ARC Reference Core alpha

ARC Reference Core alpha is a non-normative Python reference implementation for a bounded subset of ARC Protocol authority projection. Its encoding, security, ordering, scope, binding, and key-lifecycle profiles are selected by this package. They are not ARC Canon, an ARC wire format, or an interoperability or conformance standard.

The current alpha baseline covers structural Event validation, deterministic Event and Event-set identity, explicit ordering and completeness inputs, package-selected key lifecycle, closed scope and exact binding checks, authority projection, and process-local replay support. The Stage 1–3 baseline is fixed by 93 tests, including adversarial cases.

The first application consumer is the software_deployment path in ARC Execution Gate. That integration computes a structural authority projection before applying its existing application policy. GateDecision, replay consumption, dispatch, and receipts remain outside this Core.

Install from a checkout

This alpha is not published as an automatically installed package dependency. Use a local checkout and a current Python packaging toolchain:

python3 -m venv .venv
. .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install -e .

The optional Ed25519 profile uses the external cryptography package:

python -m pip install -e '.[ed25519]'

Test

From the repository root, with the optional dependency installed:

PYTHONPATH=src python -m unittest discover -v

The current baseline passes 93 tests. Ed25519 test keys are generated only in memory during the test run.

Public API and design

• API.md describes the public import surface and result contract.
• DESIGN.md records the selected package boundaries.
• STAGE3_TRACEABILITY.md maps the adversarial validation baseline to the ARC probes and records unresolved seams.

The root package exports frozen Event and validation models, profile interfaces, the authority projector and result types, and in-memory EventStore and ReplayStore implementations. Concrete package-selected profiles are exported from arc_reference_core.profiles.

Security and authority limits

A structural projection does not establish signature verification, key provenance, root trust, key custody, authenticated causal ordering, or evidence completeness. The optional Ed25519 profile can verify signature bytes under explicitly supplied key material; it does not establish why that material or a caller-selected principal root should be trusted.

The Core does not return ALLOW, DENY, REQUIRE_APPROVAL, or REVOKED. Application policy owns those decisions. The included ReplayStore is process-local application support and provides no durable, distributed, or exactly-once guarantee.

Unresolved root/bootstrap authority, caller-declared ordering authority, descendant key-revocation propagation, and completeness provenance block production authorization and public conformance claims. This alpha is not a production authorization system.

License

Licensed under the Apache License 2.0. See LICENSE.