platformforge 0.1.1__tar.gz → 0.1.3__tar.gz

platformforge-0.1.3/.github/workflows/publish-pypi.yml

@@ -0,0 +1,201 @@
+name: publish-pypi
+
+# Secure PyPI release pipeline — build once, publish the same artifact.
+#
+#   build   — version gate + `python -m build` + integrity manifest + artifact
+#             upload (contents:read only)
+#   publish — downloads the SAME dist/ built above, re-verifies sha256, then
+#             publishes via PyPI Trusted Publishing (OIDC — no stored token)
+#   verify  — installs the published version from PyPI in a clean venv and
+#             smoke-tests the console script
+#
+# Trusted Publishing (OIDC) — no stored token. The publisher registered on
+# PyPI must point to:
+#   owner/repo: <org>/<repo>  workflow: publish-pypi.yml  environment: release
+# NOTE: the previous pipeline used an empty environment — update the PyPI
+# publisher registration to `release` before the first run of this workflow.
+#
+# `environment: release` also enables repo protection — configure required
+# reviewers/rules under Settings > Environments > release.
+#
+# GitHub artifact attestations (PEP 740) are intentionally disabled to keep
+# this pipeline minimal; to enable later, add `attestations: write` to the
+# publish job permissions and `attestations: true` to the pypi-publish inputs.
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to publish — must match [project] version in pyproject.toml"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build release artifact
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+
+      - name: Version gate (input match, PyPI freshness, changelog)
+        env:
+          EXPECTED_VERSION: ${{ inputs.version }}
+        run: |
+          python - <<'PY'
+          import json, os, re, sys, tomllib, urllib.error, urllib.request
+
+          def fail(msg):
+              print(f"::error::version gate: {msg}")
+              sys.exit(1)
+
+          with open("pyproject.toml", "rb") as fh:
+              project = tomllib.load(fh)["project"]
+          name = project["name"]
+          version = project["version"]
+          print(f"pyproject.toml: {name} == {version}")
+
+          expected = os.environ.get("EXPECTED_VERSION", "").strip()
+          if expected:
+              if version != expected:
+                  fail(f"dispatch input {expected!r} != pyproject.toml version {version!r}")
+              print(f"dispatch input matches pyproject version: {version}")
+          else:
+              print("no version input supplied — input-match check skipped")
+
+          pypi_name = re.sub(r"[-_.]+", "-", name).lower()
+          url = f"https://pypi.org/pypi/{pypi_name}/json"
+          releases = None
+          try:
+              with urllib.request.urlopen(url, timeout=15) as resp:
+                  releases = json.load(resp).get("releases", {})
+          except urllib.error.HTTPError as e:
+              if e.code == 404:
+                  print(f"{pypi_name}: not on PyPI yet (HTTP 404) — first publish")
+              else:
+                  fail(f"PyPI JSON returned HTTP {e.code}; refusing to publish unverified")
+          except Exception as e:
+              fail(f"PyPI check failed: {e}")
+          if releases is not None and version in releases:
+              fail(f"{pypi_name} {version} is already published on PyPI")
+
+          if os.path.exists("CHANGELOG.md"):
+              lines = open("CHANGELOG.md", encoding="utf-8").read().splitlines()
+              tracks = any(re.match(r"##\s*\[?\d+\.\d+", l) for l in lines[:40])
+              if not tracks:
+                  print("CHANGELOG.md does not track versions — changelog gate skipped")
+              elif any(l.startswith("##") and version in l for l in lines):
+                  print(f"CHANGELOG.md has an entry for {version}")
+              else:
+                  fail(f"CHANGELOG.md tracks versions but has no entry for {version}")
+          else:
+              print("no CHANGELOG.md — changelog gate skipped")
+
+          print(f"version gate OK: {name} {version}")
+          PY
+
+      - name: Build wheel + sdist
+        run: python -m pip install --quiet build twine && python -m build
+
+      - name: Twine check
+        run: python -m twine check dist/*
+
+      - name: Inspect wheel contents
+        run: |
+          for whl in dist/*.whl; do
+            echo "== $whl"
+            python -m zipfile -l "$whl"
+          done
+
+      - name: Record artifact checksums
+        run: (cd dist && sha256sum -- *) | tee dist-checksums.txt
+
+      - name: Upload release artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: release-dist
+          path: |
+            dist/
+            dist-checksums.txt
+          if-no-files-found: error
+          retention-days: 7
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    # configure protection rules/reviewers for the "release" environment
+    # in repo Settings > Environments
+    environment: release
+    permissions:
+      contents: read
+      id-token: write  # OIDC for PyPI trusted publishing — scoped to this job only
+    steps:
+      - name: Download release artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: release-dist
+
+      - name: Verify artifact integrity (same artifact that was built)
+        run: |
+          test -f dist-checksums.txt
+          cd dist && sha256sum --check ../dist-checksums.txt
+
+      - name: Publish to PyPI (trusted publishing)
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+
+  verify:
+    name: Verify published package
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+
+      - name: Wait for release to appear on PyPI
+        env:
+          PKG_NAME: platformforge
+          EXPECTED_VERSION: ${{ inputs.version }}
+        run: |
+          python - <<'PY'
+          import os, sys, time, urllib.request
+          name = os.environ["PKG_NAME"]
+          version = os.environ["EXPECTED_VERSION"]
+          url = f"https://pypi.org/pypi/{name}/{version}/json"
+          for attempt in range(1, 21):  # up to ~5 min
+              try:
+                  with urllib.request.urlopen(url, timeout=15) as resp:
+                      if resp.status == 200:
+                          print(f"{name} {version} live on PyPI (attempt {attempt})")
+                          sys.exit(0)
+              except Exception as e:
+                  print(f"attempt {attempt}/20: not live yet ({e})")
+              time.sleep(15)
+          sys.exit(f"{name} {version} not visible on PyPI after ~5 minutes")
+          PY
+
+      - name: Install published package in clean venv
+        run: |
+          python -m venv /tmp/verify-venv
+          for i in 1 2 3 4 5 6 7 8 9 10; do
+            if /tmp/verify-venv/bin/python -m pip install --no-cache-dir \
+              --index-url https://pypi.org/simple \
+              "platformforge==${{ inputs.version }}"; then break; fi
+
+                echo "install attempt $i failed (index propagation); retrying in 30s"
+
+                sleep 30
+
+              done
+
+      - name: Smoke test console script
+        run: /tmp/verify-venv/bin/platformforge --version

