substratum-cli 0.2.1__tar.gz → 0.2.3__tar.gz

{substratum_cli-0.2.1 → substratum_cli-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: substratum-cli
-Version: 0.2.1
+Version: 0.2.3
 Summary: Substratum: verified-or-refused code, with provenance. The terminal over the comprehension engine.
 Author: Substratum
 License: LicenseRef-Proprietary

{substratum_cli-0.2.1 → substratum_cli-0.2.3}/substratum_cli/__init__.py

@@ -5,4 +5,4 @@ Import budget: this package is stdlib-only; the ONLY module reaching into backen
 """
 # SINGLE SOURCE OF TRUTH for the release version. pyproject reads this (dynamic version), the boot shows
 # it, and the update-check compares against it. To cut a release, bump ONLY this line, then publish.
-__version__ = "0.2.1"
+__version__ = "0.2.3"

{substratum_cli-0.2.1 → substratum_cli-0.2.3}/substratum_cli/_boot.py

@@ -13,9 +13,11 @@ from __future__ import annotations
 
 import hashlib
 
-# The PUBLIC substrate release name -- what the product shows, like a model version (GPT-5.2, Opus 4.8).
-# Decoupled from the internal mining tag (pattern_library_scaled_v15): that tag still drives the seal
-# hash (the seal must certify the ACTUAL build), but users see this. Bump only on a real public release.
+# The PUBLIC name of the first intelligence library -- a model version, like GPT-5.2 or Opus 4.8. Shown
+# ONLY when this library actually backs the session: in AIRGAPPED-LOCAL mode (the engine + library shipped
+# on-prem, present on this machine), or reported by the HOSTED engine once the full corpus is live on it.
+# The boot NEVER shows this from a hardcoded local path -- the label must be a real representation of the
+# intelligence serving the user. The internal mining tag (pattern_library_scaled_v15) stays internal.
 RELEASE = "Substrate 1.0 Preview"
 
 L = "\033[38;5;154m"      # brand lime
@@ -53,18 +55,21 @@ def seal(lib_name: str, version: str) -> tuple[str, str]:
     return sigil, digest
 
 
-def render(name, census, langs, libname, patterns, warm, standing, version,
-           color=True, ascii_mode=False, logged_in=True, update_to="") -> list[str]:
-    """Return the boot lines. `standing` is build_state.standing() (may be {})."""
+def render(name, census, langs, substrate, substrate_note, substrate_ok, standing, version,
+           color=True, ascii_mode=False, logged_in=True, update_to="", seal_key="") -> list[str]:
+    """Return the boot lines. `substrate` is the HONEST name of the intelligence serving this session
+    (the hosted engine version, or 'not connected') -- NEVER a local path. `substrate_note`/`_ok` render
+    the connection state. `seal_key` is the stable identity the self-certificate hashes."""
     def c(code, s):
         return f"{code}{s}{R}" if color else s
 
-    sig, dig = seal(libname, version)
+    sig, dig = seal(seal_key or substrate, version)
     if ascii_mode:
         sig = "#" + dig.split()[0]
     dot = "-" if ascii_mode else "·"          # separators degrade with the glyph set
     if ascii_mode:                            # the renderer guarantees ascii output regardless of input
-        name, census, langs, libname = (str(s).replace("·", "-") for s in (name, census, langs, libname))
+        name, census, langs, substrate, substrate_note = (
+            str(s).replace("·", "-") for s in (name, census, langs, substrate, substrate_note))
     W = 78                                    # certificate inner width
     out = ["", ""]
 
@@ -99,8 +104,9 @@ def render(name, census, langs, libname, patterns, warm, standing, version,
         pad = " " * max(0, W - 1 - _vis(inner_plain))
         return c(CH, v_) + " " + inner_colored + pad + c(CH, v_)
 
