lex-identity 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 18e33b5500f9d9b8ea10ec64025f01c80ecf3e31587c1d0933fe12f0a6b5a951
-  data.tar.gz: e3545bf086d36d22f7001ac6fbb523396b6380311d5c2a06aaabd7a22affdf90
+  metadata.gz: 402e57fb1c2fafdaac3bbbfd79ab0cd34d448798fe9f61e14511002845dc3d7c
+  data.tar.gz: 30585e986691ac0bee3bd2111f291fdc4adcef5c6ef83179c16a4e12d3e6eb67
 SHA512:
-  metadata.gz: a884c9d1092ab1560f008da1c5f45270d64f2702f31dc9316976a4c2e62cc4a8fe4c0cb127d4a13174170d192907cc7e9508401a77f00bc6676872cf3bbd13a0
-  data.tar.gz: cab921cd7605cc190b9cf5157d650c6816d4af46c0da7394b16b4b114fc556d82ed96b0135ee7eeac188df7f61dbb2ce0604fd7a868d295536ad673ae75e48f4
+  metadata.gz: 87d225ef73a724bcbf18649664670e56ed5eb93c7f5f2312ee19cf70550191c41849a4e25bb303aee50e98b330962269cd2c0c53c3781f5926a5fca89ed047f4
+  data.tar.gz: 798d6de090c2666919a3bc778adb4decaa0c08e586a14d03fc6e781a13ad2d33ecad0cb35f852b41c12d59c830c0f69b248aaddafe54e6b59e96d4800129dc47

data/Gemfile

@@ -1,11 +1,9 @@
 # frozen_string_literal: true
 
 source 'https://rubygems.org'
+
 gemspec
 
-group :development, :test do
-  gem 'rspec', '~> 3.13'
-  gem 'rubocop', '~> 1.75'
-  gem 'rubocop-legion', '~> 0.1'
-  gem 'simplecov', '~> 0.22'
-end
+gem 'faraday', '~> 2.0'
+gem 'rspec', '~> 3.13'
+gem 'rubocop', '~> 1.75', require: false

data/lex-identity.gemspec

@@ -5,29 +5,26 @@ require_relative 'lib/legion/extensions/identity/version'
 Gem::Specification.new do |spec|
   spec.name          = 'lex-identity'
   spec.version       = Legion::Extensions::Identity::VERSION
-  spec.authors       = ['LegionIO']
+  spec.authors       = ['Esity']
+  spec.email         = ['matthewdiverson@gmail.com']
 
-  spec.summary       = 'Shared LegionIO identity extension base'
-  spec.description   = 'Base extension gem for shared behavior across LegionIO identity provider extensions.'
+  spec.summary       = 'LEX Identity'
+  spec.description   = 'Human partner identity modeling and behavioral entropy for brain-modeled agentic AI'
   spec.homepage      = 'https://github.com/LegionIO/lex-identity'
   spec.license       = 'MIT'
   spec.required_ruby_version = '>= 3.4'
 
-  spec.metadata['homepage_uri']         = spec.homepage
-  spec.metadata['source_code_uri']      = spec.homepage
-  spec.metadata['documentation_uri']    = "#{spec.homepage}/blob/main/README.md"
-  spec.metadata['changelog_uri']        = "#{spec.homepage}/blob/main/CHANGELOG.md"
-  spec.metadata['bug_tracker_uri']      = "#{spec.homepage}/issues"
+  spec.metadata['homepage_uri'] = spec.homepage
+  spec.metadata['source_code_uri'] = 'https://github.com/LegionIO/lex-identity'
+  spec.metadata['documentation_uri'] = 'https://github.com/LegionIO/lex-identity'
+  spec.metadata['changelog_uri'] = 'https://github.com/LegionIO/lex-identity'
+  spec.metadata['bug_tracker_uri'] = 'https://github.com/LegionIO/lex-identity/issues'
   spec.metadata['rubygems_mfa_required'] = 'true'
 
