@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/runtime/workflow_http.py

@@ -0,0 +1,178 @@
+"""Typed approval-workflow HTTP boundary with operator-owned tenant and policy.
+
+No domain inference, identity provider, role administration or automatic execution
+is provided here. Trusted bootstrap supplies the verifier, typed store and origin.
+Acceptance means durable enqueue, never completed processing or delivery.
+"""
+import asyncio
+import json
+import re
+import threading
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse
+from starlette.concurrency import run_in_threadpool
+from durable_workflow import Principal, Denied, Missing, Conflict, identifier
+from workflow_payload import PayloadContract
+from workflow_configuration import owned_origin
+
+MAX_BODY = 66000  # Includes the envelope; typed data itself remains <=64000.
+
+
+class BodyTooLarge(ValueError): pass
+class UnsupportedBody(ValueError): pass
+class Busy(RuntimeError): pass
+
+
+def public_operation(row, *, include_source=False):
+    result = {'id':str(row['id']), 'state':row['state'], 'revision':row['result_revision'],
+            'result':row['result'], 'receipt':row['receipt'],
+            'createdAt':row['created_at'].isoformat(), 'updatedAt':row['updated_at'].isoformat()}
+    if include_source: result['source'] = row['source_ref']
+    return result
+
+
+async def body(request, fields):
+    types = request.headers.getlist('content-type')
+    if len(types) != 1 or types[0].split(';')[0].lower() != 'application/json':
+        raise UnsupportedBody('Use application/json')
+    lengths = request.headers.getlist('content-length')
+    if len(lengths) > 1 or lengths and not re.fullmatch(r'0|[1-9][0-9]{0,8}',lengths[0]):
+        raise ValueError('Use an exact body length')
+    expected = int(lengths[0]) if lengths else None
+    if expected is not None and expected > MAX_BODY: raise BodyTooLarge()
+    raw = bytearray()
+    async with asyncio.timeout(5):
+        async for chunk in request.stream():
+            if len(raw) + len(chunk) > MAX_BODY: raise BodyTooLarge()
+            raw.extend(chunk)
+    if expected is not None and len(raw) != expected: raise ValueError('Body length differs')
+    def unique(pairs):
+        result = {}
+        for key, value in pairs:
+            if key in result: raise ValueError('Duplicate application field')
+            result[key] = value
+        return result
+    def constant(_): raise ValueError('Nonfinite JSON is unsupported')
+    value = json.loads(raw.decode('utf-8'),object_pairs_hook=unique,parse_constant=constant)
+    if type(value) is not dict or set(value) != set(fields): raise ValueError('Use the exact operation envelope')
+    return value
+
+
+def create_app(verify, store, *, account_id, public_origin, operation_kind='draft', token_header=None):
+    identifier(account_id); origin = owned_origin(public_origin)
+    if not callable(verify) or type(getattr(store,'payload_contract',None)) is not PayloadContract:
+        raise ValueError('Supply an owned verifier and typed application store')
+    if type(operation_kind) is not str or operation_kind not in {'document','draft','account_change'}: raise ValueError('Use an owned operation policy')
+    if getattr(store,'operation_kind',None) not in {None,operation_kind}: raise ValueError('HTTP and stored operation policies differ')
+    if token_header is not None and (type(token_header) is not str or token_header != 'x-goog-iap-jwt-assertion'): raise ValueError('Unsupported native identity transport')
+    app = FastAPI(docs_url=None,redoc_url=None,openapi_url=None)
+    policy = getattr(store, 'review_policy', None)
+    def representation(row): return public_operation(row, include_source=policy is not None)
+    slots = threading.BoundedSemaphore(20)
+    def error(code,status): return JSONResponse({'error':{'code':code}},status_code=status)
+    async def actor(request):
+        if token_header:
+            headers = request.headers.getlist(token_header)
+            token = headers[0] if len(headers) == 1 else ''
+        else:
+            headers = request.headers.getlist('authorization')
