@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/server/memory_service.py

@@ -0,0 +1,273 @@
+from .settings import setting, home as product_home
+"""AtMem AI Architect's authenticated single-user scope policy over the real AtMem core SDK.
+
+Application queue/receipts live in state.sqlite; memory and supersession live in AtMem.
+No unfiltered dashboard, shared ~/.atmem store, or model-selected subject is exposed.
+"""
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import sqlite3
+import subprocess
+import threading
+import uuid
+from contextlib import contextmanager
+from datetime import datetime, timezone
+
+ROOT = Path(__file__).resolve().parent.parent
+SECRET_KEY = re.compile(r'^(password|secret|api_?key|access_?key|token|client_?secret)$', re.I)
+SECRET_VALUE = re.compile(r'AKIA[0-9A-Z]{16}|sk-(?:ant-)?[A-Za-z0-9_-]{20,}|ghp_[A-Za-z0-9]{36}|AIza[\w-]{35}|-----BEGIN .*PRIVATE KEY-----')
+
+
+def safe(value):
+    if isinstance(value, str):
+        return not SECRET_VALUE.search(value)
+    if isinstance(value, list):
+        return all(safe(v) for v in value)
+    if isinstance(value, dict):
+        return all(not (SECRET_KEY.match(k) and v) and safe(v) for k, v in value.items())
+    return True
+
+
+def digest(value):
+    return hashlib.sha256(json.dumps(value, sort_keys=True, ensure_ascii=False).encode()).hexdigest()
+
+
+def timestamp():
+    return datetime.now(timezone.utc).isoformat()
+
+
+class MemoryService:
+    def __init__(self, home=None, worker=None):
+        self.home = Path(home or product_home()) / 'memory'
+        self.home.mkdir(parents=True, exist_ok=True, mode=0o700)
+        self.worker = str(worker or setting('MEMORY_PYTHON') or ROOT / '.memory-venv' / ('Scripts/python.exe' if os.name == 'nt' else 'bin/python'))
+        self.lock = threading.RLock()
+        self.error = None
+        with self.db() as db:
+            db.executescript('''
+              CREATE TABLE IF NOT EXISTS identity (id TEXT PRIMARY KEY);
+              CREATE TABLE IF NOT EXISTS settings (project TEXT PRIMARY KEY, enabled INTEGER NOT NULL DEFAULT 1);
+              CREATE TABLE IF NOT EXISTS snapshots (project TEXT PRIMARY KEY, revision INTEGER, entities TEXT, digest TEXT);
+              CREATE TABLE IF NOT EXISTS queue (seq INTEGER PRIMARY KEY AUTOINCREMENT, event_id TEXT UNIQUE, project TEXT, scope TEXT, key TEXT, text TEXT, source TEXT, state TEXT, created TEXT);
+              CREATE TABLE IF NOT EXISTS activity (id TEXT PRIMARY KEY, project TEXT, created TEXT, payload TEXT);
+              CREATE TABLE IF NOT EXISTS skill_settings (id TEXT PRIMARY KEY, enabled INTEGER);
+            ''')
+            row = db.execute('SELECT id FROM identity').fetchone()
+            if 'reason' not in {r[1] for r in db.execute('PRAGMA table_info(queue)')}:
+                db.execute("ALTER TABLE queue ADD COLUMN reason TEXT DEFAULT ''")
+            self.owner = row[0] if row else str(uuid.uuid4())
+            if not row:
+                db.execute('INSERT INTO identity VALUES (?)', (self.owner,))
+
+    @contextmanager
+    def db(self):
+        db = sqlite3.connect(self.home / 'state.sqlite', timeout=15)
+        db.execute('PRAGMA secure_delete=ON')
+        try:
+            with db:
+                yield db
+        finally:
+            db.close()
+
+    def project(self, project):
+        if not isinstance(project, str) or not re.fullmatch(r'[A-Za-z0-9-]{8,64}', project):
+            raise ValueError('Invalid project identity')
