plexus-mesh 0.2.2__tar.gz → 0.3.0__tar.gz

{plexus_mesh-0.2.2 → plexus_mesh-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plexus-mesh
-Version: 0.2.2
+Version: 0.3.0
 Summary: Declarative capability discovery + auto-wiring for agent toolchains: point it at tool manifests and it wires producer to consumer into an executable pipeline, every discovery edge tagged declared and citing the module its producer names. Discovery does not import or run cited tools; optional explicit probe helpers can launch owned MCP servers. Zero runtime dependencies.
 Author: Zain Dana Harper
 License-Expression: LicenseRef-FSL-1.1-MIT
@@ -119,7 +119,7 @@ GitHub-only release install for 0.2.1 on native PowerShell:
 }
 ```
 
-`plexus-mesh` is not published on PyPI in this release track. A source branch or
+`plexus-mesh` 0.2.2 is published on PyPI; install it with `python -m pip install plexus-mesh`. The GitHub wheel recipes above retain the available 0.2.1 GitHub Release assets. A source branch or
 CI run is not a release; install from the GitHub `v0.2.1` assets only after the
 wheel, sdist, and `SHA256SUMS.txt` are attached to that release.
 
@@ -376,3 +376,7 @@ The long form of this belief: [The Unbundling](https://github.com/HarperZ9/flywh
 ---
 
 **[Zentropy Labs](https://github.com/ZentropyLabs-ai)** · order out of entropy. An independent lab building evidence-first tools that leave a re-checkable artifact behind. Built by Zain Dana Harper in Seattle. The full workbench is at [Project Telos](https://harperz9.github.io).
+
+## 0.3.0 local client distribution candidate
+
+The additional [client package](client-plugin/README.md) includes portable plugin metadata and a Windows x64 MCPB/ZIP build. The source version is 0.3.0; these client packages remain unpublished candidates. Existing release installation commands above retain their released version. Native packages carry their Python runtime. No publisher backend is required.

{plexus_mesh-0.2.2 → plexus_mesh-0.3.0}/README.md

@@ -100,7 +100,7 @@ GitHub-only release install for 0.2.1 on native PowerShell:
 }
 ```
 
-`plexus-mesh` is not published on PyPI in this release track. A source branch or
+`plexus-mesh` 0.2.2 is published on PyPI; install it with `python -m pip install plexus-mesh`. The GitHub wheel recipes above retain the available 0.2.1 GitHub Release assets. A source branch or
 CI run is not a release; install from the GitHub `v0.2.1` assets only after the
 wheel, sdist, and `SHA256SUMS.txt` are attached to that release.
 
@@ -357,3 +357,7 @@ The long form of this belief: [The Unbundling](https://github.com/HarperZ9/flywh
 ---
 
 **[Zentropy Labs](https://github.com/ZentropyLabs-ai)** · order out of entropy. An independent lab building evidence-first tools that leave a re-checkable artifact behind. Built by Zain Dana Harper in Seattle. The full workbench is at [Project Telos](https://harperz9.github.io).
+
+## 0.3.0 local client distribution candidate
+
+The additional [client package](client-plugin/README.md) includes portable plugin metadata and a Windows x64 MCPB/ZIP build. The source version is 0.3.0; these client packages remain unpublished candidates. Existing release installation commands above retain their released version. Native packages carry their Python runtime. No publisher backend is required.

{plexus_mesh-0.2.2 → plexus_mesh-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "plexus-mesh"
-version = "0.2.2"
+version = "0.3.0"
 description = "Declarative capability discovery + auto-wiring for agent toolchains: point it at tool manifests and it wires producer to consumer into an executable pipeline, every discovery edge tagged declared and citing the module its producer names. Discovery does not import or run cited tools; optional explicit probe helpers can launch owned MCP servers. Zero runtime dependencies."
 readme = "README.md"
 requires-python = ">=3.11"

{plexus_mesh-0.2.2 → plexus_mesh-0.3.0}/src/plexus/__init__.py

@@ -14,7 +14,7 @@ from .receipt import build_plan_receipt, verify_plan
 from .registry import builtin_manifests, load_dir
 from .run import pipeline_script
 
-__version__ = "0.2.2"
+__version__ = "0.3.0"
 
