@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/runtime/web_user_admin.py

@@ -0,0 +1,44 @@
+"""Explicit user onboarding/disable for the generated Cognito pool and catalog.
+
+No invitation email is sent. Passwords come from a terminal prompt, never argv or
+Terraform state. The user enrolls their own software-token MFA at first sign-in.
+"""
+import argparse
+import getpass
+import json
+from pathlib import Path
+import re
+import boto3
+from botocore.config import Config
+
+
+def main():
+    parser=argparse.ArgumentParser(description=__doc__)
+    for name in ['pool','table','account','region','username','receipt']:parser.add_argument('--'+name,required=True)
+    parser.add_argument('--subject');parser.add_argument('--employee-region')
+    parser.add_argument('--disable',action='store_true');parser.add_argument('--confirm-change',action='store_true',required=True)
+    args=parser.parse_args()
+    if not args.disable and (not args.subject or not re.fullmatch(r'[A-Za-z0-9_-]{1,100}',args.subject) or not args.employee_region or not re.fullmatch(r'[A-Z]{2}',args.employee_region)):parser.error('Create requires an authoritative subject and two-letter employee region')
+    session=boto3.Session(region_name=args.region);config=Config(ignore_configured_endpoint_urls=True,connect_timeout=3,read_timeout=10,retries={'total_max_attempts':2})
+    if session.client('sts',config=config).get_caller_identity()['Account']!=args.account:raise SystemExit('Account mismatch')
+    cognito=session.client('cognito-idp',config=config);db=session.client('dynamodb',config=config)
+    pool=cognito.describe_user_pool(UserPoolId=args.pool)['UserPool']
+    if pool.get('UserPoolTags',{}).get('ManagedBy')!='AtMem AI Architect':raise SystemExit('Pool is not a generated AtMem target')
+    receipt=Path(args.receipt);receipt.parent.mkdir(parents=True,exist_ok=True)
+    record={'status':'in_progress','operation':'disable' if args.disable else 'create','pool':args.pool,'username':args.username}
+    def save():receipt.write_text(json.dumps(record,indent=2)+'\n');receipt.chmod(0o600)
+    save()
+    if args.disable:
+        user=cognito.admin_get_user(UserPoolId=args.pool,Username=args.username)
+        subject=next(a['Value'] for a in user['UserAttributes'] if a['Name']=='sub')
+        db.update_item(TableName=args.table,Key={'recordId':{'S':'IDENTITY#COGNITO#'+subject}},UpdateExpression='SET enabled = :disabled',ConditionExpression='attribute_exists(recordId)',ExpressionAttributeValues={':disabled':{'BOOL':False}})
+        record['directoryDisabled']=True;save()
+        cognito.admin_disable_user(UserPoolId=args.pool,Username=args.username)
+    else:
+        password=getpass.getpass('Temporary password (not logged): ')
+        user=cognito.admin_create_user(UserPoolId=args.pool,Username=args.username,TemporaryPassword=password,MessageAction='SUPPRESS')['User']
+        subject=next(a['Value'] for a in user['Attributes'] if a['Name']=='sub')
+        record['userCreated']=True;record['subjectId']=subject;save()
+        db.put_item(TableName=args.table,Item={'recordId':{'S':'IDENTITY#COGNITO#'+subject},'kind':{'S':'IDENTITY'},'enabled':{'BOOL':True},'subject':{'S':args.subject},'employeeRegion':{'S':args.employee_region}},ConditionExpression='attribute_not_exists(recordId)')
+    record['status']='completed';save();print(json.dumps({'status':'completed','receipt':str(receipt)}))
+if __name__=='__main__':main()

