technical-debt-engine-runtime 0.1.0__py3-none-any.whl

tde_runtime/software_assurance.py

@@ -0,0 +1,183 @@
+"""Canonical, fail-closed operational Software Assurance evidence."""
+from __future__ import annotations
+
+from hashlib import sha256
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+from typing import Any, Iterable
+
+from .configuration import RuntimeConfiguration
+
+ASSURANCE_SCHEMA_VERSION = "1.0.0"
+_USES_KEY = re.compile(r"^\s*(?:-\s+)?uses:\s*(?P<reference>.*)$")
+_ACTION_REFERENCE = re.compile(
+    r"^(?P<owner>[A-Za-z0-9][A-Za-z0-9-]*)/"
+    r"(?P<repository>[A-Za-z0-9_.-]+)"
+    r"(?P<path>(?:/[A-Za-z0-9_.-]+)*)@(?P<revision>[^\s#]+)$"
+)
+_COMMIT_SHA = re.compile(r"^[0-9a-fA-F]{40}$")
+
+
+def _canonical(value: object) -> bytes:
+    return (json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True) + "\n").encode("utf-8")
+
+
+def _digest(path: Path) -> str:
+    hasher = sha256()
+    with path.open("rb") as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b""):
+            hasher.update(block)
+    return "sha256:" + hasher.hexdigest()
+
+
+def _git(root: Path, *arguments: str) -> tuple[bool, str]:
+    completed = subprocess.run(["git", "-C", str(root), *arguments], text=True, capture_output=True, check=False)
+    return completed.returncode == 0, completed.stdout.strip()
+
+
+def parse_action_reference(reference: str) -> dict[str, Any]:
+    """Normalize a GitHub Action reference and classify its immutability.
+
+    GitHub accepts ``owner/repository[/path]@revision`` for both step-level
+    actions and job-level reusable workflows.  Only a complete commit SHA is
+    immutable; malformed, local, expression, and mutable references remain
+    explicitly untrusted.
+    """
+    reference = reference.split("#", 1)[0].strip()
+    match = _ACTION_REFERENCE.fullmatch(reference)
+    if not match:
+        return {"owner": None, "repository": None, "path": None, "commitSha": None, "immutable": False}
+    values = match.groupdict()
+    revision = values["revision"]
+    immutable = bool(_COMMIT_SHA.fullmatch(revision))
+    return {
+        "owner": values["owner"].lower(),
+        "repository": values["repository"].lower(),
+        "path": values["path"] or None,
+        "commitSha": revision.lower() if immutable else None,
+        "immutable": immutable,
+    }
+
+
+class SoftwareAssurance:
+    """Evaluate repository and candidate artifacts without delivery or release behavior."""
+
+    def assure(self, root: str | Path, artifact_directories: Iterable[str | Path] = (), docker_artifact_directory: str | Path | None = None) -> dict[str, Any]:
+        root = Path(root).resolve(); limitations: list[str] = []
+        repository = self._repository(root, limitations); dependencies = self._dependencies(root, limitations)
+        workflows = self._workflows(root, limitations); configuration = self._configuration(root, limitations)
+        documentation = self._documentation(root, limitations)
+        artifacts = self._artifacts(tuple(Path(item).resolve() for item in artifact_directories), limitations)
+        if docker_artifact_directory is not None:
+            from .docker_artifact import validate as validate_docker
+            candidate = repository["candidateIdentity"].removeprefix("candidate.git.") if repository.get("candidateIdentity") else ""
+            docker = validate_docker(docker_artifact_directory, candidate)
+            artifacts["docker"] = docker
+            artifacts["records"].append({"directory": str(Path(docker_artifact_directory).resolve()), "artifactCount": 1,
+                                         "verified": docker["verified"], "artifacts": [{key: docker[key] for key in ("filename", "digest")} ]})
+            artifacts["integrity"] = artifacts["integrity"] and docker["verified"]
+            if not docker["verified"]:
+                limitations.append("candidate Docker archive or provenance is invalid")
+        checks = {"repositoryIntegrity": repository["integrity"], "dependencyIntegrity": dependencies["integrity"],
+                  "artifactIntegrity": artifacts["integrity"], "workflowIntegrity": workflows["integrity"],
+                  "configurationIntegrity": configuration["integrity"], "documentationIntegrity": documentation["integrity"],
