@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/runtime/invoice_parser_service.py

@@ -0,0 +1,89 @@
+"""Private bounded PDF RPC container; never expose as an anonymous public service.
+
+Hosting must restrict callers to the worker, isolate this container and grant it
+no document-store, database, model or destination permissions. Provider ingress
+auth/network/TLS is a separate infrastructure boundary, not an HTTP header trust
+claim made by this server. No request selects a URL, file, command or credential.
+"""
+from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
+import hashlib
+import json
+import os
+import socket
+import sys
+from pathlib import Path
+import threading
+import time
+sys.path.insert(0,str(Path(__file__).resolve().parent))
+from invoice_document import PdfDocument,DocumentError
+
+LIMIT=10000000
+
+class ParserServer(ThreadingHTTPServer):
+    daemon_threads=True
+    request_queue_size=16
+    def __init__(self,address,parser,authorize=None):
+        if authorize is not None and not callable(authorize):raise ValueError('Use the owned parser authorization adapter')
+        self.parser=parser;self.authorize=authorize;self.slot=threading.BoundedSemaphore(1);super().__init__(address,ParserHandler)
+
+class ParserHandler(BaseHTTPRequestHandler):
+    protocol_version='HTTP/1.0'
+    def log_message(self,*args):pass
+    def setup(self):
+        super().setup();self.connection.settimeout(5)
+    def reply(self,status,value):
+        body=json.dumps(value,ensure_ascii=False,allow_nan=False).encode('utf-8')
+        self.send_response(status);self.send_header('Content-Type','application/json');self.send_header('Content-Length',str(len(body)));self.send_header('Cache-Control','no-store');self.send_header('X-Content-Type-Options','nosniff');self.end_headers();self.wfile.write(body)
+    def do_GET(self):
+        if self.path=='/healthz':self.reply(200,{'status':'running'})
+        else:self.reply(404,{'status':'rejected','reason':'invalid_request'})
+    def do_POST(self):
+        if self.path!='/extract':self.reply(404,{'status':'rejected','reason':'invalid_request'});return
+        if self.server.authorize is not None:
+            try:
+                headers=self.headers.get_all('Authorization')or[]
+                if len(headers)!=1 or not headers[0].startswith('Bearer '):raise PermissionError()
+                self.server.authorize(headers[0][7:])
+            except Exception:self.reply(403,{'status':'rejected','reason':'access_denied'});return
+        # Reject ambiguous framing rather than trusting a proxy's normalization.
+        lengths=self.headers.get_all('Content-Length')or[]
+        if self.headers.get('Transfer-Encoding')or len(lengths)!=1 or not lengths[0].isascii()or not lengths[0].isdigit():self.reply(411,{'status':'rejected','reason':'invalid_request'});return
+        if len(lengths[0])>10 or not 1<=int(lengths[0])<=LIMIT:self.reply(413,{'status':'rejected','reason':'document_too_large'});return