-    lamp = (("*" if ascii_mode else "●") + " ready") if warm else (dot + " loading")
-    lampc = c(GR, lamp) if warm else c(CH, lamp)
+    glyph = ("*" if ascii_mode else "●") if substrate_ok else dot
+    lamp = f"{glyph} {substrate_note}"
+    lampc = c(GR if substrate_ok else CH, lamp)
     st = standing or {}
     runs, ver = st.get("runs", 0), st.get("verified", 0)
     unsaved = st.get("unapplied_total", 0)
@@ -114,8 +120,8 @@ def render(name, census, langs, libname, patterns, warm, standing, version,
     box.append(c(CH, v_) + " " + seal_inner_c + pad + right_c + c(CH, v_))
 
     box.append(bar(label="SUBSTRATE"))
-    box.append(rowline(f"  release   {RELEASE}      {lamp}",
-                       c(LAB, "  release   ") + c(DAT, RELEASE) + "      " + lampc))
+    box.append(rowline(f"  engine    {substrate}      {lamp}",
+                       c(LAB, "  engine    ") + c(DAT, substrate) + "      " + lampc))
     box.append(rowline(f"  covers    {langs}", c(LAB, "  covers    ") + c(DAT, langs)))
     box.append(bar(label="REPO"))
     box.append(rowline(f"  project   {name}", c(LAB, "  project   ") + c(DAT, name)))

{substratum_cli-0.2.1 → substratum_cli-0.2.3}/substratum_cli/_update.py

@@ -27,15 +27,25 @@ def _version_tuple(s: str) -> tuple:
     return tuple(out)
 
 
-def available(current: str) -> str:
-    """The newer published version if the cache knows of one, else "". Pure, instant, no network."""
+def _cache() -> dict:
     try:
-        latest = str(json.load(open(_cache_path(), encoding="utf-8")).get("latest") or "")
+        return json.load(open(_cache_path(), encoding="utf-8")) or {}
     except Exception:
-        return ""
+        return {}
+
+
+def available(current: str) -> str:
+    """The newer published version if the cache knows of one, else "". Pure, instant, no network."""
+    latest = str(_cache().get("latest") or "")
     return latest if latest and _version_tuple(latest) > _version_tuple(current) else ""
 
 
+def engine_version() -> str:
+    """The HOSTED engine's substrate version from the last check (cached), or "". This is what actually
+    serves fix/write for a thin client, so the boot shows THIS -- never a local path."""
+    return str(_cache().get("engine") or "")
+
+
 def refresh_async() -> None:
     """Fire-and-forget: ask the server for the latest published client and cache it for next session.
     The server sources this from PyPI, so publishing is all it takes -- no redeploy, no constant to bump."""
@@ -44,12 +54,16 @@ def refresh_async() -> None:
             from . import remote
             info = remote.server_info() or {}
             latest = str(info.get("latest_client") or "")
-            if not latest:
+            engine = str(info.get("engine_version") or "")
+            if not (latest or engine):
                 return
             path = _cache_path()
             os.makedirs(os.path.dirname(path), exist_ok=True)
+            cur = _cache()
+            cur.update({"latest": latest or cur.get("latest", ""),
+                        "engine": engine or cur.get("engine", ""), "t": int(time.time())})
             with open(path, "w", encoding="utf-8") as fh:
-                json.dump({"latest": latest, "t": int(time.time())}, fh)
+                json.dump(cur, fh)
         except Exception:
             pass
     try:

