validibot-shared 0.7.3__tar.gz → 0.7.4__tar.gz

{validibot_shared-0.7.3 → validibot_shared-0.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: validibot-shared
-Version: 0.7.3
+Version: 0.7.4
 Summary: Shared library for data interchange between Validibot and validator containers
 Project-URL: Homepage, https://validibot.com
 Project-URL: Documentation, https://docs.validibot.com
@@ -34,7 +34,7 @@ Description-Content-Type: text/markdown
 
 # Validibot Shared
 
-**Shared Pydantic models for Validibot Advanced Validator containers**
+**Shared Pydantic models for Validibot validator backends**
 
 [![PyPI version](https://badge.fury.io/py/validibot-shared.svg)](https://pypi.org/project/validibot-shared/)
 [![Python versions](https://img.shields.io/pypi/pyversions/validibot-shared.svg)](https://pypi.org/project/validibot-shared/)
@@ -106,7 +106,7 @@ poetry add validibot-shared
 ### Requirements
 
 - Python 3.10 or later
-- Pydantic 2.8.0 or later
+- Pydantic 2.13 or later (< 3.0)
 
 ## Core Concepts
 
@@ -132,7 +132,7 @@ Validibot uses an "envelope" pattern for validator communication. Every validati
                               │
                               ▼ JSON
 ┌─────────────────────────────────────────────────────────────────┐
-│                    Validator Container                          │
+│                  Validator Backend Container                    │
 │                    (EnergyPlus, FMU, etc.)                      │
 │                                                                 │
 │  1. Parses input envelope                                       │
@@ -399,13 +399,13 @@ This library is one component of the Validibot open-source data validation platf
 │ validibot-cli   │    │ validibot-validator-backends │    │ validibot-shared    │
 │                 │    │                              │    │  (this repo)        │
 │ Terminal access │    │ EnergyPlus™, FMU             │    │                     │
-│ to API          │    │ containers                   │    │ Pydantic models     │
+│ to API          │    │ validator backends           │    │ Pydantic models     │
 │                 │    │              │               │    │ (shared contract)   │
 └─────────────────┘    └──────────────┼───────────────┘    └─────────────────────┘
                                 │                          ▲
                                 └──────────────────────────┘
-                                   validators import shared
-                                   models for type safety
+                                  backends import shared
+                                  models for type safety
 ```
 
 ## Development

{validibot_shared-0.7.3 → validibot_shared-0.7.4}/README.md

@@ -2,7 +2,7 @@
 
 # Validibot Shared
 
-**Shared Pydantic models for Validibot Advanced Validator containers**
+**Shared Pydantic models for Validibot validator backends**
 
 [![PyPI version](https://badge.fury.io/py/validibot-shared.svg)](https://pypi.org/project/validibot-shared/)
 [![Python versions](https://img.shields.io/pypi/pyversions/validibot-shared.svg)](https://pypi.org/project/validibot-shared/)
@@ -74,7 +74,7 @@ poetry add validibot-shared
 ### Requirements
 
 - Python 3.10 or later
-- Pydantic 2.8.0 or later
+- Pydantic 2.13 or later (< 3.0)
 
 ## Core Concepts
 
@@ -100,7 +100,7 @@ Validibot uses an "envelope" pattern for validator communication. Every validati
                               │
                               ▼ JSON
 ┌─────────────────────────────────────────────────────────────────┐
-│                    Validator Container                          │
+│                  Validator Backend Container                    │
 │                    (EnergyPlus, FMU, etc.)                      │
 │                                                                 │
 │  1. Parses input envelope                                       │
@@ -367,13 +367,13 @@ This library is one component of the Validibot open-source data validation platf
 │ validibot-cli   │    │ validibot-validator-backends │    │ validibot-shared    │
 │                 │    │                              │    │  (this repo)        │
 │ Terminal access │    │ EnergyPlus™, FMU             │    │                     │
-│ to API          │    │ containers                   │    │ Pydantic models     │
+│ to API          │    │ validator backends           │    │ Pydantic models     │
 │                 │    │              │               │    │ (shared contract)   │
 └─────────────────┘    └──────────────┼───────────────┘    └─────────────────────┘
                                 │                          ▲
                                 └──────────────────────────┘
-                                   validators import shared
-                                   models for type safety
+                                  backends import shared
+                                  models for type safety
 ```
 
