diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 497a93cf..90bc3040 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -66,7 +66,7 @@ jobs: - name: Install the qualified Python pair run: | uv venv .dev/docs-host-python - uv pip install --python .dev/docs-host-python/bin/python --only-binary=:all: --refresh morphir==0.1.0 morphir-python==0.1.0 + uv pip install --python .dev/docs-host-python/bin/python --only-binary=:all: --refresh morphir==0.1.1 morphir-python==0.1.2 - name: Run displayed recipe, offline bundle checks and MoonBit refusal probes run: .dev/docs-host-python/bin/python scripts/docs_hosts.py qualify - uses: actions/upload-artifact@v6 diff --git a/README.md b/README.md index f64c27c8..728fa171 100644 --- a/README.md +++ b/README.md @@ -25,15 +25,15 @@ The library and CLI are separate distributions: Install just the library and SDK: ```bash -pip install morphir==0.1.0 -# or: uv add morphir==0.1.0 +pip install morphir==0.1.1 +# or: uv add morphir==0.1.1 ``` Install the CLI, which also installs the library: ```bash -python -m pip install --only-binary=:all: morphir-python==0.1.0 -# or: uv add morphir-python==0.1.0 +python -m pip install --only-binary=:all: morphir-python==0.1.2 +# or: uv add morphir-python==0.1.2 ``` For an isolated command-line installation, use the diff --git a/docs/compatibility.md b/docs/compatibility.md index 7ba2403b..b71b1713 100644 --- a/docs/compatibility.md +++ b/docs/compatibility.md @@ -5,8 +5,8 @@ as well as the version before copying an integration command. | Tool | Qualified identity | Python compiler route | IR and artifacts | | --- | --- | --- | --- | -| `morphir-python` | Python distribution 0.1.0, core 0.1.0, native 0.1.1 | In-process typed API and CLI | v3 Library by default; explicit draft v4; versioned JSON | -| `finos/morphir` | Rust product CLI 0.4.0-beta.10 | Python Extism bundle 0.4.2, MEP 0.1 | Explicit v3/v4 JSON; compile writes `morphir-ir.json` | +| `morphir-python` | Python distribution 0.1.2, core 0.1.1, native 0.1.2 | In-process typed API and CLI | v3 Library by default; explicit draft v4; versioned JSON | +| `finos/morphir` | Rust product CLI 0.4.0-beta.10 | Python WASM/process bundle 0.5.0, legacy MEP 0.1 at this host pin | Explicit v3/v4 JSON; compile writes `morphir-ir.json` | | MoonBit-based `morphir` | Source pin documented in the MoonBit guide | Current `core-wasm-process` and `native-process` adapters do not run the Python Extism guest | Portable MEP 0.2 draft, IR v4 model envelope; Ion default, explicit JSON tuple | ## Verify the provider diff --git a/docs/installation.md b/docs/installation.md index ca9b5ff4..0e7b6504 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -14,7 +14,7 @@ your project's `mise.toml`: [tools] python = "3.14" uv = "0.12.10" -"pypi:morphir-python" = { version = "0.1.0", uvx_args = "--no-build" } +"pypi:morphir-python" = { version = "0.1.2", uvx_args = "--no-build" } ``` @@ -44,7 +44,7 @@ pipx = "pypi:pipx" python = "3.14" uv = "0.12.10" pipx = { version = "1.18.4", python = "3.14", expose = ["pipx"] } -"pipx:morphir-python" = { version = "0.1.0", python = "3.14", uvx = false, pipx_args = "--pip-args='--only-binary=:all:'" } +"pipx:morphir-python" = { version = "0.1.2", python = "3.14", uvx = false, pipx_args = "--pip-args='--only-binary=:all:'" } ``` @@ -80,13 +80,13 @@ Choose a package according to what your application needs. | `morphir-python` | The CLI and `morphir_tools.python` compiler API | `morphir`, Typer and an exact compatible native compiler | | `morphir-python-native` | Compiler implementation dependency | Installed automatically by `morphir-python` | -The released quickstarts use `morphir-python==0.1.0`, `morphir==0.1.0` and -`morphir-python-native==0.1.1`. The core and CLI have independent versions. +The released quickstarts use `morphir-python==0.1.2`, `morphir==0.1.1` and +`morphir-python-native==0.1.2`. The core and CLI have independent versions. ```bash python3.14 -m venv .venv . .venv/bin/activate -python -m pip install --only-binary=:all: morphir==0.1.0 morphir-python==0.1.0 +python -m pip install --only-binary=:all: morphir==0.1.1 morphir-python==0.1.2 morphir-python --help ``` @@ -106,7 +106,7 @@ requires Rust 1.98 or later and is distinct from the wheel-only quickstart. ## Use only the library ```bash -python -m pip install morphir==0.1.0 +python -m pip install morphir==0.1.1 ``` The [IR and SDK examples](library.md) work without the native compiler. Installing diff --git a/docs/library.md b/docs/library.md index fe0d16f7..9cb0d523 100644 --- a/docs/library.md +++ b/docs/library.md @@ -1,6 +1,6 @@ # Work with IR and the SDK -**Released:** CPython 3.14 and `morphir==0.1.0`. These examples need neither the +**Released:** CPython 3.14 and `morphir==0.1.1`. These examples need neither the CLI nor the native compiler. Install only `morphir` as described in [installation](installation.md#use-only-the-library). diff --git a/docs/python-extension.md b/docs/python-extension.md index ebe0d635..a5635c4b 100644 --- a/docs/python-extension.md +++ b/docs/python-extension.md @@ -20,26 +20,24 @@ available there. | Language | `python` (`.py`) | | Target | `python` | | IR versions | `3`, `4` | -| Published 0.4.2 MEP version | `0.1` | -| Development 0.5.0 MEP versions | `0.2.0-draft.1`, `0.1` | +| Published 0.5.0 MEP versions | `0.2.0-draft.1`, `0.1` | | Multiple source documents | `multiDocument: true`, from `0.4.2` | -Extension `0.4.2` pairs with `morphir-python==0.1.0` and -`morphir-python-native==0.1.1`, qualified with `morphir==0.1.0`. -The native API reports compiler version `0.4.2`. -Use `0.4.2` or later with hosts that require an explicit multi-document claim; -`0.4.1` omits that claim. +Extension `0.5.0` pairs with `morphir-python==0.1.2` and +`morphir-python-native==0.1.2`, using published Rust SDK `0.4.0`. +The bridge API remains revision `1`; core `morphir==0.1.1` includes the updated +documentation metadata. -Development extension `0.5.0` pairs with `morphir-python==0.1.1` and -`morphir-python-native==0.1.2`, using published Rust SDK `0.4.0`. These Python -and extension versions are candidates, not published installation targets. -The bridge API remains revision `1`; the core `morphir` library remains `0.1.0`. +Historical extension `0.4.2` pairs with `morphir-python==0.1.0`, +`morphir-python-native==0.1.1` and `morphir==0.1.0`; its compiler version is +`0.4.2`. Use `0.4.2` or later with hosts that require an explicit multi-document +claim; `0.4.1` omits that claim. -## Model protocol in the development candidate +## Model protocol in release 0.5.0 Package, protocol, envelope, claims and IR versions identify different contracts: -| Contract | Candidate value | +| Contract | Value | | --- | --- | | Compiler / extension package | `0.5.0` | | Rust extension SDK dependency | exactly `0.4.0` from crates.io | @@ -70,10 +68,13 @@ handles requests only, so notification silence and exit describe the adapter and guest route, not notification delivery inside the WASM guest. The declaration is in [`rust/extension.toml`](https://github.com/finos/morphir-python/blob/main/rust/extension.toml). +The released host recipe below uses legacy MEP `0.1`. For new-draft protocol +checks, use the [source-pinned MCK](releasing.md#qualify-both-extension-runtimes) +recorded in the release evidence. ## Install the qualified release bundle -This recipe uses **finos/morphir 0.4.0-beta.10** and Python extension **0.4.2**. +This recipe uses **finos/morphir 0.4.0-beta.10** and Python extension **0.5.0**. Use the Rust product CLI, not the MoonBit executable of the same name. The [compatibility guide](compatibility.md) explains the difference. CPython is not needed to run the installed WASM guest. @@ -86,14 +87,14 @@ prints the absolute `MORPHIR_HOST` and `PYTHON_BUNDLE` paths. Pins live in and [rust/extension.toml](https://github.com/finos/morphir-python/blob/main/rust/extension.toml). Run the printed `--version` command and check it reports 0.4.0-beta.10. -For manual acquisition, download the 0.4.2 `.wasm`, `.wasm.sha256` and `.release.json` assets -from the [extension release](https://github.com/finos/morphir-python/releases/tag/extension/python/v0.4.2). +For manual acquisition, download the 0.5.0 `.wasm`, `.wasm.sha256` and `.release.json` assets +from the [extension release](https://github.com/finos/morphir-python/releases/tag/extension/python/v0.5.0). Verify the SHA-256 values in the pin file before using them, then rename the `.release.json` descriptor to `release.json` in the same bundle directory. The WASM digest is -`10acafa0f0282c5240e9620a5f2bb21629cc7580b9add528e7b77c7e54db22b5`. +`791d6cc60f442b1088b291e9aed4f2740a38b0f0cc920f5f7418735c2b88aeb6`. The descriptor digest is -`72770f73f05a72535fd8c86ad4629175019037441a758b827c1ba47cc9a52ebd`. +`a78df591623388a95f3f7f8f7465422cee3dd4f6d86a64224d2a02291d8a81b3`. The host release has platform-specific archives; use the declared target and hash rather than an unversioned executable from PATH. @@ -110,7 +111,7 @@ before compiling. It is the exact recipe run by documentation qualification. #!/usr/bin/env bash set -euo pipefail # MORPHIR_HOST is the verified finos/morphir 0.4.0-beta.10 executable. -# PYTHON_BUNDLE is the verified 0.4.2 bundle directory containing release.json. +# PYTHON_BUNDLE is the verified 0.5.0 bundle directory containing release.json. : "${MORPHIR_HOST:?Set the verified Rust-host executable path}" : "${PYTHON_BUNDLE:?Set the verified bundle directory}" "$MORPHIR_HOST" --version @@ -150,11 +151,11 @@ Use `python3 scripts/docs_hosts.py qualify` to repeat the displayed workflow and offline checks. Receipts record pins, file hashes, host identity, checker and input digest. Download failure never counts as a passing qualification. -## Choose a runtime in development +## Download and choose a runtime -Published bundles remain WASM. The process bundle is a development candidate -from the manual release-qualification workflow, not a published installation -channel yet. Its executable is a MEP guest for the finos/morphir host. The +Release `0.5.0` provides both WASM and process bundles on +[GitHub Releases](https://github.com/finos/morphir-python/releases/tag/extension/python/v0.5.0). +The process executable is a MEP guest for the finos/morphir host. The `morphir-python` CLI continues to use its pinned native Python wheel through the [mise/pipx installation](python-compiler.md); choosing an extension runtime does not configure that CLI. @@ -163,36 +164,50 @@ Use two separate canonical bundle directories and named local repositories. The WASM bundle contains its `.wasm`, checksum and `release.json`. The process bundle contains the raw executables, their checksums and its own `release.json`. The canonical repository writer refuses a bundle mixing both runtimes. -The process candidate includes Linux x86_64/ARM64, macOS x86_64/ARM64 and Windows +The process bundle includes Linux x86_64/ARM64, macOS x86_64/ARM64 and Windows x86_64. Installation chooses the matching platform and refuses an absent one. -The `process-release-candidate` workflow artifact also retains `process-assets/`: -five raw executables and checksums, a separately named process descriptor, -`morphir-python-extension-VERSION.tar.gz`, a source-bound packaging receipt and -`SHA256SUMS`. The archive contains the complete canonical process bundle, with -`release.json` and executable permissions. Its payloads match the raw assets. -These are development candidates. GitHub release publication requires matching -independent conformance evidence and the approved release tag. +The release includes five raw executables and checksums, a separately named +process descriptor, `morphir-python-extension-VERSION.tar.gz`, source-bound +qualification receipts and `SHA256SUMS`. The archive contains the complete +canonical process bundle, with `release.json` and executable permissions. Its +payloads match the raw assets. Raw MCK reports, their saved rechecks, runtime +switching evidence and host timing samples are retained alongside the bundles. -After downloading the candidate, verify and extract it in Bash: +With the [GitHub CLI](https://cli.github.com/) installed, run this in a fresh +directory using Bash, `shasum` and `tar`. Download all assets before checking +`SHA256SUMS`; it covers the qualification evidence as well as the bundles. + ```bash -cd process-assets -shasum -a 256 -c SHA256SUMS -mkdir ../python-process -tar -xzf morphir-python-extension-*.tar.gz -C ../python-process -export PROCESS_BUNDLE="$(cd ../python-process && pwd)" +#!