zerynex-python 0.2.0__py3-none-any.whl

zerynex_py/refund_workflows.py

@@ -0,0 +1,118 @@
+"""Fixed, bundled synthetic-only refund privacy MCP and preflight workflows.
+
+No caller-controlled filesystem paths, arbitrary manifests, real wallet refs or
+private PCZT data cross the agent trust boundary.
+"""
+from __future__ import annotations
+
+from importlib.resources import files
+import json
+
+from .client import ZerynexError
+from .refund_privacy import audit_manifest, compare_manifests, RefundAuditInputError
+
+SCENARIOS = ("isolated", "risky", "regression-expanded")
+FIXTURE_FILES = {
+    "isolated": "refund-isolated.json",
+    "risky": "refund-risky.json",
+    "regression-expanded": "refund-regression-expanded.json",
+}
+LIMITATION = (
+    "Bundled synthetic and self-declared metadata only. No wallet, refund, viewing "
+    "keys, private information retrieval, quantum protection, or actual chain data."
+)
+
+
+def _load_scenario(scenario: str) -> dict[str, object]:
+    if type(scenario) is not str or scenario not in FIXTURE_FILES:
+        raise ZerynexError("Only reviewed synthetic refund scenarios are allowed.")
+    try:
+        raw = files("zerynex_py").joinpath("fixtures", FIXTURE_FILES[scenario]).read_bytes()
+        if len(raw) > 64 * 1024 or not raw:
+            raise ValueError("bad resource")
+        def unique(pairs):
+            result = {}
+            for key, value in pairs:
+                if key in result:
+                    raise ValueError("duplicate")
+                result[key] = value
+            return result
+        value = json.loads(raw, object_pairs_hook=unique)
+        if type(value) is not dict:
+            raise ValueError("bad data")
+        return value
+    except (OSError, UnicodeError, ValueError, TypeError):
+        raise ZerynexError("Bundled synthetic refund scenario unavailable.") from None
+
+
+def synthetic_refund_audit(scenario: str = "isolated") -> dict[str, object]:
+    """Return only a sanitized report on one of three known test scenarios."""
+    data = _load_scenario(scenario)
+    try:
+        report = audit_manifest(data)
+    except RefundAuditInputError:
+        raise ZerynexError("Bundled synthetic refund scenario failed validation.") from None
+    return {
+        "scenario": scenario,
+        "synthetic": True,
+        "report": report,
+        "limitation": LIMITATION,
+    }
+
+
+def synthetic_refund_regression(
+    baseline: str = "risky", candidate: str = "regression-expanded"
+) -> dict[str, object]:
+    """Diff pre-reviewed scenarios, never expose flow tokens or arbitrary JSON."""
+    left, right = _load_scenario(baseline), _load_scenario(candidate)
+    try:
+        report = compare_manifests(left, right)
+    except RefundAuditInputError:
+        raise ZerynexError("Bundled synthetic refund comparison failed validation.") from None
+    return {
+        "baseline": baseline,
+        "candidate": candidate,
+        "synthetic": True,
+        "report": report,
+        "limitation": LIMITATION,
+    }
+
+
+def synthetic_refund_smoke_suite() -> dict[str, object]:
+    """Verify the known pass/fail and per-flow risk-delta expectations."""
+    expected = {
+        "isolated": (True, 0),
+        "risky": (False, 5),
+        "regression-expanded": (False, 5),
+    }
+    outcomes: list[dict[str, object]] = []
+    for scenario, (passed, finding_count) in expected.items():
+        try:
+            data = synthetic_refund_audit(scenario)["report"]
+            matched = data["passed"] is passed and data["finding_count"] == finding_count
+        except (ZerynexError, KeyError, TypeError):
+            matched = False
+        outcomes.append({"scenario": scenario, "matched_expectation": matched})
+    for baseline, candidate, passed, new_events in (
+        ("isolated", "risky", False, 8),
+        ("risky", "regression-expanded", False, 1),
+        ("risky", "isolated", True, 0),
+    ):
+        try:
+            data = synthetic_refund_regression(baseline, candidate)["report"]
+            matched = data["passed"] is passed and data["new_risk_events"] == new_events
+        except (ZerynexError, KeyError, TypeError):
+            matched = False
+        outcomes.append({
+            "scenario": baseline + "-to-" + candidate,
+            "matched_expectation": matched,
+        })
+    count = sum(item["matched_expectation"] is True for item in outcomes)
+    return {
+        "synthetic": True,
+        "passed": count == len(outcomes),
+        "matched": count,
+        "total": len(outcomes),
+        "tests": outcomes,
+        "limitation": LIMITATION,
+    }

zerynex_py/rpc_contract.py

@@ -0,0 +1,172 @@
+#!/usr/bin/env python3
+"""Offline, value-free OpenRPC method/parameter compatibility check."""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import stat
+import re
+import sys
+
+MAX_SCHEMA = 1024 * 1024
+MAX_CONTRACT = 64 * 1024
+SAFE_NAME = re.compile(r"^[a-zA-Z_][a-zA-Z0-9_.-]{0,95}$")
+
+
+class ContractInputError(Exception):
+    """Sanitized error, never copies JSON source values or private paths."""
