@atmem/architect 0.0.0-stage → 0.2.0

package/server/contracts.py

@@ -0,0 +1,315 @@
+"""Strict contracts for the local agent boundary; no executable config accepted."""
+from typing import Literal, Annotated
+import re
+from pydantic import BaseModel, ConfigDict, Field, PrivateAttr, StrictBool, StrictFloat, StrictInt, StrictStr, field_validator, model_validator
+
+class Strict(BaseModel):
+    model_config=ConfigDict(extra='forbid')
+
+class Position(Strict):
+    x:float=Field(ge=-100000,le=100000,allow_inf_nan=False)
+    y:float=Field(ge=-100000,le=100000,allow_inf_nan=False)
+
+class OutputField(Strict):
+    name:StrictStr=Field(pattern=r'^[a-z][a-zA-Z0-9_]{0,39}$')
+    type:Literal['string','boolean','number']
+    description:StrictStr=Field(min_length=1,max_length=300)
+    values:list[StrictStr]|None=Field(default=None,min_length=1,max_length=30)
+    maxLength:StrictInt|None=Field(default=None,ge=1,le=4096)
+    @model_validator(mode='after')
+    def constraints(self):
+        if not self.description.strip():raise ValueError('Output field description is empty')
+        if self.values is not None and (self.type!='string' or len(set(self.values))!=len(self.values) or any(not v or len(v)>100 for v in self.values)):raise ValueError('Invalid string enumeration')
+        if self.maxLength is not None and self.type!='string':raise ValueError('Only strings have maxLength')
+        if self.values and any(len(v)>(self.maxLength or 4096) for v in self.values):raise ValueError('Enumeration values exceed the field length limit')
+        return self
+
+class OutputContract(Strict):
+    instruction:StrictStr=Field(min_length=1,max_length=2000)
+    fields:list[OutputField]=Field(min_length=1,max_length=24)
+    @model_validator(mode='after')
+    def constraints(self):
+        if not self.instruction.strip():raise ValueError('Instruction is empty')
+        if len({f.name for f in self.fields})!=len(self.fields):raise ValueError('Duplicate output fields')
+        return self
+
+class Configuration(Strict):
+    maxPdfBytes:StrictInt|None=Field(default=None,ge=1,le=20000000)
+    maxPdfPages:StrictInt|None=Field(default=None,ge=1,le=1000)
+    retentionDays:StrictInt|None=Field(default=None,ge=1,le=3653)
+    outputContract:OutputContract|None=None
+    region:str=Field(default='To be selected',max_length=100,description='For a proposed cloud deployment, use only its canonical region code, such as ap-southeast-2, australiaeast, australia-southeast1 or au-syd. Put city names, proposed status and unverified availability in description/assumptions, never appended to this machine field. Use To be selected when genuinely unresolved.')
+    classification:Literal['Public','Internal','Confidential']='Internal'
+    timeout:int=Field(default=5000,ge=100,le=60000)
+    containerMemoryBytes:StrictInt|None=Field(default=None,ge=1,le=9007199254740991)
+    memoryMb:StrictInt|None=Field(default=None,ge=128,le=10240)
+    functionTimeoutSeconds:StrictInt|None=Field(default=None,ge=1,le=900)
+    concurrency:StrictInt|None=Field(default=None,ge=1,le=1000)
+    maxInputBytes:StrictInt|None=Field(default=None,ge=1,le=1000000)
+    maxOutputTokens:StrictInt|None=Field(default=None,ge=1,le=4096)
+    modelId:StrictStr|None=Field(default=None,max_length=150,pattern=r'^[a-z0-9][a-z0-9.-]*:[0-9]+$')
+    logRetentionDays:Literal[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1096,1827,2192,2557,2922,3288,3653]|None=None
+
+class Measure(Strict):
+    label:str=Field(min_length=1,max_length=150)
+    path:str=Field(pattern=r'^[A-Za-z_][A-Za-z0-9_.]{0,79}$')
+    op:Literal['>=','<=','==']
+    target:StrictBool|StrictInt|StrictFloat|StrictStr
+    @field_validator('target')
+    @classmethod
+    def short(cls,value):
+        if isinstance(value,str) and len(value)>100:raise ValueError('Target too long')
+        return value
+
+class Data(Strict):
+    label:str=Field(max_length=16000)
+    kind:Literal['source','predict','agent','guard','output','tool','resource','stream','history','features','train','registry','monitor','note']
+    provider:Literal['aws','azure','gcp','ibm','tools']
+    description:str=Field(default='',max_length=16000)
+    config:Configuration=Field(default_factory=Configuration)
+    inputPosition:Literal['left','right','top','bottom']='left'
+    outputPosition:Literal['left','right','top','bottom']='right'
+    origin:str=Field(default='proposed',max_length=100)
+    deploymentMode:Literal['reference','create']|None=None
+    poc:bool=False
+    role:Literal['data','ingest','index','llm','guard','human','app','output','model','monitor']|None=None
+    measures:list[Measure]|None=Field(default=None,max_length=10)
+    topologyGroup:str|None=Field(default=None,max_length=100)
+    service:str|None=Field(default=None,max_length=150)
+    category:str|None=Field(default=None,max_length=150)
+    binding:Literal['public-catalog-editor','cloud-storage-principal','aws-iam-principal','aws-bedrock-model','normalized-source-contract','web-browser','existing-service']|None=None
