worktrust 0.10.13__tar.gz

worktrust-0.10.13/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 WorkTrust
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

worktrust-0.10.13/MANIFEST.in

@@ -0,0 +1,4 @@
+include VERSION LICENSE README.md runtime-lock.json build_runtime.py setup.py
+recursive-include src/worktrust_cli/bundle *.mjs *.json
+recursive-include tests *.py
+prune src/worktrust_cli/runtime

worktrust-0.10.13/PKG-INFO

@@ -0,0 +1,110 @@
+Metadata-Version: 2.4
+Name: worktrust
+Version: 0.10.13
+Summary: The WorkTrust CLI, using the same measurement engine as npm
+License-Expression: MIT
+Project-URL: Homepage, https://worktrust.io
+Project-URL: Source, https://github.com/fhomey/worktrust-cli
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# WorkTrust for Python tool runners
+
+This package launches the same JavaScript measurement engine shipped in the WorkTrust npm
+package. It does not implement another measurement engine or a Python instrumentation SDK.
+Python 3.10+ is required. Supported platform wheels include **Node.js 22.23.3**; no separate
+Node or npm installation is needed. The launcher uses that bundled runtime, never downloads a
+runtime when invoked, and does not silently switch to another CLI version.
+
+Wheels target macOS 11+ (Intel and Apple Silicon), Linux with glibc 2.28+ (x64 and arm64), and
+Windows 10+ (x64 and arm64). Linux also requires the Node-supported system C++ runtime
+(GLIBCXX_3.4.25 or newer). Alpine/musl, 32-bit systems and other platforms are not supported.
+A source distribution cannot fetch Node automatically: a source build requires the explicit
+maintainer preparation step below. Supported users should install the matching wheel.
+
+After publication under a verified WorkTrust-owned PyPI project, the intended commands are:
+
+```sh
+uvx worktrust preserve
+pipx run worktrust preserve
+```
+
+These public commands are not a claim that this package has already been published. Test a
+reviewed local wheel first:
+
+```sh
+uvx --from /absolute/path/worktrust-VERSION-py3-none-PLATFORM.whl worktrust --help
+pipx run --spec /absolute/path/worktrust-VERSION-py3-none-PLATFORM.whl worktrust --help
+```
+
+Use your package manager to choose and update the installed version. The package contains
+the CLI modules and Node runtime, so `preserve` itself needs no network after installation. It reads supported
+local session files and can change retention settings or create local metadata archives;
+only the person runs it. Existing WorkTrust agent safeguards and consent prompts remain.
+Other commands can contact WorkTrust. Package installation itself can contact registries.
+
+After PyPI publication, explicitly request the latest published package when needed:
+
+```sh
+uvx worktrust@latest preserve
+pipx run --no-cache worktrust preserve
+```
+
+For persistent installations, use `uv tool upgrade worktrust` or `pipx upgrade worktrust`.
+An existing cache or version constraint can otherwise keep an older release. `worktrust update`
+refreshes the computer coupling using the selected package; it does not upgrade the Python package.
+
+Runtime bundle hashes detect missing or changed files; they are not hardware attestation or
+independent proof of authenticity. Request and archive signatures retain the existing CLI's
+software-key threat model. See the npm package SECURITY.md and README.md for the data contract.
