pyproject.toml

[build-system]
requires = []
build-backend = "build_backend"
backend-path = ["."]

[project]
name = "kry-attest"   # PyPI distribution name ("kry" is an unrelated PyPI package); import name stays `kry`
version = "0.1.2"
description = "KRY — proof-of-efficiency compute credit (earn by avoiding inference cost, spend on routing permission)"
keywords = [
    "llm", "llmops", "llm-cost-optimization", "inference-cost", "model-routing",
    "finops", "cost-optimization", "proof-of-efficiency", "verifiable-compute",
    "attestation", "tee", "tlsnotary", "zero-dependency",
]
license = {text = "Apache-2.0"}
readme = "README.md"
requires-python = ">=3.11"
dependencies = []   # zero-dependency, pure stdlib

# "3 - Alpha" tracks the 0.1.x version and the README's own `readiness: research_grade`; do not
# promote it ahead of either. The Python entries mirror `requires-python`, and the License
# classifier pairs with the free-text `License:` field above — swapping that field for a PEP 639
# `License-Expression` would make PyPI reject this classifier.
classifiers = [
    "Development Status :: 3 - Alpha",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: Apache Software License",
    "Operating System :: OS Independent",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3 :: Only",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Topic :: Software Development :: Libraries :: Python Modules",
    "Topic :: System :: Monitoring",
    "Typing :: Typed",
]

[project.urls]
Homepage = "https://github.com/thequantumfalcon/kry"
Repository = "https://github.com/thequantumfalcon/kry"
Documentation = "https://github.com/thequantumfalcon/kry/blob/main/SPEC.md"
Changelog = "https://github.com/thequantumfalcon/kry/blob/main/CHANGELOG.md"
Issues = "https://github.com/thequantumfalcon/kry/issues"

# The core token is stdlib-only. The `tee` extra adds the ONE thing you must never
# hand-roll — audited public-key crypto — used solely by scripts/kry_tee_verify.py to
# verify an AWS Nitro attestation's ECDSA-P384 signature + X.509 chain (the tee_attested
# tier). Without it, tee verification fails closed; the rest of KRY is unaffected.
[project.optional-dependencies]
dev = ["pytest==9.1.1", "ruff==0.16.1"]
tee = ["cryptography>=49.0.0"]
pqc = ["liboqs-python>=0.15.0"]

[tool.pytest.ini_options]
pythonpath = ["src"]

[tool.ruff.lint]
# Pinned EXPLICITLY rather than inherited from ruff's default `select`. Ruff 0.16 widened that
# default from 59 to 413 rules, which silently turned a clean tree into 703 findings on a pin
# bump. A lint gate whose meaning moves with the linter version is a reproducibility bug in a
# repo that sells reproducibility — so the contract is written down here. This set IS ruff's
# pre-0.16 default: the bug-catching F-codes plus the E-codes that survive a formatter.
# Widening it is a deliberate, reviewable change, not a side effect of dependabot.
select = ["E4", "E7", "E9", "F"]

[tool.ruff.lint.per-file-ignores]
# The core library (src/) is held to the full rule set selected above and stays clean.
# The research/proof scripts and example shims are deliberately written in a compact
# one-liner idiom (grouped imports, semicolon-joined statements, inline lambdas in
# __main__ self-test mocks). Relax ONLY those style codes there — the bug-catching
# F-codes and the readability rule E741 stay enforced everywhere.
"scripts/*" = ["E401", "E701", "E702"]
"examples/*" = ["E731"]