igniter 0.5.1 → 0.5.2

data/packages/igniter-cluster/lib/igniter/cluster/trust/admission_runner.rb

@@ -1,125 +0,0 @@
-# frozen_string_literal: true
-
-module Igniter
-  module Cluster
-    module Trust
-      class AdmissionRunner
-        def initialize(config:)
-          @config = config
-        end
-
-        def run(plan, approve: false)
-          applied = []
-          blocked = []
-
-          plan.actions.each do |action|
-            if action[:requires_approval] && !approve
-              blocked_entry = {
-                id: action[:id],
-                action: action[:action],
-                status: :blocked,
-                reason: :approval_required,
-                params: action[:params]
-              }
-              blocked << blocked_entry
-              record(
-                :trust_admission_blocked,
-                action: action,
-                payload: {
-                  peer_name: action.dig(:params, :peer_name),
-                  node_id: action.dig(:params, :node_id),
-                  reason: :approval_required
-                }
-              )
-              next
-            end
-
-            applied << execute(action)
-          end
-
-          AdmissionResult.new(
-            applied: applied,
-            blocked: blocked,
-            summary: {
-              status: applied.any? ? :applied : :blocked,
-              source_status: plan.summary[:status],
-              applied: applied.size,
-              blocked: blocked.size
-            }
-          )
-        end
-
-        private
-
-        def execute(action)
-          case action[:action]
-          when :admit_trusted_peer
-            params = action[:params]
-            @config.trust_store.add(
-              params.fetch(:node_id),
-              public_key: params.fetch(:public_key),
-              label: params[:label]
-            )
-            refresh_peer_trust!(params[:peer_name])
-
-            record(
-              :trust_admission_applied,
-              action: action,
-              payload: {
-                peer_name: params[:peer_name],
-                node_id: params[:node_id],
-                label: params[:label],
-                scope: action[:scope]
-              }
-            )
-
-            {
-              id: action[:id],
-              action: action[:action],
-              status: :applied,
-              scope: action[:scope],
-              params: params
-            }
-          else
-            raise ArgumentError, "Unsupported trust admission action #{action[:action].inspect}"
-          end
-        end
-
-        def refresh_peer_trust!(peer_name)
-          peer = @config.peer_registry.peer_named(peer_name)
-          return unless peer
-
-          manifest = peer.metadata.dig(:mesh_identity, :manifest)
-          return unless manifest.is_a?(Hash)
-
-          attributes = Igniter::Cluster::Mesh::PeerIdentityEnvelope.build(
-            source: manifest,
-            trust_store: @config.trust_store
-          )
-
-          @config.peer_registry.register(
-            Igniter::Cluster::Mesh::Peer.new(
-              name: attributes[:name],
-              url: attributes[:url],
-              capabilities: attributes[:capabilities],
-              tags: attributes[:tags],
-              metadata: attributes[:metadata]
-            )
-          )
-        end
-
-        def record(type, action:, payload:)
-          @config.governance_trail&.record(
-            type,
-            source: :trust_admission_runner,
-            payload: {
-              action: action[:action],
-              requires_approval: action[:requires_approval],
-              automated: action[:automated]
-            }.merge(payload)
-          )
-        end
-      end
-    end
-  end
-end

data/packages/igniter-cluster/lib/igniter/cluster/trust/trust_assessment.rb

@@ -1,37 +0,0 @@
-# frozen_string_literal: true
-
-module Igniter
-  module Cluster
-    module Trust
-      class TrustAssessment
-        attr_reader :status, :node_id, :peer_name, :reason, :fingerprint, :expected_fingerprint
-
-        def initialize(status:, node_id:, peer_name:, reason: nil, fingerprint: nil, expected_fingerprint: nil)
-          @status = status.to_sym
-          @node_id = node_id.to_s
-          @peer_name = peer_name.to_s
-          @reason = (reason || status).to_sym
-          @fingerprint = fingerprint
-          @expected_fingerprint = expected_fingerprint
-          freeze
-        end
-
-        def trusted?
-          status == :trusted
-        end
-
-        def to_h
-          {
-            status: status,
-            trusted: trusted?,
-            node_id: node_id,
-            peer_name: peer_name,
-            reason: reason,
-            fingerprint: fingerprint,
-            expected_fingerprint: expected_fingerprint
-          }
-        end
-      end
-    end
-  end
-end

