orchestrata_ultimate.factory.enforcement
Reference › orchestrata_ultimate › factory › enforcement
State-diff enforcement core (SPEC-033 §3, B1a/B1b/B1c, Phase 1).
The enforcement package enforces that every change to the repository was made by a registered, governed writer (SPEC-033 section 3, rows B1a, B1b and B1c, and section 7, row B20; ADR-0001, ADR-0017, ADR-0030). It rests on a state-diff rule: the tree difference between two commits must be accounted for by recorded writes, with no allow-by-default branch.
Parts: models (WriterIdentity, GovernedWriteRecord); ledger (the append-only EventLedger and the WriterRegistry); bootstrap (baseline hashing and delta classification); and enforce (the check that returns a Verdict). The attestation layer adds supply-chain records: attestation maps records to in-toto links and SLSA provenance, signing signs them and attestation_store stores them. The ledger is also used by the evidence and promotion packages. The CLI entry point is scripts.factory_enforce. Start with enforce.
8 modules, 1,173 lines of code.
Modules
| Module | Summary | LOC |
|---|---|---|
__init__ |
State-diff enforcement core (SPEC-033 §3, B1a/B1b/B1c, Phase 1). | 27 |
attestation |
in-toto link + SLSA provenance mapping (ADR-0030, SPEC-033 §7, B20). | 135 |
attestation_store |
Append-only, signed in-toto attestation store (ADR-0030, SPEC-033 §7, B20). | 225 |
bootstrap |
Bootstrap + the unregistered-new-file registration path (SPEC-033 §3, B1b). | 154 |
enforce |
The state-diff enforcement core (SPEC-033 §3, B1a, Phase 1). | 185 |
ledger |
EventLedger + WriterRegistry (SPEC-033 §3, B1c, Phase 1). |
268 |
models |
Data model for the governed-event ledger (SPEC-033 §3, B1c, Phase 1). | 92 |
signing |
Attestation signing (ADR-0030, SPEC-033 §7, B20). | 87 |
Dependency diagram