substratum_cli-0.2.3/substratum_cli/_vendor/client_gate.py

@@ -0,0 +1,166 @@
+"""client_gate -- the Docker-less INSTANCE-GRAIN gate for client repos.
+
+The commercial unlock: the verified-or-refuse machine currently gates instance-grain
+emissions through benchmark Docker images. A client repo has no image -- it has ITS OWN
+tests. This gate runs them, with DIFFERENTIAL (fail_to_pass) semantics:
+
+    the named tests must FAIL on the UNPATCHED base and PASS with the candidate applied.
+
+The differential is load-bearing for zero-wrong: a candidate that "passes" tests which
+already passed at base has proven NOTHING about the fix (pass-because-it-tests-nothing);
+it is refused NAMED (GATE_TESTS_PASS_AT_BASE), never shipped on that warrant.
+
+Isolation: base_commit is materialized in a TEMP GIT WORKTREE (the proven toolchain_derive
+pattern); the client checkout is never touched; the worktree is always removed.
+
+Outcomes are a CLOSED set and only PASS ships:
+    PASS                  differential held (failed at base, passed with patch)
+    TEST_FAILED           patch applied, tests still fail
+    GATE_TESTS_PASS_AT_BASE  nothing to fix on this warrant -> refuse
+    GATE_BASE_ERROR       tests could not RUN at base (env/collection) -> refuse
+    GATE_ERROR            tests could not RUN with the patch -> refuse (never a pass)
+    GATE_TIMEOUT / GATE_WORKTREE_FAILED / GATE_NO_RUNNER   named infrastructure refusals
+
+Runner resolution (closed, explicit-first): caller-provided command > detected by repo
+shape (pytest for python repos, `go test` for go.mod repos, npm test for package.json with
+a test script). Detection failure refuses NAMED -- the gate never guesses how to test."""
+from __future__ import annotations
+
+import os
+import shlex
+import shutil
+import subprocess
+import tempfile
+from dataclasses import dataclass
+from typing import Dict, List, Optional, Sequence, Tuple
+
+
+@dataclass(frozen=True)
+class ClientGateResult:
+    passed: bool
+    code: str                 # closed set above
+    detail: str = ""
+
+
+def _run(cmd: Sequence[str], cwd: str, timeout: int) -> Tuple[Optional[int], str]:
+    try:
+        # children get a REAL-fs tmpdir: pytest's capture holds unlinked-open tempfiles,
+        # which drvfs/9p mounts cannot represent (FileNotFoundError at truncate).
+        # PYTHONDONTWRITEBYTECODE is a CORRECTNESS requirement, not hygiene: the base run
+        # writes __pycache__; a patched source of the same size within the same second is
+        # SHADOWED by the stale pyc (timestamp validation is second-granular), and the
+        # with-patch run silently re-imports the buggy module -- the differential then
+        # reports TEST_FAILED for a genuine fix (or worse directions on other shapes).
+        r = subprocess.run(list(cmd), cwd=cwd, capture_output=True, text=True,
+                           timeout=timeout,
+                           env=dict(os.environ, PYTHONHASHSEED="0", TMPDIR="/tmp",
+                                    PYTHONDONTWRITEBYTECODE="1"))
+        return r.returncode, (r.stdout + "\n" + r.stderr)[-4000:]
+    except subprocess.TimeoutExpired:
+        return None, "timeout"
+    except FileNotFoundError as e:
+        return None, f"runner missing: {e}"
+
+
+def resolve_test_command(repo_dir: str, test_cmd: Optional[str],
+                         test_paths: Optional[Sequence[str]]) -> Optional[List[str]]:
+    """The command that runs the WARRANT tests. Explicit beats detection; detection is a
+    closed table keyed by repo shape; anything else -> None (refuse, never guess)."""
+    test_cmd = test_cmd or os.environ.get("SUBSTRATUM_CLIENT_TEST_CMD")
+    if test_cmd:
+        return shlex.split(test_cmd)
+    paths = list(test_paths or [])
+    if os.path.exists(os.path.join(repo_dir, "go.mod")):
+        go = os.path.expanduser("~/.local/go/bin/go")
+        go = go if os.path.exists(go) else shutil.which("go")
+        if not go:
+            return None
+        # go test takes package dirs + -run for test-name selectors (pkg::Test form)
+        pkgs, runs = [], []
+        for p in paths:
+            if "::" in p:
+                d, name = p.split("::", 1)
+                pkgs.append("./" + os.path.dirname(d) if os.path.dirname(d) else "./...")
+                runs.append(name)