+
+
+def reject_duplicate_keys(pairs: list[tuple[str, object]]) -> dict:
+    """Reject ambiguous JSON input with repeated keys at any depth."""
+    decoded = {}
+    for key, value in pairs:
+        if key in decoded:
+            raise ContractInputError("Duplicate JSON key.")
+        decoded[key] = value
+    return decoded
+
+
+def unwrap_openrpc_schema(data: dict) -> dict:
+    """Accept only a bare OpenRPC document or saved rpc.discover JSON-RPC reply."""
+    if "jsonrpc" not in data:
+        return data
+    if (set(data) != {"jsonrpc", "id", "result"} or
+            data["jsonrpc"] != "2.0" or
+            (data["id"] is not None and type(data["id"]) not in (str, int)) or
+            not isinstance(data["result"], dict)):
+        raise ContractInputError("Invalid rpc.discover response.")
+    schema = data["result"]
+    if not isinstance(schema.get("openrpc"), str) or "jsonrpc" in schema:
+        raise ContractInputError("Expected OpenRPC schema result.")
+    return schema
+
+
+def read_json(path: str, limit: int) -> dict:
+    try:
+        selected = Path(path)
+        if selected.is_symlink():
+            raise ContractInputError
+        # On POSIX, O_NOFOLLOW rejects symlink substitutions between our
+        # pathname check and open(). O_NONBLOCK avoids waiting on a swapped
+        # special file (e.g. FIFO); fstat checks the opened descriptor.
+        flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0)
+        fd = os.open(selected, flags)
+        with os.fdopen(fd, 'rb') as handle:
+            info = os.fstat(handle.fileno())
+            if not stat.S_ISREG(info.st_mode) or not 0 < info.st_size <= limit:
+                raise ContractInputError
+            raw = handle.read(limit + 1)
+        if len(raw) > limit:
+            raise ContractInputError
+        decoded = json.loads(raw, object_pairs_hook=reject_duplicate_keys)
+        if not isinstance(decoded, dict):
+            raise ContractInputError
+        return decoded
+    except (OSError, ValueError, UnicodeError, RecursionError, ContractInputError):
+        raise ContractInputError("Invalid or oversized local OpenRPC input.") from None
+
+
+def parse_methods(data: dict, *, contract: bool) -> dict[str, list[tuple[str, bool]]]:
+    if contract and (type(data.get("version")) is not int or data["version"] != 1 or
+                     set(data) != {"version", "methods"}):
+        raise ContractInputError("Unsupported RPC contract version.")
+    if not contract and not isinstance(data.get("openrpc"), str):
+        raise ContractInputError("OpenRPC version is required.")
+    items = data.get("methods")
+    if not isinstance(items, list) or not items or len(items) > 512:
+        raise ContractInputError("Invalid method list.")
+    parsed = {}
+    for entry in items:
+        if not isinstance(entry, dict) or not isinstance(entry.get("name"), str):
+            raise ContractInputError("Invalid method description.")
+        name = entry["name"]
+        if not SAFE_NAME.fullmatch(name) or name in parsed:
+            raise ContractInputError("Invalid or repeated method name.")
+        if contract and set(entry) != {"name", "params"}:
+            raise ContractInputError("Unexpected contract field.")
+        params = entry.get("params")
+        if not isinstance(params, list) or len(params) > 100:
+            raise ContractInputError("Invalid parameter list.")
+        found = set()
+        parsed_params = []
+        for param in params:
+            if not isinstance(param, dict):
+                raise ContractInputError("Invalid parameter declaration.")