+        return project
+
+    def subject(self, scope, project):
+        return 'atforma-' + digest([self.owner, scope, project if scope == 'project' else 'shared'])[:40]
+
+    def enabled(self, project):
+        with self.db() as db:
+            row = db.execute('SELECT enabled FROM settings WHERE project=?', (project,)).fetchone()
+        return not row or bool(row[0])
+
+    def configure(self, project, enabled):
+        self.project(project)
+        with self.lock, self.db() as db:
+            db.execute('INSERT OR REPLACE INTO settings VALUES (?,?)', (project, int(enabled)))
+            if not enabled:
+                db.execute("UPDATE queue SET state='cancelled' WHERE project=? AND state='pending'", (project,))
+        return {'enabled': enabled}
+
+    def call(self, operations):
+        result = subprocess.run([self.worker, '-I', str(ROOT / 'server/memory_worker.py')],
+            input=json.dumps({'database': str(self.home / 'memories.db'), 'operations': operations}),
+            text=True, capture_output=True, timeout=25, cwd=str(self.home))
+        try:
+            payload = json.loads(result.stdout)
+        except (ValueError, TypeError):
+            raise RuntimeError('AtMem runtime unavailable; run npm run setup:memory') from None
+        if result.returncode or 'error' in payload:
+            raise RuntimeError('AtMem rejected the operation (' + payload.get('error', 'worker failed') + ')')
+        self.error = None
+        return payload['results']
+
+    def enqueue(self, project, scope, key, text, event_id=None, source=''):
+        if not safe(text) or len(text) > 1900:
+            raise ValueError('Memory content is too long or looks like a credential')
+        event_id = event_id or digest([project, scope, key, text])
+        with self.db() as db:
+            db.execute("INSERT OR IGNORE INTO queue(event_id,project,scope,key,text,source,state,created) VALUES (?,?,?,?,?,?,'pending',?)", (event_id, project, scope, key, text, source, timestamp()))
+
+    def flush(self):
+        with self.lock:
+            with self.db() as db:
+                rows = db.execute("SELECT seq,event_id,project,scope,key,text,source FROM queue WHERE state='pending' ORDER BY seq LIMIT 500").fetchall()
+            if not rows:
+                return True
+            try:
+                # The worker durably receipts each event so a partial batch can replay safely.
+                results = self.call([{'action': 'remember', 'subject': self.subject(scope, project), 'key': key, 'text': text, 'eventId': event, 'source': source} for seq, event, project, scope, key, text, source in rows])
+                with self.db() as db:
+                    for row, result in zip(rows, results):
+                        db.execute("UPDATE queue SET state=?,reason=?,text='',source='' WHERE seq=?", ('rejected' if result.get('refused') else 'synced', json.dumps(result.get('refused',[])), row[0]))
+                return True
+            except (OSError, RuntimeError, subprocess.TimeoutExpired):
+                self.error = 'AtMem unavailable — using this project only; eligible changes queued'
+                return False
+
+    @staticmethod
+    def entities(file):
+        values = {}
+        design = file.get('design') or {}
+        # The editable project already holds the diagram, comments and conversation brief.
+        # Only durable, confirmed facts belong in long-term memory.
