legionio 1.4.109 → 1.4.111

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 52e1d5b8749747a9fe4b89302f1e0122f86a7630e02f668dfa5df8de363399d7
-  data.tar.gz: 315b433465e06726391616a01d0cd6d8d8b13c849eff241a2702cdb8ab66cbaa
+  metadata.gz: fa14ee5aba79a712b64bd58ff53a40076fd8c4d3f84d6b58757f393175aba7f2
+  data.tar.gz: 572ed5d1c54e429da795341b6aa725c9187c06e4dca4445eff530d59f3324f5e
 SHA512:
-  metadata.gz: 4b8c67b2e70b786fc16abb5f43ce8a4d8155e87b22fcf4e901afb24c021fc2112b07b884b75e16f9a48e046a959cacc035885d4251f4812e3eb805f2465e66f6
-  data.tar.gz: 79b46b3605b2c249090b11dd4d12db71ff523061b9f9ae929cca2d7a1b3646489c3afb01f8dd36d6dcc532d925c86b2b48c6b90ee9cbac39c5bbdee5514618c7
+  metadata.gz: 3eb840d78c0218c25882e8f3e757164ca7463b73f246aec0ac41a99c3c54ab3e644c5f59ee0fd695c0ab31818043f976f765c1316930a4ae86985179f92b69ba
+  data.tar.gz: 338a32c3e8e50b6f4113144b90daf0508a95032ddf3c393317ef1f431671db2d1caf32caf94c5e870181c5cf05e6a483a329bfdb636eacd2b6a4ce646ab34a8b

data/.rubocop.yml

@@ -46,6 +46,7 @@ Metrics/BlockLength:
     - 'lib/legion/cli/notebook_command.rb'
     - 'lib/legion/api/acp.rb'
     - 'lib/legion/api/auth_saml.rb'
+    - 'lib/legion/cli/failover_command.rb'
 
 Metrics/AbcSize:
   Max: 60

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Legion Changelog
 
+## [1.4.111] - 2026-03-21
+
+### Added
+- Register logging hooks in boot sequence: fatal/error/warn published to `legion.logging` RMQ exchange
+- Routing key pattern: `legion.<source>.<level>` (e.g., `legion.core.fatal`, `legion.lex-slack.error`)
+- `Legion::Region` module: cloud metadata detection (AWS IMDSv2, Azure IMDS), region affinity routing
+- `Legion::Region::Failover`: promote regions with replication lag checks, --dry-run, --force
+- `legion failover` CLI: promote and status subcommands for region failover management
+
+## [1.4.110] - 2026-03-21
+
+### Added
+- Domain restrictions in extension Sandbox (allowed_domains on Policy, domain_allowed? check)
+- Sandbox.allowed? class method for combined capability + domain checks
+
 ## [1.4.109] - 2026-03-21
 
 ### Added

data/CODEOWNERS

@@ -0,0 +1 @@
+* @Esity

data/Gemfile

@@ -4,6 +4,8 @@ source 'https://rubygems.org'
 
 gemspec
 
+gem 'legion-logging', path: '../legion-logging' if File.exist?(File.expand_path('../legion-logging', __dir__))
+
 gem 'kramdown', '>= 2.0'
 gem 'mysql2'
 

