[FEATURE] Feature · Python SDK (P2)

[contexa73]

Feature · Python SDK (P2)

Labels: enhancement, help-wanted
Assignee: @contexa73
Type: Feature
Parent: #1 (Roadmap 2027) · Phase 2 — starts after Node.js v1.0 or hiring

Position in the roadmap

Python is the second runtime expansion after Node.js (#5). The Java reference took ~12 months solo, so Python is realistically targeted at 2028 H1 (single-developer baseline), or earlier if hiring closes before Node.js ship.

2027   → Node.js (P1, current focus)
2028 H1 → Python SDK (this issue)
2028 H2 → Go Runtime Adapter (#04)

Goal

Bring the Post-Authentication Runtime Control Plane to the Python ecosystem (~12 M developers, dominant in data, ML, and FastAPI-based services).

Phase 1 scope (the first ship)

Surface	Status	Notes
@protectable decorator	TODO	Method-level protection mirroring Java's @Protectable
FastAPI middleware	TODO	Async-first, dependency injection — the MVP target
Django middleware	TODO	MIDDLEWARE registration
Flask before_request handler	TODO	Sync model
Synchronous decision client	TODO	HTTP/2 to the Contexa decision endpoint
OAuth2 / JWT bridge	TODO	Token introspection compatible with mcp-auth-server
Evidence forwarding	TODO	8-section sealed package emit

Phase 1 out of scope (deferred to Phase 2 within Python track)

• gRPC interceptor
• Async streaming evidence
• Local mock decision server
• Pydantic v1 backward compatibility (v2 only)

Acceptance criteria

• All 5 actions reach the framework correctly
• HTTP status codes match the Java contract (200 / 401 / 403 / 423 / 503)
• OAuth2 client credentials flow integrates with mcp-auth-server
• Sealed evidence SHA-256 verification passes round-trip
• PyPI publication under the package name contexa (TBD)
• Python 3.10+ supported
• Type hints complete; passes mypy --strict

How to contribute

Python contributions are welcome now even though the core focus is Node.js. Early Python prototyping helps validate the cross-runtime contract design before P2 starts.

Reply with your stack (FastAPI / Django / Flask / async / sync) and your top integration concern.

Reference

• Java reference: spring-boot-starter-contexa
• Decision contract: 5 actions defined in ZeroTrustAction enum
• Architecture: https://docs.ctxa.ai/docs/reference/architecture/overview.html