warrant-graph 2.0.0a1__tar.gz

warrant_graph-2.0.0a1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 s0fractal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

warrant_graph-2.0.0a1/PKG-INFO

@@ -0,0 +1,130 @@
+Metadata-Version: 2.4
+Name: warrant-graph
+Version: 2.0.0a1
+Summary: Record transitions of work with their residual, close loops exactly, and hand the next agent a capsule instead of a transcript.
+Author: s0fractal
+License: MIT
+Project-URL: Homepage, https://github.com/s0fractal/warrant
+Project-URL: Specification, https://github.com/s0fractal/warrant/blob/master/SPEC.md
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=41
+Provides-Extra: compute
+Requires-Dist: sigma-glyph==0.8.0; extra == "compute"
+Provides-Extra: mcp
+Requires-Dist: mcp==2.3.0; extra == "mcp"
+Dynamic: license-file
+
+# Warrant
+
+Warrant records transitions of work: what was done, on what basis, what it
+established, which exact conditions it closed, which questions it opened, and
+what it leaves unestablished. The next agent reads a short capsule instead of a
+transcript, and cannot credit the work with more than its grounds support.
+
+Review is one use. Ordinary decisions, running services, periodic obligations
+and reproducible computations are others.
+
+The core is small: six signed record types and one pure function, `assess`,
+that reads one view of a store (its bytes, the reader's own trust file and
+profile, a time) and answers what may be relied on now, what is still owed and
+by whom. The package `warrant` holds the core and the `warrant` command, and
+imports nothing but the Python standard library and `cryptography`;
+`warrant_agent` is an interface for agents on top of it.
+
+- **[Warrant in 15 minutes](https://github.com/s0fractal/warrant/blob/master/QUICKSTART.md)**:
+  one duty, its closure, an acceptance, a challenge; every command and output on
+  the page is run by CI.
+- Contract: [SPEC.md](https://github.com/s0fractal/warrant/blob/master/SPEC.md)
+- Handing work to another agent (Python API, CLI, stdio MCP): [AGENT.md](https://github.com/s0fractal/warrant/blob/master/AGENT.md)
+- What the rebuild retired, and where the previous generation lives: [HISTORY.md](https://github.com/s0fractal/warrant/blob/master/HISTORY.md)
+- The proof-space pilot (goal G9), its contract and resolution layer, outside SPEC.md: [PILOT.md](https://github.com/s0fractal/warrant/blob/master/PILOT.md)
+
+## Install
+
+```bash
+pip install --pre warrant-graph               # Python ≥ 3.10; depends on `cryptography`
+pip install --pre "warrant-graph[mcp]"        # adds `warrant-agent-mcp` on the official MCP SDK
+pip install --pre "warrant-graph[compute]"    # adds the Sigma provider (sigma-glyph==0.8.0)
+```
+
+This installs the commands `warrant` and `warrant-agent` and the packages
+`warrant` and `warrant_agent`. The package published as `warrant-verify`
+(≤ 0.12.0) is the retired 0.x generation.
+
+Attest and observe need nothing else. `compute` conditions are replayed by the
+Sigma provider, the `sigma_provider` module of the `sigma-glyph` distribution
+(PyPI `0.8.0`, provider identity `0caff793…`; `warrant compute --store S
+provider` prints it). A recipient accepts a provider by putting that identity
+in its profile's `providers`; without an accepted, installed provider every
+REPLAYED basis is UNVERIFIED.
+
+## The model in one table
+
+| Record | Says |
+| --- | --- |
+| `duty` | a condition someone owes someone: attest, observe, or compute; optionally scheduled |
+| `transition` | work done: basis, evidence, established, residual, opened questions, exact closures |
