bitexoft-verify
The platform's only definition of "correct". It runs in two places and decides the same thing in both:
| Where | When | What it is worth |
|---|---|---|
| Your machine | while you work, answers in seconds | informative |
| GitHub Actions | on every push, pinned, clean environment | official |
The difference shows up as provenance.surface in the report. The platform marks a
delivery as verified only on a green CI report.
Install
Python 3.10 or newer — the version Ubuntu 22.04 LTS ships, so a stock Linux works without upgrading anything.
pip install bitexoft-verify # core; one small dependency below 3.11
pip install 'bitexoft-verify[api]' # adds what later deliveries need to verify APIs
If pip answers requires a different Python, check your version with python3 -V. The
project itself targets a newer Python than the tool does: each delivery's contract states
what it needs.
Use
bitexoft-verify check A1 # verify A1
bitexoft-verify check A3 # verify A3 and, on the way, A1 and A2
bitexoft-verify check A3 --only # just A3
bitexoft-verify deliveries # what this version can verify
Exit codes: 0 all green, 1 something fails, 2 could not even start.
bitexoft.toml
Organise your project however you like. You declare it here and verification reads it from here; what is not negotiable is the shape of the boundaries, not their names.
[project]
id = "chaos-sports-lab"
package = "chaoslab"
[layers]
domain = "chaoslab.domain"
[cli]
module = "chaoslab" # run as `python -m chaoslab`
# main = "main.py" # or a script, if that is your entry point
The three gates
- Acceptance — that it works: the contract's symbols, impossible objects refused, value semantics, the geometry, the entry point and its exit codes.
- Design — that it is built well: the domain's boundary read from the syntax tree, your tests passing, at least one test that builds an impossible object.
- Evidence — that you understand it. The CLI does not judge this gate: it always
reports
skipwith a message. You close it on the platform by writing the why and comparing it against the rubric.
A check never fails for something you cannot fix: if an optional dependency or a git tag is missing, it skips with a message saying what to do.
Cumulative verification
Verifying A3 also runs A1 and A2, with inherited checks tagged [A1]. That is what makes
the method agile: every delivery leaves the whole project standing, and a regression in
old work shows up while verifying the new.
The sample files
Deliveries are verified against files the CLI ships with, not against one you wrote. For A1 that is 30 instants crossing all three block states, plus a copy with one coordinate off the pitch to check that bad data fails cleanly instead of printing a traceback at the user. They are synthetic: no third-party data is distributed here.
Development
pip install -e '.[dev,api]'
pytest # builds a fake learner repository and verifies it
ruff check .
python tools/make_fixtures.py # regenerate the sample files
Before changing what a check says when it fails, or the layout of the output, read
docs/foundations/03-feedback-self-explanation-calibration.md
(the verifier's messages are the feedback a learner reads) and ADR 0002. The check ids and the report
schema are a contract with the platform: do not rename them.
Releasing
The version is written once, in __version__ (src/bitexoft_verify/__init__.py). The pin in
.github/workflows/verify.yml (cli-version) must match its major.minor; a test checks it.
First release, by hand on pypi.org:
- Account → Publishing → Add a pending publisher: project
bitexoft-verify, ownerbitexoft, repositorysports-lab-v1, workflowrelease-verify.yml, environmentpypi. - In the repository settings, create the environment
pypi.
Each release:
git tag verify-v0.2.0 && git push origin verify-v0.2.0
The workflow runs pytest on 3.10 and 3.12, refuses a tag that differs from __version__, builds
with python -m build and publishes with trusted publishing (no tokens). Check it in a clean
environment: pipx run --spec bitexoft-verify bitexoft-verify deliveries.
Metadata
Release files for bitexoft-verify 0.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| bitexoft_verify-0.2.0.tar.gz | 43.9 kB | With provenance | Details for bitexoft_verify-0.2.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| bitexoft_verify-0.2.0-py3-none-any.whl | Python 3 | none | any | Details for bitexoft_verify-0.2.0-py3-none-any.whl |
Total release size: 74.8 kB
Release files / bitexoft_verify-0.2.0.tar.gz
| Download URL | bitexoft_verify-0.2.0.tar.gz |
|---|---|
| Size | 43.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ded8099c538eedafb5936776a83064703a5658f16f55441794a82f9423b4a75a
|
|
BLAKE2b-256 checksum How to use checksums |
63d6326f01192e4622cf7fe65b360228b6b8fdfb611a3d68f42404ab274f1202
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logRelease files / bitexoft_verify-0.2.0-py3-none-any.whl
| Download URL | bitexoft_verify-0.2.0-py3-none-any.whl |
|---|---|
| Size | 30.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
27ce05977c5f7a2f2e34db4c85f3fb28a83555fa2f26dc72a5a3fd0563070ddb
|
|
BLAKE2b-256 checksum How to use checksums |
e2641f0e65f4778d6cb75f6d426eba210a838a5f199a791c08ad0817bce83031
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logSecurity for bitexoft-verify 0.2.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for bitexoft_verify-0.2.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.