docket/pyproject.toml at main · docket-dev-org/docket · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
# The distribution name is `docket-ai` because PyPI administratively prohibits the bare name
# `docket`: it answers 404 on the JSON API, and `twine upload` still refuses it with
# "The name 'docket' isn't allowed". PyPI keeps that list to prevent dependency-confusion
# attacks, and the only way off it is a PEP 541 request reviewed by the PyPI admins.
# The *import* name, the console script and the command a user types are all still `docket`;
# only the thing `pip install` names is different. See README.md and PUBLISHING.md.
name = "docket-ai"
version = "0.2.5"
description = "Every AI agent run gets a docket number: hard spending caps and a tamper-evident receipt anyone can verify offline."
readme = "README.md"
requires-python = ">=3.11"
license = "Apache-2.0"
license-files = ["LICENSE"]
authors = [{ name = "The Docket contributors" }]
keywords = [
  "ai-agents",
  "llm",
  "observability",
  "audit",
  "provenance",
  "cost-control",
  "guardrails",
  "transparency-log",
  "tamper-evident",
  "cli",
]
classifiers = [
  "Development Status :: 4 - Beta",
  "Environment :: Console",
  "Intended Audience :: Developers",
  "Intended Audience :: Financial and Insurance Industry",
  "Intended Audience :: Information Technology",
  "License :: OSI Approved :: Apache Software License",
  "Operating System :: OS Independent",
  "Programming Language :: Python :: 3",
  "Programming Language :: Python :: 3.11",
  "Programming Language :: Python :: 3.12",
  "Programming Language :: Python :: 3.13",
  "Topic :: Software Development :: Quality Assurance",
  "Topic :: System :: Logging",
  "Topic :: System :: Monitoring",
  "Typing :: Typed",
]
dependencies = []

[project.optional-dependencies]
# Nothing here is needed to *use* docket: `dependencies` above is empty and stays empty. These are
# the three ways the project is developed, and each one is optional on its own terms.
sign = ["cryptography>=42"]
# tools/deploy_check.py reads the manifests and the CI workflows with PyYAML. Without it the checker
# exits 2 with a reason (never a silent pass) and its 40 tests skip with the same reason.
deploy = ["pyyaml>=6"]
dev = [
  "pytest>=8",
  "pytest-cov>=5",
  # Pinned, not floored, and to the same version `.github/workflows/ci.yml` installs. Ruff's
  # formatter is not stable between releases: 0.17 rewrites 24 files in this tree that 0.6.9 leaves
  # alone (it joins implicitly concatenated string literals), so a floored requirement would give a
  # contributor a `make lint` that fails on files CI calls formatted — and a `make fmt` that
  # rewrites twenty-four of them. Moving the pin is a deliberate change: reformat, then bump both
  # places together.
  "ruff==0.17.0",
  "mkdocs-material>=9.5",
  "pyyaml>=6",
]

[project.scripts]
docket = "docket.cli:main"

[project.urls]
Homepage = "https://github.com/docket-dev-org/docket"
Documentation = "https://docket-dev-org.github.io/docket/"
Specification = "https://github.com/docket-dev-org/docket/blob/main/spec/docket-receipt-1.md"
Issues = "https://github.com/docket-dev-org/docket/issues"
Changelog = "https://github.com/docket-dev-org/docket/blob/main/CHANGELOG.md"
Sponsor = "https://github.com/sponsors/docket-dev-org"

[tool.hatch.build.targets.wheel]
packages = ["src/docket"]

# The independent verifier and the conformance corpus ship inside the wheel, so the claim
# "the format is not this tool" survives installation. A recipient who installs `docket` can
# run `docket verify --impl node` and get a verdict from a program that shares no code with
# this one; without this they would have to clone the repository to make that point, which is
# exactly the friction the claim cannot afford.
[tool.hatch.build.targets.wheel.force-include]
"verify-js/verify.mjs" = "docket/_vendor/verify.mjs"
"spec/vectors" = "docket/_vendor/vectors"

[tool.hatch.build.targets.sdist]
# `tools/` is in the sdist because `docs/testing.md` (also shipped) documents the mutation
# sweep and the fuzz harness by path: a source distribution whose own docs point at files it
# does not contain is a small lie, and the tools are the evidence for two of its claims.
include = ["src", "spec", "tests", "docs", "examples", "verify-js", "tools", "README.md", "LICENSE", "CHANGELOG.md"]

[tool.pytest.ini_options]
testpaths = ["tests"]
addopts = "-q --strict-markers"
filterwarnings = ["error::DeprecationWarning"]

[tool.bandit]
# B310 flags every `urllib.request.urlopen` whose URL is not a literal, because an unchecked
# URL is how a program is talked into fetching file:// or a cloud metadata endpoint. Every
# urlopen in this repository passes its URL through `util.http_url` (scheme must be http/https)
# or `util.local_http_url` (that, plus the host must be loopback), applied at the call site —
# which is the check B310 wants and cannot see. The alternative, `# nosec` on each call, hides
# the reasoning; this records it in one place and keeps the rule live for new call sites.
skips = [
  "B310",  # see above
  # B105 is "possible hardcoded password". The matches are the literal status word "PASS"
  # (and its ANSI-coloured form) in the check renderers for `docket verify`, `docket selftest`
  # and the game-day post-mortem. There is no credential here; the words are the output format.
  "B105",
  # B311 is "pseudo-random generators are not suitable for security". The matches are the
  # *seeded* `random.Random` used for reproducible demos, fault injection, fuzzing and id
  # generation. Determinism is the requirement; nothing here is a secret, a token or a key.
  "B311",
  # B404/B603/B607 are about `subprocess`. Every call in this repository passes an argv list
  # (no shell, so no shell-injection surface) and runs either the *user's own command* —
  # which is what `docket run -- <command>` and `docket chaos -- <command>` are for — or a
  # fixed program (`sys.executable -c <constant probe>`, `ps`, `mkdocs`). B607 also flags the
  # PATH-resolved `ps` and `mkdocs`, both of which should be resolved from PATH.
  "B404",
  "B603",
  "B607",
]

[tool.ruff]
line-length = 120
target-version = "py311"

[tool.ruff.lint]
select = ["E", "F", "I", "UP", "B", "SIM", "C4"]
ignore = ["E501", "SIM108"]

[tool.coverage.run]
source = ["src/docket"]