/usr/bin/env bash +set -euo pipefail +VERSION=0.5.0 +gh release download "extension/python/v$VERSION" \ + --repo finos/morphir-python --dir python-extension-assets +(cd python-extension-assets && shasum -a 256 -c SHA256SUMS) +mkdir python-wasm python-process +cp "python-extension-assets/morphir-python-binding-$VERSION.wasm" \ + "python-extension-assets/morphir-python-binding-$VERSION.wasm.sha256" python-wasm/ +cp "python-extension-assets/morphir-python-binding-$VERSION.release.json" \ + python-wasm/release.json +tar -xzf "python-extension-assets/morphir-python-extension-$VERSION.tar.gz" \ + -C python-process +export WASM_BUNDLE="$(cd python-wasm && pwd)" +export PROCESS_BUNDLE="$(cd python-process && pwd)" ``` + -The qualification workflow runs the installation and runtime-switching checks -against this extracted archive. Its original WASM bundle remains separate. +The qualification workflow runs installation and runtime-switching checks +against this extracted archive. Both directories above contain version `0.5.0`. +Historical `0.4.2` bundles remain available from their original release. Set `WASM_BUNDLE` and `PROCESS_BUNDLE` to those unmodified directories. With `MORPHIR_HOST` pointing at the pinned host described above, an isolated trial is: ```bash export MORPHIR_HOME="$(mktemp -d)" -VERSION=0.5.0 # Current development candidate version from release.json. +VERSION=0.5.0 "$MORPHIR_HOST" extension repository init ./wasm-repository "$MORPHIR_HOST" extension repository init ./process-repository "$MORPHIR_HOST" extension repository add python-wasm --directory ./wasm-repository diff --git a/docs/quickstart.md b/docs/quickstart.md index 285f3c13..6b494c37 100644 --- a/docs/quickstart.md +++ b/docs/quickstart.md @@ -1,7 +1,7 @@ # A Python model round trip -**Released:** CPython 3.14, `morphir-python==0.1.0`, `morphir==0.1.0`, native -compiler `0.1.1`. Follow [installation](installation.md) first. This recipe uses +**Released:** CPython 3.14, `morphir-python==0.1.2`, `morphir==0.1.1`, native +compiler `0.1.2`. Follow [installation](installation.md) first. This recipe uses a POSIX shell such as Bash. The CLI commands themselves also work on Windows; create the same source files in your editor there. diff --git a/docs/releasing.md b/docs/releasing.md index 626a0267..7963c99f 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -43,9 +43,11 @@ published package with the same version for the candidate. Native releases and manual release qualification cover Linux x86_64/aarch64, macOS arm64/x86_64 and Windows x86_64. A CLI release also runs these platforms, -using its pinned published native wheels instead of rebuilding Rust. Every +using its pinned published native wheels. Every selected platform must pass before the CLI publishes. The reused Linux wheel already passes the same installer checks in the qualification workflow. +The shared CI qualification still checks a fresh Linux source build; the +per-platform CLI installation checks use the published native wheels. Each installer has separate temporary mise configuration, state, cache and package environments outside the checkout. Tests check installed versions, diff --git a/examples/extension.sh b/examples/extension.sh index 7057c726..77175c43 100644 --- a/examples/extension.sh +++ b/examples/extension.sh @@ -1,7 +1,7 @@ #!/usr/bin/env bash set -euo pipefail # MORPHIR_HOST is the verified finos/morphir 0.4.0-beta.10 executable. -# PYTHON_BUNDLE is the verified 0.4.2 bundle directory containing release.json. +# PYTHON_BUNDLE is the verified 0.5.0 bundle directory containing release.json. : "${MORPHIR_HOST:?Set the verified Rust-host executable path}" : "${PYTHON_BUNDLE:?Set the verified bundle directory}" "$MORPHIR_HOST" --version diff --git a/examples/install/extension-bundles.sh b/examples/install/extension-bundles.sh new file mode 100644 index 00000000..09634be6 --- /dev/null +++ b/examples/install/extension-bundles.sh @@ -0,0 +1,15 @@ +#!/usr/bin/env bash +set -euo pipefail +VERSION=0.5.0 +gh release download "extension/python/v$VERSION" \ + --repo finos/morphir-python --dir python-extension-assets +(cd python-extension-assets && shasum -a 256 -c SHA256SUMS) +mkdir python-wasm python-process +cp "python-extension-assets/morphir-python-binding-$VERSION.wasm" \ + "python-extension-assets/morphir-python-binding-$VERSION.wasm.sha256" python-wasm/ +cp "python-extension-assets/morphir-python-binding-$VERSION.release.json" \ + python-wasm/release.json +tar -xzf "python-extension-assets/morphir-python-extension-$VERSION.tar.gz" \ + -C python-process +export WASM_BUNDLE="$(cd python-wasm && pwd)" +export PROCESS_BUNDLE="$(cd python-process && pwd)" diff --git a/examples/install/mise-pipx.toml b/examples/install/mise-pipx.toml index 384c3354..40597613 100644 --- a/examples/install/mise-pipx.toml +++ b/examples/install/mise-pipx.toml @@ -5,4 +5,4 @@ pipx = "pypi:pipx" python = "3.14" uv = "0.12.10" pipx = { version = "1.18.4", python = "3.14", expose = ["pipx"] } -"pipx:morphir-python" = { version = "0.1.0", python = "3.14", uvx = false, pipx_args = "--pip-args='--only-binary=:all:'" } +"pipx:morphir-python" = { version = "0.1.2", python = "3.14", uvx = false, pipx_args = "--pip-args='--only-binary=:all:'" } diff --git a/examples/install/mise-uv.toml b/examples/install/mise-uv.toml index cb4318b6..84628e55 100644 --- a/examples/install/mise-uv.toml +++ b/examples/install/mise-uv.toml @@ -1,4 +1,4 @@ [tools] python = "3.14" uv = "0.12.10" -"pypi:morphir-python" = { version = "0.1.0", uvx_args = "--no-build" } +"pypi:morphir-python" = { version = "0.1.2", uvx_args = "--no-build" } diff --git a/examples/manifest.json b/examples/manifest.json index 410edc9e..b8516f4f 100644 --- a/examples/manifest.json +++ b/examples/manifest.json @@ -2,9 +2,9 @@ "schema_version": 1, "python": "3.14", "released": { - "morphir": "0.1.0", - "morphir-python": "0.1.0", - "morphir-python-native": "0.1.1" + "morphir": "0.1.1", + "morphir-python": "0.1.2", + "morphir-python-native": "0.1.2" }, "examples": [ { diff --git a/openspec/changes/add-process-mep-extension/tasks.md b/openspec/changes/add-process-mep-extension/tasks.md deleted file mode 100644 index da731ca7..00000000 --- a/openspec/changes/add-process-mep-extension/tasks.md +++ /dev/null @@ -1,48 +0,0 @@ -# Tasks - -This change is being applied. SDK 0.4.0 is published and the separate upstream Python JSON MCK profile is merged. All implementation and candidate qualification tasks are complete. Landing and approved component publication remain in progress. - -## 1. Negotiate current and legacy MEP (morphir-5hxy.1) - -- [x] 1.1 Resolve the SDK 0.3.0 numeric-only wire ID gap with a qualified published SDK pin, linking an upstream prerequisite if needed; add explicit legacy `0.1` and exact `0.2.0-draft.1` offers using the pinned SDK's session helpers; verify numeric/string ID preservation, both handshakes, incompatible drafts and unchanged legacy compile/generate behavior. -- [x] 1.2 Add bilateral complete-tuple and limit negotiation without widening static claims; verify cross-product, unadvertised method, unsupported guarantee and legacy-session refusals. -- [x] 1.3 Document independent MEP, envelope, IR, claims and package versions; verify the capability reference matches live discovery and initialized sessions. - -## 2. Adapt supported model envelopes (morphir-5hxy.2) - -- [x] 2.1 Implement bounded canonical JSON model-envelope admission using SDK helpers; verify base64, byte length, hash, critical fields, semantic IR version and size-limit negative cases. -- [x] 2.2 Adapt compileModel/generateModel for admitted JSON-profile v3/v4 Library tuples through the shared compiler; verify compile/generate/recompile semantics and diagnostic parity with legacy operations. -- [x] 2.3 Refuse unadvertised Ion profiles, unsupported distributions and guarantees without lossy fallback; test these refusals and document the initial support matrix. - -## 3. Serve native stdio sessions (morphir-5hxy.3) - -- [x] 3.1 Add the thin Rust process guest and documented `morphir-python-extension --stdio` entry point; verify it builds and executes without CPython/PyO3 or a user Rust toolchain. -- [x] 3.2 Implement bounded Content-Length framing around the SDK session; test Unicode byte lengths, partial/truncated messages, duplicate/invalid lengths, overflow, invalid UTF-8/JSON and header/body limits. -- [x] 3.3 Preserve request IDs, notification silence, fixed session capabilities, shutdown/exit and protocol-only stdout; verify a real multi-request process test and document stderr and supervision behavior. - -## 4. Distribute both runtime choices (morphir-5hxy.4) - -- [x] 4.1 Build process artifacts for each advertised platform and retain the WASM artifact; verify both use the shared compiler and produce matching supported results and diagnostics. -- [x] 4.2 Stage canonical runtime/platform/mode/argument/digest/claim descriptors and source receipts with pinned tooling; verify host readers, installed-byte integrity, offline activation and explicit unsupported-platform refusal. -- [x] 4.3 Add release assurance and runtime-selection documentation alongside each artifact producer, including exact native/CLI pairing where affected; verify missing or mismatched evidence blocks promotion and historical WASM assets remain available. - -## 5. Qualify host interoperability (morphir-5hxy.5) - -- [x] 5.1 Run the pinned executable MEP guest suite for both runtimes and protocol offers, including supported model operations and negative admission; retain source/artifact-bound conformance receipts. -- [x] 5.2 Qualify the concrete Rust host process and WASM routes using a pinned compatible release or source build; verify initialization, v3/v4 operations, parity, timeout and child cleanup with a clean child environment. -- [x] 5.3 Test documented MoonBit routes independently, record prerequisite upstream work for any unsupported path and publish only evidenced compatibility claims; verify documentation recipes against the specified host revisions. -- [x] 5.4 Measure representative cold-start and compile/generate workloads for process and WASM without making an unmeasured speed claim; retain the reproducible inputs, toolchain and timing report. - -## Workflow follow-up - -- All 16 implementation tasks are complete. Full candidate [40726356123](https://github.com/finos/morphir-python/actions/runs/40726356123) succeeded at `bce5d859b524edf452b3031e2e2e56fc32f4da71`. The five process platforms and portable WASM each pass 91 canonical observations and saved rechecks, totaling 546 observations. All transferred receipts were independently checked locally against current source, helper, corpus, checker, lockfile, artifact and claim identities. -- Exact native `0.1.2` / CLI `0.1.1` pairing and compiler/extension `0.5.0` are qualified. Every process producer passes installed offline operation and full structured diagnostic parity with the Python API. Windows imports only allowed OS runtimes. The extracted process archive passes runtime switching, installed-byte integrity and unsupported-platform refusal. -- Final promotion stages 39 assets plus `SHA256SUMS`. Local audit verifies every final checksum, all 11 canonical process archive members, payload hashes, executable modes and all six raw MCK report/recheck pairs. A real four-platform input set is refused for missing Intel evidence. Historical WASM releases `0.4.0` and `0.4.2` remain available with their recorded digests. -- Source-pinned Rust host checks and ten fresh timing samples for small/medium workloads pass on the actual candidate bytes. Raw inputs, reports and toolchain/build identities are retained in the candidate and final host-evidence archive. No general performance claim is made. MoonBit routes remain unsupported at the documented pin with checked limitations. -- SDK `0.4.0` publication and the separate upstream Python JSON MCK profile are complete. The Windows checker build passes with short scoped Cargo storage and explicit parent/submodule Git settings; real source changes are still refused. No corpus change or integrity exception was accepted. -- Main specs are synced. All merges and admin bypass are approved. The maintainer approved native `0.1.2`, CLI `0.1.1` and extension `0.5.0` at merge `f2032e3adaf72854a3907dc092e8abb757f08b4a`. -- Native [40758932916](https://github.com/finos/morphir-python/actions/runs/40758932916) published all five wheels and the source archive. Every PyPI file matches its qualified workflow artifact and checksum exactly. Extension [40758936256](https://github.com/finos/morphir-python/actions/runs/40758936256) is qualifying the approved source. -- CLI [40764461472](https://github.com/finos/morphir-python/actions/runs/40764461472) correctly refused publication: the current core `0.1.0` wheel differs from PyPI after documentation-site metadata edits. Direct comparison confirms identical runtime sources and changes only to `METADATA` and `RECORD`. No CLI files were published. Bug `morphir-5hxy.6` prepares core `0.1.1` and CLI `0.1.2`; preserve the failed `python-v0.1.1` tag and the strict byte-identity guard. Corrected publication requires approval for the new tags and source after qualification. -- Extension run `40758936256` passed its platform MEP checks but its native candidate verifier correctly rejected the forwarded extension tag. Bug `morphir-5hxy.7` preserves the verifier and selects the source native tag for extension/manual runs; an actual workflow-shell regression fails before the fix and passes afterward, including rejection of a wrong explicit native tag. Keep extension publication held. Approval for the corrected source is required before retargeting the unpublished extension tag and repeating all gates; published native tags remain unchanged. -- Bug `morphir-5hxy.8` refreshes the stale committed host-evidence fallback exposed by selective PR CI. Fresh qualification from clean commit `6e88b295017d346007409bdd7182e8584c91c622` passes the currently documented released Rust-host recipe, offline round trips and both pinned MoonBit refusal probes. A regression checks the real committed cache against every documented input, preventing a full fresh-host CI run from hiding stale fallback evidence. -- Keep this change active until publication and final verification; archive afterward. Do not treat staged assets as published releases. diff --git a/openspec/changes/add-process-mep-extension/.openspec.yaml b/openspec/changes/archive/2026-10-28-add-process-mep-extension/.openspec.yaml similarity index 100% rename from openspec/changes/add-process-mep-extension/.openspec.yaml rename to openspec/changes/archive/2026-10-28-add-process-mep-extension/.openspec.yaml diff --git a/openspec/changes/add-process-mep-extension/design.html b/openspec/changes/archive/2026-10-28-add-process-mep-extension/design.html similarity index 80% rename from openspec/changes/add-process-mep-extension/design.html rename to openspec/changes/archive/2026-10-28-add-process-mep-extension/design.html index bb76f858..8db125b0 100644 --- a/openspec/changes/add-process-mep-extension/design.html +++ b/openspec/changes/archive/2026-10-28-add-process-mep-extension/design.html @@ -13,22 +13,22 @@ Code goes in 
 (or json, toml, bash, diff). Give sections an id and
   list them in nav.toc.
 -->
-
-
-
-
-
+
+
+
+
+
 