+        if self.headers.get('Content-Type','').split(';')[0].lower()!='application/pdf':self.reply(415,{'status':'rejected','reason':'invalid_pdf'});return
+        if not self.server.slot.acquire(blocking=False):self.reply(429,{'status':'rejected','reason':'busy'});return
+        try:
+            remaining=int(lengths[0]);body=bytearray();deadline=time.monotonic()+15
+            while remaining:
+                left=deadline-time.monotonic()
+                if left<=0:raise TimeoutError()
+                self.connection.settimeout(min(5,left));chunk=self.rfile.read1(min(remaining,65536))
+                if not chunk:raise ValueError('Incomplete PDF body')
+                body.extend(chunk);remaining-=len(chunk)
+            raw=bytes(body);self.connection.settimeout(5)
+            document=self.server.parser.extract(raw,hashlib.sha256(raw).hexdigest())
+            self.reply(200,{'status':'ok','document':document})
+        except DocumentError as error:self.reply(422,{'status':'rejected','reason':error.code})
+        except(TimeoutError,socket.timeout):self.reply(408,{'status':'rejected','reason':'upload_timeout'})
+        except ValueError:self.reply(400,{'status':'rejected','reason':'invalid_request'})
+        except Exception:self.reply(503,{'status':'rejected','reason':'extraction_unavailable'})
+        finally:self.server.slot.release()
+
+def main():
+    # These checks catch common accidental mounts. Infrastructure admission still
+    # must prove that this separate workload has no inherited cloud authority.
+    forbidden=['DATABASE_PASSWORD','DATABASE_PASSWORD_FILE','DATABASE_HOST','DATABASE_CONNECTION_NAME','DESTINATION_TOKEN_FILE','DESTINATION_ENDPOINT','GOOGLE_APPLICATION_CREDENTIALS','AWS_ACCESS_KEY_ID','AWS_SECRET_ACCESS_KEY','AWS_CONTAINER_CREDENTIALS_RELATIVE_URI','AWS_CONTAINER_CREDENTIALS_FULL_URI','IDENTITY_ENDPOINT','IDENTITY_HEADER','MSI_ENDPOINT','MSI_SECRET']
+    if any(os.environ.get(key)for key in forbidden)or Path('/var/run/secrets/codeengine.cloud.ibm.com/compute-resource-token/token').exists():raise ValueError('Do not supply parser database, action or workload credentials')
+    port=int(os.environ.get('PORT','8080'))
+    if not 1024<=port<=65535:raise ValueError('Use the owned nonprivileged parser port')
+    mode=os.environ.get('PARSER_AUTH_MODE','private-ingress');authorize=None
+    if mode=='entra-workload':
+        from invoice_parser_identity import EntraParserVerifier
+        authorize=EntraParserVerifier(*[os.environ[name]for name in ['PARSER_TENANT_ID','PARSER_AUDIENCE','PARSER_WORKER_CLIENT_ID','PARSER_WORKER_PRINCIPAL_ID']])
+    elif mode=='shared-token':
+        from invoice_parser_identity import SharedParserVerifier
+        authorize=SharedParserVerifier(os.environ.pop('PARSER_SHARED_TOKEN',''))
+    elif mode!='private-ingress':raise ValueError('Use the owned parser authorization mode')
+    elif 'PARSER_SHARED_TOKEN'in os.environ:raise ValueError('Parser token requires explicit authenticated mode')
+    ParserServer(('0.0.0.0',port),PdfDocument(),authorize).serve_forever(poll_interval=.2)
+
+if __name__=='__main__':main()