   spec.files = Dir.chdir(File.expand_path(__dir__)) do
-    Dir.glob('{lib,spec/support}/**/*.rb') + %w[lex-identity.gemspec Gemfile LICENSE README.md CHANGELOG.md]
+    Dir.glob('{lib,spec}/**/*') + %w[lex-identity.gemspec Gemfile]
   end
   spec.require_paths = ['lib']
-
-  spec.add_dependency 'faraday',         '~> 2.0'
-  spec.add_dependency 'legion-cache',    '>= 1.3.0'
-  spec.add_dependency 'legion-json',     '>= 1.2.1'
-  spec.add_dependency 'legion-logging',  '>= 1.5.3'
-  spec.add_dependency 'legion-settings', '>= 1.3.14'
+  spec.add_development_dependency 'sequel',  '>= 5.70'
+  spec.add_development_dependency 'sqlite3', '>= 2.0'
 end

data/lib/legion/extensions/identity/actors/credential_refresh.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'legion/extensions/actors/every'
+
+module Legion
+  module Extensions
+    module Identity
+      module Actor
+        class CredentialRefresh < Legion::Extensions::Actors::Every
+          CREDENTIAL_REFRESH_INTERVAL = 21_600 # 6 hours
+
+          def runner_class
+            Legion::Extensions::Identity::Runners::Entra
+          end
+
+          def runner_function
+            'credential_refresh_cycle'
+          end
+
+          def time
+            CREDENTIAL_REFRESH_INTERVAL
+          end
+
+          def enabled?
+            defined?(Legion::Data) && Legion::Settings[:data][:connected] != false
+          rescue StandardError
+            false
+          end
+
+          def use_runner?
+            false
+          end
+
+          def check_subtask?
+            false
+          end
+
+          def generate_task?
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/actors/orphan_check.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require 'legion/extensions/actors/every'
+
+module Legion
+  module Extensions
+    module Identity
+      module Actor
+        # Periodic orphan detection: scans active workers for disabled Entra apps
+        # or inactive owners. Runs every 4 hours by default.
+        # Requires legion-data for worker records.
+        class OrphanCheck < Legion::Extensions::Actors::Every
+          ORPHAN_CHECK_INTERVAL = 14_400 # 4 hours in seconds
+
+          def runner_class
+            Legion::Extensions::Identity::Runners::Entra
+          end
+
+          def runner_function
+            'check_orphans'
+          end
+
+          def time
+            ORPHAN_CHECK_INTERVAL
+          end
+
+          def enabled?
+            defined?(Legion::Data) && Legion::Settings[:data][:connected] != false
+          rescue StandardError
+            false
+          end
+
+          def use_runner?
+            false
+          end
+
+          def check_subtask?
+            false
+          end
+
+          def generate_task?
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/client.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'legion/extensions/identity/helpers/dimensions'
+require 'legion/extensions/identity/helpers/fingerprint'
+require 'legion/extensions/identity/runners/identity'
+
+module Legion
+  module Extensions
+    module Identity
+      class Client
+        include Runners::Identity
+
+        def initialize(**)
+          @identity_fingerprint = Helpers::Fingerprint.new
+        end
+
+        private
+
+        attr_reader :identity_fingerprint
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/helpers/dimensions.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Identity
+      module Helpers
+        module Dimensions
+          # The 6 behavioral dimensions that constitute identity
+          IDENTITY_DIMENSIONS = %i[
+            communication_cadence
+            vocabulary_patterns
+            emotional_response
+            decision_patterns
+            contextual_consistency
+            temporal_patterns
+          ].freeze
+
+          # Entropy thresholds (from tick-loop-spec Phase 4)
+          HIGH_ENTROPY_THRESHOLD = 0.70
+          LOW_ENTROPY_THRESHOLD  = 0.20
+          OPTIMAL_ENTROPY_RANGE  = (0.20..0.70)
+
+          # EMA alpha for dimension updates
+          OBSERVATION_ALPHA = 0.1
+
+          module_function
+
+          def new_identity_model
+            IDENTITY_DIMENSIONS.to_h do |dim|
+              [dim, { mean: 0.5, variance: 0.1, observations: 0, last_observed: nil }]
+            end
+          end
+
+          def compute_entropy(observations, model)