 
 

 
add-process-mep-extension

-
OpenSpec change · Bead morphir-5hxy · 2026-10-28 · Implementation landed; native published; extension qualification and CLI metadata correction in progress

-
-
Context
See proposal.md for motivation and the two spec deltas for requirements. PythonExtension already implements native Rust frontend/backend traits. The baseline published SDK 0.3.0 exposed NativeExtension::frontend_backend, open_protocol, model methods and admission helpers. Its wire request type used a numeric ID, while the canonical contract admits numeric and string IDs; adopting helpers alone is not full draft conformance. The baseline Python0.4.2 implementation declared legacy MEP0.1 only. Candidate0.5.0 uses publishedSDK 0.4.0 and opts into the exact JSON model draft after native/WASM executable qualification. finos/morphir c552dac801f23f2b2b566d29e08780723498ce36 defines exact MEP 0.2.0-draft.1 and model envelope 0.1.0-draft.1. These versions are independent of SDK 0.3.0, compiler 0.4.2, claims format and IR version.

+
OpenSpec change · Bead morphir-5hxy · 2026-10-28 · Implementation and component releases complete; final documentation and archive

+
+
Context
See proposal.md for motivation and the two spec deltas for requirements. PythonExtension already implements native Rust frontend/backend traits. The baseline published SDK 0.3.0 exposed NativeExtension::frontend_backend, open_protocol, model methods and admission helpers. Its wire request type used a numeric ID, while the canonical contract admits numeric and string IDs; adopting helpers alone is not full draft conformance. The baseline Python0.4.2 implementation declared legacy MEP0.1 only. Published0.5.0 uses publishedSDK 0.4.0 and opts into the exact JSON model draft after native/WASM executable qualification. finos/morphir c552dac801f23f2b2b566d29e08780723498ce36 defines exact MEP 0.2.0-draft.1 and model envelope 0.1.0-draft.1. These versions are independent of SDK 0.3.0, compiler 0.4.2, claims format and IR version.

 
Goals and non-goals
Add a native Rust process guest and current-draft model adapters while retaining WASM and legacy behavior. Keep language semantics shared. Initial model tuples use morphir-ir/morphir-json and supported Library IR 3.0.0 and draft 4.0.0. Rich Ion profiles, unsupported distribution kinds, additional Python syntax, cancellation/progress and performance claims are not introduced. A Python CLI stdio wrapper can follow separately; the selected CLI installation remains mise/pipx.

 
Decisions
RNT-1. Add a thin native Rust guest
Add a process guest crate/entry point, depending on the maintained compiler and published SDK, with no PyO3 or CPython requirement. The proposed command is:
morphir-python-extension --stdio
No-argument launches also select stdio, matching the canonical native bundler and installed process launcher. Reuse the SDK's session endpoint and dispatch. Keep model adaptation in the shared PythonExtension so native, WASM and process paths agree. Put stdio effects in the guest layer. A Python CLI wrapper would reuse the engine but retain an interpreter/launcher dependency; a frozen Python CLI would bundle an unnecessary runtime for this guest.
BoundaryCurrent releaseProposed change
MEPLegacy 0.1Retain 0.1 and add exact 0.2.0-draft.1
Model envelopeNot advertised0.1.0-draft.1, admitted JSON profile
Extension runtimeWASMWASM and native process
SDK0.3.0, numeric-only wire IDsQualified published pin covering the canonical wire contract
Semantic IRSupported v3 and draft v4 Library modelsSame semantic scope, explicit admitted tuples
SDK-1. Resolve concrete SDK wire gaps before claiming conformance
Pin a published SDK that supports canonical numeric and string request IDs and the required draft behavior. SDK 0.3.0 currently has numeric-only ExtensionRequest.id, so link and qualify an upstream SDK update if no suitable release exists. Do not vendor a sibling checkout or silently coerce wire IDs. Both WASM and process must pass the same ID-preservation vectors before the new draft is advertised. The concrete prerequisite is request ID support, issue 316, tracked as morphir-4wrx. SDK 0.4.0 is merged in PR 317 as d51daa8aea7ae09ae295ff254d72b27770c64104. All CI and the committed-source publication dry run pass. The maintainer approved publication at that exact merge. Tag crates/morphir-extension-sdk/v0.4.0 triggered successful workflow40695514380; Cargo independently downloaded the published0.4.0 crate. The compiler now pins registry dependency =0.4.0, without a sibling or Git SDK dependency. Related upstream work is MEP protocol type generation, issue 241; its existence is not evidence that the wire gap is fixed.
WIN-1. Keep the standalone Windows runtime independent of Python
Binary inspection of the b38e00e development executable found VCRUNTIME140.dll. Build only the standalone guest with -C target-feature=+crt-static; preserve the Python wheel's existing ABI configuration. The Windows producer uses MSVC dumpbin /DEPENDENTS, records exact artifact/tool/checker identities, and refuses VC or Python runtime DLL imports. Assembly requires that source-bound proof. This CRT configuration needs separate code generation from the Python wheel; it is not a compatible cache consumer.
MEP-1. Negotiate the new draft explicitly
Retain legacy 0.1 operations and exact 0.2.0-draft.1 offers. Opt in only after supported model methods and executable conformance pass. Reuse SDK model admission and session rules; method constants alone are not support. Never enable model methods under legacy negotiation. Keep optional flags false until implemented.
MOD-1. Start with the explicit JSON model profile
Implement compile_model/generate_model over the existing compile/generate core. Admit complete operation/profile/codec/envelope/IR tuples and their bilateral limits. The initial profile is morphir-ir/morphir-json with envelope 0.1.0-draft.1. Use the canonical base64 payload, exact byte length/hash and critical-field rules. After SDK admission, materialize JSON through published morphir-json 0.2.0 with finite depth/node/string budgets, preserving numeric lexemes and literal private-looking keys. Bound outgoing JSON before extending payload buffers. Reject unadvertised Ion profiles, guarantees and unsupported semantic forms. This achieves bounded new-draft support without implying rich Ion preservation or silently converting rich input.
IO-1. Treat framing and lifetime as a bounded server boundary
Use Content-Length JSON-RPC framing, byte-based lengths, an 8 KiB header ceiling and an initial 16 MiB complete-body ceiling. Advertised decoded/encoded model limits must fit those outer bounds, including envelope overhead. Enforce local bounds even if the peer advertises more. Check partial input, duplicate lengths, integer overflow, invalid UTF-8/JSON and EOF before unbounded allocation. Reserve stdout for frames and flush responses. Follow initialization, capability locks, shutdown and exit; do not respond to notifications. Host supervision owns deadlines and descendant cleanup.
RLS-1. Qualify dual-runtime distribution
Retain the portable WASM guest and publish native process executables for the advertised targets, with canonical empty arguments selecting stdio by default. Use a canonical host-readable descriptor with runtime/platform/mode/digest/claims bound per artifact. Validate the staged descriptor with pinned host tooling; do not assume that either the existing WASM-only packager or native-only bundle command can package a mixed release unchanged. Preserve historical assets. Release exact native/CLI package pairs if shared compiler changes affect them.
HST-1. Qualify hosts independently
The Rust host provides ProcessLaunch/ProcessChannel and verified-byte staging. It clears the child environment, favoring a directly executable Rust guest. Qualify a pinned conforming Rust host and test each documented MoonBit route independently. Use a pinned source build when a released host lacks the new draft, and state that prerequisite. If a route needs upstream work, record that dependency and label it unsupported until it passes. Existing MoonBit process wrappers demonstrate framing, not Python extension activation.

 
Risks and trade-offs
RiskMitigation
Draft, SDK and runtime support are confusedExact independent version table, live negotiation and candidate-bound conformance before claims.
Model content or guarantees are lostAdmit only explicit JSON tuples initially. Refuse unsupported profiles, critical fields and guarantees; no silent fallback.
Malformed input exhausts resourcesBound headers, wire bodies and decoded bytes before allocation; test boundary and partial cases.
Process mode is mistaken for a sandboxDocument ordinary OS privileges and the host's explicit supervision, distinct from WASM isolation.
Packaging or host support lagsPin descriptor readers and host builds, qualify installed bytes, record upstream blockers and make only verified support claims.
Native execution is assumed fasterMeasure startup and representative compile/generate workloads before making a performance claim.
The baseline executable MCK accepted only moonbit-model-bool-library-v1, with mandatory rich Ion semantics and MoonBit artifact inventories. Python cannot qualify against that profile. The maintainer approved a separate Python JSON profile, merged in upstreamPR1109 as85cf4352eeb517fefb85cda10961f749cce51004 and tracked by closed morphir-av8s. Its treec42c55ef3aa9d0190850251dac97bd094cebb4c4 equals the independently audited328c0216 source tree. The source, lockfile, corpus and complete91-case identity set are pinned in rust/extension.toml. Existing MoonBit rich-Ion checks remain unchanged. The clean committed328c0216 shared checker independently qualified all91observations for both actual release-native and WASM0.5.0 bytes, and saved report-check passed for both. Review corrected two non-isolated negative vectors; reports now reach invalid_base64 and unsupported_ir_version. The WASM bridge passes raw request/response bytes; notification silence and exit qualify the adapter/guest route because Extism exposes a requests-only handle ABI. The merged85cf4352 checker also passes both actual runtime candidates and saved rechecks. Release producers now run the canonical suite and saved recheck before upload. No unit-test result substitutes for the executable suite; the replacement five-platform candidate run 40726356123 now passes.

