v0.46.0: one JSON, every address, every judgement, one file

One JSON: every address, every judgement, one file.

The package now carries one data file, proximo.json.gz: one row per address the four Proxmox products publish (Virtual Environment, Backup Server, Mail Gateway, Datacenter Manager), plus the shell lane's authored rows, each with the vendor's schema and description and every judgement Proximo makes about it: the blast-radius tier and the sentence that justifies it, a held refusal, the taint channel, the fields withheld from an answer and the arguments fingerprinted in the ledger, a judged create, a container command's snapshot net, the read that shows a mutation's target, where the plane reports its task. DIAGNOSE's battery and proximo_find's vocabulary ride beside the rows, and a built header names every input by hash.

The records are the source; the build is the check. The authored judgements live in records/ in the repo (seven TOML files, each line with its why) and ship in nothing. scripts/build_proximo_json.py joins them onto the vendor's trees and refuses the build, by name, on any line that would do nothing: a tier key that matches no address, a taint line on a tunnel, a create without the twins its undo needs, a shell row the vendor now publishes, a net naming a snapshot the door does not serve. A record edited without a rebuild is red in the suite. A damaged shipped file refuses every address with a sentence, never a traceback.

The engine asks the row. The special cases that knew a command by its path became columns the build computes, visible on the row. Proof that nothing changed: every command-shaped fact the old engine derived, dumped per address and reproduced from the columns, identical on all 1,804 addresses; door contract 1 unchanged; three adversarial lenses over the branch, one BLOCKING and four MAJOR folded, each replanted red.

The door has a contract. docs/door-contract.json is door contract 1: the six tools as tools/list hands them over, the shapes of a find, a plan, a read, an audit read and a call that ran, and the words of every refusal lane a sample reaches. A test holds the shipped door to it; a drift is red until it is made on purpose and announced. Build against the contract number, not the version.

If you pinned table.json.gz by hash: it and apidoc/ are gone from the wheel. Pin proximo.json.gz, or the vendor stage's hash in its built header, which moves only when Proxmox's api-viewer does.

Full history for this release, commit by commit, is on the internal mirror; this
public branch carries one squashed commit per release by design.
Every change here is described in CHANGELOG.md.

Where to read more

• The one JSON and its records: records/README.md
• The door contract, and what a client may build against: docs/door-contract.json
• The trust model, and the honest scope notes saying what does not hold: SECURITY.md
• The six tools and their inputs: docs/TOOLS.md
• Verifying the image signature, the SBOM and the provenance yourself: VERIFY.md
• Full change detail: CHANGELOG.md

Install: uvx proximo-proxmox · pip install proximo-proxmox · ghcr.io/john-broadway/proximo:0.46.0