pgc-domains 2.0.0__tar.gz

pgc_domains-2.0.0/LICENSE

@@ -0,0 +1,67 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+Copyright 2026 Bhash Ganti aka Bachi
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
+------------------------
+FULL LICENSE TEXT BELOW
+------------------------
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+   "Licensor" shall mean the copyright owner.
+   "Legal Entity" shall mean the union of the acting entity and all other
+   entities that control, are controlled by, or are under common control.
+   "You" shall mean an individual or Legal Entity exercising permissions.
+   "Source" form shall mean the preferred form for making modifications.
+   "Object" form shall mean any form resulting from mechanical transformation.
+   "Work" shall mean the work of authorship.
+   "Derivative Works" shall mean any work based on the Work.
+   "Contribution" shall mean any work intentionally submitted.
+   "Contributor" shall mean Licensor and any individual submitting Contributions.
+
+2. Grant of Copyright License.
+   Each Contributor grants You a perpetual, worldwide, non-exclusive,
+   no-charge, royalty-free copyright license.
+
+3. Grant of Patent License.
+   Each Contributor grants a patent license to make, use, sell, etc.
+
+4. Redistribution.
+   You may reproduce and distribute copies provided that:
+   - You include a copy of this License
+   - You retain notices
+   - You state modifications
+   - You include NOTICE file if present
+
+5. Submission of Contributions.
+   Contributions are under this License unless stated otherwise.
+
+6. Trademarks.
+   This License does not grant trademark rights.
+
+7. Disclaimer of Warranty.
+   Provided "AS IS", without warranties.
+
+8. Limitation of Liability.
+   No liability for damages.
+
+9. Accepting Warranty or Additional Liability.
+   You may offer support/warranty on your own behalf only.

pgc_domains-2.0.0/NOTICE

@@ -0,0 +1,11 @@
+PGS — Protocol-Governed Systems
+Copyright 2026 Bhash Ganti aka Bachi
+
+This project introduces a protocol-first execution model in which:
+
+- Behavior is declared in protocol artifacts
+- Execution is performed by a deterministic runtime
+- Capability implementations are bound at compile time
+- Governance is enforced through invariants and assertions
+
+Extensibility is achieved by declaration, not refactor.

