tempus-ddb 0.4.0__tar.gz

tempus_ddb-0.4.0/.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.whl binary
+*.db binary
+*.sqlite binary
+*.sqlite3 binary

tempus_ddb-0.4.0/.github/CODEOWNERS

@@ -0,0 +1,9 @@
+# Default ownership
+* @elbuilder77
+
+# Security-sensitive protocol and release surfaces
+/src/ @elbuilder77
+/python/tempus_ddb/ @elbuilder77
+/.github/workflows/ @elbuilder77
+/SECURITY.md @elbuilder77
+/THREAT_MODEL.md @elbuilder77

tempus_ddb-0.4.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,70 @@
+name: Bug report
+description: Report a reproducible defect in Tempus DDB
+title: "bug: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for helping improve Tempus DDB. Do not include keys, tokens, private
+        payloads, or vulnerability details. Report security issues through the private
+        advisory link instead.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Preflight
+      options:
+        - label: I searched existing issues for this problem.
+          required: true
+        - label: This report does not disclose a security vulnerability or secret.
+          required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Affected surface
+      options:
+        - Rust core
+        - Python API
+        - CLI
+        - MCP server
+        - GitHub executor
+        - Vault Transit signer
+        - Packaging or CI
+        - Documentation
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      placeholder: "0.4.0 or git SHA"
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      placeholder: "OS, Python version, Rust version, installation method"
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Include sanitized commands, inputs, and the smallest example that fails.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior and logs
+      description: Remove secrets and private business data before submitting.
+    validations:
+      required: true

tempus_ddb-0.4.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/elbuilder77/tempus-ddb/security/advisories/new
+    about: Report vulnerabilities privately. Do not open a public issue.
+  - name: Discussions
+    url: https://github.com/elbuilder77/tempus-ddb/discussions
+    about: Ask usage questions and discuss protocol or product ideas.

tempus_ddb-0.4.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,55 @@
+name: Feature request
+description: Propose a focused product or protocol improvement
+title: "feat: "
+labels:
+  - enhancement
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Explain the user problem before proposing an implementation. Changes to signed
+        contracts or trust boundaries may require a design discussion first.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Preflight
+      options:
+        - label: I searched existing issues and the public roadmap.
+          required: true
+        - label: This request is consistent with the documented product invariant and non-goals.
+          required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Who is affected, and what cannot be done safely or reliably today?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: Describe observable behavior and acceptance criteria.
+    validations:
+      required: true
+  - type: dropdown
+    id: impact
+    attributes:
+      label: Security or compatibility impact
+      options:
+        - No signed-contract or trust-boundary impact
+        - Changes a convenience API only
+        - Changes a signed contract
+        - Changes identity, policy, signer, or executor trust boundaries
+        - Unsure
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Additional evidence
+      description: Add sanitized examples, measurements, or links that clarify the request.

tempus_ddb-0.4.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,31 @@
+## Summary
+
+Describe what changed and the user-visible outcome.
+
+## Motivation
+
+Explain the problem and link the issue with `Fixes #<number>` when applicable.
+
+## Security and compatibility impact
+
+- Trust boundary affected:
+- Signed contract affected:
+- Migration required:
+- New failure mode or operational dependency:
+
+Write `None` where appropriate. Security-sensitive changes must include an adversarial
+regression test and any required threat-model update.
+
+## Validation
+
+List the exact commands and relevant manual checks performed.
+
+## Checklist
+
+- [ ] The change is focused and contains no generated artifacts or secrets.
+- [ ] Rust format, Clippy, and tests pass where applicable.
+- [ ] Ruff and pytest pass where applicable.
+- [ ] New behavior has positive and negative test coverage.
+- [ ] Unknown or unsupported states still fail closed.
+- [ ] Public contracts and migration impact were reviewed.
+- [ ] Documentation and `CHANGELOG.md` were updated when needed.

tempus_ddb-0.4.0/.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

tempus_ddb-0.4.0/.github/workflows/ci.yml

@@ -0,0 +1,106 @@
+name: CI
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  rust:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy,rustfmt
+
+      - name: Check Rust formatting
+        run: cargo fmt --check
+
+      - name: Run Cargo Clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit
+
+      - name: Run Cargo Audit
+        run: cargo audit
+
+      - name: Run Rust tests
+        env:
+          RUST_BACKTRACE: 1
+        run: cargo test --all-targets --verbose -- --nocapture
+
+  python:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    env:
+      PYTHONIOENCODING: utf-8
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        python-version: ['3.10', '3.12']
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install Python test dependencies
+        run: |
+          python -m pip install --upgrade pip "setuptools>=83.0.0"
+          python -m pip install -e .[dev]
+          python -m pip install bandit pip-audit
+
+      - name: Run Bandit
+        run: bandit -r python/tempus_ddb/
+
+      - name: Run pip-audit
+        run: pip-audit
+
+      - name: Run Ruff
+        run: ruff check .
+
+      - name: Validate SPDX SBOM generation
+        run: |
+          python scripts/generate_sbom.py --version 0.4.0-ci --output artifacts/tempus-ddb.spdx.json
+          python -c "import json; d=json.load(open('artifacts/tempus-ddb.spdx.json', encoding='utf-8')); assert d['spdxVersion']=='SPDX-2.3' and d['packages']"
+
+      - name: Run Python tests
+        run: python -m pytest tests/ -vv --tb=long -ra
+
+      - name: Test CLI basic commands
+        run: |
+          tempus --version
+          tempus --help
+          tempus-github-executor --help
+
+      - name: Smoke test examples
+        run: |
+          python examples/basic_record.py
+          python examples/verify_chain.py
+          python examples/full_agent_flow.py

