igniter 0.4.5 → 0.5.1

data/packages/igniter-cluster/lib/igniter/cluster/governance/stores/file_store.rb

@@ -0,0 +1,249 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+
+module Igniter
+  module Cluster
+    module Governance
+      module Stores
+        class FileStore
+          attr_reader :path, :max_events, :archive_path, :retention_policy
+
+          def initialize(path:, max_events: nil, archive_path: nil, retention_policy: nil)
+            @path = path
+            @max_events = max_events&.to_i
+            @archive_path = archive_path
+            @retention_policy = normalize_retention_policy(retention_policy)
+            FileUtils.mkdir_p(File.dirname(path))
+            FileUtils.mkdir_p(File.dirname(archive_path)) if archive_path
+          end
+
+          def append(event)
+            File.open(path, "a") do |file|
+              file.puts(JSON.generate(event))
+            end
+            rotate_if_needed!
+            event
+          end
+
+          def load_events
+            return [] unless File.exist?(path)
+
+            File.readlines(path, chomp: true).filter_map do |line|
+              next if line.strip.empty?
+
+              deep_symbolize(JSON.parse(line))
+            rescue JSON::ParserError
+              next
+            end
+          end
+
+          def clear!
+            FileUtils.rm_f(path)
+            FileUtils.rm_f(archive_path) if archive_path
+            self
+          end
+
+          def retained_limit
+            max_events
+          end
+
+          # Rewrite the log file to contain exactly the given events (compaction).
+          #
+          # @param events [Array<Hash>]
+          # @return [self]
+          def compact!(events)
+            lines = Array(events).map { |e| JSON.generate(e) }
+            File.write(path, lines.empty? ? "" : "#{lines.join("\n")}\n")
+            self
+          end
+
+          def prune_events(events)
+            pruned = if retention_policy.empty?
+                       prune_by_total_limit(Array(events))
+                     else
+                       prune_by_class_policy(Array(events))
+                     end
+
+            pruned.map { |event| deep_symbolize(event) }
+          end
+
+          def persistence_metadata
+            {
+              enabled: true,
+              store_class: self.class.name,
+              path: path,
+              max_events: max_events,
+              retention_policy: retention_policy,
+              retained_by_class: counts_by_class(load_events),
+              archive_path: archive_path,
+              archived_events: archived_events_count,
+              archived_by_class: counts_by_class(load_archive_events)
+            }.compact
+          end
+
+          private
+
+          def deep_symbolize(value)
+            case value
+            when Hash
+              value.each_with_object({}) do |(key, nested), memo|
+                memo[key.to_sym] = deep_symbolize(nested)
+              end
+            when Array
+              value.map { |item| deep_symbolize(item) }
+            else
+              value
+            end
+          end
+
+          def rotate_if_needed!
+            return unless File.exist?(path)
+
+            entries = File.readlines(path, chomp: true).filter_map do |line|
+              next if line.strip.empty?
+
+              parsed = JSON.parse(line)
+              { line: line, event: deep_symbolize(parsed) }
+            rescue JSON::ParserError
+              next
+            end
+
+            retained_entries = if retention_policy.empty?
+                                 prune_entries_by_total_limit(entries)
+                               else
+                                 prune_entries_by_class_policy(entries)
+                               end
+            return if retained_entries.size == entries.size
+
+            retained_event_ids = retained_entries.map { |entry| entry.dig(:event, :event_id) }
+            overflow = entries.reject { |entry| retained_event_ids.include?(entry.dig(:event, :event_id)) }.map { |entry| entry[:line] }
+            retained_lines = retained_entries.map { |entry| entry[:line] }
+            append_archive_lines(overflow)
+            File.write(path, retained_lines.empty? ? "" : "#{retained_lines.join("\n")}\n")
+          end
+
+          def append_archive_lines(lines)
+            return if lines.empty? || archive_path.nil?
