lex-agentic-self 0.1.0

data/lib/legion/extensions/agentic/self/identity/helpers/fingerprint.rb

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'time'
+
+module Legion
+  module Extensions
+    module Agentic
+      module Self
+        module Identity
+          module Helpers
+            class Fingerprint
+              attr_reader :model, :observation_count, :entropy_history
+
+              def initialize
+                @model = Dimensions.new_identity_model
+                @observation_count = 0
+                @entropy_history = []
+                load_from_local
+              end
+
+              def observe(dimension, value)
+                return unless Dimensions::IDENTITY_DIMENSIONS.include?(dimension)
+
+                dim = @model[dimension]
+                dim[:observations] += 1
+                @observation_count += 1
+
+                alpha = Dimensions::OBSERVATION_ALPHA
+                old_mean = dim[:mean]
+                dim[:mean] = (alpha * value) + ((1.0 - alpha) * old_mean)
+                deviation = (value - dim[:mean]).abs
+                dim[:variance] = (alpha * deviation) + ((1.0 - alpha) * dim[:variance])
+                dim[:last_observed] = Time.now.utc
+              end
+
+              def observe_all(observations)
+                observations.each { |dim, value| observe(dim, value) }
+              end
+
+              def current_entropy(observations = {})
+                entropy = Dimensions.compute_entropy(observations, @model)
+                @entropy_history << { entropy: entropy, at: Time.now.utc }
+                @entropy_history.shift while @entropy_history.size > 200
+                entropy
+              end
+
+              def entropy_trend(window: 10)
+                recent = @entropy_history.last(window)
+                return :stable if recent.size < 2
+
+                values = recent.map { |e| e[:entropy] }
+                first_half = values[0...(values.size / 2)]
+                second_half = values[(values.size / 2)..]
+
+                diff = (second_half.sum / second_half.size) - (first_half.sum / first_half.size)
+                if diff > 0.1
+                  :rising
+                elsif diff < -0.1
+                  :falling
+                else
+                  :stable
+                end
+              end
+
+              def maturity
+                if @observation_count < 10
+                  :nascent
+                elsif @observation_count < 100
+                  :developing
+                elsif @observation_count < 1000
+                  :established
+                else
+                  :mature
+                end
+              end
+
+              def to_h
+                {
+                  model:                @model,
+                  observation_count:    @observation_count,
+                  maturity:             maturity,
+                  entropy_history_size: @entropy_history.size
+                }
+              end
+
+              def save_to_local
+                return unless local_available?
+
+                db = Legion::Data::Local.connection
+
+                @model.each do |dimension, data|
+                  existing = db[:identity_fingerprint].where(dimension: dimension.to_s).first
+                  row = {
+                    dimension:     dimension.to_s,
+                    mean:          data[:mean],
+                    variance:      data[:variance],
+                    observations:  data[:observations],
+                    last_observed: data[:last_observed]
+                  }
+                  if existing
+                    db[:identity_fingerprint].where(dimension: dimension.to_s).update(row)
+                  else
+                    db[:identity_fingerprint].insert(row)
+                  end
+                end
+
+                history_json = ::JSON.generate(@entropy_history.map { |e| { entropy: e[:entropy], at: e[:at].iso8601 } })
+                meta = db[:identity_meta].first
+                if meta
+                  db[:identity_meta].where(id: meta[:id]).update(
+                    observation_count: @observation_count,
+                    entropy_history:   history_json
+                  )
+                else
+                  db[:identity_meta].insert(
+                    observation_count: @observation_count,
+                    entropy_history:   history_json
+                  )
+                end
+
+                true
+              rescue StandardError => e
+                Legion::Logging.warn "lex-identity: save_to_local failed: #{e.message}" if defined?(Legion::Logging)
+                false
+              end
+
+              def load_from_local
+                return unless local_available?
+
+                db = Legion::Data::Local.connection
+
+                db[:identity_fingerprint].each do |row|
+                  dim = row[:dimension].to_sym
+                  next unless @model.key?(dim)
+
+                  @model[dim][:mean]          = row[:mean].to_f
+                  @model[dim][:variance]      = row[:variance].to_f
+                  @model[dim][:observations]  = row[:observations].to_i
+                  @model[dim][:last_observed] = row[:last_observed]
+                end
+
+                meta = db[:identity_meta].first
+                if meta
+                  @observation_count = meta[:observation_count].to_i
+                  raw = meta[:entropy_history]
+                  if raw && !raw.empty?
+                    parsed = ::JSON.parse(raw)
+                    @entropy_history = parsed.map { |e| { entropy: e['entropy'].to_f, at: Time.parse(e['at']) } }
+                  end
+                end
+
+                true
+              rescue StandardError => e
+                Legion::Logging.warn "lex-identity: load_from_local failed: #{e.message}" if defined?(Legion::Logging)
+                false
+              end
+
+              private
+
+              def local_available?
+                defined?(Legion::Data::Local) && Legion::Data::Local.connected?
