unidpp 0.1.0__tar.gz

unidpp-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 UniDPP contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

unidpp-0.1.0/PKG-INFO

@@ -0,0 +1,117 @@
+Metadata-Version: 2.4
+Name: unidpp
+Version: 0.1.0
+Summary: UniDPP Python library: mirrored model, commitment-chained event log, verification-pipeline harness, conformance runners, EPCIS/UNTP adapters
+Author: UniDPP contributors
+License: MIT
+Project-URL: Homepage, https://github.com/unidpp/unidpp-py
+Keywords: digital-product-passport,dpp,unidpp,traceability,espr
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: build; extra == "dev"
+Dynamic: license-file
+
+# unidpp-py
+
+The UniDPP Python library — the semantics mirror and conformance
+tooling. Part of UniDPP (github.com/unidpp). License: MIT.
+
+Pure stdlib (no runtime dependencies). The package mirrors the
+Rust/TypeScript core so the semantics have a second, independent
+statement:
+
+- `unidpp.model` — the mirrored model (documents, findings, verdicts);
+- `unidpp.eventlog` — the commitment-chained event log;
+- `unidpp.verify` — the verification-pipeline harness (the I13
+  degradation ladder + I9 verdicts; stdlib `hmac`/`hashlib` replace
+  WebCrypto, ECDSA is a deliberate unsupported-slot placeholder per
+  the multi-suite degrade model);
+- `unidpp.canonical` — canonical JSON (RFC 8785-lite);
+- `unidpp.adapters` — protocol adapters: `untp` (UNTP verifiable
+  credentials), `en18223` (the EN 18223 document validator +
+  EU-profile runner), `epcis`;
+- `unidpp.temporal` — the DPP temporal profile;
+- `unidpp.carrier` — QR carrier-budget conformance;
+- `unidpp.conformance` — the conformance runner.
+
+## Conformance
+
+The conformance runner proves the validators catch real defects, not
+synthetic strawmen. `CHECK_REGISTRY` carries the check classes:
+
+| check | what it proves |
+|---|---|
+| `positive-corpus` | the ported TS fixtures (laptop, car) validate against the wire schemas and their chains verify |
+| `audit-negative` | the AUDIT A1–A6 corpus defects (found in EN 18223's own examples) fail with precise findings |
+| `temporal-conformance` | every timestamp field conforms to the DPP temporal profile (ISO 8601-1:2019 incl. Amd 1:2022 disambiguation) |
+| `carrier-budget` | serialized payload sizes fit their declared carrier class (ISO/IEC 18004 QR capacity tables, ported from the CLI) |
+
+```sh
+python -m unidpp.conformance --out reports/
+```
+
+The **temporal profile** (`unidpp.temporal`) validates every
+timestamp field with a distinct finding code — separator typography
+(`T1`, the en-dash the EN's own Annex B prints), extended-format and
+precision rules, calendar ranges, the `24:00:00` end-of-day form,
+timezone discipline, and the decimal sign:
+
+```pycon
+>>> from unidpp.temporal import validate_timestamp
+>>> validate_timestamp("2025–08–22T03:12:00Z", "lastUpdated").code
+'T1-separator-typography'
+>>> validate_timestamp("2025-08-22T03:12:00Z", "lastUpdated") is None
+True
+```
+
+The **carrier budget** (`unidpp.carrier`) measures the canonical
+serialized size of a payload against the ported ISO/IEC 18004 QR
+byte-capacity tables; a payload that exceeds its declared class is
+flagged with the computed size versus the capacity — never silently
+truncated:
+
+```pycon
+>>> from unidpp.carrier import measure
+>>> m = measure({"a": "x" * 380}, declared="qr-v15-M")
+>>> (m.size_bytes, m.fits_declared)
+(388, True)
+```
+
+Two report suites build on the runner (`scripts/`):
+
+- **EU profile** (`eu_profile_report.py`) — the full EN 18223:2026
+  example corpus through the validators. The corpus itself is an
+  extraction from licensed sources and is deliberately **not
+  distributed** with the repository (gitignored); the suite runs
+  where the corpus is present and its findings are published as
+  `conformance/eu-profile/REPORT.md`.
