boldsec (Python)

BoLD live authorization monitoring for Python. boldsec.core is a hand-port of @boldsec/core (the shared TypeScript extraction core): the same id/owner/scope/tenant/GraphQL extraction. Verified against the JS core on the full shared golden conformance vector suite (web/sdk/bold-conformance/test-vectors*.json, run end to end against a real FastAPI target), the hand-lifted unit cases ported from extract.test.ts/observe.test.ts, a mechanical regex battery generated from the real built @boldsec/core regex objects, and a set of differential tests added specifically for traps a naive port would get wrong (JS's Object.values() integer-index key reordering, the four-character JS line-terminator class, and JS truthiness/String()/?? semantics on off-contract resolver values). This is not a claim of byte-parity on every conceivable input; see boldsec/core.py's module docstring for the one disclosed, bounded ceiling (a non-integer-fractional float's string representation).

boldsec.fastapi is the FastAPI adapter: a custom APIRoute subclass that reads the framework's authoritative matched route param and the already-buffered request/response bodies, then hands a NeutralObservation to boldsec.core.observe_neutral(), which composes and ships the metadata event. The adapter contains zero extraction logic; it only translates.

Metadata only, fail-safe: no payloads, credentials, or response bodies are ever persisted or logged, and any error inside the adapter can never break, slow, or alter the wrapped application's response.

See web/UNIVERSAL_SDK_PHASE_2_DESIGN.md (Section B) and web/UNIVERSAL_SDK_PHASE_2_BUILD_PLAN.md (Phase 2.2) for the governing design and build plan.