+                  "buildProvenanceVerification": artifacts["provenanceVerified"]}
+        required = ("repositoryIntegrity", "dependencyIntegrity", "workflowIntegrity", "configurationIntegrity", "documentationIntegrity")
+        failed = not all(checks[name] for name in required) or (bool(artifacts["directories"]) and not checks["artifactIntegrity"])
+        decision = "FAIL" if failed else "PASS_WITH_WARNINGS" if limitations else "PASS"
+        evidence = {"schemaId": "tde.software-assurance", "schemaVersion": ASSURANCE_SCHEMA_VERSION,
+                    "repository": repository, "dependencies": dependencies, "artifacts": artifacts, "workflows": workflows,
+                    "configuration": configuration, "documentation": documentation, "checks": checks,
+                    "limitations": limitations, "decision": decision}
+        evidence["assuranceId"] = "assurance.sha256." + sha256(_canonical(evidence)).hexdigest()
+        evidence["qualification"] = decision
+        return evidence
+
+    @staticmethod
+    def _repository(root: Path, limitations: list[str]) -> dict[str, Any]:
+        valid, candidate = _git(root, "rev-parse", "HEAD"); _, branch = _git(root, "branch", "--show-current")
+        branch = branch or os.environ.get("TDE_CANDIDATE_SOURCE_BRANCH", "")
+        _, remote = _git(root, "config", "--get", "remote.origin.url"); status_ok, dirty = _git(root, "status", "--porcelain")
+        integrity = valid and status_ok and not dirty and bool(branch)
+        if not valid: limitations.append("repository identity is unavailable")
+        if not branch: limitations.append("candidate is detached from a branch")
+        if dirty: limitations.append("working tree is not clean")
+        return {"identity": remote or "local", "candidateIdentity": "candidate.git." + candidate if candidate else None,
+                "branch": branch or None, "workingTreeClean": not bool(dirty), "integrity": integrity}
+
+    @staticmethod
+    def _dependencies(root: Path, limitations: list[str]) -> dict[str, Any]:
+        project = root / "pyproject.toml"; build_tools = root / "requirements" / "build-tools.txt"; pinned = hashes = False
+        if project.is_file():
+            match = re.search(r"requires\s*=\s*\[([^]]*)\]", project.read_text(encoding="utf-8"), re.DOTALL)
+            pinned = bool(match and re.findall(r'"[^"\n]+==[^"\n]+"', match.group(1)))
+        if build_tools.is_file():
+            content = build_tools.read_text(encoding="utf-8"); hashes = "--hash=sha256:" in content and "Generated with:" in content
+        integrity = project.is_file() and pinned and build_tools.is_file() and hashes
+        if not integrity: limitations.append("dependency declarations, exact versions, and hash-locked build provenance are incomplete")
+        return {"declaration": str(project.relative_to(root)), "buildTools": str(build_tools.relative_to(root)),
+                "exactVersions": pinned, "reproducible": hashes, "provenance": hashes, "integrity": integrity}
+
+    @staticmethod
+    def _workflows(root: Path, limitations: list[str]) -> dict[str, Any]:
+        directory = root / ".github" / "workflows"; files = sorted(directory.glob("*.y*ml")) if directory.is_dir() else []
+        contents = [item.read_text(encoding="utf-8") for item in files]
+        action_references = [parse_action_reference(match.group("reference"))
+                             for content in contents for line in content.splitlines()
+                             if (match := _USES_KEY.match(line))]
+        immutable = bool(action_references) and all(reference["immutable"] for reference in action_references)
+        least_privilege = any(re.search(r"^permissions:\s*\n\s+contents:\s+read\s*$", content, re.MULTILINE) for content in contents)
+        package_build = any(item.name == "package-build.yml" and "tools/package_build.py" in content and "--require-hashes" in content for item, content in zip(files, contents))
+        integrity = bool(files) and immutable and least_privilege and package_build
+        if not integrity: limitations.append("workflow immutability, least privilege, or reproducible-build coverage is incomplete")
+        return {"workflowCount": len(files), "immutableActions": immutable, "actionReferences": action_references,
+                "leastPrivilege": least_privilege,
