funduq-contract
The bytes both sides of funduq sign and verify: the signing payloads, the
actor-chain hop format, and signature checking. Core depends on it and so
does funduq-provider-sdk; neither depends on the other.
pip install funduq-contract
It holds no private key. Producing the bytes and having custody are
different jobs, which is what lets one package sit under core and an SDK at
once without either lending the other its keys. Nothing here talks to a
network or a database; the dependencies are cryptography and pyjwt.
payloads— one function per act, returning the canonical bytes a signer signs. The domain tag on each is what stops a signature made for one act being spent as another.chain—sign_hop,new_chain,extend_chain,dispatch_hop, andverify_chain. A hop carries the signer's key and a hash-link to the hop before it, and nothing else — no subject, and no time.verify_chainreturns the hops it parsed, so reading a dispatch isresult.hops[-1] .dispatched_to, never a hand-decoded JWT.signatures—verify_signature,new_nonce, provider fingerprints.
Implementing funduq's contract in another language
Replay contract-vectors.json:
build each payload from its inputs, assert the exact payload_utf8 bytes,
and check signature_hex verifies under the published test key. The test key
is for vectors only — never accept it in a real deployment.
The vectors are recorded, not derived. They work because they are old, so nothing in a build or a test run regenerates them: a file dumped from the code would pass whatever the code happened to do. Producing new ones is a deliberate act, and the contract revision in that file — with its changelog — is how you tell whether anything you depend on has moved.
1 maintainer
Metadata
1 maintainer
Release files for funduq-contract 0.0.14
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| funduq_contract-0.0.14.tar.gz | 47.1 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| funduq_contract-0.0.14-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 60.8 kB
Release files / funduq_contract-0.0.14.tar.gz
| Download URL | funduq_contract-0.0.14.tar.gz |
|---|---|
| Size | 47.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
45363b28f2d1d76fa2eb7a6b9bc18f4d8b2e51d4f2a895258abfff44696be0af
|
|
BLAKE2b-256 checksum How to use checksums |
ab2fe26b0dd92b1d7f5087917efdea3955c7ec29d0f9d64f7bc10fbf92d83a66
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.
Transparency logRelease files / funduq_contract-0.0.14-py3-none-any.whl
| Download URL | funduq_contract-0.0.14-py3-none-any.whl |
|---|---|
| Size | 13.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
ef012a6846dbacbce2385d6ffc1a4c6f7ff3ff5ab22889ddac5619e34f3fdee6
|
|
BLAKE2b-256 checksum How to use checksums |
d413f741ac16ad5cede9b436f024b73e9d32e0bf99b89dfbb1f1f193ad44acc8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.
Transparency logSecurity for funduq-contract 0.0.14
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for funduq_contract-0.0.14.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 20, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