+
+            File.open(archive_path, "a") do |file|
+              lines.each { |line| file.puts(line) }
+            end
+          end
+
+          def archived_events_count
+            return 0 unless archive_path && File.exist?(archive_path)
+
+            File.foreach(archive_path).count
+          end
+
+          def load_archive_events
+            return [] unless archive_path && File.exist?(archive_path)
+
+            File.readlines(archive_path, chomp: true).filter_map do |line|
+              next if line.strip.empty?
+
+              deep_symbolize(JSON.parse(line))
+            rescue JSON::ParserError
+              next
+            end
+          end
+
+          def normalize_retention_policy(policy)
+            Array(policy || {}).each_with_object({}) do |(key, value), memo|
+              next if value.nil?
+
+              memo[key.to_sym] = value.to_i
+            end
+          end
+
+          def prune_by_total_limit(events)
+            return events unless max_events && max_events.positive?
+            return events if events.size <= max_events
+
+            events.last(max_events)
+          end
+
+          def prune_entries_by_total_limit(entries)
+            return entries unless max_events && max_events.positive?
+            return entries if entries.size <= max_events
+
+            entries.last(max_events)
+          end
+
+          def prune_by_class_policy(events)
+            return prune_by_total_limit(events) if retention_policy.empty?
+
+            keep_indexes = []
+            counters = Hash.new(0)
+
+            (events.length - 1).downto(0) do |index|
+              event = events[index]
+              event_class = classify_event(event)
+              limit = limit_for_class(event_class)
+              if limit.nil?
+                keep_indexes << index
+                next
+              end
+
+              next unless counters[event_class] < limit
+
+              counters[event_class] += 1
+              keep_indexes << index
+            end
+
+            events.values_at(*keep_indexes.sort)
+          end
+
+          def prune_entries_by_class_policy(entries)
+            return prune_entries_by_total_limit(entries) if retention_policy.empty?
+
+            keep_indexes = []
+            counters = Hash.new(0)
+
+            (entries.length - 1).downto(0) do |index|
+              entry = entries[index]
+              event_class = classify_event(entry[:event])
+              limit = limit_for_class(event_class)
+              if limit.nil?
+                keep_indexes << index
+                next
+              end
+
+              next unless counters[event_class] < limit
+
+              counters[event_class] += 1
+              keep_indexes << index
+            end
+
+            entries.values_at(*keep_indexes.sort)
+          end
+
+          def classify_event(event)
+            type = event[:type].to_s
+
+            return :applied if type.include?("applied")
+            return :blocked if type.include?("blocked")
+            return :planning if type.include?("plan")
+
+            :other
+          end
+
+          def limit_for_class(event_class)
+            return retention_policy[event_class] if retention_policy.key?(event_class)
+            return retention_policy[:default] if retention_policy.key?(:default)
+
+            nil
+          end
+
+          def counts_by_class(events)
+            Array(events).each_with_object(Hash.new(0)) do |event, memo|
+              memo[classify_event(event)] += 1
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/packages/igniter-cluster/lib/igniter/cluster/governance/trail.rb

@@ -0,0 +1,164 @@
+# frozen_string_literal: true
+
+require "securerandom"
+require "time"
+
+module Igniter
+  module Cluster
+    module Governance
+      class Trail
+        attr_reader :store, :compaction_history
+
+        def initialize(store: nil, clock: -> { Time.now.utc.iso8601 })
+          @store = store
+          @clock = clock
+          @events = Array(store&.load_events).map { |event| normalize_loaded_event(event).freeze }
+          @compaction_history = []
+        end
+
+        def record(type, source:, payload: {})
+          event = {
+            event_id: SecureRandom.uuid,
+            type: type.to_sym,
+            source: source.to_sym,
+            timestamp: @clock.call,
+            payload: deep_dup(payload)
+          }.freeze
+
+          @events << event
+          store&.append(event)
+          prune_retained_events!
+          event
+        end
+
+        def events(limit: nil)
+          selected = limit ? @events.last(limit) : @events
+          selected.map(&:dup)
+        end
+
+        def snapshot(limit: 10)
+          {
+            total: @events.size,
+            latest_type: @events.last&.dig(:type),
+            latest_at: @events.last&.dig(:timestamp),
+            by_type: @events.each_with_object(Hash.new(0)) { |event, memo| memo[event[:type]] += 1 },
+            persistence: persistence_metadata,
+            events: events(limit: limit)
+          }
+        end
+
+        def clear!