+        for category in ('requirements', 'assumptions', 'openQuestions'):
+            for item in file.get(category, [])[:300]:
+                if category != 'requirements' or item.get('source') != 'user' or item.get('priority') != 'must' or str(item.get('id','')).startswith('drv-'):
+                    continue
+                key = str(item.get('id', ''))
+                content = item.get('statement') or item.get('question')
+                if key and content:
+                    values[f'{category}.{key}'] = f'{category} [{key}]: {content}; status: {item.get("status", "recorded")}'[:1800]
+        for item in file.get('discovery', {}).get('facts', [])[:300]:
+            if isinstance(item, dict) and item.get('name') == 'budget.per_month' and not item.get('conflictsWith'):
+                name = str(item['name'])
+                values['fact.' + name] = f'Project fact {name}: {item.get("value")} {item.get("unit", "")}; stated {item.get("madeAt", "unknown")}' + ('; unresolved conflict: confirm with user' if item.get('conflictsWith') else '')
+        decisions = file.get('decisions', [])
+        for item in decisions[:200]:
+            if item.get('status') != 'Accepted':
+                continue
+            subject = str(item.get('subject') or item.get('id') or 'decision')
+            if subject.startswith('design.'):
+                continue
+            values['decision.' + subject] = f'Project decision {subject}: {item.get("decision") or item.get("title", "")}; status: {item.get("status", "Proposed")}; reason: {item.get("reason") or item.get("rationale") or "not recorded"}'[:1800]
+        return values
+
+    def sync(self, project, file):
+        self.project(project)
+        if not isinstance(file, dict) or file.get('format') not in {'atmem.ai-architect.project','atforma.project'} or file.get('meta', {}).get('id') != project or not safe(file):
+            raise ValueError('Invalid project snapshot or credential-bearing data')
+        revision = file.get('meta', {}).get('revision')
+        if not isinstance(revision, int) or revision < 1:
+            raise ValueError('Invalid project revision')
+        with self.lock:
+            if not self.enabled(project):
+                return {'enabled': False, 'status': 'disabled'}
+            entities = self.entities(file)
+            with self.db() as db:
+                old = db.execute('SELECT revision,entities,digest FROM snapshots WHERE project=?', (project,)).fetchone()
+            if old and revision < old[0]:
+                return {'status': 'conflict', 'detail': 'Older project revision; memory was not changed'}
+            previous = json.loads(old[1]) if old else {}
+            change_id = str(uuid.uuid4())
+            with self.db() as db:
+                # Snapshot update and outbox insertion are one transaction: no lost change on crash.
+                for key in previous.keys() | entities.keys():
+                    text = entities.get(key, f'{key} was removed from this project; do not treat the earlier value as current.')
+                    if previous.get(key) == entities.get(key):
+                        continue
+                    db.execute("INSERT INTO queue(event_id,project,scope,key,text,source,state,created) VALUES (?,?,?,?,?,?,'pending',?)", (digest([change_id,key]), project, 'project', key, text, 'project snapshot r' + str(revision), timestamp()))
+                db.execute('INSERT OR REPLACE INTO snapshots VALUES (?,?,?,?)', (project, revision, json.dumps(entities), digest(file)))
+            self.flush()
+            return self.status(project)
+
+    def status(self, project):
+        with self.db() as db:
+            counts = dict(db.execute('SELECT state,count(*) FROM queue WHERE project=? GROUP BY state', (project,)).fetchall())
+        return {'enabled': self.enabled(project), 'status': 'disabled' if not self.enabled(project) else 'unavailable' if self.error else 'ready', 'pending': counts.get('pending', 0), 'rejected': counts.get('rejected', 0), 'engine': 'AtMem 2.3.10 core SDK', 'policy': 'AtMem AI Architect single-user scope and opt-out policy', 'detail': self.error}
+
+    def profile(self, project, field, value):
+        if field not in {'explanation', 'experience', 'iac', 'preferences'} or not value.strip() or len(value) > 1000:
+            raise ValueError('Choose a profile field and enter up to 1,000 characters')
+        with self.lock:
+            if not self.enabled(project):
+                raise ValueError('Memory is disabled for this project')
+            # User presses Remember; these are confirmed preferences, not model inferences.