+    implementation:Literal['approval-workflow','invoice-workflow','public-faq-app','ibm-structured-app','gcp-structured-app','azure-structured-app','container-service','private-object-storage','rag-web-app','rag-user-pool','bounded-keyword-rag','iam-rag-api','bounded-rag-catalog','text-statistics','bedrock-summary','bedrock-structured','structured-api','structured-web-app','structured-user-pool','async-word-count','sqs-standard','sqs-dead-letter','word-count-results']|None=None
+
+    approvalProfile:dict|None=None
+
+    @field_validator('approvalProfile')
+    @classmethod
+    def approval_declaration(cls,value):
+        if value is None:return value
+        from src.runtime.workflow_bindings import application_declaration
+        return application_declaration(value).data
+
+    @model_validator(mode='after')
+    def named_component(self):
+        if self.approvalProfile is not None and (self.kind=='note' or self.binding or self.implementation!='approval-workflow' or self.provider!=self.approvalProfile['provider'] or self.origin!='proposed'):
+            raise ValueError('Approval profile requires its exact proposed provider/component contract; preserve existing ownership')
+        if self.config.containerMemoryBytes is not None and self.implementation!='container-service':raise ValueError('Exact container memory requires an explicit container-service contract')
+        if self.deploymentMode=='reference' and self.origin not in {'existing','imported Pulumi state'}:raise ValueError('Reference handling must preserve an existing system')
+        if self.binding and (self.origin not in {'existing','imported Pulumi state'} or self.deploymentMode=='create'):raise ValueError('Reference bindings identify existing systems and cannot provision a replacement')
+        if self.origin=='imported Pulumi state' and self.deploymentMode=='create':
+            raise ValueError('Imported cloud-state metadata identifies an existing deployment, not application source. Preserve its reference ownership; create a separate proposed deployment for new resources.')
+        if self.origin=='existing' and self.deploymentMode=='create' and (self.implementation!='container-service' or self.binding):
+            raise ValueError('Existing application source needs an explicit container-service contract without a reference binding.')
+        if self.kind != 'note' and len(self.label)>150:
+            raise ValueError('Architecture component names must have at most 150 characters.')
+        if self.kind != 'note' and not self.label.strip():
+            raise ValueError('Architecture components need a name; sticky notes may be empty.')
+        return self
+
+class Node(Strict):
+    id:str=Field(min_length=1,max_length=100)
+    type:Literal['resource']='resource'
+    position:Position
+    data:Data
+
+    @model_validator(mode='after')
+    def approval_owner(self):
+        if self.data.approvalProfile is not None and self.data.approvalProfile['componentId']!=self.id:raise ValueError('Approval profile component identity differs from its owner')
+        return self
+
+class Edge(Strict):
+    id:str=Field(min_length=1,max_length=150)
+    source:str=Field(max_length=100)
+    target:str=Field(max_length=100)
+    type:Literal['smoothstep']='smoothstep'
+    label:str=Field(default='data',max_length=150)
+    integration:Literal['approved-accounting-api','public-catalog-edit','browser-https','web-rag-api','oauth-pkce','jwt-authorizer','source-catalog-sync','http-api-lambda','lambda-catalog-read','bedrock-converse','s3-object-created','sqs-lambda','lambda-s3-read','lambda-dynamodb-write','sqs-redrive']|None=None
+    access:Literal['storage-object-admin','s3-read','s3-read-write','lambda-invoke','api-invoke']|None=None
+
+class Project(Strict):
+    version:Literal[1]=1
+    revision:int=Field(ge=1)
+    name:str=Field(min_length=1,max_length=200)
+    provider:Literal['aws','azure','gcp','ibm','tools']='tools'
+    domain:Literal['maintenance','churn']|None=None
+    requirements:str=Field(default='',max_length=64000)
+    nodes:list[Node]=Field(max_length=200)
+    edges:list[Edge]=Field(max_length=600)
+    @model_validator(mode='after')
+    def integrity(self):
+        ids=[n.id for n in self.nodes]
+        if len(ids)!=len(set(ids)):raise ValueError('Duplicate block IDs')
+        wires=[e.id for e in self.edges]
+        if len(wires)!=len(set(wires)):raise ValueError('Duplicate wire IDs')
+        if any(e.source not in ids or e.target not in ids or e.source==e.target for e in self.edges):raise ValueError('Invalid wire endpoint')
+        from src.runtime.workflow_bindings import application_declaration
+        nodes={n.id:n for n in self.nodes}
+        for node in self.nodes:
+            if node.data.approvalProfile is None:continue
+            declaration=application_declaration(node.data.approvalProfile)
+            for ref in getattr(declaration,'references',[]):
+                source=nodes.get(ref['componentId'])
+                if source is None or source.data.kind=='note' or source.data.provider!=ref['provider']:raise ValueError('Native output reference must retain its graph component/provider')
+        return self
+
+def validate_proposed_regions(project:Project):
+    """Repair producer output without rejecting historical incoming designs."""