+
+## Maintainers
+
+Running `node tools/worktrust-cli/sync.mjs` from the monorepo also regenerates the Python JavaScript
+bundle and version. `node scripts/build-python-cli.mjs --check` refuses drift. The native runtime
+is a separate build artifact, excluded from Git and sdists. Explicitly prepare it before building:
+
+```sh
+python tools/worktrust-python/build_runtime.py
+python -m build --wheel tools/worktrust-python
+python -m build --sdist tools/worktrust-python
+```
+
+`build_runtime.py` downloads one official Node archive from nodejs.org at build time, verifies its
+committed SHA256 from `runtime-lock.json`, and extracts only the executable and complete LICENSE.
+It accepts `--target` for a reviewed target and `--cache` for a build cache. Platform wheel tags
+follow the selected runtime. Never label these wheels `any`. Building a wheel from the sdist
+fails closed until this explicit preparation step has been performed; no install hook downloads code.
+
+Run `python tools/worktrust-python/tests/test_runtime_build.py`, then
+`node scripts/test-python-cli.mjs` with a Python containing the build requirements (select it with
+`WORKTRUST_TEST_PYTHON`). Tests build and exercise a real wheel using its own runtime with no Node
+on PATH; they use synthetic homes and metadata only. Native execution must pass independently on
+all six claimed OS/architecture combinations before release. Cross-building alone is not that proof.
+Set `WORKTRUST_REQUIRE_TOOL_RUNNERS=1` to require actual uv and pipx wheel smoke tests, and
+`WORKTRUST_TEST_ARTIFACT_DIR` to a fresh directory to retain the exact tested wheel and sdist.
+Existing artifacts are never overwritten. Canonical module bytes match across channels;
+bit-for-bit reproducibility of whole wheel or sdist archives is not asserted.
+
+The public `fhomey/worktrust-cli` repository carries this package under `python/`, alongside the
+npm package at its root. There, install `python/requirements-release.txt`, run
+`python python/build_runtime.py`, then `python python/tests/test_distribution.py` with
+`WORKTRUST_TEST_CLI_SOURCE` set to the repository's absolute path and
+`WORKTRUST_REQUIRE_TOOL_RUNNERS=1`. The test derives Node from the built wheel; it does not require
+a system Node installation. Keep build-only workflow results distinct from successful publication.
+
+The inactive `release-pypi.yml.example` targets this public layout. Its intended active filename
+is `.github/workflows/release-pypi.yml`, using the protected `pypi` environment and PyPI Trusted
+Publishing. Once activated, the same GitHub release triggers both registries; manual execution
+supports the initial Python publication and retries. npm also requires the supported-platform Python
+artifact/parity tests before publishing. Both channels use the same version and module bytes.
+Approvals and registry failures remain separate; confirm both publications before announcing a
+release as available on both channels. Neither workflow invokes a Vercel deployment.
+
+Do not edit generated `bundle/`, `VERSION` or `LICENSE`. Publication requires confirmed
+PyPI ownership and a configured Trusted Publisher; source readiness does not grant that.
+
+Official runtime platform requirements: https://github.com/nodejs/node/blob/v22.23.3/BUILDING.md
+Pinned upstream archive checksums: https://nodejs.org/dist/v22.23.3/SHASUMS256.txt