+            self.enqueue(project, 'user', 'profile.' + field, f'User-confirmed {field}: {value.strip()}', event_id=str(uuid.uuid4()))
+            self.flush()
+            return self.status(project)
+
+    def inspect(self, project):
+        self.project(project)
+        with self.lock:
+            if self.enabled(project):
+                self.flush()
+            subjects = [self.subject('user', project), self.subject('project', project), self.subject('knowledge', project)]
+            try:
+                results = self.call([{'action': 'list', 'subject': s} for s in subjects])
+                records = [[{k: r.get(k) for k in ('id','content','status','fact_key','created_at','supersedes_id')} for r in rows[-200:] if r.get('status') != 'tombstoned'] for rows in results]
+            except (OSError, RuntimeError, subprocess.TimeoutExpired):
+                self.error = 'AtMem unavailable — using this project only; eligible changes queued'
+                records = [[], [], []]
+            with self.db() as db:
+                activity = [{'id': r[0], 'createdAt': r[1], **json.loads(r[2])} for r in db.execute('SELECT id,created,payload FROM activity WHERE project=? ORDER BY created DESC LIMIT 20', (project,))]
+                events = [{'key':r[0],'status':r[1],'reason':r[2],'createdAt':r[3]} for r in db.execute("SELECT key,state,reason,created FROM queue WHERE project=? AND state IN ('pending','rejected') ORDER BY seq DESC LIMIT 20",(project,))]
+            return {**self.status(project), 'profile': records[0], 'project': records[1], 'knowledge': records[2], 'activity': activity, 'events':events}
+
+    def forget(self, project, scope, record_id):
+        if scope not in {'user', 'project'}:
+            raise ValueError('Invalid memory scope')
+        with self.lock:
+            result = self.call([{'action': 'forget', 'subject': self.subject(scope, project), 'recordId': record_id}])[0]
+            key = result.pop('key')
+            with self.db() as db:
+                # Remove plaintext outbox copies too, and cancel replay of this exact key.
+                if scope == 'user':
+                    db.execute('DELETE FROM queue WHERE scope=? AND key=?', (scope, key))
+                else:
+                    db.execute('DELETE FROM queue WHERE project=? AND scope=? AND key=?', (project, scope, key))
+            return result
+
+    def recall(self, project, query):
+        self.project(project)
+        with self.lock:
+            if not self.enabled(project):
+                return [], self.status(project)
+            if not self.flush():
+                return [], self.status(project)
+            try:
+                rows = self.call([{'action': 'recall', 'subject': self.subject(s, project), 'query': query, 'limit': 6} for s in ('user', 'project')])
+                context = [{'scope': scope, 'id': r['id'], 'text': r['content'], 'sourceDate': r['created_at'], 'key': r.get('fact_key')} for scope, records in zip(('user','project'), rows) for r in records]
+                return context, self.status(project)
+            except (OSError, RuntimeError, subprocess.TimeoutExpired):
+                self.error = 'AtMem unavailable — using this project only; eligible changes queued'
+                return [], self.status(project)
+
+    def record_turn(self, project, payload):
+        ident = str(uuid.uuid4())
+        with self.lock, self.db() as db:
+            db.execute('INSERT INTO activity VALUES (?,?,?,?)', (ident, project, timestamp(), json.dumps(payload)))
+            db.execute('DELETE FROM activity WHERE project=? AND id NOT IN (SELECT id FROM activity WHERE project=? ORDER BY created DESC LIMIT 100)', (project, project))
+        if self.enabled(project) and payload.get('recordIds'):
+            try:
+                self.call([{'action': 'log', 'subject': self.subject('project', project), 'eventType': 'atforma.turn', 'payload': payload}])
+            except (OSError, RuntimeError, subprocess.TimeoutExpired):
+                pass
+        return ident
+
+
+_instance = None
+_instance_home = None
+_guard = threading.Lock()
+def service():
+    global _instance, _instance_home
+    home = str(product_home())
+    with _guard:
+        if _instance is None or _instance_home != home:
+            _instance, _instance_home = MemoryService(home), home
+    return _instance

package/server/memory_worker.py

@@ -0,0 +1,66 @@
+"""Isolated pinned AtMem SDK process. JSON over stdio; no model/cloud tools."""