+            supplied = headers[0] if len(headers) == 1 else ''
+            token = supplied[7:] if supplied.startswith('Bearer ') else ''
+        if not token or len(token) > 16384: raise Denied('Verified identity required')
+        try: subject = await run_in_threadpool(verify,token)
+        except Exception: raise Denied('Verified identity required') from None
+        try: principal = Principal(account_id,subject)
+        except ValueError: raise Denied('Verified identity required') from None
+        await run_in_threadpool(store.authorize,principal)
+        return principal
+    async def mutation(request,fields):
+        user = await actor(request)
+        if request.query_params: raise ValueError('Mutations do not accept query configuration')
+        value = await body(request,fields)
+        if await actor(request) != user: raise Denied('Identity changed while reading input')
+        return user,value
+    @app.middleware('http')
+    async def boundary(request,next_handler):
+        acquired = False
+        try:
+            origins = request.headers.getlist('origin')
+            if len(origins) > 1 or origins and origins[0] != origin: raise Denied('Wrong application origin')
+            if request.method not in {'GET','HEAD','OPTIONS'}:
+                if origins != [origin]: raise Denied('Exact application origin required')
+                acquired = slots.acquire(blocking=False)
+                if not acquired: raise Busy()
+            response = await next_handler(request)
+        except Denied: response = error('access_denied',403)
+        except Missing: response = error('not_found',404)
+        except Conflict: response = error('conflict',409)
+        except BodyTooLarge: response = error('body_too_large',413)
+        except UnsupportedBody: response = error('unsupported_content_type',415)
+        except Busy: response = error('busy',429)
+        except TimeoutError: response = error('body_timeout',408)
+        except (ValueError,UnicodeError,RecursionError): response = error('invalid_request',400)
+        except Exception: response = error('unavailable',503)
+        finally:
+            if acquired: slots.release()
+        response.headers.update({'Cache-Control':'no-store','X-Content-Type-Options':'nosniff',
+            'Referrer-Policy':'no-referrer','Strict-Transport-Security':'max-age=31536000',
+            'Content-Security-Policy':"default-src 'none'; frame-ancestors 'none'; base-uri 'none'"})
+        return response
+    @app.get('/healthz')
+    def health(): return {'status':'running'}
+    @app.get('/api/session')
+    async def session(request:Request):
+        user = await actor(request)
+        if request.query_params: raise ValueError('No session overrides are accepted')
+        return {'roles':await run_in_threadpool(store.authorize,user),'accountMode':'operator-owned'}
+    @app.post('/api/operations',status_code=202)
+    async def submit(request:Request):
+        user,value = await mutation(request,['source'])
+        keys = request.headers.getlist('idempotency-key')
+        if len(keys) != 1 or not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9_.:-]{0,199}',keys[0]):
+            raise ValueError('Use a stable bounded operation key')
+        operation = await run_in_threadpool(store.submit,user,operation_kind,keys[0],value['source'])
+        return {'operation':representation(await run_in_threadpool(store.get,user,operation))}
+    @app.get('/api/operations')
+    async def listing(request:Request):
+        user = await actor(request)
+        if set(request.query_params)-{'before'} or len(request.query_params.getlist('before')) > 1:
+            raise ValueError('Use the bounded operation cursor')
+        rows = await run_in_threadpool(store.list,user,before=request.query_params.get('before'),limit=25)
+        return {'operations':[representation(row) for row in rows], 'next':str(rows[-1]['id']) if len(rows)==25 else None}
+    @app.get('/api/operations/{operation_id}')
+    async def detail(operation_id:str,request:Request):
+        user = await actor(request)
+        if request.query_params: raise ValueError('No operation overrides are accepted')
