Metadata-Version: 2.4
Name: ecz-id-dora
Version: 0.1.1
Summary: Inspects operational-resilience evidence posture. Explains and routes only; never a compliance verdict.
Project-URL: Documentation, https://developers.ecocitizenz.com
Project-URL: Machine Interface, https://machine.ecocitizenz.org/.well-known/ecz-machine.json
Project-URL: Resolver, https://resolver.ecocitizenz.org
Project-URL: Operator Setup, https://trustops.ecocitizenz.com/start
Project-URL: Developer Guidance, https://developers.ecocitizenz.com
Author-email: Ecocitizenz <ecocitizenz@gmail.com>
License-Expression: Apache-2.0
License-File: LICENSE
License-File: NOTICE
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Requires-Python: >=3.10
Requires-Dist: ecz-id
Description-Content-Type: text/markdown

# ECZ-ID DORA Readiness Inspection

**You have a DORA operational-resilience register and you need to see, at a
glance, what evidence you have actually declared — and which referenced
files are really on disk — before anyone relies on it.** `ecz-id-dora`
reads your resilience-evidence descriptor and shows exactly what is
**declared**, **present** or **absent**, locally, offline, in one command.

It **inspects, explains and routes only.** It never issues or activates an
ECZ-ID, never determines BOUND, never prices or carts, never executes
discovered project, agent, MCP or robot code. It is **not a DORA
compliance verdict, regulatory approval, audit outcome or statement of
legal sufficiency.** A missing item is a neutral observation, not a
judgement. Missing public proof is neutral. **Local policy decides.
Re-check before reliance.**

`Machine Interface` · `Manifest` · `Resolve` · `Operator Setup` · `Developer Guidance`

## One-command free trial

```console
$ uvx ecz-id-dora inspect ./my-resilience-register
# or: pipx run ecz-id-dora inspect ./my-resilience-register
```

No account, no network and no config required. The public Resolver check is
strictly opt-in (`--check-public`).

## Example result

```text
ECZ-ID inspection: ./my-resilience-register [ecz-id-dora]
A. configuration posture : PRESENT
B. public proof posture  : NOT_CHECKED  (neutral)
means        : Local ECZ-ID configuration was found for this subject. | Public Resolver proof was not checked.
does not mean: This is not a DORA compliance verdict, regulatory approval, audit outcome or statement of legal sufficiency. | ...
reason codes : ECZ-1000, ECZ-2002
```

Export the evidence-readiness table for a register:

```console
$ ecz-id-dora export-csv ./my-resilience-register
evidence_item,declared,file_referenced,file_present
ICT provider identity,true,provider-attestation.txt,true
service inventory,true,,
contract references,true,,
continuity/recovery references,true,recovery-plan.md,true
exit-plan evidence,true,exit-plan.md,true
discontinuation-impact references,true,impact-analysis.md,false
API/package/cloud/SBOM relationships,true,sbom.json,true
```

## Supported inputs

- A directory or descriptor file. Recognised names:
  `resilience_evidence.json`, `dora_evidence.json`, `dora_register.json`.
- Declared sections observed as neutral findings: ICT vendor / provider
  identity; service inventory and customer/service relationships; contract
  references; provider/subcontractor mapping; operational locations;
  important-function references; substitutability declarations and
  alternatives; continuity / recovery references; incident contacts;
  exit-plan evidence; discontinuation-impact references; and
  API / package / cloud / SBOM relationships.
- Where a section names an evidence file, that file's **presence under the
  inspected root** is reported (present / absent). Files are matched by
  basename inside the root only; the root is never escaped and symlinks are
  refused.

## Free capabilities

- Two-sided posture: local configuration evidence vs public Resolver
  evidence.
- `export-csv` — a deterministic evidence-readiness table of
  `evidence_item, declared, file_referenced, file_present`.
- `compare` for drift; JSON / Markdown / text / SARIF / CSV output;
  secret redaction on every export.