-
Migration and rollout
  1. Add negotiation and bounded JSON model adapters with tests and compatibility documentation.
  2. Add the Rust process server with framing and lifecycle tests; preserve the existing WASM path.
  3. Build and qualify runtime artifacts and descriptors with matching claims and source receipts.
  4. Run pinned MEP guest conformance and real host installation/operation cases, including legacy hosts and explicit refusals.
  5. After maintainer approval, publish a new extension version and document runtime selection. Existing users can stay on the prior WASM release; never replace its bytes.
Implementation is underway on the process delivery branch. The0.5.0 candidate advertises exact0.2.0-draft.1 and legacy0.1 after publishedSDK adoption and passing independent native/WASM reports. Extension0.4.2 remains the published legacy release. All five process platforms, portable WASM and final candidate promotion pass in run 40726356123 at bce5d85. Component publication remains subject to exact maintainer approval.

+
Migration and rollout
  1. Add negotiation and bounded JSON model adapters with tests and compatibility documentation.
  2. Add the Rust process server with framing and lifecycle tests; preserve the existing WASM path.
  3. Build and qualify runtime artifacts and descriptors with matching claims and source receipts.
  4. Run pinned MEP guest conformance and real host installation/operation cases, including legacy hosts and explicit refusals.
  5. After maintainer approval, publish a new extension version and document runtime selection. Existing users can stay on the prior WASM release; never replace its bytes.
Extension 0.5.0 is published with all five process targets and portable WASM. It advertises exact 0.2.0-draft.1 and legacy 0.1 after published SDK adoption and independent conformance checks. Historical 0.4.2 remains available. Core 0.1.1, CLI 0.1.2 and native 0.1.2 are published and verified. The maintainer approved the corrected release tags and deployments.

 
Build and release assessment

 
The personal build-master skill applies because this repository has no local copy. Process delivery belongs to the existing compiler artifact producers. Build the Linux x86_64 executable in the wheel producer's manylinux 2.28 container and qualify it beside WASM in the existing bundle job. The release/manual five-platform wheel matrix owns the remaining native builds, using its matching wheel for installed Python API comparison. A dependent read-only assembly job requires all five byte-bound installed-host and executable MCK receipts plus the WASM reference and its MCK receipt. The existing extension promotion job stages both runtime asset sets and their evidence; only an approved extension tag triggers publication. Reuse the already qualified Linux x86_64 process artifact. No new scheduled workflow or separate platform matrix is introduced.

 
@@ -47,8 +47,17 @@ 
add-process-mep-extension
Risk and deadlineExecution and ownerEvidence and failure response

 

 
The b38e00e development candidate passed all five platform producers and process-only assembly in run 40676766327. Cached-tool identity, IR and generated-artifact digests agreed with WASM/API references. The verified CLI recipe selects separate named repositories, with uninstall before changing the active runtime. A real macOS check switched WASM/process/WASM, rejected a foreign-only descriptor and refused changed installed bytes. Integrity checks now run inside every platform producer with fresh project caches and exact expected/observed hashes; atomic replacement avoids modifying hardlinked inputs. These checks remain distinct from the pending new-draft MCK prerequisite. Replacement source 820c9d0 passed all five producers and assembly in run 40685569455. Its Windows dependency proof admits only OS DLLs, with no VC or Python runtime imports. All eleven combined release files, the five producer receipts and the Windows checker proof were independently matched to the collected assembly hashes. Runtime switching, installed-byte tampering and foreign-platform refusal passed on the assembled Linux candidate.
The current candidate supplies the previously missing platform, conformance, transfer and promotion evidence. The assessment concerns implementation assurance; it is not publication authorization or a general performance result. Per-tag qualification still gates publication at the exact approved source. No native speed claim follows from this build design.

 
Windows checker setup and source integrity
The full candidate run exposed Cargo/libgit2 failing on a locked Gleam snapshot path of 265 characters under the default Windows Cargo home. A short checker-only cache under RUNNER_TEMP/mck reduces the longest pinned path to 252 characters. A second diagnostic showed that transient parent Git options did not persist into the Rust submodule: inaccessible long fixtures produced false deleted/modified statuses. Preparation now configures LF and long-path handling locally in each checkout and requires clean source before and after compilation. An actual tracked-file edit is still refused and preserved. No source patch, ignored diff, changed corpus or reduced platform requirement was accepted.
Diagnostic run 40726235322 passes with clean parent/submodule state and a prepared Windows checker receipt. The manual mck-diagnostic mode builds only that checker and retains raw compiler and Git diagnostics; it cannot qualify or publish a release. Its separate concurrency group permits diagnosis while the full platform run continues. The normal workflow remains the promotion authority. The first Linux preparation of the shared checker and WASM adapter took 12m24s, followed by 1m31s for canonical execution and saved rechecks; these are assurance costs, not guest performance measurements.
Download assets and transformed-byte checks
The assembly category stages all five raw executables with checksums, a separately named process descriptor, and one deterministic gzip/tar download containing the canonical eleven-file process bundle. Archive metadata uses fixed ownership/timestamps and explicit executable permissions; every copied and archived payload must retain its original digest. Corrupt transfers, mixed source/claims/platforms, symlinks and extra files are refused without leaving partial assets. The candidate receipt and final checksum list bind the download bytes to assembly. The existing runtime-selection and source-pinned host checks consume the extracted archive, preserving the build-once contract. Actual 820c9d0 archive bytes pass local offline switching, installed-byte refusal and unsupported-platform refusal. The same manual/extension-tag workflow now requires canonical producer MCK rechecks before assembly. Final promotion copies verified raw process assets, their separate descriptor/archive, WASM assets and all producer evidence, then seals their final names. Manual runs stage this exact release set without publishing. An approved extension tag publishes it after all selected jobs pass.
Source-pinned host and timing observations
The standalone developer checker in tools/extension-qualification/ pins Rust host source d51daa8aea7ae09ae295ff254d72b27770c64104, independently of the compiler's published SDK dependency. Actual b38e00e WASM and macOS process bytes pass legacy initialization, v3/v4 type/value compile-generate-recompile, diagnostic parity, orderly close and a real timeout with child reaping. This is not executable MCK or new-draft qualification.
A release-built checker ran five fresh samples per workload on one macOS ARM64 machine. The small workload has one record and one function; the medium workload has 200 records and 100 typed conditional functions. Raw results, input files, exact artifact/checker/lock/toolchain hashes and descriptive timings are retained in .dev/qualification/timings-b38-release/. Startup includes fresh guest initialization and WASM module compilation. OS caches are not cleared; later v3/v4 operations share the session and WASM runs first. No general speed claim follows. The existing manual/release candidate consumer now owns source-pinned host checks and raw timing retention; it builds the checker once and consumes the already qualified guest bytes. The extension promotion job depends on that consumer. Estimated uncached Linux host build cost is 3 to 6 minutes; the observed local release build took 53 seconds. Actual CI timing remains to be measured.

-
Qualification result
All 16 implementation tasks are complete. Full candidate run 40726356123 succeeds at source bce5d859b524edf452b3031e2e2e56fc32f4da71. Later documentation, task and spec-sync edits preserve the production code and check definitions. Publication remains pending exact maintainer approval and per-tag validation.
ObligationObserved evidence
Platform and API agreementAll five process producers and WASM pass installed offline v3/v4 operation checks. Full process diagnostic records match native Python API 0.1.2 with compiler 0.5.0. Windows runtime imports pass.
Canonical current/legacy MEPSix reports each contain 91 required observations with successful saved rechecks from clean merged85cf4352 source, totaling 546. Local transfer verification preserves original paths and exact source/tool/artifact/claim identities.
Assembly and download formFive raw process targets combine into an eleven-file canonical bundle and deterministic archive. Extracted-archive switching, installed-byte tampering and foreign-platform refusal pass. An actual four-platform input set is refused.
Real hosts and timingsPinned Rust host d51daa8 passes actual WASM/process legacy lifecycle, v3/v4 operations, diagnostics, timeout and child cleanup. Ten raw samples, five per small/medium workload, retain inputs and exact toolchain/artifact identities. No general speed claim.
Promotion and retentionFinal staging has 39 assets plus SHA256SUMS. Every final checksum, six raw report/recheck pairs and all eleven archive payload/mode entries are independently checked. Historical 0.4.0/0.4.2 WASM assets remain uploaded with their original digests.
Local validation passes 2632 tests with five intentional skips, strict typing, BDD, focused evidence/assembly tests, actionlint, site checks and strict OpenSpec validation. SDK 0.4.0 is published; Python/native/extension tags have not yet been published. The OpenSpec change remains active until that operational follow-up is complete.

