igniter 0.5.0 → 0.5.1

data/packages/igniter-cluster/lib/igniter/cluster/trust/admission_runner.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+module Igniter
+  module Cluster
+    module Trust
+      class AdmissionRunner
+        def initialize(config:)
+          @config = config
+        end
+
+        def run(plan, approve: false)
+          applied = []
+          blocked = []
+
+          plan.actions.each do |action|
+            if action[:requires_approval] && !approve
+              blocked_entry = {
+                id: action[:id],
+                action: action[:action],
+                status: :blocked,
+                reason: :approval_required,
+                params: action[:params]
+              }
+              blocked << blocked_entry
+              record(
+                :trust_admission_blocked,
+                action: action,
+                payload: {
+                  peer_name: action.dig(:params, :peer_name),
+                  node_id: action.dig(:params, :node_id),
+                  reason: :approval_required
+                }
+              )
+              next
+            end
+
+            applied << execute(action)
+          end
+
+          AdmissionResult.new(
+            applied: applied,
+            blocked: blocked,
+            summary: {
+              status: applied.any? ? :applied : :blocked,
+              source_status: plan.summary[:status],
+              applied: applied.size,
+              blocked: blocked.size
+            }
+          )
+        end
+
+        private
+
+        def execute(action)
+          case action[:action]
+          when :admit_trusted_peer
+            params = action[:params]
+            @config.trust_store.add(
+              params.fetch(:node_id),
+              public_key: params.fetch(:public_key),
+              label: params[:label]
+            )
+            refresh_peer_trust!(params[:peer_name])
+
+            record(
+              :trust_admission_applied,
+              action: action,
+              payload: {
+                peer_name: params[:peer_name],
+                node_id: params[:node_id],
+                label: params[:label],
+                scope: action[:scope]
+              }
+            )
+
+            {
+              id: action[:id],
+              action: action[:action],
+              status: :applied,
+              scope: action[:scope],
+              params: params
+            }
+          else
+            raise ArgumentError, "Unsupported trust admission action #{action[:action].inspect}"
+          end
+        end
+
+        def refresh_peer_trust!(peer_name)
+          peer = @config.peer_registry.peer_named(peer_name)
+          return unless peer
+
+          manifest = peer.metadata.dig(:mesh_identity, :manifest)
+          return unless manifest.is_a?(Hash)
+
+          attributes = Igniter::Cluster::Mesh::PeerIdentityEnvelope.build(
+            source: manifest,
+            trust_store: @config.trust_store
+          )
+
+          @config.peer_registry.register(
+            Igniter::Cluster::Mesh::Peer.new(
+              name: attributes[:name],
+              url: attributes[:url],
+              capabilities: attributes[:capabilities],
+              tags: attributes[:tags],
+              metadata: attributes[:metadata]
+            )
+          )
+        end
+
+        def record(type, action:, payload:)
+          @config.governance_trail&.record(
+            type,
+            source: :trust_admission_runner,
+            payload: {
+              action: action[:action],
+              requires_approval: action[:requires_approval],
+              automated: action[:automated]
+            }.merge(payload)
+          )
+        end
+      end
+    end
+  end
+end

data/packages/igniter-cluster/lib/igniter/cluster/trust/trust_assessment.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Igniter
+  module Cluster
+    module Trust
+      class TrustAssessment
+        attr_reader :status, :node_id, :peer_name, :reason, :fingerprint, :expected_fingerprint
+
+        def initialize(status:, node_id:, peer_name:, reason: nil, fingerprint: nil, expected_fingerprint: nil)
+          @status = status.to_sym
+          @node_id = node_id.to_s
+          @peer_name = peer_name.to_s
+          @reason = (reason || status).to_sym
+          @fingerprint = fingerprint
+          @expected_fingerprint = expected_fingerprint
+          freeze
+        end
+
+        def trusted?
+          status == :trusted
+        end
+
+        def to_h
+          {
+            status: status,
+            trusted: trusted?,
+            node_id: node_id,
+            peer_name: peer_name,
+            reason: reason,
+            fingerprint: fingerprint,
+            expected_fingerprint: expected_fingerprint
+          }
+        end
+      end
+    end
+  end
+end