+| `accept` | acceptance of one exact closure item (or of a transition's results) |
+| `observation` | what an observer saw, when, with which probe |
+| `grant` | permission to release named duties, attenuable |
+| `challenge` | a counterexample against a closure or a result |
+
+Assessment is a pure function of one view: the store's bytes read once, the
+recipient's trust file and profile, a time, and the current revision. It
+answers `reliance` (ELIGIBLE, STALE, CHALLENGED, SUPERSEDED, UNASSESSED,
+NOT_CLOSED, ...), `frontier`, `questions` and `capsule`. A key authenticates; it
+does not authorize. A computation is credited only by the recipient's own replay.
+
+## Status
+
+**2.0.0a1 is an alpha**, the first publication of `warrant-graph`. A
+pre-release may still change the record formats, the command line, the Python
+API and the agent interface.
+
+- **What is backed.** Every normative sentence of SPEC.md is a signed claim
+  record. Of 358 sentences, 281 are BACKED: each names the test cases that
+  witness it and the mutants those cases kill. 20 are UNBACKED, each with the
+  reason it is still open, and 57 are informative.
+  [SPEC-CLAIMS.md](https://github.com/s0fractal/warrant/blob/master/SPEC-CLAIMS.md)
+  lists every claim with its witnesses and mutants. A change to a rule is filed
+  as a new record that supersedes the old one and says why; the old one stays.
+- **What is not.** Most of the code is exercised by tests but not tied to a
+  claim. At 7c6d80b, 304 of the 2317 statements of `warrant/` (13%), and 431 of
+  the 3980 statements of `warrant/` and `warrant_agent/` together (11%), are
+  changed by a mutant that a BACKED claim cites (`tools/claims.py why
+  --uncovered`). Raising that is the open goal G6. The other open goals,
+  among them an agent with no preparation using Warrant correctly (G2) and
+  admission of witnesses without an admin (G3), are in
+  [ROADMAP.md](https://github.com/s0fractal/warrant/blob/master/ROADMAP.md).
+- **Review.** Pull requests are reviewed by a model reviewer through the
+  repository's review loop
+  ([REVIEWS.md](https://github.com/s0fractal/warrant/blob/master/REVIEWS.md));
+  no external security audit is recorded. There is one implementation, this
+  Python one.
+
+## Limits
+
+Not in this version: threshold adoption, key rotation, P-256, policy
+compilation, grants for acts other than release, goals as a distinct kind, and
+any independent implementation besides this Python one. The process boundary
+around the Sigma kernel isolates module names; it is not an OS sandbox. A view
+cannot prove its own completeness, and every report says so. An assessment
+has aggregate admission limits (records, bytes, `requires` edges, periods;
+SPEC §9): beyond one it is refused, never answered in part.
+
+## The repository
+
+The repository also builds and checks Warrant with Warrant: SPEC.md is
+generated from the claim records, the roadmap and the pull request reviews are
+records in the same store, and a gate merges a pull request on a recorded
+acceptance. That machinery (`tools/`, `.warrant/`, `.github/`) is evidence
+behind the package, not part of it: `tests/boundary_test.py` refuses a core
+module that imports it and a wheel or sdist that carries it.
+[docs/REPOSITORY.md](https://github.com/s0fractal/warrant/blob/master/docs/REPOSITORY.md)
+describes it, with the checks to run from a checkout;
+[CHANGELOG.md](https://github.com/s0fractal/warrant/blob/master/CHANGELOG.md)
+records what changed.
+
+Licensed MIT. See [TRADEMARK.md](https://github.com/s0fractal/warrant/blob/master/TRADEMARK.md) for the name.

