pyproject.toml

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[project]
name = "sentinel-kernel"
version = "3.4.3"
description = "Evidence infrastructure for the regulated AI era. Trace every decision, attest it cryptographically, audit the record, comply with EU AI Act Art. 12/13/14/17 via a signed evidence pack. Air-gapped, offline-first, Apache 2.0."
readme = "README.md"
license = { file = "LICENSE" }
requires-python = ">=3.11"
keywords = [
    "evidence-infrastructure",
    "trace-attest-audit-comply",
    "provability",
    "regulated-ai",
    "eu-ai-act",
    "decision-tracing",
    "audit-trail",
    "autonomous-systems",
    "ai-governance",
    "compliance",
    "air-gapped",
    "bsi",
    "llm",
    "machine-learning",
    "rule-engine",
    "robotics",
]
classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Developers",
    "Intended Audience :: Information Technology",
    "Intended Audience :: Legal Industry",
    "License :: OSI Approved :: Apache Software License",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Topic :: Scientific/Engineering :: Artificial Intelligence",
    "Topic :: Security",
    "Topic :: Software Development :: Libraries :: Python Modules",
]

# Core dependencies.
#
# `cryptography` is required so that default `Sentinel()` can sign
# every trace with Ed25519 out of the box — the canonical trust
# signal per CLAUDE.md. pyca/cryptography is BSD/Apache, community-
# maintained, pure-crypto (no network at runtime), and works air-
# gapped via wheel install. Moved from optional `[ed25519]` extra in
# v3.4.2 after v3.4.1 shipped the code path but not the dependency.
dependencies = [
    "cryptography>=42.0",
]

[project.optional-dependencies]
# LangChain callback handler integration
langchain = ["langchain-core>=0.1"]

# Haystack integration (deepset GmbH, Berlin — EU-sovereign)
haystack = ["haystack-ai>=2.0"]

# Anthropic integration
anthropic = ["anthropic>=0.25"]

# OpenAI integration
openai = ["openai>=1.0"]

# OPA-based policy evaluation
opa = []  # Requires OPA binary: https://www.openpolicyagent.org/

# PostgreSQL storage backend
postgres = ["psycopg2-binary>=2.9"]

# OpenTelemetry export
otel = [
    "opentelemetry-sdk>=1.20",
    "opentelemetry-exporter-otlp-proto-grpc>=1.20",
]

# LangFuse enrichment
langfuse = ["langfuse>=2.0"]

# Prometheus textfile exporter (CNCF, neutral)
prometheus = ["prometheus-client>=0.19"]

# Jupyter notebook widget
jupyter = ["ipywidgets>=8.0", "IPython>=8.0"]

# FastAPI / Starlette middleware
fastapi = ["starlette>=0.30"]

# Django middleware
django = ["Django>=4.2"]

# CrewAI integration (US-owned library; runtime uses local LLM)
crewai = ["crewai>=0.1"]

# Microsoft AutoGen integration (US-owned; runtime uses local LLM)
autogen = ["pyautogen>=0.2"]

# Ed25519 default attestation signing.
#
# `cryptography` is now a core dependency (v3.4.2+) so this extra is
# retained only as a compatibility alias — `pip install
# sentinel-kernel[ed25519]` keeps working but adds nothing new.
ed25519 = ["cryptography>=42.0"]

# PAdES PDF signing (pyhanko — MIT, community-maintained, works offline).
# Makes the "signed PDF evidence pack" claim truthful in the Adobe /
# Foxit verification sense, not just hash-manifest sense.
pades = ["pyhanko>=0.22", "cryptography>=42.0"]

# Quantum-safe signing (ML-DSA-65 via liboqs)
pqc = ["oqs-python>=0.8"]

# PDF evidence pack (reportlab — BSD-3-Clause, UK-based, pure Python)
# Includes Ed25519 by default since evidence packs are the primary
# artefact that benefits from cryptographic attestation. Includes
# pyhanko for PAdES signing of the generated PDFs.
pdf = ["reportlab>=4.0", "cryptography>=42.0", "pyhanko>=0.22"]

# Development — pulls every optional extra so `pytest --cov` hits the
# happy-path branches of all optional-dep guards.
dev = [
    "pytest>=8.0",
    "pytest-asyncio>=0.23",
    "pytest-cov>=4.0",
    "pytest-xdist>=3.0",
    "ruff>=0.3",
    "mypy>=1.9",
    "hatch>=1.9",
    "rich>=13.0",
    "prometheus-client>=0.19",
    "langchain-core>=0.1",
    "opentelemetry-sdk>=1.20",
    "opentelemetry-exporter-otlp-proto-grpc>=1.20",
    "langfuse>=2.0",
    "psycopg2-binary>=2.9",
    "ipywidgets>=8.0",
    "starlette>=0.30",
    "Django>=4.2",
    "httpx>=0.27",
    "reportlab>=4.0",
    "cryptography>=42.0",
    "pyhanko>=0.22",
]

[project.scripts]
sentinel = "sentinel.cli:main"

[project.urls]
Homepage = "https://github.com/sebastianweiss83/sentinel-kernel"
Documentation = "https://github.com/sebastianweiss83/sentinel-kernel/tree/main/docs"
Repository = "https://github.com/sebastianweiss83/sentinel-kernel"
Issues = "https://github.com/sebastianweiss83/sentinel-kernel/issues"
Changelog = "https://github.com/sebastianweiss83/sentinel-kernel/blob/main/CHANGELOG.md"

[tool.hatch.build.targets.wheel]
packages = ["sentinel"]

[tool.hatch.envs.default]
dependencies = [
    "sentinel-kernel[dev,anthropic,openai,langchain,otel]",
]

[tool.ruff]
line-length = 100
target-version = "py311"
exclude = [".venv", "dist", "build", ".ruff_cache", ".pytest_cache"]

[tool.ruff.lint]
select = ["E", "F", "I", "UP", "B", "SIM"]
ignore = ["E501"]

[tool.mypy]
python_version = "3.11"
strict = true
ignore_missing_imports = true

[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["tests"]
# -n auto parallelises across cores; pytest-xdist is a dev dep so CI
# and local devs both benefit. Wall-clock on a 10-core Mac: ~6s → ~3s.
addopts = "-n auto --cov=sentinel --cov-report=term-missing --cov-branch"

[tool.coverage.run]
source = ["sentinel"]
omit = [
    "tests/*",
    "examples/*",
    # Optional-framework integrations — tested only when framework is installed.
    # CI installs all deps and covers these; local runs without .[dev] skip them.
    "sentinel/integrations/django.py",
    "sentinel/integrations/fastapi.py",
    "sentinel/integrations/jupyter.py",
    "sentinel/integrations/prometheus.py",
]