data/packages/igniter-cluster/lib/igniter/cluster/trust/trust_store.rb

@@ -1,58 +0,0 @@
-# frozen_string_literal: true
-
-module Igniter
-  module Cluster
-    module Trust
-      class TrustStore
-        Entry = Struct.new(:node_id, :public_key, :label, keyword_init: true)
-
-        def initialize(entries = {})
-          @entries = {}
-          source_entries = entries.is_a?(Hash) ? entries.each_value : Array(entries)
-          source_entries.each do |entry|
-            add(entry[:node_id], public_key: entry[:public_key], label: entry[:label])
-          end
-        end
-
-        def add(node_id, public_key:, label: nil)
-          @entries[node_id.to_s] = Entry.new(node_id: node_id.to_s, public_key: public_key.to_s, label: label&.to_s)
-          self
-        end
-
-        def remove(node_id)
-          @entries.delete(node_id.to_s)
-          self
-        end
-
-        def entry_for(node_id)
-          @entries[node_id.to_s]
-        end
-
-        def known?(node_id)
-          !entry_for(node_id).nil?
-        end
-
-        def size
-          @entries.size
-        end
-
-        def all
-          @entries.values.dup
-        end
-
-        def to_h
-          {
-            size: size,
-            entries: all.map do |entry|
-              {
-                node_id: entry.node_id,
-                label: entry.label,
-                fingerprint: Igniter::Cluster::Trust::Verifier.fingerprint_for(entry.public_key)
-              }
-            end
-          }
-        end
-      end
-    end
-  end
-end

data/packages/igniter-cluster/lib/igniter/cluster/trust/verifier.rb

@@ -1,80 +0,0 @@
-# frozen_string_literal: true
-
-require "openssl"
-
-module Igniter
-  module Cluster
-    module Trust
-      module Verifier
-        module_function
-
-        def assess(manifest, trust_store:)
-          candidate = manifest.is_a?(Igniter::Cluster::Identity::Manifest) ? manifest : Igniter::Cluster::Identity::Manifest.from_h(manifest)
-
-          return assessment(:missing_identity, candidate) if candidate.node_id.empty? || candidate.public_key.empty?
-          return assessment(:missing_signature, candidate) if candidate.signature.empty?
-          return assessment(:invalid_signature, candidate) unless candidate.verify_signature
-
-          entry = trust_store&.entry_for(candidate.node_id)
-          return assessment(:unknown, candidate) unless entry
-
-          expected = fingerprint_for(entry.public_key)
-          actual = candidate.fingerprint
-          return assessment(:key_mismatch, candidate, expected_fingerprint: expected) unless expected == actual
-
-          assessment(:trusted, candidate, expected_fingerprint: expected)
-        end
-
-        def assess_attestation(attestation, trust_store:)
-          candidate = attestation.is_a?(Igniter::Cluster::Identity::CapabilityAttestation) ? attestation : Igniter::Cluster::Identity::CapabilityAttestation.from_h(attestation)
-
-          return assessment(:missing_identity, candidate) if candidate.node_id.empty? || candidate.public_key.empty?
-          return assessment(:missing_signature, candidate) if candidate.signature.empty?
-          return assessment(:invalid_signature, candidate) unless candidate.verify_signature
-
-          entry = trust_store&.entry_for(candidate.node_id)
-          return assessment(:unknown, candidate) unless entry
-
-          expected = fingerprint_for(entry.public_key)
-          actual = candidate.fingerprint
-          return assessment(:key_mismatch, candidate, expected_fingerprint: expected) unless expected == actual
-
-          assessment(:trusted, candidate, expected_fingerprint: expected)
-        end
-
-        def assess_governance_checkpoint(checkpoint, trust_store:)
-          candidate = checkpoint.is_a?(Igniter::Cluster::Governance::Checkpoint) ? checkpoint : Igniter::Cluster::Governance::Checkpoint.from_h(checkpoint)
-
-          return assessment(:missing_identity, candidate) if candidate.node_id.empty? || candidate.public_key.empty?
-          return assessment(:missing_signature, candidate) if candidate.signature.empty?
-          return assessment(:invalid_signature, candidate) unless candidate.verify_signature
-
-          entry = trust_store&.entry_for(candidate.node_id)
-          return assessment(:unknown, candidate) unless entry
-
-          expected = fingerprint_for(entry.public_key)
-          actual = candidate.fingerprint
-          return assessment(:key_mismatch, candidate, expected_fingerprint: expected) unless expected == actual
-
-          assessment(:trusted, candidate, expected_fingerprint: expected)
-        end
-
-        def fingerprint_for(public_key)
-          OpenSSL::Digest::SHA256.hexdigest(OpenSSL::PKey.read(public_key.to_s).to_der)[0, 24]
-        rescue OpenSSL::PKey::PKeyError
-          nil
-        end
-
-        def assessment(status, manifest, expected_fingerprint: nil)
-          TrustAssessment.new(
-            status: status,
-            node_id: manifest.node_id,
-            peer_name: manifest.peer_name,
-            fingerprint: manifest.fingerprint,
-            expected_fingerprint: expected_fingerprint
-          )
-        end
-      end
-    end
-  end
-end