warrant_graph-2.0.0a1/README.md

@@ -0,0 +1,112 @@
+# Warrant
+
+Warrant records transitions of work: what was done, on what basis, what it
+established, which exact conditions it closed, which questions it opened, and
+what it leaves unestablished. The next agent reads a short capsule instead of a
+transcript, and cannot credit the work with more than its grounds support.
+
+Review is one use. Ordinary decisions, running services, periodic obligations
+and reproducible computations are others.
+
+The core is small: six signed record types and one pure function, `assess`,
+that reads one view of a store (its bytes, the reader's own trust file and
+profile, a time) and answers what may be relied on now, what is still owed and
+by whom. The package `warrant` holds the core and the `warrant` command, and
+imports nothing but the Python standard library and `cryptography`;
+`warrant_agent` is an interface for agents on top of it.
+
+- **[Warrant in 15 minutes](https://github.com/s0fractal/warrant/blob/master/QUICKSTART.md)**:
+  one duty, its closure, an acceptance, a challenge; every command and output on
+  the page is run by CI.
+- Contract: [SPEC.md](https://github.com/s0fractal/warrant/blob/master/SPEC.md)
+- Handing work to another agent (Python API, CLI, stdio MCP): [AGENT.md](https://github.com/s0fractal/warrant/blob/master/AGENT.md)
+- What the rebuild retired, and where the previous generation lives: [HISTORY.md](https://github.com/s0fractal/warrant/blob/master/HISTORY.md)
+- The proof-space pilot (goal G9), its contract and resolution layer, outside SPEC.md: [PILOT.md](https://github.com/s0fractal/warrant/blob/master/PILOT.md)
+
+## Install
+
+```bash
+pip install --pre warrant-graph               # Python ≥ 3.10; depends on `cryptography`
+pip install --pre "warrant-graph[mcp]"        # adds `warrant-agent-mcp` on the official MCP SDK
+pip install --pre "warrant-graph[compute]"    # adds the Sigma provider (sigma-glyph==0.8.0)
+```
+
+This installs the commands `warrant` and `warrant-agent` and the packages
+`warrant` and `warrant_agent`. The package published as `warrant-verify`
+(≤ 0.12.0) is the retired 0.x generation.
+
+Attest and observe need nothing else. `compute` conditions are replayed by the
+Sigma provider, the `sigma_provider` module of the `sigma-glyph` distribution
+(PyPI `0.8.0`, provider identity `0caff793…`; `warrant compute --store S
+provider` prints it). A recipient accepts a provider by putting that identity
+in its profile's `providers`; without an accepted, installed provider every
+REPLAYED basis is UNVERIFIED.
+
+## The model in one table
+
+| Record | Says |
+| --- | --- |
+| `duty` | a condition someone owes someone: attest, observe, or compute; optionally scheduled |
+| `transition` | work done: basis, evidence, established, residual, opened questions, exact closures |
+| `accept` | acceptance of one exact closure item (or of a transition's results) |
+| `observation` | what an observer saw, when, with which probe |
+| `grant` | permission to release named duties, attenuable |
+| `challenge` | a counterexample against a closure or a result |
+
+Assessment is a pure function of one view: the store's bytes read once, the
+recipient's trust file and profile, a time, and the current revision. It
+answers `reliance` (ELIGIBLE, STALE, CHALLENGED, SUPERSEDED, UNASSESSED,
+NOT_CLOSED, ...), `frontier`, `questions` and `capsule`. A key authenticates; it
+does not authorize. A computation is credited only by the recipient's own replay.
+
+## Status
+
+**2.0.0a1 is an alpha**, the first publication of `warrant-graph`. A
+pre-release may still change the record formats, the command line, the Python
+API and the agent interface.
+
+- **What is backed.** Every normative sentence of SPEC.md is a signed claim
+  record. Of 358 sentences, 281 are BACKED: each names the test cases that
+  witness it and the mutants those cases kill. 20 are UNBACKED, each with the
+  reason it is still open, and 57 are informative.
+  [SPEC-CLAIMS.md](https://github.com/s0fractal/warrant/blob/master/SPEC-CLAIMS.md)
+  lists every claim with its witnesses and mutants. A change to a rule is filed
+  as a new record that supersedes the old one and says why; the old one stays.
+- **What is not.** Most of the code is exercised by tests but not tied to a
+  claim. At 7c6d80b, 304 of the 2317 statements of `warrant/` (13%), and 431 of
+  the 3980 statements of `warrant/` and `warrant_agent/` together (11%), are
+  changed by a mutant that a BACKED claim cites (`tools/claims.py why
+  --uncovered`). Raising that is the open goal G6. The other open goals,
+  among them an agent with no preparation using Warrant correctly (G2) and
+  admission of witnesses without an admin (G3), are in
+  [ROADMAP.md](https://github.com/s0fractal/warrant/blob/master/ROADMAP.md).
+- **Review.** Pull requests are reviewed by a model reviewer through the
+  repository's review loop
+  ([REVIEWS.md](https://github.com/s0fractal/warrant/blob/master/REVIEWS.md));
+  no external security audit is recorded. There is one implementation, this
+  Python one.
+
+## Limits
+
+Not in this version: threshold adoption, key rotation, P-256, policy
+compilation, grants for acts other than release, goals as a distinct kind, and
+any independent implementation besides this Python one. The process boundary
+around the Sigma kernel isolates module names; it is not an OS sandbox. A view
+cannot prove its own completeness, and every report says so. An assessment
+has aggregate admission limits (records, bytes, `requires` edges, periods;
+SPEC §9): beyond one it is refused, never answered in part.
+
+## The repository
+
+The repository also builds and checks Warrant with Warrant: SPEC.md is
+generated from the claim records, the roadmap and the pull request reviews are
+records in the same store, and a gate merges a pull request on a recorded
+acceptance. That machinery (`tools/`, `.warrant/`, `.github/`) is evidence
+behind the package, not part of it: `tests/boundary_test.py` refuses a core
+module that imports it and a wheel or sdist that carries it.
+[docs/REPOSITORY.md](https://github.com/s0fractal/warrant/blob/master/docs/REPOSITORY.md)
+describes it, with the checks to run from a checkout;
+[CHANGELOG.md](https://github.com/s0fractal/warrant/blob/master/CHANGELOG.md)
+records what changed.
+
+Licensed MIT. See [TRADEMARK.md](https://github.com/s0fractal/warrant/blob/master/TRADEMARK.md) for the name.