+- **Competitor register** (`competitor_report.py`) — the published
+  artifacts of the open-source DPP implementations (freeDPP live
+  endpoints, open-dpp's e2e fixture) through the same pipeline, with
+  verbatim source citations; findings in
+  `conformance/competitors/REPORT.md`.
+
+## Build & test
+
+```sh
+pip install -e ".[test]"
+pytest
+```
+
+The suite covers the model, event log, verification ladder, adapters
+(UNTP round-trip, EN 18223 projection), the conformance checks
+(temporal, carrier, corpus), and the competitor register. The
+EU-profile corpus tests skip automatically when the licensed
+extraction is not present.

unidpp-0.1.0/README.md

@@ -0,0 +1,92 @@
+# unidpp-py
+
+The UniDPP Python library — the semantics mirror and conformance
+tooling. Part of UniDPP (github.com/unidpp). License: MIT.
+
+Pure stdlib (no runtime dependencies). The package mirrors the
+Rust/TypeScript core so the semantics have a second, independent
+statement:
+
+- `unidpp.model` — the mirrored model (documents, findings, verdicts);
+- `unidpp.eventlog` — the commitment-chained event log;
+- `unidpp.verify` — the verification-pipeline harness (the I13
+  degradation ladder + I9 verdicts; stdlib `hmac`/`hashlib` replace
+  WebCrypto, ECDSA is a deliberate unsupported-slot placeholder per
+  the multi-suite degrade model);
+- `unidpp.canonical` — canonical JSON (RFC 8785-lite);
+- `unidpp.adapters` — protocol adapters: `untp` (UNTP verifiable
+  credentials), `en18223` (the EN 18223 document validator +
+  EU-profile runner), `epcis`;
+- `unidpp.temporal` — the DPP temporal profile;
+- `unidpp.carrier` — QR carrier-budget conformance;
+- `unidpp.conformance` — the conformance runner.
+
+## Conformance
+
+The conformance runner proves the validators catch real defects, not
+synthetic strawmen. `CHECK_REGISTRY` carries the check classes:
+
+| check | what it proves |
+|---|---|
+| `positive-corpus` | the ported TS fixtures (laptop, car) validate against the wire schemas and their chains verify |
+| `audit-negative` | the AUDIT A1–A6 corpus defects (found in EN 18223's own examples) fail with precise findings |
+| `temporal-conformance` | every timestamp field conforms to the DPP temporal profile (ISO 8601-1:2019 incl. Amd 1:2022 disambiguation) |
+| `carrier-budget` | serialized payload sizes fit their declared carrier class (ISO/IEC 18004 QR capacity tables, ported from the CLI) |
+
+```sh
+python -m unidpp.conformance --out reports/
+```
+
+The **temporal profile** (`unidpp.temporal`) validates every
+timestamp field with a distinct finding code — separator typography
+(`T1`, the en-dash the EN's own Annex B prints), extended-format and
+precision rules, calendar ranges, the `24:00:00` end-of-day form,
+timezone discipline, and the decimal sign:
+
+```pycon
+>>> from unidpp.temporal import validate_timestamp
+>>> validate_timestamp("2025–08–22T03:12:00Z", "lastUpdated").code
+'T1-separator-typography'
+>>> validate_timestamp("2025-08-22T03:12:00Z", "lastUpdated") is None
+True
+```
+
+The **carrier budget** (`unidpp.carrier`) measures the canonical
+serialized size of a payload against the ported ISO/IEC 18004 QR
+byte-capacity tables; a payload that exceeds its declared class is
+flagged with the computed size versus the capacity — never silently
+truncated:
+
+```pycon
+>>> from unidpp.carrier import measure
+>>> m = measure({"a": "x" * 380}, declared="qr-v15-M")
+>>> (m.size_bytes, m.fits_declared)
+(388, True)
+```
+
+Two report suites build on the runner (`scripts/`):
+
+- **EU profile** (`eu_profile_report.py`) — the full EN 18223:2026
+  example corpus through the validators. The corpus itself is an
+  extraction from licensed sources and is deliberately **not
+  distributed** with the repository (gitignored); the suite runs
+  where the corpus is present and its findings are published as
+  `conformance/eu-profile/REPORT.md`.
