@atmem/architect 0.0.0-stage → 0.2.0

package/src/runtime/enterprise_azure_pool.py

@@ -0,0 +1,161 @@
+"""Owned Batch pool observation before source upload; never provisions a pool.
+
+The contract is separate from the fourteen-field job/host policy to avoid a
+bootstrap/hash cycle. Native installation, IAM/network resources and actual pool
+image compatibility still need infrastructure/artifact and account evidence.
+"""
+import copy
+import hashlib
+import json
+import re
+from enterprise_azure_jobs import configuration as job_configuration, fingerprint, typed_equal
+from enterprise_sources import SourceUnavailable
+
+
+def sha(value):
+    return hashlib.sha256(json.dumps(value, sort_keys=True, separators=(',', ':'), allow_nan=False).encode()).hexdigest()
+
+
+def configuration(value, job):
+    job = job_configuration(job)
+    fields = {'format', 'identityResourceId', 'subnetId', 'vmSize', 'imageReference',
+              'nodeAgentSkuId', 'startTaskSha256', 'dedicatedNodes', 'taskSlotsPerNode'}
+    if not isinstance(value, dict) or set(value) != fields or value['format'] != 'enterprise-azure-document-pool-v1':
+        raise ValueError('Use the exact owned Azure pool contract')
+    base = re.escape('/subscriptions/' + job['subscriptionId'] + '/resourceGroups/')
+    group = r'[A-Za-z0-9_().-]{1,90}'
+    name = r'[A-Za-z0-9_-]{1,80}'
+    patterns = {'identityResourceId': base + group + r'/providers/Microsoft.ManagedIdentity/userAssignedIdentities/' + name,
+                'subnetId': base + group + r'/providers/Microsoft.Network/virtualNetworks/' + name + '/subnets/' + name,
+                'vmSize': r'Standard_[A-Za-z0-9_]{2,64}', 'startTaskSha256': r'[0-9a-f]{64}',
+                'nodeAgentSkuId': r'batch\.node\.[a-z][a-z0-9 ._-]{1,64}'}
+    for key, pattern in patterns.items():
+        if not isinstance(value[key], str) or not re.fullmatch(pattern, value[key]):
+            raise ValueError('Invalid owned Azure pool placement or artifact contract')
+    image = value['imageReference']
+    if (not isinstance(image, dict) or set(image) != {'publisher', 'offer', 'sku', 'version'} or
+            not isinstance(image['publisher'], str) or not isinstance(image['offer'], str) or
+            (image['publisher'], image['offer']) not in {('microsoft-dsvm', 'ubuntu-hpc'), ('almalinux', '8-hpc-gen1'), ('almalinux', '8-hpc-gen2')} or
+            not isinstance(image['sku'], str) or not re.fullmatch('[a-zA-Z0-9_.-]{1,64}', image['sku']) or
+            not isinstance(image['version'], str) or not re.fullmatch(r'[0-9]{1,12}\.[0-9]{1,12}\.[0-9]{1,12}', image['version'])):
+        raise ValueError('Use a pinned reviewed container-compatible Linux image')
+    if (type(value['dedicatedNodes']) is not int or not 1 <= value['dedicatedNodes'] <= 100 or
+            type(value['taskSlotsPerNode']) is not int or not 1 <= value['taskSlotsPerNode'] <= 4):
+        raise ValueError('Use explicit bounded dedicated pool capacity')
+    return copy.deepcopy(value)
+
+
+def metadata(value):
+    if not isinstance(value, list): raise ValueError('Native ownership metadata is required')
+    result = {}
+    for item in value:
+        if (not isinstance(item, dict) or set(item) != {'name', 'value'} or not isinstance(item['name'], str) or
+                not isinstance(item['value'], str) or item['name'] in result):
+            raise ValueError('Ambiguous native pool ownership metadata')
+        result[item['name']] = item['value']
+    return result
+
+
+def image_matches(expected, observed):
+    if not isinstance(observed, dict): return False
+    allowed = set(expected) | {'exactVersion'}
+    return (not set(observed) - allowed and all(observed.get(k) == v for k, v in expected.items()) and
+            observed.get('exactVersion', expected['version']) == expected['version'])
+
+
+def verify_start_task(value, contract, job):
+    fields = {'commandLine', 'resourceFiles', 'userIdentity', 'maxTaskRetryCount', 'waitForSuccess'}
+    if (not isinstance(value, dict) or set(value) != fields or value['waitForSuccess'] is not True or
+            type(value['maxTaskRetryCount']) is not int or value['maxTaskRetryCount'] != 0 or
+            value['userIdentity'] != {'autoUser': {'scope': 'pool', 'elevationLevel': 'admin'}} or
+            not isinstance(value['commandLine'], str) or len(value['commandLine'].encode()) > 32768 or