worktrust-0.10.13/README.md

@@ -0,0 +1,98 @@
+# WorkTrust for Python tool runners
+
+This package launches the same JavaScript measurement engine shipped in the WorkTrust npm
+package. It does not implement another measurement engine or a Python instrumentation SDK.
+Python 3.10+ is required. Supported platform wheels include **Node.js 22.23.3**; no separate
+Node or npm installation is needed. The launcher uses that bundled runtime, never downloads a
+runtime when invoked, and does not silently switch to another CLI version.
+
+Wheels target macOS 11+ (Intel and Apple Silicon), Linux with glibc 2.28+ (x64 and arm64), and
+Windows 10+ (x64 and arm64). Linux also requires the Node-supported system C++ runtime
+(GLIBCXX_3.4.25 or newer). Alpine/musl, 32-bit systems and other platforms are not supported.
+A source distribution cannot fetch Node automatically: a source build requires the explicit
+maintainer preparation step below. Supported users should install the matching wheel.
+
+After publication under a verified WorkTrust-owned PyPI project, the intended commands are:
+
+```sh
+uvx worktrust preserve
+pipx run worktrust preserve
+```
+
+These public commands are not a claim that this package has already been published. Test a
+reviewed local wheel first:
+
+```sh
+uvx --from /absolute/path/worktrust-VERSION-py3-none-PLATFORM.whl worktrust --help
+pipx run --spec /absolute/path/worktrust-VERSION-py3-none-PLATFORM.whl worktrust --help
+```
+
+Use your package manager to choose and update the installed version. The package contains
+the CLI modules and Node runtime, so `preserve` itself needs no network after installation. It reads supported
+local session files and can change retention settings or create local metadata archives;
+only the person runs it. Existing WorkTrust agent safeguards and consent prompts remain.
+Other commands can contact WorkTrust. Package installation itself can contact registries.
+
+After PyPI publication, explicitly request the latest published package when needed:
+
+```sh
+uvx worktrust@latest preserve
+pipx run --no-cache worktrust preserve
+```
+
+For persistent installations, use `uv tool upgrade worktrust` or `pipx upgrade worktrust`.
+An existing cache or version constraint can otherwise keep an older release. `worktrust update`
+refreshes the computer coupling using the selected package; it does not upgrade the Python package.
+
+Runtime bundle hashes detect missing or changed files; they are not hardware attestation or
+independent proof of authenticity. Request and archive signatures retain the existing CLI's
+software-key threat model. See the npm package SECURITY.md and README.md for the data contract.
+
+## Maintainers
+
+Running `node tools/worktrust-cli/sync.mjs` from the monorepo also regenerates the Python JavaScript
+bundle and version. `node scripts/build-python-cli.mjs --check` refuses drift. The native runtime
+is a separate build artifact, excluded from Git and sdists. Explicitly prepare it before building:
+
+```sh
+python tools/worktrust-python/build_runtime.py
+python -m build --wheel tools/worktrust-python
+python -m build --sdist tools/worktrust-python
+```
+
+`build_runtime.py` downloads one official Node archive from nodejs.org at build time, verifies its
+committed SHA256 from `runtime-lock.json`, and extracts only the executable and complete LICENSE.
+It accepts `--target` for a reviewed target and `--cache` for a build cache. Platform wheel tags
+follow the selected runtime. Never label these wheels `any`. Building a wheel from the sdist
+fails closed until this explicit preparation step has been performed; no install hook downloads code.
+
+Run `python tools/worktrust-python/tests/test_runtime_build.py`, then
+`node scripts/test-python-cli.mjs` with a Python containing the build requirements (select it with
+`WORKTRUST_TEST_PYTHON`). Tests build and exercise a real wheel using its own runtime with no Node
+on PATH; they use synthetic homes and metadata only. Native execution must pass independently on
+all six claimed OS/architecture combinations before release. Cross-building alone is not that proof.
+Set `WORKTRUST_REQUIRE_TOOL_RUNNERS=1` to require actual uv and pipx wheel smoke tests, and
+`WORKTRUST_TEST_ARTIFACT_DIR` to a fresh directory to retain the exact tested wheel and sdist.
+Existing artifacts are never overwritten. Canonical module bytes match across channels;
+bit-for-bit reproducibility of whole wheel or sdist archives is not asserted.
+
+The public `fhomey/worktrust-cli` repository carries this package under `python/`, alongside the
+npm package at its root. There, install `python/requirements-release.txt`, run
+`python python/build_runtime.py`, then `python python/tests/test_distribution.py` with
+`WORKTRUST_TEST_CLI_SOURCE` set to the repository's absolute path and
+`WORKTRUST_REQUIRE_TOOL_RUNNERS=1`. The test derives Node from the built wheel; it does not require
+a system Node installation. Keep build-only workflow results distinct from successful publication.
+
+The inactive `release-pypi.yml.example` targets this public layout. Its intended active filename
+is `.github/workflows/release-pypi.yml`, using the protected `pypi` environment and PyPI Trusted
+Publishing. Once activated, the same GitHub release triggers both registries; manual execution
+supports the initial Python publication and retries. npm also requires the supported-platform Python
+artifact/parity tests before publishing. Both channels use the same version and module bytes.
+Approvals and registry failures remain separate; confirm both publications before announcing a
+release as available on both channels. Neither workflow invokes a Vercel deployment.
+
+Do not edit generated `bundle/`, `VERSION` or `LICENSE`. Publication requires confirmed
+PyPI ownership and a configured Trusted Publisher; source readiness does not grant that.
+
+Official runtime platform requirements: https://github.com/nodejs/node/blob/v22.23.3/BUILDING.md
+Pinned upstream archive checksums: https://nodejs.org/dist/v22.23.3/SHASUMS256.txt

