Skip to content

Apizr 0.2.0

Published 21 September 2026 on PyPI and GitHub.

0.2.0 makes existing Python software inspectable as capabilities before exposing or executing it. The notebook/API/container pipeline is also supported as an independent workflow.

Discover, understand, expose, govern

  • apizr scan . produces a deterministic repository catalog without executing source.
  • apizr graph . describes statically known capability relationships.
  • apizr inspect example.py reports Capability IR and static interface readiness.
  • apizr readiness . assesses catalog/graph evidence under a readiness policy. apizr repository-readiness also accepts previously saved artifacts.
  • apizr generate rest and apizr generate mcp consume the same eligible contracts.
  • apizr execute and governed REST/MCP use explicit local-process or OCI policies.

Try the small example, then read the architecture overview. The compiler commands do not require the legacy pipeline, and discovery/generation do not require Docker.

Compatibility

Use Python 3.11–3.14 for Apizr and generated targets. Select a supported interpreter for your environment and container targets. Imports now use the installed apizr package; CLI generation is non-interactive by default and refuses non-empty output directories. HTTP generation endpoints return artifacts instead of writing caller-selected filesystem paths.

apizr --script ... and apizr --notebook ... remain supported as the Legacy pipeline. This is a compatibility path, not a deprecation announcement. Read the compatibility guide for configuration, dependency inference and HTTP endpoint behavior.

Trust and known limits

Scanning, inspection, readiness and generation do not execute the supplied code. Starting direct servers imports it; governed invocation executes it in an explicit worker. READY is not a runtime safety assessment. Effects often remain unknown.

Execution remains experimental: local workers do not isolate filesystem/network access; OCI requires a trusted Linux Docker host and worker image and is not a VM boundary. Absolute subprocess denial is unsupported (#49). Class/method capabilities are outside the contract (#5); the historical duplicate/overload issue remains (#28). No RBAC, approvals, secrets provider, enterprise control plane or Attest integration is included. Hashable artifacts are not signed attestations.

Verification and maintenance

The release procedure requires Python 3.11–3.14 tests and coverage floors, installed-wheel smoke, legacy containers, dedicated OCI boundary tests, dependency audits, CodeQL and strict documentation builds. Historical measurements remain in the engineering archive; they are not a claim about the final release commit. Publication uses the exact reviewed build artifacts, after all required checks pass.

See maintainer publication instructions.