@atmem/architect 0.0.0-stage → 0.2.0

package/src/runtime/enterprise_operator.py

@@ -0,0 +1,160 @@
+"""Owned SQL bootstrap/enrollment/revocation; never an HTTP user operation.
+
+Existing company/source IDs come from the approved directory/IT handoff. Do not
+self-activate a source mapping by matching email strings or unverified JWT claims.
+No cloud identity, database, role, replacement key or source registration is created.
+"""
+from pathlib import Path
+import sys
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import hashlib
+import json
+import os
+from psycopg.rows import dict_row
+import psycopg
+from enterprise_configuration import deployment,read_deployment,native_database,session_domain
+from enterprise_auth_store import initialize_auth_store,grant_auth_runtime
+from enterprise_audit import initialize_audit,grant_audit_writer
+from enterprise_extraction_cache import initialize_extraction_cache,grant_extraction_runtime
+from enterprise_queries import initialize_query_store,grant_query_runtime
+from enterprise_document_jobs import initialize_document_jobs,grant_document_jobs_runtime
+from enterprise_secrets import SecretFiles
+from public_faq import object_pairs
+
+
+def initialize(conn,api_role,worker_role):
+    if conn.autocommit or not isinstance(api_role,str)or not isinstance(worker_role,str)or api_role==worker_role:
+        raise ValueError('Use an operator transaction and separate existing API/worker SQL identities')
+    with conn.transaction():
+        existing=conn.execute("SELECT count(*)FROM pg_namespace WHERE nspname IN('enterprise_auth','enterprise_queries','enterprise_extractions','enterprise_audit','enterprise_document_jobs')").fetchone()[0]
+        if existing:raise ValueError('Private schemas already exist; no adoption or implicit migration is permitted')
+        initialize_auth_store(conn);initialize_query_store(conn);initialize_extraction_cache(conn);initialize_audit(conn);initialize_document_jobs(conn)
+        grant_auth_runtime(conn,api_role);grant_query_runtime(conn,api_role);grant_audit_writer(conn,api_role)
+        grant_auth_runtime(conn,worker_role);grant_query_runtime(conn,worker_role,worker=True)
+        grant_extraction_runtime(conn,worker_role);grant_audit_writer(conn,worker_role);grant_document_jobs_runtime(conn,worker_role)
+
+
+def checked_identity(metadata,subject):
+    owned=deployment(metadata)
+    if not isinstance(subject,str)or not 1<=len(subject.encode('utf-8'))<=255 or any(ord(c)<32 for c in subject):
+        raise ValueError('Supply the existing verified company API subject from the approved directory handoff')
+    key=hashlib.sha256((owned['company']['issuer']+'\0'+subject).encode()).hexdigest()
+    return owned,key
+
+
+def require_schema(cursor):
+    for schema,filename in [('enterprise_auth','enterprise_auth_schema.sql'),('enterprise_queries','enterprise_queries_schema.sql')]:
+        observed=cursor.execute('SELECT version,source_sha256 FROM '+schema+'.schema_version').fetchone()
+        expected=hashlib.sha256(Path(__file__).with_name(filename).read_bytes()).hexdigest()
+        if observed!={'version':1,'source_sha256':expected}:raise ValueError('Operator schema differs; use the reviewed lifecycle')
+
+
+def journal(cursor,account,key,action,active,alias=None,version=None,registration_version=None,domain=None):
+    cursor.execute('INSERT INTO enterprise_auth.administration_events(account_id,principal_key,action,active,source_alias,mapping_version,registration_version,registration_domain)VALUES(%s,%s,%s,%s,%s,%s,%s,%s)',(account,key,action,active,alias,version,registration_version,domain))
+
+
+def cancel_requests(cursor,account,key=None):
+    suffix=' AND principal_key=%s'if key is not None else''
+    rows=cursor.execute("UPDATE enterprise_queries.requests SET state='cancelled',question_ciphertext=NULL,result_ciphertext=NULL,lease_token=NULL,lease_until=NULL,error_code=NULL,updated_at=clock_timestamp()WHERE account_id=%s AND state IN('queued','running','ready')"+suffix+' RETURNING id,principal_key,attempt',(account,key)if key is not None else(account,)).fetchall()
+    for row in rows:cursor.execute("INSERT INTO enterprise_queries.events(query_id,account_id,principal_key,event,attempt)VALUES(%s,%s,%s,'cancelled',%s)",(row['id'],account,row['principal_key'],row['attempt']))
+    return rows
+
+
+def activate(conn,metadata):
+    owned=deployment(metadata);account=owned['accountId'];domain=session_domain(owned)
+    if conn.autocommit:raise ValueError('Use an operator transaction')
+    with conn.transaction(),conn.cursor(row_factory=dict_row)as cursor:
+        require_schema(cursor)
+        cursor.execute('SELECT pg_advisory_xact_lock(hashtextextended(%s,0))',('enterprise-company:'+account,))
+        row=cursor.execute('SELECT session_domain,version FROM enterprise_auth.company_bindings WHERE account_id=%s FOR UPDATE',(account,)).fetchone()
+        if row and row['session_domain']==domain:return {'changed':False,'registrationVersion':row['version']}
+        version=row['version']+1 if row else 1
+        cursor.execute('INSERT INTO enterprise_auth.company_bindings(account_id,session_domain,version)VALUES(%s,%s,%s)ON CONFLICT(account_id)DO UPDATE SET session_domain=EXCLUDED.session_domain,version=EXCLUDED.version,actor=current_user,updated_at=clock_timestamp()',(account,domain,version))