worktrust-0.10.13/VERSION

@@ -0,0 +1 @@
+0.10.13

worktrust-0.10.13/build_runtime.py

@@ -0,0 +1,115 @@
+"""Explicit build-time fetch of pinned official Node binaries. Never imported by the CLI."""
+import argparse
+import hashlib
+import io
+import json
+from pathlib import Path
+import platform
+import shutil
+import stat
+import tarfile
+import tempfile
+import urllib.request
+import zipfile
+
+ROOT = Path(__file__).resolve().parent
+MAX_ARCHIVE = 150 * 1024 * 1024
+MAX_BINARY = 200 * 1024 * 1024
+
+
+def host_target():
+    system = {"Darwin":"darwin", "Linux":"linux", "Windows":"win"}.get(platform.system())
+    architecture = {"x86_64":"x64", "amd64":"x64", "arm64":"arm64", "aarch64":"arm64"}.get(platform.machine().lower())
+    target = f"{system}-{architecture}"
+    if system is None or architecture is None:
+        raise ValueError(f"unsupported runtime platform: {target}")
+    return target
+
+
+def selected_members(data, archive_name, executable):
+    """Copy only two exact regular members; never extract archive paths or links."""
+    suffix = ".zip" if archive_name.endswith(".zip") else ".tar.gz" if archive_name.endswith(".tar.gz") else ".tar.xz"
+    prefix = archive_name[:-len(suffix)]
+    expected = {f"{prefix}/{'node.exe' if executable == 'node.exe' else 'bin/node'}":executable,
+                f"{prefix}/LICENSE":"LICENSE"}
+    result = {}
+    if suffix == ".zip":
+        with zipfile.ZipFile(io.BytesIO(data)) as archive:
+            for member in archive.infolist():
+                if member.filename not in expected:
+                    continue
+                mode = member.external_attr >> 16
+                if member.is_dir() or stat.S_ISLNK(mode) or (stat.S_IFMT(mode) not in (0, stat.S_IFREG)):
+                    raise ValueError("runtime archive member must be a regular file")
+                if member.file_size > MAX_BINARY or member.filename in result:
+                    raise ValueError("invalid runtime archive member")
+                result[member.filename] = archive.read(member)
+    else:
+        with tarfile.open(fileobj=io.BytesIO(data), mode="r:*") as archive:
+            for member in archive:
+                if member.name not in expected:
+                    continue
+                if not member.isfile() or member.size > MAX_BINARY or member.name in result:
+                    raise ValueError("invalid runtime archive member")
+                stream = archive.extractfile(member)
+                result[member.name] = stream.read(MAX_BINARY + 1)
+    if set(result) != set(expected):
+        raise ValueError("runtime archive is missing an expected file")
+    if any(not value or len(value) > MAX_BINARY for value in result.values()):
+        raise ValueError("runtime archive member size invalid")
+    return {expected[name]: value for name, value in result.items()}
+
+
+def prepare(target, cache):
+    lock = json.loads((ROOT / "runtime-lock.json").read_text())
+    item = lock["targets"].get(target)
+    if item is None:
+        raise ValueError(f"unsupported runtime target: {target}")
+    cache.mkdir(parents=True, exist_ok=True)
+    cached = cache / item["archive"]
+    if cached.is_symlink():
+        raise ValueError("runtime archive cache must not be a symlink")
+    if cached.exists():
+        if cached.stat().st_size > MAX_ARCHIVE:
+            raise ValueError("runtime archive too large")
+        data = cached.read_bytes()
+    else:
+        request = urllib.request.Request(lock["base_url"] + item["archive"], headers={"User-Agent":"WorkTrust-runtime-build"})
+        with urllib.request.urlopen(request, timeout=60) as response:
+            if not response.url.startswith("https://nodejs.org/dist/"):
+                raise ValueError("runtime download redirected away from official origin")
+            data = response.read(MAX_ARCHIVE + 1)
+    if len(data) > MAX_ARCHIVE or hashlib.sha256(data).hexdigest() != item["sha256"]:
+        raise ValueError("official runtime archive checksum mismatch")
+    if not cached.exists():
+        with tempfile.NamedTemporaryFile(dir=cache, delete=False) as handle:
+            handle.write(data)
+            pending = Path(handle.name)
+        pending.replace(cached)
+    executable = "node.exe" if target.startswith("win-") else "node"
+    members = selected_members(data, item["archive"], executable)
+    destination = ROOT / "src/worktrust_cli/runtime"
+    if destination.is_symlink():
+        raise ValueError("runtime staging directory must not be a symlink")
+    destination.mkdir(parents=True, exist_ok=True)
+    for entry in destination.iterdir():
+        if entry.is_dir() and not entry.is_symlink():
+            raise ValueError("unexpected directory in runtime stage")
+        entry.unlink()
+    for name, payload in members.items():
+        path = destination/name
+        path.write_bytes(payload)
+        path.chmod(0o755 if name == executable else 0o644)
+    descriptor = {"version":lock["version"], "platform":target, "executable":executable,
+                  "archive_sha256":item["sha256"],
+                  "files":{name:hashlib.sha256(payload).hexdigest() for name,payload in sorted(members.items())}}
+    (destination/"runtime.json").write_text(json.dumps(descriptor,indent=2)+"\n")
+    print(f"Staged Node {lock['version']} for {target}; official archive SHA256 verified")
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--target", default=host_target())
+    parser.add_argument("--cache", type=Path, default=Path(tempfile.gettempdir())/"worktrust-node-build-cache")
+    args = parser.parse_args()
+    prepare(args.target, args.cache)

