@atmem/architect 0.0.0-stage → 0.2.0

package/src/runtime/enterprise_aws_host_probe.py

@@ -0,0 +1,105 @@
+"""Fixed SSM host inspection. Standard library only; no document or secret input."""
+import base64
+import json
+import ipaddress
+from pathlib import Path
+import re
+import subprocess
+import shlex
+import sys
+
+
+def run(argv):
+    if argv and argv[0]=='/usr/bin/docker':
+        # An operator's saved Docker context must never redirect this native
+        # host inspection to another daemon, even with a scrubbed environment.
+        argv=[argv[0],'--host','unix:///var/run/docker.sock',*argv[1:]]
+    value=subprocess.run(argv,stdin=subprocess.DEVNULL,stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,
+                         timeout=4,check=True,env={'PATH':'/usr/sbin:/usr/bin:/sbin:/bin','LANG':'C'})
+    if len(value.stdout)>32768:raise ValueError('Invalid host observation')
+    return value.stdout.decode().strip()
+
+
+def expected_policy(expected):
+    if (not isinstance(expected,dict)or set(expected)!={'format','clusterArn','policySha256'}or
+        expected['format']!='enterprise-aws-host-policy-v1'or
+        not isinstance(expected['policySha256'],str)or not re.fullmatch('[0-9a-f]{64}',expected['policySha256'])or
+        not isinstance(expected['clusterArn'],str)or not re.fullmatch(r'arn:aws:ecs:[a-z]{2}-[a-z]+-[1-9]:[0-9]{12}:cluster/[A-Za-z0-9_-]{1,255}',expected['clusterArn'])):
+        raise ValueError('Use the exact owned host policy')
+    return dict(expected)
+
+
+def first_rule_matches(lines,chain,pairs):
+    active=[value for value in lines.splitlines()if value.startswith('-A ')]
+    if not active:return False
+    fields=shlex.split(active[0])
+    if fields[:2]!=['-A',chain]or len(fields)!=2+2*len(pairs):return False
+    actual={}
+    for index in range(2,len(fields),2):
+        key,value=fields[index:index+2]
+        if key in actual:return False
+        if key=='-d':
+            try:value=str(ipaddress.ip_network(value,strict=True))
+            except ValueError:return False
+        actual[key]=value
+    return actual==pairs
+
+
+def inspect_host(expected,*,read=lambda name:Path(name).read_text(),command=run):
+    expected=expected_policy(expected)
+    # Parse values as inert text. Never source a host config into a shell.
+    values={}
+    for line in read('/etc/ecs/ecs.config').splitlines():
+        if not line.strip()or line.lstrip().startswith('#'):continue
+        key,separator,value=line.partition('=')
+        if not separator or key in values:raise ValueError('Ambiguous ECS configuration')
+        values[key]=value
+    if (values.get('ECS_CLUSTER')!=expected['clusterArn']or
+        values.get('ECS_ENABLE_TASK_IAM_ROLE')!='true'or
+        values.get('ECS_ENGINE_TASK_CLEANUP_WAIT_DURATION')!='1s'or
+        values.get('ECS_ENABLE_TASK_IAM_ROLE_NETWORK_HOST')!='false'):
+        raise ValueError('ECS host policy changed')
+    attributes=json.loads(values.get('ECS_INSTANCE_ATTRIBUTES','{}'))
+    if attributes!={'atmem-document-policy':expected['policySha256']}:raise ValueError('Host policy selection changed')
+    daemon=json.loads(read('/etc/docker/daemon.json'))
+    if (daemon.get('log-driver')!='none'or daemon.get('live-restore',False)is not False or daemon.get('bridge','docker0')!='docker0'):
+        raise ValueError('Unsafe daemon logging, network or task persistence')
+    if json.loads(command(['/usr/bin/docker','info','--format','{{json .LoggingDriver}}']))!='none':raise ValueError('Actual daemon logging changed')
+    if json.loads(command(['/usr/bin/docker','info','--format','{{json .LiveRestoreEnabled}}']))is not False:raise ValueError('Native live restore is active')
+    options=json.loads(command(['/usr/bin/docker','info','--format','{{json .SecurityOptions}}']))
+    if not isinstance(options,list)or 'name=seccomp,profile=builtin'not in options:
+        raise ValueError('Native seccomp is not active')
+    bridge=json.loads(command(['/usr/bin/docker','network','inspect','bridge','--format','{{json .Options}}']))
+    if bridge.get('com.docker.network.bridge.name')!='docker0':raise ValueError('Actual default bridge changed')
+    native_env=json.loads(command(['/usr/bin/docker','inspect','ecs-agent','--format','{{json .Config.Env}}']))
+    if not isinstance(native_env,list)or any(not isinstance(v,str)for v in native_env):raise ValueError('Native ECS agent configuration unavailable')
+    native={}
+    for entry in native_env:
+        key,separator,value=entry.partition('=')
+        if not separator or key in native:raise ValueError('Ambiguous native ECS environment')
+        native[key]=value
+    for key in ['ECS_CLUSTER','ECS_ENABLE_TASK_IAM_ROLE','ECS_ENGINE_TASK_CLEANUP_WAIT_DURATION','ECS_ENABLE_TASK_IAM_ROLE_NETWORK_HOST','ECS_INSTANCE_ATTRIBUTES']:
+        if native.get(key)!=values[key]:raise ValueError('Running ECS agent differs from host policy')
+    # Both paths are fixed, read-only probes. A plain TCP bridge must not expose
+    # instance-profile credentials to the transfer containers.