data/packages/igniter-cluster/lib/igniter/cluster/trust/trust_store.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Igniter
+  module Cluster
+    module Trust
+      class TrustStore
+        Entry = Struct.new(:node_id, :public_key, :label, keyword_init: true)
+
+        def initialize(entries = {})
+          @entries = {}
+          source_entries = entries.is_a?(Hash) ? entries.each_value : Array(entries)
+          source_entries.each do |entry|
+            add(entry[:node_id], public_key: entry[:public_key], label: entry[:label])
+          end
+        end
+
+        def add(node_id, public_key:, label: nil)
+          @entries[node_id.to_s] = Entry.new(node_id: node_id.to_s, public_key: public_key.to_s, label: label&.to_s)
+          self
+        end
+
+        def remove(node_id)
+          @entries.delete(node_id.to_s)
+          self
+        end
+
+        def entry_for(node_id)
+          @entries[node_id.to_s]
+        end
+
+        def known?(node_id)
+          !entry_for(node_id).nil?
+        end
+
+        def size
+          @entries.size
+        end
+
+        def all
+          @entries.values.dup
+        end
+
+        def to_h
+          {
+            size: size,
+            entries: all.map do |entry|
+              {
+                node_id: entry.node_id,
+                label: entry.label,
+                fingerprint: Igniter::Cluster::Trust::Verifier.fingerprint_for(entry.public_key)
+              }
+            end
+          }
+        end
+      end
+    end
+  end
+end

data/packages/igniter-cluster/lib/igniter/cluster/trust/verifier.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module Igniter
+  module Cluster
+    module Trust
+      module Verifier
+        module_function
+
+        def assess(manifest, trust_store:)
+          candidate = manifest.is_a?(Igniter::Cluster::Identity::Manifest) ? manifest : Igniter::Cluster::Identity::Manifest.from_h(manifest)
+
+          return assessment(:missing_identity, candidate) if candidate.node_id.empty? || candidate.public_key.empty?
+          return assessment(:missing_signature, candidate) if candidate.signature.empty?
+          return assessment(:invalid_signature, candidate) unless candidate.verify_signature
+
+          entry = trust_store&.entry_for(candidate.node_id)
+          return assessment(:unknown, candidate) unless entry
+
+          expected = fingerprint_for(entry.public_key)
+          actual = candidate.fingerprint
+          return assessment(:key_mismatch, candidate, expected_fingerprint: expected) unless expected == actual
+
+          assessment(:trusted, candidate, expected_fingerprint: expected)
+        end
+
+        def assess_attestation(attestation, trust_store:)
+          candidate = attestation.is_a?(Igniter::Cluster::Identity::CapabilityAttestation) ? attestation : Igniter::Cluster::Identity::CapabilityAttestation.from_h(attestation)
+
+          return assessment(:missing_identity, candidate) if candidate.node_id.empty? || candidate.public_key.empty?
+          return assessment(:missing_signature, candidate) if candidate.signature.empty?
+          return assessment(:invalid_signature, candidate) unless candidate.verify_signature
+
+          entry = trust_store&.entry_for(candidate.node_id)
+          return assessment(:unknown, candidate) unless entry
+
+          expected = fingerprint_for(entry.public_key)
+          actual = candidate.fingerprint
+          return assessment(:key_mismatch, candidate, expected_fingerprint: expected) unless expected == actual
+
+          assessment(:trusted, candidate, expected_fingerprint: expected)
+        end
+
+        def assess_governance_checkpoint(checkpoint, trust_store:)
+          candidate = checkpoint.is_a?(Igniter::Cluster::Governance::Checkpoint) ? checkpoint : Igniter::Cluster::Governance::Checkpoint.from_h(checkpoint)
+
+          return assessment(:missing_identity, candidate) if candidate.node_id.empty? || candidate.public_key.empty?
+          return assessment(:missing_signature, candidate) if candidate.signature.empty?
+          return assessment(:invalid_signature, candidate) unless candidate.verify_signature
+
+          entry = trust_store&.entry_for(candidate.node_id)
+          return assessment(:unknown, candidate) unless entry
+
+          expected = fingerprint_for(entry.public_key)
+          actual = candidate.fingerprint
+          return assessment(:key_mismatch, candidate, expected_fingerprint: expected) unless expected == actual
+
+          assessment(:trusted, candidate, expected_fingerprint: expected)
+        end
+
+        def fingerprint_for(public_key)
+          OpenSSL::Digest::SHA256.hexdigest(OpenSSL::PKey.read(public_key.to_s).to_der)[0, 24]
+        rescue OpenSSL::PKey::PKeyError
+          nil
+        end
+
+        def assessment(status, manifest, expected_fingerprint: nil)
+          TrustAssessment.new(
+            status: status,
+            node_id: manifest.node_id,
+            peer_name: manifest.peer_name,
+            fingerprint: manifest.fingerprint,
+            expected_fingerprint: expected_fingerprint
+          )
+        end
+      end
+    end
+  end
+end

