grant/keysat-root
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mark SDK expiry parity fully shipped: Python 0.3.0 on PyPI, Go v0.2.0

Browse Source
This commit is contained in:
Keysat
2026-06-19 15:35:03 -05:00
parent 82a87276c9
commit 0a6018598f
2 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+6 -7
View File
@@ -120,13 +120,12 @@ Operator-specific memories at `~/.claude/projects/-Users-macpro-Projects-keysat/
(DB narrows, never widens; `clamp_to_signed_ceiling`). (2) An expired/tampered self-license lingered until
restart; now re-verified each refresh and demoted like revoked/suspended. Crypto + offline master key
confirmed sound (no signature-forgery path). Commit messages kept **generic** per operator request.
- **SDK offline-expiry parity resolved + Go published.** Python `Verifier.verify_with_time` + Go
- **SDK offline-expiry parity resolved + published (all four).** Python `Verifier.verify_with_time` + Go
`ParseAndVerifyAt`/`ErrExpired` now reject expired keys offline, matching Rust/TS (reviewer-approved). **Go
published** as tag `v0.2.0` (go-proxy). **Python `0.3.0` is ready in-repo but NOT on PyPI** — upload needs the
operator's token (no twine/creds in-session). Both public sites redeployed (landing + docs, 200).
- **Next (priority):** 1) operator uploads Python SDK `0.3.0` to PyPI (`python -m build` + `twine upload`, your
token). 2) email Start9 re: license + 0.4.x build flow (registry submission). 3) eval P2 hardening (XFF
rate-limit, dep bumps, admin/public port split). 4) split `audit:read` scope. (Nice-to-have: document the new
SDK verify methods in keysat-docs.)
published** (tag `v0.2.0`, go-proxy) and **Python published** (`keysat-licensing-client 0.3.0` on PyPI). Both
public sites redeployed (landing + docs, 200).
- **Next (priority):** 1) email Start9 re: license + 0.4.x build flow (gates registry submission). 2) eval P2
hardening (XFF rate-limit, dep bumps, admin/public port split). 3) split `audit:read` scope. (Nice-to-have:
document the new SDK verify methods in keysat-docs.)
- **Tests/build:** daemon `cargo test` green (~125 / 8 suites, incl. 5 new self-license clamp tests); wrapper
`tsc` clean; Python SDK pytest 14 green + Go `go test` green (both incl. new expiry tests). No CI.
ROADMAP.md
+1 -2
View File
@@ -90,5 +90,4 @@ Longer-term backlog. Near-term state lives in `AGENTS.md` → Current state.
## Validation
- Re-test `KEYSAT_INTEGRATION.md` against a fresh downstream app to confirm a clean one-shot SDK integration.
- **Add an automated regression test for multi-profile webhook routing** (adjudicated 2026-06-17 → DO, low blast radius — replaces the parked "manual Zaprite sandbox pass"). The routing is a deterministic provider-id→profile primary-key lookup with an anti-forgery re-fetch backstop, so the manual sandbox ceremony isn't worth it — but the path-keyed route (`/v1/{provider}/webhook/:provider_id` → `handle_for_provider`) currently has zero automated coverage on the money path. Plan: in `tests/api.rs`, reuse the two-provider fixture (~:3958), POST a Settled webhook to `/v1/zaprite/webhook/{provider-A-id}`, assert only profile A settles (B untouched; an unknown path-id 404s). Existing mock seam, no external account, runs in `cargo test`. Effort S.
- **Upload the Python SDK `0.3.0` to PyPI** (carries the offline-expiry `verify_with_time`). The Go SDK already shipped 2026-06-19 as tag `v0.2.0` (go-proxy serves it from GitHub); Python is ready in-repo but not on PyPI — `python -m build` + `twine upload` with the operator's PyPI token (no creds in-session). `keysat-licensing-client` is not yet on PyPI, so `0.3.0` is the first upload. Additive, non-breaking. (Online `/v1/validate` already enforces expiry for every SDK, so unupgraded offline integrators are the only exposure.)
- **Add an automated regression test for multi-profile webhook routing** (adjudicated 2026-06-17 → DO, low blast radius — replaces the parked "manual Zaprite sandbox pass"). The routing is a deterministic provider-id→profile primary-key lookup with an anti-forgery re-fetch backstop, so the manual sandbox ceremony isn't worth it — but the path-keyed route (`/v1/{provider}/webhook/:provider_id` → `handle_for_provider`) currently has zero automated coverage on the money path. Plan: in `tests/api.rs`, reuse the two-provider fixture (~:3958), POST a Settled webhook to `/v1/zaprite/webhook/{provider-A-id}`, assert only profile A settles (B untouched; an unknown path-id 404s). Existing mock seam, no external account, runs in `cargo test`. Effort S.