package/src/runtime/invoice_parser_transport.py

@@ -0,0 +1,89 @@
+"""Worker-only private HTTPS parser contract. Endpoint/auth are operator-owned."""
+import json
+import re
+import time
+from urllib.parse import urlsplit
+import requests
+from invoice_document import DocumentError
+from invoice_extraction import document_evidence
+from invoice_object_store import digest_pdf
+from structured_output import _object
+from workflow_errors import TemporaryWork
+
+class ParserClient:
+    def __init__(self,endpoint,authorization=None,*,session=None):
+        try:target=urlsplit(endpoint)
+        except(ValueError,TypeError):raise ValueError('Use the exact private parser endpoint')from None
+        if(not isinstance(endpoint,str)or len(endpoint)>2000 or target.scheme!='https'or not target.hostname or target.path!='/extract'
+           or target.query or target.fragment or target.username or target.password or any(ord(c)<33 or ord(c)>126 for c in endpoint)):raise ValueError('Use the owned private HTTPS /extract endpoint')
+        try:port=target.port
+        except ValueError:raise ValueError('Use the owned private parser port')from None
+        if port is not None and not 1<=port<=65535:raise ValueError('Use the owned private parser port')
+        if authorization is not None and not callable(authorization):raise ValueError('Use owned native caller authorization')
+        self.endpoint=endpoint;self.authorization=authorization;self.session=session or requests.Session();self.session.trust_env=False
+    def __call__(self,raw):
+        digest=digest_pdf(raw);headers={'Content-Type':'application/pdf'}
+        try:
+            if self.authorization is not None:
+                token=self.authorization()
+                if not isinstance(token,str)or not token.startswith('Bearer ')or not 8<=len(token)<=20000 or any(ord(c)<33 or ord(c)>126 for c in token[7:]):raise ValueError('Invalid parser caller identity')
+                headers['Authorization']=token
+            deadline=time.monotonic()+125
+            with self.session.post(self.endpoint,data=raw,headers=headers,timeout=(2,115),allow_redirects=False,stream=True)as response:
+                if response.status_code in {408,429,500,502,503,504}:raise TemporaryWork('PDF parsing is temporarily unavailable')
+                if response.status_code==422:raise DocumentError('unreadable_pdf')
+                if response.status_code!=200:raise TemporaryWork('Private parser admission is unavailable')
+                content=bytearray()
+                for chunk in response.iter_content(1):
+                    content.extend(chunk)
+                    if len(content)>120500 or time.monotonic()>deadline:raise ValueError('Parser response exceeds its boundary')
+            value=json.loads(content,object_pairs_hook=_object,parse_constant=lambda _:(_ for _ in ()).throw(ValueError('Nonfinite parser output')))
+            if not isinstance(value,dict)or set(value)!={'status','document'}or value['status']!='ok':raise ValueError('Invalid parser response')
+            document=value['document'];document_evidence(document)
+            if document['sha256']!=digest:raise ValueError('Parser original digest differs')
+            return document
+        except(DocumentError,TemporaryWork):raise
+        except Exception:raise TemporaryWork('Private parser could not confirm extraction')from None
+
+def google_parser_authorization(audience,session=None):
+    if not isinstance(audience,str)or not re.fullmatch(r'https://[a-z0-9-]+(?:\.[a-z0-9-]+)?\.run\.app',audience):raise ValueError('Use the owned Cloud Run parser audience')
+    session=session or requests.Session();session.trust_env=False
+    def read():
+        deadline=time.monotonic()+4
+        with session.get('http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity',params={'audience':audience,'format':'full'},headers={'Metadata-Flavor':'Google'},allow_redirects=False,timeout=(1,2),stream=True)as response:
+            if response.status_code!=200 or response.headers.get('Metadata-Flavor')!='Google':raise TemporaryWork('Parser workload identity unavailable')
+            raw=bytearray()
+            for chunk in response.iter_content(1):
+                raw.extend(chunk)
+                if len(raw)>16384 or time.monotonic()>deadline:raise TemporaryWork('Parser workload identity unavailable')
+        value=raw.decode('ascii')
+        if not value or any(ord(c)<33 or ord(c)>126 for c in value):raise TemporaryWork('Parser workload identity unavailable')
+        return'Bearer '+value
+    return read
+
+def azure_parser_authorization(audience,worker_client,credential=None):
+    uuid=r'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
+    if any(not isinstance(value,str)or not re.fullmatch(uuid,value)for value in [audience,worker_client]):raise ValueError('Use the exact owned parser audience and worker client')
+    if credential is None:
+        from azure.identity import ManagedIdentityCredential
+        credential=ManagedIdentityCredential(client_id=worker_client,retry_total=0,connection_timeout=1,read_timeout=2)
+    def read():
+        try:return'Bearer '+credential.get_token('api://'+audience+'/.default').token
+        except Exception:raise TemporaryWork('Parser workload identity unavailable')from None
+    return read
+
+def ibm_parser_authorization(path):
+    from pathlib import Path
+    import os
+    import stat
+    source=Path(path)
+    if not source.is_absolute():raise ValueError('Use the separately mounted owned parser token file')
+    def read():
+        try:
+            metadata=source.stat()
+            if not stat.S_ISREG(metadata.st_mode)or metadata.st_uid!=os.geteuid()or metadata.st_mode&0o077 or metadata.st_size!=64:raise ValueError('Unowned or invalid parser token file')
+            with source.open('rb')as stream:token=stream.read(65).decode('ascii')
+            if not re.fullmatch(r'[0-9a-f]{64}',token):raise ValueError('Invalid parser token')
+            return'Bearer '+token
+        except Exception:raise TemporaryWork('Parser admission credential unavailable')from None
+    return read

