delegus-core (Python)

A Python port of the Delegus v0.2 protocol layer (delegus-base-v1, spec §15 step 1), module for module from packages/core: Grant and Proof parsing (P1, P8), DID-document key lookup (P2), Ed25519 verification (P3, P9), validity and audience (P4, P5, P7), the Bitstring Status List credential (P6), Proof binding (P10–P14), the action vocabulary (P15–P20), the T1–T3 and T5 seams as injected hooks in the §5.4 order, receipt assembly and signing (§6), and offline re-verification with the historical clock (§6.4).

• No I/O. The DID document snapshot, status-list credential snapshot, replay state and the clock are inputs; the three seams are methods on a hooks object (see delegus_core/memory.py for the in-memory one).
• Fail closed and deterministic: the port reproduces every one of the 40 conformance vectors, receipt JWS byte for byte, and passes the htu, JCS and jti sets.
• One dependency: cryptography (Ed25519). Python ≥ 3.9.

Run the vectors

python3 -m delegus_core.conformance            # finds packages/conformance/src/vectors in the monorepo
python3 -m delegus_core.conformance --dir <path with cases/ and sets/>
python3 -m unittest discover -s tests

Exit 0 when all vectors pass with byte-identical receipts, every committed receipt re-verifies offline, and the three sets pass.

Use

from delegus_core import EvaluateInput, evaluate, verify, MemoryService, MemorySigner

evaluate(EvaluateInput(...)) returns the receipt body as a dict; verify(input, signer) adds the receipt JWS; reverify_receipt(...) re-runs the protocol layer for a receipt with now = evaluated_at.

Notes on fidelity

JSON numbers follow JavaScript semantics: integral literals such as 1.0 or 1e2 are the integers 1 and 100, integer literals outside ±(2^53 − 1) are rejected, and canonical output uses ECMAScript Number::toString. Object keys sort by UTF-16 code units (RFC 8785), and strings quote like JSON.stringify (lone surrogates escaped).