+    patterns={'aws':r'([a-z]{2}-[a-z]+|us-gov-[a-z]+)-[0-9]{1,2}','azure':r'[a-z][a-z0-9]{1,39}','gcp':r'[a-z]+-[a-z]+[0-9]{1,2}','ibm':r'[a-z]{2}-[a-z]+'}
+    for node in project.nodes:
+        data=node.data
+        if data.implementation!='invoice-workflow'or data.origin in {'existing','imported Pulumi state'}or data.config.region=='To be selected':continue
+        if data.provider not in patterns or not re.fullmatch(patterns[data.provider],data.config.region):raise ValueError('Invoice config.region must be the canonical provider region code only (for example au-syd for IBM). Preserve proposed placement and unverified availability in description/assumptions; do not ask the user to repair this machine field.')
+
+class Proposal(Strict):
+    baseRevision:int=Field(ge=1)
+    title:str=Field(max_length=200)
+    body:str=Field(max_length=4000)
+    next:Project
+
+class ToolRequest(Strict):
+    name:Literal['memory.lookup','knowledge.lookup','project.read','skills.lookup','pricing.lookup','pricing.aws_s3']
+    query:str=Field(default='',max_length=500)
+
+class Scores(Strict):
+    cost:int=Field(ge=1,le=5)
+    risk:int=Field(ge=1,le=5)
+    scalability:int=Field(ge=1,le=5)
+    security:int=Field(ge=1,le=5)
+
+class OptionAssessment(Strict):
+    provider:Literal['current','aws','azure','gcp','ibm']
+    scores:Scores
+    rationale:str=Field(min_length=1,max_length=1000)
+
+class UsageUpdate(Strict):
+    key:Literal['requests_per_month','tokens_per_request','data_gb','endpoint_hours','events_per_month','training_hours']
+    value:float=Field(ge=0,le=1e12,allow_inf_nan=False)
+    sourceText:str=Field(min_length=1,max_length=500)
+
+class RequirementUpdate(Strict):
+    rationale:str=Field(default='',max_length=1000)
+    id:str=Field(min_length=1,max_length=60)
+    statement:str=Field(min_length=1,max_length=1000)
+    sourceText:str=Field(min_length=1,max_length=500)
+
+class RequirementTarget(Strict):
+    metric:str=Field(min_length=1,max_length=150)
+    op:Literal['>=','<=','==']
+    target:float=Field(allow_inf_nan=False)
+    unit:str=Field(default='',max_length=40)
+
+class RequirementDraft(Strict):
+    rationale:str=Field(default='',max_length=1000)
+    basis:str=Field(default='',max_length=1000)
+    id:str=Field(pattern=r'^ai-[A-Za-z0-9-]{1,55}$')
+    statement:str=Field(min_length=1,max_length=1000)
+    kind:Literal['functional','nonfunctional']
+    category:Literal['security','reliability','availability','scalability','performance','maintainability','cost','compliance','other']
+    priority:Literal['must','should','could']='should'
+    links:list[str]=Field(default_factory=list,max_length=50)
+    measure:RequirementTarget|None=None
+
+class DecisionUpdate(Strict):
+    subject:Literal['platform.cloud','cloud.region','data.country','infrastructure.tool']
+    value:str=Field(min_length=1,max_length=100)
+    sourceText:str=Field(min_length=1,max_length=500)
+
+class ComponentReviewResult(Strict):
+    componentId:str=Field(min_length=1,max_length=100)
+    summary:str=Field(min_length=1,max_length=2000)
+    questions:list[str]=Field(default_factory=list,max_length=6)
+    @field_validator('questions')
+    @classmethod
+    def bounded_questions(cls,values):
+        if any(not q.strip() or len(q)>1000 for q in values):
+            raise ValueError('Block questions must contain 1–1000 characters.')
