ProofFrame 0.7.2 · Rust native
Give it a strict Arrow contract. Get exact findings, a deterministic fingerprint, a keyed diff, and evidence you can verify.
pip install proofframe==0.7.2 · cargo add proofframe@0.7.2
Runs in your browser
This one is not a replay. The ProofFrame engine itself is compiled to WebAssembly and runs inside this tab, so your file is never uploaded anywhere. The version it reports below is the build you are running.
ProofFrame reads the file, infers a draft contract from what it finds, and refuses to run it until you have reviewed it.
Current release · September 2026
Airflow and Dagster get real packages instead of a sample DAG, and both call the engine in process rather than shelling out to the CLI. The decision a scan returns has three states; each scheduler offers two, so neither mapping is left to the caller.
ProofFrameAcceptOperator scans a file against a contract inside the worker, so the library's exception types survive and the engine's own memory and temporary-storage limits are the ones that apply. ProofFrameVerifyOperator checks a bundle another task produced, and rescans nothing.
build_acceptance_check returns an asset check, so a rejected dataset appears on the asset that produced it rather than in a separate op nobody reads. Blocking by default, so downstream assets wait for a verdict.
Rejected is an error: the data was scanned and did not qualify. Unknown is a warning: the scan never completed, so nothing was decided. Collapsing unknown into a failure would report a decision that was never made, and collapsing it into a pass would report one made the other way.
XCom lives in the scheduler's metadata database and a bundle carries the full report and the Evidence V2 envelope. The decision, the digests that identify it, and the path the bundle was written to go through instead.
The same bytes under the same contract cannot reach a different decision, so a rejection raises Airflow's non-retryable failure. Unknown is the one status a retry can legitimately change, and it is the one left configurable.
A bundle is hash-bound unless you give it a key. Both packages report whether the bundle they produced carries a signature rather than implying every bundle does.
Know what was checked. Keep proof of what changed.
The proof loop
ProofFrame keeps the dataset, the rules, the execution limits, and the result tied together.
Unknown fields, missing columns, invalid bounds, and type mismatches fail before the first row is scanned.
Counts stay exact while retained findings stay bounded. You see where the rule broke without unbounded output.
Fingerprints and digests bind source identity, schema, contract, plan, resources, and result into one verifiable record.
How it works
Python and Rust meet at the same Arrow-native engine. There is no expression language interpreting rows at runtime.
Write column, cross-column, conditional, dataset, and partition rules as a versioned JSON contract.
Run against PyArrow, Pandas, Polars, CSV, Parquet, or streams with explicit memory and temporary-storage limits.
Persist deterministic Evidence V2 or sign a Receipt V2, then verify it independently in CI or production.
Evidence anatomy
Every digest has one job. Together they make silent changes visible and reproducible.
Corrupt spill data, incompatible schemas, ambiguous contracts, and exceeded limits return explicit failures. Signed receipts keep cryptographic validity separate from signer trust.
Open source · Apache 2.0
Use the Python package or Rust crate. The same native engine compiles the same contract and emits the same evidence model.
$ pip install proofframe==0.7.2 # strict check + Evidence V2 checked = pf.check_with_evidence( table, contract, max_samples=20 )
FAQ
Yes. The linter runs the engine compiled to WebAssembly, in your tab. Your file is not uploaded, the report and the fingerprint come from the engine, and the HTML review you download is the file the CLI writes.
The V2 protocol binds physical Arrow schema, row and column order, nulls, type tags, and canonical values. It stays stable across record-batch boundaries.
Exact uniqueness, keyed diff, and related operations use explicit memory and temporary-storage budgets. They spill to checksummed sorted runs and fail closed when a configured limit is exceeded.
Version 0.7.2 ships Python wheels and a Rust crate with cross-platform CI, versioned contracts, frozen fingerprint protocols, Evidence V2, Receipt V2, acceptance bundles, and release provenance. Evaluate it against your own reliability requirements before critical adoption.
Proof over promises
Start with one contract, one pipeline, and evidence you can inspect after the job is gone.
View ProofFrame on GitHub