{platformforge-0.1.1 → platformforge-0.1.3}/CHANGELOG.md

@@ -1,6 +1,22 @@
 # CHANGELOG
 
 All notable changes. Format: wave/feature, the "why", key commits.
+## [0.1.3] - 2026-10-20
+
+### Changed
+- Cycle 12 portable distribution: `data_path()` zipimport-safe via
+  `as_file` + ExitStack with thread-safe dedupe; contracts/freeze/envelope
+  loaders resolve packaged data without a checkout.
+- `test_artifact_contents.py` builds the real wheel and asserts
+  `data/{rules,knowledge,contracts,evals}` file-by-file.
+- Economy-parity validation receipt rebound to the functional HEAD.
+
+## [0.1.2] - 2026-10-18
+
+### Changed
+- Portal 2.2 vendored generation (44-asset frontend, telemetry,
+  py3.10-safe server); hardened PyPI pipeline (build-once/
+  publish-same-artifact, version gate, post-publish verify)
 
 ## [0.1.1] - 2026-10-18
 

{platformforge-0.1.1 → platformforge-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: platformforge
-Version: 0.1.1
+Version: 0.1.3
 Summary: Agentic Platform Engineering intelligence platform — deterministic, offline-first, evidence-first
 Project-URL: Homepage, https://github.com/EdgarSocrates98/platform-forge
 Project-URL: Repository, https://github.com/EdgarSocrates98/platform-forge
@@ -46,6 +46,7 @@ Requires-Dist: pyyaml>=6.0
 Provides-Extra: aws
 Requires-Dist: boto3<2,>=1.34; extra == 'aws'
 Provides-Extra: dev
+Requires-Dist: build>=1.0; extra == 'dev'
 Requires-Dist: pytest<10,>=9; extra == 'dev'
 Requires-Dist: ruff<1,>=0.7; extra == 'dev'
 Provides-Extra: mcp

{platformforge-0.1.1 → platformforge-0.1.3}/docs/economy-parity/VALIDATION-RECEIPT.json