+          @events.clear
+          store&.clear!
+          self
+        end
+
+        # Collapse old events into a signed Checkpoint, keeping only the most
+        # recent `keep_last` events in memory and on disk.
+        #
+        # @param keep_last  [Integer]  how many recent events to retain
+        # @param identity   [Identity, nil]  when provided, signs the checkpoint
+        # @param peer_name  [String, nil]
+        # @param previous   [Checkpoint, nil]  checkpoint to chain from
+        # @return [CompactionRecord]
+        def compact!(keep_last: 20, identity: nil, peer_name: nil, previous: nil)
+          removed_count = [@events.size - keep_last, 0].max
+          checkpoint = if identity
+                         Checkpoint.build(
+                           identity: identity,
+                           peer_name: peer_name || "unknown",
+                           trail: self,
+                           limit: keep_last,
+                           previous: previous
+                         )
+                       end
+
+          @events = @events.last(keep_last)
+          store.compact!(@events) if store.respond_to?(:compact!)
+
+          kept_count = @events.size
+          digest = checkpoint&.crest_digest
+
+          record(:trail_compacted, source: :trail, payload: {
+            removed_events: removed_count,
+            kept_events:    kept_count,
+            checkpoint_digest: digest
+          })
+
+          rec = CompactionRecord.new(
+            checkpoint:        checkpoint,
+            removed_events:    removed_count,
+            kept_events:       kept_count,
+            checkpoint_digest: digest
+          )
+          @compaction_history << rec
+          rec
+        end
+
+        # All events recorded after the given Checkpoint's timestamp.
+        # Returns all events when checkpoint is nil.
+        #
+        # @param checkpoint [Checkpoint, nil]
+        # @return [Array<Hash>]
+        def events_since(checkpoint)
+          return @events.dup unless checkpoint
+
+          since_ts = Time.parse(checkpoint.checkpointed_at.to_s) rescue nil
+          return @events.dup unless since_ts
+
+          @events.select do |e|
+            ts = Time.parse(e[:timestamp].to_s) rescue nil
+            ts && ts > since_ts
+          end
+        end
+
+        private
+
+        def deep_dup(value)
+          case value
+          when Hash
+            value.each_with_object({}) do |(key, nested), memo|
+              memo[key] = deep_dup(nested)
+            end
+          when Array
+            value.map { |item| deep_dup(item) }
+          else
+            value
+          end
+        end
+
+        def normalize_loaded_event(event)
+          loaded = deep_dup(event)
+          loaded[:type] = loaded[:type]&.to_sym
+          loaded[:source] = loaded[:source]&.to_sym
+          loaded
+        end
+
+        def persistence_metadata
+          return { enabled: false } unless store
+
+          return store.persistence_metadata if store.respond_to?(:persistence_metadata)
+
+          {
+            enabled: true,
+            store_class: store.class.name,
+            path: store.respond_to?(:path) ? store.path : nil
+          }.compact
+        end
+
+        def prune_retained_events!
+          if store&.respond_to?(:prune_events)
+            @events = store.prune_events(@events).map(&:freeze)
+            return
+          end
+
+          limit = store&.respond_to?(:retained_limit) ? store.retained_limit : nil
+          return unless limit && limit.positive?