pgc_domains-2.0.0/PKG-INFO

@@ -0,0 +1,169 @@
+Metadata-Version: 2.4
+Name: pgc-domains
+Version: 2.0.0
+Summary: PGC business domains — the capability implementations the composed reference snapshot binds at execution
+Author-email: Bhash Ganti <bachipeachy@gmail.com>
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://omnibachi.org/
+Project-URL: Repository, https://github.com/protocol-governed-computing/business_domains
+Project-URL: Standard, https://doi.org/10.5281/zenodo.22150616
+Keywords: protocol-governed-computing,pgc,business-domain,capability-transforms
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: pgc-runtime>=2.0.0
+Requires-Dist: pycryptodome
+Dynamic: license-file
+
+# business_domains
+
+**Real business work, declared as governed protocol.**
+
+Registering a participant, cataloguing a book, licensing an AI agent — work that would be worth
+doing whether or not this platform existed. Each domain here is a directory of declarations: a
+workflow graph, the contracts its nodes name, the intents that admit a request, the events it
+announces, the store it writes to. No domain implements admission, routing, persistence, auditing
+or refusal. It declares them, and the platform enforces what it declared.
+
+> **New here?** Start with [`ARCHITECTURE.md`](ARCHITECTURE.md) — what this repository is, what it
+> owns, and a hands-on walkthrough. For the whole picture, see the
+> [organization profile](https://github.com/protocol-governed-computing).
+
+---
+
+## The domains
+
+| Domain | Subdomains | What it does |
+|---|---|---|
+| **`blockchain`** | `identity`, `wallet` | Register a participant, then accept or reject them — keeping a durable record of what they registered with. An accepted person is then given exactly one wallet, whose creation is recorded as a moment on its own trail. Reachable over HTTP and the command line, with a web client. |
+| **`book_library_mgmt`** | `catalog` | Register works, editions and physical copies; retire and reinstate them; update bibliographic information; search. Ten workflows — the largest surface here — of which six announce the business moments they complete. |
+| **`ai_governance`** | `agent_governance`, `ai_licensing` | Admit or deny an AI agent's action; provision, deny and reclaim licences. Two subdomains sharing one namespace. |
+
+A **domain is a namespace**; a **subdomain is a division within it**. `ai_governance` is the case
+that makes the distinction concrete — two subdomains, one compiled domain, neither a fork of the
+other.
+
+Maturity differs, and it is stated rather than implied. `blockchain::identity` is functionally
+complete; two of its validated criteria are not exercised, and both wait on a function that does not
+exist yet — a timed test, and the transaction half of the wallet claim. `blockchain::wallet` is
+delivered and validated, and it is the domain that demonstrates **consulting** another subdomain's
+records without writing them. `book_library_mgmt` now announces: six of its ten acts emit the moments
+they complete, from the ending that completes them. `ai_governance` carries no change dossier —
+deliberately — and is the least exercised.
+
+**The wallet is also where a defect and its repair are on the record.** Its validation once read 7/9
+because the suite registered the same people identity's suite registers, so a shared data root left
+the unverified-person criterion testing someone already accepted. The suite now seeds people of its
+own. Both blockchain suites run into one data root, because a domain has one place its records live.
+
+## Where this sits
+
+```
+software_governance          conformance_workloads       business_domains
+what is GOVERNED             what PROVES the guarantee   what is DONE  ← here
+       └──────────────────────────┼──────────────────────────┘
+                                  │
+                          compiler → assembler
+                                  │
+                         ┌────────▼────────┐
+                         │ sealed snapshot │
+                         └────┬───────┬────┘
+                              ▼       ▼
