided that:
+   - You include a copy of this License
+   - You retain notices
+   - You state modifications
+   - You include NOTICE file if present
+
+5. Submission of Contributions.
+   Contributions are under this License unless stated otherwise.
+
+6. Trademarks.
+   This License does not grant trademark rights.
+
+7. Disclaimer of Warranty.
+   Provided "AS IS", without warranties.
+
+8. Limitation of Liability.
+   No liability for damages.
+
+9. Accepting Warranty or Additional Liability.
+   You may offer support/warranty on your own behalf only.

pgc_assembler-2.0.0/MANIFEST.in

@@ -0,0 +1,15 @@
+# The in-tree build backend and the file it stages.
+#
+# `pyproject.toml` sets build-backend = "_build_hook" with backend-path = ["."],
+# so the hook must travel in the sdist: `python -m build` builds the wheel FROM
+# the sdist, in an isolated directory where anything not shipped does not exist.
+# Without these two lines the sdist builds and the wheel step then fails with
+# `Backend '_build_hook' is not available`.
+#
+# VERSION is the repo-root composition ordinal the hook copies into the package.
+# Omitting it does not fail the build — `_stage_ordinal` skips a missing file —
+# it produces a wheel whose ordinal is silently absent.
+include _build_hook.py
+include VERSION
+
+global-exclude __pycache__ *.pyc .DS_Store

pgc_assembler-2.0.0/NOTICE

@@ -0,0 +1,11 @@
+PGS — Protocol-Governed Systems
+Copyright 2026 Bhash Ganti aka Bachi
+
+This project introduces a protocol-first execution model in which:
+
+- Behavior is declared in protocol artifacts
+- Execution is performed by a deterministic runtime
+- Capability implementations are bound at compile time
+- Governance is enforced through invariants and assertions
+
+Extensibility is achieved by declaration, not refactor.