data/packages/igniter-cluster/lib/igniter/cluster/trust.rb

@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "trust/admission_plan"
-require_relative "trust/admission_result"
-require_relative "trust/admission_planner"
-require_relative "trust/admission_runner"
-require_relative "trust/trust_assessment"
-require_relative "trust/trust_store"
-require_relative "trust/verifier"

data/packages/igniter-core/README.md

@@ -1,21 +0,0 @@
-# igniter-core
-
-Local monorepo gem that owns Igniter's core kernel:
-
-- contract/model/compiler/runtime primitives
-- diagnostics and extensions foundations
-- stream-loop and tool base classes
-
-Primary entrypoints:
-
-- `require "igniter-core"`
-- `require "igniter/core"`
-- `require "igniter/core/tool"`
-- `require "igniter/core/memory"`
-- `require "igniter/core/metrics"`
-
-Docs:
-
-- [Guide](../../docs/guide/README.md)
-- [Core guide](../../docs/guide/core.md)
-- [Dev](../../docs/dev/README.md)

data/packages/igniter-core/lib/igniter/core/capabilities.rb

@@ -1,70 +0,0 @@
-# frozen_string_literal: true
-
-module Igniter
-  # Capability-based security for Igniter executors.
-  #
-  # Executors declare what they are allowed to do via the `capabilities` DSL.
-  # A Policy can deny or audit specific capabilities at execution time.
-  #
-  # == Usage
-  #
-  #   require "igniter/extensions/capabilities"
-  #
-  #   class PaymentExecutor < Igniter::Executor
-  #     capabilities :network, :external_api
-  #   end
-  #
-  #   class TaxCalculator < Igniter::Executor
-  #     pure   # shorthand for capabilities :pure
-  #   end
-  #
-  #   # Inspect a contract's required capabilities:
-  #   MyContract.compiled_graph.required_capabilities
-  #   # => { payment: [:network, :external_api], tax: [:pure] }
-  #
-  #   # Enforce a policy:
-  #   Igniter::Capabilities.policy = Igniter::Capabilities::Policy.new(
-  #     denied: %i[network external_api]
-  #   )
-  module Capabilities
-    KNOWN = %i[pure network database filesystem external_api messaging queue cache].freeze
-
-    class CapabilityViolationError < Igniter::Error
-      def initialize(message, node_name: nil)
-        super(message, context: { node_name: node_name }.compact)
-      end
-    end
-
-    # Enforce capability rules at execution time.
-    #
-    # Options:
-    #   denied:  Array of capabilities that must NOT be used.
-    #   on_unknown: :warn | :ignore (default :ignore) — what to do with undeclared capabilities.
-    class Policy
-      attr_reader :denied, :on_unknown
-
-      def initialize(denied: [], on_unknown: :ignore)
-        @denied     = Array(denied).map(&:to_sym).freeze
-        @on_unknown = on_unknown
-      end
-
-      # Raise CapabilityViolationError if the executor uses a denied capability.
-      def check!(node_name, executor_class)
-        caps       = executor_class.declared_capabilities
-        violations = caps & denied
-        return if violations.empty?
-
-        raise CapabilityViolationError.new(
-          "Node '#{node_name}' executor #{executor_class.name} " \
-          "uses denied capabilities: #{violations.join(", ")}",
-          node_name: node_name
-        )
-      end
-    end
-
-    class << self
-      # Global capability policy. nil = no enforcement (default).
-      attr_accessor :policy
-    end
-  end
-end

