Develop

.github/workflows/ci.yml

@@ -36,6 +36,30 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Checkout coreason-manifest
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: CoReason-AI/coreason-manifest
+          ref: develop
+          path: coreason-manifest
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-manifest as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-manifest'); dst=os.path.abspath('../coreason-manifest'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
+      - name: Checkout coreason-urn-authority
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: CoReason-AI/coreason-urn-authority
+          ref: develop
+          path: coreason-urn-authority
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-urn-authority as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-urn-authority'); dst=os.path.abspath('../coreason-urn-authority'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
@@ -91,6 +115,30 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Checkout coreason-manifest
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: CoReason-AI/coreason-manifest
+          ref: develop
+          path: coreason-manifest
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-manifest as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-manifest'); dst=os.path.abspath('../coreason-manifest'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
+      - name: Checkout coreason-urn-authority
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: CoReason-AI/coreason-urn-authority
+          ref: develop
+          path: coreason-urn-authority
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-urn-authority as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-urn-authority'); dst=os.path.abspath('../coreason-urn-authority'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
@@ -140,6 +188,30 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Checkout coreason-manifest
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: CoReason-AI/coreason-manifest
+          ref: develop
+          path: coreason-manifest
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-manifest as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-manifest'); dst=os.path.abspath('../coreason-manifest'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
+      - name: Checkout coreason-urn-authority
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: CoReason-AI/coreason-urn-authority
+          ref: develop
+          path: coreason-urn-authority
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-urn-authority as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-urn-authority'); dst=os.path.abspath('../coreason-urn-authority'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
@@ -175,6 +247,30 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Checkout coreason-manifest
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: CoReason-AI/coreason-manifest
+          ref: develop
+          path: coreason-manifest
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-manifest as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-manifest'); dst=os.path.abspath('../coreason-manifest'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
+      - name: Checkout coreason-urn-authority
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: CoReason-AI/coreason-urn-authority
+          ref: develop
+          path: coreason-urn-authority
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-urn-authority as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-urn-authority'); dst=os.path.abspath('../coreason-urn-authority'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:

.github/workflows/publish.yml

@@ -37,6 +37,18 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Checkout coreason-manifest
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: CoReason-AI/coreason-manifest
+          ref: develop
+          path: coreason-manifest
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-manifest as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-manifest'); dst=os.path.abspath('../coreason-manifest'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
       - name: Install uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
@@ -132,6 +144,18 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Checkout coreason-manifest
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: CoReason-AI/coreason-manifest
+          ref: develop
+          path: coreason-manifest
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-manifest as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-manifest'); dst=os.path.abspath('../coreason-manifest'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.3.0
 

.github/workflows/scorecard.yml

@@ -4,7 +4,7 @@ on:
   schedule:
     - cron: '30 1 * * 6'
   push:
-    branches: [ "main", "develop" ]
+    branches: [ "main" ]
 
 permissions: read-all
 

.github/workflows/security.yml

@@ -39,6 +39,30 @@ jobs:
 
       - uses: actions/checkout@v4
 
+      - name: Checkout coreason-manifest
+        uses: actions/checkout@v4
+        with:
+          repository: CoReason-AI/coreason-manifest
+          ref: develop
+          path: coreason-manifest
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-manifest as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-manifest'); dst=os.path.abspath('../coreason-manifest'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
+      - name: Checkout coreason-urn-authority
+        uses: actions/checkout@v4
+        with:
+          repository: CoReason-AI/coreason-urn-authority
+          ref: develop
+          path: coreason-urn-authority
+          token: ${{ secrets.GHCR_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Link coreason-urn-authority as sibling
+        run: python -c "import os, shutil; src=os.path.abspath('coreason-urn-authority'); dst=os.path.abspath('../coreason-urn-authority'); (os.remove(dst) if os.path.islink(dst) else (shutil.rmtree(dst) if os.path.isdir(dst) else os.remove(dst))) if (os.path.exists(dst) or os.path.islink(dst)) else None; os.symlink(src, dst, target_is_directory=True)"
+        shell: bash
+
       - name: Install uv
         uses: astral-sh/setup-uv@v5
         with:

Dockerfile

@@ -21,6 +21,12 @@ COPY pyproject.toml uv.lock ./
 # Copy .git if it exists for versioning
 COPY .gi[t] ./.git/
 
+# Copy local manifest dependency to satisfy path dependency
+COPY coreason-manifest* /coreason-manifest/
+
+# Copy local urn-authority dependency to satisfy path dependency
+COPY coreason-urn-authority* /coreason-urn-authority/
+
 # Copy the project files
 COPY src/ ./src/
 COPY README.md .

pyproject.toml

@@ -15,7 +15,7 @@ authors = [
     { name = "Gowtham A Rao", email = "gowtham.rao@coreason.ai" },
 ]
 dependencies = [
-    "coreason-manifest==0.80.0",
+    "coreason-manifest==0.81.0",
     "coreason-urn-authority>=0.11.1",
     "httpx>=0.28.1",
     "hvac>=2.4.0",
@@ -116,5 +116,9 @@ prerelease = "allow"
 
 
 
+[tool.uv.sources]
+coreason-manifest = { path = "../coreason-manifest" }
+coreason-urn-authority = { path = "../coreason-urn-authority" }
+
 [tool.hatch.metadata]
 allow-direct-references = true

src/coreason_meta_engineering/pvv.py

@@ -27,9 +27,9 @@
 from typing import Any
 
 from coreason_manifest.spec import CognitiveDeliberativeEnvelopeState, OracleExecutionReceipt
-from coreason_urn_authority.crypto.hasher import compute_canonical_hash
 from pydantic import BaseModel
 
+from coreason_meta_engineering.utils.hasher import compute_canonical_hash
 from coreason_meta_engineering.utils.logger import logger
 
 

src/coreason_meta_engineering/utils/hasher.py

@@ -0,0 +1,21 @@
+# Copyright (c) 2026 CoReason, Inc
+#
+# This software is proprietary and dual-licensed
+# Licensed under the Prosperity Public License 3.0 (the "License")
+# A copy of the license is available at <https://prosperitylicense.com/versions/3.0.0>
+# For details, see the LICENSE file
+# Commercial use beyond a 30-day trial requires a separate license
+#
+# Source Code: <https://github.com/CoReason-AI/coreason-meta-engineering>
+
+import hashlib
+
+
+def compute_canonical_hash(payload: str | bytes) -> str:
+    """Computes a SHA-256 hash for a raw string or bytes payload.
+
+    Ensures that AST payloads are hashed using the authoritative ledger crypto.
+    """
+    if isinstance(payload, str):
+        payload = payload.encode("utf-8")
+    return hashlib.sha256(payload).hexdigest()

tests/test_pvv.py

@@ -12,14 +12,14 @@
 
 import pytest
 from coreason_manifest.spec import CognitiveDeliberativeEnvelopeState, OracleExecutionReceipt
-from coreason_urn_authority.crypto.hasher import compute_canonical_hash
 
 from coreason_meta_engineering.pvv import (
     _epistemic_strip,
     _generate_receipt,
     _native_validation,
     execute_pvv_pipeline,
 )
+from coreason_meta_engineering.utils.hasher import compute_canonical_hash
 
 # ═════════════════════════════════════════════════════════════════════════════
 # Phase 1: Epistemic Strip