pgc_assembler-2.0.0/PKG-INFO

@@ -0,0 +1,148 @@
+Metadata-Version: 2.4
+Name: pgc-assembler
+Version: 2.0.0
+Summary: PGC snapshot assembler — composes compiled projections into a manifest-pinned executable snapshot (import package: assembler)
+Author-email: Bhash Ganti <bachipeachy@gmail.com>
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://omnibachi.org/
+Project-URL: Repository, https://github.com/protocol-governed-computing/snapshot_assembler
+Project-URL: Standard, https://doi.org/10.5281/zenodo.22150616
+Keywords: protocol-governed-computing,pgc,snapshot,assembler,manifest
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Dynamic: license-file
+
+# snapshot_assembler
+
+**Protocol-Governed Computing — snapshot assembler** (import package: `assembler`).
+
+Composes each domain's compiled projections (from the protocol compiler) into one **executable
+snapshot** with a content-derived, **manifest-pinned identity**. The runtime consumes only the
+assembled snapshot — never an individual repo's compiled layout.
+
+> The assembly contract — what a compiled projection must look like for the assembler to
+> accept it — is governed by the standard, not by this repository.
+
+```
+repos → protocol_compiler → each repo's compiled/ projections
+        → snapshot_assembler → protocol-governed-computing/snapshot/ → runtime warm reboot
+```
+
+The platform is an ordinary member of the composition — no singleton branch. The composition
+currently assembles **seven domains**: `platform`, `workload`, `inspection`, `transformation`,
+and the business domains `ai_governance`, `blockchain` and `book_library_mgmt`.
+
+## Install
+
+```bash
+pip install pgc-assembler
+```
+
+Once installed:
+
+```bash
+snapshot_assembler --help
+```
+
+## Use
+
+```bash
+# assemble sibling platform compiled/ -> sibling snapshot/
+./assemble.sh
+
+# explicit / multi-source (future domains)
+./assemble.sh --source /abs/software_governance/snapshot/compiled --out /abs/protocol-governed-computing/snapshot
+
+# module form
+PYTHONPATH=. python -m assembler.cli assemble --source <compiled_root> --out <snapshot_dir>
+PYTHONPATH=. python -m assembler.cli verify  --out <snapshot_dir>
+```
+
+## Product
+
+```
+protocol-governed-computing/snapshot/
+  manifest.json         # COMMITTED — the identity + root of trust
+  tokenized/<domain>/   # regenerated build product (gitignored)
+  trust/<domain>/       # regenerated build product (gitignored)
+  vocabulary/<domain>/  # regenerated build product (gitignored)
+```
+
+- **`manifest.json` is the committed identity record.** The assembled projections are regenerated
+  build products whose contents MUST match the manifest during warm reboot.
+- **`composite_hash`** is content-derived over the identity view of `domains[]` (per-domain
+  projection/attestation/graph hashes). Provenance and timestamps are excluded → same inputs +
+  same compiler + same assembler ⇒ same identity.
+
+## Composition conformance
+
+Assembly does not end at the manifest. **Composition Conformance** is the lifecycle phase after it:
+rules that can only be asked of the whole — the ones a single domain build contains no evidence for.
+It runs on every assemble and its result is written to `conformance/composition.json`, so a snapshot
+carries the record of having been judged as a composition rather than as a pile of domains.
+
+## Scope
+
+- **Copy and pin:** each domain's projections are copied, hashes are lifted from compiler output, the
+  manifest is written, and round-trip `verify` runs after every `assemble`.
+- **Vocabulary address-space reconciliation** remains the deferred real job. Collision detection is
+  enforced today; composing the reconciled forward/reverse maps across domains is not yet done, and
+  the composition has grown past the one-domain case that made it postponable.
+
+## License
+
+Apache-2.0.
+
+---
+
+## The package family
+
+| Package | Repository | Role |
+|---|---|---|
+| `pgc-compiler` | `protocol_compiler` | declarations → compiled projections |
+| `pgc-assembler` | `snapshot_assembler` | projections → sealed snapshot |
+| `pgc-runtime` | `protocol_runtime` | snapshot → governed execution |
+| `pgc-inspector` | `snapshot_inspector` | snapshot → read-only inspection |
+| `pgc-transformation` | `transformation` | change request → protocol artifacts |
+| `pgc-governance` | `software_governance` | the governance surface and its capability implementations |
+| `pgc-workloads` | `conformance_workloads` | the workloads that make conformance observable |
+| `pgc-domains` | `business_domains` | the business domain implementations the composed snapshot binds |
+
+`pip install pgc` brings in the whole family.
+
+**Installing the toolchain is one of two steps.** The compiler resolves the governance surface from
+`PGC_PLATFORM_ROOT` — fail-hard, cwd-independent, zero inference — so the *declarations* come from a
+repository you point at, never from a wheel. A registry inside a package would be a second governance
+surface competing with the repository's, and a build could then be governed by a stale copy.
+
+```bash
+git clone https://github.com/protocol-governed-computing/software_governance
+export PGC_PLATFORM_ROOT=$PWD/software_governance
+pgc            # reports what is installed and whether the anchor resolves
+```
+
+`PGC_BUILD_ROOT` (compiled output, keeping the governance repo read-only) and `PGC_DOMAIN_ROOTS`
+(additional domains contributing their own `registry/structures`) are optional.
+
+**Versioning.** Two schemes, and the published version follows the second.
+
+- **Internal** — each repository's `VERSION` file, a monotonic composition ordinal. PGC versions the
+  composition rather than each repo: they release together and the governance closure forces lockstep,
+  so the ordinal names which composition a repo belongs to. Development happens on `dev/<N>` and each
+  cycle is tagged `release-<N>`. This is not published.
+- **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v2`**.
+
+**The published version is the public one: `v2` is `2.0.0`.** The standard the packages implement is a
+separate artifact on its own track and is not this number.
+
+The standard these packages implement is published separately: https://doi.org/10.5281/zenodo.22150616