-
CLI publication prerequisite
Approved native tag native-v0.1.2 at f2032e3adaf72854a3907dc092e8abb757f08b4a published successfully in workflow 40758932916; all six PyPI files match the qualified release bytes. Approved CLI tag python-v0.1.1 correctly failed workflow 40764461472 before publication: core 0.1.0 documentation links and its project URL changed after publication. Direct wheel comparison proves identical runtime files, with only METADATA and RECORD differing. Bug morphir-5hxy.6 prepares core 0.1.1 followed by CLI 0.1.2. The strict published-core byte guard remains unchanged, and the failed CLI tag is preserved. Native 0.1.2 and extension 0.5.0 retain their approved source and versions. Corrected core/CLI publication awaits exact approval after qualification.
The extension-tag run also exposed a separate routing error: its native candidate verifier received extension/python/v0.5.0 and correctly refused it as a non-native tag. Bug morphir-5hxy.7 keeps that verifier and the complete wheel-set check, using the source native version for extension/manual contexts while validating explicit native tags unchanged. A regression executes the production workflow shell for manual, native, extension and invalid-native routes; the extension route fails before the fix and all routes pass afterward. Protected extension publication remains held. Corrected-source approval is required before retargeting the unpublished extension tag and repeating full qualification; published native tags remain unchanged.
Selective PR CI also exposed a stale committed host-evidence fallback after earlier documentation input changes. Bug morphir-5hxy.8 replaces it with actual qualification from clean commit 6e88b295017d346007409bdd7182e8584c91c622: the currently documented 0.4.2 bundle passes the pinned Rust-host recipe and offline round trips, and both pinned MoonBit refusal probes pass. A regression verifies the real committed cache against all documented inputs, including when CI separately runs fresh host checks.

+
Qualification result
All 16 implementation tasks are complete. Full candidate run 40726356123 succeeds at source bce5d859b524edf452b3031e2e2e56fc32f4da71. Later documentation, task and spec-sync edits preserve the production code and check definitions. Subsequent approved per-tag validation and actual public release checks are recorded below.
ObligationObserved evidence
Platform and API agreementAll five process producers and WASM pass installed offline v3/v4 operation checks. Full process diagnostic records match native Python API 0.1.2 with compiler 0.5.0. Windows runtime imports pass.
Canonical current/legacy MEPSix reports each contain 91 required observations with successful saved rechecks from clean merged85cf4352 source, totaling 546. Local transfer verification preserves original paths and exact source/tool/artifact/claim identities.
Assembly and download formFive raw process targets combine into an eleven-file canonical bundle and deterministic archive. Extracted-archive switching, installed-byte tampering and foreign-platform refusal pass. An actual four-platform input set is refused.
Real hosts and timingsPinned Rust host d51daa8 passes actual WASM/process legacy lifecycle, v3/v4 operations, diagnostics, timeout and child cleanup. Ten raw samples, five per small/medium workload, retain inputs and exact toolchain/artifact identities. No general speed claim.
Promotion and retentionFinal staging has 39 assets plus SHA256SUMS. Every final checksum, six raw report/recheck pairs and all eleven archive payload/mode entries are independently checked. Historical 0.4.0/0.4.2 WASM assets remain uploaded with their original digests.
Final local validation passes 2,638 tests with five intentional skips, strict typing, BDD and Ruff. Published extension run 40777545069 repeats all platform gates and canonical checks at the approved source. Actual release downloads pass checksum, archive, transfer-receipt and runtime-switch verification. All nine delta requirements match the main specs before archival.

+
Published components and corrected release path

+
The maintainer approved corrected source d1fb8217ae266c588ffe39a5a769aef2943b0fab, merged in PR 57. Core morphir-v0.1.1, CLI python-v0.1.2 and extension extension/python/v0.5.0 all use this source. Published native native-v0.1.2 remains unchanged at f2032e3adaf72854a3907dc092e8abb757f08b4a.

+
+
+
+
+
+
ComponentSuccessful release runIndependent public-byte verification
Native 0.1.240758932916Five platform wheels and source archive match PyPI hashes and qualified artifacts.
Core 0.1.140777541581Wheel/source match PyPI and GitHub mirrors. A separate core rebuild passes the exact published-wheel guard.
CLI 0.1.240779451394Wheel/source match PyPI and GitHub mirrors; all five installed native platform checks pass.
Extension 0.5.040777545069All 39 public assets and checksums, eleven archive members and modes, six canonical report/recheck pairs and documentation pins match.

+
Actual published bundles pass WASM/process/WASM switching, offline v3/v4 operation, installed-byte tampering refusal and unsupported-platform refusal. Fresh PyPI API/CLI examples and actual mise/uv and mise/pipx installations pass with core 0.1.1, CLI 0.1.2 and native 0.1.2. Committed host evidence records the released bundle and the independently checked MoonBit limitations. The documentation retains the MoonBit-derived blue/orange colors and landing-page layout.

+
The failed python-v0.1.1 tag remains preserved. Its strict guard correctly refused changed core 0.1.0 metadata before publication; runtime files were identical. The new core/CLI versions fix that mismatch. An extension/native tag-routing repair preserves the native verifier and complete wheel check. Only the still-unpublished extension tag was retargeted with explicit approval. Published tags were not moved. A committed-host-cache regression prevents fresh CI from masking stale fallback evidence. Actual installer qualification also reproduced stale user-global pip metadata; private pip/uv caches now isolate each qualification without modifying user caches, and both public installers pass. These repairs are tracked by morphir-5hxy.6 through morphir-5hxy.9.

 
Repository evidence and references
  • rust/crates/morphir-python-binding/src/lib.rs: shared PythonExtension traits and truthful current capabilities.
  • rust/crates/morphir-python-native/src/lib.rs: current private two-function JSON bridge; it is not a full MEP transport.
  • Published morphir-extension-sdk0.4.0: canonical request IDs, native session dispatch and model admission helpers.
  • finos/morphir-rust 26d5e707e5ec94d16421db6380edbdc865d85c04: process launch/channel and stdio frontend fixture. Fixture framing must not be copied as a hardened server.
  • finos/morphir-moonbit bd3adc52e6b8f6368fdaee50f76535799732f8d6: portable MEP embedding wrapper. No claim of Python host compatibility follows.
  • Canonical MEP contract and model transport rules.
Related work: morphir-bj9r owns the selected CLI installation route; morphir-ukvn.5.98 tracks the earlier MoonBit extension qualification context.

 

