pgc-assembler 5.0.0__tar.gz → 6.0.0__tar.gz

{pgc_assembler-5.0.0 → pgc_assembler-6.0.0}/NOTICE

@@ -1,4 +1,4 @@
-PGS — Protocol-Governed Systems
+PGC — Protocol-Governed Computing
 Copyright 2026 Bhash Ganti aka Bachi
 
 This project introduces a protocol-first execution model in which:

{pgc_assembler-5.0.0/pgc_assembler.egg-info → pgc_assembler-6.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pgc-assembler
-Version: 5.0.0
+Version: 6.0.0
 Summary: PGC snapshot assembler — composes compiled projections into a manifest-pinned executable snapshot (import package: assembler)
 Author-email: Bhash Ganti <bachipeachy@gmail.com>
 License-Expression: Apache-2.0
@@ -118,7 +118,7 @@ Apache-2.0.
 | `pgc-assembler` | `snapshot_assembler` | projections → sealed snapshot |
 | `pgc-runtime` | `protocol_runtime` | snapshot → governed execution |
 | `pgc-inspector` | `snapshot_inspector` | snapshot → read-only inspection |
-| `pgc-transformation` | `transformation` | change request → protocol artifacts |
+| `pgc-transformation` | `transformation_compilers` | change request → protocol artifacts |
 | `pgc-governance` | `software_governance` | the governance surface and its capability implementations |
 | `pgc-workloads` | `conformance_workloads` | the workloads that make conformance observable |
 | `pgc-domains` | `business_domains` | the business domain implementations the composed snapshot binds |
@@ -149,15 +149,16 @@ sealed against.
 The full sequence, with the repositories it needs, is in
 [`pgc_install`](https://github.com/protocol-governed-computing/pgc_install).
 
-**Versioning.** Two schemes, and the published version follows the second.
+**Versioning.** Two numbers name two different things.
 
-- **Internal** — each repository's `VERSION` file, a monotonic composition ordinal. PGC versions the
-  composition rather than each repo: they release together and the governance closure forces lockstep,
-  so the ordinal names which composition a repo belongs to. Development happens on `dev/<N>` and each
-  cycle is tagged `release-<N>`. This is not published.
-- **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v3`**.
+- **Published** — this distribution's `version` in `pyproject.toml`. It moves on its own. A release
+  that changes this repository bumps it, and a release that leaves the repository unchanged keeps it.
+- **Composition** — the public identity (`v6`, …) names one composition of the whole family.
+  `pgc_release` records which version of each distribution that composition holds, and `pgc_install`
+  pins exactly those versions.
 
-**The published version is the public one: `v4` is `4.0.0`.** The standard the packages implement is a
-separate artifact on its own track and is not this number.
+Each repository's `VERSION` file holds the workspace's cycle ordinal, which names the `dev/<N>`
+branch. It is development accounting, and it is never published. The standard the packages
+implement is a separate artifact on its own track, and none of these numbers is its revision.
 
 The standard these packages implement is published separately: https://doi.org/10.5281/zenodo.22150616

{pgc_assembler-5.0.0 → pgc_assembler-6.0.0}/README.md

@@ -91,7 +91,7 @@ Apache-2.0.
 | `pgc-assembler` | `snapshot_assembler` | projections → sealed snapshot |
 | `pgc-runtime` | `protocol_runtime` | snapshot → governed execution |
 | `pgc-inspector` | `snapshot_inspector` | snapshot → read-only inspection |
-| `pgc-transformation` | `transformation` | change request → protocol artifacts |
+| `pgc-transformation` | `transformation_compilers` | change request → protocol artifacts |
 | `pgc-governance` | `software_governance` | the governance surface and its capability implementations |
 | `pgc-workloads` | `conformance_workloads` | the workloads that make conformance observable |
 | `pgc-domains` | `business_domains` | the business domain implementations the composed snapshot binds |
@@ -122,15 +122,16 @@ sealed against.
 The full sequence, with the repositories it needs, is in
 [`pgc_install`](https://github.com/protocol-governed-computing/pgc_install).
 