+            not value['commandLine'].startswith('/usr/bin/python3 -I -c ') or
+            not isinstance(value['resourceFiles'], list) or not 1 <= len(value['resourceFiles']) <= 3 or
+            sha(value) != contract['startTaskSha256']):
+        raise ValueError('Owned native installation task changed')
+    for resource in value['resourceFiles']:
+        if (not isinstance(resource, dict) or set(resource) != {'httpUrl', 'filePath', 'fileMode', 'identityReference'} or
+                resource['identityReference'] != {'resourceId': contract['identityResourceId']} or
+                resource['fileMode'] != '0400' or not isinstance(resource['filePath'], str) or
+                not re.fullmatch(r'[a-z][a-z0-9-]{0,63}\.zip', resource['filePath']) or
+                not isinstance(resource['httpUrl'], str) or not re.fullmatch(
+                    re.escape('https://' + job['storageAccount'] + '.blob.core.windows.net/bootstrap/') + r'[0-9a-f]{64}\.zip', resource['httpUrl'])):
+            raise ValueError('Use only immutable owned-MI bootstrap packages')
+
+
+def verify_pool(job, contract, observed):
+    if (not isinstance(observed, dict) or observed.get('id') != job['poolId'] or observed.get('state') != 'active' or
+            observed.get('allocationState') != 'steady'):
+        raise ValueError('Owned native pool is not active')
+    if metadata(observed.get('metadata')) != {'atmem-document-policy': fingerprint(job), 'atmem-start-task-sha256': contract['startTaskSha256']}:
+        raise ValueError('Owned native pool policy changed')
+    exact = {'enableAutoScale': False, 'enableInterNodeCommunication': False, 'targetLowPriorityNodes': 0,
+             'currentLowPriorityNodes': 0, 'targetDedicatedNodes': contract['dedicatedNodes'],
+             'currentDedicatedNodes': contract['dedicatedNodes'], 'taskSlotsPerNode': contract['taskSlotsPerNode']}
+    if any(not typed_equal(value, observed.get(key)) for key, value in exact.items()) or observed.get('vmSize') != contract['vmSize']:
+        raise ValueError('Owned native pool scheduling or capacity changed')
+    for field in ['applicationPackageReferences', 'userAccounts', 'mountConfiguration', 'resizeErrors']:
+        if observed.get(field) not in [None, []]: raise ValueError('Unexpected shared pool input or resize error')
+    native_identity = observed.get('identity')
+    if not isinstance(native_identity, dict) or set(native_identity) != {'type', 'userAssignedIdentities'} or native_identity['type'] != 'UserAssigned':
+        raise ValueError('Use only the dedicated transfer identity on the node')
+    identities = native_identity['userAssignedIdentities']
+    if not isinstance(identities, list) or len(identities) != 1: raise ValueError('Do not expose other workload identities to the node')
+    identity = identities[0]
+    if (not isinstance(identity, dict) or set(identity) != {'resourceId', 'clientId', 'principalId'} or
+            not isinstance(identity['resourceId'], str) or identity['resourceId'].lower() != contract['identityResourceId'].lower() or
+            identity['clientId'] != job['transferClientId'] or not isinstance(identity['principalId'], str) or
+            not re.fullmatch(r'[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}', identity['principalId'])):
+        raise ValueError('Native pool managed identity changed')
+    network = observed.get('networkConfiguration')
+    if (not isinstance(network, dict) or not set(network) <= {'subnetId', 'publicIPAddressConfiguration', 'endpointConfiguration', 'enableAcceleratedNetworking'} or
+            network.get('subnetId', '').lower() != contract['subnetId'].lower() or
+            network.get('publicIPAddressConfiguration') != {'provision': 'nopublicipaddresses'} or
+            network.get('endpointConfiguration') not in [None, {'inboundNATPools': []}]):
+        raise ValueError('Use the exact same-subscription private subnet without public endpoints')
+    machine = observed.get('virtualMachineConfiguration')
+    if (not isinstance(machine, dict) or set(machine) != {'imageReference', 'nodeAgentSKUId', 'containerConfiguration', 'diskEncryptionConfiguration'} or
+            not image_matches(contract['imageReference'], machine['imageReference']) or machine['nodeAgentSKUId'] != contract['nodeAgentSkuId'] or