tempus_ddb-0.4.0/.github/workflows/release.yml

@@ -0,0 +1,120 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: release-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build wheels on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+          - os: macos-latest
+            target: x86_64-apple-darwin
+          - os: macos-latest
+            target: aarch64-apple-darwin
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist
+          manylinux: auto
+      - name: Upload wheels
+        uses: actions/upload-artifact@v7
+        with:
+          name: wheels-${{ matrix.os }}-${{ matrix.target }}
+          path: dist
+
+  sdist:
+    name: Build sdist
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist
+      - name: Upload sdist
+        uses: actions/upload-artifact@v7
+        with:
+          name: sdist
+          path: dist
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    needs: [build, sdist]
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: wheels-*
+          path: dist
+          merge-multiple: true
+      - uses: actions/download-artifact@v8
+        with:
+          name: sdist
+          path: dist
+      - name: Generate SPDX SBOM
+        run: >-
+          python scripts/generate_sbom.py
+          --version "${{ github.event.release.tag_name }}"
+          --output "sbom/tempus-ddb-${{ github.event.release.tag_name }}.spdx.json"
+      - name: Attest release provenance
+        uses: actions/attest@v4
+        with:
+          subject-path: dist/*
+      - name: Attest release SBOM
+        uses: actions/attest@v4
+        with:
+          subject-path: dist/*
+          sbom-path: sbom/tempus-ddb-${{ github.event.release.tag_name }}.spdx.json
+      - name: Upload to GitHub Release
+        uses: svenstaro/upload-release-action@v2
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: dist/*
+          file_glob: true
+          tag: ${{ github.event.release.tag_name }}
+          overwrite: true
+      - name: Upload SBOM to GitHub Release
+        uses: svenstaro/upload-release-action@v2
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: sbom/tempus-ddb-${{ github.event.release.tag_name }}.spdx.json
+          tag: ${{ github.event.release.tag_name }}
+          overwrite: true
+
+      # Publish to PyPI using Trusted Publishing (recommended: configure at pypi.org/manage/project/tempus_ddb/settings/publishing/)
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

tempus_ddb-0.4.0/.gitignore

@@ -0,0 +1,101 @@
+# Local configuration and secrets
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.p12
+*.pfx
+*.jks
+*.keystore
+*.keys.json
+*_keys.json
+keys.json
+agent_wallet.json
+server_secret.key
+credentials*.json
+*.secrets.json
+
+# Local databases and runtime state
+*.db
+*.db-*
+*.sqlite
+*.sqlite3
+*.wal
+*.shm
+*.journal
+
+# Rust build output
+/target/
+
+# Python bytecode, environments, and tool caches
+__pycache__/
+*.py[cod]
+*$py.class
+.pytest_cache/
+pytest-cache-files-*/
+.ruff_cache/
+.mypy_cache/
+.pyre/
+.hypothesis/
+.tox/
+.nox/
+.venv/
+.venv*/
+venv/
+ENV/
+
+# Package and release artifacts
+/build/
+/dist/
+*.egg-info/
+.eggs/
+pip-wheel-metadata/
+*.whl
+*.tar.gz
+/artifacts/
+
+# Coverage, profiling, and benchmark output
+.coverage
+.coverage.*
+htmlcov/
+coverage.xml
+*.prof
+*.flamegraph.svg
+/.benchmarks/
+/benchmark-results/
+
+# Temporary workspaces and logs
+/.tmp/
+/scratch/
+/tmp/
+/temp/
+/.cache/
+.direnv/
+.python-version
+.envrc
+*.tmp
+*.temp
+*.log
+*.bak
+*.orig
+*.rej
+*.swp
+*~
+
+# Editors and operating systems
+.agents/
+.codex/
+.claude/
+.cursor/
+.windsurf/
+.zed/
+.idea/
+.vscode/
+.vs/
+*.suo
+*.user
+*.code-workspace
+.DS_Store
+Thumbs.db
+Desktop.ini