+                "buildReproducibility": package_build, "integrity": integrity}
+
+    @staticmethod
+    def _configuration(root: Path, limitations: list[str]) -> dict[str, Any]:
+        schema = root / "schemas" / "configuration.schema.json"; project = root / "pyproject.toml"; config = root / ".tde.yml"
+        compatible = False; provenance = None
+        try:
+            compatible = schema.is_file() and json.loads(schema.read_text(encoding="utf-8"))["properties"]["schemaVersion"]["const"] == "1.0.0"
+            if config.is_file(): provenance = RuntimeConfiguration.discover(root).digest()
+        except (KeyError, ValueError, json.JSONDecodeError): pass
+        integrity = schema.is_file() and project.is_file() and compatible
+        if not integrity: limitations.append("configuration schema compatibility or provenance is unavailable")
+        return {"schema": str(schema.relative_to(root)), "schemaCompatible": compatible, "configurationDigest": provenance, "integrity": integrity}
+
+    @staticmethod
+    def _documentation(root: Path, limitations: list[str]) -> dict[str, Any]:
+        required = ("README.md", "ENGINEERING_METHOD.md", "RUNTIME_ARCHITECTURE.md", "INTEGRATION_MODEL.md", "PACKAGING.md")
+        missing = [item for item in required if not (root / item).is_file()]
+        if missing: limitations.append("canonical documentation is missing: " + ", ".join(missing))
+        return {"required": list(required), "missing": missing, "architectureConsistent": not missing,
+                "governanceConsistent": not missing, "integrity": not missing}
+
+    @staticmethod
+    def _artifacts(directories: tuple[Path, ...], limitations: list[str]) -> dict[str, Any]:
+        if not directories:
+            limitations.append("no candidate artifact directory was supplied; artifact integrity and reproducibility were not evaluated")
+            return {"directories": [], "records": [], "checksumsVerified": False, "identityVerified": False,
+                    "reproducible": False, "provenanceVerified": False, "integrity": False}
+        records: list[dict[str, Any]] = []; valid = True; identities: list[list[tuple[str, str]]] = []
+        for directory in directories:
+            manifest = directory / "SHA256SUMS"; provenance = directory / "build-provenance.json"
+            artifacts = sorted([*directory.glob("*.whl"), *directory.glob("*.tar.gz")]) if directory.is_dir() else []
+            try:
+                expected = {line.split(maxsplit=1)[1]: "sha256:" + line.split(maxsplit=1)[0] for line in manifest.read_text(encoding="utf-8").splitlines() if line.strip()}
+                source = json.loads(provenance.read_text(encoding="utf-8")); recorded = {item["filename"]: item["digest"] for item in source["artifacts"]}
+                current = {item.name: _digest(item) for item in artifacts}; directory_valid = len(artifacts) == 2 and current == expected == recorded and bool(source.get("candidateSha"))
+            except (OSError, ValueError, KeyError, IndexError, json.JSONDecodeError): directory_valid = False; current = {}
+            valid = valid and directory_valid; identities.append(sorted(current.items()))
+            records.append({"directory": str(directory), "artifactCount": len(artifacts), "verified": directory_valid,
+                            "artifacts": [{"filename": name, "digest": digest} for name, digest in sorted(current.items())]})
+        reproducible = valid and len(identities) > 1 and all(identity == identities[0] for identity in identities[1:])
+        if not valid: limitations.append("candidate artifact checksums, identities, or build provenance are invalid")
+        if len(directories) == 1: limitations.append("one candidate artifact directory was supplied; reproducibility requires an independent second candidate")
+        elif not reproducible: limitations.append("candidate artifacts are not byte-identical across independent builds")
+        return {"directories": [str(item) for item in directories], "records": records, "checksumsVerified": valid,
+                "identityVerified": valid, "reproducible": reproducible, "provenanceVerified": valid, "integrity": valid and reproducible}

tde_runtime/trend.py

@@ -0,0 +1,73 @@
+"""Normalized, read-only trends over validated baseline evidence."""