@@ -1,7 +1,7 @@
 {
   "benchmarks": {
     "control_plane_overhead": "docs/economy-parity/ECONOMY-BENCHMARKS.md",
-    "end_to_end": "insufficient evidence — no production corpus claimed"
+    "end_to_end": "insufficient evidence \u2014 no production corpus claimed"
   },
   "closure_sha": null,
   "cycle": "economy-parity",
@@ -11,7 +11,7 @@
     "economy-agentic": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_agents_waste.py tests/test_economy_evals.py -k uniqueness or debate or duplication or fanout or waste or stagnant",
-      "seconds": 0.36
+      "seconds": 0.37
     },
     "economy-budget": {
       "ok": true,
@@ -21,17 +21,17 @@
     "economy-cache": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_cache.py",
-      "seconds": 0.29
+      "seconds": 0.4
     },
     "economy-closure": {
       "ok": true,
       "reproduce": "python -c import sys\nfrom pathlib import Path\nreq = {'docs/economy-parity/FINAL-REPORT.md':\n         ['validated_sha', 'remote_ci', 'known gap'],\n       'docs/economy-parity/FINAL-MATRIX.md':\n         ['validated', 'externally-unverified'],\n       'docs/economy-parity/ECONOMY-BENCHMARKS.md':\n         ['Control Plane Overhead', 'End-to-End'],\n       'docs/economy/ROUTING.md':\n         ['decide', 'advisory'],\n       'docs/economy-parity/POLISH-BASELINE.md': ['drift']}\nbad = []\nfor f, needles in req.items():\n    p = Path(f)\n    if not p.is_file(): bad.append(('missing', f)); continue\n    txt = p.read_text()\n    for n in needles:\n        if n not in txt: bad.append((f, n))\nm = Path('docs/economy-parity/FINAL-MATRIX.md').read_text()\nif '\\n' + '|' in m and ' fully-production' in m:\n    bad.append(('matrix', 'overclaimed status'))\nif bad: print(bad); sys.exit(1)\nprint('closure docs coherent')\n && pytest -q tests/test_economy_closure.py",
-      "seconds": 0.4
+      "seconds": 0.41
     },
     "economy-context": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_gateway.py -k TestGateway or TestLazy or TestRole or Suff",
-      "seconds": 0.29
+      "seconds": 0.31
     },
     "economy-contracts": {
       "ok": true,
@@ -41,22 +41,22 @@
     "economy-evals": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_evals.py",
-      "seconds": 0.38
+      "seconds": 0.37
     },
     "economy-qpt": {
       "ok": true,
       "reproduce": "pytest -q tests/test_qpt_v2.py tests/test_economy_fleet_qpt.py",
-      "seconds": 0.94
+      "seconds": 0.95
     },
     "economy-receipt": {
       "ok": true,
-      "reproduce": "python -c import json, re, subprocess, sys\nfrom pathlib import Path\nsys.path.insert(0, 'scripts')\nimport validate as V\np = Path(V.ECONOMY_RECEIPT_PATH)\nif not p.is_file():\n    print('missing receipt:', p); sys.exit(1)\nr = json.loads(p.read_text())\nbad = []\nif r.get('schema') != V.ECONOMY_RECEIPT_SCHEMA:\n    bad.append(('schema', r.get('schema')))\nvs = r.get('validated_sha') or ''\nok_sha = subprocess.run(['git','cat-file','-e',\n    vs + '^{commit}'], capture_output=True).returncode == 0\nif not ok_sha: bad.append(('validated_sha-not-a-commit', vs))\nhead = subprocess.run(['git','rev-parse','HEAD'],\n    capture_output=True, text=True).stdout.strip()\n# PR merge ref: HEAD^2 is the pushed branch tip — the Option-A\n# pair (functional commit + receipt commit) sits one level down.\nhead2 = subprocess.run(['git','rev-parse','HEAD^2'],\n    capture_output=True, text=True).stdout.strip()\nbase = head2 if __import__('re').fullmatch(r'[0-9a-f]{40}', head2) else head\nhead1 = subprocess.run(['git','rev-parse', base + '~1'],\n    capture_output=True, text=True).stdout.strip()\nif vs not in (base, head1):\n    bad.append(('validated_sha-stale', vs, head))\ncanon = set(V._economy_gate_names())\nextra = set(r.get('gates', {})) - canon\nif extra: bad.append(('noncanonical-gates', sorted(extra)))\npat = re.compile('tests/' + r'\\S+' + r'\\.py')\nfor g, e in r.get('gates', {}).items():\n    for t in pat.findall(e.get('reproduce') or ''):\n        if not Path(t).is_file():\n            bad.append(('dead-reproduce-path', g, t))\nif r.get('verdict') not in ('validated', 'failed'):\n    bad.append(('verdict', r.get('verdict')))\nif bad: print(bad); sys.exit(1)\nprint('receipt coherent:', len(r['gates']), 'gates,',\n      'sha bound')\n",