+        return values
+
+class FollowUpQuestion(Strict):
+    question:str=Field(min_length=1,max_length=400)
+    why:str=Field(min_length=1,max_length=400)
+    example:str=Field(default='',max_length=400)
+    topic:Literal['application','users','data','systems','quality','cloud','budget']|None=None
+
+class NodeFieldUpdate(Strict):
+    id:StrictStr=Field(min_length=1,max_length=100)
+    field:Literal['label','description','kind','provider','service','role','origin','binding','implementation','deploymentMode','topologyGroup','config.maxPdfBytes','config.maxPdfPages','config.retentionDays','config.region','config.classification','config.maxInputBytes','config.maxOutputTokens','config.memoryMb','config.containerMemoryBytes','config.functionTimeoutSeconds','config.concurrency','config.logRetentionDays','config.modelId','config.outputContract']
+    value:StrictStr|StrictInt|StrictBool|OutputContract|None
+
+class EdgeFieldUpdate(Strict):
+    id:StrictStr=Field(min_length=1,max_length=150)
+    field:Literal['label','source','target','integration','access']
+    value:StrictStr|None
+
+class DesignPatch(Strict):
+    projectName:StrictStr|None=Field(default=None,min_length=1,max_length=200)
+    baseRevision:int=Field(ge=1)
+    title:str=Field(min_length=1,max_length=200)
+    body:str=Field(default='',max_length=4000)
+    addNodes:list[Node]=Field(default_factory=list,max_length=200)
+    nodeUpdates:list[NodeFieldUpdate]=Field(default_factory=list,max_length=600)
+    removeNodeIds:list[Annotated[StrictStr,Field(min_length=1,max_length=100)]]=Field(default_factory=list,max_length=200)
+    addEdges:list[Edge]=Field(default_factory=list,max_length=600)
+    edgeUpdates:list[EdgeFieldUpdate]=Field(default_factory=list,max_length=1200)
+    removeEdgeIds:list[Annotated[StrictStr,Field(min_length=1,max_length=150)]]=Field(default_factory=list,max_length=600)
+
+class ArchitectResponse(Strict):
+    _response_repair_attempts:int=PrivateAttr(default=0)
+    _model_response_encoding:str=PrivateAttr(default="full_response")
+    _model_response_json_bytes:int=PrivateAttr(default=0)
+    message:str=Field(min_length=1,max_length=16000)
+    patch:DesignPatch|None=None
+    componentReview:ComponentReviewResult|None=None
+    followUp:FollowUpQuestion|None=None
+    phase:Literal['Discovery','Architecture','Cost Analysis','Architecture Review']='Discovery'
+    proposal:Proposal|None=None
+    toolRequests:list[ToolRequest]|None=Field(default=None,max_length=3)
+    optionAssessment:list[OptionAssessment]|None=Field(default=None,max_length=5)
+    usageUpdates:list[UsageUpdate]|None=Field(default=None,max_length=6)
+    requirementDrafts:list[RequirementDraft]|None=Field(default=None,max_length=20)
+    requirementUpdates:list[RequirementUpdate]|None=Field(default=None,max_length=10)
+    decisionUpdates:list[DecisionUpdate]|None=Field(default=None,max_length=3)
+
+class Message(Strict):
+    role:Literal['user','assistant']
+    text:str=Field(max_length=12000)
+
+class ContextItem(Strict):
+    type:Literal['requirement','assumption','question','decision','discovery']
+    id:str=Field(min_length=1,max_length=60)
+    text:str=Field(max_length=1000)
+
+class Attachment(Strict):
+    name:str=Field(min_length=1,max_length=180,pattern=r'^[^/\\\x00-\x1f]+$')
+    mime:Literal['image/png','image/jpeg','image/webp','application/pdf','application/vnd.openxmlformats-officedocument.wordprocessingml.document','text/plain','text/markdown','text/csv','application/json']
+    data:str=Field(min_length=1,max_length=5592408)
+
+class ChatRequest(Strict):
+    activityId:str|None=Field(default=None,pattern=r'^[a-f0-9-]{36}$')
+    attachments:list[Attachment]=Field(default_factory=list,max_length=4)
+    origin:Literal['chat','canvas','workflow','document','preview','emulation','block-review']='chat'
+    projectId:str|None=Field(default=None,pattern=r'^[A-Za-z0-9-]{8,64}$')
+    message:str=Field(min_length=1,max_length=8000)
+    provider:Literal['claude-code','codex','copilot','gemini-cli','anthropic','openai','gemini-api','xai','bedrock']='claude-code'
+    model:str=Field(min_length=1,max_length=150)
+    effort:Literal['none','minimal','low','medium','high','xhigh','max','ultra']|None=None
+    project:Project
+    stage:Literal['discover','design','review','estimate','deploy','build']='discover'
+    context:list[ContextItem]=Field(default_factory=list,max_length=300)
+    history:list[Message]=Field(default_factory=list,max_length=16)
+    @field_validator('message','model')
+    @classmethod
+    def not_blank(cls,value):
+        if not value.strip():raise ValueError('Must not be blank')
+        return value
+
+
+def architect_output_schema(allow_tools=True):
+    """Compact model wire protocol; host still returns the established proposal API."""