data/lib/legion/cli/failover_command.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+require 'thor'
+require 'legion/cli/output'
+require 'legion/cli/connection'
+
+module Legion
+  module CLI
+    class Failover < Thor
+      namespace 'failover'
+
+      class_option :json, type: :boolean, default: false, desc: 'Output as JSON'
+      class_option :no_color, type: :boolean, default: false, desc: 'Disable color output'
+
+      desc 'promote', 'Promote a region to primary'
+      option :region, type: :string, required: true, desc: 'Target region to promote'
+      option :dry_run, type: :boolean, default: false, desc: 'Show replication lag without promoting'
+      option :force, type: :boolean, default: false, desc: 'Force promotion even if lag exceeds threshold'
+      def promote
+        out = formatter
+        ensure_settings
+
+        target = options[:region]
+        require 'legion/region/failover'
+
+        if options[:dry_run]
+          run_dry_run(out, target)
+        else
+          run_promote(out, target)
+        end
+      rescue Legion::Region::Failover::UnknownRegionError => e
+        out.error(e.message)
+        raise SystemExit, 1
+      rescue Legion::Region::Failover::LagTooHighError => e
+        if options[:force]
+          out.warn("#{e.message} — forcing promotion")
+          force_promote(out, target)
+        else
+          out.error("#{e.message}. Use --force to override.")
+          raise SystemExit, 1
+        end
+      end
+
+      desc 'status', 'Show current region configuration'
+      def status
+        out = formatter
+        ensure_settings
+
+        region_config = Legion::Settings[:region] || {}
+        if options[:json]
+          out.json(region_config)
+        else
+          out.header('Region Configuration')
+          out.detail({
+                       current:          region_config[:current] || '(not set)',
+                       primary:          region_config[:primary] || '(not set)',
+                       failover:         region_config[:failover] || '(not set)',
+                       peers:            (region_config[:peers] || []).join(', ').then { |s| s.empty? ? '(none)' : s },
+                       default_affinity: region_config[:default_affinity] || 'prefer_local'
+                     })
+        end
+      end
+
+      no_commands do
+        def formatter
+          @formatter ||= Output::Formatter.new(
+            json:  options[:json],
+            color: !options[:no_color]
+          )
+        end
+
+        private
+
+        def ensure_settings
+          Connection.ensure_settings
+        end
+
+        def run_dry_run(out, target)
+          Legion::Region::Failover.validate_target!(target)
+          lag = Legion::Region::Failover.replication_lag
+
+          if options[:json]
+            out.json({ target: target, lag_seconds: lag, dry_run: true })
+          else
+            out.header('Failover Dry Run')
+            lag_str = lag ? "#{lag.round(1)}s" : '(unavailable — no DB connection)'
+            out.detail({ target: target, replication_lag: lag_str })
+            if lag && lag > Legion::Region::Failover::MAX_LAG_SECONDS
+              out.warn("Lag exceeds #{Legion::Region::Failover::MAX_LAG_SECONDS}s threshold")
+            else
+              out.success('Lag within acceptable range')
+            end
+          end
+        end
+
+        def run_promote(out, target)
+          result = Legion::Region::Failover.promote!(region: target)
+          if options[:json]
+            out.json(result)
+          else
+            out.success("Region promoted: #{result[:previous]} -> #{result[:promoted]}")
+            lag_str = result[:lag_seconds] ? "#{result[:lag_seconds].round(1)}s" : '(unavailable)'
+            out.detail({ promoted: result[:promoted], previous: result[:previous], replication_lag: lag_str })
+          end
+        end
+
+        def force_promote(out, target)
+          previous = Legion::Settings.dig(:region, :primary)
+          lag = Legion::Region::Failover.replication_lag
+          Legion::Settings[:region][:primary] = target
+          Legion::Events.emit('region.failover', from: previous, to: target) if defined?(Legion::Events)
+
+          result = { promoted: target, previous: previous, lag_seconds: lag, forced: true }
+          if options[:json]
+            out.json(result)
+          else
+            out.success("Region force-promoted: #{previous} -> #{target}")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/cli.rb

@@ -54,6 +54,7 @@ module Legion
     autoload :Payroll,        'legion/cli/payroll_command'
     autoload :Interactive, 'legion/cli/interactive'
     autoload :Docs,        'legion/cli/docs_command'
+    autoload :Failover,    'legion/cli/failover_command'
 
     class Main < Thor
       def self.exit_on_failure?
@@ -282,6 +283,9 @@ module Legion
       desc 'docs SUBCOMMAND', 'Documentation site generator'
       subcommand 'docs', Legion::CLI::Docs
 
+      desc 'failover SUBCOMMAND', 'Region failover management'
+      subcommand 'failover', Legion::CLI::Failover
+
       desc 'tree', 'Print a tree of all available commands'
       def tree
         legion_print_command_tree(self.class, 'legion', '')

data/lib/legion/extensions/actors/subscription.rb

@@ -112,6 +112,19 @@ module Legion
 
             message = process_message(payload, metadata, delivery_info)
             fn = find_function(message)
+
+            affinity_result = check_region_affinity(message)
+            if affinity_result == :reject
+              Legion::Logging.warn "Rejecting message: region affinity mismatch (region=#{message[:region]}, affinity=#{message[:region_affinity]})"
+              @queue.reject(delivery_info.delivery_tag) if manual_ack
+              next
+            end
+
+            if affinity_result == :remote
+              Legion::Logging.debug 'Processing remote-region message ' \
+                                    "(region=#{message[:region]}, affinity=#{message[:region_affinity]})"
+            end
+
             if use_runner?
               dispatch_runner(message, runner_class, fn, check_subtask?, generate_task?)
             else
@@ -131,6 +144,14 @@ module Legion
 