data/packages/igniter-core/lib/igniter/core/compiler/compiled_graph.rb

@@ -1,218 +0,0 @@
-# frozen_string_literal: true
-
-module Igniter
-  module Compiler
-    class CompiledGraph
-      attr_reader :name, :nodes, :nodes_by_id, :nodes_by_name, :nodes_by_path, :outputs, :outputs_by_name, :resolution_order, :dependents
-
-      def initialize(name:, nodes:, outputs:, resolution_order:, dependents:)
-        @name = name
-        @nodes = nodes.freeze
-        @nodes_by_id = nodes.each_with_object({}) { |node, memo| memo[node.id] = node }.freeze
-        @nodes_by_name = nodes.each_with_object({}) { |node, memo| memo[node.name] = node }.freeze
-        @nodes_by_path = nodes.each_with_object({}) { |node, memo| memo[node.path] = node }.freeze
-        @outputs = outputs.freeze
-        @outputs_by_name = outputs.each_with_object({}) { |node, memo| memo[node.name] = node }.freeze
-        @resolution_order = resolution_order.freeze
-        @dependents = dependents.transform_values(&:freeze).freeze
-        freeze
-      end
-
-      def fetch_node_by_id(id)
-        @nodes_by_id.fetch(id)
-      end
-
-      def fetch_node(name)
-        @nodes_by_name.fetch(name.to_sym)
-      end
-
-      def node?(name)
-        @nodes_by_name.key?(name.to_sym)
-      end
-
-      def fetch_node_by_path(path)
-        @nodes_by_path.fetch(path.to_s)
-      end
-
-      def fetch_output(name)
-        @outputs_by_name.fetch(name.to_sym)
-      end
-
-      def output?(name)
-        @outputs_by_name.key?(name.to_sym)
-      end
-
-      def fetch_dependency(name)
-        return fetch_node(name) if node?(name)
-        return fetch_output(name) if output?(name)
-
-        raise KeyError, "Unknown dependency '#{name}'"
-      end
-
-      def await_nodes
-        @nodes.select { |n| n.kind == :await }
-      end
-
-      def to_h
-        {
-          name: name,
-          nodes: nodes.map do |node|
-            base = {
-              id: node.id,
-              kind: node.kind,
-              name: node.name,
-              path: node.path,
-              dependencies: node.dependencies
-            }
-            if node.kind == :composition
-              base[:contract] = node.contract_class.name
-              base[:inputs] = node.input_mapping
-            end
-            if node.kind == :agent
-              interaction = node.interaction_contract.to_h
-              base[:via] = node.agent_name
-              base[:message] = node.message_name
-              base[:inputs] = node.input_mapping
-              base[:timeout] = node.timeout
-              base.merge!(interaction)
-            end
-            if node.kind == :branch
-              base[:selector] = node.selector_dependency
-              base[:depends_on] = node.context_dependencies if node.context_dependencies.any?
-              base[:cases] = node.cases.map { |entry| serialized_branch_case(entry, contract_name: true) }
-              base[:default_contract] = node.default_contract.name
-              base[:inputs] = node.input_mapping
-              base[:mapper] = node.input_mapper.to_s if node.input_mapper?
-            end
-            if node.kind == :collection
-              base[:with] = node.source_dependency
-              base[:depends_on] = node.context_dependencies if node.context_dependencies.any?
-              base[:each] = node.contract_class.name
-              base[:key] = node.key_name
-              base[:mode] = node.mode
-              base[:mapper] = node.input_mapper.to_s if node.input_mapper?
-            end
-            base[:event] = node.event_name if node.kind == :await
-            base
-          end,
-          outputs: outputs.map do |output|
-            {
-              name: output.name,
-              path: output.path,
-              source: output.source
-            }
-          end,
-          resolution_order: resolution_order.map(&:name)
-        }
-      end
-
-      def to_text
-        Extensions::Introspection::GraphFormatter.to_text(self)
-      end
-
-      def to_schema
-        {
-          name: name,
-          inputs: nodes.select { |node| node.kind == :input }.map do |node|
-            {
-              name: node.name,
-              type: node.type,
-              required: node.required?,
-              default: (node.default if node.default?),
-              metadata: node.metadata.reject { |key, _| key == :source_location || key == :type || key == :required || key == :default }
-            }.compact
-          end,
-          compositions: nodes.select { |node| node.kind == :composition }.map do |node|
-            {
-              name: node.name,
-              contract: node.contract_class,
-              inputs: node.input_mapping,
-              metadata: node.metadata.reject { |key, _| key == :source_location }
-            }
-          end,
-          awaits: nodes.select { |node| node.kind == :await }.map do |node|
-            {
-              name: node.name,
-              event: node.event_name,
-              metadata: node.metadata.reject { |key, _| key == :source_location }
-            }
-          end,
-          agents: nodes.select { |node| node.kind == :agent }.map do |node|
-            {
-              name: node.name,
-              via: node.agent_name,
-              message: node.message_name,
-              inputs: node.input_mapping,
-              timeout: node.timeout,
-              **node.interaction_contract.to_h,
-              metadata: node.metadata.reject { |key, _| key == :source_location }
-            }
-          end,
-          branches: nodes.select { |node| node.kind == :branch }.map do |node|
-            {
-              name: node.name,
-              with: node.selector_dependency,
-              depends_on: node.context_dependencies,
-              inputs: node.input_mapping,
-              map_inputs: (node.input_mapper if node.input_mapper?),
-              cases: node.cases.map { |entry| serialized_branch_case(entry, contract_name: false) },
-              default: node.default_contract,
-              metadata: node.metadata.reject { |key, _| key == :source_location }
-            }
-          end,
-          collections: nodes.select { |node| node.kind == :collection }.map do |node|
-            {
-              name: node.name,
-              with: node.source_dependency,
-              depends_on: node.context_dependencies,
-              each: node.contract_class,
-              key: node.key_name,
-              mode: node.mode,
-              map_inputs: (node.input_mapper if node.input_mapper?),
-              metadata: node.metadata.reject { |key, _| key == :source_location }
-            }
-          end,
-          computes: nodes.select { |node| node.kind == :compute }.map do |node|
-            {
-              name: node.name,
-              depends_on: node.dependencies,
-              executor: node.executor_key,
-              call: (node.callable unless node.executor_key),
-              metadata: node.metadata.reject { |key, _| %i[source_location executor_key].include?(key) }
-            }.compact
-          end,
-          outputs: outputs.map do |output|
-            {
-              name: output.name,
-              from: output.source,
-              metadata: output.metadata.reject { |key, _| %i[source_location type].include?(key) }
-            }.compact
-          end
-        }
-      end
-
-      def to_mermaid
-        Extensions::Introspection::GraphFormatter.to_mermaid(self)
-      end
-
-      private
-
-      def serialized_branch_case(entry, contract_name:)
-        contract_value = contract_name ? entry[:contract].name : entry[:contract]
-
-        case entry[:matcher]
-        when :eq
-          { on: entry[:value], contract: contract_value }
-        when :in
-          { in: entry[:value], contract: contract_value }
-        when :matches
-          value = contract_name ? entry[:value].inspect : entry[:value]
-          { matches: value, contract: contract_value }
-        else
-          { matcher: entry[:matcher], value: entry[:value], contract: contract_value }
-        end
-      end
-
-    end
-  end
-end