package/src/runtime/invoice_processing.py

@@ -0,0 +1,24 @@
+"""The actual storage -> isolated parser -> model -> independent decoder composition."""
+from invoice_document import DocumentError
+from invoice_extraction import extract_invoice,document_evidence
+from invoice_object_store import ObjectUnavailable,digest_pdf
+from workflow_errors import TemporaryWork,PermanentWork
+from invoice_retention import retained
+
+class InvoiceProcessor:
+    def __init__(self,objects,parser,model):
+        if not callable(parser)or not callable(getattr(model,'generate',None)):raise ValueError('Use the owned parser and model adapters')
+        self.objects=objects;self.parser=parser;self.model=model
+    def __call__(self,row):
+        if not retained(row):raise PermanentWork('Invoice retention period ended; do not read the original or call the model')
+        try:
+            source=row['source_ref'];raw=self.objects.load(str(row['account_id']),source)
+            if digest_pdf(raw)!=source['sha256']:raise ValueError('Original identity changed')
+            document=self.parser(raw);document_evidence(document)
+            if document['sha256']!=source['sha256']:raise ValueError('Parsed original identity changed')
+        except DocumentError:raise PermanentWork('This PDF needs review before extraction can continue')from None
+        except(ObjectUnavailable,TemporaryWork):raise TemporaryWork('Original or parser temporarily unavailable')from None
+        except Exception:raise PermanentWork('Original or parsed evidence could not be verified')from None
+        try:return extract_invoice(document,self.model.generate)
+        except(ValueError,TypeError,UnicodeError,RecursionError):raise PermanentWork('Invoice suggestions need review')from None
+        except Exception:raise TemporaryWork('Model processing is temporarily unavailable')from None

package/src/runtime/invoice_retention.py

@@ -0,0 +1,16 @@
+"""Invoice payload access expires independently of asynchronous physical cleanup."""
+from datetime import datetime,timedelta,timezone
+
+def retained(row):
+    created=row.get('created_at')
+    if isinstance(created,str):
+        try:created=datetime.fromisoformat(created)
+        except ValueError:return False
+    if not isinstance(created,datetime)or created.tzinfo is None:return False
+    now=datetime.now(timezone.utc)
+    return now-timedelta(days=90)<created<=now+timedelta(minutes=5)
+
+def current(row):
+    from durable_workflow import Missing
+    if not retained(row):raise Missing('Invoice retention period ended')
+    return row

package/src/runtime/invoice_runtime_secrets.py

@@ -0,0 +1,43 @@
+"""Turn native platform secret injections into private runtime files, never exports.
+
+The infrastructure supplies secret references, not values in Terraform/source.
+Platforms resolve them at startup. Rotation requires the documented workload
+rollout; this module does not claim cloud-mounted files refresh automatically.
+The untrusted parser never receives these values or this directory.
+"""
+import atexit
+import os
+import re
+from pathlib import Path
+import shutil
+import tempfile
+
+def prepare_runtime_environment(provider,environment,role):
+    if provider not in {'aws','azure','gcp','ibm'}or role not in {'api','worker'}:raise ValueError('Use the owned native workload and role')
+    env=dict(environment)
+    if any(name in env for name in ['PARSER_SHARED_TOKEN','PARSER_SHARED_TOKEN_FILE'])and(provider!='ibm'or role!='worker'):raise ValueError('Only the IBM extraction worker receives parser admission authority')
+    if 'PARSER_SHARED_TOKEN'in env and(not isinstance(env['PARSER_SHARED_TOKEN'],str)or not re.fullmatch(r'[0-9a-f]{64}',env['PARSER_SHARED_TOKEN'])):raise ValueError('Use a separately provisioned 256-bit parser token')
+    if role=='api'and any(name in env for name in ['DESTINATION_TOKEN','DESTINATION_TOKEN_FILE']):raise ValueError('Do not inject outbound credentials into the API')
+    if provider!='ibm'and'DATABASE_PASSWORD'in env:raise ValueError('IAM database workloads must not receive a SQL password')
+    mapping={'PARSER_SHARED_TOKEN':('PARSER_SHARED_TOKEN_FILE','parser-token',64),'DATABASE_CA_PEM':('DATABASE_CA_FILE','database-ca.pem',256000),'DATABASE_PASSWORD':('DATABASE_PASSWORD_FILE','database-password',500),'DESTINATION_TOKEN':('DESTINATION_TOKEN_FILE','destination-token',16000)}
+    selected=[]
+    for name,(pointer,filename,maximum)in mapping.items():
+        if name not in env:continue
+        value=env[name]
+        if pointer in env or not isinstance(value,str)or not value or len(value.encode('utf-8'))>maximum or'\0'in value:raise ValueError('Invalid or conflicting native secret injection')
+        if name=='DESTINATION_TOKEN'and any(ord(c)<33 or ord(c)>126 for c in value):raise ValueError('Use the owned opaque action token')
+        if name=='DATABASE_CA_PEM'and'-----BEGIN CERTIFICATE-----'not in value:raise ValueError('Use the native database CA certificate')
+        selected.append((name,pointer,filename,value))
+    if not selected:return env
+    directory=Path(tempfile.mkdtemp(prefix='atmem-private-runtime-'));directory.chmod(0o700)
+    try:
+        for name,pointer,filename,value in selected:
+            path=directory/filename
+            # Private at creation, even under a permissive inherited umask.
+            descriptor=os.open(path,os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
+            with os.fdopen(descriptor,'wb')as stream:stream.write(value.encode('utf-8'))
+            env[pointer]=str(path);env.pop(name)
+            if environment is os.environ:os.environ.pop(name,None)
+        atexit.register(shutil.rmtree,directory,ignore_errors=True)
+        return env
+    except BaseException:shutil.rmtree(directory,ignore_errors=True);raise

