Kjell Tore Guttormsen
805a2d50d9
v0.5.0a1 shipped the one actor value the spec owner had already excluded. Caught before any pilot was notified, so it costs a tag, not a migration. Commons decided <fast id> = process:okf-ingest on 2026-07-31, on this repo's own proposal, superseding option (d) (process:llm-ingestion-okf) chosen here on 07-27. The exclusion is ingest-spec.md:7-8, frozen on the spec being framework-neutral: normalising OUR repo name into the normative id would force every other conformant implementation to write it into its own output. Verified against three independent sources before touching anything — commons' coord message 20260731T154140Z, their plan :215-216/:244, and their STATE :37. Why this had to land before the pilot notifications rather than after: actor is both the stamp written and the value owned back (OwnershipPolicy), and recognition is one-way. A pilot that had run Test A against the excluded id would hold bundles this library stops recognising the moment the id is corrected — collision_unstamped on their OWN files. That is the A-E5 failure mode, and we would have inflicted it. Worse, it would not have shown up as a failure: the plan's A-E3 expectation (:854) named the same excluded value as the code, so Test A would have PASSED and confirmed the error. Expectation and implementation agreeing is not evidence when both predate the decision. Nothing in the wild carried the old value: OKF_V0_2 did not exist at v0.4.0, so the profile has never been released. v0.5.0a1 is abandoned, not moved — a tag already on a public remote does not get force-pushed, and the history should say plainly that a1 was wrong. A-E3 now records both corrections with dates. The V1 paragraph at :1169 is superseded in place rather than rewritten: its reasoning still holds, only its outcome moved. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CVTup4v7tW9QiVyBENk2LV
63 lines
2.6 KiB
TOML
63 lines
2.6 KiB
TOML
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[project]
|
|
name = "llm-ingestion-okf"
|
|
version = "0.5.0a2"
|
|
description = "Shared OKF (Open Knowledge Format) ingestion library: spec-based connectors, bundle inbox, and external-bundle import, with security delegated to llm-ingestion-guard."
|
|
readme = "README.md"
|
|
license = "MIT"
|
|
requires-python = ">=3.10"
|
|
authors = [{ name = "Kjell Tore Guttormsen" }]
|
|
classifiers = [
|
|
"Development Status :: 2 - Pre-Alpha",
|
|
"Intended Audience :: Developers",
|
|
"Operating System :: OS Independent",
|
|
"Programming Language :: Python :: 3",
|
|
"Programming Language :: Python :: 3.10",
|
|
]
|
|
# Exactly one runtime dependency, ever: the security boundary. Everything
|
|
# else is stdlib. The version range is the real pin — it resolves normally
|
|
# against a package index, and is satisfied today by the git+https tag
|
|
# install documented in the README (a direct reference is an install-time
|
|
# channel, not a dependency declaration).
|
|
dependencies = ["llm-ingestion-guard>=0.2,<0.3"]
|
|
|
|
[project.optional-dependencies]
|
|
# Reserved for binary file-type extraction parsers (pdf/docx/xlsx).
|
|
# Populated when Door B's binary extraction is implemented.
|
|
extract = []
|
|
|
|
[dependency-groups]
|
|
dev = ["pytest>=8", "mypy>=1.14", "ruff>=0.9"]
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["src/llm_ingestion_okf"]
|
|
|
|
[tool.ruff]
|
|
line-length = 100
|
|
target-version = "py310"
|
|
|
|
[tool.mypy]
|
|
strict = true
|
|
python_version = "3.10"
|
|
|
|
# llm-ingestion-guard ships no py.typed marker, so its symbols arrive as Any.
|
|
# The adapter coerces every value it carries across the seam to a concrete
|
|
# type, which is what keeps --strict meaningful on this side of it.
|
|
[[tool.mypy.overrides]]
|
|
module = ["llm_ingestion_guard", "llm_ingestion_guard.*"]
|
|
ignore_missing_imports = true
|
|
|
|
# Install CHANNEL for the guard, which is not on a package index yet. It is
|
|
# uv-specific, and it reaches further than a dev-only setting: measured
|
|
# 2026-07-25, a consumer installing this package from git WITH UV picks the
|
|
# guard up from this tag automatically, because uv reads this file when it
|
|
# builds from the source tree. pip does not read it — it resolves
|
|
# [project.dependencies] alone and fails with "No matching distribution found
|
|
# for llm-ingestion-guard" until the guard is installed from its own tag first
|
|
# (README). Either way the range above stays the pin: the built wheel carries
|
|
# `Requires-Dist: llm-ingestion-guard<0.3,>=0.2`, verified against the wheel.
|
|
[tool.uv.sources]
|
|
llm-ingestion-guard = { git = "https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git", tag = "v0.2.0" }
|