Codex/python elite sdk

.github/workflows/python-sdk.yml

@@ -0,0 +1,240 @@
+name: Python SDK package
+
+on:
+  pull_request:
+    paths:
+      - "bindings/python/**"
+      - "bindings/python-adapters/sqlite/**"
+      - "bindings/wasm/auths-proof-wasm/examples/generate-node-vectors.rs"
+      - ".github/workflows/python-sdk.yml"
+      - "Cargo.lock"
+      - "Cargo.toml"
+  push:
+    branches: [main]
+    paths:
+      - "bindings/python/**"
+      - "bindings/python-adapters/sqlite/**"
+      - "bindings/wasm/auths-proof-wasm/examples/generate-node-vectors.rs"
+      - ".github/workflows/python-sdk.yml"
+      - "Cargo.lock"
+      - "Cargo.toml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  source-contract:
+    name: source behavior and contracts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-rust-cache
+        with:
+          toolchain: 1.97.1
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+      - name: Create source-test virtual environment
+        shell: bash
+        run: |
+          python -m venv .venv
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+      - run: >-
+          python -m pip install maturin==1.9.6 pytest==9.0.2
+          pytest-asyncio==1.3.0 ruff==0.14.9 mypy==1.19.1 pyright==1.1.407
+      - run: >-
+          cargo run --locked -p auths-proof-wasm
+          --example generate-node-vectors -- target/binding-vectors
+      - run: maturin develop --manifest-path bindings/python/Cargo.toml
+      - run: python -m pip install --no-deps -e bindings/python-adapters/sqlite
+      - run: pytest -q bindings/python/tests
+      - run: pytest -q bindings/python-adapters/sqlite/tests
+      - run: >-
+          ruff check bindings/python/python bindings/python/tests
+          bindings/python/external bindings/python/typecheck
+          bindings/python-adapters/sqlite
+      - run: >-
+          python -m mypy --strict --warn-unused-ignores
+          bindings/python-adapters/sqlite/python/auths_sqlite
+      - run: >-
+          python -m pyright --pythonpath "$(command -v python)"
+          -p bindings/python-adapters/sqlite/pyrightconfig.json
+      - run: python bindings/python/tools/check_public_api.py
+      - run: python bindings/python/tools/check_contract.py
+      - run: python bindings/python/tools/check_doc_snippets.py
+
+  consumer-contract:
+    name: build external-consumer contract
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-rust-cache
+        with:
+          toolchain: 1.97.1
+      - run: >-
+          cargo run --locked -p auths-proof-wasm
+          --example generate-node-vectors -- target/binding-vectors
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: python-sdk-consumer-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            target/binding-vectors/
+            bindings/customer-journey-matrix-v1.json
+            bindings/python/api/public-api.txt
+            bindings/python/adapter-contracts.json
+            bindings/python/external/full_workflow_consumer.py
+            bindings/python/examples/identity_quickstart.py
+            bindings/python/identity-conformance-v1.json
+            bindings/python/native-abi-v2.json
+            bindings/python/performance-baseline.json
+            bindings/python/pyrightconfig.json
+            bindings/python/python/auths/
+            bindings/python/tools/check_public_api.py
+            bindings/python/tools/check_contract.py
+            bindings/python/tools/check_doc_snippets.py
+            bindings/python/tools/check_performance.py
+            bindings/python/tools/check_wheel.py
+            bindings/python/sdk-capability.json
+            bindings/python/sdk-runtime-contract.json
+            bindings/python/typecheck/*.py
+            bindings/python/typecheck/installed-pyrightconfig.json
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 9
+
+  wheel-build:
+    name: build abi3 wheel (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-rust-cache
+        with:
+          toolchain: 1.97.1
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.9"
+      - run: python -m pip install maturin==1.9.6
+      - run: >-
+          maturin build --release --locked
+          --manifest-path bindings/python/Cargo.toml
+          --out target/python-release-wheels
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: python-wheel-${{ matrix.os }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: target/python-release-wheels/*.whl
+          if-no-files-found: error
+          retention-days: 1
+          compression-level: 0
+
+  installed-workflow:
+    name: installed CPython ${{ matrix.python }} (${{ matrix.os }})
+    needs: [consumer-contract, wheel-build]
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: ${{ matrix.python }}
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: python-wheel-${{ matrix.os }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: wheelhouse
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: python-sdk-consumer-${{ github.run_id }}-${{ github.run_attempt }}
+          path: consumer
+      - name: Assert a source-free consumer boundary
+        shell: bash
+        run: |
+          if find consumer -type f \( \
+            -name '*.rs' -o \
+            -name 'Cargo.toml' -o \
+            -name 'Cargo.lock' -o \
+            -name 'rust-toolchain*' \
+          \) -print -quit | grep -q .; then
+            echo "::error::External wheel workflow received Rust build inputs."
+            exit 1
+          fi
+      - name: Install only the built wheel
+        shell: bash
+        run: python -m pip install wheelhouse/*.whl
+      - name: Inspect exact wheel contents
+        shell: bash
+        run: python consumer/bindings/python/tools/check_wheel.py wheelhouse/*.whl
+      - name: Execute the external Full Workflow consumer
+        shell: bash
+        working-directory: ${{ runner.temp }}
+        run: >-
+          python "${{ github.workspace }}/consumer/bindings/python/external/full_workflow_consumer.py"
+          "${{ github.workspace }}/consumer/target/binding-vectors"
+      - name: Execute the installed identity quickstart
+        shell: bash
+        working-directory: ${{ runner.temp }}
+        run: >-
+          python "${{ github.workspace }}/consumer/bindings/python/examples/identity_quickstart.py"
+      - name: Check exact package/native contracts
+        shell: bash
+        run: python consumer/bindings/python/tools/check_contract.py
+      - name: Check installed-wheel performance contract
+        shell: bash
+        run: >-
+          python consumer/bindings/python/tools/check_performance.py
+          consumer/target/binding-vectors wheelhouse/*.whl
+
+  typing-and-api:
+    name: installed typing and API contract
+    needs: [consumer-contract, wheel-build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.9"
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: python-wheel-ubuntu-latest-${{ github.run_id }}-${{ github.run_attempt }}
+          path: wheelhouse
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: python-sdk-consumer-${{ github.run_id }}-${{ github.run_attempt }}
+          path: consumer
+      - name: Install the wheel and pinned type checkers
+        shell: bash
+        run: >-
+          python -m pip install wheelhouse/*.whl
+          mypy==1.19.1 pyright==1.1.407
+      - name: Check strict mypy source contract
+        run: >-
+          python -m mypy --strict --warn-unused-ignores
+          consumer/bindings/python/python/auths
+      - name: Check installed mypy consumer narrowing and negative boundaries
+        run: >-
+          python -m mypy --strict --warn-unused-ignores
+          consumer/bindings/python/typecheck/mcp_consumer.py
+          consumer/bindings/python/typecheck/elite_consumer.py
+          consumer/bindings/python/typecheck/workflow_consumer.py
+          consumer/bindings/python/typecheck/mypy_negative.py
+      - name: Check strict Pyright source contract
+        run: >-
+          python -m pyright --pythonpath "$(command -v python)"
+          -p consumer/bindings/python/pyrightconfig.json
+      - name: Check installed Pyright consumer narrowing and negative boundaries
+        run: >-
+          python -m pyright --pythonpath "$(command -v python)"
+          -p consumer/bindings/python/typecheck/installed-pyrightconfig.json
+      - name: Check the installed public API snapshot
+        run: python consumer/bindings/python/tools/check_public_api.py