+            pname = param.get("name")
+            required = param.get("required", False)
+            if (not isinstance(pname, str) or not SAFE_NAME.fullmatch(pname)
+                    or pname in found or type(required) is not bool):
+                raise ContractInputError("Invalid or duplicate parameter declaration.")
+            if contract and set(param) != {"name", "required"}:
+                raise ContractInputError("Unexpected parameter contract field.")
+            found.add(pname)
+            parsed_params.append((pname, required))
+        parsed[name] = parsed_params
+    return parsed
+
+
+def compare(schema: dict, contract: dict, *, deny_new_required: bool = False) -> dict:
+    actual = parse_methods(schema, contract=False)
+    expected = parse_methods(contract, contract=True)
+    findings = []
+    for method, expected_params in expected.items():
+        if method not in actual:
+            findings.append({"rule": "RPC-METHOD-MISSING", "method": method})
+            continue
+        actual_params = actual[method]
+        position = {name: index for index, (name, _) in enumerate(actual_params)}
+        last = -1
+        for name, required in expected_params:
+            if name not in position:
+                findings.append({"rule": "RPC-PARAMETER-MISSING", "method": method, "parameter": name})
+                continue
+            at = position[name]
+            if at < last:
+                findings.append({"rule": "RPC-PARAMETER-ORDER", "method": method, "parameter": name})
+            last = max(last, at)
+            if actual_params[at][1] != required:
+                findings.append({"rule": "RPC-REQUIRED-FLAG-CHANGED", "method": method, "parameter": name})
+        if deny_new_required:
+            expected_names = {name for name, _ in expected_params}
+            for name, required in actual_params:
+                if required and name not in expected_names:
+                    findings.append({"rule": "RPC-NEW-REQUIRED-PARAMETER", "method": method, "parameter": name})
+    return {
+        "passed": len(findings) == 0,
+        "checked_methods": len(expected),
+        "observed_methods": len(actual),
+        "deny_new_required": deny_new_required,
+        "finding_count": len(findings),
+        "findings": findings,
+        "limitation": "Offline method and parameter structure only. No RPC execution, payload semantics, wallet safety or release compatibility verified.",
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Offline Zcash OpenRPC contract checker")
+    parser.add_argument("--schema", required=True, help="Local OpenRPC JSON file")
+    parser.add_argument("--contract", required=True, help="Expected method/parameter JSON file")
+    parser.add_argument("--deny-new-required", action="store_true", help="Report newly required parameters on contracted methods")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+    try:
+        schema = unwrap_openrpc_schema(read_json(args.schema, MAX_SCHEMA))
+        report = compare(schema, read_json(args.contract, MAX_CONTRACT), deny_new_required=args.deny_new_required)
+    except ContractInputError:
+        print("Zerynex RPC: cannot evaluate input. Verify local schema and contract structure.", file=sys.stderr)
+        return 1
+    if args.json:
+        print(json.dumps(report, indent=2))
+    else:
+        print("Zerynex RPC: {} of {} contracted methods checked, {} finding(s).".format(
+            report["checked_methods"], report["checked_methods"], report["finding_count"]))
+        for item in report["findings"]:
+            print("{}: {} {}".format(item["rule"], item["method"], item.get("parameter", "")))
+    return 0 if report["passed"] else 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

zerynex_py/rules.py

@@ -0,0 +1,55 @@
+"""Bounded, versioned public rule metadata; no transaction material or network."""
+from __future__ import annotations
+from importlib.resources import files
+import json
+import re
+from .client import ZerynexError
+
+
+def parse_rule_catalog(raw: str) -> dict[str, object]:
+    if not isinstance(raw,str) or not 0 < len(raw) < 32 * 1024:
+        raise ZerynexError('Invalid local rule catalog size.')
