feat: add experimental Python spec authoring

[armstrongsam25]

Python backends currently have to assemble json-render's UI wire format by hand. This change adds an installable, typed Python package with Spec, Element, and ActionBinding dataclasses that emit the existing field names, check element references, and preserve event/state bindings and false/empty/null values.

Catalog consumes JSON Schema exported by the application's TypeScript catalog instead of recreating Zod in Python. It validates the supplied schema exactly, returns detached JSON, and does not fetch external references. This is a proposed first slice for #7; API naming, distribution ownership, dependency policy, and future native Python catalog definitions still need maintainer agreement. The package is alpha, source-install only, and has no PyPI publishing workflow.

The current React export omits runtime on, watch, and state fields and is lenient about props when multiple components exist. The package documents those limits, preserves the original wire JSON, and checks event/action compatibility separately. Rendering, prompt generation, expression/action execution, streaming, and Pydantic catalog authoring remain outside this initial version.

Validation:

• Built a wheel and source distribution; installed the wheel and passed isolated import/serialization checks on Python 3.10 and 3.14.
• 16 Python tests pass on 3.10, 3.12, and 3.14. Four TypeScript interoperability checks pass, including a real catalog export with invalid-spec controls and state-bound action resolution. The interop suite's TypeScript check passes.
• pnpm type-check passes across all 60 tasks; web dependency and production builds pass; all 122 docs route/parity checks pass. Only the intentionally changed Specs-page parity entry was updated.
• Added Python 3.10/3.14 CI jobs, package/root/Specs documentation, and core skill guidance.

Contributed by Sam Armstrong with Personal AI Labs.

[vercel]

@armstrongsam25 is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​actions/​setup-python@​a26af69be951a213d495a4c3e4e4022e16d87065
	pypi/​hatchling@​1.32.4
	pypi/​jsonschema@​4.26.0
	pypi/​referencing@​0.37.0

View full report