robustrep 0.1.0__tar.gz → 0.1.2__tar.gz

robustrep-0.1.2/CHANGELOG.md

@@ -0,0 +1,132 @@
+# Changelog
+
+All notable changes to robustrep are recorded here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the project is pre-1.0,
+so a `0.x` bump may change published numbers without changing the API.
+
+## [0.1.2] — 2026-10-03
+
+A dependency security release. No API, CLI or scoring changes.
+
+### Security — Fixed
+
+- **urllib3 floor raised to 2.8.** urllib3 2.6–2.7 can enter an infinite loop
+  on a chunked deflate stream (PYSEC-2026-4176) and buffer an unbounded
+  chunk-size line into memory (PYSEC-2026-4177). Both are reachable from
+  `fetch`, which reads responses from attacker-chosen evidence hosts, so a
+  hostile URI could hang or exhaust the fetcher. 2.8 also fixes HTTPS-proxy TLS
+  settings being ignored (PYSEC-2026-4175). The CI pin moves to 2.8.0 as well.
+
+## [0.1.1] — 2026-09-15
+
+A security release: it closes every finding of an external security review of
+0.1.0. There are no API changes — the library entry points and CLI commands are
+the same, and existing calls keep working — but **scores will differ from 0.1.0
+for any (tag, scale) group that held a poisoning value**, because normalization
+no longer rescales a group by its own extremes.
+
+### Security — Fixed
+
+- **SSRF guard bypass via a URL-parser differential.** The guard vetted what
+  `urlsplit` saw, but two transforms ran between it and the socket. `urllib3`'s
+  parser treats a backslash as an authority terminator, so
+  `http://127.0.0.1:6379\@example.com/` vetted as `example.com` and connected to
+  `127.0.0.1:6379`; and `requests`' `requote_uri()` percent-*decodes* unreserved
+  characters in the authority after the guard has run, so
+  `http://169.254.169.25%34/` vetted as an unresolvable-looking host and
+  connected to `169.254.169.254`. The request URL is now rebuilt from the vetted
+  components rather than the attacker's string, hostnames must be LDH labels
+  (nothing requoting would rewrite), and `urlsplit` and `urllib3` must agree on
+  scheme/host/port before anything is fetched.
+  **Operators who ran `fetch` with 0.1.0 on a host with reachability into an
+  internal network should treat it as a possible internal-GET / IMDS-touch
+  event.**
+- **Normalization no longer min-max rescales by group extremes.** `value` is an
+  attacker-chosen int128 on ERC-8004, and rule selection used to key off a
+  group's own min and max: one record of `2**127-1` pushed an honest `percent`
+  group into a min-max fallback and squashed every honest score in it to ~0, and
+  two records (+max and −min) flattened the group to exactly 0.5 — a breakdown
+  point of 1/n in the normalizer, ahead of the weighted median's ~0.5. Rule
+  selection now tolerates a bounded *count* of out-of-range records, clips those
+  records into the range they are scored against, and falls back to a percentile
+  rank; every rung but `rank` maps a record from its own value alone.
+- **Sybil clustering degrades under pair budgets instead of aborting.**
+  `sybil_max_group`, `sybil_max_pairs` and `sybil_max_pairs_per_ratee` bound the
+  candidate pairs a run examines. A run that hits a budget finishes with an
+  under-merged clustering rather than failing, and says so: what was skipped is
+  disclosed in the report's Limitations and in `cluster_stats` in `scores.json`,
+  including which way the error points (under-merged, never over-merged).
+- **Evidence tx-hash lookups are capped per URI and per run.** A single 200 KB
+  evidence document can pack ~2,985 distinct 64-hex strings, each of which used
+  to cost an `eth_getTransactionByHash` call. At most 8 distinct hashes per URI
+  and 20,000 per run are now looked up. A URI cut short by the run budget is
+  cached with a `lookup-budget:N` note and retried by later `fetch` runs up to 3