package/src/runtime/invoice_stage.py

@@ -0,0 +1,80 @@
+"""Trusted bounded worker child. JSON-only protocol, no request-selected commands."""
+import json
+import os
+from pathlib import Path
+import sys
+sys.path.insert(0,str(Path(__file__).resolve().parent))
+from invoice_native import native_objects,owned_deployment,destination_contract,mounted_secret
+from invoice_processing import InvoiceProcessor
+from invoice_parser_transport import ParserClient,google_parser_authorization,azure_parser_authorization,ibm_parser_authorization
+from approved_http_destination import ApprovedHttpDestination
+from workflow_contract import normalized_contract
+from workflow_errors import TemporaryWork,PermanentWork,ExternalOutcomeUnknown,DestinationNotAttempted,InvalidDispatch
+from structured_output import _object
+from policy_review import verify_policy_review
+
+def replay_review(environment,contract):
+    encoded=environment.get('DESTINATION_REPLAY_REVIEW_BASE64','')
+    if not encoded:return False
+    if not isinstance(encoded,str)or len(encoded)>8192:raise ValueError('Invalid owned destination review')
+    verify_policy_review(encoded,{'contract':contract,'idempotency':'same-key-same-payload-one-effect'})
+    return True
+
+def native_processor(provider,environment,*,objects=None,parser=None,model=None):
+    if provider not in {'aws','azure','gcp','ibm'}:raise ValueError('Unsupported owned model provider')
+    env=environment
+    if model is None:
+        if provider=='aws':
+            from aws_json_model import BedrockJsonModel,read_model_config
+            model=BedrockJsonModel(read_model_config(env))
+        elif provider=='azure':
+            from azure_structured import AzureModel,read_model_config
+            model=AzureModel(read_model_config(env))
+        elif provider=='gcp':
+            from gcp_structured import VertexModel,read_model_config
+            model=VertexModel(read_model_config(env))
+        elif provider=='ibm':
+            from ibm_structured import WatsonModel,read_model_config
+            # Internal workspace UUID and IBM cloud account are different owners.
+            model=WatsonModel(read_model_config({**env,'ACCOUNT_ID':env['IBM_ACCOUNT_ID']}))
+        else:raise ValueError('Unsupported owned model provider')
+    if parser is None:
+        authorization=google_parser_authorization(env['PARSER_AUDIENCE'])if provider=='gcp'else azure_parser_authorization(env['PARSER_AUDIENCE'],env['WORKLOAD_IDENTITY_CLIENT_ID'])if provider=='azure'else ibm_parser_authorization(env['PARSER_SHARED_TOKEN_FILE'])if provider=='ibm'else None
+        # AWS uses owned network restrictions; IBM additionally requires a
+        # separately provisioned parser-only token. No public anonymous parser URL
+        # is supplied by a browser/model. Infrastructure must prove that wiring.
+        parser=ParserClient(env['PARSER_ENDPOINT'],authorization)
+    return InvoiceProcessor(objects if objects is not None else native_objects(provider,env),parser,model)
+
+def dispatch_operation(operation,identity,environment):
+    from invoice_retention import retained
+    if not retained(operation):raise InvalidDispatch('Invoice retention period ended; no request was made')
+    env=environment;contract=destination_contract(env)
+    if normalized_contract(env['DESTINATION_ENDPOINT'],env['DESTINATION_SCOPE'])!=contract:raise InvalidDispatch('Destination differs from the approved contract')
+    try:verified=replay_review(env,contract)
+    except Exception:raise DestinationNotAttempted('Destination review must be renewed; no request was made')from None
+    destination=ApprovedHttpDestination(env['DESTINATION_ENDPOINT'],mounted_secret(env['DESTINATION_TOKEN_FILE'],maximum=20000),destination_scope=env['DESTINATION_SCOPE'],idempotency_verified=verified)
+    return destination(operation,**identity)
+
+def main():
+    mode=sys.argv[1]if len(sys.argv)==2 else None;status='temporary'if mode=='extract'else'unknown';result={}
+    try:
+        raw=sys.stdin.buffer.read(140001)
+        if len(raw)>140000:raise ValueError('Stage input exceeds its boundary')
+        value=json.loads(raw,object_pairs_hook=_object)
+        if not isinstance(value,dict)or set(value)!={'operation','identity'}or not isinstance(value['operation'],dict)or not isinstance(value['identity'],dict):raise ValueError('Invalid owned stage input')
+        provider=owned_deployment()['provider']
+        if mode=='extract':
+            if value['identity']:raise ValueError('Extraction cannot select an action identity')
+            result=native_processor(provider,os.environ)(value['operation']);status='ok'
+        elif mode=='dispatch':result=dispatch_operation(value['operation'],value['identity'],os.environ);status='ok'
+        else:raise ValueError('Use the owned extraction or dispatch command')
+    except PermanentWork:status='permanent'if mode=='extract'else'invalid'
+    except InvalidDispatch:status='invalid'
+    except DestinationNotAttempted:status='not_attempted'
+    except TemporaryWork:status='temporary'
+    except ExternalOutcomeUnknown:status='unknown'
+    except Exception:pass
+    sys.stdout.write(json.dumps({'status':status,'result':result},ensure_ascii=False,allow_nan=False))
+
+if __name__=='__main__':main()