+            else:
+                pkgs.append("./" + p if not p.startswith("./") else p)
+        cmd = [go, "test"] + (sorted(set(pkgs)) or ["./..."])
+        if runs:
+            cmd += ["-run", "|".join(dict.fromkeys(runs))]
+        return cmd
+    if any(os.path.exists(os.path.join(repo_dir, f))
+           for f in ("pytest.ini", "setup.py", "pyproject.toml", "setup.cfg", "tox.ini")) \
+            or os.path.isdir(os.path.join(repo_dir, "tests")) or any(
+                p.endswith(".py") or "::" in p for p in paths):
+        import sys
+        return [sys.executable, "-m", "pytest", "-x", "-q", "-p", "no:cacheprovider",
+                *paths]
+    pkg = os.path.join(repo_dir, "package.json")
+    if os.path.exists(pkg):
+        try:
+            import json
+            if json.load(open(pkg)).get("scripts", {}).get("test"):
+                return ["npm", "test", "--silent"]
+        except Exception:
+            return None
+    return None
+
+
+def run_client_gate(repo_dir: str, base_commit: str, edits: Dict[str, str],
+                    test_paths: Optional[Sequence[str]] = None,
+                    test_cmd: Optional[str] = None,
+                    differential: bool = True,
+                    timeout: int = 600,
+                    transcript_sink: Optional[dict] = None) -> ClientGateResult:
+    """THE gate. Materialize base_commit in a temp worktree; (differential) run the warrant
+    tests unpatched -- they must FAIL; write `edits`; run again -- they must PASS.
+
+    transcript_sink (out-param, additive; the proven refusal_sink precedent): when a dict is
+    passed, it is populated with {runner_command, base_rc, base_out, patched_rc, patched_out}
+    so the product surface can show the "base FAIL -> patched PASS" proof and store the gate
+    logs. Default None keeps every existing caller byte-identical."""
+    wt = tempfile.mkdtemp(prefix="cg_wt_", dir=os.environ.get("TMPDIR") or None)
+    try:
+        r = subprocess.run(["git", "-C", repo_dir, "worktree", "add", "--detach", "-f",
+                            wt, base_commit], capture_output=True, text=True, timeout=120)
+        if r.returncode != 0:
+            return ClientGateResult(False, "GATE_WORKTREE_FAILED", r.stderr[-300:])
+        cmd = resolve_test_command(wt, test_cmd, test_paths)
+        if cmd is None:
+            return ClientGateResult(False, "GATE_NO_RUNNER")
+        if transcript_sink is not None:
+            transcript_sink["runner_command"] = list(cmd)
+        if differential:
+            rc, out = _run(cmd, wt, timeout)
+            if transcript_sink is not None:
+                transcript_sink["base_rc"] = rc
+                transcript_sink["base_out"] = out
+            if rc is None:
+                return ClientGateResult(False, "GATE_TIMEOUT" if out == "timeout"
+                                        else "GATE_BASE_ERROR", out[-300:])
+            if rc == 0:
+                return ClientGateResult(False, "GATE_TESTS_PASS_AT_BASE")
+            # rc != 0 at base: the warrant tests fail before the fix, as fail_to_pass
+            # requires. (A collection error also exits non-zero; the with-patch run below
+            # is the arbiter -- a real fix makes the SAME invocation exit 0.)
+        for rel, content in edits.items():
+            p = os.path.join(wt, rel)
+            os.makedirs(os.path.dirname(p) or wt, exist_ok=True)
+            with open(p, "w", encoding="utf-8") as fh:
+                fh.write(content)
+        rc, out = _run(cmd, wt, timeout)
+        if transcript_sink is not None:
+            transcript_sink["patched_rc"] = rc
+            transcript_sink["patched_out"] = out
+        if rc is None:
+            return ClientGateResult(False, "GATE_TIMEOUT" if out == "timeout"
+                                    else "GATE_ERROR", out[-300:])
+        if rc == 0:
+            return ClientGateResult(True, "PASS")
+        return ClientGateResult(False, "TEST_FAILED", out[-400:])
+    except subprocess.TimeoutExpired:
+        return ClientGateResult(False, "GATE_WORKTREE_FAILED", "worktree add timeout")
+    finally:
+        subprocess.run(["git", "-C", repo_dir, "worktree", "remove", "-f", wt],
+                       capture_output=True)
+        shutil.rmtree(wt, ignore_errors=True)