data/packages/igniter-core/lib/igniter/core/compiler/graph_compiler.rb

@@ -1,70 +0,0 @@
-# frozen_string_literal: true
-
-require "tsort"
-
-module Igniter
-  module Compiler
-    class GraphCompiler
-      include TSort
-
-      def self.call(graph)
-        new(graph).call
-      end
-
-      def initialize(graph)
-        @graph = graph
-      end
-
-      def call
-        validator = Validator.call(@graph)
-        @nodes_by_name = validator.runtime_nodes_by_name
-        @outputs_by_name = validator.outputs.each_with_object({}) { |output, memo| memo[output.name] = output }
-
-        CompiledGraph.new(
-          name: @graph.name,
-          nodes: validator.runtime_nodes,
-          outputs: validator.outputs,
-          resolution_order: tsort,
-          dependents: build_dependents
-        )
-      end
-
-      private
-
-      def runtime_nodes
-        @runtime_nodes ||= @graph.nodes.reject { |node| node.kind == :output }
-      end
-
-      def build_dependents
-        runtime_nodes.each_with_object(Hash.new { |hash, key| hash[key] = [] }) do |node, memo|
-          node.dependencies.each do |dependency_name|
-            memo[dependency_source_name(dependency_name)] << node.name
-          end
-        end
-      end
-
-      def tsort_each_node(&block)
-        runtime_nodes.each(&block)
-      end
-
-      def tsort_each_child(node, &block)
-        node.dependencies.each do |dependency_name|
-          block.call(@nodes_by_name.fetch(dependency_source_name(dependency_name)))
-        end
-      end
-
-      def dependency_source_name(dependency_name)
-        output = @outputs_by_name[dependency_name.to_sym]
-        return output.source_root if output
-
-        dependency_name
-      end
-
-      def tsort
-        super
-      rescue TSort::Cyclic => e
-        raise CycleError, e.message
-      end
-    end
-  end
-end