+        return {'operation':representation(await run_in_threadpool(store.get,user,operation_id))}
+    @app.post('/api/operations/{operation_id}/review')
+    async def review(operation_id:str,request:Request):
+        user,value = await mutation(request,['revision','result'])
+        if type(value['revision']) is not int: raise ValueError('Use an exact revision')
+        row = await run_in_threadpool(store.edit_result,user,operation_id,value['revision'],value['result'])
+        return {'operation':representation(row)}
+    if policy is not None:
+        @app.post('/api/operations/{operation_id}/inspect')
+        async def inspect(operation_id:str,request:Request):
+            user,_ = await mutation(request,[])
+            row = await run_in_threadpool(store.inspect,user,operation_id)
+            return {'operation':representation(row),'payloadSha256':store._fingerprint(row),
+                    'destination':row['destination_contract']}
+        @app.get('/api/operations/{operation_id}/history')
+        async def history(operation_id:str,request:Request):
+            user = await actor(request)
+            if set(request.query_params)-{'afterRevision'}: raise ValueError('Invalid history cursor')
+            cursors = request.query_params.getlist('afterRevision')
+            if len(cursors)>1 or cursors and not re.fullmatch(r'0|[1-9][0-9]{0,9}',cursors[0]): raise ValueError('Invalid history cursor')
+            rows = await run_in_threadpool(store.result_history,user,operation_id,after_revision=int(cursors[0]) if cursors else 0)
+            return {'history':[{'revision':r['revision'],'result':r['result'],'actor':r['actor'],
+                                'createdAt':r['created_at'].isoformat()} for r in rows]}
+    @app.post('/api/operations/{operation_id}/approve')
+    async def approve(operation_id:str,request:Request):
+        user,value = await mutation(request,['revision','payloadSha256'] if policy is not None else ['revision'])
+        if type(value['revision']) is not int: raise ValueError('Use an exact revision')
+        if policy is not None:
+            row = await run_in_threadpool(store.approve,user,operation_id,value['revision'],value['payloadSha256'])
+        else:
+            row = await run_in_threadpool(store.approve,user,operation_id,value['revision'])
+        return {'operation':representation(row)}
+    return app

package/src/runtime/workflow_identity.py

@@ -0,0 +1,69 @@
+"""Native staff login bindings. Database membership remains authoritative for roles.
+
+Configuration is compiler/operator-owned. Never derive a signing-key URL, tenant,
+issuer, OAuth audience or processing role from caller claims or document content.
+JWT validity is bounded by expiry, not a claim of continuous IdP revocation.
+"""
+from dataclasses import dataclass
+import re
+import uuid
+import jwt
+from durable_workflow import Denied
+
+UUID=r'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
+
+class CognitoStaffVerifier:
+    def __init__(self,region,pool_id,client_id,scope,*,jwks=None):
+        if(not isinstance(region,str)or not re.fullmatch(r'[a-z]{2}-[a-z]+-[0-9]',region)
+           or not isinstance(pool_id,str)or not re.fullmatch(re.escape(region)+r'_[A-Za-z0-9]{1,55}',pool_id)
+           or not isinstance(client_id,str)or not re.fullmatch(r'[a-z0-9]{1,128}',client_id)
+           or not isinstance(scope,str)or not re.fullmatch(r'[A-Za-z0-9_.-]{1,80}/process',scope)):raise ValueError('Use the exact owned Cognito pool/client/scope')
+        self.issuer='https://cognito-idp.'+region+'.amazonaws.com/'+pool_id;self.client_id=client_id;self.scope=scope
+        self.jwks=jwks or jwt.PyJWKClient(self.issuer+'/.well-known/jwks.json',timeout=2,lifespan=300)
+    def __call__(self,token):
+        try:
+            if not isinstance(token,str)or not 1<=len(token)<=16384:raise Denied('Verified staff identity required')
+            key=self.jwks.get_signing_key_from_jwt(token).key
+            # Cognito ACCESS tokens bind the app client in client_id, rather than
+            # the ID token's aud. Never accept an ID token as an API credential.