package/src/runtime/invoice_web.py

@@ -0,0 +1,39 @@
+"""Fixed browser assets and reviewed public sign-in configuration, no private data."""
+from pathlib import Path
+import re
+from urllib.parse import urlsplit
+from fastapi.responses import FileResponse
+
+def install_web(app,configuration,root=None):
+    if not isinstance(configuration,dict):raise ValueError('Supply owned public browser configuration')
+    config=dict(configuration);mode=config.get('mode')
+    if mode=='proxy':
+        if set(config)!={'mode','loginPath','logoutPath'}:raise ValueError('Invalid proxy sign-in configuration')
+        for field in ['loginPath','logoutPath']:
+            value=config[field]
+            if field=='logoutPath'and value is None:continue
+            if not isinstance(value,str)or not value.startswith('/')or value.startswith('//')or '\\'in value or any(ord(c)<33 or ord(c)>126 for c in value):raise ValueError('Use an owned same-origin sign-in path')
+        connect="'self'"
+    elif mode=='oauth-pkce':
+        if set(config)!={'mode','authOrigin','authorizationEndpoint','tokenEndpoint','clientId','scopes'}:raise ValueError('Invalid public PKCE configuration')
+        origin=urlsplit(config['authOrigin'])
+        if origin.scheme!='https'or not re.fullmatch(r'[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?(?::443)?',origin.netloc)or'..'in origin.netloc or origin.path not in {'','/'}or origin.username or origin.query or origin.fragment:raise ValueError('Use the exact trusted HTTPS authorization origin')
+        for field in ['authorizationEndpoint','tokenEndpoint']:
+            value=urlsplit(config[field])
+            if value.scheme!='https'or value.netloc!=origin.netloc or value.username or value.query or value.fragment:raise ValueError('Sign-in endpoints must belong to the trusted authority')
+        for field in ['clientId','scopes']:
+            if not isinstance(config[field],str)or not 1<=len(config[field])<=1024 or any(ord(c)<32 or ord(c)>126 for c in config[field]):raise ValueError('Invalid public client configuration')
+        connect="'self' "+origin.scheme+'://'+origin.netloc
+    else:raise ValueError('Use native proxy or authorization-code PKCE sign-in')
+    assets=Path(root or Path(__file__).parent)
+    for name in ['invoice-web.html','invoice-web.js','invoice-web.css']:
+        if not(assets/name).is_file():raise ValueError('Invoice browser asset is missing')
+    @app.get('/config.json')
+    def public_configuration():return config
+    @app.get('/')
+    def index():return FileResponse(assets/'invoice-web.html',media_type='text/html')
+    @app.get('/app.js')
+    def script():return FileResponse(assets/'invoice-web.js',media_type='text/javascript')
+    @app.get('/app.css')
+    def style():return FileResponse(assets/'invoice-web.css',media_type='text/css')
+    return "default-src 'self'; script-src 'self'; style-src 'self'; connect-src "+connect+"; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"

