funduq-contract

The bytes both sides of funduq sign and verify: the signing payloads, the actor-chain hop format, and signature checking. Core depends on it and so does funduq-provider-sdk; neither depends on the other.

pip install funduq-contract

It holds no private key. Producing the bytes and having custody are different jobs, which is what lets one package sit under core and an SDK at once without either lending the other its keys. Nothing here talks to a network or a database; the dependencies are cryptography and pyjwt.

payloads — one function per act, returning the canonical bytes a signer signs. The domain tag on each is what stops a signature made for one act being spent as another.
chain — sign_hop, new_chain, extend_chain, dispatch_hop, and verify_chain. A hop carries the signer's key and a hash-link to the hop before it, and nothing else — no subject, and no time. verify_chain returns the hops it parsed, so reading a dispatch is result.hops[-1] .dispatched_to, never a hand-decoded JWT.
signatures — verify_signature, new_nonce, provider fingerprints.

Implementing funduq's contract in another language

Replay contract-vectors.json: build each payload from its inputs, assert the exact payload_utf8 bytes, and check signature_hex verifies under the published test key. The test key is for vectors only — never accept it in a real deployment.

The vectors are recorded, not derived. They work because they are old, so nothing in a build or a test run regenerates them: a file dumped from the code would pass whatever the code happened to do. Producing new ones is a deliberate act, and the contract revision in that file — with its changelog — is how you tell whether anything you depend on has moved.

Development Status
- 3 - Alpha
Intended Audience
- Developers
License
- OSI Approved :: Apache Software License
Programming Language
- Python :: 3.12
Topic
- Software Development :: Libraries
Typing
- Typed

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

funduq_contract-0.0.4.tar.gz (33.2 kB view details)

Uploaded Aug 26, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

funduq_contract-0.0.4-py3-none-any.whl (16.8 kB view details)

Uploaded Aug 26, 2026 Python 3

File details

Details for the file funduq_contract-0.0.4.tar.gz.

File metadata

Download URL: funduq_contract-0.0.4.tar.gz
Upload date: Aug 26, 2026
Size: 33.2 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for funduq_contract-0.0.4.tar.gz
Algorithm	Hash digest
SHA256	`666f02d4cdce3a654c58a59d72e5a62b20821738206b890f0a7fbce26424599c`
MD5	`2a8717db3f09d986a59e5b1ca6c1d757`
BLAKE2b-256	`c464f405ba27076cf6300e7d51b7bcfd2f5599bb2458d395dbb2d8f3bd79eeeb`

See more details on using hashes here.

Provenance

The following attestation bundles were made for funduq_contract-0.0.4.tar.gz:

Publisher: release.yml on hukaichun/funduq

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: funduq_contract-0.0.4.tar.gz
- Subject digest: 666f02d4cdce3a654c58a59d72e5a62b20821738206b890f0a7fbce26424599c
- Sigstore transparency entry: 2602136227
- Sigstore integration time: Aug 26, 2026
Source repository:
- Permalink: hukaichun/funduq@c48b3cff0d795a98ee3a7b4748ce330d83235797
- Branch / Tag: refs/heads/main
- Owner: https://github.com/hukaichun
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: release.yml@c48b3cff0d795a98ee3a7b4748ce330d83235797
- Trigger Event: push