+            claims=jwt.decode(token,key,algorithms=['RS256'],issuer=self.issuer,options={'verify_aud':False,'require':['iss','sub','exp','iat','client_id','token_use','scope','username']})
+            if(claims['token_use']!='access'or claims['client_id']!=self.client_id
+               or not isinstance(claims['scope'],str)or self.scope not in claims['scope'].split()
+               or not isinstance(claims['sub'],str)or str(uuid.UUID(claims['sub']))!=claims['sub']
+               or not isinstance(claims['username'],str)or not claims['username']
+               or any(type(claims[name])is not int for name in ['iat','exp'])or not 0<claims['exp']-claims['iat']<=3600):raise Denied('Verified staff identity required')
+            return claims['sub']
+        except Exception:raise Denied('Verified staff identity required')from None
+
+@dataclass(frozen=True)
+class StaffIdentity:
+    verify:object
+    public_configuration:dict
+    token_header:str|None=None
+
+def native_staff_identity(provider,settings,*,jwks=None):
+    if not isinstance(settings,dict)or any(not isinstance(value,str)for value in settings.values()):raise ValueError('Use owned native staff identity settings')
+    patterns={
+        'aws':{'REGION':r'[a-z]{2}-[a-z]+-[0-9]','POOL_ID':r'[a-z]{2}-[a-z]+-[0-9]_[A-Za-z0-9]{1,55}','CLIENT_ID':r'[a-z0-9]{1,128}','AUTH_ORIGIN':r'https://[a-z0-9][a-z0-9-]{0,61}[a-z0-9]\.auth\.[a-z]{2}-[a-z]+-[0-9]\.amazoncognito\.com','AUTH_SCOPE':r'[A-Za-z0-9_.-]{1,80}/process'},
+        'azure':{'TENANT_ID':UUID,'API_CLIENT_ID':UUID,'SPA_CLIENT_ID':UUID},
+        'gcp':{'PROJECT_NUMBER':r'[0-9]{6,20}','REGION':r'[a-z]+-[a-z]+[0-9]','SERVICE_NAME':r'[a-z][a-z0-9-]{4,47}[a-z0-9]'},
+        'ibm':{'APPID_TENANT_ID':UUID,'APPID_CLIENT_ID':UUID,'APPID_ISSUER':r'https://[a-z]{2}-[a-z]+\.appid\.cloud\.ibm\.com/oauth/v4/'+UUID,'AUTH_SCOPE':r'[A-Za-z0-9_.-]{1,80}/process'}}
+    if provider not in patterns or set(settings)!=set(patterns[provider])or any(not re.fullmatch(patterns[provider][name],value)for name,value in settings.items()):raise ValueError('Use exact reviewed native staff identity settings')
+    c=dict(settings)
+    if provider=='aws':
+        if not c['AUTH_ORIGIN'].endswith('.auth.'+c['REGION']+'.amazoncognito.com'):raise ValueError('Cognito authorization region differs from the owned pool')
+        verify=CognitoStaffVerifier(c['REGION'],c['POOL_ID'],c['CLIENT_ID'],c['AUTH_SCOPE'],jwks=jwks)
+        public={'mode':'oauth-pkce','authOrigin':c['AUTH_ORIGIN'],'authorizationEndpoint':c['AUTH_ORIGIN']+'/oauth2/authorize','tokenEndpoint':c['AUTH_ORIGIN']+'/oauth2/token','clientId':c['CLIENT_ID'],'scopes':'openid '+c['AUTH_SCOPE']}
+    elif provider=='azure':
+        from azure_structured import EntraVerifier
+        verify=EntraVerifier(c,jwks);authority='https://login.microsoftonline.com/'+c['TENANT_ID']+'/oauth2/v2.0'
+        public={'mode':'oauth-pkce','authOrigin':'https://login.microsoftonline.com','authorizationEndpoint':authority+'/authorize','tokenEndpoint':authority+'/token','clientId':c['SPA_CLIENT_ID'],'scopes':'openid api://'+c['API_CLIENT_ID']+'/access_as_user'}
+    elif provider=='gcp':
+        from gcp_structured import IapVerifier
+        return StaffIdentity(IapVerifier(c,jwks),{'mode':'proxy','loginPath':'/','logoutPath':None},'x-goog-iap-jwt-assertion')
+    else:
+        from ibm_structured import AppIdVerifier
+        if not c['APPID_ISSUER'].endswith('/oauth/v4/'+c['APPID_TENANT_ID']):raise ValueError('App ID issuer tenant differs from the owned tenant')
+        verify=AppIdVerifier(c,jwks);issuer=c['APPID_ISSUER'];origin=issuer.split('/oauth/v4/')[0]
+        public={'mode':'oauth-pkce','authOrigin':origin,'authorizationEndpoint':issuer+'/authorization','tokenEndpoint':issuer+'/token','clientId':c['APPID_CLIENT_ID'],'scopes':'openid '+c['AUTH_SCOPE']}
+    return StaffIdentity(verify,public)

package/src/runtime/workflow_payload.py

@@ -0,0 +1,118 @@
+"""Versioned bounded application data contracts, independent of domain/provider.
+
+This is a small closed contract language, not a JSON Schema implementation.
+Operator-selected contracts describe data, never roles, executable validation,
+destinations or transitions. Domain semantic checks remain the adapter's duty.