.pre-commit-config.yaml

@@ -0,0 +1,20 @@
+minimum_pre_commit_version: "3.0.0"
+
+repos:
+  - repo: local
+    hooks:
+      - id: python-native-clippy-fix
+        name: Apply Python native binding Clippy fixes
+        entry: cargo clippy --fix --package auths-proof-python --all-targets --all-features --allow-dirty --allow-staged
+        language: system
+        files: ^bindings/python/(Cargo\.toml|src/.*\.rs)$
+        pass_filenames: false
+        require_serial: true
+
+      - id: rust-format
+        name: Apply Rust formatting
+        entry: cargo fmt --all
+        language: system
+        files: \.rs$
+        pass_filenames: false
+        require_serial: true

architecture/dependency-graph.dot

@@ -389,7 +389,25 @@ digraph auths_architecture {
   "auths-proof-offline-example" -> "auths-raw-key" [label="normal"];
   "auths-proof-offline-example" -> "auths-registries" [label="normal"];
   "auths-proof-offline-example" -> "auths-signature" [label="normal"];
-  "auths-proof-python" -> "auths-proof-wasm" [label="normal"];
+  "auths-proof-python" -> "auths-author" [label="normal"];
+  "auths-proof-python" -> "auths-codec" [label="normal"];
+  "auths-proof-python" -> "auths-custody" [label="normal"];
+  "auths-proof-python" -> "auths-did-keri" [label="normal"];
+  "auths-proof-python" -> "auths-did-key" [label="normal"];
+  "auths-proof-python" -> "auths-identity" [label="normal"];
+  "auths-proof-python" -> "auths-identity-raw-key" [label="normal"];
+  "auths-proof-python" -> "auths-lifecycle" [label="normal"];
+  "auths-proof-python" -> "auths-model" [label="normal"];
+  "auths-proof-python" -> "auths-ports" [label="normal"];
+  "auths-proof-python" -> "auths-profile-api" [label="normal"];
+  "auths-proof-python" -> "auths-profile-domains" [label="normal"];
+  "auths-proof-python" -> "auths-profile-mcp" [label="normal"];
+  "auths-proof-python" -> "auths-raw-key" [label="normal"];
+  "auths-proof-python" -> "auths-registries" [label="normal"];
+  "auths-proof-python" -> "auths-sdk" [label="normal"];
+  "auths-proof-python" -> "auths-signature" [label="normal"];
+  "auths-proof-python" -> "auths-signature-ed25519" [label="normal"];
+  "auths-proof-python" -> "auths-verifier" [label="normal"];
   "auths-proof-wasm" -> "auths-author" [label="normal"];
   "auths-proof-wasm" -> "auths-codec" [label="normal"];
   "auths-proof-wasm" -> "auths-did-keri" [label="normal"];