+    schema=ArchitectResponse.model_json_schema()
+    schema['properties']['proposal']={'type':'null','description':'Full snapshots are host-owned. Use patch for design edits.'}
+    if not allow_tools:schema['properties']['toolRequests']={'type':'null','description':'Evidence lookup budget is exhausted. Return the bounded final response using available evidence.'}
+    else:schema['$defs']['ToolRequest']['properties']['name']['enum']=['memory.lookup','knowledge.lookup','pricing.lookup']
+    schema.get('$defs',{}).pop('Proposal',None)
+    schema.get('$defs',{}).pop('Project',None)
+    return schema

package/server/copilot_worker.py

@@ -0,0 +1,16 @@
+"""One isolated Copilot SDK request using the official installed CLI and native sign-in."""
+import asyncio, json, sys
+from copilot import CopilotClient, RuntimeConnection
+
+async def main():
+    config=json.load(sys.stdin)
+    async with CopilotClient(connection=RuntimeConnection.for_stdio(path=config['cli'],args=['--disable-builtin-mcps','--no-custom-instructions','--no-auto-update','--disable-client-telemetry']),working_directory=config['cwd'],use_logged_in_user=True,log_level='none') as client:
+        async with await client.create_session(model=None if config['model'] in ('auto','default') else config['model'],available_tools=[],tools=[],system_message={'mode':'replace','content':config['system']},skip_custom_instructions=True,enable_file_hooks=False,enable_skills=False,enable_config_discovery=False,enable_host_git_operations=False,enable_session_store=False,enable_session_telemetry=False,mcp_servers={},disabled_mcp_servers=['github-mcp-server','githubiq'],interactive_user=False) as session:
+            attachments=[{'type':'blob','data':i['data'],'mimeType':i['mime'],'displayName':i['name']} for i in config.get('images',[])]
+            result=await session.send_and_wait(config['prompt'],attachments=attachments or None,response_schema=config['schema'],timeout=130)
+            if not result:raise RuntimeError('No assistant response')
+            content=getattr(result.data,'content',None)
+            if not content:raise RuntimeError('No assistant content')
+            print(content)
+
+if __name__=='__main__':asyncio.run(main())

package/server/dependency_mirror.py

@@ -0,0 +1,54 @@
+"""Explicit public dependency artifacts, hashed without importing their code.
+
+No resolver, installer, URL fetch, account discovery or model-selected host path.
+The operator registers the directory/read boundary; generated projects own their
+dependency choices, portable builds and target qualification.
+"""
+import hashlib,json,os,re,stat
+from pathlib import Path
+from urllib.parse import urlsplit
+
+
+def _read(path,limit):
+    fd=os.open(path,os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK)
+    try:
+        info=os.fstat(fd)
+        if not stat.S_ISREG(info.st_mode) or info.st_nlink!=1 or info.st_size>limit:raise ValueError('Dependency mirror requires bounded unlinked regular files')
+        with os.fdopen(fd,'rb',closefd=False)as stream:
+            value=stream.read(limit+1)
+        if len(value)>limit:raise ValueError('Dependency mirror file exceeds its bound')
+        return value
+    finally:os.close(fd)
+
+
+def inspect_mirror(directory):
+    root=Path(directory)
+    if root.is_symlink() or not root.is_dir():raise ValueError('Use an operator-owned dependency mirror directory')
+    content=_read(root/'index.json',128000);index=json.loads(content)
+    if not isinstance(index,dict) or set(index)!={'format','version','artifacts'} or index['format']!='atmem.public-dependency-mirror' or type(index['version']) is not int or index['version']!=1 or not isinstance(index['artifacts'],list) or not 1<=len(index['artifacts'])<=64:raise ValueError('Unrecognized dependency catalog')
+    names=set();total=0
+    def text(value,limit=200):return isinstance(value,str) and bool(value) and len(value)<=limit and not any(ord(c)<32 for c in value)
+    for artifact in index['artifacts']:
+        if not isinstance(artifact,dict) or set(artifact)!={'file','sha256','bytes','name','version','kind','license','source','requiresPython','requiresDist'}:raise ValueError('Register complete bounded dependency metadata')
+        name=artifact['file']
+        if not isinstance(name,str) or not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9_.+-]{0,199}',name) or name=='index.json' or name in names:raise ValueError('Use unique flat dependency filenames')
+        names.add(name)
+        if not isinstance(artifact['sha256'],str) or not re.fullmatch(r'[a-f0-9]{64}',artifact['sha256']) or type(artifact['bytes']) is not int or not 0<artifact['bytes']<=32000000:raise ValueError('Dependency artifacts require bounded exact byte/digest pins')
+        for key in ['name','version','kind','license']:
+            if not text(artifact[key]):raise ValueError('Invalid dependency metadata')
+        if artifact['requiresPython'] is not None and not text(artifact['requiresPython']):raise ValueError('Invalid Python applicability')
+        if not isinstance(artifact['requiresDist'],list) or len(artifact['requiresDist'])>64 or any(not text(item,500) for item in artifact['requiresDist']):raise ValueError('Bound dependency requirements without truncation')
+        source=artifact['source']
+        if not isinstance(source,dict) or set(source)!={'url','metadataUrl','metadataSha256','retrievedAt'} or not isinstance(source['metadataSha256'],str) or not re.fullmatch(r'[a-f0-9]{64}',source['metadataSha256']):raise ValueError('Dependency source provenance is required')
+        from datetime import datetime
+        if not isinstance(source['retrievedAt'],str) or datetime.fromisoformat(source['retrievedAt']).tzinfo is None:raise ValueError('Source observation requires a timezone')
+        for key in ['url','metadataUrl']:
+            if not text(source[key],2000):raise ValueError('Invalid public dependency source URL')
+            url=urlsplit(source[key])
+            if url.scheme!='https' or not url.hostname or url.username or url.password or url.query or url.fragment:raise ValueError('Public source metadata cannot contain credentials, queries or fragments')
+        data=_read(root/name,32000000)
+        if len(data)!=artifact['bytes'] or hashlib.sha256(data).hexdigest()!=artifact['sha256']:raise ValueError('Dependency artifact differs from its registered bytes')
+        total+=len(data)
+        if total>64000000:raise ValueError('Dependency mirror exceeds its explicit total bound')
+    if set(os.listdir(root))!={'index.json',*names}:raise ValueError('Dependency mirror exposes undeclared entries')
+    return {'content':content,'sha256':hashlib.sha256(content).hexdigest(),'artifacts':len(names),'bytes':total}

package/server/design_patch.py

@@ -0,0 +1,43 @@
+"""Atomic, revision-bound model edits. No arbitrary JSON paths or requirements rewrite."""
+from .contracts import Project,Proposal
+
+def apply_design_patch(project,patch):
+    if patch.baseRevision!=project.revision:raise ValueError('Compact patch targets the wrong revision')
+    result=project.model_dump(exclude_none=True)
+    if patch.projectName is not None:result['name']=patch.projectName
+    nodes={n['id']:n for n in result['nodes']};edges={e['id']:e for e in result['edges']}
+    def remove(records,ids):
+        if len(ids)!=len(set(ids)):raise ValueError('Duplicate compact removal')
+        for id in ids:
+            if id not in records:raise ValueError('Compact removal targets an unknown ID: '+id)
+            del records[id]
+    remove(edges,patch.removeEdgeIds);remove(nodes,patch.removeNodeIds)
+    for node in patch.addNodes:
+        if node.id in nodes:raise ValueError('Compact add must not overwrite an existing component: '+node.id)
+        nodes[node.id]=node.model_dump(exclude_none=True)
+    for edge in patch.addEdges:
+        if edge.id in edges:raise ValueError('Compact add must not overwrite an existing connection: '+edge.id)
+        edges[edge.id]=edge.model_dump(exclude_none=True)
+    touched=set()
+    for update in patch.nodeUpdates:
+        if update.id not in nodes:raise ValueError('Compact update targets an unknown component: '+update.id)
+        key=('node',update.id,update.field)
+        if key in touched:raise ValueError('Duplicate compact field update')
+        touched.add(key);data=nodes[update.id]['data']
+        path=update.field.split('.')
+        if path[0]=='config':data=data.setdefault('config',{});field=path[1]
+        else:field=path[0]
+        value=update.value.model_dump(exclude_none=True) if hasattr(update.value,'model_dump') else update.value
+        if value is None:data.pop(field,None)
+        else:data[field]=value
+    for update in patch.edgeUpdates:
+        if update.id not in edges:raise ValueError('Compact update targets an unknown connection: '+update.id)
+        key=('edge',update.id,update.field)
+        if key in touched:raise ValueError('Duplicate compact field update')
+        touched.add(key)
+        if update.value is None:edges[update.id].pop(update.field,None)
+        else:edges[update.id][update.field]=update.value
+    result['nodes']=list(nodes.values());result['edges']=list(edges.values())
+    # Revalidate the whole candidate after all edits. Source project is never mutated.
+    candidate=Project.model_validate(result)
+    return Proposal(baseRevision=project.revision,title=patch.title,body=patch.body,next=candidate)

package/server/emulation-requirements.txt

@@ -0,0 +1,8 @@
+# Optional local worker additions; install after server/requirements.txt.