+- **Competitor register** (`competitor_report.py`) — the published
+  artifacts of the open-source DPP implementations (freeDPP live
+  endpoints, open-dpp's e2e fixture) through the same pipeline, with
+  verbatim source citations; findings in
+  `conformance/competitors/REPORT.md`.
+
+## Build & test
+
+```sh
+pip install -e ".[test]"
+pytest
+```
+
+The suite covers the model, event log, verification ladder, adapters
+(UNTP round-trip, EN 18223 projection), the conformance checks
+(temporal, carrier, corpus), and the competitor register. The
+EU-profile corpus tests skip automatically when the licensed
+extraction is not present.

unidpp-0.1.0/pyproject.toml

@@ -0,0 +1,36 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "unidpp"
+version = "0.1.0"
+description = "UniDPP Python library: mirrored model, commitment-chained event log, verification-pipeline harness, conformance runners, EPCIS/UNTP adapters"
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+authors = [{ name = "UniDPP contributors" }]
+keywords = ["digital-product-passport", "dpp", "unidpp", "traceability", "espr"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = []
+
+[project.optional-dependencies]
+test = ["pytest>=7"]
+dev = ["pytest>=7", "build"]
+
+[project.urls]
+Homepage = "https://github.com/unidpp/unidpp-py"
+
+[tool.setuptools.packages.find]
+include = ["unidpp*"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

unidpp-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

unidpp-0.1.0/tests/test_adapters.py

@@ -0,0 +1,196 @@
+"""Adapters: EPCIS event import (commissioning/aggregation/transformation)
+and UNTP passport stub parsing."""
+
+from typing import ClassVar
+
+import pytest
+
+from unidpp.adapters import map_epcis_event, parse_untp_stub, transformation_balance
+from unidpp.adapters.epcis import UnsupportedEpcisEvent, map_epcis_document
+from unidpp.eventlog import append_event, verify_chain
+from unidpp.model import ModelError, validate_event, validate_manifest
+
+
+class TestEpcisCommissioning:
+    def test_maps_to_passport_created(self):
+        events = map_epcis_event(
+            {
+                "type": "ObjectEvent",
+                "action": "ADD",
+                "bizStep": "urn:epcglobal:cbv:bizstep:commissioning",
+                "eventTime": "2026-09-01T10:00:00.000Z",
+                "epcList": ["urn:epc:id:sgtin:0614141.107346.2017"],
+            }
+        )
+        assert len(events) == 1
+        evt = events[0]
+        assert evt.type == "passport.created"
+        assert evt.subject == "urn:epc:id:sgtin:0614141.107346.2017"
+        chained = append_event([], evt)
+        assert validate_event(chained[0]).valid
+
+    def test_mapped_events_chain(self):
+        log: list = []
+        log = append_event(
+            log,
+            map_epcis_event(
+                {
+                    "type": "ObjectEvent",
+                    "action": "ADD",
+                    "bizStep": "commissioning",
+                    "eventTime": "2026-09-01T10:00:00Z",
+                    "epcList": ["urn:epc:id:sgtin:0614141.107346.2017"],
+                }
+            )[0],
+        )
+        assert verify_chain(log)
+
+
+class TestEpcisAggregation:
+    def test_maps_to_upgrade_install_per_child(self):
+        events = map_epcis_event(
+            {
+                "type": "AggregationEvent",
+                "action": "ADD",
+                "eventTime": "2026-09-02T10:00:00Z",
+                "parentID": "urn:epc:id:sscc:0614141.1234567890",
+                "childEPCs": [