+"""
+from dataclasses import dataclass
+import hashlib
+import json
+import re
+
+
+def encoded(value):
+    def exact(item, depth=0):
+        if depth > 32: raise ValueError('Application JSON exceeds its nesting boundary')
+        if type(item) is dict:
+            if any(type(k) is not str for k in item): raise ValueError('Application object keys must be strings')
+            for child in item.values(): exact(child, depth + 1)
+        elif type(item) is list:
+            for child in item: exact(child, depth + 1)
+        elif type(item) not in {str, int, bool, type(None)}:
+            raise ValueError('Use exact application JSON types; decimals require an explicit string contract')
+    exact(value)
+    try:
+        raw = json.dumps(value, sort_keys=True, separators=(',', ':'), ensure_ascii=False, allow_nan=False).encode('utf-8')
+    except (TypeError, ValueError, UnicodeError, RecursionError):
+        raise ValueError('Invalid bounded application JSON') from None
+    if len(raw) > 64000:
+        raise ValueError('Application JSON exceeds its byte boundary')
+    return raw
+
+
+def schema(value, depth=0, budget=None):
+    if budget is None: budget = [256]
+    budget[0] -= 1
+    if depth > 8 or budget[0] < 0 or type(value) is not dict:
+        raise ValueError('Application contract exceeds its structural boundary')
+    kind = value.get('type')
+    shapes = {'object': {'type', 'properties', 'required'}, 'array': {'type', 'items', 'maxItems'},
+              'string': {'type', 'minBytes', 'maxBytes'}, 'integer': {'type', 'minimum', 'maximum'},
+              'boolean': {'type'}, 'enum': {'type', 'values'}}
+    if type(kind) is not str or kind not in shapes or set(value) != shapes[kind]:
+        raise ValueError('Use the closed application contract language')
+    if kind == 'object':
+        properties, required = value['properties'], value['required']
+        if (type(properties) is not dict or not 1 <= len(properties) <= 32 or
+            any(type(k) is not str or not re.fullmatch(r'[A-Za-z][A-Za-z0-9_]{0,79}', k) for k in properties) or
+            type(required) is not list or any(type(k) is not str for k in required) or
+            len(required) != len(set(required)) or not set(required) <= set(properties)):
+            raise ValueError('Use bounded exact object fields')
+        for item in properties.values(): schema(item, depth + 1, budget)
+    elif kind == 'array':
+        if type(value['maxItems']) is not int or not 1 <= value['maxItems'] <= 64:
+            raise ValueError('Use a bounded array')
+        schema(value['items'], depth + 1, budget)
+    elif kind == 'string':
+        if any(type(value[k]) is not int for k in ['minBytes', 'maxBytes']) or not 0 <= value['minBytes'] <= value['maxBytes'] <= 64000:
+            raise ValueError('Use exact UTF-8 byte limits')
+    elif kind == 'integer':
+        if any(type(value[k]) is not int for k in ['minimum', 'maximum']) or not -(2**53 - 1) <= value['minimum'] <= value['maximum'] <= 2**53 - 1:
+            raise ValueError('Use exact portable integer limits')
+    elif kind == 'enum':
+        items = value['values']
+        if (type(items) is not list or not 1 <= len(items) <= 64 or
+            any(type(item) is not str or not 1 <= len(item.encode('utf-8')) <= 256 for item in items) or len(items) != len(set(items))):
+            raise ValueError('Use a bounded distinct string enumeration')
+
+
+def conforms(rule, value):
+    kind = rule['type']
+    valid = False
+    if kind == 'object':
+        valid = (type(value) is dict and set(rule['required']) <= set(value) <= set(rule['properties']))
+        if valid:
+            for key, item in value.items(): conforms(rule['properties'][key], item)
+    elif kind == 'array':
+        valid = type(value) is list and len(value) <= rule['maxItems']
+        if valid:
+            for item in value: conforms(rule['items'], item)
+    elif kind == 'string':
+        valid = type(value) is str and rule['minBytes'] <= len(value.encode('utf-8')) <= rule['maxBytes']
+    elif kind == 'integer': valid = type(value) is int and rule['minimum'] <= value <= rule['maximum']
+    elif kind == 'boolean': valid = type(value) is bool
+    elif kind == 'enum': valid = type(value) is str and value in rule['values']
+    if not valid: raise ValueError('Application payload does not match its owned contract')
+
+
+@dataclass(frozen=True, init=False)
+class PayloadContract:
+    _encoded: bytes
+
+    def __init__(self, value):