+                         runtime   inspector
+```
+
+A domain is compiled **against** an already-compiled governance surface. Governance is never edited
+to admit a domain — compiling one leaves the platform's identity unchanged. A domain declares its
+own sources in its own build manifest, so adding one is a sibling directory and nothing upstream is
+touched.
+
+## Run one
+
+```bash
+./blockchain/client/serve.sh          # http://localhost:8000
+```
+
+Register a name and contact address, then verify that address — accepting or rejecting it. The same
+path without the browser:
+
+```bash
+curl -s -X POST http://localhost:8000/blockchain -H 'Content-Type: application/json' \
+  -d '{"operation":"blockchain.register_actor",
+       "params":{"name":"Ada","contact_address":"ada@example.com"}}'
+```
+
+```json
+{ "outcome": "SUCCESS", "result_class": "SUCCESS",
+  "result": { "contact_address": "ada@example.com",
+              "occurrence": "ACTOR_REGISTERED_UNVERIFIED", "sequence_number": 1 },
+  "evidence": [ "trace:traces/blockchain/WF_REGISTER_ACTOR_V0/…" ] }
+```
+
+Accepting an unknown address returns a governed `NOT_FOUND` without writing anything; registering
+twice succeeds twice and advances the sequence, because registration is idempotent **by
+declaration**. Every response points at the trace for that exact run.
+
+To run a workflow directly against the sealed snapshot, without any web surface:
+
+```bash
+cd ../protocol_runtime
+./run.sh run --wf blockchain::WF_REGISTER_ACTOR_V0 \
+             --payload ../business_domains/blockchain/testbed/identity/test_payloads/01_register_actor.json \
+             --data-root /tmp/pgc_instance
+```
+
+## Layout
+
+```
+blockchain/
+  registry/identity/     workflows · intents · contracts · events · actors ·
+                         storage structure · runtime bindings · transport contracts
+  client/                web client, HTTP binding table, composition launcher
+  cr_dossiers/           the governed record of each change, with its baseline pin
+  testbed/               payloads, including ones that must be refused
+
+book_library_mgmt/       same shape; subdomain `catalog`; plus implementation/ transforms
+ai_governance/           same shape; two subdomains in one namespace
+```
+
+## A change to a domain is itself governed
+
+Each domain carries **change dossiers** — the record of a change from the business problem as stated
+(P0) through to the authoring mandate (P8), each phase admissible before the next may be authored.
+Every dossier pins the baseline it was approved against, and that pin stays historical: a completed
+change is never re-pinned forward.
+
+A change need not author anything. One dossier here produces a **two-line diff** — a defect
+correction, fully evidenced, every phase admissible. A lifecycle that can only describe creation
+cannot describe maintenance.
+
+## What this repository is not
+
+- **Not the platform.** The governance surface is `software_governance`; the runtime that executes
+  these domains is `protocol_runtime`, and it contains no knowledge of any domain here.
+- **Not a set of examples.** Conformance workloads (`conformance_workloads`) exist to prove a
+  guarantee; these exist because the work is worth doing. That both compile by the identical path,
+  with no privilege on either side, is the claim.
+- **Not a place for platform mechanisms.** When a domain needs something neutral the substrate
+  lacks, the substrate gains it — a domain that compensates with a private rule produces a promise
+  stated nowhere and copied everywhere.
+
+## Rules
+
+- A domain declares; it does not implement admission, routing, persistence or auditing.
+- No import of the compiler, the assembler, the runtime, or another domain. Implementations are
+  leaves; cross-domain reference happens through compiled identity.
+- Capability transforms are pure and deterministic. Every effect is a declared capability.
+- All references are by fully-qualified identity, resolved at compile time. No short names.
+
+## License
+
+Apache-2.0. See [`LICENSE`](LICENSE) and [`NOTICE`](NOTICE).