package/src/runtime/invoice_worker.py

@@ -0,0 +1,50 @@
+"""Dedicated native queue worker; private process liveness, never a business API."""
+import asyncio
+from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
+import os
+from pathlib import Path
+import sys
+import threading
+sys.path.insert(0,str(Path(__file__).resolve().parent))
+from invoice_native import native_database,owned_deployment,destination_contract
+from invoice_stage import replay_review
+from workflow_process_stage import ProcessStage
+from workflow_worker import WorkflowRuntime
+from workflow_contract import normalized_contract
+from invoice_runtime_secrets import prepare_runtime_environment
+
+COMMON=['DOCUMENT_BUCKET','REGION','PARSER_ENDPOINT','MAX_OUTPUT_TOKENS']
+EXTRACT_KEYS={
+ 'aws':COMMON+['AWS_ACCOUNT_ID','MODEL_ID','AWS_CONTAINER_CREDENTIALS_RELATIVE_URI','AWS_CONTAINER_CREDENTIALS_FULL_URI','AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE','AWS_REGION','AWS_DEFAULT_REGION'],
+ 'azure':COMMON+['PARSER_AUDIENCE','DOCUMENT_ACCOUNT','WORKLOAD_IDENTITY_CLIENT_ID','MANAGED_IDENTITY_CLIENT_ID','MODEL_RESOURCE_ID','MODEL_ENDPOINT','MODEL_DEPLOYMENT','IDENTITY_ENDPOINT','IDENTITY_HEADER','MSI_ENDPOINT','MSI_SECRET'],
+ 'gcp':COMMON+['PROJECT_ID','MODEL_ID','POLICY_REVIEW_BASE64','PARSER_AUDIENCE'],
+ 'ibm':COMMON+['PARSER_SHARED_TOKEN_FILE','IBM_ACCOUNT_ID','WATSONX_PROJECT_ID','RUNTIME_INSTANCE_ID','MODEL_REGION','MODEL_ID','IAM_PROFILE_ID','POLICY_REVIEW_BASE64']}
+
+def stage_environment(environment,names):
+    return{'PATH':'/usr/local/bin:/usr/bin:/bin','LANG':'C.UTF-8','PYTHONDONTWRITEBYTECODE':'1',**{name:environment[name]for name in names if name in environment}}
+
+def create_native_worker(provider,environment,*,connection=None):
+    if provider not in EXTRACT_KEYS:raise ValueError('Unsupported owned invoice provider')
+    env=prepare_runtime_environment(provider,environment,'worker');contract=destination_contract(env);verified=replay_review(env,contract);stage=Path(__file__).parent/'invoice_stage.py'
+    if normalized_contract(env['DESTINATION_ENDPOINT'],env['DESTINATION_SCOPE'])!=contract:raise ValueError('Worker destination differs from the approved integration identity')
+    extract=ProcessStage([sys.executable,'-I',str(stage),'extract'],kind='extract',timeout_seconds=180,environment=stage_environment(env,EXTRACT_KEYS[provider]))
+    dispatch=ProcessStage([sys.executable,'-I',str(stage),'dispatch'],kind='dispatch',timeout_seconds=45,idempotency_verified=verified,environment=stage_environment(env,['DESTINATION_ENDPOINT','DESTINATION_SCOPE','DESTINATION_TOKEN_FILE','DESTINATION_CONTRACT_BASE64','DESTINATION_REPLAY_REVIEW_BASE64']))
+    return WorkflowRuntime(connection if connection is not None else native_database(provider,env,'worker'),extract,dispatch,destination_contract=contract,idempotent_destination=verified,namespace=env['WORKFLOW_NAMESPACE'],lease_seconds=600)
+
+class Liveness(BaseHTTPRequestHandler):
+    def log_message(self,*args):pass
+    def do_GET(self):
+        self.send_response(200 if self.path=='/healthz'else 404);self.send_header('Content-Length','0');self.end_headers()
+
+def main():
+    runtime=create_native_worker(owned_deployment()['provider'],os.environ);port=int(os.environ.get('PORT','8080'))
+    if not 1024<=port<=65535:raise ValueError('Use the owned nonprivileged liveness port')
+    # Process liveness only. SQL bootstrap/restore and destination acceptance are
+    # separate deployment checks; this endpoint claims no business readiness.
+    server=ThreadingHTTPServer(('0.0.0.0',port),Liveness);threading.Thread(target=server.serve_forever,daemon=True).start()
+    # Default pairs one worker execution with one parser slot. Scale both sides
+    # together only after throughput/quotas and backpressure are qualified.
+    try:asyncio.run(runtime.run(concurrency=1))
+    finally:server.shutdown();server.server_close()
+
+if __name__=='__main__':main()