{substratum_cli-0.2.1 → substratum_cli-0.2.3}/substratum_cli/engine.py

@@ -26,10 +26,17 @@ _LEAF_CACHE: dict[str, ModuleType] = {}
 
 
 def _leaf(name: str) -> ModuleType:
-    """Load `<engine>/<name>.py` in isolation (no backend __init__), cached."""
+    """Load `<engine>/<name>.py` in isolation (no backend __init__), cached. On a THIN CLIENT
+    (pip install; no engine checkout on disk) fall back to the copy vendored INSIDE the wheel --
+    a pip user must never depend on a path that only exists on a dev machine. Dev machines still
+    get the live engine file first, so engine edits are picked up without a re-vendor."""
     if name in _LEAF_CACHE:
         return _LEAF_CACHE[name]
     path = os.path.join(_ENGINE_DIR, f"{name}.py")
+    if not os.path.isfile(path):
+        vendored = os.path.join(os.path.dirname(os.path.abspath(__file__)), "_vendor", f"{name}.py")
+        if os.path.isfile(vendored):
+            path = vendored
     spec = importlib.util.spec_from_file_location(f"_substratum_leaf_{name}", path)
     if spec is None or spec.loader is None:
         raise ImportError(f"cannot leaf-load {path}")

{substratum_cli-0.2.1 → substratum_cli-0.2.3}/substratum_cli/product_ops.py

@@ -41,6 +41,15 @@ def op_fix_from_failing_test(repo: str, failing_tests: list[str], intent: str =
     stage("GROUND", f"reading {len(failing_tests)} failing test(s)")
 
     if not engine.available():        # client-only install: fix needs the engine (local or hosted)
+        # HOSTED: when logged in, the server SYNTHESIZES from focal snippets (only the focal module +
+        # test NAMES transit; test bodies and the wider repo never leave) and the candidate diff is
+        # gated HERE, differentially, on the user's own tests. The gate stays the arbiter, client-side.
+        from . import remote
+        if remote.enabled():
+            rr = _remote_fix(repo, base, rid, key, inputs, failing_tests, intent,
+                             test_command, target, stage)
+            if rr is not None:
+                return rr
         ref = refusals.build(codes.NO_ENGINE, engine_code="NO_ENGINE",
                              ctx={"target": target or "the failing test", "run_id": rid})
         return _store(repo, _result.make(codes.REFUSED, rid, "fix", code=codes.NO_ENGINE, refusal=ref),
@@ -155,6 +164,84 @@ def _route_test_derived(repo, base_commit, failing_tests, intent, test_command,
     return None
 