+            return 0.5 if observations.empty?
+
+            divergences = IDENTITY_DIMENSIONS.filter_map do |dim|
+              obs = observations[dim]
+              next unless obs
+
+              baseline = model[dim]
+              next 0.0 unless baseline && baseline[:observations].positive?
+
+              # Weighted divergence from established baseline
+              (obs - baseline[:mean]).abs / [baseline[:variance].to_f, 0.1].max
+            end
+
+            return 0.5 if divergences.empty?
+
+            raw = divergences.sum / divergences.size
+            clamp(raw / 3.0) # normalize: divergence of 3.0 stddevs = entropy 1.0
+          end
+
+          def classify_entropy(entropy)
+            if entropy > HIGH_ENTROPY_THRESHOLD
+              :high_entropy
+            elsif entropy < LOW_ENTROPY_THRESHOLD
+              :low_entropy
+            else
+              :normal
+            end
+          end
+
+          def clamp(value, min = 0.0, max = 1.0)
+            value.clamp(min, max)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/helpers/fingerprint.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'time'
+
+module Legion
+  module Extensions
+    module Identity
+      module Helpers
+        class Fingerprint
+          attr_reader :model, :observation_count, :entropy_history
+
+          def initialize
+            @model = Dimensions.new_identity_model
+            @observation_count = 0
+            @entropy_history = []
+            load_from_local
+          end
+
+          def observe(dimension, value)
+            return unless Dimensions::IDENTITY_DIMENSIONS.include?(dimension)
+
+            dim = @model[dimension]
+            dim[:observations] += 1
+            @observation_count += 1
+
+            alpha = Dimensions::OBSERVATION_ALPHA
+            old_mean = dim[:mean]
+            dim[:mean] = (alpha * value) + ((1.0 - alpha) * old_mean)
+            deviation = (value - dim[:mean]).abs
+            dim[:variance] = (alpha * deviation) + ((1.0 - alpha) * dim[:variance])
+            dim[:last_observed] = Time.now.utc
+          end
+
+          def observe_all(observations)
+            observations.each { |dim, value| observe(dim, value) }
+          end
+
+          def current_entropy(observations = {})
+            entropy = Dimensions.compute_entropy(observations, @model)
+            @entropy_history << { entropy: entropy, at: Time.now.utc }
+            @entropy_history.shift while @entropy_history.size > 200
+            entropy
+          end
+
+          def entropy_trend(window: 10)
+            recent = @entropy_history.last(window)
+            return :stable if recent.size < 2
+
+            values = recent.map { |e| e[:entropy] }
+            first_half = values[0...(values.size / 2)]
+            second_half = values[(values.size / 2)..]
+
+            diff = (second_half.sum / second_half.size) - (first_half.sum / first_half.size)
+            if diff > 0.1
+              :rising
+            elsif diff < -0.1
+              :falling
+            else
+              :stable
+            end
+          end
+
+          def maturity
+            if @observation_count < 10
+              :nascent
+            elsif @observation_count < 100
+              :developing
+            elsif @observation_count < 1000
+              :established
+            else
+              :mature
+            end
+          end
+
+          def to_h
+            {
+              model:                @model,
+              observation_count:    @observation_count,
+              maturity:             maturity,
+              entropy_history_size: @entropy_history.size
+            }
+          end
+
+          def save_to_local
+            return unless local_available?
+
+            db = Legion::Data::Local.connection
+
+            @model.each do |dimension, data|
+              existing = db[:identity_fingerprint].where(dimension: dimension.to_s).first
+              row = {
+                dimension:     dimension.to_s,
+                mean:          data[:mean],
+                variance:      data[:variance],
+                observations:  data[:observations],
+                last_observed: data[:last_observed]
+              }
+              if existing
+                db[:identity_fingerprint].where(dimension: dimension.to_s).update(row)
+              else
+                db[:identity_fingerprint].insert(row)