## Unsupported inputs

- Not a resilience scanner, uptime monitor, penetration tester or crawler.
- Does not open, validate or attest the *content* of any referenced
  evidence file — only whether it is present.
- Does not fetch or execute your project, and never follows arbitrary
  redirects to internal hosts.

## What the result means

`PRESENT / PARTIAL / ABSENT / INVALID` describes your **local**
resilience-evidence register: whether a register was found, how much of the
expected evidence it declares, and whether it parses. `PROOF_FOUND` or a
neutral posture describes **public** Resolver evidence.

## What it does not mean

Not a safety, approval, insurance or premium decision. **Not a DORA
compliance verdict, regulatory approval, audit outcome or statement of
legal sufficiency.** "Declared" and "present" describe what the descriptor
records and what is on disk — nothing about adequacy or correctness.
Missing public proof is neutral — it does not mean unsafe.

## Compare / drift

```console
$ ecz-id-dora compare ./last-review ./current --json
```

Shows posture changes and reason-code / finding additions and removals —
useful in review and on a schedule.

## CI use

```console
$ ecz-id-dora inspect . --sarif > dora.sarif      # upload to code scanning
$ ecz-id-dora inspect . --json  > dora.json       # exit 0 for any completed inspection
$ ecz-id-dora export-csv . > dora-evidence.csv    # evidence-readiness table
```

Exit code is `0` for every completed inspection regardless of posture
(the neutrality rule); non-zero only for genuine input / tool errors.

## Machine-readable integration

Machine Interface · Manifest · Resolver · Operator setup · Developer guidance

Each installation includes structured machine-readable metadata for automation,
CI and supported integrations. Every JSON report embeds a compact
`machine_interface` object with the canonical roots and safe, read-only actions.

The package runs locally to inspect, explain and route. It does not issue an
ECZ-ID, write canonical truth, create public proof, price a cart, or replace
Resolver proof.

- Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json
- Manifest: `ecz-id-dora manifest --json`
- Resolver (read-only public proof): https://resolver.ecocitizenz.org
- Operator setup (TrustOps): https://trustops.ecocitizenz.com/start
- Developer Gateway: https://developers.ecocitizenz.com

If you operate the target and choose to begin, TrustOps handles operator setup,
acquisition, lifecycle and repair. This package only routes you there; it never
prices, carts or sells.

## Privacy and no telemetry

Bounded, read-only, symlink-refusing inspection. No telemetry, no source
upload. The optional public check sends only minimal safe context (source,
package, version, typed intent) to validated public hosts over HTTPS.
Secrets are redacted on every export. Offline mode
(`--offline` / `ECZ_ID_OFFLINE=1`) skips all network.

## Continue with ECZ-ID

- Operator setup: https://trustops.ecocitizenz.com/start
- Developer guidance: https://developers.ecocitizenz.com
- Public Resolver proof: https://resolver.ecocitizenz.org
- Central Machine Interface: https://machine.ecocitizenz.org/.well-known/ecz-machine.json
- EcoCitizenz: https://www.ecocitizenz.com
- Specifications and governance: https://www.ecocitizenz.org
- ECZ-ID on Visual Studio Marketplace: https://marketplace.visualstudio.com/publishers/ecocitizenz
- ECZ-ID on Open VSX: https://open-vsx.org/namespace/ecocitizenz
- Explore the ECZ-ID Python tool family: https://pypi.org/search/?q=ecz-id

## Licence and trademarks

Apache-2.0. See `LICENSE` and `NOTICE`.

The Apache-2.0 code licence grants **no** trademark rights. "ECZ-ID",
"EcoCitizenz" and related names and logos are trademarks of their owner(s).
See `TRADEMARKS.md`. See `CHANGELOG.md` and `SECURITY.md` at the repository
root.

CLI: `ecz-id-dora` &nbsp;|&nbsp; Import: `ecz_id_dora` &nbsp;|&nbsp; Plugin group: `ecz_id.plugins`