+            machine['diskEncryptionConfiguration'] != {'targets': ['osdisk', 'temporarydisk']}):
+        raise ValueError('Owned native image, agent SKU or disk encryption changed')
+    registry = job['parserImage'].split('/')[0]
+    expected = {'type': 'dockerCompatible', 'containerImageNames': [job['parserImage'], job['transferImage']],
+                'containerRegistries': [{'registryServer': registry, 'identityReference': {'resourceId': contract['identityResourceId']}}]}
+    if not typed_equal(expected, machine['containerConfiguration']):
+        raise ValueError('Use only the prefetched immutable images and dedicated registry identity')
+    verify_start_task(observed.get('startTask'), contract, job)
+    return True
+
+
+def verify_nodes(job, contract, response):
+    if (not isinstance(response, dict) or response.get('odata.nextLink') or response.get('@odata.nextLink') or
+            not isinstance(response.get('value'), list) or len(response['value']) != contract['dedicatedNodes']):
+        raise ValueError('Observe every node in the explicit dedicated pool')
+    identifiers = set()
+    for node in response['value']:
+        if (not isinstance(node, dict) or not isinstance(node.get('id'), str) or not re.fullmatch('[A-Za-z0-9_-]{1,128}', node['id']) or
+                node['id'] in identifiers or node.get('state') not in {'idle', 'running'} or node.get('schedulingState') != 'enabled' or
+                node.get('isDedicated') is not True or node.get('publicIPAddress') or node.get('publicIPv6Address') or node.get('errors') or
+                node.get('vmSize') != contract['vmSize']):
+            raise ValueError('Native dedicated node is not ready or private')
+        version = node.get('nodeAgentInfo', {}).get('version')
+        if not isinstance(version, str) or not re.fullmatch(r'[0-9]{1,4}\.[0-9]{1,4}\.[0-9]{1,4}', version) or tuple(map(int, version.split('.'))) <= (1, 11, 11):
+            raise ValueError('Native node agent must support explicit empty container mounts')
+        startup = node.get('startTaskInfo', {})
+        if (startup.get('state') != 'completed' or type(startup.get('exitCode')) is not int or startup['exitCode'] != 0 or
+                startup.get('result') != 'success' or startup.get('failureInfo') or
+                not image_matches(contract['imageReference'], node.get('virtualMachineInfo', {}).get('imageReference'))):
+            raise ValueError('Native node did not complete the pinned installation on the pinned image')
+        verify_start_task(node.get('startTask'), contract, job)
+        identifiers.add(node['id'])
+    return frozenset(identifiers)
+
+
+def preflight(job, contract, api):
+    job = job_configuration(job); contract = configuration(contract, job)
+    try:
+        api.account()
+        verify_pool(job, contract, api.pool())
+        return verify_nodes(job, contract, api.nodes())
+    except Exception:
+        raise SourceUnavailable('document_batch_pool_unavailable') from None

package/src/runtime/enterprise_azure_transfer.py

@@ -0,0 +1,122 @@
+"""Trusted Azure transfer stages; the untrusted parser never runs in this image."""
+import json
+import os
+from pathlib import Path
+import re
+import sys
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from enterprise_azure_objects import AzureDocumentObjects, etag
+from enterprise_document_contract import MAX_INPUT, MEDIA_TYPES, media_type
+from enterprise_document_job import MAX_ENVELOPE, read_file, request, result, unique
+from enterprise_sources import SourceUnavailable
+
+
+def metadata(encoded):
+    if not isinstance(encoded, str) or not 0 < len(encoded.encode()) <= 4096:
+        raise ValueError('Use bounded owned transfer metadata')
+    value = json.loads(encoded, object_pairs_hook=unique)
+    fields = {'format', 'subscriptionId', 'region', 'resourceGroup', 'storageAccount',
+              'container', 'transferClientId', 'request', 'inputETag'}
+    if not isinstance(value, dict) or set(value) != fields or value['format'] != 'enterprise-azure-document-transfer-v1':
+        raise ValueError('Use the exact Azure document transfer metadata')
+    # Constructing the native destination validates every identifier without
+    # acquiring a token or making an HTTP call. Close the unstarted session.
