pgc-runtime 2.0.1__tar.gz → 4.0.0__tar.gz

{pgc_runtime-2.0.1/pgc_runtime.egg-info → pgc_runtime-4.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pgc-runtime
-Version: 2.0.1
+Version: 4.0.0
 Summary: PGC protocol runtime — executes a sealed snapshot as governed DAG traversal and emits traces (import package: runtime)
 Author-email: Bhash Ganti <bachipeachy@gmail.com>
 License-Expression: Apache-2.0
@@ -151,7 +151,7 @@ Apache-2.0. See `LICENSE` and `NOTICE`.
 | `pgc-workloads` | `conformance_workloads` | the workloads that make conformance observable |
 | `pgc-domains` | `business_domains` | the business domain implementations the composed snapshot binds |
 
-`pip install pgc` brings in the whole family.
+`pip install protocol-governed-computing` brings in the whole family.
 
 **Installing the toolchain is one of two steps.** The compiler resolves the governance surface from
 `PGC_PLATFORM_ROOT` — fail-hard, cwd-independent, zero inference — so the *declarations* come from a
@@ -164,8 +164,18 @@ export PGC_PLATFORM_ROOT=$PWD/software_governance
 pgc            # reports what is installed and whether the anchor resolves
 ```
 
-`PGC_BUILD_ROOT` (compiled output, keeping the governance repo read-only) and `PGC_DOMAIN_ROOTS`
-(additional domains contributing their own `registry/structures`) are optional.
+`PGC_DOMAIN_ROOTS` names an additional domain contributing its own `registry/structures` — the
+directory that *directly contains* it, not the repository above it; pointing one level too high is a
+silent no-op. `PGC_SNAPSHOT_ROOT` is where compiled output is written, and each domain build needs
+its own: every layer's output consolidates into one root, and verification rejects any file in that
+root the current build did not declare. `PGC_SNAPSHOT_PROFILES` is the directory holding snapshot
+profiles, required by the assembler and the runtime alike.
+
+`PGC_BUILD_ROOT` is accepted and reported and **nothing reads it** — `PGC_SNAPSHOT_ROOT` is the
+anchor that controls output.
+
+The full sequence, with the repositories it needs, is in
+[`pgc_install`](https://github.com/protocol-governed-computing/pgc_install).
 
 **Versioning.** Two schemes, and the published version follows the second.
 
@@ -173,9 +183,9 @@ pgc            # reports what is installed and whether the anchor resolves
   composition rather than each repo: they release together and the governance closure forces lockstep,
   so the ordinal names which composition a repo belongs to. Development happens on `dev/<N>` and each
   cycle is tagged `release-<N>`. This is not published.
-- **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v2`**.
+- **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v3`**.
 
-**The published version is the public one: `v2` is `2.0.0`.** The standard the packages implement is a
+**The published version is the public one: `v4` is `4.0.0`.** The standard the packages implement is a
 separate artifact on its own track and is not this number.
 
 The standard these packages implement is published separately: https://doi.org/10.5281/zenodo.22150616

{pgc_runtime-2.0.1 → pgc_runtime-4.0.0}/README.md

@@ -125,7 +125,7 @@ Apache-2.0. See `LICENSE` and `NOTICE`.
 | `pgc-workloads` | `conformance_workloads` | the workloads that make conformance observable |
 | `pgc-domains` | `business_domains` | the business domain implementations the composed snapshot binds |
 
-`pip install pgc` brings in the whole family.
+`pip install protocol-governed-computing` brings in the whole family.
 
 **Installing the toolchain is one of two steps.** The compiler resolves the governance surface from
 `PGC_PLATFORM_ROOT` — fail-hard, cwd-independent, zero inference — so the *declarations* come from a
@@ -138,8 +138,18 @@ export PGC_PLATFORM_ROOT=$PWD/software_governance
 pgc            # reports what is installed and whether the anchor resolves
 ```
 
