Credibility pass: README accuracy, first-touch CLI guards, scanner removal, PyPI metadata#29
Conversation
Scanner, InventoryScanner, ModelCandidate, ScanReport and the ScannerRegistry were deprecated in v0.4.0 with removal promised for v0.5.0; they survived to v0.7.7. Their replacement is the SourceConnector protocol with DataNode + Ledger.add()/connect(). Removes the module, its 35 tests, and the two top-level re-exports (ModelCandidate, Scanner). No other code imported it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Vignesh Narayanaswamy <Vigneshn@squareup.com>
README: CI and downloads badges, production-scale benchmark callout (28.8k models / 212k events, sub-second — sourced to CHANGELOG v0.7.4), architecture diagram, security policy link, maintainer credit. The 'For organizations' section now states that the SR 11-7/SR 26-2, EU AI Act Annex IV, and NIST AI RMF validation profiles ship in the OSS core (model_ledger.validate) — it previously implied they lived in a downstream internal package. Docs: all Ledger examples persist to ./ledger.db instead of ./inventory.db, which collided with the CLI's legacy Inventory-format default (runtime guard lands in the next commit). Quickstart history() example now shows newest-first output and CI-asserts the ordering. Landing page notes the project was born at Block and runs in production there. Stale-reference sweep: MCP tool count 6 -> 8 in the server docstring and CLAUDE.md, v0.3.0 markers out of SDK docstrings, 'Task 11' comments out of rest/app.py. CHANGELOG: fold two stale Unreleased blocks into the releases that shipped them (v0.7.3 per PRs #5-#9, v0.4.8 per its own bump commit) and open a fresh Unreleased section. Add SECURITY.md (GitHub private vulnerability reporting) and ignore the .rp1/ workspace directory. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Vignesh Narayanaswamy <Vigneshn@squareup.com>
- Bare install (no [cli] extra): 'model-ledger --help' printed a ModuleNotFoundError traceback for typer. The cli package now falls back to a stub entry point that prints the one-line install hint and exits 1. - Inventory commands pointed at a Ledger event-log database (e.g. the quickstart's ledger.db) raised a raw sqlite 'no such table' error. _get_inventory now sniffs sqlite_master and exits with guidance toward Ledger.from_sqlite() or 'model-ledger mcp'. - 'model-ledger validate --profile <unknown>' raised a ValueError traceback; it now exits 1 listing the available profiles. Tested end to end in a fresh venv: bare-install --help and the quickstart-then-list collision both exit cleanly with guidance. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Vignesh Narayanaswamy <Vigneshn@squareup.com>
Development Status classifier moves from Alpha to Beta — the package has had 10 releases, a four-Python CI matrix, and a production-scale deployment; Alpha undersold it. Keywords gain the terms people actually search: mcp, model-context-protocol, ai-governance, eu-ai-act, nist-ai-rmf, sr-26-2. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Vignesh Narayanaswamy <Vigneshn@squareup.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 48cd36ac6e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| except sqlite3.Error: | ||
| return | ||
| if "snapshots" in names and "versions" not in names: |
There was a problem hiding this comment.
When this is run against a Ledger DB that was already pointed at an older model-ledger list/show/... once, the legacy SQLiteBackend will have created an empty versions table before failing (src/model_ledger/backends/sqlite.py:18-37), so this condition no longer matches even though the models table is still the Ledger schema. The command then falls through to Inventory and still raises the raw SELECT data FROM models sqlite error (src/model_ledger/backends/sqlite.py:52-54), which is exactly the quickstart-collision path this guard is meant to fix for users upgrading after seeing the traceback. Consider detecting the Ledger schema by the presence/columns of snapshots/models rather than requiring versions to be absent.
Useful? React with 👍 / 👎.
1 participant
What
Four self-contained changes that make the public surface match the code:
1.
refactor!: remove thescannermodule — deprecated in v0.4.0 with removal promised for v0.5.0; survived to v0.7.7. Its replacement (SourceConnector+DataNode+Ledger.add()/connect()) has been the documented path for months. Removes the module, its 35 tests, and the two top-level re-exports.2.
docs: credibility and accuracy passmodel_ledger.validate: SR 11-7/SR 26-2, EU AI Act Annex IV, NIST AI RMF)./ledger.db— the old./inventory.dbname collided with the CLI's legacy Inventory-format defaulthistory()example claimed chronological order; output is newest-first. Fixed and now CI-asserted via the executable-docs testv0.3.0markers out of SDK docstrings, "Task 11" comments out ofrest/app.py, two staleUnreleasedCHANGELOG blocks folded into the releases that shipped them (v0.7.3, v0.4.8)3.
fix(cli): friendly errors on the three first-touch failure pathsmodel-ledger --helpno longer tracebacks; prints thepip install "model-ledger[cli]"hintvalidate --profile <unknown>exits listing available profiles instead of raising4.
chore: PyPI metadata — Development Status Alpha→Beta; keywords addmcp,model-context-protocol,ai-governance,eu-ai-act,nist-ai-rmf,sr-26-2.Testing
mkdocs build --strictclean🤖 Generated with Claude Code