data/packages/igniter-cluster/lib/igniter/cluster/trust.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require_relative "trust/admission_plan"
+require_relative "trust/admission_result"
+require_relative "trust/admission_planner"
+require_relative "trust/admission_runner"
+require_relative "trust/trust_assessment"
+require_relative "trust/trust_store"
+require_relative "trust/verifier"

data/packages/igniter-cluster/lib/igniter/cluster.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "igniter/core"
+require "igniter/agent"
+require "igniter/core/contract"
+require "igniter/core/dsl"
+require "igniter/core/model"
+require "igniter/core/compiler"
+require "igniter/core/type_system"
+require "igniter/core/diagnostics"
+require "igniter/core/memory"
+require "igniter/sdk"
+require "igniter/server"
+require_relative "cluster/governance"
+require_relative "cluster/identity"
+require_relative "cluster/trust"
+require_relative "cluster/mesh"
+require_relative "cluster/remote_adapter"
+require_relative "cluster/agent_route_resolver"
+require_relative "cluster/routed_agent_adapter"
+require_relative "cluster/events"
+require_relative "cluster/ownership"
+require_relative "cluster/projection_store"
+require_relative "cluster/routing_plan_result"
+require_relative "cluster/routing_plan_executor"
+require_relative "cluster/consensus"
+require_relative "cluster/replication"
+require_relative "cluster/diagnostics"
+require_relative "cluster/rag"
+
+module Igniter
+  module Cluster
+    class << self
+      def remote_adapter
+        @remote_adapter ||= RemoteAdapter.new
+      end
+
+      def activate_remote_adapter!
+        Igniter::Runtime.remote_adapter = remote_adapter
+      end
+
+      def agent_adapter
+        @agent_adapter ||= RoutedAgentAdapter.new
+      end
+
+      def activate_agent_adapter!
+        Igniter::Runtime.agent_adapter = agent_adapter
+      end
+
+      def deactivate_remote_adapter!
+        Igniter::Runtime.remote_adapter = Igniter::Runtime::RemoteAdapter.new
+      end
+
+      def deactivate_agent_adapter!
+        Igniter::Runtime.agent_adapter = Igniter::Runtime::RegistryAgentAdapter.new
+      end
+
+      def use(*names)
+        resolved_names = names.flatten.map(&:to_sym)
+        Igniter::SDK.activate!(*resolved_names, layer: :cluster)
+        @sdk_capabilities ||= []
+        @sdk_capabilities |= resolved_names
+        self
+      end
+
+      def sdk_capabilities
+        @sdk_capabilities ||= []
+      end
+    end
+  end
+end

data/packages/igniter-cluster/lib/igniter-cluster.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative "igniter/cluster"

data/packages/igniter-core/README.md

@@ -0,0 +1,21 @@
+# igniter-core
+
+Local monorepo gem that owns Igniter's core kernel:
+
+- contract/model/compiler/runtime primitives
+- diagnostics and extensions foundations
+- stream-loop and tool base classes
+
+Primary entrypoints:
+
+- `require "igniter-core"`
+- `require "igniter/core"`
+- `require "igniter/core/tool"`
+- `require "igniter/core/memory"`
+- `require "igniter/core/metrics"`
+
+Docs:
+
+- [Guide](../../docs/guide/README.md)
+- [Core guide](../../docs/guide/core.md)
+- [Dev](../../docs/dev/README.md)