+    objects = document_objects(value)
+    objects.close()
+    expected = value['request']
+    if (not isinstance(expected, dict) or set(expected) != {'format', 'requestId', 'sha256', 'mediaType'} or
+            expected['format'] != 'enterprise-document-job-v1' or
+            not isinstance(expected['requestId'], str) or not re.fullmatch('[0-9a-f]{64}', expected['requestId']) or
+            not isinstance(expected['sha256'], str) or not re.fullmatch('[0-9a-f]{64}', expected['sha256']) or
+            media_type(expected['mediaType']) != expected['mediaType'] or
+            expected['mediaType'] not in MEDIA_TYPES | {'application/octet-stream'}):
+        raise ValueError('Use the exact supported byte-bound request')
+    try: etag(value['inputETag'])
+    except SourceUnavailable: raise ValueError('Use the acknowledged native input ETag') from None
+    return value
+
+
+def document_objects(value):
+    return AzureDocumentObjects(subscription=value['subscriptionId'], resource_group=value['resourceGroup'],
+        region=value['region'], account=value['storageAccount'], container=value['container'], client_id=value['transferClientId'])
+
+
+def directories(input_path, output_path):
+    source = target = None
+    try:
+        source = os.open(input_path, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+        target = os.open(output_path, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+        left, right = os.fstat(source), os.fstat(target)
+        if (left.st_dev, left.st_ino) == (right.st_dev, right.st_ino):
+            raise ValueError('Use distinct per-file volumes')
+        return source, target
+    except BaseException:
+        for fd in [target, source]:
+            if fd is not None: os.close(fd)
+        raise
+
+
+def download(value, objects, input_path='/input', output_path='/output'):
+    source, target = directories(input_path, output_path)
+    try:
+        if os.listdir(source) or os.listdir(target):
+            raise ValueError('Use fresh per-file volumes')
+        expected = value['request']
+        identifier = expected['requestId']
+        raw = objects.load(identifier, 'input', value['inputETag'])
+        if request(raw, expected['mediaType'], identifier) != expected:
+            raise ValueError('Input bytes changed')
+        for name, data in [('document', raw), ('request.json', json.dumps(expected, separators=(',', ':')).encode())]:
+            fd = os.open(name, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o444, dir_fd=source)
+            with os.fdopen(fd, 'wb') as stream:
+                stream.write(data)
+                stream.flush()
+                os.fsync(stream.fileno())
+                os.fchmod(stream.fileno(), 0o444)
+        # Batch maps a native non-admin UID. Fresh isolated output is writable
+        # by that UID; only its parser and the trusted collector receive mounts.
+        os.fchmod(source, 0o555)
+        os.fchmod(target, 0o777)
+        os.fsync(source)
+        os.fsync(target)
+    finally:
+        os.close(target)
+        os.close(source)
+
+
+def upload(value, objects, input_path='/input', output_path='/output'):
+    source, target = directories(input_path, output_path)
+    try:
+        expected = value['request']
+        identifier = expected['requestId']
+        raw = read_file(source, 'document', MAX_INPUT)
+        if request(raw, expected['mediaType'], identifier) != expected:
+            raise ValueError('Input binding changed')
+        encoded = read_file(target, 'result.json', MAX_ENVELOPE)
+        result(raw, expected['mediaType'], identifier, encoded)
+        objects.put(identifier, 'result', encoded)
+    finally:
+        os.close(target)
+        os.close(source)
+
+
+def main():
+    objects = None
+    try:
+        if len(sys.argv) != 2 or sys.argv[1] not in {'download', 'upload'}:
+            raise ValueError('Use the fixed Azure transfer stage')
+        value = metadata(os.environ.get('DOCUMENT_JOB', ''))
+        objects = document_objects(value)
+        if sys.argv[1] == 'download': download(value, objects)
+        else: upload(value, objects)
+    except Exception:
+        raise SystemExit('Owned Azure document transfer could not complete.') from None
+    finally:
+        if objects is not None:
+            try: objects.close()
+            except Exception:
+                raise SystemExit('Owned Azure document transfer could not complete.') from None
+
+
+if __name__ == '__main__':
+    main()

package/src/runtime/enterprise_configuration.py

@@ -0,0 +1,136 @@
+"""Owned private deployment metadata and native SQL identity dispatch.
+
+No connection, cloud request, user enrollment or schema mutation occurs on import.
+Metadata is packaged by the compiler/operator, never read from a chat request.