+    try:
+        def no_duplicates(pairs):
+            record={}
+            for key,value in pairs:
+                if key in record:
+                    raise ValueError('duplicate keys')
+                record[key]=value
+            return record
+        data=json.loads(raw, object_pairs_hook=no_duplicates)
+        if (not isinstance(data,dict) or set(data) != {'schema_version','tool','rule_set_version','scope','rules'} or
+                type(data['schema_version']) is not int or data['schema_version'] != 1 or
+                data['tool'] != 'zerynex' or not isinstance(data['rule_set_version'],str) or
+                not re.fullmatch(r'[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}', data['rule_set_version']) or
+                not isinstance(data['scope'],str) or not 20 < len(data['scope']) <= 512):
+            raise ValueError
+        rules=data['rules']
+        if not isinstance(rules,list) or not 1 <= len(rules) <= 32:
+            raise ValueError
+        ids=[]
+        for rule in rules:
+            if (not isinstance(rule,dict) or set(rule) != {'id','title','severity','category','applies_to','summary'} or
+                    not all(isinstance(rule[x],str) for x in ('id','title','severity','category','summary')) or
+                    not re.fullmatch(r'PCZT-[A-Z-]{3,64}',rule['id']) or
+                    not 5 <= len(rule['title']) <= 120 or not 10 <= len(rule['summary']) <= 256 or
+                    rule['category'] not in ('metadata','pool_policy','handoff','regression') or
+                    rule['severity'] not in ('warning','error') or
+                    not isinstance(rule['applies_to'],list) or
+                    rule['applies_to'] not in (['stage_comparison'],['analysis','stage_comparison'])):
+                raise ValueError
+            ids.append(rule['id'])
+        if ids != sorted(set(ids)) or any(not item.startswith('PCZT-') for item in ids):
+            raise ValueError
+        return data
+    except (ValueError,TypeError,KeyError):
+        raise ZerynexError('Invalid rule catalog from the local Rust engine.') from None
+
+
+def bundled_rule_catalog() -> dict[str, object]:
+    """Read the packaged metadata snapshot (validated during release CI)."""
+    try:
+        raw=files('zerynex_py').joinpath('fixtures','rule-catalog.json').read_bytes()
+        return parse_rule_catalog(raw.decode('utf-8'))
+    except (OSError,UnicodeError,ValueError):
+        raise ZerynexError('Bundled rule catalog is unavailable.') from None

zerynex_py/z3.py

@@ -0,0 +1,107 @@
+"""Privacy-conscious local Z3 Zebra liveness/readiness checks.
+
+Uses ONLY the documented public health routes on an explicitly loopback-only
+endpoint. No arbitrary hostnames, DNS resolution, wallet JSON-RPC, auth cookies,
+transaction data, node credentials, or external network calls.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, asdict
+from http.client import HTTPConnection, HTTPException
+import ipaddress
+import json
+from typing import Literal
+
+from .client import ZerynexError
+
+Status = Literal["healthy", "not_ready", "unavailable"]
+
+@dataclass(frozen=True)
+class ZebraHealthReport:
+    endpoint: str
+    liveness: Status
+    readiness: Status
+    summary: str
+    source: str = "Z3 Zebra documented /healthy and /ready endpoints"
+    caution: str = "This tests a local health endpoint only. It does not validate consensus, Zaino gRPC, or Zallet wallet functionality."
+
+    def as_dict(self) -> dict[str, str]:
+        return asdict(self)
+
+
+def _safe_loopback_host(host: str) -> str:
+    if host == "localhost":
+        return "127.0.0.1"  # Avoid OS proxy and non-loopback DNS surprises.
+    try:
+        addr = ipaddress.ip_address(host)
+    except ValueError:
+        raise ZerynexError("Only numeric loopback addresses or localhost are allowed.") from None
+    if not addr.is_loopback:
+        raise ZerynexError("Z3 diagnostics may connect to loopback only.")
+    return addr.compressed
+
+
+def _query(host: str, port: int, route: str, timeout: float) -> int | None:
+    connection = HTTPConnection(host, port, timeout=timeout)
+    try:
+        connection.request("GET", route, headers={"Accept": "text/plain", "Connection": "close"})
+        response = connection.getresponse()
+        # A health response may contain implementation detail; discard the body
+        # rather than putting it into logs or an agent response.
+        response.read(4096)
+        return response.status
+    except (OSError, TimeoutError, HTTPException):
+        return None
+    finally:
+        connection.close()
+
+
+def check_zebra_local(
+    *,
+    host: str = "127.0.0.1",
+    port: int = 8080,
+    timeout: float = 1.5,
+) -> ZebraHealthReport:
+    """Check Z3/Zebra local liveness and readiness; never scan public hosts."""
+    safe_host = _safe_loopback_host(host)
+    if type(port) is not int or not 1 <= port <= 65535:
+        raise ZerynexError("Invalid local Zebra health port.")
+    if not isinstance(timeout, (float, int)) or not (0 < timeout <= 3):
+        raise ZerynexError("Timeout must be greater than zero and at most three seconds.")