+    for destination in ['169.254.169.254/32','fd00:ec2::254/128']:
+        tool='/usr/sbin/iptables'if ':'not in destination else'/usr/sbin/ip6tables'
+        rules=command([tool,'-w','2','-S','DOCKER-USER'])
+        if not first_rule_matches(rules,'DOCKER-USER',{'-i':'docker0','-d':destination,'-j':'DROP'}):raise ValueError('IMDS rule is missing or shadowed')
+        forward=command([tool,'-w','2','-S','FORWARD'])
+        if not first_rule_matches(forward,'FORWARD',{'-j':'DOCKER-USER'}):raise ValueError('IMDS chain is not the first forwarding hook')
+    boot=read('/proc/sys/kernel/random/boot_id').strip()
+    if not re.fullmatch('[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}',boot):raise ValueError('Invalid native boot identity')
+    return {'format':'enterprise-aws-host-observation-v1','policySha256':expected['policySha256'],
+            'clusterArn':expected['clusterArn'],'bootId':boot}
+
+
+def main():
+    try:
+        if len(sys.argv)!=2 or len(sys.argv[1])>4096:raise ValueError()
+        expected=json.loads(base64.b64decode(sys.argv[1],validate=True))
+        print(json.dumps(inspect_host(expected),separators=(',',':')))
+    except Exception:raise SystemExit(2)from None
+
+
+if __name__=='__main__':main()

package/src/runtime/enterprise_aws_hosts.py

@@ -0,0 +1,136 @@
+"""Point-in-time host inspection through one fixed, hash/version-bound SSM document."""
+from dataclasses import dataclass
+import base64
+import json
+import math
+from pathlib import Path
+import re
+import shlex
+import threading
+import time
+from types import MappingProxyType
+from enterprise_sources import SourceUnavailable
+
+
+def unique(pairs):
+    value={}
+    for key,item in pairs:
+        if key in value:raise ValueError('Ambiguous host-inspection content')
+        value[key]=item
+    return value
+
+
+def command_document(config):
+    source=Path(__file__).with_name('enterprise_aws_host_probe.py').read_bytes()
+    expected={'format':'enterprise-aws-host-policy-v1','clusterArn':config['clusterArn'],'policySha256':config['hostPolicySha256']}
+    launcher='import base64;exec(compile(base64.b64decode('+repr(base64.b64encode(source).decode())+'),"owned-host-probe","exec"))'
+    command='exec /usr/bin/python3 -I -c '+shlex.quote(launcher)+' '+shlex.quote(base64.b64encode(json.dumps(expected,sort_keys=True,separators=(',',':')).encode()).decode())
+    return {'schemaVersion':'2.2','description':'Fixed read-only parser host inspection; no caller command or secret parameters.',
+            'parameters':{},'mainSteps':[{'action':'aws:runShellScript','name':'verifyHost',
+                'precondition':{'StringEquals':['platformType','Linux']},'inputs':{'timeoutSeconds':'30','runCommand':[command]}}]}
+
+
+@dataclass(frozen=True)
+class VerifiedHosts:
+    policy_sha256:str
+    members:tuple
+    expires_at:float
+
+    def placement(self,config):
+        if (self.policy_sha256!=config['hostPolicySha256']or type(self.expires_at)not in {int,float}or not math.isfinite(self.expires_at)or
+            not 0<self.expires_at-time.monotonic()<=121 or type(self.members)is not tuple or not 1<=len(self.members)<=10):
+            raise SourceUnavailable('document_host_verification_changed')
+        prefix='arn:aws:ecs:'+config['region']+':'+config['accountId']+':container-instance/'+config['clusterArn'].rsplit('/',1)[1]+'/'
+        instances=[];arns=[]
+        for member in self.members:
+            if (type(member)is not tuple or len(member)!=2 or not isinstance(member[0],str)or
+                not re.fullmatch(re.escape(prefix)+'[0-9a-f]{32}',member[0])or not isinstance(member[1],str)or not re.fullmatch('i-[0-9a-f]{17}',member[1])):
+                raise SourceUnavailable('document_host_verification_changed')
+            arns.append(member[0]);instances.append(member[1])
+        if len(set(instances))!=len(instances)or len(set(arns))!=len(arns):raise SourceUnavailable('document_host_verification_changed')
+        return [{'type':'memberOf','expression':'ec2InstanceId in ['+', '.join("'"+value+"'"for value in sorted(instances))+']'}]
+
+
+class HostApi:
+    def __init__(self,region,*,ecs=None,ssm=None):
+        if not isinstance(region,str)or not re.fullmatch('[a-z]{2}-[a-z]+-[1-9]',region):raise ValueError('Use the owned AWS region')
+        self.region=region;self.clients={'ecs':ecs,'ssm':ssm};self._lock=threading.Lock()
+    def call(self,service,operation,**values):
+        allowed={'ecs':{'list_container_instances','describe_container_instances'},'ssm':{'get_document','send_command','get_command_invocation'}}
+        if service not in allowed or operation not in allowed[service]:raise ValueError('Use the fixed host-inspection contract')
+        try:
+            if self.clients[service]is None:
+                with self._lock:
+                    if self.clients[service]is None:
+                        import boto3
+                        from botocore.config import Config
+                        self.clients[service]=boto3.Session().client(service,region_name=self.region,
+                            endpoint_url='https://'+service+'.'+self.region+'.amazonaws.com',
+                            config=Config(proxies={},connect_timeout=2,read_timeout=5,retries={'total_max_attempts':1}))
+            value=getattr(self.clients[service],operation)(**values)
+            if not isinstance(value,dict):raise ValueError()
+            return value
+        except Exception as error:
+            if service=='ssm'and operation=='get_command_invocation'and getattr(error,'response',{}).get('Error',{}).get('Code')=='InvocationDoesNotExist':
+                return {'Status':'Pending'}
+            raise SourceUnavailable('document_host_verification_unavailable')from None
+
+
+class EcsHostPolicy:
+    def __init__(self,config,*,api=None,poll_seconds=1):
+        from enterprise_aws_jobs import configuration
+        self.config=MappingProxyType(configuration(config));self.api=api or HostApi(self.config['region'])
+        if type(poll_seconds)not in {int,float}or not .01<=poll_seconds<=2:raise ValueError('Use a bounded host-inspection poll interval')
+        self.poll_seconds=poll_seconds
+    def __call__(self,config):
+        if config!=self.config:raise ValueError('Use the exact owned host policy destination')
+        try:return self.verify()
+        except Exception:raise SourceUnavailable('document_host_verification_unavailable')from None
+    def verify(self):
+        c=self.config;started=time.monotonic();cluster=c['clusterArn']
+        def call(service,operation,**values):
+            if time.monotonic()-started>60:raise ValueError('Host inspection deadline')
+            return self.api.call(service,operation,**values)
+        listing=call('ecs','list_container_instances',cluster=cluster,status='ACTIVE',maxResults=10,
+            filter='attribute:atmem-document-policy == '+c['hostPolicySha256'])
+        arns=listing.get('containerInstanceArns')
+        if not isinstance(arns,list)or not 1<=len(arns)<=10 or len(set(arns))!=len(arns)or listing.get('nextToken'):raise ValueError('Owned host pool unavailable')
+        observed=call('ecs','describe_container_instances',cluster=cluster,containerInstances=arns)
+        instances=observed.get('containerInstances')
+        if observed.get('failures')or not isinstance(instances,list)or len(instances)!=len(arns):raise ValueError('Owned host pool changed')
+        members=[]
+        for value in instances:
+            attributes=value.get('attributes',[])
+            if (value.get('containerInstanceArn')not in arns or value.get('agentConnected')is not True or value.get('status')!='ACTIVE'or
+                not isinstance(attributes,list)or sum(v.get('name')=='atmem-document-policy'and v.get('value')==c['hostPolicySha256']for v in attributes)!=1):
+                raise ValueError('Native host selection changed')
+            members.append((value['containerInstanceArn'],value.get('ec2InstanceId')))
+        verified=VerifiedHosts(c['hostPolicySha256'],tuple(members),time.monotonic()+120);verified.placement(c)
+        version=c['hostDocumentVersion'];document=call('ssm','get_document',Name=c['hostDocumentArn'],DocumentVersion=version,DocumentFormat='JSON')
+        content=document.get('Content')
+        if not isinstance(content,str)or len(content.encode())>65536 or document.get('DocumentVersion')!=version or json.loads(content,object_pairs_hook=unique)!=command_document(c):
+            raise ValueError('Owned command document content changed')
+        sent=call('ssm','send_command',InstanceIds=[instance for _,instance in members],DocumentName=c['hostDocumentArn'],
+            DocumentVersion=version,DocumentHash=c['hostDocumentHash'],DocumentHashType='Sha256',TimeoutSeconds=30,
+            CloudWatchOutputConfig={'CloudWatchOutputEnabled':False})
+        command=sent.get('Command',{}).get('CommandId')
+        if not isinstance(command,str)or not re.fullmatch('[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}',command):raise ValueError('Invalid native inspection identity')
+        for _,instance in members:
+            while True:
+                value=call('ssm','get_command_invocation',CommandId=command,InstanceId=instance,PluginName='verifyHost')
+                status=value.get('Status')
+                if status=='Success':break
+                if status not in {'Pending','InProgress','Delayed'}:raise ValueError('Host inspection failed')
+                time.sleep(self.poll_seconds)
+            if (value.get('CommandId')!=command or value.get('InstanceId')!=instance or value.get('DocumentVersion')!=version or
+                value.get('DocumentName')not in {c['hostDocumentArn'],c['hostDocumentArn'].rsplit('/',1)[1]}or
+                type(value.get('ResponseCode'))is not int or value['ResponseCode']!=0 or value.get('StandardErrorContent')or
+                value.get('StandardOutputUrl')or value.get('StandardErrorUrl')):raise ValueError('Host inspection identity changed')
+            encoded=value.get('StandardOutputContent')
+            if not isinstance(encoded,str)or not 0<len(encoded.encode())<=4096:raise ValueError('Invalid host observation')
+            output=json.loads(encoded,object_pairs_hook=unique)
+            if (not isinstance(output,dict)or set(output)!={'format','policySha256','clusterArn','bootId'}or
+                output['format']!='enterprise-aws-host-observation-v1'or output['policySha256']!=c['hostPolicySha256']or output['clusterArn']!=cluster or
+                not isinstance(output['bootId'],str)or not re.fullmatch('[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}',output['bootId'])):
+                raise ValueError('Host observation changed')
+        verified.placement(c);return verified

package/src/runtime/enterprise_aws_jobs.py

@@ -0,0 +1,300 @@
+"""Owned EC2/ECS per-file controller, not a complete production composition.
