pgc-assembler 3.0.0__tar.gz → 4.0.0__tar.gz

{pgc_assembler-3.0.0/pgc_assembler.egg-info → pgc_assembler-4.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pgc-assembler
-Version: 3.0.0
+Version: 4.0.0
 Summary: PGC snapshot assembler — composes compiled projections into a manifest-pinned executable snapshot (import package: assembler)
 Author-email: Bhash Ganti <bachipeachy@gmail.com>
 License-Expression: Apache-2.0
@@ -132,8 +132,18 @@ export PGC_PLATFORM_ROOT=$PWD/software_governance
 pgc            # reports what is installed and whether the anchor resolves
 ```
 
-`PGC_BUILD_ROOT` (compiled output, keeping the governance repo read-only) and `PGC_DOMAIN_ROOTS`
-(additional domains contributing their own `registry/structures`) are optional.
+`PGC_DOMAIN_ROOTS` names an additional domain contributing its own `registry/structures` — the
+directory that *directly contains* it, not the repository above it; pointing one level too high is a
+silent no-op. `PGC_SNAPSHOT_ROOT` is where compiled output is written, and each domain build needs
+its own: every layer's output consolidates into one root, and verification rejects any file in that
+root the current build did not declare. `PGC_SNAPSHOT_PROFILES` is the directory holding snapshot
+profiles, required by the assembler and the runtime alike.
+
+`PGC_BUILD_ROOT` is accepted and reported and **nothing reads it** — `PGC_SNAPSHOT_ROOT` is the
+anchor that controls output.
+
+The full sequence, with the repositories it needs, is in
+[`pgc_install`](https://github.com/protocol-governed-computing/pgc_install).
 
 **Versioning.** Two schemes, and the published version follows the second.
 
@@ -143,7 +153,7 @@ pgc            # reports what is installed and whether the anchor resolves
   cycle is tagged `release-<N>`. This is not published.
 - **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v3`**.
 
-**The published version is the public one: `v3` is `3.0.0`.** The standard the packages implement is a
+**The published version is the public one: `v4` is `4.0.0`.** The standard the packages implement is a
 separate artifact on its own track and is not this number.
 
 The standard these packages implement is published separately: https://doi.org/10.5281/zenodo.22150616

{pgc_assembler-3.0.0 → pgc_assembler-4.0.0}/README.md

@@ -107,8 +107,18 @@ export PGC_PLATFORM_ROOT=$PWD/software_governance
 pgc            # reports what is installed and whether the anchor resolves
 ```
 
-`PGC_BUILD_ROOT` (compiled output, keeping the governance repo read-only) and `PGC_DOMAIN_ROOTS`
-(additional domains contributing their own `registry/structures`) are optional.
+`PGC_DOMAIN_ROOTS` names an additional domain contributing its own `registry/structures` — the
+directory that *directly contains* it, not the repository above it; pointing one level too high is a
+silent no-op. `PGC_SNAPSHOT_ROOT` is where compiled output is written, and each domain build needs
+its own: every layer's output consolidates into one root, and verification rejects any file in that
+root the current build did not declare. `PGC_SNAPSHOT_PROFILES` is the directory holding snapshot
+profiles, required by the assembler and the runtime alike.
+
+`PGC_BUILD_ROOT` is accepted and reported and **nothing reads it** — `PGC_SNAPSHOT_ROOT` is the
+anchor that controls output.
+
+The full sequence, with the repositories it needs, is in
+[`pgc_install`](https://github.com/protocol-governed-computing/pgc_install).
 
 **Versioning.** Two schemes, and the published version follows the second.
 
@@ -118,7 +128,7 @@ pgc            # reports what is installed and whether the anchor resolves
   cycle is tagged `release-<N>`. This is not published.
 - **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v3`**.
 
-**The published version is the public one: `v3` is `3.0.0`.** The standard the packages implement is a
+**The published version is the public one: `v4` is `4.0.0`.** The standard the packages implement is a
 separate artifact on its own track and is not this number.
 
 The standard these packages implement is published separately: https://doi.org/10.5281/zenodo.22150616

pgc_assembler-4.0.0/VERSION

@@ -0,0 +1 @@
+16

pgc_assembler-4.0.0/assembler/VERSION

@@ -0,0 +1 @@
+16

{pgc_assembler-3.0.0 → pgc_assembler-4.0.0}/assembler/__init__.py

@@ -1,6 +1,6 @@
 """PGC Snapshot Assembler — composes compiled projections into a manifest-pinned snapshot.
 