worktrust-0.10.13/pyproject.toml

@@ -0,0 +1,29 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "worktrust"
+dynamic = ["version"]
+description = "The WorkTrust CLI, using the same measurement engine as npm"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+dependencies = []
+
+[project.scripts]
+worktrust = "worktrust_cli:main"
+
+[project.urls]
+Homepage = "https://worktrust.io"
+Source = "https://github.com/fhomey/worktrust-cli"
+
+[tool.setuptools.dynamic]
+version = {file = "VERSION"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+worktrust_cli = ["bundle/*.mjs", "bundle/manifest.json", "runtime/*"]

worktrust-0.10.13/runtime-lock.json

@@ -0,0 +1,36 @@
+{
+  "version": "22.23.3",
+  "base_url": "https://nodejs.org/dist/v22.23.3/",
+  "targets": {
+    "darwin-arm64": {
+      "archive": "node-v22.23.3-darwin-arm64.tar.gz",
+      "sha256": "23b25245dcfb9af7262f8ff142e9e2e0af025368117329e7a7458a51e5922f53",
+      "wheel_tag": "macosx_11_0_arm64"
+    },
+    "darwin-x64": {
+      "archive": "node-v22.23.3-darwin-x64.tar.gz",
+      "sha256": "8a677b0219178efd6eb0e475457c4afb452b521a92f6e67845a73bd85727f2a8",
+      "wheel_tag": "macosx_11_0_x86_64"
+    },
+    "linux-arm64": {
+      "archive": "node-v22.23.3-linux-arm64.tar.xz",
+      "sha256": "a44aeb94849a299b22df10b9e622ec2f605c2183501bc40590705131de7c740f",
+      "wheel_tag": "manylinux_2_28_aarch64"
+    },
+    "linux-x64": {
+      "archive": "node-v22.23.3-linux-x64.tar.xz",
+      "sha256": "df450af89261115ef9f9e3830c3eeb2cc9213b63c720b1af623cb5dcbe2e02de",
+      "wheel_tag": "manylinux_2_28_x86_64"
+    },
+    "win-arm64": {
+      "archive": "node-v22.23.3-win-arm64.zip",
+      "sha256": "33dad22e4cef5ee8f9fbb1b0d037fdacd0e56d12a4580f0d63f68b894deab535",
+      "wheel_tag": "win_arm64"
+    },
+    "win-x64": {
+      "archive": "node-v22.23.3-win-x64.zip",
+      "sha256": "2b0ff57b049cda1bbcea2240eec20467018713c1efe1f7360c2681859b90ed71",
+      "wheel_tag": "win_amd64"
+    }
+  }
+}

worktrust-0.10.13/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

worktrust-0.10.13/setup.py

@@ -0,0 +1,55 @@
+"""Platform wheels carrying Node; Python code itself has no interpreter-specific ABI."""
+import hashlib
+import json
+from pathlib import Path
+from setuptools import setup
+from setuptools.dist import Distribution
+from setuptools.command.build_py import build_py
+from setuptools.command.bdist_wheel import bdist_wheel
+
+ROOT = Path(__file__).resolve().parent
+
+
+def runtime():
+    directory = ROOT/"src/worktrust_cli/runtime"
+    descriptor = directory/"runtime.json"
+    if not descriptor.is_file() or descriptor.is_symlink():
+        raise RuntimeError("Bundled runtime is absent. Run python build_runtime.py explicitly before building a wheel; runtime downloads never occur during installation or CLI execution.")
+    data = json.loads(descriptor.read_text())
+    lock = json.loads((ROOT/"runtime-lock.json").read_text())
+    expected = lock["targets"].get(data["platform"])
+    if expected is None or data["version"] != lock["version"] or data["archive_sha256"] != expected["sha256"]:
+        raise RuntimeError("Staged runtime does not match the reviewed runtime lock")
+    executable = "node.exe" if data["platform"].startswith("win-") else "node"
+    if data["executable"] != executable or set(data["files"]) != {executable,"LICENSE"}:
+        raise RuntimeError("Staged runtime has an invalid file list")
+    if {path.name for path in directory.iterdir()} != {executable,"LICENSE","runtime.json"}:
+        raise RuntimeError("Unexpected runtime file")
+    for name,digest in data["files"].items():
+        path = directory/name
+        if path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest() != digest:
+            raise RuntimeError("Staged runtime integrity mismatch")
+    return expected["wheel_tag"]
+
+
+class BuildPython(build_py):
+    def run(self):
+        runtime()
+        super().run()
+
+
+class PlatformWheel(bdist_wheel):
+    def finalize_options(self):
+        super().finalize_options()
+        self.root_is_pure = False
+
+    def get_tag(self):
+        return "py3", "none", runtime()
+
+
+class BinaryDistribution(Distribution):
+    def has_ext_modules(self):
+        return True
+
+
+setup(distclass=BinaryDistribution, cmdclass={"build_py":BuildPython,"bdist_wheel":PlatformWheel})