+
+The parser requires per-container network disabling, unavailable on Fargate.
+Host-policy verification/provisioning and complete export integration are required;
+this module does not register a capability or change existing cloud resources.
+"""
+import json
+import copy
+import re
+import hashlib
+import threading
+import time
+import uuid
+from pathlib import Path
+from types import MappingProxyType
+from enterprise_aws_objects import S3DocumentObjects
+from enterprise_document_job import request,result
+from enterprise_document_jobs import DocumentJobLedger
+from enterprise_sources import SourceUnavailable
+from enterprise_aws_hosts import EcsHostPolicy,VerifiedHosts
+
+
+def configuration(value):
+    fields={'format','accountId','region','bucket','clusterArn','hostPolicySha256','hostDocumentArn','hostDocumentHash','hostDocumentVersion','workerRoleArn',
+            'transferRoleArn','executionRoleArn','parserImage','transferImage','taskDefinitionArn'}
+    if not isinstance(value,dict)or set(value)!=fields or value['format']!='enterprise-aws-document-job-v2':
+        raise ValueError('Use the exact owned AWS document-job configuration')
+    patterns={'accountId':r'[0-9]{12}','region':r'(?:af|ap|ca|eu|il|me|mx|sa|us)-(?:east|west|south|north|central|southeast|southwest|northeast|northwest)-[1-9]',
+              'bucket':r'[a-z0-9][a-z0-9-]{1,61}[a-z0-9]'}
+    for key,pattern in patterns.items():
+        if not isinstance(value[key],str)or not re.fullmatch(pattern,value[key]):raise ValueError('Invalid owned AWS destination')
+    if not isinstance(value['hostPolicySha256'],str)or not re.fullmatch('[0-9a-f]{64}',value['hostPolicySha256']):
+        raise ValueError('Use the reviewed dedicated-host policy fingerprint')
+    account,region=value['accountId'],value['region']
+    prefix='arn:aws:'
+    if (not isinstance(value['hostDocumentArn'],str)or not re.fullmatch(re.escape(prefix+'ssm:'+region+':'+account+':document/')+r'[A-Za-z0-9_.-]{3,128}',value['hostDocumentArn'])or
+        not isinstance(value['hostDocumentHash'],str)or not re.fullmatch('[0-9a-f]{64}',value['hostDocumentHash'])or
+        not isinstance(value['hostDocumentVersion'],str)or not re.fullmatch('[1-9][0-9]{0,8}',value['hostDocumentVersion'])):
+        raise ValueError('Use the exact owned version/hash-bound host document')
+    for key in ['workerRoleArn','transferRoleArn','executionRoleArn']:
+        if not isinstance(value[key],str)or not re.fullmatch(re.escape(prefix+'iam::'+account+':role/')+r'[A-Za-z0-9_+=,.@/-]{1,128}',value[key]):
+            raise ValueError('Use explicit same-account owned roles')
+    if len({value[key]for key in ['workerRoleArn','transferRoleArn','executionRoleArn']})!=3:
+        raise ValueError('Worker, storage transfer and image execution authority must be distinct')
+    if not isinstance(value['clusterArn'],str)or not re.fullmatch(re.escape(prefix+'ecs:'+region+':'+account+':cluster/')+r'[A-Za-z0-9_-]{1,255}',value['clusterArn']):
+        raise ValueError('Use the owned regional ECS cluster')
+    if (not isinstance(value['taskDefinitionArn'],str)or not re.fullmatch(re.escape(prefix+'ecs:'+region+':'+account+':task-definition/document-')+r'[A-Za-z0-9_-]{1,200}:[1-9][0-9]{0,8}',value['taskDefinitionArn'])):
+        raise ValueError('Use the exact operator-owned regional task-definition revision')
+    for key in ['parserImage','transferImage']:
+        if not isinstance(value[key],str)or not re.fullmatch(re.escape(account+'.dkr.ecr.'+region+'.amazonaws.com/')+r'[a-z0-9]+(?:[._/-][a-z0-9]+)*@sha256:[0-9a-f]{64}',value[key]):
+            raise ValueError('Use immutable owned regional ECR images')
+    if value['parserImage']==value['transferImage']:raise ValueError('Keep the parser and trusted transfer artifacts separate')
+    return dict(value)
+
+
+def transfer_metadata(config,metadata,etag):
+    # Preserve the shared byte contract's exact fields and canonical media type.