+import json
+import sys
+import sqlite3
+from importlib.metadata import version
+from atmem import Memory
+
+
+def run(payload):
+    if version('atmem') != '2.3.10':
+        raise RuntimeError('AtMem AI Architect requires the tested AtMem 2.3.10 runtime')
+    memory = Memory(payload['database'], auto_vectors=False)
+    receipts = sqlite3.connect(payload['database'] + '.receipts.sqlite')
+    receipts.execute('CREATE TABLE IF NOT EXISTS receipts (id TEXT PRIMARY KEY, result TEXT)')
+    results = []
+    try:
+        for op in payload['operations']:
+            subject = op['subject']
+            action = op['action']
+            if action == 'remember':
+                previous = receipts.execute('SELECT result FROM receipts WHERE id=?', (op['eventId'],)).fetchone()
+                if previous:
+                    results.append(json.loads(previous[0]))
+                    continue
+                value = memory.remember(subject, message=op['text'], source_type='user_message',
+                    interpreted_fact=op['text'], interpreted_fact_key=op['key'], actor='atforma',
+                    raw={'interpreter': 'atforma-project-event-v1', 'event_id': op['eventId'], 'source_url': op.get('source', '')})
+                receipt = {'refused': value.get('refused', []), 'ids': [r['id'] for r in value.get('records', [])] + value.get('duplicate_ids', [])}
+                receipts.execute('INSERT INTO receipts VALUES (?,?)', (op['eventId'], json.dumps(receipt)))
+                receipts.commit()
+                results.append(receipt)
+            elif action == 'recall':
+                results.append(memory.recall(subject, op['query'], limit=op.get('limit', 6)))
+            elif action == 'list':
+                results.append(memory.list(subject, include_inactive=True))
+            elif action == 'forget':
+                # Forget the entire keyed preference history so old values cannot resurface.
+                records = memory.list(subject, include_inactive=True)
+                record = next((r for r in records if r['id'] == op['recordId'] and r['status'] != 'tombstoned'), None)
+                if record is None:
+                    raise ValueError('Memory record is not available in this scope')
+                deletion_receipts = []
+                for r in records:
+                    if r.get('fact_key') == record.get('fact_key') and r['status'] != 'tombstoned':
+                        deletion_receipts.append(memory.forget_record(subject, r['id'])['receipt'])
+                results.append({'deleted': True, 'receipts': deletion_receipts, 'key': record.get('fact_key')})
+            elif action == 'audit':
+                report = memory.audit(subject)
+                results.append({'valid': report['audit_chain_valid'], 'events': report['audit_log'][-40:]})
+            elif action == 'log':
+                results.append(memory.log_action(subject, op['eventType'], op['payload'], actor='atforma'))
+            else:
+                raise ValueError('Unknown memory operation')
+        return {'version': version('atmem'), 'results': results}
+    finally:
+        memory.close()
+        receipts.close()
+
+
+if __name__ == '__main__':
+    try:
+        print(json.dumps(run(json.load(sys.stdin))))
+    except Exception as exc:
+        # No text/credentials from an exception cross this process boundary.
+        print(json.dumps({'error': type(exc).__name__}))
+        sys.exit(1)

package/server/openai_voice.py

@@ -0,0 +1,80 @@
+"""OpenAI audio transport credentials; never substitutes the selected Architect."""
+import os
+import time
+import httpx
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel, ConfigDict, Field
+
+router = APIRouter()
+MODEL = 'gpt-realtime-2.1-mini'
+TRANSCRIPTION_MODEL = 'gpt-transcribe'
+VOICE = 'marin'
+TOKEN_URL = 'https://api.openai.com/v1/realtime/client_secrets'
+_voice_key = None
+
+
+def api_key():
+    # Dedicated voice credential first, then the existing server OpenAI key.
+    # Never a native-login token, project file or extracted CLI credential.
+    from .app import ARCHITECT
+    return _voice_key or ARCHITECT.keys.get('openai') or os.getenv('OPENAI_API_KEY')
+
+
+def configuration():
+    return {'model': MODEL, 'type': 'realtime', 'output_modalities': ['audio'],
+            'instructions': 'You are the audio interface for a separate Architect. Read only the supplied written reply aloud naturally. Do not answer architecture questions yourself, add decisions, use tools or claim to have performed work.',
+            'tools': [],
+            'audio': {'input': {'transcription': {'model': TRANSCRIPTION_MODEL},
+                                'turn_detection': {'type': 'server_vad', 'create_response': False,
+                                                   'interrupt_response': False}},
+                      'output': {'voice': VOICE}}}
+
+
+class VoiceRequest(BaseModel):
+    model_config = ConfigDict(extra='forbid')
+
+
+class VoiceCredentialRequest(VoiceRequest):
+    key: str = Field(max_length=5000, strict=True)
+
+
+@router.post('/api/voice/openai/credentials')
+async def configure_key(payload: VoiceCredentialRequest):
+    global _voice_key
+    _voice_key = payload.key.strip() or None
+    return {'configuredInMemory': bool(_voice_key)}
+
+
+@router.get('/api/voice/openai/status')
+async def status():
+    return {'available': bool(api_key()), 'engine': 'openai-realtime', 'model': MODEL,
+            'voice': VOICE, 'audioDestination': 'OpenAI', 'audioStoredByArchitect': False}
+
+
+@router.post('/api/voice/openai/session')
+async def create_session(payload: VoiceRequest):
+    key = api_key()
+    if not key:
+        raise HTTPException(503, 'OpenAI voice needs an OpenAI API key on the Architect server. Configure it in the voice panel; your selected Architect model stays unchanged.')