worktrust-0.10.13/src/worktrust.egg-info/PKG-INFO

@@ -0,0 +1,110 @@
+Metadata-Version: 2.4
+Name: worktrust
+Version: 0.10.13
+Summary: The WorkTrust CLI, using the same measurement engine as npm
+License-Expression: MIT
+Project-URL: Homepage, https://worktrust.io
+Project-URL: Source, https://github.com/fhomey/worktrust-cli
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# WorkTrust for Python tool runners
+
+This package launches the same JavaScript measurement engine shipped in the WorkTrust npm
+package. It does not implement another measurement engine or a Python instrumentation SDK.
+Python 3.10+ is required. Supported platform wheels include **Node.js 22.23.3**; no separate
+Node or npm installation is needed. The launcher uses that bundled runtime, never downloads a
+runtime when invoked, and does not silently switch to another CLI version.
+
+Wheels target macOS 11+ (Intel and Apple Silicon), Linux with glibc 2.28+ (x64 and arm64), and
+Windows 10+ (x64 and arm64). Linux also requires the Node-supported system C++ runtime
+(GLIBCXX_3.4.25 or newer). Alpine/musl, 32-bit systems and other platforms are not supported.
+A source distribution cannot fetch Node automatically: a source build requires the explicit
+maintainer preparation step below. Supported users should install the matching wheel.
+
+After publication under a verified WorkTrust-owned PyPI project, the intended commands are:
+
+```sh
+uvx worktrust preserve
+pipx run worktrust preserve
+```
+
+These public commands are not a claim that this package has already been published. Test a
+reviewed local wheel first:
+
+```sh
+uvx --from /absolute/path/worktrust-VERSION-py3-none-PLATFORM.whl worktrust --help
+pipx run --spec /absolute/path/worktrust-VERSION-py3-none-PLATFORM.whl worktrust --help
+```
+
+Use your package manager to choose and update the installed version. The package contains
+the CLI modules and Node runtime, so `preserve` itself needs no network after installation. It reads supported
+local session files and can change retention settings or create local metadata archives;
+only the person runs it. Existing WorkTrust agent safeguards and consent prompts remain.
+Other commands can contact WorkTrust. Package installation itself can contact registries.
+
+After PyPI publication, explicitly request the latest published package when needed:
+
+```sh
+uvx worktrust@latest preserve
+pipx run --no-cache worktrust preserve
+```
+
+For persistent installations, use `uv tool upgrade worktrust` or `pipx upgrade worktrust`.
+An existing cache or version constraint can otherwise keep an older release. `worktrust update`
+refreshes the computer coupling using the selected package; it does not upgrade the Python package.
+
+Runtime bundle hashes detect missing or changed files; they are not hardware attestation or
+independent proof of authenticity. Request and archive signatures retain the existing CLI's
+software-key threat model. See the npm package SECURITY.md and README.md for the data contract.
+
+## Maintainers
+
+Running `node tools/worktrust-cli/sync.mjs` from the monorepo also regenerates the Python JavaScript
+bundle and version. `node scripts/build-python-cli.mjs --check` refuses drift. The native runtime
+is a separate build artifact, excluded from Git and sdists. Explicitly prepare it before building:
+
+```sh
+python tools/worktrust-python/build_runtime.py
+python -m build --wheel tools/worktrust-python
+python -m build --sdist tools/worktrust-python
+```
+
+`build_runtime.py` downloads one official Node archive from nodejs.org at build time, verifies its
+committed SHA256 from `runtime-lock.json`, and extracts only the executable and complete LICENSE.
+It accepts `--target` for a reviewed target and `--cache` for a build cache. Platform wheel tags
+follow the selected runtime. Never label these wheels `any`. Building a wheel from the sdist
+fails closed until this explicit preparation step has been performed; no install hook downloads code.
+
+Run `python tools/worktrust-python/tests/test_runtime_build.py`, then
+`node scripts/test-python-cli.mjs` with a Python containing the build requirements (select it with
+`WORKTRUST_TEST_PYTHON`). Tests build and exercise a real wheel using its own runtime with no Node
+on PATH; they use synthetic homes and metadata only. Native execution must pass independently on
+all six claimed OS/architecture combinations before release. Cross-building alone is not that proof.
+Set `WORKTRUST_REQUIRE_TOOL_RUNNERS=1` to require actual uv and pipx wheel smoke tests, and
+`WORKTRUST_TEST_ARTIFACT_DIR` to a fresh directory to retain the exact tested wheel and sdist.
+Existing artifacts are never overwritten. Canonical module bytes match across channels;
+bit-for-bit reproducibility of whole wheel or sdist archives is not asserted.
+
+The public `fhomey/worktrust-cli` repository carries this package under `python/`, alongside the
+npm package at its root. There, install `python/requirements-release.txt`, run
+`python python/build_runtime.py`, then `python python/tests/test_distribution.py` with
+`WORKTRUST_TEST_CLI_SOURCE` set to the repository's absolute path and
+`WORKTRUST_REQUIRE_TOOL_RUNNERS=1`. The test derives Node from the built wheel; it does not require
+a system Node installation. Keep build-only workflow results distinct from successful publication.
+
+The inactive `release-pypi.yml.example` targets this public layout. Its intended active filename
+is `.github/workflows/release-pypi.yml`, using the protected `pypi` environment and PyPI Trusted
+Publishing. Once activated, the same GitHub release triggers both registries; manual execution
+supports the initial Python publication and retries. npm also requires the supported-platform Python
+artifact/parity tests before publishing. Both channels use the same version and module bytes.
+Approvals and registry failures remain separate; confirm both publications before announcing a
+release as available on both channels. Neither workflow invokes a Vercel deployment.
+
+Do not edit generated `bundle/`, `VERSION` or `LICENSE`. Publication requires confirmed
+PyPI ownership and a configured Trusted Publisher; source readiness does not grant that.
+
+Official runtime platform requirements: https://github.com/nodejs/node/blob/v22.23.3/BUILDING.md
+Pinned upstream archive checksums: https://nodejs.org/dist/v22.23.3/SHASUMS256.txt