package/src/runtime/workflow_application.py

@@ -0,0 +1,62 @@
+"""Owned application assembly; imports neither API/JWT nor cloud SDK at startup.
+
+Profiles are nonsecret reviewed artifacts. They do not select Python modules,
+credential paths, migrations or deployment actions. Domain stages remain trusted
+source supplied by the bootstrap, never executable strings from client data.
+"""
+import hashlib
+from workflow_payload import encoded
+from workflow_configuration import native_database,native_identity_realm
+from workflow_profile import ApplicationProfile,load_profile,IDENTITY_KEYS
+
+def checked_environment(profile,environment):
+    if type(profile)is not ApplicationProfile:raise ValueError('Use an immutable owned application profile')
+    copied=dict(environment);data=profile.data
+    for key,expected in [('PROVIDER',data['provider']),('ACCOUNT_ID',data['accountId']),('ENVIRONMENT',data['environment']),('WORKFLOW_NAMESPACE',profile.namespace),('PUBLIC_ORIGIN',data['publicOrigin'])]:
+        if key in copied and copied[key]!=expected:raise ValueError('Runtime configuration differs from the owned application profile')
+    for key,expected in data['identitySettings'].items():
+        if key in copied and copied[key]!=expected:raise ValueError('Native identity differs from the owned application profile')
+    return copied
+
+
+def membership_key(profile,subject):
+    """Derived enrollment key from the complete verified subject and native realm.
+
+    This is not an authentication function. Enrollment is an operator action;
+    the API calls it only after cryptographic native verification. No subject
+    characters are clipped; the native IdP remains the authoritative identity.
+    """
+    if type(profile)is not ApplicationProfile or type(subject)is not str or not 1<=len(subject.encode('utf-8'))<=16384 or any(ord(c)<32 for c in subject):raise ValueError('Use the complete verified native subject')
+    data=profile.data
+    return 'native-'+hashlib.sha256(encoded({'provider':data['provider'],'issuer':native_identity_realm(data['provider'],data['identitySettings']),'subject':subject})).hexdigest()
+
+
+def create_native_api(profile,environment,*,connection=None,jwks=None,review_policy=None):
+    from workflow_identity import native_staff_identity
+    from workflow_worker import producer_store
+    from workflow_http import create_app
+    env=checked_environment(profile,environment);data=profile.data;provider=data['provider']
+    identity=native_staff_identity(provider,data['identitySettings'],jwks=jwks)
+    dsn=connection if connection is not None else native_database(provider,env,'api')
+    store=producer_store(dsn,destination_contract=profile.destination,namespace=profile.namespace,payload_contract=profile.payload,operation_kind=data['operationKind'],review_policy=review_policy)
+    def verify(token):return membership_key(profile,identity.verify(token))
+    return create_app(verify,store,account_id=data['accountId'],public_origin=data['publicOrigin'],operation_kind=data['operationKind'],token_header=identity.token_header)
+
+
+class _OwnedStage:
+    def __init__(self,stage,account,kind):self.stage=stage;self.account=account;self.kind=kind
+    def __getattr__(self,name):return getattr(self.stage,name)
+    def __call__(self,row,*args,**kwargs):
+        from workflow_errors import InvalidDispatch
+        if str(row.get('account_id'))!=self.account:raise InvalidDispatch('Work belongs to a different application account; no stage was invoked')
+        if row.get('kind')!=self.kind:raise InvalidDispatch('Work has a different operation policy; no stage was invoked')
+        return self.stage(row,*args,**kwargs)
+
+
+def create_native_worker(profile,environment,processor,deliver,*,connection=None,idempotent_destination=False,review_policy=None):
+    from workflow_worker import WorkflowRuntime
+    env=checked_environment(profile,environment);data=profile.data
+    if not callable(processor)or not callable(deliver):raise ValueError('Supply trusted application stages')
+    dsn=connection if connection is not None else native_database(data['provider'],env,'worker')
+    return WorkflowRuntime(dsn,_OwnedStage(processor,data['accountId'],data['operationKind']),_OwnedStage(deliver,data['accountId'],data['operationKind']),
+        destination_contract=profile.destination,payload_contract=profile.payload,operation_kind=data['operationKind'],namespace=profile.namespace,idempotent_destination=idempotent_destination,review_policy=review_policy)