 
diff --git a/openspec/changes/add-process-mep-extension/proposal.md b/openspec/changes/archive/2026-10-28-add-process-mep-extension/proposal.md
similarity index 100%
rename from openspec/changes/add-process-mep-extension/proposal.md
rename to openspec/changes/archive/2026-10-28-add-process-mep-extension/proposal.md
diff --git a/openspec/changes/add-process-mep-extension/specs/python/extension/spec.md b/openspec/changes/archive/2026-10-28-add-process-mep-extension/specs/python/extension/spec.md
similarity index 100%
rename from openspec/changes/add-process-mep-extension/specs/python/extension/spec.md
rename to openspec/changes/archive/2026-10-28-add-process-mep-extension/specs/python/extension/spec.md
diff --git a/openspec/changes/add-process-mep-extension/specs/python/model-transport/spec.md b/openspec/changes/archive/2026-10-28-add-process-mep-extension/specs/python/model-transport/spec.md
similarity index 100%
rename from openspec/changes/add-process-mep-extension/specs/python/model-transport/spec.md
rename to openspec/changes/archive/2026-10-28-add-process-mep-extension/specs/python/model-transport/spec.md
diff --git a/openspec/changes/archive/2026-10-28-add-process-mep-extension/tasks.md b/openspec/changes/archive/2026-10-28-add-process-mep-extension/tasks.md
new file mode 100644
index 00000000..b92acfe0
--- /dev/null
+++ b/openspec/changes/archive/2026-10-28-add-process-mep-extension/tasks.md
@@ -0,0 +1,46 @@
+# Tasks
+
+Implementation and approved component publication are complete. SDK 0.4.0 and both extension runtimes are published; the separate upstream Python JSON MCK profile is merged. The final documentation records verified released installation and host behavior.
+
+## 1. Negotiate current and legacy MEP (morphir-5hxy.1)
+
+- [x] 1.1 Resolve the SDK 0.3.0 numeric-only wire ID gap with a qualified published SDK pin, linking an upstream prerequisite if needed; add explicit legacy `0.1` and exact `0.2.0-draft.1` offers using the pinned SDK's session helpers; verify numeric/string ID preservation, both handshakes, incompatible drafts and unchanged legacy compile/generate behavior.
+- [x] 1.2 Add bilateral complete-tuple and limit negotiation without widening static claims; verify cross-product, unadvertised method, unsupported guarantee and legacy-session refusals.
+- [x] 1.3 Document independent MEP, envelope, IR, claims and package versions; verify the capability reference matches live discovery and initialized sessions.
+
+## 2. Adapt supported model envelopes (morphir-5hxy.2)
+
+- [x] 2.1 Implement bounded canonical JSON model-envelope admission using SDK helpers; verify base64, byte length, hash, critical fields, semantic IR version and size-limit negative cases.
+- [x] 2.2 Adapt compileModel/generateModel for admitted JSON-profile v3/v4 Library tuples through the shared compiler; verify compile/generate/recompile semantics and diagnostic parity with legacy operations.
+- [x] 2.3 Refuse unadvertised Ion profiles, unsupported distributions and guarantees without lossy fallback; test these refusals and document the initial support matrix.
+
+## 3. Serve native stdio sessions (morphir-5hxy.3)
+
+- [x] 3.1 Add the thin Rust process guest and documented `morphir-python-extension --stdio` entry point; verify it builds and executes without CPython/PyO3 or a user Rust toolchain.
+- [x] 3.2 Implement bounded Content-Length framing around the SDK session; test Unicode byte lengths, partial/truncated messages, duplicate/invalid lengths, overflow, invalid UTF-8/JSON and header/body limits.
+- [x] 3.3 Preserve request IDs, notification silence, fixed session capabilities, shutdown/exit and protocol-only stdout; verify a real multi-request process test and document stderr and supervision behavior.
+
+## 4. Distribute both runtime choices (morphir-5hxy.4)
+
+- [x] 4.1 Build process artifacts for each advertised platform and retain the WASM artifact; verify both use the shared compiler and produce matching supported results and diagnostics.
+- [x] 4.2 Stage canonical runtime/platform/mode/argument/digest/claim descriptors and source receipts with pinned tooling; verify host readers, installed-byte integrity, offline activation and explicit unsupported-platform refusal.
+- [x] 4.3 Add release assurance and runtime-selection documentation alongside each artifact producer, including exact native/CLI pairing where affected; verify missing or mismatched evidence blocks promotion and historical WASM assets remain available.
+
+## 5. Qualify host interoperability (morphir-5hxy.5)
+
+- [x] 5.1 Run the pinned executable MEP guest suite for both runtimes and protocol offers, including supported model operations and negative admission; retain source/artifact-bound conformance receipts.
+- [x] 5.2 Qualify the concrete Rust host process and WASM routes using a pinned compatible release or source build; verify initialization, v3/v4 operations, parity, timeout and child cleanup with a clean child environment.
+- [x] 5.3 Test documented MoonBit routes independently, record prerequisite upstream work for any unsupported path and publish only evidenced compatibility claims; verify documentation recipes against the specified host revisions.
+- [x] 5.4 Measure representative cold-start and compile/generate workloads for process and WASM without making an unmeasured speed claim; retain the reproducible inputs, toolchain and timing report.
+
+## Delivery and release verification
+
+- Implementation landed before the final release repair in [PR #57](https://github.com/finos/morphir-python/pull/57), merge `d1fb8217ae266c588ffe39a5a769aef2943b0fab`. The maintainer approved all merges, the corrected component tags and documentation deployments.
+- Published native `0.1.2` remains at `f2032e3adaf72854a3907dc092e8abb757f08b4a`, [run 40758932916](https://github.com/finos/morphir-python/actions/runs/40758932916). All five platform wheels and the source archive match their qualified workflow bytes and PyPI hashes.
+- Published core `0.1.1`, CLI `0.1.2` and extension `0.5.0` use merge `d1fb8217ae266c588ffe39a5a769aef2943b0fab`. Their successful release runs are [40777541581](https://github.com/finos/morphir-python/actions/runs/40777541581), [40779451394](https://github.com/finos/morphir-python/actions/runs/40779451394) and [40777545069](https://github.com/finos/morphir-python/actions/runs/40777545069). Both core/CLI distributions match PyPI, qualified workflow and GitHub mirror bytes. A fresh core rebuild also passes the strict published-wheel guard.
+- The public extension release contains 39 assets plus `SHA256SUMS`. A complete download audit checks every checksum, documentation digest pin, all eleven canonical process archive members, payload bytes and executable modes. Each of five process platforms and portable WASM has 91 canonical MCK observations and a verified saved recheck, totaling 546 observations. Original foreign-platform paths and source/tool/artifact/claim identities remain intact.
+- Actual published bundles pass offline v3/v4 WASM/process/WASM switching, installed-byte tampering refusal and unsupported-platform refusal with Rust host `0.4.0-beta.10`. Committed `site/evidence/hosts.json` records the released Rust-host recipe, agreement with native Python API `0.1.2` / compiler `0.5.0`, and both pinned MoonBit refusal probes. MoonBit support remains explicitly limited at its documented revision.
+- Fresh public-PyPI environments pass the API, CLI and SDK examples with Rust absent from `PATH`. Actual mise/uv and mise/pipx installations both resolve core `0.1.1`, CLI `0.1.2` and native `0.1.2`, then exercise v3/v4 operations. Qualification uses private pip/uv caches so stale user-global package metadata cannot select old releases; a regression covers both installers.
+- Source-pinned Rust-host checks and ten retained timing samples cover small/medium workloads. Reports preserve inputs and build/toolchain identities. These observations do not establish a general performance advantage. Historical WASM releases `0.4.0` and `0.4.2` retain their original bytes.
+- Release failures are retained as evidence. CLI `python-v0.1.1` failed before publication because previously published core `0.1.0` metadata differed; its tag remains unchanged. Core `0.1.1` and CLI `0.1.2` correct the versioning without weakening byte checks (`morphir-5hxy.6`). The first extension attempt forwarded an extension tag to the native validator; the actual workflow-shell regression covers the corrected routing and invalid-native refusal (`morphir-5hxy.7`). Only the still-unpublished extension tag was retargeted with explicit approval. A committed-host-cache regression prevents fresh CI from hiding stale fallback evidence (`morphir-5hxy.8`). Private installer caches fix the independently reproduced pip metadata-cache issue (`morphir-5hxy.9`).