+        cursor.execute('UPDATE enterprise_auth.sessions SET revoked_at=clock_timestamp()WHERE account_id=%s AND revoked_at IS NULL',(account,))
+        cursor.execute('DELETE FROM enterprise_auth.attempts WHERE account_id=%s',(account,))
+        cancel_requests(cursor,account)
+        journal(cursor,account,None,'company_registration_updated',True,registration_version=version,domain=domain)
+    return {'changed':True,'registrationVersion':version}
+
+
+def require_company(cursor,owned):
+    row=cursor.execute('SELECT session_domain FROM enterprise_auth.company_bindings WHERE account_id=%s FOR SHARE',(owned['accountId'],)).fetchone()
+    if not row or row['session_domain']!=session_domain(owned):raise ValueError('Activate the owned company registration before changing directory membership')
+
+
+def reset_source(cursor,account,key,source):
+    cursor.execute("UPDATE enterprise_auth.connections SET credential_ciphertext=NULL,status='revoked',revision=revision+1,updated_at=clock_timestamp()WHERE account_id=%s AND principal_key=%s AND source_id=%s",(account,key,source))
+    cursor.execute('DELETE FROM enterprise_auth.attempts WHERE account_id=%s AND principal_key=%s AND source_id=%s',(account,key,source))
+
+
+def enroll(conn,metadata,subject,mappings):
+    owned,key=checked_identity(metadata,subject)
+    if conn.autocommit or not isinstance(mappings,dict)or set(mappings)!={'sharepoint','confluence'}or any(not isinstance(v,str)or not 1<=len(v.encode('utf-8'))<=255 or any(ord(c)<32 for c in v)for v in mappings.values()):
+        raise ValueError('Supply both approved native source-account mappings in an operator transaction')
+    account=owned['accountId'];sources={'sharepoint':'sharepoint:'+owned['sources']['sharepoint']['driveId'],'confluence':'confluence:'+owned['sources']['confluence']['cloudId']}
+    with conn.transaction(),conn.cursor(row_factory=dict_row)as cursor:
+        require_schema(cursor)
+        require_company(cursor,owned)
+        cursor.execute('SELECT pg_advisory_xact_lock(hashtextextended(%s,0))',('enterprise-provision:'+account+':'+key,))
+        current=cursor.execute('SELECT issuer,subject,active FROM enterprise_auth.memberships WHERE account_id=%s AND principal_key=%s FOR UPDATE',(account,key)).fetchone()
+        if current and(current['issuer']!=owned['company']['issuer']or current['subject']!=subject):raise ValueError('Existing company identity binding differs')
+        if not current or not current['active']:
+            cursor.execute('INSERT INTO enterprise_auth.memberships(account_id,principal_key,issuer,subject,active)VALUES(%s,%s,%s,%s,true)ON CONFLICT(account_id,principal_key)DO UPDATE SET active=true',(account,key,owned['company']['issuer'],subject))
+            journal(cursor,account,key,'membership_enabled',True)
+        changed=0
+        for alias,source in sources.items():
+            old=cursor.execute('SELECT source_subject,version,active FROM enterprise_auth.source_mappings WHERE account_id=%s AND principal_key=%s AND source_id=%s FOR UPDATE',(account,key,source)).fetchone()
+            if old and old['active']and old['source_subject']==mappings[alias]:continue
+            version=old['version']+1 if old else 1
+            cursor.execute('INSERT INTO enterprise_auth.source_mappings(account_id,principal_key,source_id,source_subject,version,active)VALUES(%s,%s,%s,%s,%s,true)ON CONFLICT(account_id,principal_key,source_id)DO UPDATE SET source_subject=EXCLUDED.source_subject,version=EXCLUDED.version,active=true',(account,key,source,mappings[alias],version))
+            reset_source(cursor,account,key,source)
+            journal(cursor,account,key,'mapping_updated',True,alias,version);changed+=1
+    return {'principalKey':key,'active':True,'mappingsChanged':changed}
+
+
+def revoke(conn,metadata,subject):
+    owned,key=checked_identity(metadata,subject)
+    if conn.autocommit:raise ValueError('Use an operator transaction')
+    account=owned['accountId']
+    with conn.transaction(),conn.cursor(row_factory=dict_row)as cursor:
+        require_schema(cursor)
+        require_company(cursor,owned)
+        cursor.execute('SELECT pg_advisory_xact_lock(hashtextextended(%s,0))',('enterprise-provision:'+account+':'+key,))
+        member=cursor.execute('SELECT active FROM enterprise_auth.memberships WHERE account_id=%s AND principal_key=%s FOR UPDATE',(account,key)).fetchone()
+        if not member:return {'principalKey':key,'active':False,'changed':False}
+        cursor.execute('UPDATE enterprise_auth.memberships SET active=false WHERE account_id=%s AND principal_key=%s',(account,key))
+        mappings=cursor.execute('UPDATE enterprise_auth.source_mappings SET active=false,version=version+1 WHERE account_id=%s AND principal_key=%s AND active RETURNING source_id,version',(account,key)).fetchall()
+        sources={'sharepoint:'+owned['sources']['sharepoint']['driveId']:'sharepoint','confluence:'+owned['sources']['confluence']['cloudId']:'confluence'}
+        for row in mappings:
+            reset_source(cursor,account,key,row['source_id'])
+            if row['source_id']in sources:journal(cursor,account,key,'mapping_updated',False,sources[row['source_id']],row['version'])
+        # Also erase any older/inactive registration's remaining credential.