+    live = _query(safe_host, port, "/healthy", float(timeout))
+    ready = _query(safe_host, port, "/ready", float(timeout))
+
+    liveness: Status = "healthy" if live == 200 else "not_ready" if live is not None else "unavailable"
+    readiness: Status = "healthy" if ready == 200 else "not_ready" if ready is not None else "unavailable"
+    if live == 200 and ready == 200:
+        summary = "Zebra's local health and readiness endpoints both returned HTTP 200."
+    elif live == 200:
+        summary = "Zebra's local liveness endpoint responded, but readiness is not confirmed."
+    else:
+        summary = "Zebra liveness is not confirmed. Check the local Z3 services and port mapping."
+    return ZebraHealthReport(
+        endpoint=f"{safe_host}:{port}",
+        liveness=liveness,
+        readiness=readiness,
+        summary=summary,
+    )
+
+
+def main() -> None:
+    import argparse
+    parser = argparse.ArgumentParser(description="Zerynex: local-only Z3 Zebra health diagnostics")
+    parser.add_argument("--host", default="127.0.0.1", help="localhost or numeric loopback only")
+    parser.add_argument("--port", type=int, default=8080, help="Z3_ZEBRA_HOST_HEALTH_PORT")
+    parser.add_argument("--timeout", type=float, default=1.5, help="Request timeout, at most three seconds")
+    args = parser.parse_args()
+    try:
+        result = check_zebra_local(host=args.host, port=args.port, timeout=args.timeout)
+    except ZerynexError:
+        parser.exit(1, "Invalid or disallowed local health probe configuration.\n")
+    print(json.dumps(result.as_dict(), indent=2))
+    if result.liveness != "healthy" or result.readiness != "healthy":
+        parser.exit(2)
+
+
+if __name__ == "__main__":
+    main()

zerynex_py/zallet_fixture.py

@@ -0,0 +1,158 @@
+#!/usr/bin/env python3
+"""Offline policy check for locally supplied, release-labelled Zallet PCZT fixtures.
+
+The manifest's producer attribution is an assertion by its author. This tool
+cannot authenticate that a PCZT was produced by Zallet.
+"""
+from __future__ import annotations
+
+import argparse
+import base64
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import stat
+import subprocess
+import sys
+
+MAX_MANIFEST = 16 * 1024
+MAX_BASE64 = ((8 * 1024 * 1024 + 2) // 3) * 4
+NAME = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.-]{0,79}\.b64\Z")
+RULE = re.compile(r"[A-Z][A-Z0-9-]{0,79}\Z")
+FIELD = re.compile(r"[a-z][a-z0-9_.-]{0,95}\Z")
+DIGEST = re.compile(r"[0-9a-f]{64}\Z")
+PINNED_RELEASE = "v0.1.0-beta.3"
+PINNED_COMMIT = "987382f67e622915228686e9f956c6a9c9a7514c"
+
+
+class FixtureError(Exception):
+    """Never include fixture content or filesystem paths in this error."""
+
+
+def unique_pairs(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise FixtureError("Ambiguous manifest JSON.")
+        result[key] = value
+    return result
+
+
+def read_regular(path: Path, limit: int) -> bytes:
+    try:
+        flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0)
+        fd = os.open(path, flags)
+        with os.fdopen(fd, "rb") as handle:
+            info = os.fstat(handle.fileno())
+            if not stat.S_ISREG(info.st_mode) or not 0 < info.st_size <= limit:
+                raise FixtureError("Invalid local fixture size or type.")
+            value = handle.read(limit + 1)
+        if not 0 < len(value) <= limit:
+            raise FixtureError("Invalid local fixture size or type.")
+        return value
+    except (OSError, ValueError):
+        raise FixtureError("Cannot read a regular local fixture.") from None
+
+
+def validate_manifest(value: object) -> list[dict]:
+    if not isinstance(value, dict) or set(value) != {"version", "producer", "cases"} or type(value["version"]) is not int or value["version"] != 1:
+        raise FixtureError("Invalid fixture manifest.")
+    producer = value["producer"]
+    if (not isinstance(producer, dict) or set(producer) != {"release", "commit", "origin"}
+            or producer != {"release": PINNED_RELEASE, "commit": PINNED_COMMIT,
+                            "origin": "locally-supplied-zallet-output"}):
+        raise FixtureError("Unsupported or unpinned producer assertion.")
+    cases = value["cases"]
+    if not isinstance(cases, list) or not 1 <= len(cases) <= 16:
+        raise FixtureError("Invalid fixture case count.")