         private
 
+        def check_region_affinity(message)
+          return :local unless defined?(Legion::Region)
+
+          region = message[:region]
+          affinity = message[:region_affinity]
+          Legion::Region.affinity_for(region, affinity)
+        end
+
         def dispatch_runner(message, runner_cls, function, check_subtask, generate_task)
           run_block = lambda {
             Legion::Runner.run(**message,

data/lib/legion/region/failover.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Legion
+  module Region
+    module Failover
+      module_function
+
+      MAX_LAG_SECONDS = 30
+
+      def promote!(region:)
+        validate_target!(region)
+
+        lag = replication_lag
+        raise LagTooHighError, "replication lag #{lag.round(1)}s exceeds #{MAX_LAG_SECONDS}s threshold" if lag && lag > MAX_LAG_SECONDS
+
+        previous = Legion::Settings.dig(:region, :primary)
+        Legion::Settings[:region][:primary] = region
+        Legion::Events.emit('region.failover', from: previous, to: region) if defined?(Legion::Events)
+
+        { promoted: region, previous: previous, lag_seconds: lag }
+      end
+
+      def replication_lag
+        return nil unless defined?(Legion::Data) && Legion::Data.respond_to?(:connection) && Legion::Data.connection
+
+        row = Legion::Data.connection.fetch(
+          'SELECT EXTRACT(EPOCH FROM (now() - pg_last_xact_replay_timestamp())) AS lag'
+        ).first
+        row[:lag]&.to_f
+      rescue StandardError
+        nil
+      end
+
+      def validate_target!(region)
+        peers = Legion::Settings.dig(:region, :peers) || []
+        failover = Legion::Settings.dig(:region, :failover)
+        known = (peers + [failover].compact).uniq
+
+        return if known.include?(region)
+
+        raise UnknownRegionError, "'#{region}' is not a known peer or failover region (known: #{known.join(', ')})"
+      end
+
+      class LagTooHighError < StandardError; end
+      class UnknownRegionError < StandardError; end
+    end
+  end
+end

data/lib/legion/region.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'net/http'
+
+module Legion
+  module Region
+    module_function
+
+    def current
+      setting = defined?(Legion::Settings) ? Legion::Settings.dig(:region, :current) : nil
+      setting || detect_from_metadata
+    rescue StandardError
+      nil
+    end
+
+    def local?(target_region)
+      target_region.nil? || target_region == current
+    end
+
+    def affinity_for(message_region, affinity)
+      return :local if local?(message_region) || affinity == 'any'
+      return :remote if affinity == 'prefer_local'
+      return :reject if affinity == 'require_local'
+
+      :local
+    end
+
+    def primary
+      return nil unless defined?(Legion::Settings)
+
+      Legion::Settings.dig(:region, :primary)
+    rescue StandardError
+      nil
+    end
+
+    def failover
+      return nil unless defined?(Legion::Settings)
+
+      Legion::Settings.dig(:region, :failover)
+    rescue StandardError
+      nil
+    end
+
+    def peers
+      return [] unless defined?(Legion::Settings)
+
+      Legion::Settings.dig(:region, :peers) || []
+    rescue StandardError
+      []
+    end
+
+    def detect_from_metadata
+      detect_aws_region || detect_azure_region
+    rescue StandardError
+      nil
+    end
+
+    def detect_aws_region
+      uri = URI('http://169.254.169.254/latest/meta-data/placement/region')
+      token_uri = URI('http://169.254.169.254/latest/api/token')
+
+      token = Net::HTTP.start(token_uri.host, token_uri.port, open_timeout: 1, read_timeout: 1) do |http|
+        req = Net::HTTP::Put.new(token_uri)
+        req['X-aws-ec2-metadata-token-ttl-seconds'] = '21600'
+        http.request(req).body
+      end
+
+      Net::HTTP.start(uri.host, uri.port, open_timeout: 1, read_timeout: 1) do |http|
+        req = Net::HTTP::Get.new(uri)
+        req['X-aws-ec2-metadata-token'] = token
+        response = http.request(req)
+        response.is_a?(Net::HTTPSuccess) ? response.body.strip : nil
+      end
+    rescue StandardError
+      nil
+    end
+
+    def detect_azure_region
+      uri = URI('http://169.254.169.254/metadata/instance/compute/location?api-version=2021-02-01&format=text')
+
+      Net::HTTP.start(uri.host, uri.port, open_timeout: 1, read_timeout: 1) do |http|
+        req = Net::HTTP::Get.new(uri)
+        req['Metadata'] = 'true'
+        response = http.request(req)
+        response.is_a?(Net::HTTPSuccess) ? response.body.strip : nil
+      end
+    rescue StandardError
+      nil
+    end
+  end
+end

data/lib/legion/sandbox.rb

@@ -12,23 +12,31 @@ module Legion
         transport:publish transport:subscribe
       ].freeze
 