+        cursor.execute("UPDATE enterprise_auth.connections SET credential_ciphertext=NULL,status='revoked',revision=revision+1,updated_at=clock_timestamp()WHERE account_id=%s AND principal_key=%s AND(status<>'revoked'OR credential_ciphertext IS NOT NULL)",(account,key))
+        cursor.execute('UPDATE enterprise_auth.sessions SET revoked_at=clock_timestamp()WHERE account_id=%s AND principal_key=%s AND revoked_at IS NULL',(account,key))
+        cursor.execute('DELETE FROM enterprise_auth.attempts WHERE account_id=%s AND principal_key=%s',(account,key))
+        requests=cancel_requests(cursor,account,key)
+        if member['active']:journal(cursor,account,key,'membership_disabled',False)
+    return {'principalKey':key,'active':False,'changed':bool(member['active']or mappings or requests)}
+
+
+def main():
+    if sys.argv[1:]:raise SystemExit('Supply the owned operator command as private JSON on stdin')
+    raw=sys.stdin.buffer.read(32769)
+    if len(raw)>32768:raise ValueError('Operator command exceeds its boundary')
+    command=json.loads(raw,object_pairs_hook=object_pairs)
+    if not isinstance(command,dict):raise ValueError('Use an owned operator command')
+    mode=command.get('operation')
+    expected={'initialize':{'operation','apiRole','workerRole'},'activate':{'operation'},'enroll':{'operation','subject','mappings'},'revoke':{'operation','subject'}}
+    if mode not in expected or set(command)!=expected[mode]:raise ValueError('Invalid owned operator command')
+    owned=read_deployment()
+    with SecretFiles(owned['provider'],os.environ,'operator')as secrets:
+        database=native_database(owned['provider'],secrets.env,'migration',secrets)
+        with psycopg.connect(database(),connect_timeout=5)as conn,conn.transaction():
+            if mode=='initialize':initialize(conn,command['apiRole'],command['workerRole']);activate(conn,owned);result={'initialized':True}
+            elif mode=='activate':result=activate(conn,owned)
+            elif mode=='enroll':result=enroll(conn,owned,command['subject'],command['mappings'])
+            else:result=revoke(conn,owned,command['subject'])
+    print(json.dumps(result))
+
+
+if __name__=='__main__':main()

package/src/runtime/enterprise_parser_service.py

@@ -0,0 +1,136 @@
+"""Private byte-only company-document RPC; credentialless parser workload.
+
+Network admission, TLS and egress isolation are mandatory infrastructure controls.
+The service accepts no URL, model input, parser option or company/source identity.
+"""
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import json
+import os
+from pathlib import Path
+import socket
+import sys
+import threading
+import time
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from enterprise_document import ExtractionError, MAX_INPUT, media_type
+from enterprise_document_cli import installed_parser
+
+
+class DocumentServer(ThreadingHTTPServer):
+    daemon_threads = True
+    request_queue_size = 16
+
+    def __init__(self, address, parser, authorize):
+        if not callable(getattr(parser, 'extract', None)) or not callable(authorize):
+            raise ValueError('Supply the owned parser and explicit caller admission adapter')
+        self.parser, self.authorize = parser, authorize
+        self.slot = threading.BoundedSemaphore(1)
+        super().__init__(address, DocumentHandler)
+
+
+class DocumentHandler(BaseHTTPRequestHandler):
+    protocol_version = 'HTTP/1.0'
+
+    def log_message(self, *args):
+        pass
+
+    def setup(self):
+        super().setup()
+        self.connection.settimeout(5)
+
+    def reply(self, status, value):
+        body = json.dumps(value, ensure_ascii=False, allow_nan=False).encode()
+        self.send_response(status)
+        for key, value in [('Content-Type', 'application/json'), ('Content-Length', str(len(body))),
+                           ('Cache-Control', 'no-store'), ('X-Content-Type-Options', 'nosniff')]:
+            self.send_header(key, value)
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):
+        self.reply(200, {'status': 'running'}) if self.path == '/healthz' else self.reply(404, {'status': 'rejected'})
+
+    def do_POST(self):
+        if self.path != '/extract':
+            self.reply(404, {'status': 'rejected'})
+            return
+        try:
+            self.server.authorize(self.headers.get_all('Authorization') or [])
+        except Exception:
+            self.reply(403, {'status': 'rejected', 'reason': 'access_denied'})
+            return
+        lengths = self.headers.get_all('Content-Length') or []
+        types = self.headers.get_all('Content-Type') or []
+        if self.headers.get('Transfer-Encoding') or len(lengths) != 1 or not lengths[0].isascii() or not lengths[0].isdigit():
+            self.reply(411, {'status': 'rejected', 'reason': 'invalid_request'})
+            return
+        if len(lengths[0]) > 10 or not 1 <= int(lengths[0]) <= MAX_INPUT:
+            self.reply(413, {'status': 'rejected', 'reason': 'document_too_large'})