+  attempts, and the number of still-starved URIs is published in provenance.
+- **Etherscan key redacted from urllib3 DEBUG logs.** urllib3 logs every request
+  line — path and query string included — at DEBUG, which `robustrep --verbose`
+  turns on, so a key passed as a query parameter could reach any log sink. A
+  logging filter now substitutes the key value in records passing urllib3's
+  loggers. **Rotate `ETHERSCAN_API_KEY` if DEBUG logs were ever shared or
+  stored.**
+- **Further input bounds.** Response bodies are size-capped as they are read;
+  RPC-supplied block timestamps and log topics are validated, and an undecodable
+  log is skipped instead of aborting a sync; rater-profile pagination parameters
+  echoed back by the API are allowlisted rather than followed as given;
+  multi-tag bootstrap draws are chunked so peak memory stays bounded; and
+  `urllib3 >= 2.6` is now required — the decoded-read cap that bounds a
+  decompression bomb first exists in 2.6.0, and 2.0–2.5 decompress the whole
+  body before truncating.
+
+### Added
+
+- `--sybil-max-group`, `--sybil-max-pairs` and `--sybil-max-pairs-per-ratee` on
+  `score` and `report`.
+- `--min-clusters` on `report`.
+- `fetch --reprofile-raters`, to re-profile raters already cached.
+- `SECURITY.md` (threat model, supported versions, private reporting) and
+  `constraints.txt` (the fully pinned environment CI installs and audits).
+- Provenance now carries `norm_fit_share`, `norm_rule_counts`, `cluster_stats`,
+  the evidence lookup caps the *fetch* run actually used,
+  `evidence_lookup_starved_uris`, and the full `versions` map — the same mapping
+  in `report.md` and `scores.json`, so the two artifacts cannot disagree about
+  the stack that produced them.
+- Python 3.13 in the CI matrix (now 3.10–3.13).
+
+### Changed
+
+- `reports/latest/` publishes an allowlist of files (`report.md`,
+  `scores.json`, `fig*.png`), never whatever the last run left in the block
+  directory; it is served by GitHub Pages.
+- `export_json` refuses to write a payload containing anything shaped like an
+  EVM address — a backstop against de-anonymising a rater through a future
+  column, not a sanitizer.
+- IPFS gateways are `ipfs.io` and `dweb.link` (`cloudflare-ipfs.com` was
+  retired).
+- `__version__` is derived from the installed distribution metadata instead of a
+  literal that could go stale after a version bump.
+
+### Known limitations
+
+- **DNS rebinding is unmitigated.** The guard resolves an evidence URI's host
+  and checks those addresses, but `requests`/`urllib3` resolve it again to make
+  the connection. The persisted `(level, note)` pair makes a bypass a narrow
+  oracle rather than a blind request, which is why it is tracked rather than
+  shrugged off; a pinned-IP transport adapter is planned for v0.2. Until then,
+  run `fetch` on a host with no privileged reach into an internal network.
+- **Normalization precedes sybil collapse.** Rule selection runs per (tag,
+  scale) group over raw records, before clustering collapses a farm into one
+  vote, so a perfectly collapsed farm can still have forced a rung change that
+  re-levels every honest record in its group. `norm_rule_counts` in provenance
+  is the signal — diff it run over run.
+- **`rank`-rung scores are group-relative.** When a group falls back to
+  percentile rank, a 0.8 there means a position within that group, not the same
+  thing as a 0.8 in another group.
+
+## [0.1.0] — 2026-09-14
+
+Initial release on PyPI: the scoring library, the Base ERC-8004 adapter, and the
+reproducible report.
+
+[0.1.2]: https://github.com/iamdongwang/robustrep/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/iamdongwang/robustrep/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/iamdongwang/robustrep/releases/tag/v0.1.0