+        raw = encoded(value)
+        copied = json.loads(raw)
+        if (type(copied) is not dict or set(copied) != {'version', 'id', 'source', 'result'} or
+            type(copied['version']) is not int or copied['version'] != 1 or
+            type(copied['id']) is not str or not re.fullmatch(r'[a-z][a-z0-9-]{0,79}', copied['id'])):
+            raise ValueError('Use a versioned owned application payload contract')
+        budget = [256]
+        for side in ['source', 'result']:
+            schema(copied[side], budget=budget)
+            if copied[side]['type'] != 'object': raise ValueError('Application boundaries require object payloads')
+        object.__setattr__(self, '_encoded', raw)
+
+    @property
+    def sha256(self): return hashlib.sha256(self._encoded).hexdigest()
+
+    def fields(self, side):
+        if side not in {'source', 'result'}: raise ValueError('Use an application input or result boundary')
+        return tuple(json.loads(self._encoded)[side]['properties'])
+
+    def validate(self, side, value):
+        if side not in {'source', 'result'}: raise ValueError('Use an application input or result boundary')
+        # Round trip before validation: no caller mutation can change the bytes
+        # validated for persistence. No clipping, coercion or default insertion.
+        copied = json.loads(encoded(value))
+        conforms(json.loads(self._encoded)[side], copied)
+        return copied

package/src/runtime/workflow_process_stage.py

@@ -0,0 +1,88 @@
+"""Hard deadlines for trusted processor/destination child processes on Linux.
+
+The compiler/operator supplies absolute commands and a minimal environment. No
+shell, model-selected program, inherited account credentials or stderr payloads.
+Input/output are bounded JSON. This is a deadline boundary, not an OS sandbox;
+untrusted PDF parsers still require a separate hardened container boundary.
+"""
+import json
+import math
+import os
+from pathlib import Path
+import selectors
+import signal
+import subprocess
+import tempfile
+import time
+from durable_workflow import canonical
+from workflow_errors import TemporaryWork,PermanentWork,ExternalOutcomeUnknown,DestinationNotAttempted,InvalidDispatch
+
+class ProcessStage:
+    def __init__(self,command,*,kind,timeout_seconds=60,environment=None,cwd=None,idempotency_verified=False):
+        if (not isinstance(command,(tuple,list))or not command or any(not isinstance(v,str)or not v or '\0'in v for v in command)
+            or not Path(command[0]).is_absolute()or not Path(command[0]).is_file()):raise ValueError('A trusted absolute executable is required')
+        if kind not in {'extract','dispatch'}or type(timeout_seconds)not in {int,float}or not math.isfinite(timeout_seconds)or not 0<timeout_seconds<=300:raise ValueError('Invalid bounded stage configuration')
+        if type(idempotency_verified)is not bool or(kind=='extract'and idempotency_verified):raise ValueError('Invalid stage replay configuration')
+        environment={}if environment is None else environment
+        if not isinstance(environment,dict)or any(not isinstance(k,str)or not isinstance(v,str)or not k or '='in k or '\0'in k+v for k,v in environment.items()):raise ValueError('Use an explicit trusted child environment')
+        directory=Path(cwd).resolve()if cwd else Path(command[0]).resolve().parent
+        if not directory.is_dir():raise ValueError('Use an existing owned working directory')
+        self.command=tuple(command);self.kind=kind;self.timeout_seconds=timeout_seconds;self.environment=dict(environment);self.cwd=directory;self.idempotency_verified=idempotency_verified
+
+    def __call__(self,row,**identity):
+        # Deliberately exclude database DSNs, lease tokens and application logins.
+        selected={key:row[key]for key in ['kind','source_ref','destination_contract','result','result_revision','approved_by','approved_hash','state']if key in row}
+        selected.update({key:str(row[key])for key in ['id','account_id']if key in row})
+        if 'created_at'in row:selected['created_at']=row['created_at'].isoformat()if hasattr(row['created_at'],'isoformat')else row['created_at']
+        payload=canonical({'operation':selected,'identity':identity},140000)
+        failure=TemporaryWork if self.kind=='extract'else ExternalOutcomeUnknown
+        process=None
+        try:
+            # A bounded private temporary input avoids a pipe-write deadlock when
+            # a child never reads stdin; no sensitive input appears in argv/env.