data/{lib/igniter → packages/igniter-core/lib/igniter/core}/capabilities.rb

@@ -41,6 +41,8 @@ module Igniter
     #   denied:  Array of capabilities that must NOT be used.
     #   on_unknown: :warn | :ignore (default :ignore) — what to do with undeclared capabilities.
     class Policy
+      attr_reader :denied, :on_unknown
+
       def initialize(denied: [], on_unknown: :ignore)
         @denied     = Array(denied).map(&:to_sym).freeze
         @on_unknown = on_unknown
@@ -49,7 +51,7 @@ module Igniter
       # Raise CapabilityViolationError if the executor uses a denied capability.
       def check!(node_name, executor_class)
         caps       = executor_class.declared_capabilities
-        violations = caps & @denied
+        violations = caps & denied
         return if violations.empty?
 
         raise CapabilityViolationError.new(

data/{lib/igniter → packages/igniter-core/lib/igniter/core}/compiler/compiled_graph.rb

@@ -68,10 +68,18 @@ module Igniter
               base[:contract] = node.contract_class.name
               base[:inputs] = node.input_mapping
             end
+            if node.kind == :agent
+              interaction = node.interaction_contract.to_h
+              base[:via] = node.agent_name
+              base[:message] = node.message_name
+              base[:inputs] = node.input_mapping
+              base[:timeout] = node.timeout
+              base.merge!(interaction)
+            end
             if node.kind == :branch
               base[:selector] = node.selector_dependency
               base[:depends_on] = node.context_dependencies if node.context_dependencies.any?
-              base[:cases] = node.cases.map { |entry| { match: entry[:match], contract: entry[:contract].name } }
+              base[:cases] = node.cases.map { |entry| serialized_branch_case(entry, contract_name: true) }
               base[:default_contract] = node.default_contract.name
               base[:inputs] = node.input_mapping
               base[:mapper] = node.input_mapper.to_s if node.input_mapper?
@@ -129,6 +137,17 @@ module Igniter
               metadata: node.metadata.reject { |key, _| key == :source_location }
             }
           end,
+          agents: nodes.select { |node| node.kind == :agent }.map do |node|
+            {
+              name: node.name,
+              via: node.agent_name,
+              message: node.message_name,
+              inputs: node.input_mapping,
+              timeout: node.timeout,
+              **node.interaction_contract.to_h,
+              metadata: node.metadata.reject { |key, _| key == :source_location }
+            }
+          end,
           branches: nodes.select { |node| node.kind == :branch }.map do |node|
             {
               name: node.name,
@@ -136,7 +155,7 @@ module Igniter
               depends_on: node.context_dependencies,
               inputs: node.input_mapping,
               map_inputs: (node.input_mapper if node.input_mapper?),
-              cases: node.cases.map { |entry| { on: entry[:match], contract: entry[:contract] } },
+              cases: node.cases.map { |entry| serialized_branch_case(entry, contract_name: false) },
               default: node.default_contract,
               metadata: node.metadata.reject { |key, _| key == :source_location }
             }
@@ -175,6 +194,25 @@ module Igniter
       def to_mermaid
         Extensions::Introspection::GraphFormatter.to_mermaid(self)
       end
+
+      private
+
+      def serialized_branch_case(entry, contract_name:)
+        contract_value = contract_name ? entry[:contract].name : entry[:contract]
+
+        case entry[:matcher]
+        when :eq
+          { on: entry[:value], contract: contract_value }
+        when :in
+          { in: entry[:value], contract: contract_value }
+        when :matches
+          value = contract_name ? entry[:value].inspect : entry[:value]
+          { matches: value, contract: contract_value }
+        else
+          { matcher: entry[:matcher], value: entry[:value], contract: contract_value }
+        end
+      end
+
     end
   end
 end

data/{lib/igniter → packages/igniter-core/lib/igniter/core}/compiler/validation_pipeline.rb