robustrep-0.1.2/MANIFEST.in

@@ -0,0 +1,9 @@
+graft tests
+include constraints.txt
+include SECURITY.md
+include CHANGELOG.md
+global-exclude __pycache__ *.pyc .DS_Store
+# Local run artifacts that can sit in a dirty working tree at build time --
+# a scratch sqlite db next to the e2e fixtures, a log, a .env. None of it
+# belongs in a published sdist.
+global-exclude *.db *.db-wal *.db-shm *.log *.sqlite .env

robustrep-0.1.2/PKG-INFO

@@ -0,0 +1,90 @@
+Metadata-Version: 2.4
+Name: robustrep
+Version: 0.1.2
+Summary: Robust, transport-agnostic reputation scoring for AI agents
+Author: Dong Wang
+License: Apache-2.0
+Project-URL: Homepage, https://github.com/iamdongwang/robustrep
+Project-URL: Repository, https://github.com/iamdongwang/robustrep
+Project-URL: Issues, https://github.com/iamdongwang/robustrep/issues
+Project-URL: Report, https://iamdongwang.github.io/robustrep/reports/latest/report.md
+Classifier: Development Status :: 3 - Alpha
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Scientific/Engineering :: Information Analysis
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pandas<4,>=2.0
+Requires-Dist: numpy>=1.24
+Requires-Dist: eth-abi>=5.0
+Requires-Dist: eth-hash[pycryptodome]>=0.5
+Requires-Dist: requests>=2.31
+Requires-Dist: urllib3>=2.8
+Requires-Dist: tabulate>=0.9
+Requires-Dist: matplotlib>=3.7
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: pytest-cov>=5; extra == "dev"
+Requires-Dist: build; extra == "dev"
+Requires-Dist: twine; extra == "dev"
+Requires-Dist: pip-audit; extra == "dev"
+Dynamic: license-file
+
+# robustrep
+
+Robust, transport-agnostic reputation scoring for AI agents.
+
+Feed it any table of `(rater, ratee, value, scale, tag, ts, evidence_uri, source)` and it returns a
+robust score per ratee that resists Sybil raters and evidence-free ratings. Ships with a Base-chain
+ERC-8004 adapter and a reproducible report.
+
+Status: v0.1.1 released on PyPI. Design spec and plan live in the parent workspace; a summary is in `reports/latest/report.md`.
+Release notes, including the security fixes in 0.1.1: [CHANGELOG.md](CHANGELOG.md).
+
+## Install
+
+    pip install robustrep
+
+## Library
+
+```python
+import pandas as pd
+from robustrep import Config, score
+
+records = pd.DataFrame([...])  # columns: rater, ratee, value, scale, tag, ts, evidence_uri, source
+result = score(records, Config())
+```
+
+## Base ERC-8004 report
+
+    robustrep fetch  --db data/base.db          # pull events (resumable)
+    robustrep score  --db data/base.db --out scores.csv
+    robustrep report --db data/base.db --out-dir reports
+
+Rater profiles: Blockscout (free, no key) by default; Etherscan V2 requires a paid plan for Base.
+Pick a source explicitly with `fetch --profile-source {auto,blockscout,etherscan,none}`.
+
+Latest scores: `reports/latest/scores.json`, also served at
+https://iamdongwang.github.io/robustrep/reports/latest/scores.json
+
+## Security considerations
+
+Everything robustrep reads is written by untrusted parties: on-chain values, tags, evidence URIs and
+addresses, plus whatever the RPC/Blockscout endpoints and evidence hosts return.
+
+`robustrep fetch` makes outbound HTTP from *your* machine to evidence URIs chosen by the rated party.
+Those go through an SSRF guard (scheme/host allowlist, parser cross-check, canonical rebuild, refusal
+of private/reserved addresses, manual redirects, a size cap and per-socket-operation timeouts — not a
+wall-clock bound). Its one known SSRF bypass, DNS rebinding, is unmitigated in v0.1 — so run `fetch`
+on a host with no privileged reach into an internal network. API keys should come from the
+environment (`ETHERSCAN_API_KEY`), never the source tree; `--etherscan-key` is an escape hatch that
+takes precedence over the environment and is visible to anyone who can run `ps`.
+
+Full threat model and private reporting instructions: [SECURITY.md](SECURITY.md).