+    if not isinstance(metadata,dict)or set(metadata)!={'format','requestId','sha256','mediaType'}:
+        raise ValueError('Use the exact document request')
+    if (metadata['format']!='enterprise-document-job-v1' or
+        not isinstance(metadata['requestId'],str)or not re.fullmatch('[0-9a-f]{64}',metadata['requestId'])or
+        not isinstance(metadata['sha256'],str)or not re.fullmatch('[0-9a-f]{64}',metadata['sha256'])):
+        raise ValueError('Use the owned byte-bound request')
+    from enterprise_document_contract import media_type
+    if media_type(metadata['mediaType'])!=metadata['mediaType']:raise ValueError('Use canonical document MIME')
+    # Opaque ETag is a conditional read token, never treated as an input digest.
+    if not isinstance(etag,str)or not re.fullmatch(r'"[0-9a-f]{32}(?:-[1-9][0-9]{0,4})?"',etag):
+        raise ValueError('Use the acknowledged native input ETag')
+    return {'format':'enterprise-aws-document-transfer-v1','accountId':config['accountId'],
+            'region':config['region'],'bucket':config['bucket'],'request':dict(metadata),'inputETag':etag}
+
+
+def task_family(config):
+    return config['taskDefinitionArn'].rsplit('/',1)[1].rsplit(':',1)[0]
+
+
+def task_definition(config):
+    """Immutable operator-owned shape, shared with the Terraform compiler.
+
+    No file identity, bytes, ETag, user prompt or model authority belongs here.
+    """
+    owned=configuration(config)
+    replacements={'__FAMILY__':task_family(owned),'__POLICY_SHA256__':owned['hostPolicySha256'],
+                  '__TRANSFER_ROLE_ARN__':owned['transferRoleArn'],'__EXECUTION_ROLE_ARN__':owned['executionRoleArn'],
+                  '__TRANSFER_IMAGE__':owned['transferImage'],'__PARSER_IMAGE__':owned['parserImage']}
+    def resolve(value):
+        if isinstance(value,dict):return {key:resolve(item)for key,item in value.items()}
+        if isinstance(value,list):return [resolve(item)for item in value]
+        if isinstance(value,str):
+            for key,replacement in replacements.items():value=value.replace(key,replacement)
+        return value
+    return resolve(json.loads(Path(__file__).with_name('enterprise-aws-task-template.json').read_text()))
+
+
+def task_overrides(config,metadata,etag):
+    encoded=json.dumps(transfer_metadata(configuration(config),metadata,etag),separators=(',',':'))
+    return {'containerOverrides':[{'name':name,'environment':[{'name':'DOCUMENT_JOB','value':encoded}]}for name in ['download','upload']]}
+
+
+def verify_definition(config,reply):
+    """Reject drift before storing bytes; tolerate only inert native defaults.
+
+    Native describe metadata is not a runtime override or deployment proof.
+    Unknown nonempty configuration fails closed rather than being projected away.
+    """
+    desired=task_definition(config);desired.pop('tags')
+    if not isinstance(reply,dict)or not isinstance(reply.get('taskDefinition'),dict):raise SourceUnavailable('document_definition_unavailable')
+    actual=copy.deepcopy(reply['taskDefinition'])
+    if (actual.pop('taskDefinitionArn',None)!=config['taskDefinitionArn']or
+        type(actual.get('revision'))is not int or actual.pop('revision')!=int(config['taskDefinitionArn'].rsplit(':',1)[1])or
+        actual.pop('status',None)!='ACTIVE'):
+        raise SourceUnavailable('document_definition_unavailable')
+    for field in ['registeredAt','registeredBy','compatibilities','requiresAttributes']:
+        actual.pop(field,None)
+    if actual.get('enableFaultInjection')is False:actual.pop('enableFaultInjection')
+    if not isinstance(actual.get('containerDefinitions'),list):raise SourceUnavailable('document_definition_unavailable')
+    for container in actual['containerDefinitions']:
+        if not isinstance(container,dict):raise SourceUnavailable('document_definition_unavailable')
+        if container.get('disableNetworking')is False:container.pop('disableNetworking')
+        if container.get('versionConsistency')=='enabled':container.pop('versionConsistency')
+    def canonical(value):
+        if isinstance(value,dict):return {key:canonical(item)for key,item in value.items()if item!=[]and item!={}}
+        if isinstance(value,list):return [canonical(item)for item in value]
+        return value
+    if json.dumps(canonical(actual),sort_keys=True)!=json.dumps(canonical(desired),sort_keys=True):raise SourceUnavailable('document_definition_unavailable')
+    return config['taskDefinitionArn']
+
+
+class EcsDocumentApi:
+    def __init__(self,region,*,client=None):
+        if not isinstance(region,str)or not re.fullmatch(r'[a-z]{2}-[a-z]+-[1-9]',region):raise ValueError('Use a reviewed commercial AWS region')
+        self.region,self.client=region,client;self._lock=threading.Lock()
+
+    def call(self,operation,**values):
+        allowed={'describe_task_definition','run_task','describe_tasks','list_tasks','stop_task'}
+        if operation not in allowed:raise ValueError('Use the owned document lifecycle')
+        try:
+            if self.client is None:
+                with self._lock:
+                    if self.client is None:
+                        import boto3
+                        from botocore.config import Config
+                        self.client=boto3.Session().client('ecs',region_name=self.region,
+                            endpoint_url='https://ecs.'+self.region+'.amazonaws.com',
+                            config=Config(proxies={},connect_timeout=2,read_timeout=8,retries={'total_max_attempts':1}))