+            return
+        try:
+            if len(types) != 1:
+                raise ExtractionError('invalid_document')
+            declared = media_type(types[0])
+        except ExtractionError:
+            self.reply(415, {'status': 'rejected', 'reason': 'invalid_document'})
+            return
+        if not self.server.slot.acquire(blocking=False):
+            self.reply(429, {'status': 'rejected', 'reason': 'busy'})
+            return
+        try:
+            remaining, body, deadline = int(lengths[0]), bytearray(), time.monotonic() + 15
+            while remaining:
+                left = deadline - time.monotonic()
+                if left <= 0:
+                    raise TimeoutError()
+                self.connection.settimeout(min(5, left))
+                chunk = self.rfile.read1(min(remaining, 65536))
+                if not chunk:
+                    raise ValueError()
+                body.extend(chunk)
+                remaining -= len(chunk)
+            self.connection.settimeout(5)
+            document = self.server.parser.extract(bytes(body), declared)
+            self.reply(200, {'status': 'ok', 'document': document})
+        except ExtractionError as failure:
+            self.reply(422, {'status': 'rejected', 'reason': failure.code})
+        except (TimeoutError, socket.timeout):
+            self.reply(408, {'status': 'rejected', 'reason': 'upload_timeout'})
+        except ValueError:
+            self.reply(400, {'status': 'rejected', 'reason': 'invalid_request'})
+        except Exception:
+            self.reply(503, {'status': 'rejected', 'reason': 'extraction_unavailable'})
+        finally:
+            self.server.slot.release()
+
+
+def main():
+    forbidden = ['DATABASE_PASSWORD', 'DATABASE_PASSWORD_FILE', 'DATABASE_HOST', 'DATABASE_CONNECTION_NAME',
+        'DESTINATION_TOKEN_FILE', 'DESTINATION_ENDPOINT', 'GOOGLE_APPLICATION_CREDENTIALS', 'AWS_ACCESS_KEY_ID',
+        'AWS_SECRET_ACCESS_KEY', 'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI', 'AWS_CONTAINER_CREDENTIALS_FULL_URI',
+        'IDENTITY_ENDPOINT', 'IDENTITY_HEADER', 'MSI_ENDPOINT', 'MSI_SECRET', 'MSAL_CLIENT_SECRET', 'CONFLUENCE_CLIENT_SECRET']
+    if any(os.environ.get(key) for key in forbidden) or Path('/var/run/secrets/codeengine.cloud.ibm.com/compute-resource-token/token').exists():
+        raise ValueError('Do not supply source, database, model or workload credentials to the parser')
+    mode = os.environ.get('PARSER_AUTH_MODE', '')
+    if mode == 'shared-token':
+        from invoice_parser_identity import SharedParserVerifier
+        verify = SharedParserVerifier(os.environ.pop('PARSER_SHARED_TOKEN', ''))
+        def authorize(headers):
+            if len(headers) != 1 or not headers[0].startswith('Bearer '):
+                raise PermissionError()
+            verify(headers[0][7:])
+    elif mode == 'private-ingress':
+        # Explicitly selected only when the native hosting boundary authenticates
+        # and restricts callers. An arbitrary request header is never that proof.
+        def authorize(headers):
+            return None
+    else:
+        raise ValueError('Select explicit owned parser admission')
+    port = int(os.environ.get('PORT', '8080'))
+    if not 1024 <= port <= 65535:
+        raise ValueError('Use an owned nonprivileged parser port')
+    DocumentServer(('0.0.0.0', port), installed_parser(), authorize).serve_forever(poll_interval=.2)
+
+
+if __name__ == '__main__':
+    main()

package/src/runtime/enterprise_parser_transport.py

@@ -0,0 +1,68 @@
+"""Application-side fixed private HTTPS document parser adapter."""
+import json
+import time
+from urllib.parse import urlsplit
+import requests
+from enterprise_document_contract import MAX_INPUT, document_result, media_type
+from enterprise_sources import SourceUnavailable
+
+
+def unique_object(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError('Duplicate response field')
+        result[key] = value
+    return result
+
+
+class DocumentClient:
+    def __init__(self, endpoint, authorization, *, session=None):
+        try:
+            target = urlsplit(endpoint)
+            if (not isinstance(endpoint, str) or len(endpoint) > 2000 or target.scheme != 'https'
+                or not target.hostname or target.path != '/extract' or target.query or target.fragment
+                or target.username or target.password or (target.port is not None and not 1 <= target.port <= 65535)
+                or any(ord(c) < 33 or ord(c) > 126 for c in endpoint)):
+                raise ValueError()
+        except (TypeError, ValueError):
+            raise ValueError('Supply the fixed private HTTPS /extract endpoint') from None
+        if authorization is not None and not callable(authorization):
+            raise ValueError('Supply an owned workload admission adapter')
+        self.endpoint, self.authorization = endpoint, authorization
+        # No shared session mutation during parallel source extraction.