+"""
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+from urllib.parse import urlsplit
+from enterprise_identity import CompanyIdentity, trusted_https
+from enterprise_sources import GraphSharePoint, ConfluenceCloud
+from public_faq import object_pairs
+
+
+def deployment(value):
+    if (not isinstance(value, dict) or set(value) != {'format', 'provider', 'accountId', 'publicOrigin', 'company', 'sources', 'parserRevision'}
+        or value['format'] != 'enterprise-knowledge-v1' or value['provider'] not in {'aws', 'azure', 'gcp', 'ibm'}
+        or not isinstance(value['accountId'], str) or not re.fullmatch(r'[A-Za-z0-9_-]{1,128}', value['accountId'])
+        or not isinstance(value['parserRevision'], str) or not re.fullmatch(r'[0-9a-f]{64}', value['parserRevision'])):
+        raise ValueError('Invalid owned private deployment metadata')
+    origin = trusted_https(value['publicOrigin'])
+    if urlsplit(origin).path or origin.endswith('/'):
+        raise ValueError('Use the canonical owned HTTPS origin')
+    company = value['company']
+    if not isinstance(company, dict) or set(company) != {'issuer', 'audience', 'jwksUri', 'scope', 'web'}:
+        raise ValueError('Supply the existing company API and public OIDC registration')
+    identity = CompanyIdentity(value['accountId'], company['issuer'], company['audience'], company['jwksUri'], company['scope'])
+    from enterprise_web import company_configuration
+    company_configuration(identity, company['web'])
+    sources = value['sources']
+    if not isinstance(sources, dict) or set(sources) != {'sharepoint', 'confluence'}:
+        raise ValueError('Supply the existing SharePoint and Confluence registrations')
+    graph, confluence = sources['sharepoint'], sources['confluence']
+    if not isinstance(graph, dict) or set(graph) != {'tenantId', 'clientId', 'driveId', 'host'}:
+        raise ValueError('Invalid owned Graph registration')
+    if any(not isinstance(graph[key], str) or not re.fullmatch(r'[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}', graph[key]) for key in ['tenantId', 'clientId']):
+        raise ValueError('Use the owned Graph tenant and confidential client IDs')
+    if (not isinstance(confluence, dict) or set(confluence) != {'clientId', 'cloudId', 'host', 'spaces'}
+        or not isinstance(confluence['clientId'], str) or not re.fullmatch(r'[A-Za-z0-9_-]{1,200}', confluence['clientId'])):
+        raise ValueError('Invalid owned Confluence registration')
+    # Constructor validation is local only: no delegated access is used here.
+    GraphSharePoint(graph['driveId'], graph['host'], None)
+    ConfluenceCloud(confluence['cloudId'], confluence['host'], confluence['spaces'], None)
+    return json.loads(json.dumps(value, allow_nan=False))
+
+
+def read_owned_json(filename,direct,pointer,environment,*,path=None):
+    """Compiler/operator metadata only; no chat/request chooses a file or loader."""
+    if (direct in environment and pointer in environment)or(path is not None and any(key in environment for key in [direct,pointer])):
+        raise ValueError('Conflicting owned configuration sources')
+    if direct in environment:
+        value=environment[direct]
+        if not isinstance(value,str):raise ValueError('Use serialized owned configuration')
+        raw=value.encode('utf-8')
+    else:
+        if pointer in environment:
+            value=environment[pointer]
+            if not isinstance(value,str)or not Path(value).is_absolute():raise ValueError('Use an absolute owned configuration mount')
+            path=Path(value)
+        path=Path(path)if path is not None else Path(__file__).with_name(filename)
+        with path.open('rb')as stream:raw=stream.read(32769)
+    if not 0<len(raw)<=32768:raise ValueError('Owned configuration exceeds its byte boundary')
+    def constant(value):raise ValueError('Use finite owned JSON values')
+    return json.loads(raw,object_pairs_hook=object_pairs,parse_constant=constant)
+
+
+def read_deployment(path=None,*,environment=None):
+    environment=os.environ if environment is None else environment
+    return deployment(read_owned_json('enterprise-deployment.json','ENTERPRISE_DEPLOYMENT_JSON','ENTERPRISE_DEPLOYMENT_FILE',environment,path=path))
+
+
+def session_domain(metadata):
+    return hashlib.sha256(json.dumps({'account':metadata['accountId'],'origin':metadata['publicOrigin'],
+        'company':metadata['company'],'sources':metadata['sources'],'provider':metadata['provider']},sort_keys=True,separators=(',',':')).encode()).hexdigest()
+
+
+def native_database(provider, environment, role, secrets):
+    from workflow_connection import aws_database, azure_database, gcp_database, ibm_database
+    if role not in {'api', 'worker', 'migration'}:
+        raise ValueError('Use the owned native database role')
+    env = environment
+    common = {'database': env['DATABASE_NAME'], 'role': role}
+    if provider == 'gcp':
+        transport = env.get('DATABASE_TRANSPORT', 'cloudsql-socket')
+        if transport not in {'cloudsql-socket', 'cloudsql-private-proxy'}:
+            raise ValueError('Use the owned Cloud SQL transport')
+        return gcp_database(**common, connection_name=env['DATABASE_CONNECTION_NAME'],
+            service_account_email=env['DATABASE_SERVICE_ACCOUNT'], private_proxy=transport == 'cloudsql-private-proxy')
+    common.update(host=env['DATABASE_HOST'], user=env['DATABASE_USER'], ca_file=secrets.env['DATABASE_CA_FILE'])
+    if provider == 'aws': return aws_database(**common, region=env['REGION'])
+    if provider == 'azure': return azure_database(**common, managed_identity_client_id=env['WORKLOAD_IDENTITY_CLIENT_ID'])
+    if provider == 'ibm': return ibm_database(**common, port=int(env['DATABASE_PORT']), password=secrets.reader('database_password'))
+    raise ValueError('Unsupported owned database provider')
+
+
+def validate_runtime(auth, role, account_id):
+    if role not in {'api', 'worker'}: raise ValueError('Use a runtime database identity')
+    schemas = {'enterprise_auth': 'enterprise_auth_schema.sql', 'enterprise_queries': 'enterprise_queries_schema.sql',
+               'enterprise_audit': 'enterprise_audit_schema.sql'}
+    if role == 'worker':
+        schemas['enterprise_extractions'] = 'enterprise_extraction_schema.sql'
+        schemas['enterprise_document_jobs'] = 'enterprise_document_jobs_schema.sql'
+    with auth.transaction() as cursor:
+        row = cursor.execute('SELECT rolsuper,rolcreatedb,rolcreaterole,rolreplication,rolbypassrls FROM pg_roles WHERE rolname=current_user').fetchone()
+        if not row or any(row.values()): raise ValueError('Private runtime must use its nonadministrative database identity')
+        for schema, filename in schemas.items():
+            if cursor.execute('SELECT has_schema_privilege(current_user,%s,\'CREATE\') AS allowed', (schema,)).fetchone()['allowed']:
+                raise ValueError('Runtime must not own private application schemas')
+            # Identifiers come only from the fixed dictionary above.