+    names = set()
+    for case in cases:
+        if not isinstance(case, dict) or set(case) != {"file", "sha256", "deny_transparent", "expect"}:
+            raise FixtureError("Invalid fixture case.")
+        name = case["file"]
+        expect = case["expect"]
+        if (not isinstance(name, str) or not NAME.fullmatch(name) or name in names
+                or not isinstance(case["sha256"], str) or not DIGEST.fullmatch(case["sha256"])
+                or type(case["deny_transparent"]) is not bool
+                or not isinstance(expect, list) or len(expect) > 32):
+            raise FixtureError("Invalid fixture case.")
+        names.add(name)
+        seen = set()
+        for item in expect:
+            if (not isinstance(item, dict) or set(item) != {"rule", "field"}
+                    or not isinstance(item["rule"], str) or not RULE.fullmatch(item["rule"])
+                    or not isinstance(item["field"], str) or not FIELD.fullmatch(item["field"])):
+                raise FixtureError("Invalid finding expectation.")
+            pair = (item["rule"], item["field"])
+            if pair in seen:
+                raise FixtureError("Repeated finding expectation.")
+            seen.add(pair)
+    return cases
+
+
+def run(manifest_path: Path, cli: Path) -> dict:
+    try:
+        manifest = json.loads(read_regular(manifest_path, MAX_MANIFEST), object_pairs_hook=unique_pairs)
+    except (ValueError, UnicodeError, RecursionError):
+        raise FixtureError("Invalid fixture manifest JSON.") from None
+    cases = validate_manifest(manifest)
+    results = []
+    for case in cases:
+        encoded = read_regular(manifest_path.parent / case["file"], MAX_BASE64)
+        if hashlib.sha256(encoded).hexdigest() != case["sha256"]:
+            raise FixtureError("Fixture digest mismatch.")
+        try:
+            decoded = base64.b64decode(encoded, validate=True)
+            if not decoded or len(decoded) > 8 * 1024 * 1024 or base64.b64encode(decoded) != encoded:
+                raise FixtureError("Invalid canonical base64 fixture.")
+        except (ValueError, base64.binascii.Error):
+            raise FixtureError("Invalid canonical base64 fixture.") from None
+        args = [str(cli), "-", "--input-format", "base64", "--json"]
+        if case["deny_transparent"]:
+            args.append("--deny-transparent")
+        try:
+            completed = subprocess.run(args, input=encoded, capture_output=True, timeout=30, check=False)
+        except (OSError, subprocess.TimeoutExpired):
+            raise FixtureError("Local analyzer unavailable or timed out.") from None
+        if completed.returncode not in (0, 2) or len(completed.stdout) > 1024 * 1024:
+            raise FixtureError("Local analyzer rejected a fixture.")
+        try:
+            report = json.loads(completed.stdout, object_pairs_hook=unique_pairs)
+            findings = report["findings"]
+            actual = sorted((item["rule"], item["field"]) for item in findings)
+            if (not isinstance(findings, list) or len(findings) > 32
+                    or type(report["deny_transparent"]) is not bool
+                    or report["deny_transparent"] != case["deny_transparent"]
+                    or (completed.returncode == 0) != (len(actual) == 0)
+                    or any(not RULE.fullmatch(rule) or not FIELD.fullmatch(field)
+                           for rule, field in actual)):
+                raise FixtureError("Invalid analyzer report.")
+        except (ValueError, KeyError, TypeError, AttributeError):
+            raise FixtureError("Invalid analyzer report.") from None
+        expected = sorted((item["rule"], item["field"]) for item in case["expect"])
+        results.append({"case": len(results) + 1, "matched": actual == expected,
+                        "finding_count": len(actual), "rules": sorted(set(rule for rule, _ in actual))})
+    return {"evidence": "locally-supplied-fixture; producer origin asserted, not authenticated",
+            "release_assertion": PINNED_RELEASE, "case_count": len(results),
+            "passed": all(item["matched"] for item in results), "cases": results,
+            "limitation": "No wallet RPC, signing, proving, broadcast, or live Zallet interoperability verified."}
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--manifest", required=True, type=Path)
+    parser.add_argument("--cli", required=True, type=Path)
+    args = parser.parse_args()
+    try:
+        result = run(args.manifest, args.cli)
+    except FixtureError:
+        print("Zerynex: invalid local PCZT fixture or analyzer result.", file=sys.stderr)
+        return 1
+    print(json.dumps(result, indent=2))
+    return 0 if result["passed"] else 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())