package/src/runtime/lambda_faq.py

@@ -0,0 +1,5 @@
+"""Owned HTTP API v2 entrypoint; no action or provider selected by the request."""
+from mangum import Mangum
+from public_faq_app import app_factory
+
+handler=Mangum(app_factory(),lifespan='off')

package/src/runtime/parser-requirements.lock

@@ -0,0 +1,4 @@
+cffi==2.1.1 --hash=sha256:a931079504ecc49efed7744c476a5c343a92fabf66dec2db95edb1b2fdc770e2
+cryptography==50.0.2 --hash=sha256:9dab55f57c74c3cad24c323bacbbd04be4705ba6eb0d92e920b1fc4837ed5079
+pycparser==3.12 --hash=sha256:a076f3f489b39b43ed13563a1dafe42447445bec2e294154ec5c57fcdda4c85e
+PyJWT==2.15.1 --hash=sha256:42d59d631f7768a1028a64c7ff581a9bf7519804daf91fc5b6c56e30eec5e193

package/src/runtime/policy_review.py

@@ -0,0 +1,18 @@
+"""Scoped operator-attested policy review. Never fabricates a provider approval API."""
+import base64
+from datetime import datetime,timezone
+import json
+import re
+from structured_output import _object
+from structured_http import PolicyUnverified
+
+def verify_policy_review(encoded,expected,now=None):
+    try:
+        review=json.loads(base64.b64decode(encoded,validate=True),object_pairs_hook=_object)
+        if any(review.get(key)!=value for key,value in expected.items()):raise PolicyUnverified()
+        if not isinstance(review.get('approvedBy'),str) or not review['approvedBy'].strip():raise PolicyUnverified()
+        if not re.fullmatch(r'[0-9a-f]{64}',review.get('evidenceSha256','')) or review['evidenceSha256']=='0'*64:raise PolicyUnverified()
+        expiry=datetime.fromisoformat(review['expiresAt']);now=now or datetime.now(timezone.utc)
+        if expiry.tzinfo is None or not 0<(expiry-now).total_seconds()<=31*86400:raise PolicyUnverified()
+        return review
+    except Exception:raise PolicyUnverified() from None

package/src/runtime/postgres-qualification-lock.json

@@ -0,0 +1,21 @@
+{
+  "image": "postgres:17-alpine",
+  "manifests": {
+    "linux/amd64": "sha256:4717f90960a225c2d1c5dac50508c401230f693ff626e06e84e6db0a68ded508",
+    "linux/arm64": "sha256:1108a8fe22dff4eab48870e081be046d549ddc1b6f5972e0a766eaf1e0b1003c"
+  },
+  "reviewedAt": "2026-11-10",
+  "boundary": "Official Docker PostgreSQL 17 image manifests for local qualification only; not proof of managed cloud PostgreSQL availability, privileges, patch level or deployment.",
+  "variants": {
+    "18": {
+      "image": "postgres:18-alpine",
+      "manifests": {
+        "linux/amd64": "sha256:300ebd02c6d4de9ee27ad7f6855d5d21b4d3a4a5117767c1197d284c635d9736",
+        "linux/arm64": "sha256:c935aff069a7bbe5c286411a08e9678850d79be7848b190a0e4637b266478626"
+      },
+      "reviewedAt": "2026-11-10",
+      "manifestSha256": "123b17998ccaf47e53b502e8c6a1e79afd8f579c6f3eec83c563da026f957395",
+      "source": "https://registry-1.docker.io/v2/library/postgres/manifests/18-alpine"
+    }
+  }
+}