+            with tempfile.TemporaryFile(mode='w+b')as source,selectors.DefaultSelector()as selector:
+                source.write(payload);source.seek(0)
+                started=time.monotonic()
+                process=subprocess.Popen(self.command,stdin=source,stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,cwd=self.cwd,env=self.environment,start_new_session=True)
+                os.set_blocking(process.stdout.fileno(),False);selector.register(process.stdout,selectors.EVENT_READ)
+                output=bytearray()
+                while selector.get_map():
+                    remaining=self.timeout_seconds-(time.monotonic()-started)
+                    if remaining<=0:raise failure('Owned stage exceeded its deadline')
+                    for key,_ in selector.select(min(remaining,.1)):
+                        chunk=os.read(key.fd,8192)
+                        if not chunk:selector.unregister(key.fileobj);continue
+                        output.extend(chunk)
+                        if len(output)>70000:raise failure('Owned stage exceeded its output boundary')
+                remaining=self.timeout_seconds-(time.monotonic()-started)
+                if remaining<=0:raise failure('Owned stage exceeded its deadline')
+                try:code=process.wait(timeout=remaining)
+                except subprocess.TimeoutExpired:raise failure('Owned stage exceeded its deadline')from None
+                if code!=0:raise failure('Owned stage did not confirm completion')
+            def unique(pairs):
+                value={}
+                for key,item in pairs:
+                    if key in value:raise ValueError('Duplicate stage field')
+                    value[key]=item
+                return value
+            try:
+                response=json.loads(output,object_pairs_hook=unique,parse_constant=lambda _:(_ for _ in ()).throw(ValueError('Nonfinite stage result')))
+                if not isinstance(response,dict)or set(response)!={'status','result'}or not isinstance(response['result'],dict):raise ValueError('Invalid stage result')
+                canonical(response['result'],64000)
+            except (ValueError,TypeError,UnicodeError,RecursionError):raise failure('Owned stage returned an invalid response')from None
+            status=response['status']
+            if status=='ok':return response['result']
+            if self.kind=='extract'and status=='temporary':raise TemporaryWork('Processing temporarily unavailable')
+            if self.kind=='extract'and status=='permanent':raise PermanentWork('Processing requires review')
+            if self.kind=='dispatch'and status=='not_attempted':raise DestinationNotAttempted('Destination not attempted')
+            if self.kind=='dispatch'and status=='invalid':raise InvalidDispatch('Approved dispatch integrity requires review')
+            raise failure('Owned stage did not confirm completion')
+        except (TemporaryWork,PermanentWork,ExternalOutcomeUnknown):raise
+        except Exception:raise failure('Owned stage did not confirm completion')from None
+        finally:
+            if process is not None:
+                # Kill descendants even if the direct child exited before them.
+                try:os.killpg(process.pid,signal.SIGKILL)
+                except ProcessLookupError:pass
+                process.wait()
+                if process.stdout:process.stdout.close()

package/src/runtime/workflow_profile.py

@@ -0,0 +1,91 @@
+"""Pure versioned application declaration, shared by engine and delivered runtime."""
