sm-listing
How a community publishes the members who asked to be findable — so an agent that has never met them can discover them by what they offer and where they are.
This is the second hop of agent discovery.
sm-federation finds the
community; this profile finds the member. They are separate because
federation's own §1 says it is not a directory, and a member lookup service is
exactly that.
A listing is not a member directory
A directory is the roster: everyone, including people who never asked to be listed anywhere. A listing contains only members who actively opted in, carrying only the fields they chose. Its default state is empty, and a community that enables it with nobody opted in publishes an empty document — which is correct, not a misconfiguration.
That distinction is the whole security model, so the spec states it normatively:
- A non-consenting member is ABSENT — not an opaque entry, not a redacted placeholder. An opaque entry in a list is a census of the non-consenting: it publishes the one fact those members declined to publish, which is that they are there.
- No count of excluded members, or anything one can be derived from. A count computed and then withheld is one refactor away from being emitted; excluding rows so that no count exists by construction is the mechanism.
- The contact route is the member's agent endpoint, never a human contact detail. A consented listing carrying phone numbers is still a harvesting surface — one people opted into without understanding what they opted into.
- No member-authored free text. Every field is a code, an identifier, a URL or a number. Free text is what leaks, and prose does not match across languages, so it was never the discovery mechanism.
What it carries
| geography | ISO 3166-2 for matching, plus resolvable place references for the precision ISO cannot express |
| offering | (scheme, code) pairs — multi-encodable, so one member can publish NAICS and UNSPSC and a schema.org type |
| trade terms | ships-to, currencies, minimum order, lead time — all on free, stable standards |
What it does not promise
Matching is exact and hierarchical-prefix within one scheme. Cross- vocabulary matching is out of scope and stays out: a consumer querying JSIC will not match a publisher who listed only NAICS. Crosswalk tables are lossy, permanently maintained, and produce confidently wrong matches when stale — worse than no match. §6's multi-encoding is the mitigation, and it works by moving the translation burden onto the only participant who cannot get it wrong: the member describing itself.
Layout
spec/listing/0.1/listing.md |
the normative profile |
src/sm_listing/wire/schema/listing/0.1/*.json |
JSON Schemas — the published wire contract, shipped inside the wheel (sm_listing.wire.load_schema) |
src/sm_listing/wire/vectors/listing/v01/*.json |
conformance vectors, also shipped (sm_listing.wire.load_vectors) |
src/sm_listing/conformance/ |
the over-the-wire suite, shipped inside the wheel — what an implementer runs against their own endpoint |
conformance/ |
the schema and corpus-coverage suite for this repository; not in the wheel |
Measuring your implementation
pip install "sm-listing[conformance]"
SM_LISTING_ADAPTER=your.module:make_adapter pytest --pyargs sm_listing.conformance
make_adapter returns an implementation of sm_listing.conformance.ListingAdapter.
Every run prints the subject it measured. With SM_LISTING_ADAPTER unset the
suite fails rather than measuring anything — it does not fall back to the
reference implementation, which is what 0.3.0 and earlier did while reporting the
result as though it were about your system. Use SM_LISTING_ADAPTER=reference to
exercise the suite against the reference on purpose.
MIT.
Metadata
Release files for sm-listing 0.7.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| sm_listing-0.7.0.tar.gz | 111.4 kB | With provenance | Details for sm_listing-0.7.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| sm_listing-0.7.0-py3-none-any.whl | Python 3 | none | any | Details for sm_listing-0.7.0-py3-none-any.whl |
Total release size: 183.4 kB
Release files / sm_listing-0.7.0.tar.gz
| Download URL | sm_listing-0.7.0.tar.gz |
|---|---|
| Size | 111.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
3fa2faa3816ca9f09b0981521c550a9b256af2af775971c6a7521009ddf370c6
|
|
BLAKE2b-256 checksum How to use checksums |
bca005e73c62994abfdfa1c48ec2a57afab46b04f3293b0ae4e92a5c3cbebe31
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 10, 2026.
Transparency logRelease files / sm_listing-0.7.0-py3-none-any.whl
| Download URL | sm_listing-0.7.0-py3-none-any.whl |
|---|---|
| Size | 71.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
a89b43716112336bcdb9e1346d91657e1b8e6837786a4c54fb330e57e4972e30
|
|
BLAKE2b-256 checksum How to use checksums |
7e9bac7aa922b6221b9f81f861581704cf3863e39da1fa042d2a093b2017bf8d
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 10, 2026.
Transparency logSecurity for sm-listing 0.7.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for sm_listing-0.7.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 10, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.