+            current = cursor.execute('SELECT version,source_sha256 FROM ' + schema + '.schema_version').fetchone()
+            expected = hashlib.sha256(Path(__file__).with_name(filename).read_bytes()).hexdigest()
+            if current != {'version': 1, 'source_sha256': expected}:
+                raise ValueError('Private runtime schema differs; run the reviewed operator lifecycle')
+        queue = cursor.execute('SELECT queue_version FROM enterprise_queries.schema_version').fetchone()
+        if queue['queue_version'] != '3.10.0': raise ValueError('Private runtime queue version differs')
+        for table in ['enterprise_auth.memberships', 'enterprise_auth.source_mappings', 'enterprise_auth.company_bindings', 'enterprise_auth.schema_version']:
+            if cursor.execute('SELECT has_table_privilege(current_user,%s,\'INSERT,UPDATE,DELETE,TRUNCATE,TRIGGER,REFERENCES\') AS allowed', (table,)).fetchone()['allowed']:
+                raise ValueError('Runtime must not inherit company authority writes')
+        if cursor.execute("SELECT has_table_privilege(current_user,'enterprise_audit.events','SELECT,UPDATE,DELETE,TRUNCATE,TRIGGER,REFERENCES') AS allowed").fetchone()['allowed']:
+            raise ValueError('Runtime must use append-only audit authority')
+        if cursor.execute("SELECT has_table_privilege(current_user,'enterprise_auth.administration_events','SELECT,INSERT,UPDATE,DELETE,TRUNCATE,TRIGGER,REFERENCES') AS allowed").fetchone()['allowed']:
+            raise ValueError('Runtime must not inherit operator history authority')
+        if role == 'api' and cursor.execute("SELECT has_table_privilege(current_user,'enterprise_queries.procrastinate_jobs','UPDATE,DELETE,TRUNCATE') AS allowed").fetchone()['allowed']:
+            raise ValueError('API must not inherit worker queue mutation authority')
+        forbidden = 'SELECT,INSERT,UPDATE,DELETE,TRUNCATE,TRIGGER,REFERENCES' if role == 'api' else 'TRUNCATE,TRIGGER,REFERENCES'
+        table = cursor.execute("SELECT c.oid::bigint AS oid FROM pg_catalog.pg_class c JOIN pg_catalog.pg_namespace n ON n.oid=c.relnamespace WHERE n.nspname='enterprise_document_jobs'AND c.relname='jobs'AND c.relkind='r'").fetchone()
+        if not table:raise ValueError('Private document cleanup schema is missing')
+        # API deliberately has no schema USAGE. Resolve the object through the
+        # public system catalogue instead of broadening its application grants.
+        if cursor.execute("SELECT has_table_privilege(current_user,%s::oid,%s) AS allowed", (table['oid'],forbidden)).fetchone()['allowed']:
+            raise ValueError('Use only the owned worker cleanup metadata authority')
+        from enterprise_sources import SourceDenied
+        try:auth.require_company(cursor,account_id)
+        except SourceDenied:raise ValueError('Activate the owned company registration with the reviewed operator lifecycle')from None

package/src/runtime/enterprise_document.py

@@ -0,0 +1,116 @@
+"""General company-document decoding in a separate credentialless parser service.
+
+This module accepts bytes, never caller-selected URLs or parser configuration.
+The JVM/native tools must be contained by the deployment's network/resource sandbox;
+process deadlines alone are not isolation. Invoice PDF protocol is unchanged.