tempus_ddb-0.4.0/CHANGELOG.md

@@ -0,0 +1,122 @@
+# Changelog
+
+## [Unreleased]
+
+## [0.4.0] - 2026-08-27
+
+### Fixed
+
+- Kept the Rust quality gate compatible with current stable Clippy.
+- Validate GitHub executor endpoints as absolute HTTPS URLs before an outbound request;
+  malformed, credential-bearing, query-bearing, and plaintext endpoints fail closed.
+- Restored standards-compliant Python package metadata by keeping `keywords` in the
+  project metadata rather than treating it as an install extra.
+
+### Changed
+
+- Reused a bounded, configurable SQLite connection pool in the mediated executor instead
+  of opening a new connection for every state transition.
+- Added a recovery index and concurrent replay regression coverage proving that only one
+  contender can consume a permit.
+- Moved runnable demonstrations and the benchmark into `examples/` so the repository
+  root contains only project configuration and public documentation.
+- Updated repository, security, discussion, ownership, and SBOM links for
+  `elbuilder77/tempus-ddb`.
+
+### Phase 3
+
+- A provider-neutral Rust signer boundary and verification-key resolver with compatible
+  local Ed25519 and Vault Transit CLI backends. Signer URI, key version, and algorithm are
+  bound into signed artifacts; unknown providers, algorithms, versions, and malformed
+  responses fail closed.
+- Signed deterministic policy bundles covering tenant, action type, resource, input size,
+  optional money constraints, TTL, and allowed executors. Permits now bind the policy
+  digest, reproducible evidence digest, executor constraints, and complete reason codes.
+- Tenant-scoped identity delegation plus signed rotation and revocation events. Historical
+  receipts resolve the key valid at signing time, while emergency revocation invalidates
+  unconsumed permits.
+- `tempus doctor`, policy and identity lifecycle commands, signer conformance checks, and
+  a machine-readable adapter conformance fixture.
+- SPDX 2.3 SBOM generation and GitHub artifact provenance/SBOM attestations in the release
+  workflow, plus a compatibility policy and Vault Transit operating guide.
+- Package maturity advances to design-partner beta (`0.4.0`). Existing v1 schema names
+  remain compatible; the Phase 3 binding fields are additive and enforced by executors.
+
+Live credentialed Vault and GitHub checks remain explicit opt-in tests; an integration
+that was not run is never reported as passing.
+
+### Added
+
+- First complete local B2A authorization flow: signed action intent, gate permit,
+  executor outcome, final receipt, trace reading, and end-to-end verification.
+- Stable versioned JSON contracts and closed machine statuses for autonomous consumers.
+- Signed, immutable agent registration events with a gate delegation root.
+- Deterministic action idempotency, expiring permits, and single-consumption outcomes.
+- Rust, Python, CLI, and MCP B2A surfaces plus replay/tamper/authorization tests.
+- Public protocol boundary and production-oriented threat-model documentation.
+- Signed MCP authorization and outcome tools for clients that keep agent and executor
+  private keys outside the gate process.
+- Signed executor observations for `STARTED`, `SUCCEEDED`, `FAILED`, and `UNKNOWN`, plus
+  restart recovery that never replays an ambiguous external effect.
+- Packaged `tempus-github-executor` for exactly bound GitHub issue and pull-request
+  creation with an executor-only credential.
+- A public product roadmap with ordered Phase 3 trust and adoption milestones.
+- Dependabot coverage for Cargo, Python, and GitHub Actions dependencies.
+
+### Changed
+
+- MCP defaults to the autonomous execution-gate surface. Administrative, legacy, and
+  destructive tools now require explicit environment flags.
+- Product positioning now treats money as optional action metadata and humans as
+  read-only auditors rather than transaction approvers.
+- Default MCP mode now exposes only signed B2A write tools. The compatibility tools
+  that receive local keyfile paths require `TEMPUS_LOCAL_KEYFILE_TOOLS=1`.
+- Phase 2 is complete for the single-instance GitHub adapter, including policy-version
+  checks, exact argument binding, credential isolation, and crash recovery.
+- Package metadata now reflects the actual Python 3.10+ MCP dependency and alpha status.
+- The Python package exports its installed version and the GitHub executor derives its
+  user-agent version from package metadata.
+- Tests and runnable examples use self-cleaning temporary workspaces instead of leaving
+  databases and generated keys in the repository root.
+
+### Security
+
+- Agent registrations can no longer be silently replaced.
+- The gate signing key is server-controlled for MCP authorization requests.
+- Unregistered agents are blocked before execution and conflicting permit reuse is
+  rejected.
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.1] - 2026-06-26
+
+### Changed
+- Updated examples to the current free core API.
+- Added smoke-test coverage for runnable example scripts.
+- Stabilized release readiness for the free/open-core packaging and CI path.
+
+## [0.2.0] - 2026-06-26
+
+### Added
+- Comprehensive CLI improvements: `tempus record`, `tempus status`, `tempus --version`
+- Expanded test coverage with Python API tests and CLI integration tests
+- Multiple end-to-end examples in `examples/`
+- GitHub Actions CI workflow for multi-OS/Python testing
+- Module docstrings and improved Python API documentation
+
+### Changed
+- Removed license gate entirely from Rust core and Python bindings for true free/open nature
+- Simplified `TempusDDB` constructor to `TempusDDB(db_path, keyfile)`
+- Updated positioning to emphasize "free, local-first, tamper-evident"
+- Improved error handling and UX across CLI
+
+### Fixed
+- License generation to properly support direct CLI usage
+- Constructor calls in tests and examples
+
+## [0.1.0] - Previous
+
+Initial public version with core Rust engine, MCP integration, and basic CLI.