pgc_assembler-2.0.0/README.md

@@ -0,0 +1,124 @@
+# snapshot_assembler
+
+**Protocol-Governed Computing — snapshot assembler** (import package: `assembler`).
+
+Composes each domain's compiled projections (from the protocol compiler) into one **executable
+snapshot** with a content-derived, **manifest-pinned identity**. The runtime consumes only the
+assembled snapshot — never an individual repo's compiled layout.
+
+> The assembly contract — what a compiled projection must look like for the assembler to
+> accept it — is governed by the standard, not by this repository.
+
+```
+repos → protocol_compiler → each repo's compiled/ projections
+        → snapshot_assembler → protocol-governed-computing/snapshot/ → runtime warm reboot
+```
+
+The platform is an ordinary member of the composition — no singleton branch. The composition
+currently assembles **seven domains**: `platform`, `workload`, `inspection`, `transformation`,
+and the business domains `ai_governance`, `blockchain` and `book_library_mgmt`.
+
+## Install
+
+```bash
+pip install pgc-assembler
+```
+
+Once installed:
+
+```bash
+snapshot_assembler --help
+```
+
+## Use
+
+```bash
+# assemble sibling platform compiled/ -> sibling snapshot/
+./assemble.sh
+
+# explicit / multi-source (future domains)
+./assemble.sh --source /abs/software_governance/snapshot/compiled --out /abs/protocol-governed-computing/snapshot
+
+# module form
+PYTHONPATH=. python -m assembler.cli assemble --source <compiled_root> --out <snapshot_dir>
+PYTHONPATH=. python -m assembler.cli verify  --out <snapshot_dir>
+```
+
+## Product
+
+```
+protocol-governed-computing/snapshot/
+  manifest.json         # COMMITTED — the identity + root of trust
+  tokenized/<domain>/   # regenerated build product (gitignored)
+  trust/<domain>/       # regenerated build product (gitignored)
+  vocabulary/<domain>/  # regenerated build product (gitignored)
+```
+
+- **`manifest.json` is the committed identity record.** The assembled projections are regenerated
+  build products whose contents MUST match the manifest during warm reboot.
+- **`composite_hash`** is content-derived over the identity view of `domains[]` (per-domain
+  projection/attestation/graph hashes). Provenance and timestamps are excluded → same inputs +
+  same compiler + same assembler ⇒ same identity.
+
+## Composition conformance
+
+Assembly does not end at the manifest. **Composition Conformance** is the lifecycle phase after it:
+rules that can only be asked of the whole — the ones a single domain build contains no evidence for.
+It runs on every assemble and its result is written to `conformance/composition.json`, so a snapshot
+carries the record of having been judged as a composition rather than as a pile of domains.
+
+## Scope
+
+- **Copy and pin:** each domain's projections are copied, hashes are lifted from compiler output, the
+  manifest is written, and round-trip `verify` runs after every `assemble`.
+- **Vocabulary address-space reconciliation** remains the deferred real job. Collision detection is
+  enforced today; composing the reconciled forward/reverse maps across domains is not yet done, and
+  the composition has grown past the one-domain case that made it postponable.
+
+## License
+
+Apache-2.0.
+
+---
+
+## The package family
+
+| Package | Repository | Role |
+|---|---|---|
+| `pgc-compiler` | `protocol_compiler` | declarations → compiled projections |
+| `pgc-assembler` | `snapshot_assembler` | projections → sealed snapshot |
+| `pgc-runtime` | `protocol_runtime` | snapshot → governed execution |
+| `pgc-inspector` | `snapshot_inspector` | snapshot → read-only inspection |
+| `pgc-transformation` | `transformation` | change request → protocol artifacts |
+| `pgc-governance` | `software_governance` | the governance surface and its capability implementations |
+| `pgc-workloads` | `conformance_workloads` | the workloads that make conformance observable |
+| `pgc-domains` | `business_domains` | the business domain implementations the composed snapshot binds |
+
+`pip install pgc` brings in the whole family.
+
+**Installing the toolchain is one of two steps.** The compiler resolves the governance surface from
+`PGC_PLATFORM_ROOT` — fail-hard, cwd-independent, zero inference — so the *declarations* come from a
+repository you point at, never from a wheel. A registry inside a package would be a second governance
+surface competing with the repository's, and a build could then be governed by a stale copy.
+
+```bash
+git clone https://github.com/protocol-governed-computing/software_governance
+export PGC_PLATFORM_ROOT=$PWD/software_governance
+pgc            # reports what is installed and whether the anchor resolves
+```
+
+`PGC_BUILD_ROOT` (compiled output, keeping the governance repo read-only) and `PGC_DOMAIN_ROOTS`
+(additional domains contributing their own `registry/structures`) are optional.
+
+**Versioning.** Two schemes, and the published version follows the second.
+
+- **Internal** — each repository's `VERSION` file, a monotonic composition ordinal. PGC versions the
+  composition rather than each repo: they release together and the governance closure forces lockstep,
+  so the ordinal names which composition a repo belongs to. Development happens on `dev/<N>` and each
+  cycle is tagged `release-<N>`. This is not published.
+- **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v2`**.
+
+**The published version is the public one: `v2` is `2.0.0`.** The standard the packages implement is a
+separate artifact on its own track and is not this number.
+
+The standard these packages implement is published separately: https://doi.org/10.5281/zenodo.22150616