package/src/runtime/workflow_bindings.py

@@ -0,0 +1,128 @@
+"""Pure deferred public-output binding. No cloud lookup or approval inference."""
+from dataclasses import dataclass
+import hashlib
+import json
+from pathlib import Path
+import re
+if __package__:
+    from .workflow_profile import ApplicationProfile,IDENTITY_KEYS
+    from .workflow_payload import encoded
+else:
+    from workflow_profile import ApplicationProfile,IDENTITY_KEYS
+    from workflow_payload import encoded
+
+ENVIRONMENTS={'staging','production','qualification'}
+PROVIDERS={'aws','azure','gcp','ibm','tools'}
+
+
+def reference(value):
+    if type(value)is not dict or set(value)!={'nativeOutput'}:raise ValueError('Use an explicit public native-output reference')
+    ref=value['nativeOutput']
+    if type(ref)is not dict or set(ref)!={'componentId','provider','environment','name'}:raise ValueError('Use an exact native-output owner')
+    if type(ref['componentId'])is not str or not 1<=len(ref['componentId'].encode())<=512 or any(ord(c)<32 for c in ref['componentId']):raise ValueError('Use the complete output component identity')
+    if type(ref['provider'])is not str or ref['provider']not in PROVIDERS or type(ref['environment'])is not str or ref['environment']not in ENVIRONMENTS:raise ValueError('Use the exact output provider/environment')
+    if type(ref['name'])is not str or not re.fullmatch(r'[A-Za-z][A-Za-z0-9_]{0,79}',ref['name'])or re.search(r'secret|password|credential|private_?key',ref['name'],re.I):raise ValueError('Only reviewed public output names may bind')
+    return ref
+
+
+@dataclass(frozen=True,init=False)
+class ApplicationTemplate:
+    _encoded:bytes
+
+    def __init__(self,value):
+        raw=encoded(value);data=json.loads(raw)
+        if type(data)is not dict or data.get('format')!='approval-application-template-v1':raise ValueError('Use a versioned application template')
+        trial=json.loads(raw);trial['format']='approval-application-v1';refs=[]
+        if type(trial.get('publicOrigin'))is dict:
+            refs.append(('publicOrigin',reference(trial['publicOrigin'])));trial['publicOrigin']='https://unresolved.invalid'
+        identity=trial.get('identitySettings')
+        if type(identity)is dict:
+            for key,val in identity.items():
+                if type(val)is dict:refs.append(('identitySettings/'+key,reference(val)));identity[key]='UNRESOLVED_NATIVE_OUTPUT'
+        dest=trial.get('destinationContract')
+        if type(dest)is dict:
+            for key in ['endpointSha256','scope']:
+                if type(dest.get(key))is dict:
+                    refs.append(('destinationContract/'+key,reference(dest[key])));dest[key]='0'*64 if key=='endpointSha256'else'unresolved'
+        ApplicationProfile(trial)
+        if not refs:raise ValueError('A deferred template must retain at least one output reference')
+        for path,ref in refs:
+            if ref['environment']!=data['environment']:raise ValueError('Output environment differs from the application template')
+            if path.startswith('identitySettings/')and ref['provider']!=data['provider']:raise ValueError('Native identity output provider differs from the selected adapter')
+        object.__setattr__(self,'_encoded',raw)
+
+    @property
+    def data(self):return json.loads(self._encoded)
+    @property
+    def sha256(self):return hashlib.sha256(self._encoded).hexdigest()
+    @property
+    def references(self):
+        data=self.data;result=[]
+        for key in ['publicOrigin']:
+            if type(data[key])is dict:result.append({'path':key,**reference(data[key])})
+        for section in ['identitySettings','destinationContract']:
+            for key,value in data[section].items():
+                if type(value)is dict:result.append({'path':section+'/'+key,**reference(value)})
+        return result
+
+
+def application_declaration(value):
+    return ApplicationTemplate(value)if type(value)is dict and value.get('format')=='approval-application-template-v1'else ApplicationProfile(value)
+
+
+def resolve_template(template,ledger):
+    if type(template)is not ApplicationTemplate:raise ValueError('Use an immutable owned template')
+    raw=encoded(ledger);ledger=json.loads(raw)
+    if type(ledger)is not dict or set(ledger)!={'version','outputs'}or type(ledger['version'])is not int or ledger['version']!=1 or type(ledger['outputs'])is not list or not 1<=len(ledger['outputs'])<=128:raise ValueError('Use a bounded public-output ledger')
+    by_key={};snapshots={}
+    for item in ledger['outputs']:
+        if type(item)is not dict or set(item)!={'componentId','provider','environment','name','value','sensitive','sourceSha256'}:raise ValueError('Use exact public output records')
+        reference({'nativeOutput':{key:item[key]for key in ['componentId','provider','environment','name']}})
+        if item['sensitive']is not False or type(item['value'])is not str or not 1<=len(item['value'].encode())<=2000:raise ValueError('Sensitive or unbounded values cannot enter application profiles')
+        if re.search(r'-----BEGIN .*PRIVATE KEY-----|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36}|sk-(?:ant-)?[A-Za-z0-9_-]{20,}',item['value']):raise ValueError('Credential-like output refused')
+        if type(item['sourceSha256'])is not str or not re.fullmatch(r'[0-9a-f]{64}',item['sourceSha256']):raise ValueError('Retain the source artifact identity')
+        owner=tuple(item[key]for key in ['componentId','provider','environment']);key=owner+(item['name'],)
+        if key in by_key:raise ValueError('Duplicate output identity; no version was chosen')
+        if owner in snapshots and snapshots[owner]!=item['sourceSha256']:raise ValueError('One component cannot mix output snapshots')
+        snapshots[owner]=item['sourceSha256'];by_key[key]=item
+    data=template.data;data['format']='approval-application-v1';used={}
+    for ref in template.references:
+        key=tuple(ref[k]for k in ['componentId','provider','environment','name']);item=by_key.get(key)
+        if item is None:raise ValueError('A required native output is unresolved; no default was substituted')
+        keys=ref['path'].split('/');target=data
+        for part in keys[:-1]:target=target[part]
+        target[keys[-1]]=item['value'];used[key]=item
+    profile=ApplicationProfile(data)
+    receipt={'format':'atmem.application-binding','version':1,'templateSha256':template.sha256,'profileSha256':profile.sha256,'inputs':{'version':1,'outputs':[used[key]for key in sorted(used)]},'status':'structurally_resolved','cloudVerified':False}
+    return profile,receipt
+
+
+def read_json(path):
+    with Path(path).open('rb')as stream:raw=stream.read(64001)
+    if len(raw)>64000:raise ValueError('Binding artifact exceeds its byte boundary')
+    def unique(pairs):
+        result={}
+        for key,value in pairs:
+            if key in result:raise ValueError('Duplicate binding artifact field')
+            result[key]=value
+        return result
+    return json.loads(raw.decode(),object_pairs_hook=unique)
+
+
+def load_bound_profile(template_path,directory):
+    template=ApplicationTemplate(read_json(template_path));directory=Path(directory)
+    receipt=read_json(directory/'binding-receipt.json')
+    if type(receipt)is not dict or set(receipt)!={'format','version','templateSha256','profileSha256','inputs','status','cloudVerified'}:raise ValueError('Missing or invalid binding receipt; resolve public outputs before starting')
+    profile,expected=resolve_template(template,receipt['inputs'])
+    if encoded(receipt)!=encoded(expected) or ApplicationProfile(read_json(directory/'application-profile.json')).data!=profile.data:raise ValueError('Binding/profile bytes differ from the owned template and inputs')
+    return profile
+
+
+def write_binding(template_path,ledger_path,directory):
+    profile,receipt=resolve_template(ApplicationTemplate(read_json(template_path)),read_json(ledger_path))
+    profile_bytes,receipt_bytes=encoded(profile.data),encoded(receipt)
+    directory=Path(directory);directory.mkdir(mode=0o700,parents=False,exist_ok=False)
+    # Receipt is the commit marker. Readers reject an interrupted/partial bundle.
+    with(directory/'application-profile.json').open('xb')as stream:stream.write(profile_bytes)
+    with(directory/'binding-receipt.json').open('xb')as stream:stream.write(receipt_bytes)
+    return receipt