-Contract: snapshot_assembler/doc/SNAPSHOT_ASSEMBLY_CONTRACT.md
+Contract: snapshot_assembler/CONTRACT.md
 """
 
 from pathlib import Path

{pgc_assembler-3.0.0 → pgc_assembler-4.0.0}/assembler/core.py

@@ -4,7 +4,7 @@ core.py — PGC snapshot assembly.
 Composes each domain's compiled projections (from the protocol compiler) into one
 executable snapshot + a content-derived, manifest-pinned identity.
 
-Contract: snapshot_assembler/doc/SNAPSHOT_ASSEMBLY_CONTRACT.md
+Contract: snapshot_assembler/CONTRACT.md
 
 Invariants enforced here:
   * The assembler INVENTS no per-domain identity — every hash is lifted verbatim from
@@ -358,12 +358,6 @@ def verify_profile(out_root: Path, profile: str) -> list[str]:
     return unmet
 
 
-def compute_composite_hash(domains: list[dict]) -> str:
-    """sha256 over canonical-JSON of the identity view. Deterministic; timestamp-free."""
-    canonical = json.dumps(_identity_view(domains), sort_keys=True, separators=(",", ":"))
-    return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
-
-
 # ---------------------------------------------------------------------------
 # Cross-domain FQDN uniqueness (per-domain vocabularies are independent address namespaces)
 # ---------------------------------------------------------------------------
@@ -755,6 +749,17 @@ def verify_snapshot(out_root: Path) -> dict[str, Any]:
             f"{str(borne)[:16]}… (3b §7 clause 2, SN-2)."
         )
 
+    # The manifest states its identity twice. Both statements are the claim, so both are evaluated:
+    # checking one and not the other let a manifest carry two contradictory identities and be
+    # accepted — measured, not hypothesised. A self-description that disagrees with itself is not a
+    # self-description.
+    borne_composite = manifest.get("composite_hash")
+    if borne_composite != derived:
+        raise AssemblyError(
+            f"identity failure: derived {derived[:16]}… from content, snapshot's composite_hash "
+            f"bears {str(borne_composite)[:16]}… (3b §7 clause 2, SN-2)."
+        )
+
     # Copies of one identity across domains must agree (GC-12) — a composition obligation rather
     # than correspondence, and not subsumed by the four conditions above.
     _verify_copies_agree(out_root)

{pgc_assembler-3.0.0 → pgc_assembler-4.0.0}/assembler/indexes.py

@@ -35,8 +35,36 @@ SCHEMA_VERSION = "v0"
 # Shared readers over the consolidated snapshot
 # ---------------------------------------------------------------------------
 
+def _authoring_rank(doc: dict) -> int:
+    """How authoritative a canonical copy is for its identity. Higher wins.
+
+    One identity can be published by more than one domain. A domain that CONSUMES a platform
+    capability carries it as an execution binding — the compiler lifts the compiled node so the
+    capability is executable there, and the authoring stays platform-owned. Both copies are
+    canonical and both are legitimate; they are not interchangeable.
+
+    The binding copy is the authoring copy with the authored parts removed: `content_hash`,
+    `frontmatter` and the IR are identical, while `content` and `references` are empty and
+    `layer_code` names the consuming layer. So the copy that still carries authored content is the
+    authoring copy, and it is the one an identity must resolve to — `si.artifact.show` promises "the
+    published canonical artifact for an FQDN, as authored".
+
+    A binding copy also carries the `content_hash` of content it does not hold, which is the sharper
+    tell but not one to select on: a hash mismatch is a defect to report, not a discriminator.
+    """
+    return 1 if (doc.get("content") or "").strip() else 0
+
+
 def _load_canonical(out_root: Path) -> dict[str, dict]:
-    """fqdn → canonical artifact doc, across all domains (canonical/<domain>/<type>/*.json)."""
+    """fqdn → canonical artifact doc, across all domains (canonical/<domain>/<type>/*.json).
+
+    Where an identity is published more than once, the authoring copy wins (`_authoring_rank`).
+    Selecting by iteration order would resolve an identity by the alphabetical accident of its
+    consumer's domain name: `canonical/platform/` sorts before `canonical/workload/` and after
+    `canonical/blockchain/`, so last-write-wins returned the authoring copy for consumers named
+    early and the binding copy for consumers named late. Renaming a domain would then change what
+    an identity resolves to.
+    """
     canon = out_root / "canonical"
     docs: dict[str, dict] = {}
     if not canon.is_dir():
@@ -46,8 +74,12 @@ def _load_canonical(out_root: Path) -> dict[str, dict]:
             continue
         raw = json.loads(f.read_text(encoding="utf-8"))
         fqdn = raw.get("fqdn_id")
-        if fqdn and "::" in fqdn:
-            raw["_canonical_path"] = f.relative_to(out_root).as_posix()
+        if not fqdn or "::" not in fqdn:
+            continue
+        raw["_canonical_path"] = f.relative_to(out_root).as_posix()
+        held = docs.get(fqdn)
+        # Ties keep the first seen, so a sorted walk stays the tiebreak and the result is stable.
+        if held is None or _authoring_rank(raw) > _authoring_rank(held):
             docs[fqdn] = raw
     return docs
 