+
+from __future__ import annotations
+
+from hashlib import sha256
+from pathlib import Path
+from typing import Any, Mapping
+
+from .baseline import BaselineRepository
+
+
+class TrendEngine:
+    """Aggregates canonical evidence history and deliberately makes no policy decision."""
+
+    def build(self, current: Mapping[str, Any], location: str | Path, history_depth: int | None = None) -> dict[str, Any]:
+        BaselineRepository._validate_evidence(current)
+        repository = BaselineRepository(location)
+        history = []
+        for path in sorted(Path(location).glob("*.json")) if Path(location).is_dir() else []:
+            history.append(repository.load(path))
+        history.sort(key=lambda item: item["createdAt"])
+        if history_depth is not None:
+            history = history[-history_depth:]
+        evidence = [item["evidence"] for item in history] + [current]
+        metric_trends = self._metrics(evidence)
+        capability_trends = self._capabilities(evidence)
+        finding_trends = self._findings(evidence)
+        qualification_history = [item.get("policyEvidence", {}).get("decision", "NOT_APPLICABLE") for item in evidence]
+        return {"trendId": "trend." + sha256("|".join(item["integrity"]["contentDigest"] for item in evidence).encode()).hexdigest()[:16],
+                "repositoryId": current["repository"]["id"], "history": [{"baselineId": item["baselineId"], "createdAt": item["createdAt"], "evidenceId": item["sourceEvidenceId"]} for item in history],
+                "comparisonReferences": [item["baselineId"] for item in history], "repositoryTrend": self._repository(metric_trends),
+                "capabilityTrends": capability_trends, "metricTrends": metric_trends, "findingTrends": finding_trends,
+                "qualificationTrend": {"history": qualification_history, "direction": self._direction(qualification_history)},
+                "window": "latest" if not history else "rolling", "limitations": []}
+
+    @staticmethod
+    def _metrics(evidence: list[Mapping[str, Any]]) -> list[dict[str, Any]]:
+        series: dict[str, list[float]] = {}
+        for snapshot in evidence:
+            for metric in snapshot.get("measurements", []):
+                if isinstance(metric.get("value"), (int, float)):
+                    series.setdefault(metric["metricKey"], []).append(metric["value"])
+        return [{"metricKey": key, "timeSeries": values, "delta": values[-1] - values[0],
+                 "movingAverage": sum(values) / len(values), "direction": TrendEngine._numeric_direction(values)} for key, values in sorted(series.items())]
+
+    @staticmethod
+    def _capabilities(evidence: list[Mapping[str, Any]]) -> list[dict[str, Any]]:
+        states: dict[str, list[str]] = {}
+        for snapshot in evidence:
+            for result in snapshot.get("capabilityResults", []):
+                states.setdefault(result["capabilityId"], []).append(result.get("status", "UNKNOWN"))
+        return [{"capabilityId": key, "history": values, "direction": "STABLE" if len(set(values)) == 1 else "CHANGED"} for key, values in sorted(states.items())]
+
+    @staticmethod
+    def _findings(evidence: list[Mapping[str, Any]]) -> list[dict[str, Any]]:
+        seen: dict[str, int] = {}
+        for snapshot in evidence:
+            for finding in snapshot.get("findings", []):
+                seen[finding["findingId"]] = seen.get(finding["findingId"], 0) + 1
+        return [{"findingId": key, "occurrences": count, "state": "PERSISTENT" if count > 1 else "INTRODUCED"} for key, count in sorted(seen.items())]
+
+    @staticmethod
+    def _repository(metrics: list[Mapping[str, Any]]) -> dict[str, Any]:
+        size = next((item for item in metrics if item["metricKey"] == "code_size.code_lines"), None)
+        return {"growth": size["delta"] if size else None, "direction": size["direction"] if size else "NOT_APPLICABLE"}
+
+    @staticmethod
+    def _numeric_direction(values: list[float]) -> str:
+        return "INCREASING" if values[-1] > values[0] else "DECREASING" if values[-1] < values[0] else "STABLE"
+
+    @staticmethod
+    def _direction(values: list[str]) -> str:
+        return "STABLE" if len(set(values)) <= 1 else "CHANGED"

tde_runtime/trusted_delivery.py

@@ -0,0 +1,137 @@
+"""Canonical, evidence-only Trusted Delivery validation."""