+          return if @events.size <= limit
+
+          @events.shift(@events.size - limit)
+        end
+      end
+    end
+  end
+end

data/packages/igniter-cluster/lib/igniter/cluster/governance.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require_relative "governance/checkpoint"
+require_relative "governance/compaction_record"
+require_relative "governance/stores/file_store"
+require_relative "governance/stores/checkpoint_store"
+require_relative "governance/trail"
+require_relative "governance/admission_request"
+require_relative "governance/admission_decision"
+require_relative "governance/admission_policy"
+require_relative "governance/admission_queue"
+require_relative "governance/admission_workflow"

data/packages/igniter-cluster/lib/igniter/cluster/identity/capability_attestation.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require "base64"
+require "json"
+require "openssl"
+require "time"
+
+module Igniter
+  module Cluster
+    module Identity
+      class CapabilityAttestation
+        attr_reader :peer_name, :node_id, :algorithm, :public_key, :url,
+                    :capabilities, :tags, :metadata, :observed_at, :signature
+
+        def self.build(identity:, peer_name:, url:, capabilities:, tags:, metadata:, observed_at: Time.now.utc.iso8601)
+          payload = {
+            peer_name: peer_name.to_s,
+            node_id: identity.node_id,
+            algorithm: identity.algorithm,
+            public_key: identity.public_key_pem,
+            url: url.to_s,
+            capabilities: Array(capabilities).map(&:to_s),
+            tags: Array(tags).map(&:to_s),
+            metadata: Hash(metadata || {}),
+            observed_at: observed_at.to_s
+          }
+
+          new(payload.merge(signature: identity.sign(payload)))
+        end
+
+        def self.from_h(hash)
+          new(hash)
+        end
+
+        def initialize(hash)
+          source = symbolize_keys(hash || {})
+          @peer_name = source[:peer_name].to_s.freeze
+          @node_id = source[:node_id].to_s.freeze
+          @algorithm = source[:algorithm].to_s.freeze
+          @public_key = source[:public_key].to_s.freeze
+          @url = source[:url].to_s.freeze
+          @capabilities = Array(source[:capabilities]).map(&:to_sym).freeze
+          @tags = Array(source[:tags]).map(&:to_sym).freeze
+          @metadata = Hash(source[:metadata] || {}).freeze
+          @observed_at = source[:observed_at].to_s.freeze
+          @signature = source[:signature].to_s.freeze
+          freeze
+        end
+
+        def payload
+          {
+            peer_name: peer_name,
+            node_id: node_id,
+            algorithm: algorithm,
+            public_key: public_key,
+            url: url,
+            capabilities: capabilities.map(&:to_s),
+            tags: tags.map(&:to_s),
+            metadata: metadata,
+            observed_at: observed_at
+          }
+        end
+
+        def verify_signature
+          return false if public_key.empty? || signature.empty?
+
+          key = OpenSSL::PKey.read(public_key)
+          key.verify(OpenSSL::Digest::SHA256.new, Base64.strict_decode64(signature), canonical_json(payload))
+        rescue OpenSSL::PKey::PKeyError, ArgumentError
+          false
+        end
+
+        def fingerprint
+          return nil if public_key.empty?
+
+          OpenSSL::Digest::SHA256.hexdigest(OpenSSL::PKey.read(public_key).to_der)[0, 24]
+        rescue OpenSSL::PKey::PKeyError
+          nil
+        end
+
+        def to_h
+          payload.merge(signature: signature)
+        end
+
+        private
+
+        def symbolize_keys(hash)
+          hash.each_with_object({}) do |(key, value), memo|
+            memo[key.to_sym] = value
+          end
+        end
+
+        def canonical_json(value)
+          JSON.generate(deep_sort(value))
+        end
+
+        def deep_sort(value)
+          case value
+          when Hash
+            value.each_with_object({}) do |(key, nested), memo|
+              memo[key.to_s] = deep_sort(nested)
+            end.sort.to_h
+          when Array
+            value.map { |item| deep_sort(item) }
+          when Symbol
+            value.to_s
+          else
+            value
+          end
+        end
+      end
+    end
+  end
+end

data/packages/igniter-cluster/lib/igniter/cluster/identity/manifest.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+require "base64"
+require "json"