pgc_domains-2.0.0/README.md

@@ -0,0 +1,144 @@
+# business_domains
+
+**Real business work, declared as governed protocol.**
+
+Registering a participant, cataloguing a book, licensing an AI agent — work that would be worth
+doing whether or not this platform existed. Each domain here is a directory of declarations: a
+workflow graph, the contracts its nodes name, the intents that admit a request, the events it
+announces, the store it writes to. No domain implements admission, routing, persistence, auditing
+or refusal. It declares them, and the platform enforces what it declared.
+
+> **New here?** Start with [`ARCHITECTURE.md`](ARCHITECTURE.md) — what this repository is, what it
+> owns, and a hands-on walkthrough. For the whole picture, see the
+> [organization profile](https://github.com/protocol-governed-computing).
+
+---
+
+## The domains
+
+| Domain | Subdomains | What it does |
+|---|---|---|
+| **`blockchain`** | `identity`, `wallet` | Register a participant, then accept or reject them — keeping a durable record of what they registered with. An accepted person is then given exactly one wallet, whose creation is recorded as a moment on its own trail. Reachable over HTTP and the command line, with a web client. |
+| **`book_library_mgmt`** | `catalog` | Register works, editions and physical copies; retire and reinstate them; update bibliographic information; search. Ten workflows — the largest surface here — of which six announce the business moments they complete. |
+| **`ai_governance`** | `agent_governance`, `ai_licensing` | Admit or deny an AI agent's action; provision, deny and reclaim licences. Two subdomains sharing one namespace. |
+
+A **domain is a namespace**; a **subdomain is a division within it**. `ai_governance` is the case
+that makes the distinction concrete — two subdomains, one compiled domain, neither a fork of the
+other.
+
+Maturity differs, and it is stated rather than implied. `blockchain::identity` is functionally
+complete; two of its validated criteria are not exercised, and both wait on a function that does not
+exist yet — a timed test, and the transaction half of the wallet claim. `blockchain::wallet` is
+delivered and validated, and it is the domain that demonstrates **consulting** another subdomain's
+records without writing them. `book_library_mgmt` now announces: six of its ten acts emit the moments
+they complete, from the ending that completes them. `ai_governance` carries no change dossier —
+deliberately — and is the least exercised.
+
+**The wallet is also where a defect and its repair are on the record.** Its validation once read 7/9
+because the suite registered the same people identity's suite registers, so a shared data root left
+the unverified-person criterion testing someone already accepted. The suite now seeds people of its
+own. Both blockchain suites run into one data root, because a domain has one place its records live.
+
+## Where this sits
+
+```
+software_governance          conformance_workloads       business_domains
+what is GOVERNED             what PROVES the guarantee   what is DONE  ← here
+       └──────────────────────────┼──────────────────────────┘
+                                  │
+                          compiler → assembler
+                                  │
+                         ┌────────▼────────┐
+                         │ sealed snapshot │
+                         └────┬───────┬────┘
+                              ▼       ▼
+                         runtime   inspector
+```
+
+A domain is compiled **against** an already-compiled governance surface. Governance is never edited
+to admit a domain — compiling one leaves the platform's identity unchanged. A domain declares its
+own sources in its own build manifest, so adding one is a sibling directory and nothing upstream is
+touched.
+
+## Run one
+
+```bash
+./blockchain/client/serve.sh          # http://localhost:8000
+```
+
+Register a name and contact address, then verify that address — accepting or rejecting it. The same
+path without the browser:
+
+```bash
+curl -s -X POST http://localhost:8000/blockchain -H 'Content-Type: application/json' \
+  -d '{"operation":"blockchain.register_actor",
+       "params":{"name":"Ada","contact_address":"ada@example.com"}}'
+```
+
+```json
+{ "outcome": "SUCCESS", "result_class": "SUCCESS",
+  "result": { "contact_address": "ada@example.com",
+              "occurrence": "ACTOR_REGISTERED_UNVERIFIED", "sequence_number": 1 },
+  "evidence": [ "trace:traces/blockchain/WF_REGISTER_ACTOR_V0/…" ] }
+```
+
+Accepting an unknown address returns a governed `NOT_FOUND` without writing anything; registering
+twice succeeds twice and advances the sequence, because registration is idempotent **by
+declaration**. Every response points at the trace for that exact run.
+
+To run a workflow directly against the sealed snapshot, without any web surface:
+
+```bash
+cd ../protocol_runtime
+./run.sh run --wf blockchain::WF_REGISTER_ACTOR_V0 \
+             --payload ../business_domains/blockchain/testbed/identity/test_payloads/01_register_actor.json \
+             --data-root /tmp/pgc_instance
+```
+
+## Layout
+
+```
+blockchain/
+  registry/identity/     workflows · intents · contracts · events · actors ·
+                         storage structure · runtime bindings · transport contracts
+  client/                web client, HTTP binding table, composition launcher
+  cr_dossiers/           the governed record of each change, with its baseline pin
+  testbed/               payloads, including ones that must be refused
+
+book_library_mgmt/       same shape; subdomain `catalog`; plus implementation/ transforms
+ai_governance/           same shape; two subdomains in one namespace
+```
+
+## A change to a domain is itself governed
+
+Each domain carries **change dossiers** — the record of a change from the business problem as stated
+(P0) through to the authoring mandate (P8), each phase admissible before the next may be authored.
+Every dossier pins the baseline it was approved against, and that pin stays historical: a completed
+change is never re-pinned forward.
+
+A change need not author anything. One dossier here produces a **two-line diff** — a defect
+correction, fully evidenced, every phase admissible. A lifecycle that can only describe creation
+cannot describe maintenance.
+
+## What this repository is not
+
+- **Not the platform.** The governance surface is `software_governance`; the runtime that executes
+  these domains is `protocol_runtime`, and it contains no knowledge of any domain here.
+- **Not a set of examples.** Conformance workloads (`conformance_workloads`) exist to prove a
+  guarantee; these exist because the work is worth doing. That both compile by the identical path,
+  with no privilege on either side, is the claim.
+- **Not a place for platform mechanisms.** When a domain needs something neutral the substrate
+  lacks, the substrate gains it — a domain that compensates with a private rule produces a promise
+  stated nowhere and copied everywhere.
+
+## Rules
+
+- A domain declares; it does not implement admission, routing, persistence or auditing.
+- No import of the compiler, the assembler, the runtime, or another domain. Implementations are
+  leaves; cross-domain reference happens through compiled identity.
+- Capability transforms are pure and deterministic. Every effect is a declared capability.
+- All references are by fully-qualified identity, resolved at compile time. No short names.
+
+## License
+
+Apache-2.0. See [`LICENSE`](LICENSE) and [`NOTICE`](NOTICE).

pgc_domains-2.0.0/ai_governance/implementation/capability_transforms/atoms/ct_pure_check_quota_available_v0.py

