validibot-shared 0.6.0__tar.gz → 0.7.2__tar.gz

{validibot_shared-0.6.0 → validibot_shared-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: validibot-shared
-Version: 0.6.0
+Version: 0.7.2
 Summary: Shared library for data interchange between Validibot and validator containers
 Project-URL: Homepage, https://validibot.com
 Project-URL: Documentation, https://docs.validibot.com
@@ -39,6 +39,7 @@ Description-Content-Type: text/markdown
 [![PyPI version](https://badge.fury.io/py/validibot-shared.svg)](https://pypi.org/project/validibot-shared/)
 [![Python versions](https://img.shields.io/pypi/pyversions/validibot-shared.svg)](https://pypi.org/project/validibot-shared/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![OIDC attestation](https://img.shields.io/badge/PyPI%20attestations-enabled-2da44e.svg)](https://docs.pypi.org/attestations/)
 
 [Installation](#installation) •
 [Core Concepts](#core-concepts) •

{validibot_shared-0.6.0 → validibot_shared-0.7.2}/README.md

@@ -7,6 +7,7 @@
 [![PyPI version](https://badge.fury.io/py/validibot-shared.svg)](https://pypi.org/project/validibot-shared/)
 [![Python versions](https://img.shields.io/pypi/pyversions/validibot-shared.svg)](https://pypi.org/project/validibot-shared/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![OIDC attestation](https://img.shields.io/badge/PyPI%20attestations-enabled-2da44e.svg)](https://docs.pypi.org/attestations/)
 
 [Installation](#installation) •
 [Core Concepts](#core-concepts) •

{validibot_shared-0.6.0 → validibot_shared-0.7.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "validibot-shared"
-version = "0.6.0"
+version = "0.7.2"
 description = "Shared library for data interchange between Validibot and validator containers"
 readme = "README.md"
 license = { text = "MIT" }

{validibot_shared-0.6.0 → validibot_shared-0.7.2}/validibot_shared/evidence/manifest.py

@@ -89,6 +89,25 @@ class StepValidatorRecord(BaseModel):
             "verifiers know to expect a legacy-versioning gap there."
         ),
     )
+    # Trust ADR Phase 5 Session A — the *runtime* identity of the
+    # validator backend container that actually executed this step.
+    # ``validator_semantic_digest`` describes the validator's
+    # *configuration* (slug, version, config bytes); this field
+    # describes the *image bytes* that ran. The two are
+    # complementary: one proves "the validator was configured this
+    # way", the other proves "this exact container ran". Optional
+    # because (a) simple-validator steps run inline without a
+    # backend, and (b) historical step runs predate the field.
+    validator_backend_image_digest: str | None = Field(
+        default=None,
+        description=(
+            "Resolved sha256 digest of the validator backend image "
+            "that executed this step (e.g. 'sha256:abc...' or "
+            "'registry/...@sha256:abc...'). None for simple-validator "
+            "steps that run inline without a container, or for runs "
+            "captured before digest capture shipped."
+        ),
+    )
 
 
 class WorkflowContractSnapshot(BaseModel):