+from __future__ import annotations
+
+from hashlib import sha256
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+from typing import Any, Mapping
+
+MANIFEST_SCHEMA_ID = "tde.trusted-delivery-manifest"
+MANIFEST_SCHEMA_VERSION = "1.0.0"
+_SHA256 = re.compile(r"^sha256:[0-9a-f]{64}$")
+_GIT_SHA = re.compile(r"^[0-9a-f]{40}$")
+
+
+def _canonical(value: object) -> bytes:
+    return (json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True) + "\n").encode("utf-8")
+
+
+def _git(root: Path, *arguments: str) -> tuple[bool, str]:
+    completed = subprocess.run(["git", "-C", str(root), *arguments], text=True, capture_output=True, check=False)
+    return completed.returncode == 0, completed.stdout.strip()
+
+
+class TrustedDelivery:
+    """Bind a candidate to assurance, artifact, manifest, and workflow evidence.
+
+    This layer deliberately consumes Software Assurance evidence instead of
+    re-evaluating assurance rules or making a release/publication decision.
+    """
+
+    def validate(self, root: str | Path, runtime_evidence: Mapping[str, Any] | None,
+                 assurance_evidence: Mapping[str, Any] | None = None, manifest: str | Path | None = None) -> dict[str, Any]:
+        root = Path(root).resolve(); limitations: list[str] = []
+        candidate = self._candidate(root, limitations)
+        manifest_evidence = self._manifest(Path(manifest).resolve() if manifest else None, candidate, limitations)
+        assurance = self._assurance(assurance_evidence, limitations)
+        artifacts = self._artifacts(manifest_evidence, assurance, limitations)
+        workflow = self._workflow(root, assurance, limitations)
+        runtime_ok = runtime_evidence is not None and runtime_evidence.get("validation", {}).get("status") == "VALID"
+        if not runtime_ok:
+            limitations.append("validated Runtime evidence is unavailable")
+        checks = {
+            "candidateIntegrity": candidate["integrity"],
+            "manifestIntegrity": manifest_evidence["integrity"],
+            "artifactIntegrity": artifacts["integrity"],
+            "workflowIntegrity": workflow["integrity"],
+            "softwareAssuranceIntegrity": assurance["integrity"],
+            "runtimeEvidenceIntegrity": runtime_ok,
+            "buildProvenanceValidation": artifacts["provenanceValidated"],
+        }
+        # An omitted external delivery manifest/artifact is a bounded
+        # pre-release limitation. An explicitly supplied invalid input fails
+        # closed; candidate, Runtime, and assurance failures always fail.