package/src/runtime/workflow_configuration.py

@@ -0,0 +1,40 @@
+"""Provider-native database configuration and reviewed public origins.
+
+No cloud request, secret read, HTTP or JWT adapter is loaded at import.
+"""
+from pathlib import Path
+from workflow_profile import owned_origin
+from workflow_connection import aws_database,azure_database,gcp_database,ibm_database
+
+def mounted_secret(path,*,maximum=500):
+    if not isinstance(path,str)or not Path(path).is_absolute()or type(maximum)is not int or not 1<=maximum<=20000:raise ValueError('Use the owned mounted secret file')
+    def read():
+        with Path(path).open('rb')as stream:raw=stream.read(maximum+1)
+        if not raw or len(raw)>maximum or b'\0'in raw:raise ValueError('Mounted secret is unavailable')
+        return raw.decode('utf-8')
+    return read
+
+def native_database(provider,environment,role):
+    if role not in {'api','worker','migration'}:raise ValueError('Use an owned runtime database role')
+    env=environment;common={'database':env['DATABASE_NAME'],'role':role}
+    if provider=='gcp':
+        transport=env.get('DATABASE_TRANSPORT','cloudsql-socket')
+        if transport not in {'cloudsql-socket','cloudsql-private-proxy'}:raise ValueError('Use the owned Cloud SQL transport')
+        return gcp_database(**common,connection_name=env['DATABASE_CONNECTION_NAME'],service_account_email=env['DATABASE_SERVICE_ACCOUNT'],private_proxy=transport=='cloudsql-private-proxy')
+    common.update({'host':env['DATABASE_HOST'],'user':env['DATABASE_USER'],'ca_file':env['DATABASE_CA_FILE']})
+    if provider=='aws':return aws_database(**common,region=env['REGION'])
+    if provider=='azure':return azure_database(**common,managed_identity_client_id=env['WORKLOAD_IDENTITY_CLIENT_ID'])
+    if provider=='ibm':return ibm_database(**common,port=int(env['DATABASE_PORT']),password=mounted_secret(env['DATABASE_PASSWORD_FILE']))
+    raise ValueError('Unsupported owned database provider')
+
+def native_identity_realm(provider,settings):
+    """Issuer identity from owned settings, never unverified token claims.
+
+    Native verifiers separately enforce client/audience/scope. Changing those
+    controls must not rename a person within the same issuer's membership.
+    """
+    if provider=='aws':return 'https://cognito-idp.'+settings['REGION']+'.amazonaws.com/'+settings['POOL_ID']
+    if provider=='azure':return 'https://login.microsoftonline.com/'+settings['TENANT_ID']+'/v2.0'
+    if provider=='gcp':return 'https://cloud.google.com/iap'
+    if provider=='ibm':return settings['APPID_ISSUER']
+    raise ValueError('Unsupported owned identity provider')