+        self.session = session
+
+    def __call__(self, raw, declared):
+        if not isinstance(raw, bytes) or not 0 < len(raw) <= MAX_INPUT:
+            raise SourceUnavailable('source_document_unsupported')
+        session = self.session or requests.Session()
+        session.trust_env = False
+        try:
+            headers = {'Content-Type': media_type(declared)}
+            if self.authorization is not None:
+                token = self.authorization()
+                if not isinstance(token, str) or not token.startswith('Bearer ') or not 8 <= len(token) <= 20000 or any(ord(c) < 33 or ord(c) > 126 for c in token[7:]):
+                    raise ValueError('Invalid caller admission')
+                headers['Authorization'] = token
+            deadline = time.monotonic() + 125
+            with session.post(self.endpoint, data=raw, headers=headers, timeout=(2, 115), allow_redirects=False, stream=True) as response:
+                if response.status_code != 200:
+                    raise SourceUnavailable('document_extraction_unavailable')
+                content = bytearray()
+                for chunk in response.iter_content(1):
+                    content.extend(chunk)
+                    if len(content) > 1201000 or time.monotonic() > deadline:
+                        raise ValueError('Unconfirmed extraction boundary')
+            value = json.loads(content, object_pairs_hook=unique_object,
+                parse_constant=lambda _: (_ for _ in ()).throw(ValueError('Nonfinite output')))
+            if not isinstance(value, dict) or set(value) != {'status', 'document'} or value['status'] != 'ok':
+                raise ValueError('Unconfirmed extraction result')
+            return document_result(value['document'], raw, declared)['text']
+        except SourceUnavailable:
+            raise
+        except Exception:
+            raise SourceUnavailable('document_extraction_unavailable') from None
+        finally:
+            if self.session is None:
+                session.close()

package/src/runtime/enterprise_queries.py

@@ -0,0 +1,255 @@
+"""Encrypted durable question jobs; PostgreSQL/Procrastinate, no private queue args.
+
+Raw browser cookies, JWTs, source credentials, questions and answers never enter
+queue arguments. Domain leases independently fence duplicate/stale workers. A
+ready result is only internal evidence until current native sources reauthorize it.
+"""
+from contextlib import contextmanager
+from dataclasses import dataclass,field
+import hashlib
+import json
+from pathlib import Path
+import re
+import uuid
+import procrastinate
+from procrastinate.schema import SchemaManager
+from psycopg import sql
+from enterprise_identity import CompanyPrincipal
+from enterprise_sessions import CompanySessions
+from enterprise_sources import query_text,SourceDenied,SourceUnavailable
+
+TASK='enterprise.answer.v1'
+QUEUE='enterprise-answer'
+
+def task_identity(account_id):
+    if not isinstance(account_id,str)or not re.fullmatch('[A-Za-z0-9_-]{1,128}',account_id):raise ValueError('Supply the owned company account')
+    suffix=hashlib.sha256(account_id.encode()).hexdigest()[:16]
+    return TASK+'.'+suffix,QUEUE+'-'+suffix
+
+
+class QueryMissing(LookupError):pass
+class QueryConflict(ValueError):pass
+class QueryLeaseLost(SourceUnavailable):pass
+
+
+def identifier(value):
+    if not isinstance(value,str)or str(uuid.UUID(value))!=value:raise ValueError('Use a canonical request identity')
+    return value
+
+
+@dataclass(frozen=True)
+class QueryLease:
+    id: str
+    token: str=field(repr=False)
+    principal: CompanyPrincipal=field(repr=False)
+    session_id: str=field(repr=False)
+    question: str=field(repr=False)
+    attempt: int
+
+
+class EnterpriseQueryStore:
+    def __init__(self,auth,task,account_id,*,lease_seconds=120,ttl_seconds=900,session_domain=None):
+        name,queue=task_identity(account_id)
+        if task.name!=name or task.queue!=queue or getattr(task,'queueing_lock',None)is not None:raise ValueError('Use the owned query task without a queueing lock')
+        if type(lease_seconds)is not int or not 15<=lease_seconds<=600 or type(ttl_seconds)is not int or not lease_seconds<=ttl_seconds<=3600:raise ValueError('Invalid owned query deadlines')
+        self.auth=auth;self.task=task;self.account_id=account_id;self.lease_seconds=lease_seconds;self.ttl_seconds=ttl_seconds;self.sessions=CompanySessions(auth,domain=session_domain)
+
+    @contextmanager
+    def transaction(self):
+        with self.auth.transaction()as cur:
+            cur.execute('SET LOCAL search_path=pg_catalog,enterprise_queries,pg_temp')
+            yield cur
+
+    def context(self,row,purpose):
+        result=['knowledge-query',purpose,row['account_id'],row['principal_key'],row['session_sha256'],str(row['id'])]
+        if purpose=='answer':result.append(row['attempt'])
+        return result
+
+    def _principal(self,cur,session_id):
+        if not isinstance(session_id,str)or not re.fullmatch('[0-9a-f]{64}',session_id):raise SourceDenied('company_identity_required')
+        row=cur.execute('SELECT s.account_id,s.principal_key,s.nonce_ciphertext,s.csrf_sha256,extract(epoch FROM s.expires_at)::bigint AS expires_at,m.issuer,m.subject FROM enterprise_auth.sessions s JOIN enterprise_auth.memberships m USING(account_id,principal_key)WHERE s.session_sha256=%s AND s.revoked_at IS NULL AND s.expires_at>clock_timestamp()',(session_id,)).fetchone()
+        if not row:raise SourceDenied('company_identity_required')
+        principal=CompanyPrincipal(row['account_id'],row['issuer'],row['subject'],row['expires_at'])
+        if principal.key!=row['principal_key']or principal.account_id!=self.account_id:raise SourceDenied('company_identity_required')
+        self.auth._authorize(cur,principal)
+        self.sessions.private(row,session_id)
+        return principal
+
+    def _owner(self,cur,session):
+        principal=self._principal(cur,session.id)
+        if principal.account_id!=session.principal.account_id or principal.key!=session.principal.key:raise SourceDenied('company_identity_required')
+        return principal
+
+    def _row(self,cur,identity):
+        identifier(identity)
+        return cur.execute('SELECT *,expires_at>clock_timestamp()AS current,lease_until>clock_timestamp()AS leased FROM enterprise_queries.requests WHERE id=%s AND account_id=%s FOR UPDATE',(identity,self.account_id)).fetchone()
+
+    def _event(self,cur,row,event):
+        cur.execute('INSERT INTO enterprise_queries.events(query_id,account_id,principal_key,event,attempt)VALUES(%s,%s,%s,%s,%s)',(row['id'],row['account_id'],row['principal_key'],event,row['attempt']))
+
+    def _end(self,cur,row,state,error=None):
+        cur.execute('UPDATE enterprise_queries.requests SET state=%s,error_code=%s,question_ciphertext=NULL,result_ciphertext=NULL,lease_token=NULL,lease_until=NULL,updated_at=clock_timestamp()WHERE id=%s',(state,error,row['id']))
+        self._event(cur,row,state)
+
+    def _enqueue(self,cur,identity,*,delay=0):
+        # No execution lock: domain leases fence duplicate notifications and allow
+        # a replacement to recover an expired lease while an old worker winds down.