+              end
+            end
+
+            history_json = ::JSON.generate(@entropy_history.map { |e| { entropy: e[:entropy], at: e[:at].iso8601 } })
+            meta = db[:identity_meta].first
+            if meta
+              db[:identity_meta].where(id: meta[:id]).update(
+                observation_count: @observation_count,
+                entropy_history:   history_json
+              )
+            else
+              db[:identity_meta].insert(
+                observation_count: @observation_count,
+                entropy_history:   history_json
+              )
+            end
+
+            true
+          rescue StandardError => e
+            Legion::Logging.warn "lex-identity: save_to_local failed: #{e.message}" if defined?(Legion::Logging)
+            false
+          end
+
+          def load_from_local
+            return unless local_available?
+
+            db = Legion::Data::Local.connection
+
+            db[:identity_fingerprint].each do |row|
+              dim = row[:dimension].to_sym
+              next unless @model.key?(dim)
+
+              @model[dim][:mean]          = row[:mean].to_f
+              @model[dim][:variance]      = row[:variance].to_f
+              @model[dim][:observations]  = row[:observations].to_i
+              @model[dim][:last_observed] = row[:last_observed]
+            end
+
+            meta = db[:identity_meta].first
+            if meta
+              @observation_count = meta[:observation_count].to_i
+              raw = meta[:entropy_history]
+              if raw && !raw.empty?
+                parsed = ::JSON.parse(raw)
+                @entropy_history = parsed.map { |e| { entropy: e['entropy'].to_f, at: Time.parse(e['at']) } }
+              end
+            end
+
+            true
+          rescue StandardError => e
+            Legion::Logging.warn "lex-identity: load_from_local failed: #{e.message}" if defined?(Legion::Logging)
+            false
+          end
+
+          private
+
+          def local_available?
+            defined?(Legion::Data::Local) && Legion::Data::Local.connected?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/helpers/graph_client.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Identity
+      module Helpers
+        module GraphClient
+          GRAPH_BASE = 'https://graph.microsoft.com/v1.0'
+
+          module_function
+
+          def connection(token:, base: GRAPH_BASE)
+            require 'faraday'
+            Faraday.new(url: base) do |conn|
+              conn.request :json
+              conn.response :json, content_type: /\bjson$/
+              conn.headers['Authorization'] = "Bearer #{token}"
+              conn.headers['Content-Type'] = 'application/json'
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/helpers/graph_token.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Identity
+      module Helpers
+        module GraphToken
+          TOKEN_ENDPOINT = 'https://login.microsoftonline.com/%<tenant_id>s/oauth2/v2.0/token'
+          GRAPH_SCOPE = 'https://graph.microsoft.com/.default'
+
+          class GraphTokenError < StandardError; end
+
+          module_function
+
+          def fetch(tenant_id:, client_id:, client_secret:)
+            require 'faraday'
+            url = format(TOKEN_ENDPOINT, tenant_id: tenant_id)
+            conn = Faraday.new(url: url) do |c|
+              c.request :url_encoded
+              c.response :json, content_type: /\bjson$/
+            end
+            resp = conn.post('', grant_type: 'client_credentials', client_id: client_id,
+                                 client_secret: client_secret, scope: GRAPH_SCOPE)
+            raise GraphTokenError, resp.body['error_description'] unless resp.success?
+
+            resp.body['access_token']
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/helpers/token_cache.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Identity
+      module Helpers
+        module TokenCache
+          REFRESH_BUFFER = 300
+
+          @mutex = Mutex.new
+          @tokens = {}
+
+          module_function
+
+          def store(worker_id:, token:, expires_in:)
+            @mutex.synchronize do
+              @tokens[worker_id] = {
+                access_token: token,
+                expires_at:   Time.now + expires_in,
+                acquired_at:  Time.now
+              }
+            end
