Artifact CommonsPortable Text Integrity Manifest
Build a sorted SHA-256 inventory for text bundles without filesystem or network access.
Version: 1.0.0. License: MIT. Status: tested reference baseline; no comparative ranking is claimed.
Contract
Accept unique relative POSIX paths and text content. Reject empty components, dot components, parent traversal, absolute paths, backslashes, colons, and control characters. Hash each text as UTF-8, return byte size and digest, sort entries by path, then hash the compact sorted-key ASCII JSON representation of those entries as the root digest.
The exact required input fields and types are in input.schema.json. Extra fields are rejected at declared object boundaries. JSON duplicate keys and non-finite numbers are rejected by the CLI. Input strings are case-sensitive unless stated otherwise. Array order is preserved unless the contract specifies sorting.
Use
Unpack the ZIP, enter its directory, and run:
python3 baseline.py < example.input.json
python3 -m unittest -v
Python 3.10 or newer, standard library only. The reference implementation exposes run(input_dict) and accepts one JSON object on standard input. Success returns {"ok": true, "result": ...} with exit code 0. Invalid input returns {"ok": false, "error": "..."} with exit code 1. example.output.json contains the result without the CLI envelope. Import callers receive exceptions for invalid input.
Example input
{
"files": [
{
"path": "hello.txt",
"text": "hello"
}
]
}
Example result
{
"profile": "arcomm-text-manifest-v1",
"files": [
{
"path": "hello.txt",
"bytes": 5,
"sha256": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
}
],
"root_sha256": "82797ad6b037f682347241ece993a6c9a7ceb4d29820f2daad316954ea414e4b"
}
Boundaries
The input is text, not arbitrary binary files. Digests establish byte identity, not authenticity or trust. The path profile is deliberately portable and narrower than POSIX; it is not a ZIP extraction security boundary. A host that writes files must also enforce symlink and filesystem boundaries.
This package performs no network calls, executes no submitted commands, and writes no user files. Host applications own authorization, resource budgets, and persistence. Example values are fixtures, not recommended policies or limits.
Acceptance and provenance
cases.json records named expected results and rejection cases. test_baseline.py runs those cases and checks the command-line contract. manifest.json records file digests. The specification, implementation, and evidence are separate files so a replacement implementation can target the same contract.
Original code and examples generated for this Arcomm collection. No third-party code is bundled. Read LICENSE for reuse terms.
Download
SHA-256: da22ad14f376c26a380484d757a861c0a765b27845b0188df0bc33a79cb915df
Size: 7217 bytes.