+        scheduled=None
+        if delay:
+            scheduled=cur.execute('SELECT clock_timestamp()+make_interval(secs=>%s)AS at',(delay,)).fetchone()['at']
+        self.task.configure(connection=cur.connection,schedule_at=scheduled).defer(query_id=str(identity))
+
+    def submit(self,session,question,request_key):
+        question=query_text(question);identifier(request_key)
+        with self.transaction()as cur:
+            principal=self._owner(cur,session)
+            digest=self.auth.box.fingerprint(['question',principal.account_id,principal.key,session.id,request_key],question)
+            cur.execute('SELECT pg_advisory_xact_lock(hashtextextended(%s,0))',('knowledge-query:'+principal.account_id+':'+principal.key,))
+            existing=cur.execute('SELECT * FROM enterprise_queries.requests WHERE account_id=%s AND principal_key=%s AND session_sha256=%s AND request_key=%s FOR UPDATE',(principal.account_id,principal.key,session.id,request_key)).fetchone()
+            if existing:
+                if existing['question_mac']!=digest:raise QueryConflict('Request identity already refers to another question')
+                return str(existing['id'])
+            count=cur.execute("SELECT count(*)AS n FROM enterprise_queries.requests WHERE account_id=%s AND principal_key=%s AND state IN('queued','running')AND expires_at>clock_timestamp()",(principal.account_id,principal.key)).fetchone()['n']
+            if count>=3:raise SourceUnavailable('query_capacity_reached')
+            row={'id':str(uuid.uuid4()),'account_id':principal.account_id,'principal_key':principal.key,'session_sha256':session.id,'attempt':0}
+            encrypted=self.auth.box.seal(self.context(row,'question'),{'question':question})
+            cur.execute("INSERT INTO enterprise_queries.requests(id,account_id,principal_key,session_sha256,request_key,question_mac,question_ciphertext,state,expires_at)VALUES(%s,%s,%s,%s,%s,%s,%s,'queued',least(to_timestamp(%s),clock_timestamp()+make_interval(secs=>%s)))",(row['id'],principal.account_id,principal.key,session.id,request_key,digest,encrypted,principal.expires_at,self.ttl_seconds))
+            self._enqueue(cur,row['id']);self._event(cur,row,'submitted')
+            return row['id']
+
+    def get(self,session,identity):
+        with self.transaction()as cur:
+            principal=self._owner(cur,session);row=self._row(cur,identity)
+            if not row or row['account_id']!=principal.account_id or row['principal_key']!=principal.key or row['session_sha256']!=session.id:raise QueryMissing('Question unavailable')
+            if not row['current']and row['state']!='expired':
+                self._end(cur,row,'expired');row.update(state='expired',question_ciphertext=None,result_ciphertext=None)
+            return row
+
+    def cancel(self,session,identity):
+        with self.transaction()as cur:
+            principal=self._owner(cur,session);row=self._row(cur,identity)
+            if not row or row['account_id']!=principal.account_id or row['principal_key']!=principal.key or row['session_sha256']!=session.id:raise QueryMissing('Question unavailable')
+            if row['state']not in {'cancelled','expired'}:self._end(cur,row,'cancelled')
+
+    def pending(self,session):
+        with self.transaction()as cur:
+            principal=self._owner(cur,session)
+            rows=cur.execute("SELECT * FROM enterprise_queries.requests WHERE account_id=%s AND principal_key=%s AND session_sha256=%s AND state IN('queued','running','ready')AND expires_at>clock_timestamp()ORDER BY created_at DESC LIMIT 3",(principal.account_id,principal.key,session.id)).fetchall()
+            return [{'id':str(row['id']),'status':row['state'],'question':self.auth.box.open(self.context(row,'question'),row['question_ciphertext'])['question']}for row in reversed(rows)]
+
+    def claim(self,identity):
+        with self.transaction()as cur:
+            row=self._row(cur,identity)
+            if not row:return None
+            if not row['current']:
+                if row['state']!='expired':self._end(cur,row,'expired')
+                return None
+            if row['state']not in {'queued','running'}or(row['state']=='running'and row['leased']):return None
+            try:principal=self._principal(cur,row['session_sha256'])
+            except SourceDenied:
+                self._end(cur,row,'cancelled');return None
+            if principal.account_id!=row['account_id']or principal.key!=row['principal_key']:self._end(cur,row,'cancelled');return None
+            if row['attempt']>=3:self._end(cur,row,'failed','unavailable');return None
+            question=self.auth.box.open(self.context(row,'question'),row['question_ciphertext'])['question'];query_text(question)