 ## Development

{validibot_shared-0.7.3 → validibot_shared-0.7.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "validibot-shared"
-version = "0.7.3"
+version = "0.7.4"
 description = "Shared library for data interchange between Validibot and validator containers"
 readme = "README.md"
 license = { text = "MIT" }

{validibot_shared-0.7.3 → validibot_shared-0.7.4}/tests/test_evidence_manifest.py

@@ -131,6 +131,39 @@ class TestOptionalFields:
         manifest = EvidenceManifest(**_minimal_manifest_kwargs())
         assert manifest.steps == []
 
+    # ── Trust ADR P2 #2 (2026-05-03 review): manifest source field ──
+    #
+    # ``source`` documents which auth channel produced the run.  It's
+    # additive and optional — older producers set None, newer
+    # producers populate it from the authenticated route (NOT from a
+    # client header, see P1 #4).  The schema-version contract still
+    # reads ``v1`` because the change is purely additive.
+    def test_source_defaults_to_none(self):
+        """Older producers and producers that don't track source leave it None."""
+        manifest = EvidenceManifest(**_minimal_manifest_kwargs())
+        assert manifest.source is None
+
+    def test_source_can_be_populated(self):
+        """Newer producers populate source from the authenticated route."""
+        manifest = EvidenceManifest(
+            **_minimal_manifest_kwargs(),
+            source="X402_AGENT",
+        )
+        assert manifest.source == "X402_AGENT"
+
+    def test_source_addition_preserves_v1_schema(self):
+        """Manifests carrying ``source`` still report schema_version v1.
+
+        Adding an optional field is explicitly an additive change per
+        the schema-versioning policy in ``manifest.py``. Bumping to v2
+        would only be required for breaking changes.
+        """
+        manifest = EvidenceManifest(
+            **_minimal_manifest_kwargs(),
+            source="MCP",
+        )
+        assert manifest.schema_version == "validibot.evidence.v1"
+
 
 # ──────────────────────────────────────────────────────────────────────
 # StepValidatorRecord — semantic_digest can be None for legacy validators

{validibot_shared-0.7.3 → validibot_shared-0.7.4}/validibot_shared/evidence/manifest.py

@@ -251,6 +251,27 @@ class EvidenceManifest(BaseModel):
         default_factory=ManifestPayloadDigests,
         description="Session A: empty. Session B: input + output hashes.",
     )
+    # Trust ADR-2026-04-27 + 2026-05-03 review (P2 #2): the auth
+    # channel that initiated the run.  Pinning it in the manifest
+    # lets verifiers answer "what surface produced this run?" without
+    # consulting the producer database (the run row may be purged
+    # under DO_NOT_STORE retention).  Optional because (a) older
+    # producers persist runs without populating ``source``, and
+    # (b) the field is additive — a missing value preserves the v1
+    # schema-version contract.  Producers MUST derive this from the
+    # authenticated route, NEVER from a caller-controlled header
+    # (see Trust ADR P1 #4).
+    source: str | None = Field(
+        default=None,
+        description=(
+            "Run source identifier — one of LAUNCH_PAGE, API, MCP, "
+            "X402_AGENT, CLI, SCHEDULE.  Derived from the "
+            "authenticated route on the producer side and propagated "
+            "into the manifest verbatim.  None when the run was "
+            "captured before P2 #2 shipped or by a producer that does "
+            "not yet emit the field."
+        ),
+    )
 
 
 __all__ = [