+            value=getattr(self.client,operation)(**values)
+            if not isinstance(value,dict):raise ValueError()
+            return value
+        except Exception:raise SourceUnavailable('document_job_unavailable')from None
+
+
+class EcsDocuments:
+    def __init__(self,config,*,host_check=None,api=None,objects=None,ledger=None,deadline=140,poll_seconds=1):
+        self.config=MappingProxyType(configuration(config))
+        if host_check is None:host_check=EcsHostPolicy(dict(self.config))
+        if not callable(host_check):raise ValueError('Supply the owned dedicated-host verifier')
+        if type(deadline)is not int or not 1<=deadline<=140 or type(poll_seconds)not in {int,float}or not .01<=poll_seconds<=2:
+            raise ValueError('Use bounded document deadlines')
+        self.host_check=host_check;self.api=api or EcsDocumentApi(self.config['region'])
+        self.objects=objects or S3DocumentObjects(self.config['bucket'],self.config['region'],self.config['accountId'])
+        self.ledger=ledger;self.deadline,self.poll_seconds=deadline,poll_seconds
+        self.cluster=self.config['clusterArn'];self.prefix='arn:aws:ecs:'+self.config['region']+':'+self.config['accountId']+':'
+        self.target=hashlib.sha256(json.dumps({**{key:self.config[key]for key in ['accountId','region','bucket','clusterArn']},'taskFamily':task_family(self.config)},sort_keys=True,separators=(',',':')).encode()).hexdigest()
+
+    def __call__(self,raw,mime):raise SourceUnavailable('source_validation_required')
+
+    def bind_runtime(self,provider,environment):
+        if (provider!='aws'or environment.get('REGION')!=self.config['region']or
+            environment.get('AWS_ACCOUNT_ID')!=self.config['accountId']or environment.get('WORKER_ROLE_ARN')!=self.config['workerRoleArn']):
+            raise ValueError('Document execution must match the selected AWS destination and worker identity')
+
+    def attach_runtime(self,auth,account_id):
+        if self.ledger is None:self.ledger=DocumentJobLedger(auth,account_id,self.target)
+        elif (not isinstance(self.ledger,DocumentJobLedger)or self.ledger.auth is not auth or self.ledger.account_id!=account_id or self.ledger.target!=self.target):
+            raise ValueError('Use the owned persistent cleanup ledger')
+
+    def definition(self,arn):
+        if not isinstance(arn,str)or not re.fullmatch(re.escape(self.prefix+'task-definition/'+task_family(self.config)+':')+'[1-9][0-9]{0,8}',arn):
+            raise SourceUnavailable('document_job_unavailable')
+        return arn
+
+    def task(self,identifier,value,definition=None):
+        arn=value.get('taskArn');cluster_name=self.cluster.rsplit('/',1)[1]
+        if (not isinstance(arn,str)or not re.fullmatch(re.escape(self.prefix+'task/'+cluster_name+'/')+'[0-9a-f]{32}',arn)or
+            value.get('clusterArn')!=self.cluster or value.get('startedBy')!=identifier):raise SourceUnavailable('document_job_unavailable')
+        owned=self.definition(value.get('taskDefinitionArn'))
+        if definition is not None and owned!=definition:raise SourceUnavailable('document_job_unavailable')
+        return arn
+
+    def from_source(self,raw,mime,guard):
+        if not callable(guard):raise ValueError('Supply the live source/company/job check')
+        identifier=uuid.uuid4().hex+uuid.uuid4().hex;metadata=request(raw,mime,identifier)
+        guard()
+        if self.ledger is None:raise SourceUnavailable('document_job_recovery_required')
+        hosts=self.host_check(dict(self.config));guard()
+        if not isinstance(hosts,VerifiedHosts):raise SourceUnavailable('document_host_verification_required')
+        hosts.placement(dict(self.config))
+        definition=verify_definition(dict(self.config),self.api.call('describe_task_definition',taskDefinition=self.config['taskDefinitionArn']))
+        guard()
+        lease=self.ledger.allocate(identifier);known=None;started=time.monotonic()
+        def check():self.ledger.guard(lease);guard();self.ledger.guard(lease)
+        try:
+            check();condition=self.objects.put(identifier,'input',raw)
+            self.ledger.advance(lease,'job_pending');check()
+            launched=self.api.call('run_task',cluster=self.cluster,taskDefinition=definition,launchType='EC2',count=1,
+                clientToken=identifier,startedBy=identifier,enableExecuteCommand=False,enableECSManagedTags=False,
+                overrides=task_overrides(dict(self.config),metadata,condition),
+                placementConstraints=hosts.placement(dict(self.config)))
+            if launched.get('failures')or len(launched.get('tasks',[]))!=1:raise SourceUnavailable('document_job_unavailable')
+            known=self.task(identifier,launched['tasks'][0],definition);self.ledger.advance(lease,'job_running')
+            while True:
+                check()
+                if time.monotonic()-started>self.deadline:raise SourceUnavailable('document_job_unavailable')
+                observed=self.api.call('describe_tasks',cluster=self.cluster,tasks=[known])
+                if observed.get('failures')or len(observed.get('tasks',[]))!=1:raise SourceUnavailable('document_job_unavailable')
+                task=observed['tasks'][0]
+                if self.task(identifier,task,definition)!=known:raise SourceUnavailable('document_job_unavailable')
+                if task.get('lastStatus')=='STOPPED':
+                    if task.get('containerInstanceArn')not in {arn for arn,_ in hosts.members}:raise SourceUnavailable('document_host_verification_changed')