{pgc_assembler-3.0.0 → pgc_assembler-4.0.0/pgc_assembler.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pgc-assembler
-Version: 3.0.0
+Version: 4.0.0
 Summary: PGC snapshot assembler — composes compiled projections into a manifest-pinned executable snapshot (import package: assembler)
 Author-email: Bhash Ganti <bachipeachy@gmail.com>
 License-Expression: Apache-2.0
@@ -132,8 +132,18 @@ export PGC_PLATFORM_ROOT=$PWD/software_governance
 pgc            # reports what is installed and whether the anchor resolves
 ```
 
-`PGC_BUILD_ROOT` (compiled output, keeping the governance repo read-only) and `PGC_DOMAIN_ROOTS`
-(additional domains contributing their own `registry/structures`) are optional.
+`PGC_DOMAIN_ROOTS` names an additional domain contributing its own `registry/structures` — the
+directory that *directly contains* it, not the repository above it; pointing one level too high is a
+silent no-op. `PGC_SNAPSHOT_ROOT` is where compiled output is written, and each domain build needs
+its own: every layer's output consolidates into one root, and verification rejects any file in that
+root the current build did not declare. `PGC_SNAPSHOT_PROFILES` is the directory holding snapshot
+profiles, required by the assembler and the runtime alike.
+
+`PGC_BUILD_ROOT` is accepted and reported and **nothing reads it** — `PGC_SNAPSHOT_ROOT` is the
+anchor that controls output.
+
+The full sequence, with the repositories it needs, is in
+[`pgc_install`](https://github.com/protocol-governed-computing/pgc_install).
 
 **Versioning.** Two schemes, and the published version follows the second.
 
@@ -143,7 +153,7 @@ pgc            # reports what is installed and whether the anchor resolves
   cycle is tagged `release-<N>`. This is not published.
 - **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v3`**.
 
-**The published version is the public one: `v3` is `3.0.0`.** The standard the packages implement is a
+**The published version is the public one: `v4` is `4.0.0`.** The standard the packages implement is a
 separate artifact on its own track and is not this number.
 
 The standard these packages implement is published separately: https://doi.org/10.5281/zenodo.22150616

{pgc_assembler-3.0.0 → pgc_assembler-4.0.0}/pyproject.toml

@@ -5,7 +5,7 @@ backend-path = ["."]
 
 [project]
 name = "pgc-assembler"
-version = "3.0.0"
+version = "4.0.0"
 description = "PGC snapshot assembler — composes compiled projections into a manifest-pinned executable snapshot (import package: assembler)"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -46,5 +46,6 @@ where = ["."]
 include = ["assembler*"]
 
 [tool.setuptools.package-data]
-# VERSION has no extension, so it must be named explicitly.
-"*" = ["*.md", "*.yaml", "*.json", "VERSION"]
+# VERSION has no extension, so it must be named explicitly. Scoped to the package
+# rather than "*" — see the note in protocol_compiler.
+"assembler" = ["VERSION"]

pgc_assembler-3.0.0/VERSION

@@ -1 +0,0 @@
-15

pgc_assembler-3.0.0/assembler/VERSION

@@ -1 +0,0 @@
-15