+moto[s3,sqs,dynamodb]==5.2.5
+docker==7.2.0
+MarkupSafe==3.0.4
+py-partiql-parser==0.6.3
+responses==0.26.3
+Werkzeug==3.1.9
+xmltodict==1.0.4

package/server/emulation_adapters.py

@@ -0,0 +1,20 @@
+"""Version-scoped repairs for observed emulator defects, never application bypasses."""
+from contextlib import contextmanager
+
+PATCH={'id':'moto-s3-notification-version-id-v1','motoVersion':'5.2.5','reason':'Moto drops versionId from S3 notifications although its exact event key retains version_id.','reference':'https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-content-structure.html','scope':'Add only the exact triggering key version; do not look up current/latest objects or alter generated handlers.'}
+
+@contextmanager
+def s3_version_notifications():
+    import moto
+    from moto.s3 import notifications
+    if moto.__version__!=PATCH['motoVersion']:raise RuntimeError('Unqualified Moto version; revalidate adapter before upgrading')
+    original=notifications._get_s3_event
+    def event_with_version(event_name,bucket,key,notification_id):
+        event=original(event_name,bucket,key,notification_id)
+        version=getattr(key,'version_id',None)
+        if version and version!='null':
+            for record in event['Records']:record['s3']['object'].setdefault('versionId',version)
+        return event
+    notifications._get_s3_event=event_with_version
+    try:yield PATCH
+    finally:notifications._get_s3_event=original

package/server/emulation_routes.py

@@ -0,0 +1,98 @@
+"""Provider-neutral emulation endpoint with a bounded local worker adapter.
+
+A hosted adapter must enforce its own tenant identity and container isolation;
+this local adapter is protected by the existing loopback session middleware.
+"""
+from datetime import datetime,timezone
+import asyncio
+import hashlib
+import importlib.util
+import json
+import os
+from pathlib import Path
+import shutil
+import signal
+import subprocess
+import sys
+import tempfile
+from fastapi import APIRouter,HTTPException
+from pydantic import BaseModel,ConfigDict
+from typing import Literal
+from .settings import setting
+
+ROOT=Path(__file__).resolve().parents[1]
+router=APIRouter()
+LOCK=asyncio.Lock()
+
+class EmulationRequest(BaseModel):
+    model_config=ConfigDict(extra='forbid')
+    project:dict
+    environment:Literal['staging','production']='staging'
+
+
+def emulate(payload):
+    if setting('EMULATION_ENABLED')=='0':
+        return {'version':1,'status':'unavailable','checks':[],'message':'Local emulation is disabled on this server.'}
+    declared_clouds={n.get('data',{}).get('provider') for n in payload.project.get('nodes',[]) if n.get('data',{}).get('implementation')=='private-object-storage'}
+    declared_faq=any(n.get('data',{}).get('implementation')=='public-faq-app' for n in payload.project.get('nodes',[]))
+    declared_structured=any((n.get('data',{}).get('provider'),n.get('data',{}).get('implementation')) in {('azure','azure-structured-app'),('gcp','gcp-structured-app'),('ibm','ibm-structured-app')} for n in payload.project.get('nodes',[]))
+    if not declared_faq and not declared_structured and not declared_clouds.intersection({'azure','gcp'}) and importlib.util.find_spec('moto') is None:
+        return {'version':1,'status':'unavailable','checks':[],'message':'The emulation worker is not installed on this server. Ask the server operator to enable the optional Moto backend.'}
+    node=shutil.which('node')
+    if not node:return {'version':1,'status':'unavailable','checks':[],'message':'The server-side generator is unavailable.'}
+    with tempfile.TemporaryDirectory(prefix='atmem-emulation-') as folder:
+        # No inherited SDK credentials, profiles, endpoint overrides, proxy or model keys.