worktrust-0.10.13/src/worktrust.egg-info/SOURCES.txt

@@ -0,0 +1,32 @@
+LICENSE
+MANIFEST.in
+README.md
+VERSION
+build_runtime.py
+pyproject.toml
+runtime-lock.json
+setup.py
+src/worktrust.egg-info/PKG-INFO
+src/worktrust.egg-info/SOURCES.txt
+src/worktrust.egg-info/dependency_links.txt
+src/worktrust.egg-info/entry_points.txt
+src/worktrust.egg-info/top_level.txt
+src/worktrust_cli/__init__.py
+src/worktrust_cli/__main__.py
+src/worktrust_cli/bundle/chat-exports.mjs
+src/worktrust_cli/bundle/config-edits.mjs
+src/worktrust_cli/bundle/count-behaviour.mjs
+src/worktrust_cli/bundle/log-session.mjs
+src/worktrust_cli/bundle/manifest.json
+src/worktrust_cli/bundle/preserve-lines.mjs
+src/worktrust_cli/bundle/preserve-summary.mjs
+src/worktrust_cli/bundle/preserve.mjs
+src/worktrust_cli/bundle/runtime-install.mjs
+src/worktrust_cli/bundle/session-databases.mjs
+src/worktrust_cli/bundle/setup-mcp.mjs
+src/worktrust_cli/bundle/stack-rules.mjs
+src/worktrust_cli/bundle/stretch-evidence.mjs
+src/worktrust_cli/bundle/transcript-readers.mjs
+src/worktrust_cli/bundle/worktrust.mjs
+tests/test_distribution.py
+tests/test_runtime_build.py

worktrust-0.10.13/src/worktrust.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

worktrust-0.10.13/src/worktrust.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+worktrust = worktrust_cli:main

worktrust-0.10.13/src/worktrust.egg-info/top_level.txt

@@ -0,0 +1 @@
+worktrust_cli