+"""
+import base64
+import hashlib
+import os
+from pathlib import Path
+import selectors
+import signal
+import subprocess
+import tempfile
+import time
+
+from enterprise_document_contract import MAX_INPUT, MAX_TEXT, MEDIA_TYPES, ExtractionError, media_type, document_result
+
+
+class CompanyDocument:
+    def __init__(self, *, java, classpath, pdf, timeout=30):
+        if not Path(java).is_absolute() or not Path(java).is_file():
+            raise ValueError('Supply the installed pinned Java executable')
+        if not isinstance(classpath, (list, tuple)) or not classpath or any(not Path(p).is_absolute() or not Path(p).exists() for p in classpath):
+            raise ValueError('Supply the fixed bridge and verified Tika classpath')
+        if not callable(getattr(pdf, 'extract', None)) or type(timeout) is not int or not 1 <= timeout <= 110:
+            raise ValueError('Supply the bounded native PDF extractor and timeout')
+        self.java = java
+        self.classpath = os.pathsep.join(str(p) for p in classpath)
+        self.pdf = pdf
+        self.timeout = timeout
+
+    def extract(self, raw, declared):
+        if not isinstance(raw, bytes) or not raw:
+            raise ExtractionError('invalid_document')
+        if len(raw) > MAX_INPUT:
+            raise ExtractionError('document_too_large')
+        declared = media_type(declared)
+        digest = hashlib.sha256(raw).hexdigest()
+        if raw.startswith(b'%PDF-'):
+            from invoice_document import DocumentError
+            try:
+                parsed = self.pdf.extract(raw, digest)
+            except DocumentError as failure:
+                raise ExtractionError('extraction_timeout' if failure.code == 'extraction_timeout' else 'extraction_failed') from None
+            pages = []
+            for page in parsed['pages']:
+                native, ocr = page['text'].strip(), page['ocr'].strip()
+                # Both channels matter for mixed text/image pages. Do not discard
+                # image-only facts because a page also has a native-text header.
+                body = native if native == ocr else '\n'.join(part for part in (native, ocr) if part)
+                pages.append(f"Page {page['number']}\n{body}")
+            detected, text = 'application/pdf', '\n\n'.join(pages)
+        else:
+            detected, text = self._tika(raw)
+        return document_result({'format': 'enterprise-document-v1', 'sha256': digest,
+                                'mediaType': detected, 'text': text}, raw, declared)
+
+    def _tika(self, raw):
+        with tempfile.TemporaryDirectory(prefix='atmem-company-document-') as temporary:
+            folder = Path(temporary)
+            source = folder / 'input'
+            source.write_bytes(raw)
+            source.chmod(0o600)
+            process = None
+            try:
+                # No JAVA_TOOL_OPTIONS, CLASSPATH, proxy, application or workload
+                # credentials enter the parser. Child tools share the outer group.
+                process = subprocess.Popen([self.java, '-Xmx256m', '-XX:ActiveProcessorCount=1',
+                    '-Djava.awt.headless=true', '-Djava.io.tmpdir=' + temporary,
+                    '-cp', self.classpath, 'EnterpriseDocument', str(source)],
+                    stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL,
+                    cwd=folder, start_new_session=True, env={'PATH': '/usr/local/bin:/usr/bin:/bin', 'HOME': temporary,
+                                    'TMPDIR': temporary, 'LANG': 'C.UTF-8', 'OMP_THREAD_LIMIT': '1',
+                                    'TESSDATA_PREFIX': '/usr/share/tesseract-ocr/5/tessdata'})
+                deadline = time.monotonic() + self.timeout
+                output = bytearray()
+                with selectors.DefaultSelector() as selector:
+                    os.set_blocking(process.stdout.fileno(), False)
+                    selector.register(process.stdout, selectors.EVENT_READ)
+                    while selector.get_map():
+                        remaining = deadline - time.monotonic()
+                        if remaining <= 0:
+                            raise ExtractionError('extraction_timeout')
+                        for key, _ in selector.select(min(remaining, .1)):
+                            chunk = os.read(key.fd, 8192)
+                            if not chunk:
+                                selector.unregister(key.fileobj)
+                            else:
+                                output.extend(chunk)
+                                if len(output) > 270000:
+                                    raise ExtractionError('extraction_failed')
+                try:
+                    code = process.wait(timeout=max(.01, deadline - time.monotonic()))
+                except subprocess.TimeoutExpired:
+                    raise ExtractionError('extraction_timeout') from None
+                lines = output.decode('ascii').splitlines()
+                if code == 2 and lines == ['rejected', 'unsupported_format']:
+                    raise ExtractionError('unsupported_format')
+                if code != 0 or len(lines) != 3 or lines[0] != 'ok':
+                    raise ExtractionError('extraction_failed')
+                return lines[1], base64.b64decode(lines[2], validate=True).decode('utf-8')
+            except ExtractionError:
+                raise
+            except Exception:
+                raise ExtractionError('extraction_unavailable') from None
+            finally:
+                if process is not None:
+                    # Kill the entire private group, including an OCR child that
+                    # outlived a failed/crashed JVM. Never leave document workers.
