Limen

Actively maintained: continuous commit and release activity (releases are automated on every merge to main), plus weekly dependency updates via Dependabot. See https://github.com/Vaquum/Limen/pulse

Bug reports and enhancement requests are tracked in the GitHub issue tracker: https://github.com/Vaquum/Limen/issues

https://github.com/Vaquum/Limen/blob/main/SECURITY.md commits: reporters are credited in the release notes and CHANGELOG.md entry of the fix unless they request otherwise.

https://github.com/Vaquum/Limen/blob/main/SECURITY.md documents the private reporting channel (GitHub Security Advisories), required report content, supported-version policy, and scope; verification failures route through the same channel.

https://github.com/Vaquum/Limen/blob/main/CONTRIBUTING.md plus the developer docs (https://github.com/Vaquum/Limen/blob/main/docs/Developer/README.md) define the coding standard (PEP 8 with house rules, type hints, docstring requirements); ruff configuration in pyproject.toml encodes it.

ruff runs as the required PR Checks Ruff gate on every PR (.github/workflows/pr_checks_ruff.yml), and Pyright strict mode runs as the required PR Checks Pyright gate with a zero-errors, zero-warnings baseline.

Pure Python package built with the standard PEP 517 pipeline (python -m build); there is no C-style build system with conventional flag variables to honor.

No compiled artifacts are produced; the wheel is py3-none-any, so there is no debug information to preserve.

The PEP 517 build is single-invocation (python -m build); no recursive make or equivalent exists.

Distributions build reproducibly: the publish workflow pins SOURCE_DATE_EPOCH, and the required Packaging gate builds the distributions twice and fails unless the artifacts are byte-identical (.github/workflows/pr_checks_packaging.yml).

pip install vaquum-limen (or the documented extras) from PyPI: https://pypi.org/project/vaquum-limen/ - documented on the README front page.

Installation is delegated to pip/PEP 517, which honors the platform's standard conventions for install locations (user site, virtual environments, prefixes).

https://github.com/Vaquum/Limen/blob/main/CONTRIBUTING.md and https://github.com/Vaquum/Limen/blob/main/docs/Developer/README.md give the quick development setup: clone, create the Python 3.10 venv, pip install from requirements, run python -m tests.run and ruff check .

All external dependencies are declared in https://github.com/Vaquum/Limen/blob/main/pyproject.toml ([project.dependencies] and optional extras) with constraints in https://github.com/Vaquum/Limen/blob/main/requirements/constraints.txt; a CycloneDX SBOM ships with every release.

Dependabot monitors the pip and github-actions ecosystems weekly (.github/dependabot.yml), and the required pr_checks_supply gate runs pip-audit on every PR, blocking merge on findings unless a reasoned, expiring exception exists in .github/vuln_exceptions.json.

All reused components are standard PyPI packages installed by pip and updatable independently; no third-party code is vendored into the repository.

The public API is documented in the docs corpus and mechanically checked against actual package exports on every PR (tests/test_docs_surface.py::test_package_docs_match_public_exports and test_every_package_root_export_is_documented).

The full suite (python -m tests.run, ~1300 tests including end-to-end manifest-to-experiment integration tests) runs in the required PR Checks Tests gate on every change, with a 92% coverage floor as a separate required check.

CONTRIBUTING.md requires updating tests with any behavior change, and fix PRs carry regression tests as a matter of gate law (tests and coverage floor are required checks); recent fix history on merged PRs shows regression tests accompanying bug fixes.

Statement coverage is enforced at a 92% floor by the required Coverage check (python -m coverage report --fail-under=92); current total is 93%.

https://github.com/Vaquum/Limen/blob/main/CONTRIBUTING.md mandates updating tests with the behavior change; the policy is enforced mechanically by the required Tests and Coverage gates and the slice-gate proof obligations.

The contribution policy requires updating tests with any behavior change, enforced by the required Tests and Coverage gates: https://github.com/Vaquum/Limen/blob/main/CONTRIBUTING.md

Python package so no compiler.

Secure design principles are applied and argued end-to-end in https://github.com/Vaquum/Limen/blob/main/docs/Developer/Security-Assurance-Case.md: least privilege in CI (job-scoped write permissions), no runtime credential handling, fail-loud input validation, economy of mechanism in the release path, and complete mediation of the merge path by required checks.

Limen implements no cryptography of its own; transport security is delegated to the platform TLS stack via standard Python libraries.

The software stores no authentication credentials or private keys; there is nothing requiring credential rotation support.

All network communication (market data download from public dataset hosts) uses HTTPS through standard Python libraries; no custom or unencrypted protocols are used.

TLS configuration is delegated to Python's ssl module defaults on supported platforms, which negotiate TLS 1.2 or higher.

Certificate verification is the library default and is never disabled: the codebase contains no verify=False, CERT_NONE, or hostname-check bypass (greppable), and the docs-surface tests keep examples honest.

The only TLS traffic is public dataset download with no private information transmitted; certificate verification is performed before any request per the default behavior of the HTTP stack.

Releases are cryptographically attested: PyPI distributions carry PEP 740 attestations (see the PyPI integrity API for vaquum-limen), GitHub build-provenance attestations are generated for every release by actions/attest-build-provenance, and the Sigstore bundle is attached to each GitHub release as the provenance.intoto.jsonl asset. Verification is documented in https://github.com/Vaquum/Limen/blob/main/docs/Developer/Release-Policy.md#verifying-release-artifacts

Inputs from potentially untrusted sources are checked against expected structure: YAML manifests are schema-validated fail-loud (bool, zero, negative, and over-budget values rejected), market data frames are validated at load, and malformed artifacts (e.g. corrupt JSONL) are rejected rather than skipped, as pinned by the docs-surface contract tests.

Hardening mechanisms appropriate to a Python research library are applied: strict typing gate (Pyright strict, zero baseline), fail-loud validation everywhere, and a hardened delivery pipeline (SHA-pinned actions, least-privilege tokens, persist-credentials disabled, reproducible builds) pinned by tests/test_packaging_surface.py::test_supply_chain_surfaces.

https://github.com/Vaquum/Limen/blob/main/docs/Developer/Security-Assurance-Case.md provides the assurance case: threat model, five trust boundaries, six security requirements each with an explicit argument and named mechanical evidence, residual risks, and verification commands.

CodeQL (which looks for common vulnerabilities) runs as a required check on every pull request and push to main: https://github.com/Vaquum/Limen/blob/main/.github/workflows/pr_checks_codeql.yml

The shipped software is pure Python (the wheel is py3-none-any); no memory-unsafe language (C/C++) code is produced, so memory-safety-focused dynamic analysis does not apply.