package/src/runtime/workflow_connection.py

@@ -0,0 +1,105 @@
+"""Provider-native fresh PostgreSQL credentials with explicit transport identity.
+
+No connection or cloud request occurs at import. Constructors accept deployment
+configuration, not browser/model input. Managed Cloud SQL Unix transport relies on
+the separately configured native connector for upstream TLS; it is never a plain
+TCP fallback. IBM database passwords are distinct from IBM control-plane IAM.
+"""
+from pathlib import Path
+import re
+import time
+import threading
+import uuid
+from psycopg.conninfo import make_conninfo
+from workflow_errors import TemporaryWork
+
+class DatabaseCredentialUnavailable(TemporaryWork):pass
+
+class DatabaseConnection:
+    def __init__(self,provider,host,port,database,user,credential,*,ca_file=None,managed_cloudsql=False,managed_proxy_tcp=False,role='worker'):
+        if provider not in {'aws','azure','gcp','ibm'}or role not in {'api','worker','migration'}or type(managed_cloudsql)is not bool or type(managed_proxy_tcp)is not bool or(managed_cloudsql and managed_proxy_tcp):raise ValueError('Invalid owned database identity')
+        if not isinstance(database,str)or not re.fullmatch(r'[a-zA-Z][a-zA-Z0-9_]{0,62}',database)or not isinstance(user,str)or not 1<=len(user.encode('utf-8'))<=63 or any(ord(c)<33 or ord(c)>126 for c in user):raise ValueError('Use exact native database and role names')
+        if type(port)is not int or not 1<=port<=65535 or not callable(credential):raise ValueError('Invalid owned database credential source')
+        if managed_proxy_tcp:
+            # An explicit compiler-owned same-instance proxy, never a fallback
+            # after native TLS failure. The pinned proxy enforces upstream TLS
+            # and private-IP connectivity. No configurable TCP host/port here.
+            if provider!='gcp'or host!='127.0.0.1'or port!=5432 or ca_file is not None:raise ValueError('Use the exact owned Cloud SQL loopback proxy')
+            transport={'sslmode':'disable'}
+        elif managed_cloudsql:
+            if provider!='gcp'or not isinstance(host,str)or not re.fullmatch(r'/cloudsql/[a-z][a-z0-9-]{4,28}[a-z0-9]:[a-z]+-[a-z]+[1-9][0-9]?:[a-z][a-z0-9-]{0,62}',host)or len((host+'/.s.PGSQL.'+str(port)).encode())>103 or ca_file is not None:raise ValueError('Use the owned Cloud SQL managed Unix socket with upstream connector TLS')
+            transport={'sslmode':'disable'}
+        else:
+            if not isinstance(host,str)or not re.fullmatch(r'[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?',host)or'..'in host:raise ValueError('Use an exact owned native database hostname')
+            if not isinstance(ca_file,(str,Path))or not Path(ca_file).is_absolute()or not Path(ca_file).is_file():raise ValueError('Supply the reviewed native CA certificate file')
+            if b'-----BEGIN CERTIFICATE-----'not in Path(ca_file).read_bytes():raise ValueError('Native database CA must contain PEM certificates')
+            transport={'sslmode':'verify-full','sslrootcert':str(ca_file),'ssl_min_protocol_version':'TLSv1.2'}
+        self.provider=provider;self.credential=credential
+        self.parameters={'host':host,'port':port,'dbname':database,'user':user,'application_name':'atmem-workflow-'+role,'connect_timeout':5,'gssencmode':'disable','passfile':'/dev/null',**transport}
+    def __repr__(self):return'<Reviewed '+self.provider+' database credential factory>'
+    def __call__(self):
+        try:
+            password=self.credential()
+            if not isinstance(password,str)or not password or '\0'in password or len(password.encode('utf-8'))>20000:raise ValueError('Invalid credential')
+            return make_conninfo(**self.parameters,password=password)
+        except Exception:raise DatabaseCredentialUnavailable('Database credential is temporarily unavailable')from None
+
+def aws_database(*,host,region,database,user,ca_file,role='worker',client=None):
+    if not isinstance(region,str)or not re.fullmatch(r'[a-z]{2}-[a-z]+-[0-9]',region)or not isinstance(host,str)or not host.endswith('.'+region+'.rds.amazonaws.com'):raise ValueError('Use the actual regional RDS endpoint, not a custom DNS alias')
+    cached={'client':client};client_lock=threading.Lock()
+    def password():
+        if cached['client']is None:
+            with client_lock:
+                if cached['client']is None:
+                    import boto3
+                    from botocore.config import Config
+                    cached['client']=boto3.Session().client('rds',region_name=region,config=Config(proxies={},connect_timeout=1,read_timeout=2,retries={'total_max_attempts':1}))
+        return cached['client'].generate_db_auth_token(DBHostname=host,Port=5432,DBUsername=user,Region=region)
+    return DatabaseConnection('aws',host,5432,database,user,password,ca_file=ca_file,role=role)
+
+def azure_database(*,host,database,user,ca_file,managed_identity_client_id,role='worker',credential=None):
+    if not isinstance(host,str)or not re.fullmatch(r'[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.postgres\.database\.azure\.com',host):raise ValueError('Use the actual Azure PostgreSQL endpoint')
+    if not isinstance(managed_identity_client_id,str)or str(uuid.UUID(managed_identity_client_id))!=managed_identity_client_id:raise ValueError('Use the dedicated database workload identity client ID')
+    cached={'credential':credential}
+    def password():
+        if cached['credential']is None:
+            from azure.identity import ManagedIdentityCredential
+            cached['credential']=ManagedIdentityCredential(client_id=managed_identity_client_id,retry_total=0,connection_timeout=1,read_timeout=2)
+        access=cached['credential'].get_token('https://ossrdbms-aad.database.windows.net/.default')
+        if type(access.expires_on)is not int or access.expires_on<time.time()+30:raise ValueError('Database token is expiring')
+        return access.token
+    return DatabaseConnection('azure',host,5432,database,user,password,ca_file=ca_file,role=role)
+
+def google_metadata_token(session=None):
+    import requests
+    import json
+    session=session or requests.Session();session.trust_env=False;deadline=time.monotonic()+4
+    try:
+        with session.get('http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token',headers={'Metadata-Flavor':'Google'},timeout=(1,2),allow_redirects=False,stream=True)as response:
+            if response.status_code!=200 or response.headers.get('Metadata-Flavor')!='Google':raise ValueError('Unverified workload identity')
+            raw=bytearray()
+            for chunk in response.iter_content(1):
+                raw.extend(chunk)
+                if len(raw)>8192 or time.monotonic()>deadline:raise ValueError('Workload identity response boundary')
+        def unique(pairs):
+            value={}
+            for key,item in pairs:
+                if key in value:raise ValueError('Duplicate credential field')
+                value[key]=item
+            return value
+        value=json.loads(raw,object_pairs_hook=unique)
+        if not isinstance(value,dict)or value.get('token_type')!='Bearer'or type(value.get('expires_in'))is not int or value['expires_in']<60 or not isinstance(value.get('access_token'),str)or not value['access_token']:raise ValueError('Unverified workload token')
+        return value['access_token']
+    except Exception:raise DatabaseCredentialUnavailable('Database workload identity is temporarily unavailable')from None
+
+def gcp_database(*,connection_name,service_account_email,database,role='worker',credential=None,private_proxy=False):
+    if not isinstance(connection_name,str)or not re.fullmatch(r'[a-z][a-z0-9-]{4,28}[a-z0-9]:[a-z]+-[a-z]+[1-9][0-9]?:[a-z][a-z0-9-]{0,62}',connection_name)or type(private_proxy)is not bool:raise ValueError('Use the owned Cloud SQL connection name and explicit transport')
+    if not isinstance(service_account_email,str)or not re.fullmatch(r'[a-z][a-z0-9-]{4,29}@[a-z][a-z0-9-]{4,28}[a-z0-9]\.iam\.gserviceaccount\.com',service_account_email):raise ValueError('Use the owned service account IAM database identity')
+    user=service_account_email.removesuffix('.gserviceaccount.com')
+    return DatabaseConnection('gcp','127.0.0.1'if private_proxy else'/cloudsql/'+connection_name,5432,database,user,credential or google_metadata_token,managed_cloudsql=not private_proxy,managed_proxy_tcp=private_proxy,role=role)
+
+def ibm_database(*,host,port,database,user,ca_file,password,role='worker'):
+    if not isinstance(host,str)or not host.endswith('.databases.appdomain.cloud'):raise ValueError('Use the native IBM database endpoint and its instance CA')
+    # The callable retrieves the dedicated nonadministrative SQL role password
+    # from its separately authorized secret store. An IAM token is not substituted.
+    return DatabaseConnection('ibm',host,port,database,user,password,ca_file=ca_file,role=role)