+- Final local checks pass 2,638 tests with five intentional skips, BDD, strict mypy/pyright and Ruff. All nine delta requirements exactly match the main specs before archival. The documentation keeps the reviewed MoonBit-derived colors and landing-page layout.
diff --git a/scripts/qualify_mise.py b/scripts/qualify_mise.py
index c264cc75..c2e80c0b 100644
--- a/scripts/qualify_mise.py
+++ b/scripts/qualify_mise.py
@@ -112,6 +112,8 @@ def isolated_environment(
             "MISE_YES": "1",
             "MISE_AUTO_INSTALL": "0",
             "PIP_CONFIG_FILE": os.devnull,
+            "PIP_CACHE_DIR": str(directory / "cache" / "pip"),
+            "UV_CACHE_DIR": str(directory / "cache" / "uv"),
             "NO_COLOR": "1",
         }
     )
diff --git a/site/evidence/hosts.json b/site/evidence/hosts.json
index 7294fe73..c68407b7 100644
--- a/site/evidence/hosts.json
+++ b/site/evidence/hosts.json
@@ -2,49 +2,50 @@
   "schema_version": 1,
   "state": "succeeded",
   "inputs": {
-    "site/integrations.json": "d83a529d8d4d59c7505892f93cb7e991939e38174892cd0f11f2172c090b3578",
+    "site/integrations.json": "60f218368844cd99681719319c5b8dfc69ce1151ec4b5d5eabd913004e42b658",
     "rust/extension.toml": "31a882701022d95198aad254c4db61659d2b6ec138585a49c673d13a16c80272",
     "scripts/docs_hosts.py": "791c2e220217e8931e1c090749987a17e7787fcdbba35443d83b3e234f8b7cc6",
     "scripts/extension_bundle.py": "ca03e3d959428dfef41fb0c852eaa3d656f13133f6e4f996db77ea9952126bc3",
-    "examples/extension.sh": "bbe0a0cf27070b888439f57a9e495eb75506b8fafbafd259b1a8512bcf1af35b",
+    "examples/extension.sh": "ddfd2afa50e42c16e7d16023e4149c4f36fce0c9fb962b20eb93d7005707fa63",
     "examples/model/acme/models.py": "0f57ac6f4ffd2524373ec9ba3df079f23291ce42ca7f7700e4df50fad9d43b50",
     "examples/model/acme/rules.py": "cf475c980096c8645550c4c53c5e6343e3a584f2a19cba26c16cf1291ce235c2",
-    "docs/python-extension.md": "326b9ee7ca856ba88b3ad67accac5fa4657444e0b7968f3eec23287d9db4459c",
+    "docs/python-extension.md": "01c32c72e0bc9b7f0ea44b05b6e73cb0d68e7ea08fb0f23cf8780e0fb0f4a28d",
     "docs/moonbit.md": "574f1e0129975dc10ea68882b48dda07ced36f429b2a30746c6bc724e9f119c2",
-    "docs/compatibility.md": "3f5ef69142991edf9d30d23dce768d66cf0047f4b325c1f042166a5c2f9c29f8",
+    "docs/compatibility.md": "d5c712e019a6923346eae9f2211a2f39eb399aa5da1cc139113fd3f1032e3fc8",
     "tests/fixtures/python/loans/acme/models.py": "02b453935df7a03fd8e58c88616836d8f09e78868b9c66cae572c18852f6ccf4",
     "tests/fixtures/python/loans/acme/rules.py": "6aa4573844f82910c06079ef1af11a56103dc48cbcdc142bfc23c3aa25f6162e"
   },
   "platform": "macOS-26.6.2-arm64-arm-64bit-Mach-O",
   "python": "3.14.7 (main, Sep  1 2026, 14:05:28) [Clang 22.1.3 ]",
-  "working_tree_dirty": false,
-  "git_head": "6e88b295017d346007409bdd7182e8584c91c622",
+  "working_tree_dirty": true,
+  "git_head": "56dd4992268432cb903bc0b2117843e9e2189e75",
   "rust_recipe": {
     "recipe": "examples/extension.sh",
     "exit_code": 0,
     "host_sha256": "e610796e758c4f2b8925228082efd78f9b9d46c45ee22b6e393d9b76b8e807e2",
     "offline": {
       "bundle": {
-        "morphir-python-binding-0.4.2.wasm": "10acafa0f0282c5240e9620a5f2bb21629cc7580b9add528e7b77c7e54db22b5",
-        "morphir-python-binding-0.4.2.wasm.sha256": "64f60ff9e58e6cbe2f3323e1c375cef77be7db81b9879974f943918a92a42634",
-        "release.json": "72770f73f05a72535fd8c86ad4629175019037441a758b827c1ba47cc9a52ebd"
+        "morphir-python-binding-0.5.0.wasm": "791d6cc60f442b1088b291e9aed4f2740a38b0f0cc920f5f7418735c2b88aeb6",
+        "morphir-python-binding-0.5.0.wasm.sha256": "0da1e166b504d97584bde22280411aae7dd872dfa18d867652553b91f784647e",
+        "release.json": "a78df591623388a95f3f7f8f7465422cee3dd4f6d86a64224d2a02291d8a81b3"
       },
-      "wasm_sha256": "10acafa0f0282c5240e9620a5f2bb21629cc7580b9add528e7b77c7e54db22b5",
+      "wasm_sha256": "791d6cc60f442b1088b291e9aed4f2740a38b0f0cc920f5f7418735c2b88aeb6",
       "extension": "morphir-python",
-      "version": "0.4.2",
-      "git_commit": "1f547d17f648d5b398862f9dfceb05b6d463cb3f",
+      "version": "0.5.0",
+      "git_commit": "d1fb8217ae266c588ffe39a5a769aef2943b0fab",
       "packager_rev": "0aa60eb799d46f8a317ec47abef4a7a4e61dc8ac",
       "capabilities": [
         "backend",
-        "frontend"
+        "frontend",
+        "modelTransport"
       ],
       "multiDocument": true,
       "installed_integrity": {
-        "expected_sha256": "10acafa0f0282c5240e9620a5f2bb21629cc7580b9add528e7b77c7e54db22b5",
-        "tampered_sha256": "9fd562d8ee2d99ede2e7bd41bb219d755ec23a72813c5cbf81854a8d8b9d1fc3",
+        "expected_sha256": "791d6cc60f442b1088b291e9aed4f2740a38b0f0cc920f5f7418735c2b88aeb6",
+        "tampered_sha256": "17a4f379770516a596494ea1859ff43ee0b5c7f6ab07f4391bd50b1a73dd8b27",
         "exit_code": 1,
         "stdout": "",
-        "stderr": "Operation ID: op-215cbd72-59bc-4117-880b-f2bff34e2544\nLog: /var/folders/gk/kq2l8mzd0lq64qspbc_6j80m0000gn/T/python-bundle-host-kuoivpf8/home/logs/cli/2026-10-28/20261028T212014.733Z-7424-1d00-18e2ce4909789a80.jsonl\nError: cli::extension_error\n\n  \u00d7 Extension error: Failed to verify installed provider 'morphir-python':\n  \u2502 digest mismatch for /private/var/folders/gk/kq2l8mzd0lq64qspbc_6j80m0000gn/\n  \u2502 T/python-bundle-host-kuoivpf8/home/store/extensions/\n  \u2502 sha256/10acafa0f0282c5240e9620a5f2bb21629cc7580b9add528e7b77c7e54db22b5/\n  \u2502 morphir-python-binding-0.4.2.wasm: expected\n  \u2502 10acafa0f0282c5240e9620a5f2bb21629cc7580b9add528e7b77c7e54db22b5, got\n  \u2502 9fd562d8ee2d99ede2e7bd41bb219d755ec23a72813c5cbf81854a8d8b9d1fc3\n\n",
+        "stderr": "Operation ID: op-ccf5cb98-db47-4fbd-a84c-bf8559741b4c\nLog: /var/folders/gk/kq2l8mzd0lq64qspbc_6j80m0000gn/T/python-bundle-host-gj7y_82s/home/logs/cli/2026-10-28/20261028T224826.774Z-45146-b05a-18e2d3192fb46790.jsonl\nError: cli::extension_error\n\n  \u00d7 Extension error: Failed to verify installed provider 'morphir-python':\n  \u2502 digest mismatch for /private/var/folders/gk/kq2l8mzd0lq64qspbc_6j80m0000gn/\n  \u2502 T/python-bundle-host-gj7y_82s/home/store/extensions/\n  \u2502 sha256/791d6cc60f442b1088b291e9aed4f2740a38b0f0cc920f5f7418735c2b88aeb6/\n  \u2502 morphir-python-binding-0.5.0.wasm: expected\n  \u2502 791d6cc60f442b1088b291e9aed4f2740a38b0f0cc920f5f7418735c2b88aeb6, got\n  \u2502 17a4f379770516a596494ea1859ff43ee0b5c7f6ab07f4391bd50b1a73dd8b27\n\n",
         "fresh_project": true
       },
       "host": {
@@ -54,8 +55,8 @@
       },
       "qualification_script_sha256": "ca03e3d959428dfef41fb0c852eaa3d656f13133f6e4f996db77ea9952126bc3",
       "python_api": {
-        "native_version": "0.1.1",
-        "compiler_version": "0.4.2"
+        "native_version": "0.1.2",
+        "compiler_version": "0.5.0"
       },
       "offline_round_trips": {
         "v3": {
diff --git a/site/integrations.json b/site/integrations.json
index 5cb3e362..77074569 100644
--- a/site/integrations.json
+++ b/site/integrations.json
@@ -5,12 +5,12 @@
     "declaration": "rust/extension.toml"
   },
   "python_bundle": {
-    "version": "0.4.2",
-    "release": "https://github.com/finos/morphir-python/releases/download/extension/python/v0.4.2",
+    "version": "0.5.0",
+    "release": "https://github.com/finos/morphir-python/releases/download/extension/python/v0.5.0",
     "files": {
-      "morphir-python-binding-0.4.2.release.json": "72770f73f05a72535fd8c86ad4629175019037441a758b827c1ba47cc9a52ebd",
-      "morphir-python-binding-0.4.2.wasm": "10acafa0f0282c5240e9620a5f2bb21629cc7580b9add528e7b77c7e54db22b5",
-      "morphir-python-binding-0.4.2.wasm.sha256": "64f60ff9e58e6cbe2f3323e1c375cef77be7db81b9879974f943918a92a42634"
+      "morphir-python-binding-0.5.0.wasm": "791d6cc60f442b1088b291e9aed4f2740a38b0f0cc920f5f7418735c2b88aeb6",
+      "morphir-python-binding-0.5.0.wasm.sha256": "0da1e166b504d97584bde22280411aae7dd872dfa18d867652553b91f784647e",
+      "morphir-python-binding-0.5.0.release.json": "a78df591623388a95f3f7f8f7465422cee3dd4f6d86a64224d2a02291d8a81b3"
     }
   },
   "moonbit": {
diff --git a/tests/unit/test_qualify_mise.py b/tests/unit/test_qualify_mise.py
index d7568190..b95cbd25 100644
--- a/tests/unit/test_qualify_mise.py
+++ b/tests/unit/test_qualify_mise.py
@@ -3,15 +3,12 @@
 from __future__ import annotations
 