-**Versioning.** Two schemes, and the published version follows the second.
+**Versioning.** Two numbers name two different things.
 
-- **Internal** — each repository's `VERSION` file, a monotonic composition ordinal. PGC versions the
-  composition rather than each repo: they release together and the governance closure forces lockstep,
-  so the ordinal names which composition a repo belongs to. Development happens on `dev/<N>` and each
-  cycle is tagged `release-<N>`. This is not published.
-- **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v3`**.
+- **Published** — this distribution's `version` in `pyproject.toml`. It moves on its own. A release
+  that changes this repository bumps it, and a release that leaves the repository unchanged keeps it.
+- **Composition** — the public identity (`v6`, …) names one composition of the whole family.
+  `pgc_release` records which version of each distribution that composition holds, and `pgc_install`
+  pins exactly those versions.
 
-**The published version is the public one: `v4` is `4.0.0`.** The standard the packages implement is a
-separate artifact on its own track and is not this number.
+Each repository's `VERSION` file holds the workspace's cycle ordinal, which names the `dev/<N>`
+branch. It is development accounting, and it is never published. The standard the packages
+implement is a separate artifact on its own track, and none of these numbers is its revision.
 
 The standard these packages implement is published separately: https://doi.org/10.5281/zenodo.22150616

pgc_assembler-6.0.0/VERSION

@@ -0,0 +1 @@
+18

pgc_assembler-6.0.0/assembler/VERSION

@@ -0,0 +1 @@
+18

{pgc_assembler-5.0.0 → pgc_assembler-6.0.0}/assembler/__init__.py

@@ -7,12 +7,11 @@ from pathlib import Path
 
 
 def _release() -> str:
-    """The composition's release ordinal, read from the repo's single version declaration.
+    """The workspace's cycle ordinal, read from the repo's `VERSION` file.
 
-    PGC versions the *composition*, not each repo independently: all repos are released together
-    and the governance closure forces lockstep, so a monotonic integer names which composition a
-    repo belongs to. `VERSION` is the sole declaration — pyproject derives it, and so does this.
-    Never restate it as a literal; two statements of one fact is how they drift apart.
+    The ordinal names the development cycle a snapshot was assembled in. It is not the published
+    version, which `pyproject.toml` declares on its own. Never restate it as a literal; two
+    statements of one fact is how they drift apart.
     """
     # Source tree and editable installs: the repo-root VERSION is authoritative.
     declared = Path(__file__).resolve().parent.parent / "VERSION"

{pgc_assembler-5.0.0 → pgc_assembler-6.0.0}/assembler/core.py

@@ -18,7 +18,9 @@ Invariants enforced here:
 from __future__ import annotations
 
 import hashlib
+import importlib.metadata
 import json
+import re
 import shutil
 import subprocess
 from dataclasses import dataclass
@@ -196,7 +198,7 @@ def _is_post_seal(rel: str) -> bool:
 
 
 # What an attestation records rather than constitutes, per
-# `cryptographic_trust::CONSTITUTION_CRYPTOGRAPHIC_TRUST_V1`. The projection binding and the value
+# `cryptographic_trust::CONSTITUTION_CRYPTOGRAPHIC_TRUST_V0`. The projection binding and the value
 # over it are enforced by the runtime at boot and constitute the composition like any other content;
 # when the signing happened records something *about* it, is read by nothing, and changes on every
 # build. Counting it made a composition's identity a function of when it was built — two compiles of
@@ -450,16 +452,37 @@ def _git_commit(repo_root: Path | None) -> str:
         return "unknown"
 