warrant_graph-2.0.0a1/pyproject.toml

@@ -0,0 +1,38 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+# Warrant 2 (SPEC.md). A new distribution name on purpose: `warrant-verify`
+# (<= 0.12.0) is the retired 0.x generation and keeps its own meaning.
+name = "warrant-graph"
+version = "2.0.0a1"
+description = "Record transitions of work with their residual, close loops exactly, and hand the next agent a capsule instead of a transcript."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+authors = [{ name = "s0fractal" }]
+dependencies = ["cryptography>=41"]
+
+[project.optional-dependencies]
+# `compute` conditions need the Sigma provider (sigma_provider in the sigma-glyph
+# distribution, released on PyPI as 0.8.0). Its provider identity is
+# 0caff793d00dd798fa0af89517674c2ca562e1d517e7c969cc40617778c776c5; CI checks the installed bytes against it, since a version
+# pin alone does not name bytes. Without it, attest and observe work and every
+# REPLAYED basis is UNVERIFIED.
+compute = ["sigma-glyph==0.8.0"]
+# The thin stdio MCP front end of warrant_agent (`warrant-agent-mcp`), on the
+# official Python SDK at one exact version.
+mcp = ["mcp==2.3.0"]
+
+[project.urls]
+Homepage = "https://github.com/s0fractal/warrant"
+Specification = "https://github.com/s0fractal/warrant/blob/master/SPEC.md"
+
+[project.scripts]
+warrant = "warrant.cli:main"
+warrant-agent = "warrant_agent.cli:main"
+warrant-agent-mcp = "warrant_agent.mcp_server:main"
+
+[tool.setuptools]
+packages = ["warrant", "warrant_agent"]

warrant_graph-2.0.0a1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

warrant_graph-2.0.0a1/warrant/__init__.py

@@ -0,0 +1,11 @@
+"""Warrant 2: transitions of work, exact closures and what remains open (SPEC.md)."""
+from .jcs import canon, loads
+from .engine import assess, capsule, frontier, profile, questions, reliance
+from .keys import Key
+from .records import accept, challenge, duty, grant, item, observation, record, transition
+from .store import Snapshot, Store, Trust
+
+__version__ = "2.0.0a1"
+__all__ = ["Key", "Snapshot", "Store", "Trust", "accept", "assess", "canon", "capsule", "challenge", "duty",
+           "frontier", "grant", "item", "loads", "observation", "profile", "questions", "record", "reliance",
+           "transition"]