robustrep-0.1.2/README.md

@@ -0,0 +1,51 @@
+# robustrep
+
+Robust, transport-agnostic reputation scoring for AI agents.
+
+Feed it any table of `(rater, ratee, value, scale, tag, ts, evidence_uri, source)` and it returns a
+robust score per ratee that resists Sybil raters and evidence-free ratings. Ships with a Base-chain
+ERC-8004 adapter and a reproducible report.
+
+Status: v0.1.1 released on PyPI. Design spec and plan live in the parent workspace; a summary is in `reports/latest/report.md`.
+Release notes, including the security fixes in 0.1.1: [CHANGELOG.md](CHANGELOG.md).
+
+## Install
+
+    pip install robustrep
+
+## Library
+
+```python
+import pandas as pd
+from robustrep import Config, score
+
+records = pd.DataFrame([...])  # columns: rater, ratee, value, scale, tag, ts, evidence_uri, source
+result = score(records, Config())
+```
+
+## Base ERC-8004 report
+
+    robustrep fetch  --db data/base.db          # pull events (resumable)
+    robustrep score  --db data/base.db --out scores.csv
+    robustrep report --db data/base.db --out-dir reports
+
+Rater profiles: Blockscout (free, no key) by default; Etherscan V2 requires a paid plan for Base.
+Pick a source explicitly with `fetch --profile-source {auto,blockscout,etherscan,none}`.
+
+Latest scores: `reports/latest/scores.json`, also served at
+https://iamdongwang.github.io/robustrep/reports/latest/scores.json
+
+## Security considerations
+
+Everything robustrep reads is written by untrusted parties: on-chain values, tags, evidence URIs and
+addresses, plus whatever the RPC/Blockscout endpoints and evidence hosts return.
+
+`robustrep fetch` makes outbound HTTP from *your* machine to evidence URIs chosen by the rated party.
+Those go through an SSRF guard (scheme/host allowlist, parser cross-check, canonical rebuild, refusal
+of private/reserved addresses, manual redirects, a size cap and per-socket-operation timeouts — not a
+wall-clock bound). Its one known SSRF bypass, DNS rebinding, is unmitigated in v0.1 — so run `fetch`
+on a host with no privileged reach into an internal network. API keys should come from the
+environment (`ETHERSCAN_API_KEY`), never the source tree; `--etherscan-key` is an escape hatch that
+takes precedence over the environment and is visible to anyone who can run `ps`.
+
+Full threat model and private reporting instructions: [SECURITY.md](SECURITY.md).

robustrep-0.1.2/SECURITY.md

@@ -0,0 +1,80 @@
+# Security Policy
+
+## Supported versions
+
+robustrep is pre-1.0. Only the latest published `0.x` release receives security
+fixes; older `0.x` releases are not patched.
+
+| Version        | Supported |
+| -------------- | --------- |
+| latest `0.x`   | yes       |
+| any earlier    | no        |
+
+## Reporting a vulnerability
+
+Please report privately, not in a public issue. Use GitHub's **Report a
+vulnerability** button on the repository's
+[Security tab](https://github.com/iamdongwang/robustrep/security/advisories)
+(private vulnerability reporting is enabled). Include what you did, what
+happened, and what you expected; a reproducer helps.
+
+Response target: an acknowledgement within **7 days**, with an assessment and
+a plan (fix, mitigation, or a reasoned "not a vulnerability") in the same
+thread. Please give us a chance to ship a fix before disclosing publicly.
+
+## Threat model
+
+robustrep reads data written by arbitrary, unauthenticated third parties and
+must never be trusted to be reading anything benign.
+
+**Untrusted inputs.** On-chain feedback is attacker-controlled in every field:
+values, tags, evidence URIs and addresses. So are the responses of the RPC
+endpoints and the Blockscout API the adapters talk to, and so is every byte
+served by an evidence host. Nothing from these sources is treated as
+authoritative; all of it is validated, bounded and normalized before use.
+
+**Outbound fetches are the sharp edge.** `robustrep fetch` performs outbound
+HTTP from the operator's own machine to evidence URIs chosen by the party being
+rated. Those requests go through an SSRF guard
+(`robustrep/sources/evidence_fetch.py`): scheme/host allowlist (http/https on
+ports 80/443, LDH hostnames only, no bare IP literals, no non-ASCII hosts),
+a cross-check that `urllib3` and `urlsplit` agree on scheme/host/port, a
+request URL rebuilt from the vetted components rather than the attacker's raw
+string, refusal of any address that resolves to a private/loopback/link-local/
+reserved range, manually followed redirects (re-vetted at every hop, capped in
+count), a hard cap on response size, and per-socket-operation (connect and
+read) timeouts -- which bound each socket operation, not the request as a
+whole: there is no wall-clock cap on a slow-drip response.
+
+**Residual limitation: DNS rebinding.** The guard resolves the hostname and
+checks those addresses, but `requests`/`urllib3` resolves it again to make the
+connection. An attacker who can answer differently between the two lookups can
+still cause a GET to a private address. The response body is never persisted
+or reported -- but what *is* persisted, the `(level, note)` pair recorded per
+evidence URI, makes the bypass at least a four-state oracle about the target:
+no response at all, a response with no markers in it, a response containing a
+transaction hash or a task-id key, or a hash involving the rater/owner
+addresses -- plus a state per further note the cache can hold (`fetch-error`,
+`lookup-budget:N`). A narrow leak rather than a blind request, which is why the
+gap is tracked instead of shrugged off. It is documented in full in
+`robustrep/sources/evidence_fetch.py` and pinned by a strict-xfail test; a
+pinned-IP transport adapter is scheduled for v0.2. Until then: **run `fetch`
+on a host that has no privileged reachability into an internal network** (a
+laptop on a plain internet connection, or a throwaway cloud box), not on a
+machine inside a private network or with access to a cloud metadata service.
+
+**Secrets.** API keys (e.g. an Etherscan key) should come from the environment
+(`ETHERSCAN_API_KEY`). `--etherscan-key` exists as an escape hatch and takes
+precedence over the environment, but a command line is world-readable via `ps`
+on most systems and lands in shell history -- prefer the environment variable
+and treat the flag as a last resort. Never put a key in a config file in the
+repository, and never commit a `.env` file (`.gitignore` refuses them).
+
+Do not embed a key in an RPC URL either. `RpcError` messages are redacted to
+`scheme://host` precisely so a key in a URL cannot leak into CLI output or a
+bug report -- but `--verbose` turns on DEBUG logging, and the DEBUG line for a
+failed RPC attempt carries the full transport exception (`exc_info`), whose
+text can include the request URL the exception was raised against. The
+urllib3 log filter only scrubs an exact Etherscan key out of string log
+records, not out of an exception's own repr. So: keep keys out of RPC URLs,
+and do not hand `--verbose` logs to anyone you would not hand the keys to.

robustrep-0.1.2/constraints.txt

@@ -0,0 +1,118 @@
+# Fully-pinned CI environment for robustrep.
+#
+# Generated from a known-good local dev venv:
+#     .venv/bin/pip freeze | grep -v '^-e ' > constraints.txt
+# (the editable `-e ...robustrep` line is dropped; everything else is pinned `==`).
+#
+# Used ONLY as a pip constraints file in CI:
+#     pip install -e ".[dev]" -c constraints.txt
+# so every workflow run resolves the same dependency set and `pip-audit` sees
+# exactly what the tests ran against. It is deliberately NOT the library's
+# dependency metadata: `pyproject.toml` keeps open lower bounds so installing
+# `robustrep` never forces these exact versions on a downstream user.
+#
+# Two things `pip freeze` does not emit are appended by hand:
+#   * `pip` itself (freeze omits it), pinned so the runner image's own pip does
+#     not drift -- CI installs it explicitly, a constraint alone won't upgrade pip;
+#   * dependencies that only install on Linux (keyring's secret-storage backend
+#     and its crypto chain), which a macOS freeze can never see. They are
+#     marker-gated, so they stay uninstalled here and pinned in CI.
+#
+# Refresh by re-running the command above after upgrading the dev venv, keeping
+# the hand-added block below.
+annotated-doc==0.0.5
+annotated-types==0.8.0
+backports.tarfile==1.2.0
+boolean.py==5.0
+build==1.6.1
+CacheControl==0.14.4
+certifi==2026.7.22
+charset-normalizer==3.5.1
+contourpy==1.3.2
+coverage==7.16.1
+cycler==0.12.1
+cyclonedx-python-lib==11.12.0
+cytoolz==1.1.0
+defusedxml==0.7.1
+docutils==0.23
+eth-hash==0.8.0
+eth-typing==6.0.0
+eth-utils==6.0.0
+eth_abi==6.0.0
+exceptiongroup==1.3.1
+filelock==3.32.6
+fonttools==4.65.0
+id==1.6.1
+idna==3.19
+importlib_metadata==9.0.1
+iniconfig==2.3.0
+jaraco.classes==3.4.0
+jaraco.context==6.1.2
+jaraco.functools==4.6.0
+keyring==25.7.0
+kiwisolver==1.5.1
+license-expression==30.4.4
+markdown-it-py==4.2.0
+matplotlib==3.10.9
+mdurl==0.1.2
+more-itertools==11.1.0
+msgpack==1.2.2
+nh3==0.3.7
+numpy==2.2.6
+packageurl-python==0.17.6
+packaging==26.3
+pandas==2.3.3
+parsimonious==0.10.0
+pillow==12.3.0
+pip-requirements-parser==32.0.1
+pip_api==0.0.35
+pip_audit==2.10.1
+platformdirs==4.11.8
+pluggy==1.6.0
+py-serializable==2.1.0
+pycryptodome==3.23.0
+pydantic==2.13.5
+pydantic_core==2.46.5
+Pygments==2.21.0
+pyparsing==3.3.2
+pyproject_hooks==1.2.0
+pytest==9.1.1
+pytest-cov==7.1.0
+python-dateutil==2.9.0.post0
+pytz==2026.3.post1
+readme_renderer==46.0
+regex==2026.9.10
+requests==2.34.2
+requests-toolbelt==1.0.0
+rfc3986==2.0.0
+rich==15.0.0
+shellingham==1.5.4
+six==1.17.0
+sortedcontainers==2.4.0
+tabulate==0.10.0
+tomli==2.4.1
+tomli_w==1.2.0
+toolz==1.1.0
+twine==7.0.0
+typer==0.27.2
+typing-inspection==0.4.4
+typing_extensions==4.16.0
+tzdata==2026.4
+urllib3==2.8.0
+zipp==4.1.0
+# -- hand-added (not emitted by `pip freeze` on the dev box) -----------------
+# pip itself: freeze omits it. CI installs this version explicitly before the
+# project, since a constraint alone never upgrades the runner image's pip.
+pip==26.2.1
+# Linux-only: twine -> keyring pulls the secret-storage backend and its crypto
+# chain under `sys_platform == "linux"`, so a macOS freeze can never see them
+# while CI installs them on every job. Versions resolved with
+#     pip install --dry-run --platform manylinux2014_x86_64 \
+#         --only-binary=:all: SecretStorage jeepney
+# (identical for 3.10 and 3.13). Marker-gated, so pinning them here is inert
+# off Linux -- but it keeps them inside pip-audit's view.
+SecretStorage==3.5.0
+jeepney==0.9.0
+cryptography==50.0.1
+cffi==2.1.1
+pycparser==3.0

robustrep-0.1.2/pyproject.toml

@@ -0,0 +1,69 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "robustrep"
+version = "0.1.2"
+description = "Robust, transport-agnostic reputation scoring for AI agents"
+readme = "README.md"
+license = { text = "Apache-2.0" }
+authors = [{ name = "Dong Wang" }]
+requires-python = ">=3.10"
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "License :: OSI Approved :: Apache Software License",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Topic :: Security",
+  "Topic :: Scientific/Engineering :: Information Analysis",
+]
+dependencies = [
+  "pandas>=2.0,<4",
+  "numpy>=1.24",
+  "eth-abi>=5.0",
+  "eth-hash[pycryptodome]>=0.5",
+  "requests>=2.31",
+  # >=2.6, not >=2: the decoded-read cap `evidence_fetch` relies on to bound a
+  # decompression bomb (`max_length` on urllib3's decoders) first exists in
+  # 2.6.0. On 2.0-2.5 the same call decompresses the whole body before
+  # truncating -- measured at a 455 MB peak against 0.8 MB on 2.7.
+  # >=2.8: 2.6-2.7 can loop forever on a chunked deflate stream and buffer an
+  # unbounded chunk-size line (PYSEC-2026-4176/4177), both reachable from an
+  # attacker-chosen evidence host.
+  "urllib3>=2.8",
+  "tabulate>=0.9",
+  "matplotlib>=3.7",
+  "typer>=0.12",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "pytest-cov>=5", "build", "twine", "pip-audit"]
+
+[project.urls]
+Homepage = "https://github.com/iamdongwang/robustrep"
+Repository = "https://github.com/iamdongwang/robustrep"
+Issues = "https://github.com/iamdongwang/robustrep/issues"
+Report = "https://iamdongwang.github.io/robustrep/reports/latest/report.md"
+
+[project.scripts]
+robustrep = "robustrep.cli:app"
+
+[tool.setuptools.packages.find]
+include = ["robustrep*"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+markers = ["live: needs network; run weekly, not on every push"]
+addopts = "-m 'not live'"
+filterwarnings = ["error"]
+
+[tool.coverage.run]
+source = ["robustrep"]
+
+[tool.coverage.report]
+fail_under = 80
+show_missing = true

robustrep-0.1.2/robustrep/__init__.py

@@ -0,0 +1,12 @@
+"""robustrep: robust, transport-agnostic reputation scoring for AI agents."""
+from .config import Config
+from .pipeline import score
+
+__all__ = ["Config", "score"]
+from importlib import metadata as _metadata
+
+try:
+    # Single source of truth: pyproject.toml, via the installed distribution.
+    __version__ = _metadata.version("robustrep")
+except _metadata.PackageNotFoundError:  # running from a bare checkout without an install
+    __version__ = "0.0.0+unknown"

{robustrep-0.1.0 → robustrep-0.1.2}/robustrep/aggregate.py

@@ -23,11 +23,13 @@ _TIE_EPS = 1e-9
 # weight for the CI to be considered meaningful.
 MIN_VALID_BOOT_FRACTION = 0.1
 
-# Cap on the number of (resample x vote) float64 cells materialized at once
-# by `bootstrap_ci`'s chunked multinomial draw, so peak memory stays bounded
-# even for a ratee with thousands of votes: a chunk holds at most this many
-# cells regardless of how large `n_boot` is.
-_MAX_BOOT_CHUNK_CELLS = 2_000_000
+# Cap on the number of (resample x vote) cells materialized at once by a
+# chunked bootstrap draw, so peak memory stays bounded even for a ratee with
+# thousands of votes: a chunk holds at most this many cells regardless of how
+# large `n_boot` is. Public because `robustrep.pipeline._ci` chunks its
+# multi-tag bootstrap against the same budget (see M3 there); one constant so
+# the two paths can never bound memory differently.
+MAX_BOOT_CHUNK_CELLS = 2_000_000
 
 
 def _validate(values: np.ndarray, weights: np.ndarray, name: str) -> tuple[np.ndarray, np.ndarray]:
@@ -169,9 +171,9 @@ def bootstrap_ci(
     and the cumulative sum of `counts * sorted_weights` along each row gives
     every resample's weighted median in one vectorized pass (see
     `_bootstrap_draws`). Processed in chunks of at most
-    `max(1, 2_000_000 // n)` resamples so peak memory stays bounded even for
-    a ratee with thousands of votes; this is what keeps the per-ratee
-    bootstrap affordable at ~28k ratees.
+    `max(1, MAX_BOOT_CHUNK_CELLS // n)` resamples so peak memory stays
+    bounded even for a ratee with thousands of votes; this is what keeps the
+    per-ratee bootstrap affordable at ~28k ratees.
 
     Inputs are validated exactly like `weighted_median` (see `_validate`).
     A resample whose weights sum to zero has an undefined weighted median
@@ -186,7 +188,7 @@ def bootstrap_ci(
     order = np.argsort(values, kind="stable")
     v_sorted, w_sorted = values[order], weights[order]
 
-    chunk_size = max(1, _MAX_BOOT_CHUNK_CELLS // n)
+    chunk_size = max(1, MAX_BOOT_CHUNK_CELLS // n)
     boots = _bootstrap_draws(v_sorted, w_sorted, n_boot, rng, chunk_size)
 
     min_valid = max(2, int(n_boot * MIN_VALID_BOOT_FRACTION))