pgc_assembler-2.0.0/VERSION

@@ -0,0 +1 @@
+14

pgc_assembler-2.0.0/_build_hook.py

@@ -0,0 +1,24 @@
+"""Build-time hook: stage the composition ordinal inside the package.
+
+The repo-root VERSION is the single authored declaration and `release.sh`
+enforces agreement across every repo. A wheel has no repo root, so the value is
+copied into the package during the build. The copy is a build artifact —
+gitignored, regenerated every build, never edited.
+"""
+from setuptools import build_meta as _orig
+from setuptools.build_meta import *          # noqa: F401,F403
+import pathlib
+
+def _stage_ordinal():
+    root = pathlib.Path(__file__).parent
+    src = root / "VERSION"
+    if src.is_file():
+        (root / "assembler" / "VERSION").write_text(src.read_text(encoding="utf-8"), encoding="utf-8")
+
+def build_wheel(wheel_directory, config_settings=None, metadata_directory=None):
+    _stage_ordinal()
+    return _orig.build_wheel(wheel_directory, config_settings, metadata_directory)
+
+def build_sdist(sdist_directory, config_settings=None):
+    _stage_ordinal()
+    return _orig.build_sdist(sdist_directory, config_settings)

pgc_assembler-2.0.0/assembler/VERSION

@@ -0,0 +1 @@
+14

pgc_assembler-2.0.0/assembler/__init__.py

@@ -0,0 +1,27 @@
+"""PGC Snapshot Assembler — composes compiled projections into a manifest-pinned snapshot.
+
+Contract: snapshot_assembler/doc/SNAPSHOT_ASSEMBLY_CONTRACT.md
+"""
+
+from pathlib import Path
+
+
+def _release() -> str:
+    """The composition's release ordinal, read from the repo's single version declaration.
+
+    PGC versions the *composition*, not each repo independently: all repos are released together
+    and the governance closure forces lockstep, so a monotonic integer names which composition a
+    repo belongs to. `VERSION` is the sole declaration — pyproject derives it, and so does this.
+    Never restate it as a literal; two statements of one fact is how they drift apart.
+    """
+    # Source tree and editable installs: the repo-root VERSION is authoritative.
+    declared = Path(__file__).resolve().parent.parent / "VERSION"
+    if declared.is_file():
+        return declared.read_text(encoding="utf-8").strip()
+    # Installed wheel: no repo root. The ordinal is staged into the package at
+    # build time by _build_hook.py — a build artifact, not a second declaration.
+    return (Path(__file__).resolve().parent / "VERSION").read_text(encoding="utf-8").strip()
+
+
+ASSEMBLER_VERSION = _release()   # derived from VERSION — never edited here
+MANIFEST_VERSION = "v0"