package/src/runtime/workflow_contract.py

@@ -0,0 +1,54 @@
+"""Nonsecret, immutable integration identity included in every human approval."""
+import hashlib
+import json
+import re
+if __package__:
+    from .workflow_payload import PayloadContract
+else:
+    from workflow_payload import PayloadContract
+
+def reviewed_contract(value):
+    fields={'id','endpointSha256','scope','mappingVersion'}
+    optional={'payloadContractSha256','applicationContractSha256','reviewPolicySha256'}
+    if (not isinstance(value,dict)or not fields<=set(value)<=fields|optional
+        or not isinstance(value['id'],str)or not re.fullmatch(r'[a-z0-9-]{1,80}',value['id'])
+        or not isinstance(value['endpointSha256'],str)or not re.fullmatch(r'[0-9a-f]{64}',value['endpointSha256'])
+        or not isinstance(value['scope'],str)or not 1<=len(value['scope'])<=200 or any(ord(c)<33 or ord(c)>126 for c in value['scope'])
+        or type(value['mappingVersion'])is not int or not 1<=value['mappingVersion']<=10000
+        or any(key in value and(not isinstance(value[key],str)or not re.fullmatch(r'[0-9a-f]{64}',value[key]))for key in optional)):raise ValueError('Supply the reviewed nonsecret destination contract identity')
+    return json.loads(json.dumps(value))
+
+def normalized_contract(endpoint,scope):
+    return reviewed_contract({'id':'normalized-action-v1','endpointSha256':hashlib.sha256(endpoint.encode('utf-8')).hexdigest(),'scope':scope,'mappingVersion':1})
+
+def bind_payload_contract(destination,payload_contract):
+    result=reviewed_contract(destination)
+    if payload_contract is not None and type(payload_contract)is not PayloadContract:raise ValueError('Use an owned immutable application payload contract')
+    bound=result.get('payloadContractSha256')
+    if bound is not None and(payload_contract is None or bound!=payload_contract.sha256):raise ValueError('Application contract does not match its destination binding')
+    if payload_contract is not None:result['payloadContractSha256']=payload_contract.sha256
+    return result
+
+def bind_application_contract(destination,sha256):
+    result=reviewed_contract(destination)
+    if type(sha256)is not str or not re.fullmatch(r'[0-9a-f]{64}',sha256):raise ValueError('Use an exact owned application declaration digest')
+    if 'applicationContractSha256'in result and result['applicationContractSha256']!=sha256:raise ValueError('Application declaration binding changed')
+    result['applicationContractSha256']=sha256
+    return result
+
+def bind_review_policy(destination,payload_contract,review_policy):
+    if __package__:
+        from .workflow_review import ReviewPolicy
+    else:
+        from workflow_review import ReviewPolicy
+    result=bind_payload_contract(destination,payload_contract)
+    bound=result.get('reviewPolicySha256')
+    if review_policy is None:
+        if bound is not None:raise ValueError('The destination requires its exact review policy')
+        return result
+    if type(review_policy)is not ReviewPolicy or payload_contract is None or review_policy.data['payloadContractSha256']!=payload_contract.sha256:
+        raise ValueError('Use an owned review policy matching the exact payload contract')
+    review_policy.ensure_current()
+    if bound is not None and bound!=review_policy.sha256:raise ValueError('Review policy differs from its destination binding')
+    result['reviewPolicySha256']=review_policy.sha256
+    return result