+        env={'PATH':os.getenv('PATH',''),'HOME':folder,'TMPDIR':folder,'AWS_ACCESS_KEY_ID':'testing','AWS_SECRET_ACCESS_KEY':'testing','AWS_DEFAULT_REGION':'ap-southeast-2','AWS_EC2_METADATA_DISABLED':'true','AWS_CONFIG_FILE':str(Path(folder)/'no-config'),'AWS_SHARED_CREDENTIALS_FILE':str(Path(folder)/'no-credentials'),'PYTHONHASHSEED':'0'}
+        generated=subprocess.run([node,str(ROOT/'scripts/terraform-render.mjs')],input=json.dumps(payload.model_dump()),capture_output=True,text=True,cwd=ROOT,env=env,timeout=20)
+        if generated.returncode:raise ValueError('Invalid project for generation')
+        files=json.loads(generated.stdout)
+        digests={name:hashlib.sha256(content.encode()).hexdigest() for name,content in files.items()}
+        fingerprint=hashlib.sha256(json.dumps(digests,sort_keys=True,separators=(',',':')).encode()).hexdigest()
+        schedule=json.loads(files.get('resource-schedule.json','{}'))
+        cloud=schedule.get('provider')
+        faq=bool(schedule.get('publicFaqPlan',{}).get('entries'))
+        structured=bool(schedule.get('azureStructuredPlan',{}).get('entries') or schedule.get('gcpStructuredPlan',{}).get('entries') or schedule.get('ibmStructuredPlan',{}).get('entries'))
+        worker='public_faq_emulation_worker.py' if faq else 'structured_emulation_worker.py' if structured else 'storage_emulation_worker.py' if cloud in ('azure','gcp','ibm') else 'emulation_worker.py'
+        prerequisites={'azure':('azure.storage.blob',ROOT/'.local/cloud-emulators/node_modules/.bin/azurite-blob'),'gcp':('google.cloud.storage',ROOT/'.local/cloud-emulators/fake-gcs/fake-gcs-server')}
+        dependency='emulation_worker.py' if structured or faq else 'emulation_adapters.py'
+        worker_digest=hashlib.sha256((ROOT/'server'/worker).read_bytes()+(ROOT/'server'/dependency).read_bytes()).hexdigest()
+        metadata={'version':1,'generatedAt':datetime.now(timezone.utc).isoformat(),'workerDigest':worker_digest,'designRevision':payload.project.get('revision'),'environment':payload.environment,'artifactDigest':fingerprint,'fileDigests':digests,'cloudOperations':False,'terraformApply':'not_run'}
+        tf=json.loads(files['main.tf.json'])
+        if tf.get('locals',{}).get('unfinished_work'):
+            return {**metadata,'status':'blocked','checks':[],'message':'Resolve the generated implementation gaps before emulation.','blockers':tf['locals']['unfinished_work']}
+        if not faq and not structured and cloud in prerequisites:
+            module,binary=prerequisites[cloud]
+            try:installed=importlib.util.find_spec(module) is not None
+            except ModuleNotFoundError:installed=False
+            if not installed or not binary.is_file():return {**metadata,'status':'unavailable','checks':[],'message':f'The {cloud} storage emulator is not installed. Run the optional cloud emulator setup on the server.'}
+        for name,content in files.items():
+            relative=Path(name)
+            if relative.is_absolute() or '..' in relative.parts or '\\' in name or not isinstance(content,str):raise ValueError('Unsafe generated path')
+            target=Path(folder)/relative;target.parent.mkdir(parents=True,exist_ok=True);target.write_text(content)
+        # Kill the entire worker process group on timeout, including local API servers.
+        interpreter=sys.executable
+        if structured and schedule.get('ibmStructuredPlan',{}).get('entries'):
+            # IBM's current SDK/dateutil closure conflicts with the AWS SDK. Never
+            # mutate the server environment or pretend the omitted SDK test passed.
+            interpreter=setting('IBM_EMULATION_PYTHON') or str(ROOT/'.local/ibm-structured-runtime/bin/python')
+            if not Path(interpreter).is_file():return {**metadata,'status':'unavailable','checks':[],'message':'The isolated IBM Python 3.13 runtime is not installed. The server operator can run python3 scripts/setup-structured-runtime.py ibm.'}
+        process=subprocess.Popen([interpreter,'-I',str(ROOT/'server'/worker),folder],cwd=folder,env=env,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True,start_new_session=True)
+        try:stdout,stderr=process.communicate(timeout=90)
+        except subprocess.TimeoutExpired:
+            os.killpg(process.pid,signal.SIGKILL);process.communicate();raise
+        process.stdout=stdout
+
+        if len(process.stdout)>1_000_000:raise ValueError('Emulation result exceeds bound')
+        try:result=json.loads(process.stdout)
+        except json.JSONDecodeError:return {**metadata,'status':'failed','checks':[],'message':'The isolated worker failed without a valid report; no success was recorded.'}
+        if process.returncode and result.get('status')=='passed':raise ValueError('Worker exit contradicts report')
+        return {**result,**metadata,'completedAt':datetime.now(timezone.utc).isoformat(),'workspaceCleanup':'passed'}
+
+
+@router.post('/api/emulation/run')
+async def emulate_route(payload:EmulationRequest):
+    if LOCK.locked():raise HTTPException(409,'An emulation is already running. Try again after it finishes.')
+    async with LOCK:
+        try:return await asyncio.to_thread(emulate,payload)
+        except subprocess.TimeoutExpired:raise HTTPException(504,'Emulation timed out; the worker was stopped and no pass was recorded.')
+        except (ValueError,OSError):raise HTTPException(422,'The generated project could not be emulated. Review the design and worker installation.')