warrant_graph-2.0.0a1/warrant/bindings.py

@@ -0,0 +1,145 @@
+"""Bindings and roles of a repository's trust (the open circle of witnesses, part A, and
+AMEND 1 of #170): the one rule tools/claims.py and a warrant-agent workspace admit keys by.
+
+A binding certifies itself: its key signs canon({actor, public, purpose}). `admit_bindings`
+admits one mechanically, in file order, under the roles .warrant/roles.json pins; nobody judges
+who may join. A binding grants only "this key signs as this actor" (SPEC §6). This module reads
+documents; it writes none and runs nothing (the claims tool writes them)."""
+from . import jcs as C
+from . import keys as K
+from . import records as R
+from . import shapes as S
+from .store import Trust
+
+
+# Open circle of witnesses: a binding certifies itself (its key signs it); nobody admits anyone.
+BINDINGS = "warrant-claims/bindings@1"       # .warrant/trust.json: {"bindings": BINDINGS, "keys": [...]}
+BINDING = "warrant-claims/binding@1"         # the purpose a proof signs: canon({actor, public, purpose})
+BINDING_FIELDS = ("actor", "public", "proof")
+ROLES = "warrant-claims/roles@1"             # .warrant/roles.json: the actors the configuration gives a role
+COLLECTIVE = "collective"                    # a role no key signs as (readers): never bindable
+
+
+def binding_message(actor, public):
+    """The bytes a binding's proof signs: canon({actor, public, purpose}). It starts with `{`,
+    so it is never the message of a record signature ("warrant-sig-v1:" || id)."""
+    return C.canon({"actor": actor, "public": public, "purpose": BINDING})
+
+
+def binding_proof(key, actor):
+    return key.sign(binding_message(actor, key.public))
+
+
+def read_roles(doc):
+    """({actor: public hex | None | COLLECTIVE}, problems) of a roles document (.warrant/roles.json).
+
+    AMEND 1 of #170: a name the repository's own configuration gives a role (an acceptor, a
+    creditor, the claims' author) is not first-come. Its key is pinned here, as a receiver's
+    profile pins the keys it trusts: a hex64 public key (a binding of that actor is admitted
+    with exactly that key), null (reserved: not bindable until a pin names its key) or
+    "collective" (a role no key signs as, such as `readers`: never bindable). Every other
+    name stays first-come. Changing who a role is, is a diff of this reviewed file."""
+    if not (isinstance(doc, dict) and set(doc) == {"roles", "actors"} and doc["roles"] == ROLES
+            and isinstance(doc["actors"], dict)):
+        return {}, [("ROLES_SHAPE", f".warrant/roles.json is not {{\"roles\": {ROLES!r}, \"actors\": {{...}}}}")]
+    roles, problems = {}, []
+    for actor, v in doc["actors"].items():
+        try:
+            R.check_actor(actor)
+        except R.Invalid as e:
+            problems.append(("ROLES_SHAPE", f".warrant/roles.json: {actor[:60]!r} is not an actor id: {e}"))
+            continue
+        if not (v is None or v == COLLECTIVE or S.hex64(v)):
+            problems.append(("ROLES_SHAPE", f".warrant/roles.json: {actor}: a role is a hex64 public key, null or "
+                             f"{COLLECTIVE!r}, not {str(v)[:70]!r}"))
+            continue
+        roles[actor] = v
+    return roles, problems
+
+
+def _role_name(v):
+    """A role value for a message: 'key <id>' for a key, else what it is (never raises)."""
+    if S.hex64(v):
+        return f"key {K.key_id(v)[:12]}"
+    if v == COLLECTIVE:
+        return "collective"
+    return "reserved" if v is None else repr(v)[:40]
+
+
+def admit_bindings(doc, legacy=False, roles=None):
+    """(admitted [(actor, public)], problems [(code, detail)]) of a bindings document.
+
+    A binding is admitted mechanically, in file order, iff its proof is the signature of its
+    own key over binding_message(actor, public), its actor id has SPEC-3-21's shape, its
+    actor's role (`roles`, read_roles) admits that key, its key is not bound already, and its
+    actor is not bound already to another key: the first binding of a name with no role
+    wins, and a second key for it would need a record signed by the first, which this tool
+    does not implement (rotation is out of scope), so it is refused. Nobody judges who may