+                    containers=task.get('containers',[])
+                    if (len(containers)!=3 or {v.get('name')for v in containers}!={'download','parser','upload'}or
+                        any(v.get('lastStatus')!='STOPPED'or type(v.get('exitCode'))is not int or v['exitCode']!=0 for v in containers)):
+                        raise SourceUnavailable('document_job_unavailable')
+                    break
+                if task.get('lastStatus')not in {'PROVISIONING','PENDING','ACTIVATING','RUNNING','DEACTIVATING','STOPPING','DEPROVISIONING'}:
+                    raise SourceUnavailable('document_job_unavailable')
+                time.sleep(self.poll_seconds)
+            self.ledger.advance(lease,'succeeded');check()
+            value=result(raw,mime,identifier,self.objects.load(identifier,'result'));check();return value
+        finally:
+            cleanup=self.ledger.claim_owner(lease)
+            try:self.cleanup(identifier,known=known)
+            except BaseException:self.ledger.failed(cleanup);raise
+            else:self.ledger.completed(cleanup)
+
+    def listed(self,operation,key,*,_deadline=None,**values):
+        found=[];token=None;seen=set()
+        for _ in range(5):
+            if _deadline is not None and time.monotonic()>_deadline:raise SourceUnavailable('document_cleanup_unavailable')
+            reply=self.api.call(operation,**values,**({'nextToken':token}if token else{}))
+            items=reply.get(key)
+            if not isinstance(items,list)or any(not isinstance(v,str)for v in items):raise SourceUnavailable('document_cleanup_unavailable')
+            found.extend(items);token=reply.get('nextToken')
+            if token is None:return list(dict.fromkeys(found))
+            if not isinstance(token,str)or not 0<len(token)<=4096 or token in seen:break
+            seen.add(token)
+        raise SourceUnavailable('document_cleanup_unavailable')
+
+    def cleanup(self,identifier,*,known=None):
+        if not isinstance(identifier,str)or not re.fullmatch('[0-9a-f]{64}',identifier):raise ValueError('Use the owned cleanup identity')
+        tasks=[];failure=False;deadline=time.monotonic()+70
+        def call(operation,**values):
+            if time.monotonic()>deadline:raise SourceUnavailable('document_cleanup_unavailable')
+            return self.api.call(operation,**values)
+        try:
+            # AWS startedBy is the only filter permitted alongside cluster.
+            # Default RUNNING desired status also includes pending launches.
+            # Unknown terminal tasks are left to native task-volume cleanup;
+            # uncertain creation keeps its durable settlement/retry window.
+            tasks+=self.listed('list_tasks','taskArns',_deadline=deadline,cluster=self.cluster,startedBy=identifier,maxResults=100)
+            if known is not None:tasks.append(known)
+            tasks=list(dict.fromkeys(tasks))
+            if len(tasks)>10:raise SourceUnavailable('document_cleanup_unavailable')
+            for arn in tasks:
+                observed=call('describe_tasks',cluster=self.cluster,tasks=[arn])
+                if observed.get('failures')or len(observed.get('tasks',[]))!=1:raise SourceUnavailable('document_cleanup_unavailable')
+                value=observed['tasks'][0]
+                if self.task(identifier,value)!=arn:raise SourceUnavailable('document_cleanup_unavailable')
+                if value.get('lastStatus')!='STOPPED':
+                    call('stop_task',cluster=self.cluster,task=arn,reason='Owned document cleanup')
+                    started=time.monotonic()
+                    while True:
+                        reply=call('describe_tasks',cluster=self.cluster,tasks=[arn])
+                        if reply.get('failures')or len(reply.get('tasks',[]))!=1:raise SourceUnavailable('document_cleanup_unavailable')
+                        current=reply['tasks'][0]
+                        if self.task(identifier,current)!=arn:raise SourceUnavailable('document_cleanup_unavailable')
+                        if current.get('lastStatus')=='STOPPED':break
+                        if time.monotonic()-started>20:raise SourceUnavailable('document_cleanup_unavailable')
+                        time.sleep(self.poll_seconds)
+        except Exception:failure=True
+        # Even a native task cleanup failure still attempts both owned
+        # objects. Return no document text until the entire cleanup succeeds.
+        for side in ['input','result']:
+            try:self.objects.delete(identifier,side)
+            except Exception:failure=True
+        if failure:raise SourceUnavailable('document_cleanup_unavailable')
+
+    def reconcile(self,*,limit=5):
+        if self.ledger is None:raise SourceUnavailable('document_job_recovery_required')
+        if type(limit)is not int or not 1<=limit<=20:raise ValueError('Use bounded cleanup batches')
+        counts={'claimed':0,'retired':0,'settling':0,'failed':0}
+        for _ in range(limit):
+            lease=self.ledger.claim_due()
+            if lease is None:break
+            counts['claimed']+=1
+            try:self.cleanup(lease.request_id)
+            except Exception:self.ledger.failed(lease);counts['failed']+=1
+            else:
+                retired=self.ledger.completed(lease);counts['retired'if retired else'settling']+=1
+        return counts

package/src/runtime/enterprise_aws_objects.py

@@ -0,0 +1,93 @@
+"""Bounded, owner-checked temporary S3 document bytes, not a source connector."""