 
+def _focal_context(repo: str, failing_tests: list, intent: str):
+    """Build the focal payload for the hosted engine: parse the failing TEST locally (it never
+    transits), find the module it imports-and-calls, and send ONLY that module's content + names.
+    Returns the focal dict or None if no focal module is discoverable."""
+    test_files = sorted({t.split("::")[0] for t in failing_tests if "::" in t or t.endswith(".py")})
+    for tf in test_files:
+        tf_abs = os.path.join(repo, tf)
+        if not os.path.isfile(tf_abs):
+            continue
+        tsrc = open(tf_abs, encoding="utf-8", errors="replace").read()
+        try:
+            tree = ast.parse(tsrc)
+        except SyntaxError:
+            continue
+        for node in ast.walk(tree):
+            if isinstance(node, ast.ImportFrom) and node.module and node.level == 0:
+                mod_rel = node.module.replace(".", "/") + ".py"
+                mod_abs = os.path.join(repo, mod_rel)
+                if not os.path.isfile(mod_abs):
+                    continue
+                for a in node.names:
+                    if re.search(rf"\b{re.escape(a.name)}\s*\(", tsrc):
+                        content = open(mod_abs, encoding="utf-8", errors="replace").read()
+                        return {"files": {mod_rel: content}, "path": mod_rel,
+                                "function": a.name, "buggy_source": content,
+                                "repo": os.path.basename(repo), "intent": intent or ""}
+    return None
+
+
+def _remote_fix(repo, base, rid, key, inputs, failing_tests, intent, test_command, target, stage):
+    """fix over the hosted engine: POST focal -> receive a candidate diff -> GATE IT HERE
+    (differential, vendored client gate) -> VERIFIED or a named refusal. Returns None only when
+    the remote is unreachable AND no focal exists (falls through to the NO_ENGINE refusal)."""
+    from . import diffs, remote
+    focal = _focal_context(repo, failing_tests, intent)
+    if focal is None:
+        ref = refusals.from_engine("no_candidate", ctx={"target": target, "run_id": rid})
+        return _store(repo, _result.make(codes.REFUSED, rid, "fix", code=ref.code, refusal=ref),
+                      key, inputs)
+    stage("REMOTE", f"hosted engine synthesizes {focal['function']} (focal module only transits)")
+    try:
+        res = remote.candidate(list(failing_tests), focal)
+    except remote.RemoteError as e:
+        ref = refusals.build(codes.GATE_PRECONDITION, engine_code=str(e),
+                             ctx={"target": target, "run_id": rid})
+        return _store(repo, _result.make(codes.REFUSED, rid, "fix",
+                                         code=codes.GATE_PRECONDITION, refusal=ref), key, inputs)
+    if (res.get("status") or "") != "candidate" or not res.get("diff"):
+        reason = res.get("refuse_reason") or "no_candidate"
+        ref = refusals.from_engine(reason, ctx={"target": target, "run_id": rid})
+        return _store(repo, _result.make(codes.REFUSED, rid, "fix", code=ref.code, refusal=ref),
+                      key, inputs)
+    # the diff came back against the focal content we sent -- apply to that, then GATE locally
+    parsed = diffs.parse(res["diff"])
+    edits, stale = diffs.materialize({f.path: focal["files"].get(f.path, "") for f in parsed}, parsed)
+    if not edits:
+        ref = refusals.build(codes.HUNK_CONTEXT_STALE, engine_code="remote_diff_stale",
+                             ctx={"target": ", ".join(stale) or target, "run_id": rid})
+        return _store(repo, _result.make(codes.UNVERIFIABLE, rid, "fix",
+                                         code=codes.HUNK_CONTEXT_STALE, refusal=ref), key, inputs)
+    stage("GATE", f"differential gate on {', '.join(failing_tests)}")
+    sink: dict = {}
+    cg = engine.client_gate.run_client_gate(repo, base, edits, test_paths=list(failing_tests),
+                                            test_cmd=test_command, differential=True,
+                                            transcript_sink=sink)
+    if not cg.passed:
+        ref = refusals.from_engine("candidate_failed_execution_gate",
+                                   ctx={"target": target, "run_id": rid})
+        return _store(repo, _result.make(codes.REFUSED, rid, "fix", code=ref.code, refusal=ref,
+                                         gate=_gate_from_sink(sink, failing_tests)), key, inputs)
+    prov = [str(p) for p in (res.get("provenance") or [])][:8] + ["execution_gate:client:PASS"]
+    diff = "".join(_diff_for(repo, base, p, c) for p, c in sorted(edits.items()))
+    out = _result.make(codes.VERIFIED, rid, "fix", diff=diff, files=tuple(sorted(edits)),
+                       provenance=_result.Provenance(entries=tuple(prov)),
+                       gate=_gate_from_sink(sink, failing_tests), data={"target": target})
+    return _store(repo, out, key, inputs)
+
+
 def op_write_from_intent(repo: str, intent: str, signature: str,
                          into: Optional[str] = None, emit=None,
                          prefer_purpose: Optional[str] = None) -> "_result.SubstratumResult":

{substratum_cli-0.2.1 → substratum_cli-0.2.3}/substratum_cli/remote.py

@@ -85,8 +85,10 @@ def clarify(intent: str, signature: str) -> dict:
 def candidate(test_ids: list, focal: dict) -> dict:
     """POST /api/cli/candidate -> {status, diff, provenance, refuse_reason}. The server SYNTHESIZES;
     the client gates the returned diff locally, so the user's code + tests never leave the machine."""
+    # generous timeout: the first call on a cold server pays the numpy import chain + the lazy
+    # library's resident index load before it can synthesize
     return _post_json(account.server() + "/api/cli/candidate",
-                      {"test_ids": list(test_ids), "focal": focal}, _auth_headers())
+                      {"test_ids": list(test_ids), "focal": focal}, _auth_headers(), timeout=180)
 