 __all__ = [
     "Manifest", "Port", "validate",

{plexus_mesh-0.2.2 → plexus_mesh-0.3.0}/src/plexus_mesh.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plexus-mesh
-Version: 0.2.2
+Version: 0.3.0
 Summary: Declarative capability discovery + auto-wiring for agent toolchains: point it at tool manifests and it wires producer to consumer into an executable pipeline, every discovery edge tagged declared and citing the module its producer names. Discovery does not import or run cited tools; optional explicit probe helpers can launch owned MCP servers. Zero runtime dependencies.
 Author: Zain Dana Harper
 License-Expression: LicenseRef-FSL-1.1-MIT
@@ -119,7 +119,7 @@ GitHub-only release install for 0.2.1 on native PowerShell:
 }
 ```
 
-`plexus-mesh` is not published on PyPI in this release track. A source branch or
+`plexus-mesh` 0.2.2 is published on PyPI; install it with `python -m pip install plexus-mesh`. The GitHub wheel recipes above retain the available 0.2.1 GitHub Release assets. A source branch or
 CI run is not a release; install from the GitHub `v0.2.1` assets only after the
 wheel, sdist, and `SHA256SUMS.txt` are attached to that release.
 
@@ -376,3 +376,7 @@ The long form of this belief: [The Unbundling](https://github.com/HarperZ9/flywh
 ---
 
 **[Zentropy Labs](https://github.com/ZentropyLabs-ai)** · order out of entropy. An independent lab building evidence-first tools that leave a re-checkable artifact behind. Built by Zain Dana Harper in Seattle. The full workbench is at [Project Telos](https://harperz9.github.io).
+
+## 0.3.0 local client distribution candidate
+
+The additional [client package](client-plugin/README.md) includes portable plugin metadata and a Windows x64 MCPB/ZIP build. The source version is 0.3.0; these client packages remain unpublished candidates. Existing release installation commands above retain their released version. Native packages carry their Python runtime. No publisher backend is required.

{plexus_mesh-0.2.2 → plexus_mesh-0.3.0}/src/plexus_mesh.egg-info/SOURCES.txt

@@ -18,9 +18,11 @@ src/plexus_mesh.egg-info/dependency_links.txt
 src/plexus_mesh.egg-info/entry_points.txt
 src/plexus_mesh.egg-info/requires.txt
 src/plexus_mesh.egg-info/top_level.txt
+tests/test_client_package.py
 tests/test_extended_registry.py
 tests/test_flagship_interop_roles.py
 tests/test_mneme_contract.py
+tests/test_native_workflow_gate.py
 tests/test_plexus_core.py
 tests/test_plexus_cycle9.py
 tests/test_plexus_grounding.py

plexus_mesh-0.3.0/tests/test_client_package.py

@@ -0,0 +1,173 @@
+"""Client artifact and actual stdio controls, using only synthetic paths."""
+import importlib.util
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import zipfile
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+TOOL = 'plexus'
+sys.path.insert(0, str(ROOT / 'scripts'))
+from build_client_package import archive, build, entries, manifests, qualify
+
+
+def invoke(script, tmp_path, requests, extra_env=None, args=()):
+    env = {k: v for k, v in os.environ.items() if k.upper() in {'SYSTEMROOT','WINDIR','TEMP','TMP','SYSTEMDRIVE'}}
+    env.update(HOME=str(tmp_path), USERPROFILE=str(tmp_path), LOCALAPPDATA=str(tmp_path), APPDATA=str(tmp_path),
+               MNEME_STATE=str(tmp_path / 'synthetic.db'), RELAY_MCP_ROOT=str(tmp_path),
+               RELAY_ALLOW_WRITE='1', RELAY_ALLOW_EXEC='1')
+    env.update(extra_env or {})
+    command = [str(script)] if script.suffix == '.exe' else [sys.executable, '-I', '-S', str(script)]
+    return subprocess.run([*command,*args], input=''.join(json.dumps(r)+'\n' for r in requests),
+                          capture_output=True, text=True, env=env, cwd=tmp_path, timeout=30)
+
+
+def request(mid, method, **params):
+    return {'jsonrpc':'2.0', 'id':mid, 'method':method, 'params':params}
+
+
+@pytest.fixture
+def packaged(tmp_path):
+    archive_path = build(tmp_path / 'output')[0]