-      attr_reader :extension_name, :capabilities
+      attr_reader :extension_name, :capabilities, :allowed_domains
 
-      def initialize(extension_name:, capabilities: [])
+      def initialize(extension_name:, capabilities: [], allowed_domains: nil)
         @extension_name = extension_name
         @capabilities = capabilities.select { |c| CAPABILITIES.include?(c) }.freeze
+        @allowed_domains = allowed_domains&.map(&:to_s)&.freeze
       end
 
       def allowed?(capability)
         capabilities.include?(capability.to_s)
       end
+
+      def domain_allowed?(agent_domain)
+        return true if allowed_domains.nil? || allowed_domains.empty?
+
+        allowed_domains.include?(agent_domain.to_s)
+      end
     end
 
     class << self
-      def register_policy(extension_name, capabilities:)
+      def register_policy(extension_name, capabilities:, allowed_domains: nil)
         policies[extension_name] = Policy.new(
-          extension_name: extension_name,
-          capabilities:   capabilities
+          extension_name:  extension_name,
+          capabilities:    capabilities,
+          allowed_domains: allowed_domains
         )
       end
 
@@ -45,6 +53,19 @@ module Legion
         true
       end
 
+      def allowed?(extension_name: nil, gem_name: nil, capability: nil, agent_domain: nil)
+        ext = extension_name || gem_name
+        return true unless enforcement_enabled?
+
+        policy = policy_for(ext)
+
+        return false if capability && !policy.allowed?(capability)
+
+        return false if agent_domain && !policy.domain_allowed?(agent_domain)
+
+        true
+      end
+
       def enforcement_enabled?
         return false unless defined?(Legion::Settings)
 

data/lib/legion/service.rb

@@ -45,6 +45,7 @@ module Legion
       if transport
         setup_transport
         Legion::Readiness.mark_ready(:transport)
+        register_logging_hooks
       end
 
       if cache
@@ -250,6 +251,27 @@ module Legion
       Legion::Transport::Connection.setup
     end
 
+    def register_logging_hooks
+      return unless Legion::Transport::Connection.session_open?
+
+      exchange = Legion::Transport::Exchanges::Logging.new
+
+      %i[fatal error warn].each do |level|
+        Legion::Logging.send(:"on_#{level}") do |event|
+          next unless Legion::Transport::Connection.session_open?
+
+          source = event[:lex] || 'core'
+          routing_key = "legion.#{source}.#{level}"
+          exchange.publish(Legion::JSON.dump(event), routing_key: routing_key)
+        rescue StandardError
+          nil
+        end
+      end
+
+      Legion::Logging.enable_hooks!
+      Legion::Logging.info('Logging hooks registered for RMQ publishing')
+    end
+
     def setup_alerts
       enabled = begin
         Legion::Settings[:alerts][:enabled]

data/lib/legion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Legion
-  VERSION = '1.4.109'
+  VERSION = '1.4.111'
 end

data/lib/legion.rb

@@ -12,6 +12,8 @@ require 'legion/service'
 require 'legion/extensions'
 
 module Legion
+  autoload :Region, 'legion/region'
+
   attr_reader :service
 
   def self.start

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legionio
 version: !ruby/object:Gem::Version
-  version: 1.4.109
+  version: 1.4.111
 platform: ruby
 authors:
 - Esity
@@ -335,6 +335,7 @@ files:
 - ".rubocop.yml"
 - CHANGELOG.md
 - CLAUDE.md
+- CODEOWNERS
 - Dockerfile
 - Gemfile
 - LICENSE
@@ -498,6 +499,7 @@ files:
 - lib/legion/cli/doctor_command.rb
 - lib/legion/cli/error.rb
 - lib/legion/cli/eval_command.rb
+- lib/legion/cli/failover_command.rb
 - lib/legion/cli/function.rb
 - lib/legion/cli/gaia_command.rb
 - lib/legion/cli/generate_command.rb
@@ -653,6 +655,8 @@ files:
 - lib/legion/process.rb
 - lib/legion/process_role.rb
 - lib/legion/readiness.rb
+- lib/legion/region.rb
+- lib/legion/region/failover.rb
 - lib/legion/registry.rb
 - lib/legion/registry/governance.rb
 - lib/legion/registry/persistence.rb