+    join; what a binding grants is only "this key signs as this actor" (SPEC §6). `legacy`
+    reads a trust/2 document (actor, public, no proof) as admitted: only for a base revision
+    written before bindings carried proofs."""
+    if legacy and isinstance(doc, dict) and doc.get("warrant") == "trust/2":
+        try:
+            return [(a, p) for a, p in Trust(doc).keys.values()], []
+        except R.Invalid as e:
+            return [], [("BINDINGS_SHAPE", f".warrant/trust.json: {e}")]
+    if not (isinstance(doc, dict) and set(doc) == {"bindings", "keys"} and doc["bindings"] == BINDINGS
+            and isinstance(doc["keys"], list)):
+        return [], [("BINDINGS_SHAPE", f".warrant/trust.json is not {{\"bindings\": {BINDINGS!r}, \"keys\": [...]}} "
+                                       "(tools/claims.py bind writes it)")]
+    admitted, problems = [], []
+    publics = [k.get("public") for k in doc["keys"] if isinstance(k, dict)]
+    for i, k in enumerate(doc["keys"]):
+        code, why = _binding_problem(k, publics, admitted, roles or {})
+        if code:
+            problems.append((code, f".warrant/trust.json keys[{i}]: {why}"))
+        else:
+            admitted.append((k["actor"], k["public"]))
+    return admitted, problems
+
+
+def _binding_problem(k, publics, admitted, roles):
+    """(code, why) when entry `k` is not admitted after `admitted`, else (None, None)."""
+    if not (isinstance(k, dict) and set(k) <= set(BINDING_FIELDS) and {"actor", "public"} <= set(k)
+            and S.hex64(k["public"])):
+        return "BINDING_SHAPE", f"an entry is {{actor, public: hex64, proof: hex128}}, not {str(k)[:120]}"
+    try:
+        R.check_actor(k["actor"])
+    except R.Invalid as e:
+        return "BINDING_ACTOR_SHAPE", f"{str(k['actor'])[:60]!r} is not an actor id (SPEC-3-21): {e}"
+    if "proof" not in k:
+        return "BINDING_UNPROVEN", f"{k['actor']}: no proof; the key's own signature over the binding is needed"
+    msg = binding_message(k["actor"], k["public"])
+    if not K.verify(k["public"], k["proof"], msg):
+        other = [p for p in publics if p != k["public"] and isinstance(p, str) and K.verify(p, k["proof"], msg)]
+        if other:
+            return "BINDING_PROOF_OTHER_KEY", (f"{k['actor']}: the proof is signed by key {K.key_id(other[0])[:12]}, "
+                                               f"not by the key it binds ({K.key_id(k['public'])[:12]})")
+        return "BINDING_PROOF_FORGED", f"{k['actor']}: the proof is not the bound key's signature over this binding"
+    role = roles.get(k["actor"], k["public"])
+    if role != k["public"]:                 # one rule; the code only says which kind of role refused it
+        if role == COLLECTIVE:
+            return "BINDING_ROLE_COLLECTIVE", f"{k['actor']} is a collective role in .warrant/roles.json: no key signs as it"
+        if role is None:
+            return "BINDING_ROLE_RESERVED", (f"{k['actor']} is reserved in .warrant/roles.json: it is bindable once a "
+                                             "reviewed pin names its key")
+        return "BINDING_ROLE_KEY", (f"{k['actor']}: .warrant/roles.json pins {_role_name(role)}, this binding is of "
+                                    f"key {K.key_id(k['public'])[:12]}")
+    if any(p == k["public"] for _, p in admitted):
+        return "BINDING_KEY_TWICE", f"key {K.key_id(k['public'])[:12]} is bound already"
+    first = next((p for a, p in admitted if a == k["actor"]), None)
+    if first is not None:
+        return "BINDING_ACTOR_TAKEN", (f"{k['actor']} is bound already to key {K.key_id(first)[:12]}; the first "
+                                       "binding wins, and rotation (a record signed by the first key) is not "
+                                       "implemented, so a second key for an actor is refused")
+    return None, None
+
+
+def trust_of(bindings):
+    """A Trust of (actor, public) pairs, the first binding of each key kept."""
+    seen, pairs = set(), []
+    for a, p in bindings:
+        if p not in seen:
+            seen.add(p)
+            pairs.append((a, p))
+    return Trust(Trust.document(pairs))