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/agentic/self/identity/helpers/graph_client.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Agentic
+      module Self
+        module Identity
+          module Helpers
+            module GraphClient
+              GRAPH_BASE = 'https://graph.microsoft.com/v1.0'
+
+              module_function
+
+              def connection(token:, base: GRAPH_BASE)
+                require 'faraday'
+                Faraday.new(url: base) do |conn|
+                  conn.request :json
+                  conn.response :json, content_type: /\bjson$/
+                  conn.headers['Authorization'] = "Bearer #{token}"
+                  conn.headers['Content-Type'] = 'application/json'
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/agentic/self/identity/helpers/graph_token.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Agentic
+      module Self
+        module Identity
+          module Helpers
+            module GraphToken
+              TOKEN_ENDPOINT = 'https://login.microsoftonline.com/%<tenant_id>s/oauth2/v2.0/token'
+              GRAPH_SCOPE = 'https://graph.microsoft.com/.default'
+
+              class GraphTokenError < StandardError; end
+
+              module_function
+
+              def fetch(tenant_id:, client_id:, client_secret:)
+                require 'faraday'
+                url = format(TOKEN_ENDPOINT, tenant_id: tenant_id)
+                conn = Faraday.new(url: url) do |c|
+                  c.request :url_encoded
+                  c.response :json, content_type: /\bjson$/
+                end
+                resp = conn.post('', grant_type: 'client_credentials', client_id: client_id,
+                                     client_secret: client_secret, scope: GRAPH_SCOPE)
+                raise GraphTokenError, resp.body['error_description'] unless resp.success?
+
+                resp.body['access_token']
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/agentic/self/identity/helpers/token_cache.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Agentic
+      module Self
+        module Identity
+          module Helpers
+            module TokenCache
+              REFRESH_BUFFER = 300
+
+              @mutex = Mutex.new
+              @tokens = {}
+
+              module_function
+
+              def store(worker_id:, token:, expires_in:)
+                @mutex.synchronize do
+                  @tokens[worker_id] = {
+                    access_token: token,
+                    expires_at:   Time.now + expires_in,
+                    acquired_at:  Time.now
+                  }
+                end
+              end
+
+              def fetch(worker_id:)
+                @mutex.synchronize do
+                  entry = @tokens[worker_id]
+                  return nil unless entry
+                  return nil if Time.now >= entry[:expires_at]
+
+                  entry
+                end
+              end
+
+              def approaching_expiry?(worker_id:, buffer: REFRESH_BUFFER)
+                @mutex.synchronize do
+                  entry = @tokens[worker_id]
+                  return true unless entry
+
+                  (entry[:expires_at] - Time.now) < buffer
+                end
+              end
+
+              def clear(worker_id:)
+                @mutex.synchronize { @tokens.delete(worker_id) }
+              end
+
+              def clear_all
+                @mutex.synchronize { @tokens.clear }
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/agentic/self/identity/helpers/vault_secrets.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Agentic
+      module Self
+        module Identity
+          module Helpers
+            # Vault secret path conventions for Digital Worker Entra ID credentials.
+            #
+            # Secrets are stored in Vault KV v2 under a well-known path:
+            #   secret/data/legion/workers/{worker_id}/entra
+            #
+            # Legion uses legion-crypt for Vault access. If Vault is not connected,
+            # methods return nil/false gracefully.
+            module VaultSecrets
+              VAULT_PATH_PREFIX = 'secret/data/legion/workers'
+
+              def self.secret_path(worker_id)
+                "#{VAULT_PATH_PREFIX}/#{worker_id}/entra"
+              end
+
+              # Store Entra app client_secret in Vault.
+              # Returns true on success, false if Vault is unavailable.
+              def self.store_client_secret(worker_id:, client_secret:, entra_app_id: nil)
+                return false unless vault_available?
+
+                path = secret_path(worker_id)
+                data = { client_secret: client_secret }
+                data[:entra_app_id] = entra_app_id if entra_app_id
+
+                Legion::Crypt.write(path, data)
+                Legion::Logging.info "[identity:vault] stored Entra credentials for worker=#{worker_id}"
+                true
+              rescue StandardError => e
+                Legion::Logging.error "[identity:vault] failed to store credentials for worker=#{worker_id}: #{e.message}"
+                false
+              end
+
+              # Read Entra app client_secret from Vault.
+              # Returns the secret hash on success, nil if unavailable or not found.
+              def self.read_client_secret(worker_id:)
+                return nil unless vault_available?
+
+                path = secret_path(worker_id)
+                result = Legion::Crypt.read(path)
+                result&.dig(:data, :data) || result&.dig(:data)
+              rescue StandardError => e
+                Legion::Logging.error "[identity:vault] failed to read credentials for worker=#{worker_id}: #{e.message}"
+                nil
+              end
+
+              # Delete Entra app credentials from Vault (used during worker termination).
+              # Returns true on success, false if Vault is unavailable.
+              def self.delete_client_secret(worker_id:)
+                return false unless vault_available?
+
+                path = secret_path(worker_id)
+                Legion::Crypt.delete(path)
+                Legion::Logging.info "[identity:vault] deleted Entra credentials for worker=#{worker_id}"
+                true
+              rescue StandardError => e
+                Legion::Logging.error "[identity:vault] failed to delete credentials for worker=#{worker_id}: #{e.message}"
+                false
+              end
+
+              def self.vault_available?
+                defined?(Legion::Crypt) &&
+                  defined?(Legion::Settings) &&
+                  Legion::Settings[:crypt][:vault][:connected] == true
+              rescue StandardError
+                false
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/agentic/self/identity/local_migrations/20260316000030_create_fingerprint.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+Sequel.migration do
+  change do
+    create_table(:identity_fingerprint) do
+      primary_key :id
+      String :dimension, null: false, unique: true
+      Float :mean, default: 0.0
+      Float :variance, default: 0.0
+      Integer :observations, default: 0
+      DateTime :last_observed
+    end
+
+    create_table(:identity_meta) do
+      primary_key :id
+      Integer :observation_count, default: 0
+      String :entropy_history, text: true
+    end
+  end
+end