@@ -10,6 +10,7 @@ module Igniter
         Validators::TypeCompatibilityValidator,
         Validators::CallableValidator,
         Validators::AwaitValidator,
+        Validators::AgentValidator,
         Validators::RemoteValidator
       ].freeze
 

data/packages/igniter-core/lib/igniter/core/compiler/validators/agent_validator.rb

@@ -0,0 +1,142 @@
+# frozen_string_literal: true
+
+module Igniter
+  module Compiler
+    module Validators
+      class AgentValidator
+        def self.call(context)
+          new(context).call
+        end
+
+        def initialize(context)
+          @context = context
+        end
+
+        def call
+          @context.runtime_nodes.each do |node|
+            next unless node.kind == :agent
+
+            validate_agent_name!(node)
+            validate_message_name!(node)
+            validate_timeout!(node)
+            validate_mode!(node)
+            validate_reply_mode!(node)
+            validate_finalizer!(node)
+            validate_tool_loop_policy!(node)
+            validate_session_policy!(node)
+            validate_routing!(node)
+          end
+        end
+
+        private
+
+        def validate_agent_name!(node)
+          return unless node.agent_name.to_s.strip.empty?
+
+          raise @context.validation_error(
+            node,
+            "agent :#{node.name} requires a non-empty via:"
+          )
+        end
+
+        def validate_message_name!(node)
+          return unless node.message_name.to_s.strip.empty?
+
+          raise @context.validation_error(
+            node,
+            "agent :#{node.name} requires a non-empty message:"
+          )
+        end
+
+        def validate_timeout!(node)
+          return if node.timeout.positive?
+
+          raise @context.validation_error(
+            node,
+            "agent :#{node.name} timeout must be positive"
+          )
+        end
+
+        def validate_mode!(node)
+          return if Model::AgentInteractionContract::MODES.include?(node.mode)
+
+          raise @context.validation_error(
+            node,
+            "agent :#{node.name} mode must be :call or :cast"
+          )
+        end
+
+        def validate_reply_mode!(node)
+          unless Model::AgentInteractionContract::REPLY_MODES.include?(node.reply_mode)
+            raise @context.validation_error(
+              node,
+              "agent :#{node.name} reply must be :single, :deferred, :stream, or :none"
+            )
+          end
+
+          return unless node.mode == :cast && node.reply_mode != :none
+
+          raise @context.validation_error(
+            node,
+            "agent :#{node.name} mode :cast only supports reply: :none"
+          )
+        end
+
+        def validate_finalizer!(node)
+          return if node.finalizer.nil?
+          return if node.reply_mode == :stream
+
+          raise @context.validation_error(
+            node,
+            "agent :#{node.name} finalizer requires reply: :stream"
+          )
+        end
+
+        def validate_tool_loop_policy!(node)
+          return if node.tool_loop_policy.nil?
+
+          unless Model::AgentInteractionContract::TOOL_LOOP_POLICIES.include?(node.tool_loop_policy)
+            raise @context.validation_error(
+              node,
+              "agent :#{node.name} tool_loop_policy must be :ignore, :resolved, or :complete"
+            )
+          end
+
+          return if node.reply_mode == :stream
+
+          raise @context.validation_error(
+            node,
+            "agent :#{node.name} tool_loop_policy requires reply: :stream"
+          )
+        end
+
+        def validate_session_policy!(node)
+          return if node.session_policy.nil?
+
+          unless Model::AgentInteractionContract::SESSION_POLICIES.include?(node.session_policy)
+            raise @context.validation_error(
+              node,
+              "agent :#{node.name} session_policy must be :interactive, :single_turn, or :manual"
+            )
+          end
+
+          return if node.reply_mode == :stream
+
+          raise @context.validation_error(
+            node,
+            "agent :#{node.name} session_policy requires reply: :stream"
+          )
+        end
+
+        def validate_routing!(node)
+          return if Model::AgentInteractionContract::ROUTING_MODES.include?(node.routing_mode)
+
+          raise @context.validation_error(
+            node,
+            "agent :#{node.name} routing mode must be :local, :static, :capability, or :pinned"
+          )
+        end
+      end
+    end
+  end
+end