+    target = tmp_path / 'extracted'
+    with zipfile.ZipFile(archive_path) as z:
+        z.extractall(target)
+    return target
+
+
+def test_stdio_identity_and_unknown(packaged, tmp_path):
+    p = invoke(packaged / 'server/serve.py', tmp_path, [request(1,'initialize'),
+        request(2,'tools/list'), request(3,'tools/call',name=TOOL+'.status',arguments={}),
+        request(4,'tools/call',name='destroy_everything',arguments={})])
+    assert p.returncode == 0, p.stderr
+    rows = [json.loads(s) for s in p.stdout.splitlines()]
+    assert rows[0]['result']['serverInfo']['version'] == qualify('dev')[0]
+    assert rows[1]['result']['tools']
+    assert not rows[2].get('error') and not rows[2]['result'].get('isError')
+    assert rows[3].get('error') or rows[3]['result'].get('isError')
+    assert not (tmp_path/'synthetic.db').exists()
+
+
+def test_bad_launch_argument(packaged, tmp_path):
+    p = invoke(packaged/'server/serve.py',tmp_path,[],args=['--grant-all'])
+    assert p.returncode != 0 and not p.stdout
+
+
+@pytest.mark.skipif(TOOL == 'plexus', reason='Plexus has no mandatory state binding')
+@pytest.mark.parametrize('value',['','relative/path'])
+def test_binding_required(packaged,tmp_path,value):
+    key = 'MNEME_STATE' if TOOL == 'mneme' else 'RELAY_MCP_ROOT'
+    p = invoke(packaged/'server/serve.py',tmp_path,[],{key:value})
+    assert p.returncode != 0 and 'absolute' in p.stderr
+
+
+def test_package_deterministic(tmp_path):
+    first=build(tmp_path/'a')[0]; second=build(tmp_path/'b')[0]
+    assert first.read_bytes() == second.read_bytes()
+    with pytest.raises(FileExistsError):
+        build(tmp_path/'a')
+
+
+def test_linked_payload_refused(tmp_path):
+    source=tmp_path/'source'; source.mkdir()
+    target=tmp_path/'target'; target.mkdir()
+    try:
+        (source/'link').symlink_to(target,target_is_directory=True)
+    except OSError:
+        if os.name != 'nt':
+            raise
+        p=subprocess.run(['cmd','/c','mklink','/J',str(source/'link'),str(target)],capture_output=True)
+        assert p.returncode == 0
+    with pytest.raises(ValueError,match='linked'):
+        entries(source)
+
+
+def test_manifest_permissions_and_parity():
+    docs=manifests(qualify('dev')[0],True)
+    native=json.loads(docs['manifest.json'])
+    plugin=json.loads(docs['plugin.json'])
+    assert native['version'] == plugin['version']
+    assert native['server']['mcp_config']['args'] == []
+    assert 'annotations' not in str(docs)
+
+
+@pytest.mark.skipif(TOOL != 'mneme', reason='Mneme scope')
+def test_memory_write_refused(packaged,tmp_path):
+    p=invoke(packaged/'server/serve.py',tmp_path,[request(1,'tools/call',name='mneme.remember',
+             arguments={'session':'test','turns':[{'role':'user','text':'synthetic'}]})])
+    assert p.returncode == 0
+    assert json.loads(p.stdout)['error']
+    assert not (tmp_path/'synthetic.db').exists()
+
+
+@pytest.mark.skipif(TOOL != 'relay', reason='Relay scope')
+def test_relay_environment_cannot_grant(packaged,tmp_path):
+    p=invoke(packaged/'server/serve.py',tmp_path,[request(1,'tools/call',name='local_agent_run',
+        arguments={'goal':'do not run','root':str(tmp_path),'allow_write':True,'allow_exec':True})])
+    assert p.returncode == 0
+    row=json.loads(p.stdout)
+    assert row['result'].get('isError'),row
+    assert 'GRANT' in p.stdout.upper() or 'PERMISSION' in p.stdout.upper() or 'REFUSED' in p.stdout.upper()
+
+
+@pytest.mark.skipif(TOOL != 'plexus', reason='Plexus scope')
+def test_declarative_discovery(packaged,tmp_path):
+    p=invoke(packaged/'server/serve.py',tmp_path,[request(1,'tools/call',name='plexus_discover',arguments={})])
+    assert p.returncode == 0
+    result=json.loads(json.loads(p.stdout)['result']['content'][0]['text'])
+    assert result['organs'] and result['edges']
+
+
+def test_client_root_expansion_is_client_specific():