 import tomllib
-from typing import TYPE_CHECKING
+from pathlib import Path
 
 import pytest
 
 from scripts import qualify_mise as q
 
-if TYPE_CHECKING:
-    from pathlib import Path
-
 
 @pytest.mark.parametrize("installer", ["uv", "pipx"])
 def test_candidate_install_is_offline_and_uses_built_wheels(
@@ -40,6 +37,22 @@ def test_isolation_does_not_inherit_active_python_environment(tmp_path: Path) ->
     assert env["MISE_CONFIG_DIR"] == str(tmp_path / "config")
 
 
+def test_installer_caches_are_private_to_each_qualification(tmp_path: Path) -> None:
+    original = {
+        key: str(tmp_path / "user-cache" / key)
+        for key in ("PIP_CACHE_DIR", "UV_CACHE_DIR")
+    }
+    environments = {
+        installer: q.isolated_environment(tmp_path / installer, original)
+        for installer in ("uv", "pipx")
+    }
+    for key, user_cache in original.items():
+        for installer, env in environments.items():
+            assert env[key] != user_cache
+            assert Path(env[key]).is_relative_to(tmp_path / installer)
+        assert environments["uv"][key] != environments["pipx"][key]
+
+
 def test_candidate_refuses_a_missing_native_input_before_resolving(
     tmp_path: Path,
 ) -> None: