sable-sphynx 0.7.0.dev0__tar.gz

sable_sphynx-0.7.0.dev0/.gitattributes

@@ -0,0 +1,41 @@
+# Retain exact reviewed release bytes on every runner.
+dist/rag-parity-0.4.0.dev5-verified/** -text
+
+dist/sable-sphynx-0.4.0/** -text
+
+# New paper protocols use exact LF bytes for portable implementation receipts.
+src/sphynx/rag_papers/*.py text eol=lf
+src/sphynx/data/rag-paper-*.json text eol=lf
+tests/test_rag_paper*.py text eol=lf
+tools/integration/*paper*.py text eol=lf
+examples/rag_papers.py text eol=lf
+docs/rag-paper-methods.md text eol=lf
+docs/explorations.md text eol=lf
+.github/workflows/rag-papers.yml text eol=lf
+
+# Immutable 0.5.0 release bytes.
+dist/sable-sphynx-0.5.0/** -text
+
+# Family catalogs pin exact LF implementation bytes across every checkout.
+src/sphynx/statistical_rerank.py text eol=lf
+src/sphynx/learned_rerank.py text eol=lf
+src/sphynx/rerank_family_contracts.py text eol=lf
+
+# Native analytical response receipts pin exact LF fixture bytes.
+tests/fixtures/analytical/*.json text eol=lf
+
+# Recovered private server files are bound byte for byte by bridge/SOURCE.json.
+services/private-control-plane/bridge/src/** -text
+
+# Linux startup and frozen probe source retain portable LF bytes.
+services/private-control-plane/staging/*.sh text eol=lf
+services/private-control-plane/staging/candidate/*.py text eol=lf
+
+# First Sable preview publication; frozen reviewed distribution bytes.
+dist/sable-sphynx-0.7.0.dev0/** -text
+
+# Permanent Linux boot scripts preserve their reviewed bytes.
+services/private-control-plane/permanent/*.sh text eol=lf
+
+# Original server resource closure is bound by its own image/hash manifest.
+services/private-control-plane/bridge/runtime-data/** -text

sable_sphynx-0.7.0.dev0/.github/workflows/publish-pypi.yml

@@ -0,0 +1,211 @@
+name: Sable Sphynx validate and publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      destination:
+        description: Validate only, or publish the approved public package
+        type: choice
+        options: [validate, pypi]
+        default: validate
+        required: true
+      approved_manifest_sha256:
+        description: Exact SHA256 of PUBLICATION.json from the reviewed packet (required for pypi)
+        type: string
+        required: false
+      confirmation:
+        description: For publication enter publish sable-sphynx 0.7.0.dev0
+        type: string
+        required: false
+  pull_request:
+    paths:
+      - dist/sable-sphynx-0.7.0.dev0/**
+      - tools/release/**
+      - .github/workflows/publish-pypi.yml
+  push:
+    branches: [main]
+    paths:
+      - dist/sable-sphynx-0.7.0.dev0/**
+      - tools/release/**
+      - .github/workflows/publish-pypi.yml
+
+permissions:
+  contents: read
+
+jobs:
+  installed:
+    name: ${{ matrix.slot }} approved bytes
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {slot: windows-311, os: windows-latest, python: '3.11'}
+          - {slot: windows-312, os: windows-latest, python: '3.12'}
+          - {slot: windows-314, os: windows-latest, python: '3.14'}
+          - {slot: macos-311, os: macos-latest, python: '3.11'}
+          - {slot: macos-312, os: macos-latest, python: '3.12'}
+          - {slot: linux-311, os: ubuntu-latest, python: '3.11'}
+          - {slot: linux-312, os: ubuntu-latest, python: '3.12'}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            tools/release
+            dist/sable-sphynx-0.7.0.dev0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: ${{ matrix.python }}
+      # Every slot installs the same prebuilt wheel/sdist/source bytes from this
+      # approved commit. No slot builds replacement distribution artifacts.
+      # The release-only -text rule preserves these files before approved
+      # staging, so checkout transports SHA256SUMS and identity bytes exactly.
+      - name: Check all normal installs and record runtime/checksums
+        run: >
+          python -I tools/release/check_release.py
+          --version 0.7.0.dev0 --distribution sable-sphynx
+          --release-dir dist/sable-sphynx-0.7.0.dev0
+          --evidence-dir "${{ runner.temp }}/sdk smoke evidence/${{ matrix.slot }}"
+          --runtime-origin "GitHub actions/setup-python v7; ${{ runner.os }}; requested CPython ${{ matrix.python }}; approved commit ${{ github.sha }}"
+      - name: Validate pilot contracts from the exact installed wheel
+        shell: bash
+        run: |
+          python -I -m venv "$RUNNER_TEMP/pilot-regression-venv"
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            PILOT_PYTHON="$RUNNER_TEMP/pilot-regression-venv/Scripts/python.exe"
+          else
+            PILOT_PYTHON="$RUNNER_TEMP/pilot-regression-venv/bin/python"
+          fi
+          "$PILOT_PYTHON" -I -m pip --isolated install --no-index --no-deps dist/sable-sphynx-0.7.0.dev0/sable_sphynx-0.7.0.dev0-py3-none-any.whl
+          python -I - "$RUNNER_TEMP/pilot source" <<'PY'
+          import importlib.util, sys
+          from pathlib import Path
+          spec = importlib.util.spec_from_file_location("checks", "tools/release/check_release.py")
+          checks = importlib.util.module_from_spec(spec)
+          spec.loader.exec_module(checks)
+          checks.set_release_version("0.7.0.dev0", "sable-sphynx")
+          release = Path("dist/sable-sphynx-0.7.0.dev0").resolve()
+          checks.verify_checksums(release)
+          _, files = checks.load_identity(release / checks.MANIFEST)
+          checks.extract_source(release / checks.SOURCE, Path(sys.argv[1]), files)
+          PY
+          "$PILOT_PYTHON" -I "$RUNNER_TEMP/pilot source/tools/release/run_regressions.py" --version 0.7.0.dev0 --distribution sable-sphynx --source-root "$RUNNER_TEMP/pilot source" --release-dir dist/sable-sphynx-0.7.0.dev0 --evidence-dir "$RUNNER_TEMP/pilot regressions/${{ matrix.slot }}" --runtime-origin "GitHub actions/setup-python; ${{ matrix.slot }}; ${{ github.sha }}"
+      # Multiple upload paths retain their common ancestor. Consolidate the
+      # two evidence trees so aggregate lookup has one predictable slot root.
+      - name: Collect synthetic evidence into one slot folder
+        if: always()
+        shell: bash
+        run: |
+          python -I - "${{ runner.temp }}" "${{ matrix.slot }}" <<'PY'
+          import shutil, sys
+          from pathlib import Path
+          root, slot = Path(sys.argv[1]), sys.argv[2]
+          target = root / "sdk evidence upload" / slot
+          target.mkdir(parents=True, exist_ok=False)
+          for source in (root / "sdk smoke evidence" / slot,
+                         root / "pilot regressions" / slot):
+              for suffix in ("*.json", "*.log"):
+                  for path in sorted(source.glob(suffix)):
+                      output = target / path.name
+                      if output.exists():
+                          raise RuntimeError("Duplicate evidence filename: " + path.name)
+                      shutil.copyfile(path, output)
+          PY
+      - name: Retain synthetic logs and aggregate identities
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: sdk-release-smoke-${{ matrix.slot }}
+          path: ${{ runner.temp }}/sdk evidence upload/${{ matrix.slot }}/
+          if-no-files-found: error
+          retention-days: 7
+          include-hidden-files: false
+
+  aggregate:
+    name: Seven-slot approved-byte evidence
+    needs: installed
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          sparse-checkout: tools/release
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: '3.12'
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        with:
+          pattern: sdk-release-smoke-*
+          path: ${{ runner.temp }}/sdk smoke aggregate inputs
+          merge-multiple: false
+      - name: Require seven passing slots and identical approved bytes
+        run: >
+          python -I tools/release/summarize_release.py
+          --require-pilot-regressions --version 0.7.0.dev0 --distribution sable-sphynx
+          --input-dir "${{ runner.temp }}/sdk smoke aggregate inputs"
+          --output "${{ runner.temp }}/sdk smoke matrix.json"
+      - name: Retain synthetic matrix summary
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: sdk-release-smoke-matrix
+          path: ${{ runner.temp }}/sdk smoke matrix.json
+          if-no-files-found: error
+          retention-days: 7
+          include-hidden-files: false
+  publish:
+    name: Publish reviewed distributions to PyPI
+    needs: [installed, aggregate]
+    if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && inputs.destination == 'pypi'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          sparse-checkout: dist/sable-sphynx-0.7.0.dev0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: '3.12'
+      - name: Copy only the two reviewed public distributions
+        env:
+          PUBLISH_DIR: ${{ runner.temp }}/publish-dist
+          APPROVED_MANIFEST_SHA256: ${{ inputs.approved_manifest_sha256 }}
+          CONFIRMATION: ${{ inputs.confirmation }}
+        run: |
+          python -I - <<'PY'
+          import hashlib, json, os, shutil
+          from pathlib import Path
+          release = Path("dist/sable-sphynx-0.7.0.dev0")
+          raw = (release / "PUBLICATION.json").read_bytes()
+          if (hashlib.sha256(raw).hexdigest() != os.environ["APPROVED_MANIFEST_SHA256"]
+                  or os.environ["CONFIRMATION"] != "publish sable-sphynx 0.7.0.dev0"):
+              raise ValueError("Explicit approval must bind the exact reviewed publication manifest")
+          manifest = json.loads(raw)
+          expected = {"sable_sphynx-0.7.0.dev0-py3-none-any.whl", "sable_sphynx-0.7.0.dev0.tar.gz"}
+          if (manifest.get("distribution") != "sable-sphynx" or manifest.get("version") != "0.7.0.dev0"
+                  or len(manifest["files"]) != 2 or {r["filename"] for r in manifest["files"]} != expected):
+              raise ValueError("Publication inventory mismatch")
+          hashes = dict(line.split("  ", 1)[::-1] for line in (release / "SHA256SUMS").read_text().splitlines())
+          for row in manifest["files"]:
+              source = release / row["filename"]
+              actual = hashlib.sha256(source.read_bytes()).hexdigest()
+              if source.is_symlink() or actual != row["sha256"] or actual != hashes[row["filename"]]:
+                  raise ValueError("Publication bytes differ from validated release")
+          destination = Path(os.environ["PUBLISH_DIR"])
+          destination.mkdir(exist_ok=False)
+          for row in manifest["files"]:
+              shutil.copyfile(release / row["filename"], destination / row["filename"])
+          PY
+      - name: Publish with PyPI Trusted Publishing
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # official release/v1
+        with:
+          packages-dir: ${{ runner.temp }}/publish-dist

sable_sphynx-0.7.0.dev0/.github/workflows/rag-papers.yml

@@ -0,0 +1,42 @@
+name: Paper-named RAG source protocols
+on:
+  pull_request:
+    paths:
+      - src/sphynx/rag_papers/**
+      - src/sphynx/data/rag-paper-*.json
+      - tests/test_rag_paper*.py
+      - tools/integration/build_paper_schemas.py
+      - tools/integration/validate_paper_methods.py
+      - .github/workflows/rag-papers.yml
+permissions:
+  contents: read
+jobs:
+  offline:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ['3.11', '3.12']
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install schema test dependency (SDK runtime remains stdlib)
+        run: python -m pip install jsonschema==4.23.0
+      - name: Paper rules, native formats, Sable joins and portable contracts
+        env:
+          PYTHONPATH: src
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: >-
+          python -m unittest tests.test_rag_papers tests.test_rag_paper_connections
+          tests.test_reflex_traces tests.test_official_benchmarks
+          tests.test_rag_diagnostics_calibration tests.test_rag_diagnostics_engine
+          tests.test_rag_diagnostics_importers tests.test_rag_diagnostics_sdk
+          tests.test_rag_diagnostics_semantic tests.test_rag_diagnostics_semantic_integration
+          tests.test_dataset_v3 tests.test_full_rag -q
+      - name: Ensure portable schemas match their committed definition
+        run: |
+          python tools/integration/build_paper_schemas.py
+          git diff --exit-code -- src/sphynx/data/rag-paper-schemas.v1.json

sable_sphynx-0.7.0.dev0/.github/workflows/sdk-0-5-release.yml

@@ -0,0 +1,159 @@
+name: SDK 0.5.0 release verification
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [codex/sphynx-0-5-0-release]
+    paths:
+      - dist/sable-sphynx-0.5.0/**
+      - tools/integration/run_installed_research_tests.py
+      - tools/integration/installed_research_smoke.py
+      - tools/integration/run_installed_050_tests.py
+      - .github/workflows/sdk-0-5-release.yml
+
+permissions:
+  contents: read
+
+jobs:
+  installed:
+    name: ${{ matrix.slot }} reviewed wheel
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {slot: windows-311, os: windows-latest, python: '3.11'}
+          - {slot: windows-312, os: windows-latest, python: '3.12'}
+          - {slot: windows-314, os: windows-latest, python: '3.14'}
+          - {slot: macos-311, os: macos-latest, python: '3.11'}
+          - {slot: macos-312, os: macos-latest, python: '3.12'}
+          - {slot: linux-311, os: ubuntu-latest, python: '3.11'}
+          - {slot: linux-312, os: ubuntu-latest, python: '3.12'}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          sparse-checkout: dist/sable-sphynx-0.5.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: ${{ matrix.python }}
+      # The same reviewed wheel/source artifacts are installed in every slot.
+      # No replacement wheel or model is built. jsonschema is a dev-only test dependency.
+      - name: Verify reviewed bytes and extract only the verification tools
+        shell: bash
+        run: |
+          unset PYTHONPATH
+          python -I - "$RUNNER_TEMP/research tools" <<'PY'
+          import hashlib,json,sys,zipfile
+          from pathlib import Path
+          release=Path("dist/sable-sphynx-0.5.0")
+          expected_names={"sable_sphynx-0.5.0-py3-none-any.whl","sable_sphynx-0.5.0.tar.gz","sable-sphynx-0.5.0-source.zip","SOURCE_IDENTITY.json"}
+          expected={}
+          for line in (release/"SHA256SUMS").read_text(encoding="ascii").splitlines():
+              sha,name=line.split()
+              assert name in expected_names and name not in expected
+              assert hashlib.sha256((release/name).read_bytes()).hexdigest()==sha
+              expected[name]=sha
+          assert set(expected)==expected_names
+          identity=json.loads((release/"SOURCE_IDENTITY.json").read_text(encoding="utf-8"))
+          assert identity["sdk_version"]=="0.5.0" and identity["distribution"]=="sable-sphynx"
+          files={row["path"]:row["sha256"] for row in identity["files"]}
+          output=Path(sys.argv[1]);output.mkdir()
+          with zipfile.ZipFile(release/"sable-sphynx-0.5.0-source.zip") as archive:
+              for name in ("run_installed_research_tests.py","run_installed_050_tests.py","installed_research_smoke.py"):
+                  relative="tools/integration/"+name
+                  raw=archive.read("sable-sphynx-0.5.0-source/"+relative)
+                  assert hashlib.sha256(raw).hexdigest()==files[relative]
+                  (output/name).write_bytes(raw)
+          PY
+      - name: Install offline into a fresh consumer interpreter and test the wheel
+        shell: bash
+        run: |
+          unset PYTHONPATH
+          python -I -m venv "$RUNNER_TEMP/research consumer"
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            CONSUMER_PYTHON="$RUNNER_TEMP/research consumer/Scripts/python.exe"
+          else
+            CONSUMER_PYTHON="$RUNNER_TEMP/research consumer/bin/python"
+          fi
+          RELEASE_DIR="$GITHUB_WORKSPACE/dist/sable-sphynx-0.5.0"
+          # macOS /var is a system symlink. Keep strict evidence link rejection
+          # and give synthetic fixtures the canonical temporary-directory path.