+require "openssl"
+require "time"
+
+module Igniter
+  module Cluster
+    module Identity
+      class Manifest
+        attr_reader :peer_name, :node_id, :algorithm, :public_key, :url,
+                    :capabilities, :tags, :metadata, :contracts, :capability_attestation, :signed_at, :signature
+
+        def self.build(identity:, peer_name:, url:, capabilities:, tags:, metadata:, contracts:, capability_attestation: nil, signed_at: Time.now.utc.iso8601)
+          attestation = capability_attestation || Igniter::Cluster::Identity::CapabilityAttestation.build(
+            identity: identity,
+            peer_name: peer_name,
+            url: url,
+            capabilities: capabilities,
+            tags: tags,
+            metadata: metadata
+          )
+
+          payload = {
+            peer_name: peer_name.to_s,
+            node_id: identity.node_id,
+            algorithm: identity.algorithm,
+            public_key: identity.public_key_pem,
+            url: url.to_s,
+            capabilities: Array(capabilities).map(&:to_s),
+            tags: Array(tags).map(&:to_s),
+            metadata: Hash(metadata || {}),
+            contracts: Array(contracts).map(&:to_s),
+            capability_attestation: attestation.to_h,
+            signed_at: signed_at.to_s
+          }
+
+          new(payload.merge(signature: identity.sign(payload)))
+        end
+
+        def self.from_h(hash)
+          new(hash)
+        end
+
+        def initialize(hash)
+          source = symbolize_keys(hash || {})
+          @peer_name = source[:peer_name].to_s.freeze
+          @node_id = source[:node_id].to_s.freeze
+          @algorithm = source[:algorithm].to_s.freeze
+          @public_key = source[:public_key].to_s.freeze
+          @url = source[:url].to_s.freeze
+          @capabilities = Array(source[:capabilities]).map(&:to_sym).freeze
+          @tags = Array(source[:tags]).map(&:to_sym).freeze
+          @metadata = Hash(source[:metadata] || {}).freeze
+          @contracts = Array(source[:contracts]).map(&:to_s).freeze
+          @capability_attestation = source[:capability_attestation].is_a?(Hash) ? Igniter::Cluster::Identity::CapabilityAttestation.from_h(source[:capability_attestation]) : nil
+          @signed_at = source[:signed_at].to_s.freeze
+          @signature = source[:signature].to_s.freeze
+          freeze
+        end
+
+        def payload
+          {
+            peer_name: peer_name,
+            node_id: node_id,
+            algorithm: algorithm,
+            public_key: public_key,
+            url: url,
+            capabilities: capabilities.map(&:to_s),
+            tags: tags.map(&:to_s),
+            metadata: metadata,
+            contracts: contracts,
+            capability_attestation: capability_attestation&.to_h,
+            signed_at: signed_at
+          }
+        end
+
+        def verify_signature
+          return false if public_key.empty? || signature.empty?
+
+          key = OpenSSL::PKey.read(public_key)
+          key.verify(OpenSSL::Digest::SHA256.new, Base64.strict_decode64(signature), canonical_json(payload))
+        rescue OpenSSL::PKey::PKeyError, ArgumentError
+          false
+        end
+
+        def fingerprint
+          return nil if public_key.empty?
+
+          OpenSSL::Digest::SHA256.hexdigest(OpenSSL::PKey.read(public_key).to_der)[0, 24]
+        rescue OpenSSL::PKey::PKeyError
+          nil
+        end
+
+        def identity_summary
+          {
+            node_id: node_id,
+            algorithm: algorithm,
+            public_key: public_key,
+            fingerprint: fingerprint,
+            signed_at: signed_at
+          }
+        end
+
+        def to_h
+          payload.merge(signature: signature)
+        end
+
+        private
+
+        def symbolize_keys(hash)
+          hash.each_with_object({}) do |(key, value), memo|
+            memo[key.to_sym] = value
+          end
+        end
+
+        def canonical_json(value)
+          JSON.generate(deep_sort(value))
+        end
+
+        def deep_sort(value)
+          case value
+          when Hash
+            value.each_with_object({}) do |(key, nested), memo|
+              memo[key.to_s] = deep_sort(nested)
+            end.sort.to_h
+          when Array
+            value.map { |item| deep_sort(item) }
+          when Symbol
+            value.to_s
+          else
+            value
+          end
+        end
+      end
+    end
+  end
+end