 
 # ---- GitHub device-flow login --------------------------------------------------------------------

{substratum_cli-0.2.1 → substratum_cli-0.2.3}/substratum_cli/session.py

@@ -108,33 +108,50 @@ class Session:
         pn = S.Painter(self.color)
         name = os.path.basename(self.repo) or self.repo
         langs, files = self._repo_summary()
-        lib = engine.lib_roots.py_library_root()
-        libname = os.path.basename(lib) if lib else "none"
         census = f"{files} files" + ((" · " + langs.replace("  ", " · ")) if langs else "")
         st = build_state.standing(self.repo)
         ascii_mode = S.use_ascii()
         logged_in = account.is_logged_in()
         _update.refresh_async()                    # refresh the update cache in the background (next session)
         update_to = _update.available(_cver)       # instant read from cache; "" if none or unknown
+
+        # HONEST substrate: which intelligence actually serves fix/write this session, and in which mode.
+        # Two real deployment modes: HOSTED (thin client -> engine on Fly) and AIRGAPPED-LOCAL (engine +
+        # library shipped on-prem). Never claim a substrate that is not backing this session.
+        local_present = False
+        try:
+            _p = engine.lib_roots.py_library_root()
+            local_present = bool(_p) and os.path.exists(_p)
+        except Exception:
+            local_present = False                  # a thin client has no local library -- that is fine
+        ev = _update.engine_version()              # hosted engine's reported version (cached), "" if unknown
+        if logged_in:                              # hosted mode: write/fix reach the engine on the server
+            substrate = ev or "hosted engine"
+            sub_note, sub_ok, seal_key = (("hosted · connected", True, ev) if ev else ("connecting", False, "hosted"))
+        elif local_present:                        # airgapped / self-hosted: the on-disk library serves it
+            _warm = engine.is_warm()
+            substrate = _boot.RELEASE
+            sub_note, sub_ok, seal_key = (("local · ready" if _warm else "local · loading"), _warm, _boot.RELEASE)
+        else:                                       # thin client, not connected -> claim nothing
+            substrate, sub_note, sub_ok, seal_key = "not connected", "login to connect", False, "offline"
         # THE PROOF SEAL -- a self-certifying certificate boot: a byte-identical determinism seal (a real
         # hash of engine + substrate + scheme, no time/session input), the struck-plane emblem (the logo),
         # and a structured ledger. The sameness of the seal every boot IS the proof of determinism -- a
         # token-streaming tool cannot draw a stable self-certificate. Needs a wide pane; compact below.
         if S.seal_cols() >= 84:
-            for ln in _boot.render(name, census, "py · go · ts", libname, "", engine.is_warm(),
+            for ln in _boot.render(name, census, "py · go · ts", substrate, sub_note, sub_ok,
                                    st, "0.1.0", color=self.color, ascii_mode=ascii_mode,
-                                   logged_in=logged_in, update_to=update_to):
+                                   logged_in=logged_in, update_to=update_to, seal_key=seal_key):
                 self._say(ln)
             return
         # compact identity (narrow pane): the mark + a lime-railed status
-        state = (pn(S.g("lamp") + " ready", S.PROVEN) if engine.is_warm()
-                 else pn(S.g("dot") + " loading", S.CHROME))
+        state = pn(sub_note, S.PROVEN if sub_ok else S.CHROME)
         rail = ("\033[38;5;154m▌\033[0m" if (self.color and not ascii_mode) else "|")
         brand = (f"\033[38;5;154m{S.g('brand')}\033[0m" if (self.color and not ascii_mode)
                  else pn(S.g("brand"), S.PROVEN))
         self._say(brand + " " + pn("SUBSTRATUM", S.BOLD) + pn("   proof-carrying · deterministic", S.LABEL))
         self._say(f"  {rail} " + pn(name, S.BOLD) + "  " + pn(census, S.LABEL))
-        self._say(f"  {rail} " + pn(_boot.RELEASE, S.LABEL) + "  " + state)
+        self._say(f"  {rail} " + pn(substrate, S.LABEL) + "  " + state)
         if st:
             bits = pn(f"{st['runs']} runs", S.LABEL)
             if st.get("verified"):

{substratum_cli-0.2.1 → substratum_cli-0.2.3}/substratum_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: substratum-cli
-Version: 0.2.1
+Version: 0.2.3
 Summary: Substratum: verified-or-refused code, with provenance. The terminal over the comprehension engine.
 Author: Substratum
 License: LicenseRef-Proprietary

{substratum_cli-0.2.1 → substratum_cli-0.2.3}/substratum_cli.egg-info/SOURCES.txt

@@ -32,6 +32,7 @@ substratum_cli.egg-info/requires.txt
 substratum_cli.egg-info/top_level.txt
 substratum_cli/_vendor/__init__.py
 substratum_cli/_vendor/_pro_test_derive.py
+substratum_cli/_vendor/client_gate.py
 substratum_cli/commands/__init__.py
 substratum_cli/commands/apply.py
 substratum_cli/commands/auth.py