+import base64
+import hashlib
+import re
+import threading
+from enterprise_document_contract import MAX_INPUT
+from enterprise_document_job import MAX_ENVELOPE
+from enterprise_sources import SourceUnavailable
+
+
+def object_key(identifier,side):
+    if not isinstance(identifier,str)or not re.fullmatch('[0-9a-f]{64}',identifier)or side not in {'input','result'}:
+        raise ValueError('Use the owned per-file object identity')
+    return 'document-jobs/'+identifier+'/'+side
+
+
+def etag(value):
+    if not isinstance(value,str)or not re.fullmatch(r'"[0-9a-f]{32}(?:-[1-9][0-9]{0,4})?"',value):
+        raise SourceUnavailable('document_object_unavailable')
+    return value
+
+
+class S3DocumentObjects:
+    def __init__(self,bucket,region,account,*,client=None):
+        if (not isinstance(bucket,str)or not re.fullmatch('[a-z0-9][a-z0-9-]{1,61}[a-z0-9]',bucket)or
+            not isinstance(region,str)or not re.fullmatch(r'(?:af|ap|ca|eu|il|me|mx|sa|us)-(?:east|west|south|north|central|southeast|southwest|northeast|northwest)-[1-9]',region)or
+            not isinstance(account,str)or not re.fullmatch('[0-9]{12}',account)):
+            raise ValueError('Use an owned regional temporary bucket')
+        self.bucket,self.region,self.account=bucket,region,account
+        self.client=client;self._lock=threading.Lock()
+
+    def _client(self):
+        if self.client is None:
+            with self._lock:
+                if self.client is None:
+                    import boto3
+                    from botocore.config import Config
+                    self.client=boto3.Session().client('s3',region_name=self.region,
+                        endpoint_url='https://s3.'+self.region+'.amazonaws.com',
+                        config=Config(proxies={},connect_timeout=2,read_timeout=8,retries={'total_max_attempts':1},
+                                      s3={'addressing_style':'virtual'}))
+        return self.client
+
+    def owner(self):return {'Bucket':self.bucket,'ExpectedBucketOwner':self.account}
+
+    def preflight(self):
+        """No payload mutation if native placement or no-history policy changed."""
+        try:
+            client=self._client();where=client.get_bucket_location(**self.owner()).get('LocationConstraint')
+            region='us-east-1'if where is None else'eu-west-1'if where=='EU'else where
+            history=client.get_bucket_versioning(**self.owner())
+            if region!=self.region or history.get('Status')is not None or history.get('MFADelete')is not None:raise ValueError()
+        except Exception:raise SourceUnavailable('document_object_policy_unavailable')from None
+
+    def put(self,identifier,side,raw):
+        key=object_key(identifier,side);maximum=MAX_INPUT if side=='input'else MAX_ENVELOPE
+        if not isinstance(raw,bytes)or not 0<len(raw)<=maximum:raise ValueError('Use bounded owned document bytes')
+        self.preflight()
+        try:
+            value=self._client().put_object(**self.owner(),Key=key,Body=raw,IfNoneMatch='*',
+                ContentType='application/octet-stream',ServerSideEncryption='AES256',
+                ChecksumSHA256=base64.b64encode(hashlib.sha256(raw).digest()).decode())
+            if value.get('VersionId')not in {None,'null'}or value.get('ServerSideEncryption')!='AES256':raise ValueError()
+            return etag(value.get('ETag'))
+        except Exception:raise SourceUnavailable('document_object_unavailable')from None
+
+    def load(self,identifier,side,condition=None):
+        key=object_key(identifier,side);maximum=MAX_INPUT if side=='input'else MAX_ENVELOPE
+        extra={}if condition is None else {'IfMatch':etag(condition)}
+        self.preflight()
+        stream=None
+        try:
+            value=self._client().get_object(**self.owner(),Key=key,**extra);stream=value['Body']
+            if (value.get('VersionId')not in {None,'null'}or value.get('ServerSideEncryption')!='AES256'or
+                type(value.get('ContentLength'))is not int or not 0<value['ContentLength']<=maximum or
+                (condition is not None and value.get('ETag')!=condition)):raise ValueError()
+            raw=stream.read(maximum+1)
+            if not isinstance(raw,bytes)or len(raw)!=value['ContentLength']or not 0<len(raw)<=maximum:raise ValueError()
+            return raw
+        except Exception:raise SourceUnavailable('document_object_unavailable')from None
+        finally:
+            if stream is not None:
+                try:stream.close()
+                except Exception:raise SourceUnavailable('document_object_unavailable')from None
+
+    def delete(self,identifier,side):
+        key=object_key(identifier,side)
+        # Never treat a delete marker as erasure of retained object versions.
+        self.preflight()
+        try:
+            value=self._client().delete_object(**self.owner(),Key=key)
+            if value.get('DeleteMarker')or value.get('VersionId')not in {None,'null'}:raise ValueError()
+        except Exception:raise SourceUnavailable('document_cleanup_unavailable')from None