+        required = ("candidateIntegrity", "softwareAssuranceIntegrity", "runtimeEvidenceIntegrity")
+        invalid_input = manifest is not None and (not checks["manifestIntegrity"] or not checks["artifactIntegrity"])
+        decision = "FAIL" if not all(checks[name] for name in required) or invalid_input else "PASS_WITH_WARNINGS" if limitations else "PASS"
+        evidence = {
+            "schemaId": "tde.trusted-delivery", "schemaVersion": "1.0.0", "candidate": candidate,
+            "manifest": manifest_evidence, "artifacts": artifacts, "workflow": workflow,
+            "softwareAssurance": {"assuranceId": assurance.get("assuranceId"), "decision": assurance.get("decision")},
+            "runtimeEvidenceId": runtime_evidence.get("integrity", {}).get("contentDigest") if runtime_evidence else None,
+            "checks": checks, "limitations": limitations, "decision": decision, "qualification": decision,
+        }
+        evidence["trustedDeliveryId"] = "trusted-delivery.sha256." + sha256(_canonical(evidence)).hexdigest()
+        return evidence
+
+    @staticmethod
+    def _candidate(root: Path, limitations: list[str]) -> dict[str, Any]:
+        sha_ok, sha = _git(root, "rev-parse", "HEAD"); _, branch = _git(root, "branch", "--show-current")
+        branch = branch or os.environ.get("TDE_CANDIDATE_SOURCE_BRANCH", "")
+        _, repository = _git(root, "config", "--get", "remote.origin.url"); status_ok, dirty = _git(root, "status", "--porcelain")
+        integrity = sha_ok and bool(_GIT_SHA.fullmatch(sha)) and bool(branch) and status_ok and not dirty
+        if not integrity:
+            limitations.append("candidate SHA, repository branch, or clean working tree is invalid")
+        return {"sha": sha or None, "candidateIdentity": "candidate.git." + sha if sha else None,
+                "repository": repository or "local", "branch": branch or None, "workingTreeClean": not bool(dirty),
+                "integrity": integrity}
+
+    @staticmethod
+    def _manifest(path: Path | None, candidate: Mapping[str, Any], limitations: list[str]) -> dict[str, Any]:
+        if path is None:
+            limitations.append("no delivery manifest was supplied; manifest and artifact references were not evaluated")
+            return {"path": None, "identity": None, "integrity": False, "supplied": False, "artifacts": []}
+        try:
+            raw = path.read_bytes(); value = json.loads(raw)
+            items = value["artifacts"]
+            valid = (value.get("schemaId") == MANIFEST_SCHEMA_ID and value.get("schemaVersion") == MANIFEST_SCHEMA_VERSION
+                     and value.get("candidate", {}).get("sha") == candidate["sha"]
+                     and value.get("candidate", {}).get("repository") == candidate["repository"]
+                     and value.get("candidate", {}).get("branch") == candidate["branch"]
+                     and isinstance(items, list) and bool(items)
+                     and all(isinstance(item, dict) and isinstance(item.get("filename"), str) and _SHA256.fullmatch(item.get("digest", "")) for item in items))
+        except (OSError, ValueError, KeyError, TypeError, json.JSONDecodeError):
+            raw = b""; value = {}; items = []; valid = False
+        if not valid:
+            limitations.append("supplied delivery manifest does not meet the canonical schema, candidate, or checksum requirements")
+        return {"path": str(path), "identity": "manifest.sha256." + sha256(raw).hexdigest() if raw else None,
+                "schemaId": value.get("schemaId"), "schemaVersion": value.get("schemaVersion"), "supplied": True,
+                "candidate": value.get("candidate"), "artifacts": items, "integrity": valid}
+
+    @staticmethod
+    def _assurance(evidence: Mapping[str, Any] | None, limitations: list[str]) -> Mapping[str, Any]:
+        valid = (evidence is not None and evidence.get("schemaId") == "tde.software-assurance"
+                 and isinstance(evidence.get("assuranceId"), str) and evidence.get("decision") != "FAIL")
+        if not valid:
+            limitations.append("canonical Software Assurance evidence is unavailable or failed")
+            return {"integrity": False}
+        return {**evidence, "integrity": True}
+
+    @staticmethod
+    def _artifacts(manifest: Mapping[str, Any], assurance: Mapping[str, Any], limitations: list[str]) -> dict[str, Any]:
+        records = [artifact for directory in assurance.get("artifacts", {}).get("records", []) for artifact in directory.get("artifacts", [])]
+        supplied = bool(manifest.get("supplied"))
+        if not supplied:
+            return {"records": [], "integrity": False, "provenanceValidated": False}
+        expected = {(item["filename"], item["digest"]) for item in manifest.get("artifacts", [])}
+        actual = {(item.get("filename"), item.get("digest")) for item in records}
+        integrity = bool(assurance.get("checks", {}).get("artifactIntegrity")) and expected == actual
+        if not integrity:
+            limitations.append("manifest artifact references do not match checksum-verified, reproducible assurance artifacts")
+        return {"records": sorted(records, key=lambda item: item["filename"]), "integrity": integrity,
+                "provenanceValidated": integrity and bool(assurance.get("checks", {}).get("buildProvenanceVerification"))}
+
+    @staticmethod
+    def _workflow(root: Path, assurance: Mapping[str, Any], limitations: list[str]) -> dict[str, Any]:
+        directory = root / ".github" / "workflows"
+        records = [{"path": str(item.relative_to(root)), "digest": "sha256:" + sha256(item.read_bytes()).hexdigest()}
+                   for item in sorted(directory.glob("*.y*ml"))] if directory.is_dir() else []
+        workflow = assurance.get("workflows", {})
+        integrity = bool(workflow.get("immutableActions")) and bool(workflow.get("leastPrivilege")) and bool(records)
+        if not integrity:
+            limitations.append("workflow provenance, immutable actions, or least-privilege evidence is unavailable")
+        return {"records": records, "immutableActions": bool(workflow.get("immutableActions")),
+                "leastPrivilege": bool(workflow.get("leastPrivilege")), "integrity": integrity}

technical_debt_engine_runtime-0.1.0.dist-info/METADATA

@@ -0,0 +1,5 @@
+Metadata-Version: 2.4
+Name: technical-debt-engine-runtime
+Version: 0.1.0
+Summary: Technical Debt Engine runtime foundation API
+Requires-Python: >=3.11

technical_debt_engine_runtime-0.1.0.dist-info/RECORD