+                    "urn:epc:id:sgtin:0614141.107346.2017",
+                    "urn:epc:id:sgtin:0614141.107346.2018",
+                ],
+            }
+        )
+        assert [e.type for e in events] == ["upgrade.install", "upgrade.install"]
+        assert {e.payload["childId"] for e in events} == {
+            "urn:epc:id:sgtin:0614141.107346.2017",
+            "urn:epc:id:sgtin:0614141.107346.2018",
+        }
+        log: list = []
+        for e in events:
+            log = append_event(log, e)
+        for e in log:
+            assert validate_event(e).valid
+
+    def test_delete_action_not_mapped(self):
+        with pytest.raises(UnsupportedEpcisEvent):
+            map_epcis_event(
+                {
+                    "type": "AggregationEvent",
+                    "action": "DELETE",
+                    "eventTime": "2026-09-02T10:00:00Z",
+                    "parentID": "urn:x",
+                    "childEPCs": ["urn:y"],
+                }
+            )
+
+
+class TestEpcisTransformation:
+    def _evt(self, outputs, inputs):
+        return map_epcis_event(
+            {
+                "type": "TransformationEvent",
+                "eventTime": "2029-01-15T08:00:00Z",
+                "transformationID": "urn:x:recycle-run-1",
+                "inputQuantityList": inputs,
+                "outputQuantityList": outputs,
+            }
+        )[0]
+
+    def test_maps_to_material_decompose_with_references(self):
+        evt = self._evt(
+            outputs=[
+                {"epcClass": "urn:x:cells", "quantity": 40.0, "uom": "KGM"},
+                {"epcClass": "urn:x:casing", "quantity": 8.0, "uom": "KGM"},
+                {"epcClass": "urn:x:electronics", "quantity": 5.0, "uom": "KGM"},
+            ],
+            inputs=[{"epcClass": "urn:x:battery", "quantity": 53.0, "uom": "KGM"}],
+        )
+        assert evt.type == "material.decompose"
+        assert evt.payload["inputReferences"][0]["passportId"] == "urn:x:battery"
+        assert validate_event(append_event([], evt)[0]).valid
+        balance = transformation_balance(evt)
+        assert balance.balanced and balance.loss == 0.0
+
+    def test_mass_violation_detected(self):
+        evt = self._evt(
+            outputs=[{"epcClass": "urn:x:gold", "quantity": 60.0, "uom": "KGM"}],
+            inputs=[{"epcClass": "urn:x:battery", "quantity": 53.0, "uom": "KGM"}],
+        )
+        assert not transformation_balance(evt).balanced
+
+    def test_balance_requires_transformation_event(self):
+        evt = self._evt(
+            outputs=[{"epcClass": "urn:x:cells", "quantity": 1.0, "uom": "KGM"}],
+            inputs=None,
+        )
+        evt.type = "inspection.stamp"  # not a transformation
+        with pytest.raises(ModelError):
+            transformation_balance(evt)
+
+    def test_document_mapping(self):
+        doc = {
+            "@context": ["https://ref.gs1.org/standards/epcis/epcis-2.0.json"],
+            "type": "EPCISDocument",
+            "eventList": [
+                {
+                    "type": "ObjectEvent",
+                    "action": "ADD",
+                    "bizStep": "commissioning",
+                    "eventTime": "2026-09-01T10:00:00Z",
+                    "epcList": ["urn:epc:id:sgtin:0614141.107346.2017"],
+                },
+                {
+                    "type": "AggregationEvent",
+                    "action": "ADD",
+                    "eventTime": "2026-09-02T10:00:00Z",
+                    "parentID": "urn:x:kit",
+                    "childEPCs": ["urn:epc:id:sgtin:0614141.107346.2017"],