+import base64
+from dataclasses import dataclass
+import hashlib
+import json
+from pathlib import Path
+import uuid
+from urllib.parse import urlsplit
+if __package__:
+    from .workflow_payload import PayloadContract,encoded
+    from .workflow_contract import bind_payload_contract,bind_application_contract
+else:
+    from workflow_payload import PayloadContract,encoded
+    from workflow_contract import bind_payload_contract,bind_application_contract
+
+
+def identifier(value):
+    if type(value)is not str or str(uuid.UUID(value))!=value:raise ValueError('Use a canonical account UUID')
+    return value
+
+
+def owned_origin(value):
+    try:
+        parts = urlsplit(value)
+        port = parts.port
+    except (TypeError, ValueError): raise ValueError('Use the exact owned application origin') from None
+    if (type(value) is not str or not parts.hostname or parts.username or parts.password or
+        parts.query or parts.fragment or parts.path or
+        (port is not None and not 1 <= port <= 65535) or
+        any(ord(c) < 33 or ord(c) > 126 for c in value) or
+        (parts.scheme != 'https' and not (parts.scheme == 'http' and parts.hostname in {'localhost','127.0.0.1','::1'}))):
+        raise ValueError('Use the exact HTTPS origin or explicit loopback test origin')
+    return value
+
+
+IDENTITY_KEYS={
+ 'aws':('REGION','POOL_ID','CLIENT_ID','AUTH_ORIGIN','AUTH_SCOPE'),
+ 'azure':('TENANT_ID','API_CLIENT_ID','SPA_CLIENT_ID'),
+ 'gcp':('PROJECT_NUMBER','REGION','SERVICE_NAME'),
+ 'ibm':('APPID_TENANT_ID','APPID_CLIENT_ID','APPID_ISSUER','AUTH_SCOPE')}
+
+
+@dataclass(frozen=True,init=False)
+class ApplicationProfile:
+    _encoded:bytes
+
+    def __init__(self,value):
+        raw=encoded(value);data=json.loads(raw)
+        keys={'format','provider','componentId','environment','accountId','publicOrigin','operationKind','identitySettings','payloadContract','destinationContract'}
+        if type(data)is not dict or set(data)!=keys or data['format']!='approval-application-v1':raise ValueError('Use the exact versioned application profile')
+        if type(data['provider'])is not str or data['provider']not in IDENTITY_KEYS:raise ValueError('Use the selected application provider')
+        if type(data['componentId'])is not str or not 1<=len(data['componentId'].encode('utf-8'))<=512 or any(ord(c)<32 for c in data['componentId']):raise ValueError('Use the complete bounded component identity')
+        if type(data['environment'])is not str or data['environment']not in {'staging','production','qualification'}:raise ValueError('Use the reviewed deployment environment')
+        identifier(data['accountId']);owned_origin(data['publicOrigin'])
+        if type(data['operationKind'])is not str or data['operationKind']not in {'document','draft','account_change'}:raise ValueError('Use an explicit owned operation policy')
+        identity=data['identitySettings']
+        if type(identity)is not dict or set(identity)!=set(IDENTITY_KEYS[data['provider']])or any(type(v)is not str or not 1<=len(v.encode('utf-8'))<=2000 for v in identity.values()):raise ValueError('Use the complete nonsecret native identity settings')
+        if type(data['destinationContract'])is not dict or 'applicationContractSha256'in data['destinationContract']:raise ValueError('Use the reviewed base destination; application binding is generated')
+        bind_payload_contract(data['destinationContract'],PayloadContract(data['payloadContract']))
+        object.__setattr__(self,'_encoded',raw)
+
+    @property
+    def data(self):return json.loads(self._encoded)
+    @property
+    def payload(self):return PayloadContract(self.data['payloadContract'])
+    @property
+    def sha256(self):return hashlib.sha256(self._encoded).hexdigest()
+    @property
+    def destination(self):return bind_application_contract(bind_payload_contract(self.data['destinationContract'],self.payload),self.sha256)
+    @property
+    def binding_sha256(self):
+        value={key:self.data[key]for key in ['provider','componentId','environment','accountId']}
+        return hashlib.sha256(encoded(value)).hexdigest()
+    @property
+    def namespace(self):
+        # Explicit native alias, not truncation of the saved component identity.
+        # 88-bit digest encoding fits the existing task/notification constraints.
+        return 'w'+base64.b32encode(bytes.fromhex(self.binding_sha256)[:11]).decode().lower().rstrip('=')
+
+
+def load_profile(path):
+    if not isinstance(path,(str,Path))or not Path(path).is_absolute():raise ValueError('Use an owned absolute application profile path')
+    with Path(path).open('rb')as stream:raw=stream.read(64001)
+    if len(raw)>64000:raise ValueError('Application profile exceeds its byte boundary')
+    def unique(pairs):
+        result={}
+        for key,value in pairs:
+            if key in result:raise ValueError('Duplicate application profile field')
+            result[key]=value
+        return result
+    return ApplicationProfile(json.loads(raw.decode('utf-8'),object_pairs_hook=unique))