-`PGC_BUILD_ROOT` (compiled output, keeping the governance repo read-only) and `PGC_DOMAIN_ROOTS`
-(additional domains contributing their own `registry/structures`) are optional.
+`PGC_DOMAIN_ROOTS` names an additional domain contributing its own `registry/structures` — the
+directory that *directly contains* it, not the repository above it; pointing one level too high is a
+silent no-op. `PGC_SNAPSHOT_ROOT` is where compiled output is written, and each domain build needs
+its own: every layer's output consolidates into one root, and verification rejects any file in that
+root the current build did not declare. `PGC_SNAPSHOT_PROFILES` is the directory holding snapshot
+profiles, required by the assembler and the runtime alike.
+
+`PGC_BUILD_ROOT` is accepted and reported and **nothing reads it** — `PGC_SNAPSHOT_ROOT` is the
+anchor that controls output.
+
+The full sequence, with the repositories it needs, is in
+[`pgc_install`](https://github.com/protocol-governed-computing/pgc_install).
 
 **Versioning.** Two schemes, and the published version follows the second.
 
@@ -147,9 +157,9 @@ pgc            # reports what is installed and whether the anchor resolves
   composition rather than each repo: they release together and the governance closure forces lockstep,
   so the ordinal names which composition a repo belongs to. Development happens on `dev/<N>` and each
   cycle is tagged `release-<N>`. This is not published.
-- **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v2`**.
+- **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v3`**.
 
-**The published version is the public one: `v2` is `2.0.0`.** The standard the packages implement is a
+**The published version is the public one: `v4` is `4.0.0`.** The standard the packages implement is a
 separate artifact on its own track and is not this number.
 
 The standard these packages implement is published separately: https://doi.org/10.5281/zenodo.22150616

{pgc_runtime-2.0.1 → pgc_runtime-4.0.0/pgc_runtime.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pgc-runtime
-Version: 2.0.1
+Version: 4.0.0
 Summary: PGC protocol runtime — executes a sealed snapshot as governed DAG traversal and emits traces (import package: runtime)
 Author-email: Bhash Ganti <bachipeachy@gmail.com>
 License-Expression: Apache-2.0
@@ -151,7 +151,7 @@ Apache-2.0. See `LICENSE` and `NOTICE`.
 | `pgc-workloads` | `conformance_workloads` | the workloads that make conformance observable |
 | `pgc-domains` | `business_domains` | the business domain implementations the composed snapshot binds |
 
-`pip install pgc` brings in the whole family.
+`pip install protocol-governed-computing` brings in the whole family.
 