+                },
+            ],
+        }
+        events = map_epcis_document(doc)
+        assert [e.type for e in events] == ["passport.created", "upgrade.install"]
+        log: list = []
+        for e in events:
+            log = append_event(log, e)
+        assert verify_chain(log)
+
+
+class TestUntpStub:
+    STUB: ClassVar[dict] = {
+        "@context": ["https://ref.gs1.org/gs1/v/model"],
+        "type": "ProductPassport",
+        "id": "https://example.com/passports/123",
+        "productIdentifiers": [
+            {"scheme": "https://gs1.org/voc/", "value": "(01)09506000134352(21)BP52-000841"}
+        ],
+        "passportIssuer": {"id": "urn:example:issuer:1", "name": "Example Cells"},
+        "validFrom": "2026-09-01T00:00:00Z",
+        "validUntil": "2036-09-01T00:00:00Z",
+        "standardsConformance": [
+            {"standard": "ESPR", "conformanceVersion": "1"}
+        ],
+    }
+
+    def test_parse_into_neutral_manifest(self):
+        manifest = parse_untp_stub(self.STUB, as_of="2026-09-05T00:00:00Z")
+        assert manifest.subject_id.scheme == "gs1"
+        assert manifest.subject_id.value == "(01)09506000134352(21)BP52-000841"
+        assert manifest.status == "active"
+        assert manifest.profiles[0].profile_id == "ESPR"
+        assert manifest.event_log.log_uri == "https://example.com/passports/123"
+        assert validate_manifest(manifest).valid
+
+    def test_import_receipt_commitment_is_stable(self):
+        m1 = parse_untp_stub(self.STUB, as_of="2026-09-05T00:00:00Z")
+        m2 = parse_untp_stub(self.STUB, as_of="2026-09-05T00:00:00Z")
+        assert m1.event_log.commitment == m2.event_log.commitment
+        assert len(m1.event_log.commitment) == 64
+
+    def test_rejects_non_passport(self):
+        with pytest.raises(ValueError):
+            parse_untp_stub({"type": "DeliveryNote"}, as_of="2026-09-05T00:00:00Z")
+
+    def test_rejects_stub_without_identifiers(self):
+        with pytest.raises(ValueError):
+            parse_untp_stub({"type": "ProductPassport"}, as_of="2026-09-05T00:00:00Z")

unidpp-0.1.0/tests/test_carrier.py

@@ -0,0 +1,198 @@
+"""Carrier conformance: ISO/IEC 18004 QR capacity tables ported from the
+CLI, the budget grammar, canonical serialized sizes, and the carrier
+fixtures — a payload known to fit QR v15-M passes; an oversized payload
+is flagged with the computed size versus the capacity; the reports carry
+the carrier column."""
+
+from pathlib import Path
+
+import pytest
+
+from unidpp import carrier
+from unidpp.carrier import (
+    CarrierBudgetError,
+    byte_capacity,
+    check_payload,
+    measure,
+    min_version_for,
+    parse_budget,
+    render,
+    serialized_size,
+)
+from unidpp.conformance import CHECK_REGISTRY, carrier_fixtures, run_conformance
+
+COMPETITORS = Path(__file__).resolve().parents[1] / "conformance" / "competitors"
+EU_FIXTURES = (
+    Path(__file__).resolve().parents[1]
+    / "conformance"
+    / "eu-profile"
+    / "fixtures"
+    / "en-18223"
+)
+
+
+class TestPortedCapacityTables:
+    def test_known_capacities_match_the_cli_tables(self):
+        # Spot values from unidpp-core/crates/tier_a/src/qr.rs tests.
+        assert byte_capacity(1, "L") == 17
+        assert byte_capacity(1, "H") == 7
+        assert byte_capacity(10, "M") == 213
+        assert byte_capacity(40, "L") == 2953
+        assert byte_capacity(40, "M") == 2331
+        assert byte_capacity(40, "H") == 1273
+
+    def test_the_en18220_class_span_is_covered(self):
+        # v10-M floor through v40-H ceiling (the plan's EN 18220 span).