pgc_assembler-2.0.0/assembler/cli.py

@@ -0,0 +1,112 @@
+"""
+cli.py — PGC snapshot assembler CLI.
+
+    assemble   — compose compiled projections into the assembled snapshot + manifest,
+                 then run Composition Conformance over the result
+    verify     — verify an assembled snapshot against its manifest (root of trust)
+    conform    — run Composition Conformance alone against an assembled snapshot
+
+Assembly and Composition Conformance are distinct lifecycle phases, not one step: the assembler
+composes and proves identity; the conformance phase proves governance properties of the
+composition. `assemble` runs both because an unproven snapshot should never be left on disk
+looking finished — but each is separately invocable, and neither implements the other.
+
+Paths are explicit or resolved from documented sibling defaults. No cwd guessing.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+from pathlib import Path
+
+from assembler import conformance, core
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(prog="snapshot_assembler", description="PGC snapshot assembler")
+    subs = p.add_subparsers(dest="command", required=True)
+
+    a = subs.add_parser("assemble", help="Compose compiled projections into the assembled snapshot")
+    a.add_argument(
+        "--source", action="append", required=True, metavar="COMPILED_ROOT",
+        help="A compiler compiled/ root (repeatable). e.g. .../software_governance/snapshot/compiled",
+    )
+    a.add_argument(
+        "--out", required=True, metavar="SNAPSHOT_DIR",
+        help="Assembled snapshot output dir (the product). e.g. .../protocol-governed-computing/snapshot",
+    )
+    a.add_argument(
+        "--profile", default=os.environ.get("PGC_SNAPSHOT_PROFILE", ""), metavar="PROFILE_IDENTITY",
+        help="The profile identity this snapshot claims (3b SN-5). Required; a snapshot that claims "
+             "none cannot have clause 4 of 3b §7 evaluated about it.",
+    )
+
+    v = subs.add_parser("verify", help="Verify an assembled snapshot against its manifest")
+    v.add_argument("--out", required=True, metavar="SNAPSHOT_DIR", help="Assembled snapshot dir to verify")
+
+    c = subs.add_parser("conform", help="Run Composition Conformance against an assembled snapshot")
+    c.add_argument("--out", required=True, metavar="SNAPSHOT_DIR", help="Assembled snapshot dir to check")
+
+    return p
+
+
+def _fatal(msg: str) -> None:
+    print(f"[assembler] Error: {msg}", file=sys.stderr)
+    sys.exit(1)
+
+
+def main() -> None:
+    args = _build_parser().parse_args()
+
+    if args.command == "assemble":
+        source_roots = [Path(s).resolve() for s in args.source]
+        out_root = Path(args.out).resolve()
+        for s in source_roots:
+            if not s.is_dir():
+                _fatal(f"source root is not a directory: {s}")
+        try:
+            manifest = core.assemble(source_roots, out_root, args.profile)
+            core.verify_snapshot(out_root)  # round-trip self-check
+        except core.AssemblyError as exc:
+            _fatal(str(exc))
+
+        doms = [d["domain"] for d in manifest["domains"]]
+        print(f"[assembler] Assembled {len(doms)} domain(s): {', '.join(doms)}")
+        print(f"[assembler] snapshot_id: {manifest['snapshot_id']}")
+        print(f"[assembler] out:         {out_root}")
+        print(f"[assembler] manifest:    {out_root / 'manifest.json'}")
+        print("[assembler] round-trip verify: OK")
+
+        # Composition Conformance — a separate phase over the composed snapshot.
+        try:
+            ev = conformance.check_composition(out_root)
+        except conformance.ConformanceError as exc:
+            _fatal(str(exc))
+        print(f"[conformance] composition: {ev['status']} "
+              f"({ev['rules_evaluated']} rule(s) over {ev['artifacts_examined']} artifacts)")
+
+    elif args.command == "verify":
+        out_root = Path(args.out).resolve()
+        try:
+            manifest = core.verify_snapshot(out_root)
+        except core.AssemblyError as exc:
+            _fatal(str(exc))
+        print(f"[assembler] VERIFIED  snapshot_id={manifest['snapshot_id']}")
+        print(f"[assembler] domains: {json.dumps([d['domain'] for d in manifest['domains']])}")
+
+    elif args.command == "conform":
+        out_root = Path(args.out).resolve()
+        try:
+            ev = conformance.check_composition(out_root)
+        except conformance.ConformanceError as exc:
+            _fatal(str(exc))
+        print(f"[conformance] {ev['status']}  snapshot_id={ev['snapshot_id']}")
+        for f in ev["findings"]:
+            print(f"  {f['status']:<7} {f['invariant']:<58} {f['message']}")
+
+
+if __name__ == "__main__":
+    main()