@@ -0,0 +1,33 @@
+tde_cli/__init__.py,sha256=nfLKy9af_L7AkShru2wINR11XlthP2RYas7oDEJ3RmI,108
+tde_cli/main.py,sha256=sExbye_XFA0qpD7h1qFZOLruLomeRXb6bnoBzdgvuTk,25763
+tde_runtime/__init__.py,sha256=a3F_jaulHsYtvNir7bu5h7YZYfv8LHlFbFLpianR-mQ,209
+tde_runtime/baseline.py,sha256=V6Q2NAKYsMlJJrFJ8DVUEuLatNqX7EY1IdaGePObSQo,12220
+tde_runtime/code_size.py,sha256=MZUICW01Hpr2pptZdL3xkvevy1xVvPRogyb8xk1okP4,3920
+tde_runtime/complexity.py,sha256=qkXceiNRhMDfEUW6welqCehkK-x4dW05As6LLFqAFS8,5560
+tde_runtime/configuration.py,sha256=Pk5LhOl1LAnHF4_UFIrE8fhanHRNet7zEPz8FW6n67U,4606
+tde_runtime/dependency_health.py,sha256=Q-YCLfXHHDC6nPuQoU7KUqFSYW8l477Vm6vquDYzz7M,1896
+tde_runtime/docker_artifact.py,sha256=4Xtc8WKAkxXbmgHkMj6p40VivQUpJyVl8ATLHyfZPyo,2270
+tde_runtime/evidence_store.py,sha256=w2lzPZ-KnhXKZlBY5hnpWl58Ld8i20vG_lUXCpq8BQk,4062
+tde_runtime/execution.py,sha256=qvKxS7DfNQlHpOLSHv9HHlVDPKHFjOkq3ofPVqctwpw,17288
+tde_runtime/maintainability.py,sha256=cFlSogrKeoh7reQ1uHx7s_QHga6zPZaptscyl_QjI5s,1282
+tde_runtime/models.py,sha256=wa--Ryn8y81lGSCc6qqcRHys2KJYt4R0Qtczm6O7m8E,1789
+tde_runtime/policy.py,sha256=bRfKWRa4rBxutYItF-SJUp1X1JXZqHJoS303_RQNJb4,12503
+tde_runtime/query.py,sha256=wiFafUy5ah1mHes8p5k5dHe6txsjHSGnFVR9PjIJ2V4,2626
+tde_runtime/registries.py,sha256=weJ9JyRpqjYVkyY8KOFRp9VXyphmNcksiBVzqoKGAKc,903
+tde_runtime/release_bundle.py,sha256=g9XmdtIiUfGoluUo40awtQUdXOpghhwWsSN05vZdbdQ,1744
+tde_runtime/release_candidate.py,sha256=G69PalpAZWetHgGE_dpkMq7QG7j85wVl4ku64uriDBQ,3519
+tde_runtime/release_certification.py,sha256=adyZh6EvXQODUIYxxWn9cyjKEosUOJrcXZD5twP66IE,5865
+tde_runtime/release_publication.py,sha256=LUruMnUpa9LWkysfPeaoMTQJ1IZEJaO1o3B4forzass,8318
+tde_runtime/release_qualification.py,sha256=zStbHQDbzExhUOq7Hur0eAHcoDrobeFZ29CHBDyL59E,7076
+tde_runtime/runtime.py,sha256=ccD0psn76VgKL3gWuiVuUzu9ERrqgzdSl7UbjVwBzX8,12918
+tde_runtime/runtime_qualification.py,sha256=edDuGrcZPVUywq7syL8Tx3z_e5A60bJzSyVt3dVNtBs,4075
+tde_runtime/software_assurance.py,sha256=PuHqwtGwV7jrwZFERbQmrdAsq3qYAq2_JWcK9nnTJn8,12669
+tde_runtime/trend.py,sha256=lHI_HhqQ5w-bZrL7KUuRP7_G9zwSRRO1bUSDPe_7k9w,4258
+tde_runtime/trusted_delivery.py,sha256=R1PHQP6l1tcbK3au-3jbVdrdK4SGIqx8SfCY3Rq9emo,8826
+tde_runtime/policies/__init__.py,sha256=BElFqFO-IljGDlnnJsBmc0yfm_FOh3vWRbrnAc7K1EQ,57
+tde_runtime/policies/generation-1.json,sha256=BuhZYZwT9hjRd-hf4vKENwSwy8DRIv_g3aOSRP2TDvU,1224
+technical_debt_engine_runtime-0.1.0.dist-info/METADATA,sha256=CRx_dlxoJUQZ0KwHkhpdhC0ZlWasPHE2PSaXkpcW3HE,151
+technical_debt_engine_runtime-0.1.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+technical_debt_engine_runtime-0.1.0.dist-info/entry_points.txt,sha256=Stpn7-vZYlZ8VYVfoscTtV1DRxktV8flogT0tWFl1GE,50
+technical_debt_engine_runtime-0.1.0.dist-info/top_level.txt,sha256=Iz1bgDYbK6v7h3XujaLDy-Or-T3aRDf2BVmdtXlPOys,20
+technical_debt_engine_runtime-0.1.0.dist-info/RECORD,,

technical_debt_engine_runtime-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (80.9.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

technical_debt_engine_runtime-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+tde = tde_cli.main:console_main

technical_debt_engine_runtime-0.1.0.dist-info/top_level.txt

@@ -0,0 +1,2 @@
+tde_cli
+tde_runtime