+          end
+
+          def fetch(worker_id:)
+            @mutex.synchronize do
+              entry = @tokens[worker_id]
+              return nil unless entry
+              return nil if Time.now >= entry[:expires_at]
+
+              entry
+            end
+          end
+
+          def approaching_expiry?(worker_id:, buffer: REFRESH_BUFFER)
+            @mutex.synchronize do
+              entry = @tokens[worker_id]
+              return true unless entry
+
+              (entry[:expires_at] - Time.now) < buffer
+            end
+          end
+
+          def clear(worker_id:)
+            @mutex.synchronize { @tokens.delete(worker_id) }
+          end
+
+          def clear_all
+            @mutex.synchronize { @tokens.clear }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/helpers/vault_secrets.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module Legion
+  module Extensions
+    module Identity
+      module Helpers
+        # Vault secret path conventions for Digital Worker Entra ID credentials.
+        #
+        # Secrets are stored in Vault KV v2 under a well-known path:
+        #   secret/data/legion/workers/{worker_id}/entra
+        #
+        # Legion uses legion-crypt for Vault access. If Vault is not connected,
+        # methods return nil/false gracefully.
+        module VaultSecrets
+          VAULT_PATH_PREFIX = 'secret/data/legion/workers'
+
+          def self.secret_path(worker_id)
+            "#{VAULT_PATH_PREFIX}/#{worker_id}/entra"
+          end
+
+          # Store Entra app client_secret in Vault.
+          # Returns true on success, false if Vault is unavailable.
+          def self.store_client_secret(worker_id:, client_secret:, entra_app_id: nil)
+            return false unless vault_available?
+
+            path = secret_path(worker_id)
+            data = { client_secret: client_secret }
+            data[:entra_app_id] = entra_app_id if entra_app_id
+
+            Legion::Crypt.write(path, data)
+            Legion::Logging.info "[identity:vault] stored Entra credentials for worker=#{worker_id}"
+            true
+          rescue StandardError => e
+            Legion::Logging.error "[identity:vault] failed to store credentials for worker=#{worker_id}: #{e.message}"
+            false
+          end
+
+          # Read Entra app client_secret from Vault.
+          # Returns the secret hash on success, nil if unavailable or not found.
+          def self.read_client_secret(worker_id:)
+            return nil unless vault_available?
+
+            path = secret_path(worker_id)
+            result = Legion::Crypt.read(path)
+            result&.dig(:data, :data) || result&.dig(:data)
+          rescue StandardError => e
+            Legion::Logging.error "[identity:vault] failed to read credentials for worker=#{worker_id}: #{e.message}"
+            nil
+          end
+
+          # Delete Entra app credentials from Vault (used during worker termination).
+          # Returns true on success, false if Vault is unavailable.
+          def self.delete_client_secret(worker_id:)
+            return false unless vault_available?
+
+            path = secret_path(worker_id)
+            Legion::Crypt.delete(path)
+            Legion::Logging.info "[identity:vault] deleted Entra credentials for worker=#{worker_id}"
+            true
+          rescue StandardError => e
+            Legion::Logging.error "[identity:vault] failed to delete credentials for worker=#{worker_id}: #{e.message}"
+            false
+          end
+
+          def self.vault_available?
+            defined?(Legion::Crypt) &&
+              defined?(Legion::Settings) &&
+              Legion::Settings[:crypt][:vault][:connected] == true
+          rescue StandardError
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/legion/extensions/identity/local_migrations/20260316000030_create_fingerprint.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+Sequel.migration do
+  change do
+    create_table(:identity_fingerprint) do
+      primary_key :id
+      String :dimension, null: false, unique: true
+      Float :mean, default: 0.0
+      Float :variance, default: 0.0
+      Integer :observations, default: 0
+      DateTime :last_observed
+    end
+
+    create_table(:identity_meta) do
+      primary_key :id
+      Integer :observation_count, default: 0
+      String :entropy_history, text: true
+    end
+  end
+end