+    try:
+        async with httpx.AsyncClient(timeout=15, follow_redirects=False) as client:
+            response = await client.post(TOKEN_URL, headers={'Authorization': 'Bearer '+key},
+                json={'expires_after': {'anchor': 'created_at', 'seconds': 60}, 'session': configuration()})
+        if response.status_code == 429:
+            raise HTTPException(429, 'OpenAI voice is rate limited. Retry after a short wait.')
+        if response.status_code in {401, 403}:
+            raise HTTPException(503, 'The OpenAI API key could not start voice. Check its permissions and account access.')
+        if response.status_code != 200:
+            raise HTTPException(502, 'OpenAI voice could not start. Check API access and retry; no local voice fallback was selected.')
+        value = response.json()
+        if (not isinstance(value, dict) or not isinstance(value.get('value'), str)
+                or not value['value'].startswith('ek_') or len(value['value']) > 4096
+                or type(value.get('expires_at')) not in {int, float}
+                or not time.time() < value['expires_at'] <= time.time()+120):
+            raise ValueError('Invalid ephemeral credential response')
+        return {'value': value['value'], 'expires_at': value['expires_at'], 'model': MODEL, 'voice': VOICE}
+    except HTTPException:
+        raise
+    except Exception:
+        # Never expose upstream bodies, credentials or HTTP transport diagnostics.
+        raise HTTPException(502, 'OpenAI voice connection failed. Check API access and retry.') from None

package/server/packaged_app.py

@@ -0,0 +1,9 @@
+"""Serve the compiled UI and the authenticated loopback API from one process."""
+from pathlib import Path
+from fastapi.staticfiles import StaticFiles
+from .app import app
+
+frontend=Path(__file__).resolve().parents[1]/'dist'
+if not (frontend/'index.html').is_file():
+    raise RuntimeError('The installed package has no compiled UI. Reinstall the complete Architect package.')
+app.mount('/',StaticFiles(directory=frontend,html=True),name='architect-ui')

package/server/pricing.py

@@ -0,0 +1,84 @@
+"""Bounded public AWS price-list lookup, never model-generated price numbers."""