+    docs=manifests(qualify('dev')[0],False)
+    assert b'${PLUGIN_ROOT}' in docs['mcp.json']
+    assert b'${CLAUDE_PLUGIN_ROOT}' in docs['.mcp.json']
+    assert b'${PLUGIN_ROOT}' not in docs['.mcp.json']
+
+
+def test_version_drift_refused(tmp_path,monkeypatch):
+    import build_client_package as package
+    (tmp_path/'pyproject.toml').write_text('[project]\nversion="0.9.0"\n')
+    source=tmp_path/'src'/TOOL; source.mkdir(parents=True)
+    (source/'__init__.py').write_text('__version__="0.8.0"\n')
+    monkeypatch.setattr(package,'ROOT',tmp_path)
+    with pytest.raises(ValueError,match='versions differ'):
+        package.qualify('dev')
+
+@pytest.mark.parametrize('name',['.env','.env.json','state.db','credential.key','secret.token'])
+def test_state_and_credentials_refused_before_archiving(tmp_path,name):
+    root=tmp_path/'payload'; root.mkdir()
+    (root/name).write_text('synthetic-not-a-secret')
+    with pytest.raises(ValueError,match='unsupported package input'):
+        entries(root)
+
+
+def test_unreleased_candidate_cannot_be_packaged_as_release():
+    if 'unreleased' in next(line for line in (ROOT/'CHANGELOG.md').read_text().splitlines() if line.startswith('## ')).lower():
+        with pytest.raises(ValueError,match='unreleased marker'):
+            qualify('release')
+
+
+def test_native_builder_pins_reproducibility_environment(tmp_path,monkeypatch):
+    import build_client_package as package
+    class StopBeforeBuild(Exception):
+        pass
+    def capture(command,**kwargs):
+        env=kwargs['env']
+        assert env['PYTHONHASHSEED']=='0'
+        assert env['SOURCE_DATE_EPOCH'].isdigit()
+        assert 'SYNTHETIC_SECRET' not in env
+        raise StopBeforeBuild
+    monkeypatch.setenv('PYTHONHASHSEED','random')
+    monkeypatch.setenv('SOURCE_DATE_EPOCH','1')
+    monkeypatch.setenv('SYNTHETIC_SECRET','synthetic-not-a-secret')
+    monkeypatch.setattr(package.sys,'platform','win32')
+    monkeypatch.setattr(package.subprocess,'run',capture)
+    monkeypatch.setattr(package,'qualify',lambda mode: ('0.3.0' if TOOL=='plexus' else '0.6.0','synthetic-head'))
+    monkeypatch.setattr(package.subprocess,'check_output',lambda *a,**k:'1234567890\n')
+    with pytest.raises(StopBeforeBuild):
+        package.build(tmp_path/'native-build',native=True)

plexus_mesh-0.3.0/tests/test_native_workflow_gate.py

@@ -0,0 +1,17 @@
+"""A successful-looking protocol response cannot replace workflow evidence."""
+import importlib.util
+import json
+from pathlib import Path
+from types import SimpleNamespace
+import pytest
+
+
+def test_workflow_rejects_protocol_success_without_effect(tmp_path, monkeypatch):
+    path = Path(__file__).resolve().parents[1] / 'scripts/check_native_workflow.py'
+    spec = importlib.util.spec_from_file_location('plexus_workflow', path)
+    module = importlib.util.module_from_spec(spec); spec.loader.exec_module(module)
+    response = {'result': {'content': [{'type': 'text', 'text': json.dumps({'edges': []})}]}}
+    monkeypatch.setattr(module.subprocess, 'run', lambda *a, **k:
+        SimpleNamespace(returncode=0, stdout=json.dumps(response), stderr=''))
+    with pytest.raises(ValueError):
+        module.check_workflow(tmp_path / 'fake.exe', tmp_path, {})

{plexus_mesh-0.2.2 → plexus_mesh-0.3.0}/tests/test_release_metadata.py

@@ -4,7 +4,7 @@ from pathlib import Path
 
 
 ROOT = Path(__file__).resolve().parents[1]
-VERSION = "0.2.2"
+VERSION = "0.3.0"
 
 
 def test_release_identity_is_aligned():
@@ -27,7 +27,7 @@ def test_install_docs_are_github_only_and_hash_verified():
     assert "SHA256SUMS.txt" in readme
     assert "Get-FileHash -Algorithm SHA256" in readme
     assert "Invoke-WebRequest" in readme
-    assert "not published on PyPI" in readme
+    assert "`plexus-mesh` 0.2.2 is published on PyPI" in readme
     assert "pip install git+https://github.com/HarperZ9/plexus.git" not in readme