 **Installing the toolchain is one of two steps.** The compiler resolves the governance surface from
 `PGC_PLATFORM_ROOT` — fail-hard, cwd-independent, zero inference — so the *declarations* come from a
@@ -164,8 +164,18 @@ export PGC_PLATFORM_ROOT=$PWD/software_governance
 pgc            # reports what is installed and whether the anchor resolves
 ```
 
-`PGC_BUILD_ROOT` (compiled output, keeping the governance repo read-only) and `PGC_DOMAIN_ROOTS`
-(additional domains contributing their own `registry/structures`) are optional.
+`PGC_DOMAIN_ROOTS` names an additional domain contributing its own `registry/structures` — the
+directory that *directly contains* it, not the repository above it; pointing one level too high is a
+silent no-op. `PGC_SNAPSHOT_ROOT` is where compiled output is written, and each domain build needs
+its own: every layer's output consolidates into one root, and verification rejects any file in that
+root the current build did not declare. `PGC_SNAPSHOT_PROFILES` is the directory holding snapshot
+profiles, required by the assembler and the runtime alike.
+
+`PGC_BUILD_ROOT` is accepted and reported and **nothing reads it** — `PGC_SNAPSHOT_ROOT` is the
+anchor that controls output.
+
+The full sequence, with the repositories it needs, is in
+[`pgc_install`](https://github.com/protocol-governed-computing/pgc_install).
 
 **Versioning.** Two schemes, and the published version follows the second.
 
@@ -173,9 +183,9 @@ pgc            # reports what is installed and whether the anchor resolves
   composition rather than each repo: they release together and the governance closure forces lockstep,
   so the ordinal names which composition a repo belongs to. Development happens on `dev/<N>` and each
   cycle is tagged `release-<N>`. This is not published.
-- **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v2`**.
+- **Public** — `PUBLIC_VERSION`, tagged on every component repository. The platform is at **`v3`**.
 
-**The published version is the public one: `v2` is `2.0.0`.** The standard the packages implement is a
+**The published version is the public one: `v4` is `4.0.0`.** The standard the packages implement is a
 separate artifact on its own track and is not this number.
 
 The standard these packages implement is published separately: https://doi.org/10.5281/zenodo.22150616

{pgc_runtime-2.0.1 → pgc_runtime-4.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pgc-runtime"
-version = "2.0.1"
+version = "4.0.0"
 description = "PGC protocol runtime — executes a sealed snapshot as governed DAG traversal and emits traces (import package: runtime)"
 readme = "README.md"
 requires-python = ">=3.10"

{pgc_runtime-2.0.1 → pgc_runtime-4.0.0}/runtime/boot.py

@@ -2,7 +2,7 @@
 boot.py — warm reboot: bring the assembled snapshot resident and hash-verified.
 
 The manifest is the ROOT OF TRUST. The runtime boots *through* it, never by scanning the
-filesystem. Contract: snapshot_assembler/doc/SNAPSHOT_ASSEMBLY_CONTRACT.md
+filesystem. Contract: snapshot_assembler/CONTRACT.md
 
 Boot sequence:
     1. load manifest.json
@@ -75,29 +75,6 @@ def default_snapshot_root() -> Path:
 
 # --- composite hash: independent reimplementation of the assembly contract -----------------
 
-def _identity_view(domains: list[dict]) -> list[dict]:
-    view = [
-        {
-            "domain": d["domain"],
-            "tokenized_projection_hash":  d["projections"]["tokenized"]["projection_hash"],
-            "vocabulary_projection_hash": d["projections"]["vocabulary"]["projection_hash"],
-            # Canonical joins the view because every other member is graph-derived, and STRUCTURE
-            # artifacts never enter the semantic graph — without it a STRUCTURE artifact could
-            # change inside a sealed snapshot and boot would still attest the same identity.
-            "canonical_projection_hash":  d["projections"]["canonical"]["projection_hash"],
-            "attestation_hash":           d["projections"]["trust"]["attestation_hash"],
-            "graph_address_hash":         d["graph_address_hash"],
-        }
-        for d in domains
-    ]
-    return sorted(view, key=lambda e: e["domain"])
-
-
-def _composite_hash(domains: list[dict]) -> str:
-    canonical = json.dumps(_identity_view(domains), sort_keys=True, separators=(",", ":"))
-    return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
-
-
 def _load_manifest(snapshot_root: Path) -> dict:
     path = snapshot_root / "manifest.json"
     if not path.exists():

{pgc_runtime-2.0.1 → pgc_runtime-4.0.0}/runtime/loader.py

@@ -10,7 +10,7 @@ it (dispatcher, scheduler, memory, evidence) works only against the frozen
 RuntimePackage.
 
 Consumed from the assembled snapshot root (the assembler product; see
-snapshot_assembler/doc/SNAPSHOT_ASSEMBLY_CONTRACT.md):
+snapshot_assembler/CONTRACT.md):
     tokenized/<domain>/dispatch.json     — routing (per-WF), pipeline, entry, bindings
     tokenized/<domain>/handlers.json     — ct, cs, rb_policy
     tokenized/<domain>/metadata.json     — projection_hash for trust verification