+        lo, hi = carrier.EN18220_QR_CLASS_SPAN
+        assert byte_capacity(10, "M") == 213
+        assert byte_capacity(40, "H") == 1273
+        assert parse_budget(lo) == ("M", 10)
+        assert parse_budget(hi) == ("H", 40)
+        assert len(carrier.QR_BYTE_CAPACITY["M"]) == 40
+
+    def test_out_of_range_arguments_raise(self):
+        with pytest.raises(CarrierBudgetError):
+            byte_capacity(0, "M")
+        with pytest.raises(CarrierBudgetError):
+            byte_capacity(41, "M")
+        with pytest.raises(CarrierBudgetError):
+            byte_capacity(15, "X")
+
+    def test_min_version_for(self):
+        assert min_version_for(17, "L") == 1
+        assert min_version_for(18, "L") == 2
+        assert min_version_for(412, "M") == 15  # v15-M holds 412
+        assert min_version_for(413, "M") == 16
+        assert min_version_for(2953, "L") == 40
+        assert min_version_for(2954, "L") is None
+
+
+class TestBudgetGrammar:
+    def test_valid_tokens_parse_case_insensitively(self):
+        assert parse_budget("qr-v15-M") == ("M", 15)
+        assert parse_budget("QR-V3-h") == ("H", 3)
+        assert parse_budget(" qr-v40-m ") == ("M", 40)
+
+    def test_invalid_tokens_rejected(self):
+        for bad in ("qr-v0-M", "qr-v41-M", "qr-v15-X", "qr-vX-M", "qr-v15", "v15-M"):
+            with pytest.raises(CarrierBudgetError):
+                parse_budget(bad)
+
+
+class TestSerializedSize:
+    def test_canonical_size_is_the_compact_form(self):
+        assert serialized_size({"a": 1}) == len(b'{"a":1}')
+        assert serialized_size({"b": 2, "a": 1}) == len(b'{"a":1,"b":2}')
+
+    def test_model_objects_are_measured_in_wire_form(self):
+        from unidpp.model import ProductIdentifier
+
+        pid = ProductIdentifier("ma", "MA.1", "item", "live")
+        assert serialized_size(pid) == serialized_size(pid.to_dict())
+
+
+class TestCheckPayload:
+    def test_fixture_known_to_fit_qr_v15_m_passes(self):
+        fixtures = {f.name: f for f in carrier_fixtures()}
+        fits = fixtures["dpp-fits-qr-v15-m"]
+        findings = check_payload(fits.data["payload"], fits.data["declaredCarrier"])
+        assert findings == []
+        m = measure(fits.data["payload"], declared=fits.data["declaredCarrier"])
+        assert m.fits_declared is True
+        assert 363 <= m.size_bytes <= 412  # inside the v15-M band, beyond v14-M
+        assert m.min_qr_by_ec["M"] == 15
+
+    def test_oversized_payload_flagged_with_size_versus_capacity(self):
+        fixtures = {f.name: f for f in carrier_fixtures()}
+        over = fixtures["dpp-over-qr-v15-m"]
+        findings = check_payload(over.data["payload"], over.data["declaredCarrier"])
+        assert [f.code for f in findings] == ["C1-carrier-over-budget"]
+        message = findings[0].message
+        assert f"{serialized_size(over.data['payload'])} bytes" in message
+        assert "holds 412 bytes" in message
+        assert "never truncate" in message
+
+    def test_malformed_budget_token_flagged(self):
+        findings = check_payload({"a": 1}, "qr-v15-X")
+        assert [f.code for f in findings] == ["C2-carrier-budget-malformed"]
+
+    def test_undeclared_payload_produces_no_findings(self):
+        # Without a declared class the check measures only — never flags.