@@ -0,0 +1,64 @@
+"""
+CT_PURE_CHECK_QUOTA_AVAILABLE_V0
+
+Pure Capability Transform (Atom)
+
+Purpose:
+    Determine whether license quota remains under a declared cap.
+
+Implementation:
+    - Compares assigned_count against quota
+    - Raises CTExecutionError when the cap is reached — the protocol's VIOLATION signal
+      for a validating CT; returns the remaining count otherwise
+
+Purity Class: ct_pure
+"""
+
+from typing import Any, Dict
+
+from runtime.ct_executor import CTExecutionError
+
+
+def _require_int(inputs: Dict[str, Any], key: str) -> int:
+    if key not in inputs:
+        raise CTExecutionError(
+            f"CT_PURE_CHECK_QUOTA_AVAILABLE_V0: missing required input '{key}'"
+        )
+    value = inputs[key]
+    # bool is a subclass of int — reject it explicitly rather than silently coercing.
+    if isinstance(value, bool) or not isinstance(value, int):
+        raise CTExecutionError(
+            f"CT_PURE_CHECK_QUOTA_AVAILABLE_V0: '{key}' must be an int, "
+            f"got {type(value).__name__}"
+        )
+    if value < 0:
+        raise CTExecutionError(
+            f"CT_PURE_CHECK_QUOTA_AVAILABLE_V0: '{key}' must be non-negative, got {value}"
+        )
+    return value
+
+
+def execute(inputs: Dict[str, Any], context: Any = None) -> Dict[str, Any]:
+    """
+    Execute CT_PURE_CHECK_QUOTA_AVAILABLE_V0.
+
+    Inputs:
+        assigned_count (int): Licenses currently assigned
+        quota (int): Declared license cap
+
+    Outputs:
+        quota_available (bool): True when assigned_count is below quota
+        remaining (int): Licenses remaining under the cap, floored at zero
+    """
+    assigned_count = _require_int(inputs, "assigned_count")
+    quota = _require_int(inputs, "quota")
+
+    remaining = quota - assigned_count
+
+    if remaining <= 0:
+        raise CTExecutionError(
+            f"CT_PURE_CHECK_QUOTA_AVAILABLE_V0: license cap reached "
+            f"(assigned_count={assigned_count}, quota={quota})"
+        )
+
+    return {"result_status": "SUCCESS", "quota_available": True, "remaining": remaining}

pgc_domains-2.0.0/ai_governance/implementation/capability_transforms/atoms/ct_pure_check_training_status_v0.py

@@ -0,0 +1,51 @@
+"""
+CT_PURE_CHECK_TRAINING_STATUS_V0
+
+Pure Capability Transform (Atom)
+
+Purpose:
+    Evaluate whether an employee has completed the training required for AI license
+    provisioning.
+
+Implementation:
+    - Reads the declared training_completed fact
+    - Raises CTExecutionError when training is incomplete — the protocol's VIOLATION
+      signal for a validating CT; returns the eligibility flag otherwise
+
+Purity Class: ct_pure
+"""
+
+from typing import Any, Dict
+
+from runtime.ct_executor import CTExecutionError
+
+
+def execute(inputs: Dict[str, Any], context: Any = None) -> Dict[str, Any]:
+    """
+    Execute CT_PURE_CHECK_TRAINING_STATUS_V0.
+
+    Inputs:
+        training_completed (bool): Whether required training is complete
+
+    Outputs:
+        training_eligible (bool): True when training is complete
+    """
+    if "training_completed" not in inputs:
+        raise CTExecutionError(
+            "CT_PURE_CHECK_TRAINING_STATUS_V0: missing required input 'training_completed'"
+        )
+
+    training_completed = inputs["training_completed"]
+
+    if not isinstance(training_completed, bool):
+        raise CTExecutionError(
+            "CT_PURE_CHECK_TRAINING_STATUS_V0: 'training_completed' must be a bool, "
+            f"got {type(training_completed).__name__}"
+        )
+
+    if not training_completed:
+        raise CTExecutionError(
+            "CT_PURE_CHECK_TRAINING_STATUS_V0: required training is not complete"
+        )
+
+    return {"result_status": "SUCCESS", "training_eligible": True}

pgc_domains-2.0.0/ai_governance/implementation/capability_transforms/atoms/ct_pure_evaluate_inactivity_v0.py