+      "reproduce": "python -c import json, re, subprocess, sys\nfrom pathlib import Path\nsys.path.insert(0, 'scripts')\nimport validate as V\np = Path(V.ECONOMY_RECEIPT_PATH)\nif not p.is_file():\n    print('missing receipt:', p); sys.exit(1)\nr = json.loads(p.read_text())\nbad = []\nif r.get('schema') != V.ECONOMY_RECEIPT_SCHEMA:\n    bad.append(('schema', r.get('schema')))\nvs = r.get('validated_sha') or ''\nok_sha = subprocess.run(['git','cat-file','-e',\n    vs + '^{commit}'], capture_output=True).returncode == 0\nif not ok_sha: bad.append(('validated_sha-not-a-commit', vs))\nhead = subprocess.run(['git','rev-parse','HEAD'],\n    capture_output=True, text=True).stdout.strip()\n# PR merge ref: HEAD^2 is the pushed branch tip \u2014 the Option-A\n# pair (functional commit + receipt commit) sits one level down.\nhead2 = subprocess.run(['git','rev-parse','HEAD^2'],\n    capture_output=True, text=True).stdout.strip()\nbase = head2 if __import__('re').fullmatch(r'[0-9a-f]{40}', head2) else head\nhead1 = subprocess.run(['git','rev-parse', base + '~1'],\n    capture_output=True, text=True).stdout.strip()\nif vs not in (base, head1):\n    bad.append(('validated_sha-stale', vs, head))\ncanon = set(V._economy_gate_names())\nextra = set(r.get('gates', {})) - canon\nif extra: bad.append(('noncanonical-gates', sorted(extra)))\npat = re.compile('tests/' + r'\\S+' + r'\\.py')\nfor g, e in r.get('gates', {}).items():\n    for t in pat.findall(e.get('reproduce') or ''):\n        if not Path(t).is_file():\n            bad.append(('dead-reproduce-path', g, t))\nif r.get('verdict') not in ('validated', 'failed'):\n    bad.append(('verdict', r.get('verdict')))\nif bad: print(bad); sys.exit(1)\nprint('receipt coherent:', len(r['gates']), 'gates,',\n      'sha bound')\n",
       "seconds": 0.04
     },
     "economy-reconcile": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_gateway.py tests/test_economy_evals.py -k reconcil or mismatch or unobserved",
-      "seconds": 0.33
+      "seconds": 0.35
     },
     "economy-resume": {
       "ok": true,
@@ -76,25 +76,25 @@
     "economy-verification": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_pricing_verify.py",
-      "seconds": 0.3
+      "seconds": 0.31
     }
   },
-  "generated_at": "2026-10-17T04:52:46Z",
+  "generated_at": "2026-10-20T07:36:57Z",
   "kind": "platformforge/economy-validation-receipt/1",
   "known_gaps": [
     "real provider pricing catalog not bundled (declared-rates engine only, by design)",
-    "money axis lacks a real model-call corpus — QPC money is unresolved without declared pricing + measured usage",
+    "money axis lacks a real model-call corpus \u2014 QPC money is unresolved without declared pricing + measured usage",
     "production savings unproven; microbench overhead only",
-    "analysis cache reuse requires identical evidence/policy/risk tuple — conservative by construction"
+    "analysis cache reuse requires identical evidence/policy/risk tuple \u2014 conservative by construction"
   ],
   "quality": {
     "note": "QPT/QPC floors enforced inside economy-qpt / economy-evals gates; quality floors gate every economy claim"
   },
-  "remote_ci": "PR pending; local gates canonical",
+  "remote_ci": "not independently verified",
   "schema": "platformforge/economy-validation-receipt/v1",
   "spec": "prompt_evo_economy.md",
-  "validated_sha": "32c2eac6f648c72e0271f533966d2002329c8aa5",
+  "validated_sha": "23a613b7de67e0cfc9300e1a4f621c55827f63d5",
   "validator": "scripts/validate.py",
   "validator_version": "economy-validation-receipt/v1",
   "verdict": "validated"
-}
+}