 
+def _distribution(repo_root: Path | None) -> tuple[str, str] | None:
+    """The distribution a repo publishes, as its pyproject declares it: `(name, version)`.
+
+    Read by line rather than parsed as TOML, because `tomllib` is not in every Python this package
+    supports. A repo that publishes nothing has no pyproject and records nothing.
+    """
+    if repo_root is None or not (repo_root / "pyproject.toml").is_file():
+        return None
+    text = (repo_root / "pyproject.toml").read_text(encoding="utf-8")
+    name = re.search(r'^name\s*=\s*"([^"]+)"', text, re.M)
+    version = re.search(r'^version\s*=\s*"([^"]+)"', text, re.M)
+    return (name.group(1), version.group(1)) if name and version else None
+
+
 def _build_provenance(inputs: list[DomainInput], domains: list[dict]) -> dict[str, Any]:
     source_commits: dict[str, str] = {}
+    component_versions: dict[str, str] = {}
     for inp in inputs:
         if inp.repo_root is not None:
             source_commits[inp.repo_root.name] = _git_commit(inp.repo_root)
+            published = _distribution(inp.repo_root)
+            if published:
+                component_versions[published[0]] = published[1]
+    # The assembler names its own distribution: it is the one component certainly at work here.
+    component_versions["pgc-assembler"] = importlib.metadata.version("pgc-assembler")
     compiler_versions = {d["domain"]: d["compiler_version"] for d in domains}
     return {
         "assembler_version": ASSEMBLER_VERSION,
         "assembled_at": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
         "source_commits": source_commits,
+        "component_versions": dict(sorted(component_versions.items())),
         "compiler_versions": compiler_versions,
     }
 
@@ -576,7 +599,7 @@ def assemble(source_roots: list[Path], out_root: Path, profile: str) -> dict[str
 # filter (compiler/stages/s1_extract.py): a governance invariant is imported into a domain iff
 # its applies_to_kinds intersects this set and it declares no layer/surface scope.
 # TEST_DATA joined when transform vectors moved into the supplying domain's build
-# (conformance::CONSTITUTION_TEST_DATA_V2).
+# (conformance::CONSTITUTION_TEST_DATA_V0).
 _DOMAIN_INSTANTIATED = frozenset({"WF", "CC", "CS", "CT", "RB", "AC", "IN", "EV", "TI", "TE", "TEST_DATA"})
 
 
@@ -708,9 +731,9 @@ def verify_snapshot(out_root: Path) -> dict[str, Any]:
       4. profile    — the snapshot claims one, and the profile it claims is the one it was sealed
                       against: its declaration digests to the value the identity covers
 
-    This previously compared recorded values to recorded values — manifest against metadata.json
-    against attestation — which is transitive from construction and establishes nothing to a party
-    who did not build the snapshot (AI-16).
+    Every check recomputes from content. Comparing recorded values to recorded values — manifest
+    against metadata.json against attestation — is transitive from construction and establishes
+    nothing to a party who did not build the snapshot (AI-16).
 
     On any failure the snapshot is refused whole (SN-9). There is no partial acceptance.
     """

{pgc_assembler-5.0.0 → pgc_assembler-6.0.0}/assembler/indexes.py

@@ -2,7 +2,7 @@
 indexes.py — cross-domain query indexes over the assembled snapshot.
 
 Three inspection indexes, built AFTER composition (the assembler is the only point with the full
-federated view of all domains — the PGC successor to RI-0's cross-structure `build` aggregation):
+federated view of all domains):
 
   * artifact_index/index.json — FQDN → domain / kind / owner_subdomain / canonical_path /
                                 evidence_paths / per-domain addresses. Consumed by `si`.
@@ -43,14 +43,11 @@ def _authoring_rank(doc: dict) -> int:
     capability is executable there, and the authoring stays platform-owned. Both copies are
     canonical and both are legitimate; they are not interchangeable.
 