+                    try:
+                        os.killpg(process.pid, signal.SIGKILL)
+                    except ProcessLookupError:
+                        pass
+                    process.wait()
+                    process.stdout.close()

package/src/runtime/enterprise_document_cli.py

@@ -0,0 +1,32 @@
+"""Byte-only CLI used by the isolated document parser image."""
+import json
+from pathlib import Path
+import sys
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from enterprise_document import CompanyDocument, ExtractionError, MAX_INPUT
+from invoice_document import PdfDocument
+
+
+def installed_parser():
+    return CompanyDocument(java='/opt/java/bin/java',
+        classpath=['/app/tika-app.jar', '/app/document-bridge'], pdf=PdfDocument())
+
+
+if __name__ == '__main__':
+    if sys.argv[1:] == ['--job']:
+        from enterprise_document_job import execute
+        value, code = execute(installed_parser())
+        print(json.dumps(value, allow_nan=False))
+        raise SystemExit(code)
+    try:
+        if len(sys.argv) > 2:
+            raise ExtractionError('invalid_document')
+        raw = sys.stdin.buffer.read(MAX_INPUT + 1)
+        document = installed_parser().extract(raw, sys.argv[1] if len(sys.argv) == 2 else 'application/octet-stream')
+        value, code = {'status': 'ok', 'document': document}, 0
+    except ExtractionError as failure:
+        value, code = {'status': 'rejected', 'reason': failure.code}, 2
+    except Exception:
+        value, code = {'status': 'rejected', 'reason': 'extraction_unavailable'}, 2
+    print(json.dumps(value, ensure_ascii=False, allow_nan=False))
+    raise SystemExit(code)

package/src/runtime/enterprise_document_contract.py

@@ -0,0 +1,54 @@
+"""Byte-bound document protocol shared by app/cache and isolated parser.
+
+Standard-library validation only: no subprocess, native parser, URL or secrets.
+"""
+import hashlib
+import re
+
+MAX_INPUT = 10000000
+MAX_TEXT = 200000
+MEDIA_TYPES = frozenset({'application/pdf', 'text/plain', 'text/html', 'application/rtf',
+    'application/msword', 'application/vnd.ms-excel', 'application/vnd.ms-powerpoint',
+    'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    'application/vnd.oasis.opendocument.text', 'application/vnd.oasis.opendocument.spreadsheet',
+    'application/vnd.oasis.opendocument.presentation'})
+
+
+class ExtractionError(ValueError):
+    def __init__(self, code):
+        if code not in {'document_too_large', 'invalid_document', 'unsupported_format',
+                        'extraction_failed', 'extraction_timeout', 'extraction_unavailable', 'mime_mismatch'}:
+            raise ValueError('Unknown extraction failure')
+        self.code = code
+        super().__init__(code)
+
+
+def media_type(value):
+    if not isinstance(value, str) or len(value) > 200 or any(ord(c) < 32 for c in value):
+        raise ExtractionError('invalid_document')
+    result = value.split(';', 1)[0].strip().lower()
+    if not re.fullmatch(r'[a-z0-9.+-]+/[a-z0-9.+-]+', result):
+        raise ExtractionError('invalid_document')
+    return {'text/rtf': 'application/rtf', 'application/x-rtf': 'application/rtf'}.get(result, result)
+
+
+def document_result(value, raw, declared):
+    """Validate the entire byte-bound response at both sides of the RPC boundary."""
+    if not isinstance(raw, bytes) or not 0 < len(raw) <= MAX_INPUT:
+        raise ExtractionError('invalid_document')
+    if not isinstance(value, dict) or set(value) != {'format', 'sha256', 'mediaType', 'text'}:
+        raise ExtractionError('invalid_document')
+    if value['format'] != 'enterprise-document-v1' or value['sha256'] != hashlib.sha256(raw).hexdigest():
+        raise ExtractionError('invalid_document')
+    actual = media_type(value['mediaType'])
+    if actual not in MEDIA_TYPES or actual != value['mediaType']:
+        raise ExtractionError('unsupported_format')
+    expected = media_type(declared)
+    if actual != expected and expected != 'application/octet-stream':
+        raise ExtractionError('mime_mismatch')
+    text = value['text']
+    if not isinstance(text, str) or not text.strip() or len(text.encode('utf-8')) > MAX_TEXT or '\x00' in text:
+        raise ExtractionError('invalid_document')
+    return value