@@ -0,0 +1,96 @@
+"""
+CT_PURE_EVALUATE_INACTIVITY_V0
+
+Pure Capability Transform (Atom)
+
+Purpose:
+    Evaluate whether a license has been dormant past its reclamation threshold.
+
+Implementation:
+    - Parses last_active_date and evaluation_date as ISO-8601
+    - Computes whole days elapsed between them
+    - Compares against threshold_days
+    - Raises CTExecutionError when the license is still active — the protocol's VIOLATION
+      signal for a validating CT; returns the dormancy verdict otherwise
+
+    evaluation_date is a declared input, never a clock read: a pure CT that consulted the
+    system clock would be non-deterministic and its trace unreplayable.
+
+Purity Class: ct_pure
+"""
+
+from datetime import date, datetime
+from typing import Any, Dict
+
+from runtime.ct_executor import CTExecutionError
+
+
+def _parse_iso_date(inputs: Dict[str, Any], key: str) -> date:
+    if key not in inputs:
+        raise CTExecutionError(
+            f"CT_PURE_EVALUATE_INACTIVITY_V0: missing required input '{key}'"
+        )
+    raw = inputs[key]
+    if not isinstance(raw, str):
+        raise CTExecutionError(
+            f"CT_PURE_EVALUATE_INACTIVITY_V0: '{key}' must be an ISO-8601 string, "
+            f"got {type(raw).__name__}"
+        )
+    # Accept both date and date-time forms; a trailing Z is ISO-8601 but not accepted by
+    # fromisoformat before 3.11, so normalize it.
+    normalized = raw[:-1] + "+00:00" if raw.endswith("Z") else raw
+    try:
+        return datetime.fromisoformat(normalized).date()
+    except ValueError:
+        raise CTExecutionError(
+            f"CT_PURE_EVALUATE_INACTIVITY_V0: '{key}' is not a valid ISO-8601 date: {raw!r}"
+        ) from None
+
+
+def execute(inputs: Dict[str, Any], context: Any = None) -> Dict[str, Any]:
+    """
+    Execute CT_PURE_EVALUATE_INACTIVITY_V0.
+
+    Inputs:
+        last_active_date (str): ISO-8601 date/date-time of last recorded activity
+        evaluation_date (str): ISO-8601 date/date-time the evaluation is made as of
+        threshold_days (int): Inactivity threshold in days
+
+    Outputs:
+        is_inactive (bool): True when days_inactive >= threshold_days
+        days_inactive (int): Whole days elapsed between the two dates
+    """
+    last_active = _parse_iso_date(inputs, "last_active_date")
+    evaluated_on = _parse_iso_date(inputs, "evaluation_date")
+
+    if "threshold_days" not in inputs:
+        raise CTExecutionError(
+            "CT_PURE_EVALUATE_INACTIVITY_V0: missing required input 'threshold_days'"
+        )
+    threshold_days = inputs["threshold_days"]
+    if isinstance(threshold_days, bool) or not isinstance(threshold_days, int):
+        raise CTExecutionError(
+            "CT_PURE_EVALUATE_INACTIVITY_V0: 'threshold_days' must be an int, "
+            f"got {type(threshold_days).__name__}"
+        )
+    if threshold_days < 0:
+        raise CTExecutionError(
+            f"CT_PURE_EVALUATE_INACTIVITY_V0: 'threshold_days' must be non-negative, "
+            f"got {threshold_days}"
+        )
+
+    if evaluated_on < last_active:
+        raise CTExecutionError(
+            "CT_PURE_EVALUATE_INACTIVITY_V0: 'evaluation_date' precedes 'last_active_date' "
+            f"({evaluated_on.isoformat()} < {last_active.isoformat()})"
+        )
+
+    days_inactive = (evaluated_on - last_active).days
+
+    if days_inactive < threshold_days:
+        raise CTExecutionError(
+            f"CT_PURE_EVALUATE_INACTIVITY_V0: license is still active "
+            f"(days_inactive={days_inactive} < threshold_days={threshold_days})"
+        )
+
+    return {"result_status": "SUCCESS", "is_inactive": True, "days_inactive": days_inactive}