+            if self.auth.box.fingerprint(['question',row['account_id'],row['principal_key'],row['session_sha256'],str(row['request_key'])],question)!=row['question_mac']:raise SourceDenied('query_binding_invalid')
+            token=str(uuid.uuid4());row['attempt']+=1
+            cur.execute("UPDATE enterprise_queries.requests SET state='running',attempt=%s,lease_token=%s,lease_until=least(expires_at,clock_timestamp()+make_interval(secs=>%s)),result_ciphertext=NULL,error_code=NULL,updated_at=clock_timestamp()WHERE id=%s",(row['attempt'],token,self.lease_seconds,identity))
+            self._event(cur,row,'claimed')
+            return QueryLease(identity,token,principal,row['session_sha256'],question,row['attempt'])
+
+    def _lease(self,cur,lease):
+        row=self._row(cur,lease.id)
+        if not row or row['state']!='running'or not row['current']or not row['leased']or str(row['lease_token'])!=lease.token or row['attempt']!=lease.attempt:raise QueryLeaseLost('Question worker lease changed')
+        principal=self._principal(cur,row['session_sha256'])
+        if principal.account_id!=lease.principal.account_id or principal.key!=lease.principal.key:raise SourceDenied('company_identity_required')
+        return row
+
+    def guard(self,lease,*,renew=False):
+        with self.transaction()as cur:
+            row=self._lease(cur,lease)
+            if renew:cur.execute('UPDATE enterprise_queries.requests SET lease_until=least(expires_at,clock_timestamp()+make_interval(secs=>%s))WHERE id=%s',(self.lease_seconds,row['id']))
+
+    def complete(self,lease,receipt):
+        if not isinstance(receipt,dict)or receipt.get('question')!=lease.question or len(json.dumps(receipt,ensure_ascii=False,allow_nan=False).encode())>500000:raise ValueError('Invalid owned answer receipt')
+        with self.transaction()as cur:
+            row=self._lease(cur,lease);cipher=self.auth.box.seal(self.context(row,'answer'),receipt)
+            cur.execute("UPDATE enterprise_queries.requests SET state='ready',result_ciphertext=%s,lease_token=NULL,lease_until=NULL,updated_at=clock_timestamp()WHERE id=%s",(cipher,row['id']));self._event(cur,row,'ready')
+
+    def failed(self,lease,code,*,retry=False):
+        if code not in {'source','setup','signin','unavailable','answer'}:raise ValueError('Use an owned public failure code')
+        with self.transaction()as cur:
+            row=self._row(cur,lease.id)
+            if not row or row['state']!='running'or str(row['lease_token'])!=lease.token or row['attempt']!=lease.attempt:return
+            if retry and row['current']and row['attempt']<3:
+                cur.execute("UPDATE enterprise_queries.requests SET state='queued',lease_token=NULL,lease_until=NULL,error_code=NULL,updated_at=clock_timestamp()WHERE id=%s",(row['id'],))
+                self._enqueue(cur,row['id'],delay=5*row['attempt']);self._event(cur,row,'retry_pending')
+            else:self._end(cur,row,'failed',code)
+
+    def open_result(self,row):
+        if row['state']!='ready':raise QueryConflict('Question is not ready')
+        return self.auth.box.open(self.context(row,'answer'),row['result_ciphertext'])
+
+    def released(self,session,identity,attempt):
+        with self.transaction()as cur:
+            principal=self._owner(cur,session);row=self._row(cur,identity)
+            if not row or row['account_id']!=principal.account_id or row['principal_key']!=principal.key or row['session_sha256']!=session.id:raise QueryMissing('Question unavailable')
+            if not row['current']or row['state']!='ready'or row['attempt']!=attempt:raise QueryLeaseLost('Question changed before release')
+            self._event(cur,row,'released')
+
+    def requeue(self,session,identity,attempt):
+        with self.transaction()as cur:
+            principal=self._owner(cur,session);row=self._row(cur,identity)
+            if not row or row['account_id']!=principal.account_id or row['principal_key']!=principal.key or row['session_sha256']!=session.id:raise QueryMissing('Question unavailable')
+            if row['state']!='ready'or row['attempt']!=attempt:return
+            if not row['current']or row['attempt']>=3:self._end(cur,row,'failed','answer');return
+            cur.execute("UPDATE enterprise_queries.requests SET state='queued',result_ciphertext=NULL,error_code=NULL,updated_at=clock_timestamp()WHERE id=%s",(identity,));self._enqueue(cur,identity);self._event(cur,row,'retry_pending')
+
+    def recover(self,limit=50):
+        if type(limit)is not int or not 1<=limit<=100:raise ValueError('Use a bounded recovery batch')
+        with self.transaction()as cur:
+            rows=cur.execute("SELECT r.*,expires_at>clock_timestamp()AS current FROM enterprise_queries.requests r WHERE account_id=%s AND((state!='expired'AND expires_at<clock_timestamp())OR(state='running'AND lease_until<clock_timestamp())OR(state='queued'AND NOT EXISTS(SELECT 1 FROM enterprise_queries.procrastinate_jobs j WHERE j.task_name=%s AND j.args->>'query_id'=r.id::text AND j.status IN('todo','doing'))))ORDER BY updated_at FOR UPDATE OF r SKIP LOCKED LIMIT %s",(self.account_id,self.task.name,limit)).fetchall()
+            for row in rows:
+                if not row['current']:self._end(cur,row,'expired')
+                elif row['attempt']>=3:self._end(cur,row,'failed','unavailable')
+                else:
+                    cur.execute("UPDATE enterprise_queries.requests SET state='queued',lease_token=NULL,lease_until=NULL,result_ciphertext=NULL,updated_at=clock_timestamp()WHERE id=%s",(row['id'],));self._enqueue(cur,row['id']);self._event(cur,row,'retry_pending')
+            return len(rows)
+
+
+def producer_queries(auth,dsn,account_id,*,session_domain=None):
+    app=procrastinate.App(connector=procrastinate.SyncPsycopgConnector(conninfo=dsn,kwargs={'connect_timeout':5,'options':'-c search_path=pg_catalog,enterprise_queries,pg_temp'}))
+    def worker_only(query_id):raise RuntimeError('Run the owned dedicated query worker')
+    name,queue=task_identity(account_id)
+    task=app.task(name=name,queue=queue)(worker_only)
+    return EnterpriseQueryStore(auth,task,account_id,session_domain=session_domain)
+
+
+def initialize_query_store(conn):
+    if procrastinate.__version__!='3.10.0' or conn.autocommit:raise ValueError('Use the reviewed queue version and an operator transaction')
+    body=Path(__file__).with_name('enterprise_queries_schema.sql').read_bytes()
+    conn.execute('CREATE SCHEMA enterprise_queries');conn.execute('SET LOCAL search_path=enterprise_queries,pg_catalog')
+    conn.execute(SchemaManager.get_schema());conn.execute(body.decode())
+    conn.execute('INSERT INTO enterprise_queries.schema_version VALUES(1,%s,%s)',(hashlib.sha256(body).hexdigest(),procrastinate.__version__))
+    for objects in ['TABLES','SEQUENCES','FUNCTIONS']:conn.execute('REVOKE ALL ON ALL '+objects+' IN SCHEMA enterprise_queries FROM PUBLIC')
+    conn.execute('REVOKE ALL ON SCHEMA enterprise_queries FROM PUBLIC')
+
+
+def grant_query_runtime(conn,role,*,worker=False):
+    if conn.autocommit or not isinstance(role,str)or not re.fullmatch('[A-Za-z0-9_.@-]{1,63}',role)or type(worker)is not bool:raise ValueError('Use an owned runtime role and operator transaction')
+    expected=hashlib.sha256(Path(__file__).with_name('enterprise_queries_schema.sql').read_bytes()).hexdigest()
+    if conn.execute('SELECT version,source_sha256,queue_version FROM enterprise_queries.schema_version').fetchone()!=(1,expected,'3.10.0'):raise ValueError('Review the exact fresh query schema before granting access')
+    flags=conn.execute('SELECT rolsuper,rolcreatedb,rolcreaterole,rolreplication,rolbypassrls,rolcanlogin FROM pg_roles WHERE rolname=%s',(role,)).fetchone()
+    if not flags or any(flags[:5])or not flags[5]or conn.execute("SELECT has_schema_privilege(%s,'enterprise_queries','CREATE')",(role,)).fetchone()[0]:raise ValueError('Use a nonadministrative role that does not own the query schema')
+    for table in ['memberships','source_mappings','company_bindings','schema_version']:
+        if conn.execute('SELECT has_table_privilege(%s,%s,%s)',(role,'enterprise_auth.'+table,'INSERT,UPDATE,DELETE,TRUNCATE,TRIGGER,REFERENCES')).fetchone()[0]:raise ValueError('Question runtime must not inherit authority-table write privileges')
+    target=sql.Identifier(role)
+    conn.execute(sql.SQL('GRANT USAGE ON SCHEMA enterprise_queries TO {}').format(target))
+    conn.execute(sql.SQL('GRANT SELECT ON enterprise_queries.schema_version TO {}').format(target))
+    conn.execute(sql.SQL('GRANT SELECT,INSERT,UPDATE ON enterprise_queries.requests TO {}').format(target))
+    conn.execute(sql.SQL('GRANT INSERT ON enterprise_queries.events TO {}').format(target))
+    conn.execute(sql.SQL('GRANT USAGE,SELECT ON ALL SEQUENCES IN SCHEMA enterprise_queries TO {}').format(target))
+    conn.execute(sql.SQL('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA enterprise_queries TO {}').format(target))
+    conn.execute(sql.SQL('GRANT SELECT,INSERT ON enterprise_queries.procrastinate_jobs,enterprise_queries.procrastinate_events TO {}').format(target))
+    if worker:
+        for table in ['procrastinate_jobs','procrastinate_events','procrastinate_workers','procrastinate_periodic_defers']:
+            conn.execute(sql.SQL('GRANT SELECT,INSERT,UPDATE,DELETE ON enterprise_queries.{} TO {}').format(sql.Identifier(table),target))