+from datetime import datetime, timezone
+import json
+import re
+import urllib.request
+from functools import lru_cache
+import time
+
+
+def parse_s3(data, region, url):
+    matches=[]
+    for sku, product in data.get('products',{}).items():
+        attrs=product.get('attributes',{})
+        if product.get('productFamily') != 'Storage' or attrs.get('volumeType') != 'Standard' or attrs.get('regionCode') != region or attrs.get('locationType') != 'AWS Region': continue
+        for term in data.get('terms',{}).get('OnDemand',{}).get(sku,{}).values():
+            for rate in term.get('priceDimensions',{}).values():
+                if rate.get('unit')=='GB-Mo' and rate.get('beginRange')=='0' and rate.get('endRange')=='51200':
+                    price=float(rate.get('pricePerUnit',{}).get('USD','nan'))
+                    if price >= 0 and price < 10:
+                        matches.append({'price':price,'currency':'USD','unit':'GB-month','region':region,'service':'Amazon S3 Standard / '+sku,'source':'AWS public Price List','url':url,'date':datetime.now(timezone.utc).date().isoformat(),'publicationDate':data.get('publicationDate'),'description':rate.get('description'),'tierLimit':51200,'coverage':'S3 Standard storage, first 50 TB/month only; excludes requests, transfer, taxes and discounts'})
+    if len(matches)!=1: raise ValueError('Could not uniquely identify S3 Standard storage pricing for this region')
+    return matches[0]
+
+
+@lru_cache(maxsize=32)
+def _fetch(region, hour):
+    url=f'https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonS3/current/{region}/index.json'
+    with urllib.request.urlopen(urllib.request.Request(url,headers={'User-Agent':'AtMem AI Architect/0.2'}),timeout=12) as response:
+        raw=response.read(12_000_001)
+    if len(raw)>12_000_000: raise ValueError('Price list exceeds the supported size')
+    return parse_s3(json.loads(raw),region,url)
+
+
+def aws_s3(region):
+    if not re.fullmatch(r'[a-z]{2}-(?:gov-)?[a-z]+-\d',region):
+        raise ValueError('Select an explicit AWS region such as ap-southeast-2 before fetching pricing')
+    return dict(_fetch(region,int(time.time()//3600)))
+
+PROVIDER_PAGES = {
+ 'aws':'https://aws.amazon.com/s3/pricing/',
+ 'azure':'https://azure.microsoft.com/pricing/details/storage/blobs/',
+ 'gcp':'https://cloud.google.com/storage/pricing',
+ 'ibm':'https://www.ibm.com/products/cloud-object-storage/pricing',
+}
+
+@lru_cache(maxsize=32)
+def _azure_storage(region,hour):
+    from urllib.parse import urlencode
+    if not re.fullmatch(r'[a-z0-9]{3,40}',region):raise ValueError('Select an Azure region code')
+    query="serviceName eq 'Storage' and armRegionName eq '"+region+"' and meterName eq 'Hot LRS Data Stored' and priceType eq 'Consumption' and productName eq 'Blob Storage'"
+    url='https://prices.azure.com/api/retail/prices?'+urlencode({'$filter':query})
+    with urllib.request.urlopen(url,timeout=12) as response:data=json.loads(response.read(2_000_000))
+    matches=[r for r in data.get('Items',[]) if r.get('armRegionName')==region and r.get('productName')=='Blob Storage' and r.get('meterName')=='Hot LRS Data Stored' and r.get('tierMinimumUnits')==0 and r.get('currencyCode')=='USD' and r.get('unitOfMeasure')=='1 GB/Month']
+    if len(matches)!=1:raise ValueError('No unique matching Azure meter')
+    r=matches[0]
+    return {'available':True,'provider':'azure','price':r['retailPrice'],'currency':'USD','unit':'GB-month','region':region,'service':'Azure Blob Storage Hot LRS / '+r['skuId'],'source':'Azure Retail Prices API','url':url,'date':datetime.now(timezone.utc).date().isoformat(),'tierLimit':51200,'coverage':'Hot LRS base storage tier only; operations, transfer, redundancy alternatives, taxes and discounts excluded'}
+
+
+def storage_quote(provider,region):
+    if provider not in PROVIDER_PAGES:raise ValueError('Choose AWS, Azure, Google Cloud or IBM')
+    if provider=='aws':return {**aws_s3(region),'provider':'aws','available':True}
+    if provider=='azure':return dict(_azure_storage(region,int(time.time()//3600)))
+    if provider=='gcp':
+        import os
+        key=os.getenv('GOOGLE_CLOUD_BILLING_API_KEY')
+        if key and re.fullmatch(r'[a-z]+-[a-z]+\d',region):
+            # Official catalogue; caller supplies the standard API key in server environment only.