+        assert CHECK_REGISTRY["carrier-budget"].fn({"payload": {"a": "x" * 5000}}) == []
+
+
+class TestRunnerIntegration:
+    def test_check_registered_in_the_registry(self):
+        assert "carrier-budget" in CHECK_REGISTRY
+        assert "ISO/IEC 18004" in CHECK_REGISTRY["carrier-budget"].title
+
+    def test_runner_carrier_fixtures_run_and_pass(self):
+        report = run_conformance()
+        carrier_results = [r for r in report["results"] if r["kind"] == "carrier"]
+        assert [r["fixture"] for r in carrier_results] == [
+            "dpp-fits-qr-v15-m",
+            "dpp-over-qr-v15-m",
+        ]
+        assert all(r["outcome"] == "pass" for r in carrier_results)
+        fits, over = (r["carrier"] for r in carrier_results)
+        assert fits["declared"] == "qr-v15-M" and fits["fitsDeclared"] is True
+        assert over["declared"] == "qr-v15-M" and over["fitsDeclared"] is False
+        assert over["declaredCapacity"] == 412
+
+    def test_report_shows_the_carrier_column(self, tmp_path):
+        import unidpp.conformance as C
+
+        report = run_conformance()
+        md = C.write_markdown_report(report, tmp_path / "r.md").read_text()
+        assert "| Fixture | Kind | Outcome | Temporal | Carrier |" in md
+        assert "406 B vs 412 B · qr-v15-M (fits)" in md
+        assert "(OVER)" in md
+        assert "| AUDIT-A4 | negative | pass |" in md  # existing rows intact
+
+    def test_measurements_cover_every_result(self):
+        report = run_conformance()
+        for r in report["results"]:
+            assert r["carrier"]["sizeBytes"] > 0
+            assert set(r["carrier"]["minQrByEc"]) == {"L", "M", "Q", "H"}
+
+
+class TestReportIntegration:
+    @pytest.mark.skipif(
+        not (EU_FIXTURES / "INDEX.json").exists(),
+        reason="EN 18223 example corpus not present "
+        "(licensed extraction, not distributed with the repository)",
+    )
+    def test_eu_profile_report_carries_the_carrier_column(self):
+        from unidpp.adapters.en18223 import run_eu_profile_suite
+
+        report = run_eu_profile_suite(EU_FIXTURES)
+        by_id = {r["fixture"]: r for r in report["results"]}
+        # The EN's own Annex A Example 3 lands in the QR v15-M band.
+        ex3 = by_id["annexA-example3"]
+        assert ex3["carrier"]["sizeBytes"] == 371
+        assert ex3["carrier"]["minQrByEc"]["M"] == 15
+        # Unparseable fixtures carry no measurement.
+        assert by_id["annexA-example2"]["carrier"] is None
+
+    def test_competitor_report_carries_carrier_observations(self):
+        from scripts.competitor_report import run_competitor_suite
+
+        report = run_competitor_suite(COMPETITORS)
+        results = [r for v in report["vendors"] for r in v["results"]]
+        by_fixture = {r["fixture"]: r for r in results}
+        drill = by_fixture["drill-api-compressed"]
+        assert drill["carrier"]["sizeBytes"] == 2917  # exceeds QR v40-M? no: 2331
+        assert drill["carrier"]["minQrByEc"]["M"] is None  # 2917 > 2331
+        # The AAS artifact is measured too (size only, no findings).
+        aas = by_fixture["battery-passport.json"]
+        assert aas["carrier"]["sizeBytes"] > 0
+        assert len(aas["findings"]) == 1  # still only the coverage observation
+
+    def test_render_column_formats(self):
+        assert render(None) == "—"
+        text = render(measure({"a": "x" * 380}, declared="qr-v15-M").to_dict())
+        assert text == "388 B vs 412 B · qr-v15-M (fits)"
+        over = render(measure({"a": "x" * 5000}, declared="qr-v15-M").to_dict())
+        assert "OVER" in over
+        big = render(measure({"a": "x" * 5000}).to_dict())
+        assert big.endswith("exceeds QR v40-M")