+          if [[ "$RUNNER_OS" == "macOS" ]]; then
+            export TMPDIR="$(python -I -c 'import pathlib,tempfile; print(pathlib.Path(tempfile.gettempdir()).resolve())')"
+          fi
+          "$CONSUMER_PYTHON" -I -m pip --isolated install --no-index --no-deps "$RELEASE_DIR/sable_sphynx-0.5.0-py3-none-any.whl"
+          "$CONSUMER_PYTHON" -I -m pip --isolated install jsonschema==4.23.0
+          mkdir "$RUNNER_TEMP/research consumer cwd"
+          cd "$RUNNER_TEMP/research consumer cwd"
+          "$CONSUMER_PYTHON" -I "$RUNNER_TEMP/research tools/installed_research_smoke.py" --output-dir "$RUNNER_TEMP/research evidence/${{ matrix.slot }}/smoke"
+          "$CONSUMER_PYTHON" -I "$RUNNER_TEMP/research tools/run_installed_050_tests.py" --release-dir "$RELEASE_DIR" --slot "${{ matrix.slot }}" --evidence-dir "$RUNNER_TEMP/research evidence/${{ matrix.slot }}/tests"
+      - name: Retain synthetic aggregate reports and test-name logs
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: sdk-0-5-release-${{ matrix.slot }}
+          path: |
+            ${{ runner.temp }}/research evidence/${{ matrix.slot }}/smoke/VERIFICATION.json
+            ${{ runner.temp }}/research evidence/${{ matrix.slot }}/tests/RESEARCH_TESTS.json
+            ${{ runner.temp }}/research evidence/${{ matrix.slot }}/tests/unittest.log
+          if-no-files-found: error
+          retention-days: 7
+          include-hidden-files: false
+
+  aggregate:
+    name: Seven platforms using identical reviewed bytes
+    needs: installed
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            dist/sable-sphynx-0.5.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: '3.12'
+      - name: Extract the exact reviewed aggregate tools
+        run: |
+          python -I - "${{ runner.temp }}/stable aggregate tools" <<'PY'
+          import hashlib,json,sys,zipfile
+          from pathlib import Path
+          release=Path("dist/sable-sphynx-0.5.0")
+          for line in (release/"SHA256SUMS").read_text(encoding="ascii").splitlines():
+              sha,name=line.split()
+              assert name in {"SOURCE_IDENTITY.json","sable_sphynx-0.5.0-py3-none-any.whl","sable_sphynx-0.5.0.tar.gz","sable-sphynx-0.5.0-source.zip"}
+              assert hashlib.sha256((release/name).read_bytes()).hexdigest()==sha
+          identity=json.loads((release/"SOURCE_IDENTITY.json").read_text(encoding="utf-8"))
+          files={row["path"]:row["sha256"] for row in identity["files"]}
+          output=Path(sys.argv[1]);output.mkdir()
+          with zipfile.ZipFile(release/"sable-sphynx-0.5.0-source.zip") as archive:
+              for name in ("run_installed_research_tests.py","run_installed_050_tests.py"):
+                  relative="tools/integration/"+name
+                  raw=archive.read("sable-sphynx-0.5.0-source/"+relative)
+                  assert hashlib.sha256(raw).hexdigest()==files[relative]
+                  (output/name).write_bytes(raw)
+          PY
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        with:
+          pattern: sdk-0-5-release-*
+          path: ${{ runner.temp }}/research aggregate inputs
+          merge-multiple: false
+      - name: Require seven passing slots with matching release and test hashes
+        run: >
+          python -I "${{ runner.temp }}/stable aggregate tools/run_installed_050_tests.py"
+          --release-dir dist/sable-sphynx-0.5.0
+          --aggregate "${{ runner.temp }}/research aggregate inputs"
+          --output "${{ runner.temp }}/research matrix.json"
+      - name: Retain synthetic matrix summary
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: sdk-0-5-release-matrix
+          path: ${{ runner.temp }}/research matrix.json
+          if-no-files-found: error
+          retention-days: 7
+          include-hidden-files: false