-    The binding copy is the authoring copy with the authored parts removed: `content_hash`,
-    `frontmatter` and the IR are identical, while `content` and `references` are empty and
-    `layer_code` names the consuming layer. So the copy that still carries authored content is the
-    authoring copy, and it is the one an identity must resolve to — `si.artifact.show` promises "the
-    published canonical artifact for an FQDN, as authored".
-
-    A binding copy also carries the `content_hash` of content it does not hold, which is the sharper
-    tell but not one to select on: a hash mismatch is a defect to report, not a discriminator.
+    The binding copy records exactly what the authoring copy records, so the two are the same
+    document, and `si snapshot validate`'s `republished_copies_agree` refuses any pair that is not.
+    An identity resolves to a copy that carries its authored content — `si.artifact.show` promises
+    "the published canonical artifact for an FQDN, as authored" — so a copy without content never
+    wins over one with it.
     """
     return 1 if (doc.get("content") or "").strip() else 0
 

{pgc_assembler-5.0.0 → pgc_assembler-6.0.0/pgc_assembler.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pgc-assembler
-Version: 5.0.0
+Version: 6.0.0
 Summary: PGC snapshot assembler — composes compiled projections into a manifest-pinned executable snapshot (import package: assembler)
 Author-email: Bhash Ganti <bachipeachy@gmail.com>
 License-Expression: Apache-2.0
@@ -118,7 +118,7 @@ Apache-2.0.
 | `pgc-assembler` | `snapshot_assembler` | projections → sealed snapshot |
 | `pgc-runtime` | `protocol_runtime` | snapshot → governed execution |
 | `pgc-inspector` | `snapshot_inspector` | snapshot → read-only inspection |
-| `pgc-transformation` | `transformation` | change request → protocol artifacts |
+| `pgc-transformation` | `transformation_compilers` | change request → protocol artifacts |
 | `pgc-governance` | `software_governance` | the governance surface and its capability implementations |
 | `pgc-workloads` | `conformance_workloads` | the workloads that make conformance observable |
 | `pgc-domains` | `business_domains` | the business domain implementations the composed snapshot binds |
@@ -149,15 +149,16 @@ sealed against.
 The full sequence, with the repositories it needs, is in
 [`pgc_install`](https://github.com/protocol-governed-computing/pgc_install).
 
-**Versioning.** Two schemes, and the published version follows the second.
+**Versioning.** Two numbers name two different things.
 
-- **Internal** — each repository's `VERSION` file, a monotonic composition ordinal. PGC versions the
-  composition rather than each repo: they release together and the governance closure forces lockstep,
-  so the ordinal names which composition a repo belongs to. Development happens on `dev/<N>` and each
-  cycle is tagged `release-<N>`. This is not published.
-- **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v3`**.
+- **Published** — this distribution's `version` in `pyproject.toml`. It moves on its own. A release
+  that changes this repository bumps it, and a release that leaves the repository unchanged keeps it.
+- **Composition** — the public identity (`v6`, …) names one composition of the whole family.
+  `pgc_release` records which version of each distribution that composition holds, and `pgc_install`
+  pins exactly those versions.
 
-**The published version is the public one: `v4` is `4.0.0`.** The standard the packages implement is a
-separate artifact on its own track and is not this number.
+Each repository's `VERSION` file holds the workspace's cycle ordinal, which names the `dev/<N>`
+branch. It is development accounting, and it is never published. The standard the packages
+implement is a separate artifact on its own track, and none of these numbers is its revision.
 
 The standard these packages implement is published separately: https://doi.org/10.5281/zenodo.22150616

{pgc_assembler-5.0.0 → pgc_assembler-6.0.0}/pyproject.toml

@@ -5,7 +5,7 @@ backend-path = ["."]
 
 [project]
 name = "pgc-assembler"
-version = "5.0.0"
+version = "6.0.0"
 description = "PGC snapshot assembler — composes compiled projections into a manifest-pinned executable snapshot (import package: assembler)"
 readme = "README.md"
 requires-python = ">=3.10"

pgc_assembler-5.0.0/VERSION

@@ -1 +0,0 @@
-17

pgc_assembler-5.0.0/assembler/VERSION

@@ -1 +0,0 @@
-17