{platformforge-0.1.1 → platformforge-0.1.3}/install.ps1

@@ -1,5 +1,7 @@
-# Forge account install — editable runtime + user-scoped environment.
+# Forge account install — wheel runtime + user-scoped environment.
 # Persists HKCU variables and can refresh current session when dot-sourced.
+# The default installs a built wheel (no checkout dependence). Pass --editable
+# for the development flow (CLI tied to this checkout).
 $ErrorActionPreference = "Stop"
 $isDotSourced = $MyInvocation.InvocationName -eq "."
 $oldLocation = Get-Location
@@ -16,7 +18,7 @@ try {
         }
     }
     if (-not $py) { throw "install: no Python executable on PATH (need >=3.10)" }
-    $installArgs = @("--editable", "--persist-env", "--allow-download") + $args
+    $installArgs = @("--persist-env", "--allow-download") + $args
     & $py @pyArgs scripts/forge_bootstrap.py @installArgs
     $status = $LASTEXITCODE
     if ($status -eq 0) {

{platformforge-0.1.1 → platformforge-0.1.3}/install.sh

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
-# Forge account install — editable runtime + user-scoped environment.
+# Forge account install — wheel runtime + user-scoped environment.
 # Works from POSIX shells and native Windows Git Bash.
+# The default installs a built wheel (no checkout dependence). Pass --editable
+# for the development flow (CLI tied to this checkout).
 set -euo pipefail
 
 _forge_is_sourced=0
@@ -37,7 +39,7 @@ if [ -z "$PY" ]; then
   if [ "$_forge_is_sourced" -eq 1 ]; then return 2; fi
   exit 2
 fi
-ARGS=(--editable --persist-env --allow-download "$@")
+ARGS=(--persist-env --allow-download "$@")
 if "$PY" "${PY_ARGS[@]}" scripts/forge_bootstrap.py "${ARGS[@]}"; then
   status=0
 else

{platformforge-0.1.1 → platformforge-0.1.3}/platformforge/__init__.py

@@ -4,4 +4,4 @@ Deterministic-first, offline-first, evidence-first. The core never imports
 LLM SDKs, cloud SDKs, or MCP — those live behind optional adapters.
 """
 
-__version__ = "0.1.1"
+__version__ = "0.1.3"

{platformforge-0.1.1 → platformforge-0.1.3}/platformforge/_forge_portal.py

@@ -65,9 +65,9 @@ _REDACT_EXEMPT = frozenset({"plan_token"})
 def _utc_now() -> str:
     """Real wall-clock timestamp for telemetry — emitted at record time,
     never back-filled for events that already happened."""
-    from datetime import UTC, datetime
+    from datetime import datetime, timezone
 
-    return datetime.now(UTC).isoformat(timespec="milliseconds").replace("+00:00", "Z")
+    return datetime.now(timezone.utc).isoformat(timespec="milliseconds").replace("+00:00", "Z")
 
 
 # ---------------------------------------------------------------------------
@@ -243,8 +243,11 @@ class PortalAdapter:
         return detect_account_environment(self)
 
 
+PORTAL_VERSION = "1.0.0"
+
+
 def portal_version() -> str:
-    return "1.0.0"
+    return PORTAL_VERSION
 
 
 def workspace_name(root: str | None) -> str | None:

{platformforge-0.1.1 → platformforge-0.1.3}/platformforge/_installkit.py

@@ -22,6 +22,7 @@ import hashlib
 import json
 import os
 import platform
+import re
 import sys
 import tempfile
 import time
@@ -34,7 +35,7 @@ from typing import Any
 _INSTALLKIT_VERSION = "1.0.0"
 # Filled by the vendor step (scripts/installkit/vendor.py) — the sha256 of
 # the canonical source body, so drift checks can compare vendored copies.
-_SOURCE_SHA256 = "e2623a522e431c34"
+_SOURCE_SHA256 = "bc189dd2ae0028ce"
 
 SCHEMA_MANIFEST = "forge/InstallationManifest/v1"
 SCHEMA_RECEIPT = "forge/InstallReceipt/v1"
@@ -89,6 +90,20 @@ class InstallError(Exception):
         }
 
 
+_URL_USERINFO_RE = re.compile(r"(https?://)[^/@\s]+@")
+
+
+def redact_url_userinfo(text: str) -> str:
+    """Strip ``user:pass@`` userinfo from URLs in persisted/logged text.
+
+    ``--dist "name @ https://user:token@host/x.whl"`` must never land in
+    manifests, receipts or stdout verbatim (prompt §6.5 — nunca registrar
+    valores secretos). Host and path survive so diagnostics still identify
+    the wheelhouse.
+    """
+    return _URL_USERINFO_RE.sub(r"\1***@", text)
+
+
 def _utc_now() -> str:
     from datetime import datetime, timezone
 
@@ -1286,6 +1301,7 @@ def manifest_for(
     version: str,
     source: dict[str, Any],
     shim: Path | None,
+    installation_method: str | None = None,
 ) -> dict[str, Any]:
     doc = {
         "schema": SCHEMA_MANIFEST,
@@ -1301,6 +1317,16 @@ def manifest_for(
             "satisfies": spec.python_spec,
         },
         "source": source,
+        "installation_method": installation_method
+        or (
+            "pypi-wheel"
+            if source.get("kind") == "pypi"
+            else (
+                "git-checkout"
+                if source.get("editable", source.get("kind") == "git-checkout")
+                else "wheel"
+            )
+        ),
         "installed_at": _utc_now(),
         "installed_by": {"agent": "forge_bootstrap", "version": _INSTALLKIT_VERSION},
     }