package/src/runtime/workflow_database.py

@@ -0,0 +1,94 @@
+"""Operator migration/bootstrap API; never an application HTTP endpoint.
+
+Use the separate approved migration credential. Native cloud principal mapping,
+connection TLS and account authorization are provider-specific setup steps.
+"""
+import hashlib
+from pathlib import Path
+import re
+import psycopg
+from psycopg import sql
+from psycopg.rows import tuple_row
+import procrastinate
+from procrastinate.schema import SchemaManager
+
+QUEUE_TABLES=['procrastinate_jobs','procrastinate_events','procrastinate_workers','procrastinate_periodic_defers']
+SCHEMA_VERSION=2
+
+
+def require_current_schema(conn):
+    """Read-only admission; never migrate/adopt a database during runtime use."""
+    expected=hashlib.sha256((Path(__file__).parent/'workflow_schema.sql').read_bytes()).hexdigest()
+    with conn.cursor(row_factory=tuple_row)as cursor:
+        row=cursor.execute('SELECT version,source_sha256,queue_version FROM workflow.schema_version').fetchone()
+    if row!=(SCHEMA_VERSION,expected,'3.10.0'):
+        raise ValueError('Use the owned exact schema version; review migrations before using this runtime')
+
+def initialize_database(conn):
+    if procrastinate.__version__!='3.10.0':raise ValueError('Use the reviewed queue dependency before migration')
+    # CREATE, not CREATE IF NOT EXISTS: do not adopt an unrelated existing schema
+    # or run a fresh schema over a production version that needs real migrations.
+    body=(Path(__file__).parent/'workflow_schema.sql').read_bytes()
+    conn.execute('CREATE SCHEMA workflow')
+    conn.execute('SET LOCAL search_path=workflow,pg_catalog')
+    conn.execute(SchemaManager.get_schema())
+    conn.execute(body.decode('utf-8'))
+    conn.execute('INSERT INTO workflow.schema_version(version,source_sha256,queue_version) VALUES(%s,%s,%s)',(SCHEMA_VERSION,hashlib.sha256(body).hexdigest(),procrastinate.__version__))
+    conn.execute('REVOKE ALL ON SCHEMA workflow FROM PUBLIC')
+    conn.execute('REVOKE ALL ON ALL TABLES IN SCHEMA workflow FROM PUBLIC')
+    conn.execute('REVOKE ALL ON ALL SEQUENCES IN SCHEMA workflow FROM PUBLIC')
+    conn.execute('REVOKE ALL ON ALL FUNCTIONS IN SCHEMA workflow FROM PUBLIC')
+
+def grant_runtime_roles(conn,api_role,worker_role,*,native_provider=None):
+    if conn.autocommit:raise ValueError('Use one operator transaction for runtime grant admission')
+    # Grants for distinct logins still update the same pg_namespace/pg_class ACL
+    # tuples. Serialize this owned bootstrap across deployments in this database;
+    # unrelated schema/client changes remain outside this lock and are not adopted.
+    conn.execute("SELECT pg_advisory_xact_lock(hashtextextended('atmem-workflow-runtime-grants-v1',0))")
+    authentication_roles={None:set(),'aws':{'rds_iam'},'azure':set(),'gcp':{'cloudsqliamuser','cloudsqliamserviceaccount'},'ibm':set()}
+    if native_provider not in authentication_roles:raise ValueError('Use an explicitly reviewed native database grant profile')
+    require_current_schema(conn)
+    if api_role==worker_role:raise ValueError('Application and worker database identities must be separate')
+    for role in [api_role,worker_role]:
+        if not isinstance(role,str)or not re.fullmatch(r'[A-Za-z0-9_.@-]{1,63}',role):raise ValueError('Use the reviewed existing native database principal name')
+        with conn.cursor(row_factory=tuple_row)as cursor:
+            flags=cursor.execute('SELECT rolsuper,rolcreatedb,rolcreaterole,rolreplication,rolbypassrls,rolcanlogin FROM pg_roles WHERE rolname=%s',(role,)).fetchone()
+        if not flags or any(flags[:5])or not flags[5]:raise ValueError('A runtime identity must be an existing nonadministrative database login')
+        with conn.cursor(row_factory=tuple_row)as cursor:
+            elevated=cursor.execute("WITH RECURSIVE parents AS (SELECT oid,rolsuper,rolcreatedb,rolcreaterole,rolreplication,rolbypassrls FROM pg_roles WHERE rolname=%s UNION SELECT r.oid,r.rolsuper,r.rolcreatedb,r.rolcreaterole,r.rolreplication,r.rolbypassrls FROM pg_roles r JOIN pg_auth_members m ON m.roleid=r.oid JOIN parents p ON p.oid=m.member) SELECT EXISTS(SELECT 1 FROM parents WHERE rolsuper OR rolcreatedb OR rolcreaterole OR rolreplication OR rolbypassrls) OR has_database_privilege(%s,current_database(),'CREATE')",(role,role)).fetchone()[0]
+        if elevated:raise ValueError('Do not use an inherited administrator or database owner as a runtime identity')
+        with conn.cursor(row_factory=tuple_row)as cursor:
+            parents=cursor.execute("WITH RECURSIVE parents AS(SELECT m.roleid FROM pg_auth_members m JOIN pg_roles r ON r.oid=m.member WHERE r.rolname=%s UNION SELECT m.roleid FROM pg_auth_members m JOIN parents p ON p.roleid=m.member)SELECT r.rolname FROM parents p JOIN pg_roles r ON r.oid=p.roleid",(role,)).fetchall()
+        parent_names={item[0]for item in parents}
+        if not parent_names<=authentication_roles[native_provider]:raise ValueError('Runtime database memberships are outside the reviewed native authentication profile')
+        with conn.cursor(row_factory=tuple_row)as cursor:
+            owned=cursor.execute("SELECT EXISTS(SELECT 1 FROM pg_namespace n JOIN pg_roles r ON r.oid=n.nspowner WHERE r.rolname=ANY(%s)) OR EXISTS(SELECT 1 FROM pg_class c JOIN pg_roles r ON r.oid=c.relowner WHERE r.rolname=ANY(%s)) OR EXISTS(SELECT 1 FROM pg_proc p JOIN pg_roles r ON r.oid=p.proowner WHERE r.rolname=ANY(%s)) OR EXISTS(SELECT 1 FROM pg_database d JOIN pg_roles r ON r.oid=d.datdba WHERE r.rolname=ANY(%s))",([role,*parent_names],)*4).fetchone()[0]
+        if owned:raise ValueError('Runtime and authentication roles must not own database objects')
+        name=sql.Identifier(role)
+        conn.execute(sql.SQL('REVOKE ALL ON SCHEMA workflow FROM {}').format(name))
+        conn.execute(sql.SQL('REVOKE ALL ON ALL TABLES IN SCHEMA workflow FROM {}').format(name))
+        # PostgreSQL 17's table REVOKE also removes corresponding column grants;
+        # keep a native regression for reused role grants rather than assuming it.
+        # https://www.postgresql.org/docs/17/sql-revoke.html
+        conn.execute(sql.SQL('REVOKE ALL ON ALL SEQUENCES IN SCHEMA workflow FROM {}').format(name))
+        conn.execute(sql.SQL('REVOKE ALL ON ALL FUNCTIONS IN SCHEMA workflow FROM {}').format(name))
+        with conn.cursor(row_factory=tuple_row)as cursor:
+            inherited_access=cursor.execute("SELECT has_schema_privilege(%s,'workflow','CREATE') OR EXISTS(SELECT 1 FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname='workflow'AND CASE WHEN c.relkind IN('r','p','v','m','f')THEN(has_table_privilege(%s,c.oid,'SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')OR has_any_column_privilege(%s,c.oid,'SELECT,INSERT,UPDATE,REFERENCES'))ELSE false END) OR EXISTS(SELECT 1 FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname='workflow'AND CASE WHEN c.relkind='S'THEN has_sequence_privilege(%s,c.oid,'SELECT,USAGE,UPDATE')ELSE false END)",(role,role,role,role)).fetchone()[0]
+        if inherited_access:raise ValueError('Public or inherited grants broaden the owned workflow boundary; review them before granting runtime access')
+        conn.execute(sql.SQL('GRANT USAGE ON SCHEMA workflow TO {}').format(name))
+        conn.execute(sql.SQL('GRANT USAGE,SELECT ON ALL SEQUENCES IN SCHEMA workflow TO {}').format(name))
+        conn.execute(sql.SQL('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA workflow TO {}').format(name))
+        conn.execute(sql.SQL('GRANT SELECT ON workflow.schema_version,workflow.accounts,workflow.memberships,workflow.operations,workflow.events,workflow.results_history TO {}').format(name))
+        # PostgreSQL requires UPDATE on at least one column for SELECT FOR SHARE.
+        # Only this inert locking column is writable; roles/active/identity are not.
+        # https://www.postgresql.org/docs/17/ddl-priv.html
+        conn.execute(sql.SQL('GRANT UPDATE(authorization_lock) ON workflow.memberships TO {}').format(name))
+        conn.execute(sql.SQL('GRANT INSERT,UPDATE ON workflow.operations TO {}').format(name))
+        conn.execute(sql.SQL('GRANT INSERT ON workflow.events TO {}').format(name))
+        conn.execute(sql.SQL('GRANT INSERT ON workflow.results_history TO {}').format(name))
+    # API notifications are append-only; it cannot finish/prune/rewrite worker
+    # jobs, alter memberships, delete audit history or migrate the schema.
+    api=sql.Identifier(api_role);worker=sql.Identifier(worker_role)
+    conn.execute(sql.SQL('GRANT SELECT,INSERT ON workflow.procrastinate_jobs,workflow.procrastinate_events TO {}').format(api))
+    for table in QUEUE_TABLES:
+        conn.execute(sql.SQL('GRANT SELECT,INSERT,UPDATE,DELETE ON workflow.{} TO {}').format(sql.Identifier(table),worker))

package/src/runtime/workflow_errors.py

@@ -0,0 +1,6 @@
+"""Sanitized failure categories; never carry raw model/document/provider text."""
+class TemporaryWork(Exception):pass
+class PermanentWork(Exception):pass
+class ExternalOutcomeUnknown(Exception):pass
+class DestinationNotAttempted(TemporaryWork):pass
+class InvalidDispatch(PermanentWork):pass