SHIVA ArticleMap
A self-contained reference implementation for deterministic scientific release
bundling. One Python package, one YAML schema, three CLI verbs — ship,
verify, capsule — and a self-contained HTML capsule
application with the entire source code embedded. Adapter-ready for Sigstore,
Rekor, OpenTimestamps, and PAR2 redundancy.
articlemap.yaml + JSON Schemabuild/AM-2026-001shiva_registry/ship.
verify.
capsule.
Each verb is a complete, scripted contract. Same inputs → same outputs, byte for byte.
No internet required.
The whole pipeline runs locally. External providers are pluggable via swap-in adapters; everything else is in the package.
Canonicalization
Deterministic ordering so the same workspace produces the same bytes.
Schema validation
Every input checked against the published articlemap.schema.json.
File hashing
SHA-256 per file. Listed in the manifest with its byte-size and path.
Merkle roots
Bottom-up tree across the manifest. Single root in the signed seal.
DSSE signing + verification
Ed25519 envelopes around the manifest. Self-verifiable with the public key.
Local transparency log
Rekor-style checkpoint + verification, without needing a public log server.
Local timestamp receipts
OpenTimestamps-style receipts emitted and verified locally.
Deterministic zip
Same inputs → byte-identical zip. No timestamps in the archive metadata.
HTML capsule generation
Single-file viewer with the entire src/ tree embedded and indexable.
Pluggable providers for higher-trust modes.
Native PAR2 generation if par2 is installed locally. External Sigstore / Rekor / OpenTimestamps providers via provider swap, when you do want public anchoring.