+            url='https://cloudbilling.googleapis.com/v1/services/95FF-2EF5-5EA1/skus?currencyCode=USD'
+            request=urllib.request.Request(url,headers={'X-Goog-Api-Key':key})
+            with urllib.request.urlopen(request,timeout=12) as response:data=json.loads(response.read(8_000_000))
+            candidates=[]
+            for sku in data.get('skus',[]):
+                description=sku.get('description','')
+                if region not in sku.get('serviceRegions',[]) or 'Standard Storage' not in description or 'Dual' in description or 'Multi' in description:continue
+                for info in sku.get('pricingInfo',[])[:1]:
+                    expression=info.get('pricingExpression',{})
+                    if expression.get('usageUnit')!='GiBy.mo':continue
+                    rates=expression.get('tieredRates',[])
+                    if len(rates)!=1 or rates[0].get('startUsageAmount',0)!=0:continue
+                    price=rates[0]['unitPrice'];value=float(price.get('units',0))+float(price.get('nanos',0))/1e9
+                    candidates.append({'available':True,'provider':'gcp','price':value,'currency':'USD','unit':'GiB-month','region':region,'service':'Google Cloud Storage Standard / '+sku['skuId'],'source':'Google Cloud Billing Catalog','url':'https://cloud.google.com/skus/?currency=USD','date':datetime.now(timezone.utc).date().isoformat(),'coverage':'Standard storage only; operations, replication and transfer excluded'})
+            if len(candidates)==1:return candidates[0]
+        return {'available':False,'provider':'gcp','region':region,'sourceUrl':PROVIDER_PAGES[provider],'reason':'An exact regional storage SKU needs a configured Google Cloud Billing Catalog API key or a sourced quote. A generic/default-region web price will not be substituted.','nextQuestion':'Which Google Cloud region and storage class should we price?'}
+    return {'available':False,'provider':'ibm','region':region,'sourceUrl':PROVIDER_PAGES[provider],'reason':'IBM pricing depends on region, storage class and plan. No verified regional quote is configured; no AWS or invented rate is substituted.','nextQuestion':'Which IBM region and storage class or existing IBM quote should we use?'}

package/server/process_control_observation.py

@@ -0,0 +1,31 @@
+"""Trusted empty-source probe fragment; observations never grant capabilities.
+
+Only libc prctl is used, not ISA-specific syscall numbers. RET_ALLOW stacks onto
+the existing outer policy; it cannot remove that policy or restore privileges.
+"""
+PYTHON_PROCESS_CONTROLS = r'''
+import ctypes,hashlib,platform,uuid
+from pathlib import Path
+class Filter(ctypes.Structure):
+ _fields_=[('code',ctypes.c_ushort),('jt',ctypes.c_ubyte),('jf',ctypes.c_ubyte),('k',ctypes.c_uint32)]
+class Program(ctypes.Structure):
+ _fields_=[('len',ctypes.c_ushort),('filter',ctypes.POINTER(Filter))]
+libc=ctypes.CDLL(None,use_errno=True)
+libc.prctl.argtypes=[ctypes.c_int,ctypes.c_ulong,ctypes.c_ulong,ctypes.c_ulong,ctypes.c_ulong]
+libc.prctl.restype=ctypes.c_int
+def observe_prctl(option,value):
+ ctypes.set_errno(0);code=libc.prctl(option,value,0,0,0);error=ctypes.get_errno()
+ return {'supported':code==0 and error==0,'returnCode':code,'errno':error}
+controls={'noNewPrivileges':observe_prctl(38,1)}
+filters=(Filter*1)(Filter(6,0,0,0x7fff0000));program=Program(1,filters)
+# Do not try the dependent operation without its prerequisite. Null is unknown.
+controls['seccompFilter']=None
+if controls['noNewPrivileges']['supported']:
+ ctypes.set_errno(0);code=libc.prctl(22,2,ctypes.addressof(program),0,0);error=ctypes.get_errno()
+ controls['seccompFilter']={'supported':code==0 and error==0,'returnCode':code,'errno':error}
+boot=Path('/proc/sys/kernel/random/boot_id').read_text().strip()
+if str(uuid.UUID(boot))!=boot:raise ValueError('Unrecognized kernel boot identity')
+result['processControls']=controls
+result['executionContext']={'processMachine':platform.machine(),'kernelRelease':platform.release(),
+ 'kernelBootSha256':hashlib.sha256(boot.encode()).hexdigest(),'uid':os.getuid()}
+'''