@atmem/architect 0.0.0-stage → 0.2.0

package/server/local_providers.py

@@ -0,0 +1,185 @@
+"""Supported local CLI account adapters. No account token extraction or custom OAuth."""
+import asyncio, base64, json, os, shutil, signal, sys, tempfile
+from pathlib import Path
+
+SIGN_IN={'claude-code':('claude','claude auth login'),'codex':('codex','codex login'),'gemini-cli':('gemini','gemini'),'copilot':('copilot','copilot login')}
+
+def cli_command(argv):
+    """Resolve PATHEXT shims explicitly; CreateProcess does not search .cmd names."""
+    return [shutil.which(argv[0]) or argv[0], *argv[1:]]
+
+def account_environment():
+    env=dict(os.environ)
+    for key in ['ANTHROPIC_API_KEY','ANTHROPIC_AUTH_TOKEN','OPENAI_API_KEY','CODEX_API_KEY','GEMINI_API_KEY','GOOGLE_API_KEY','GITHUB_TOKEN','GH_TOKEN','COPILOT_GITHUB_TOKEN']:
+        env.pop(key,None)
+    return env
+
+# Official sign-in, started from the app: each CLI opens its provider's own page in the browser.
+LOGIN={'claude-code':['claude','auth','login'],'codex':['codex','login'],'copilot':['copilot','login']}
+STATUS={'claude-code':['claude','auth','status','--json'],'codex':['codex','login','status']}
+LOGINS={}
+
+def signed_in(provider):
+    """True/False when the CLI can tell us, None when it can't."""
+    argv=STATUS.get(provider)
+    if not argv or not shutil.which(argv[0]):return None
+    import subprocess
+    try:
+        done=subprocess.run(cli_command(argv),capture_output=True,text=True,encoding='utf-8',errors='replace',timeout=8,stdin=subprocess.DEVNULL,env=account_environment())
+    except Exception:
+        return None
+    if provider=='claude-code':
+        try:return bool(json.loads(done.stdout).get('loggedIn'))
+        except Exception:return None
+    return done.returncode==0 and 'logged in' in (done.stdout+done.stderr).lower()
+
+def capabilities():
+    return {key:{'available':bool(shutil.which(binary)),'installed':bool(shutil.which(binary)),'loginCommand':command,'canSignInFromApp':key in LOGIN,
+                 'signedIn':signed_in(key) if shutil.which(binary) else False} for key,(binary,command) in SIGN_IN.items()}
+
+async def start_login(provider):
+    """Start the provider's official login; return a sign-in URL if the CLI prints one."""
+    import re
+    argv=LOGIN.get(provider)
+    if not argv or not shutil.which(argv[0]):raise RuntimeError('This provider has no sign-in AtMem AI Architect can start. Use its API key instead.')
+    running=LOGINS.get(provider)
+    if running and running.returncode is None:return {'started':True,'url':None}
+    process=await asyncio.create_subprocess_exec(*cli_command(argv),stdin=asyncio.subprocess.DEVNULL,stdout=asyncio.subprocess.PIPE,stderr=asyncio.subprocess.STDOUT,env=account_environment(),start_new_session=os.name!='nt')
+    LOGINS[provider]=process
+    url=None
+    try:
+        deadline=asyncio.get_running_loop().time()+6
+        while asyncio.get_running_loop().time()<deadline and url is None:
+            line=await asyncio.wait_for(process.stdout.readline(),timeout=max(.1,deadline-asyncio.get_running_loop().time()))
+            if not line:break
+            found=re.search(r'https://\S+',line.decode(errors='ignore'))
+            if found:url=found.group(0).rstrip('.,)')
+    except asyncio.TimeoutError:pass
+    # Keep draining output so the CLI can finish its callback; don't block the request.
+    async def drain():
+        try:
+            while await process.stdout.read(4096):pass
+        except Exception:pass
+    asyncio.create_task(drain())
+    return {'started':True,'url':url}
+
+def extract_json(text):
+    text=text.strip()
+    if text.startswith('```'):text='\n'.join(text.splitlines()[1:-1])
+    return json.loads(text)
+
+def strict_schema(schema):
+    """Codex structured output requires every declared object field to be required."""
+    schema=json.loads(json.dumps(schema))
+    def visit(value):
+        if isinstance(value,dict):
+            if value.get('type')=='object' and 'properties' in value:value['required']=list(value['properties']);value['additionalProperties']=False
+            for child in value.values():visit(child)
+        elif isinstance(value,list):
+            for child in value:visit(child)
+    visit(schema);return schema
+
+def provider_failure(output=b'',error=b''):
+    """Classify provider errors without exposing raw CLI output or account details."""
+    text=(output.decode(errors='replace') if isinstance(output,bytes) else str(output))+' '+(error.decode(errors='replace') if isinstance(error,bytes) else str(error))
+    text=text[:64000].lower()
+    if any(term in text for term in ['session limit','usage limit','hit your limit','rate limit','rate_limit','insufficient_quota','credit balance','too many requests']):
+        return 'The selected architect has reached its usage or rate limit. Wait for the provider reset or choose another connected architect. Your design is preserved; no correction was applied.'
+    if any(term in text for term in ['not logged in','authentication failed','invalid api key','unauthorized','login required']):
+        return 'The selected architect needs you to sign in again through its official client or update its API connection. Your design is preserved.'
+    if any(term in text for term in ['model not found','model_not_found','model is not available']):
+        return 'That model is not available to the selected account. Choose an accessible model in Connections. Your design is preserved.'
+    return 'Provider request failed. Check its official CLI sign-in, model access and usage limits. No changes were applied.'
+
+async def communicate(argv,prompt,cwd,is_disconnected,env=None,timeout=150):
+    process=await asyncio.create_subprocess_exec(*argv,stdin=asyncio.subprocess.PIPE,stdout=asyncio.subprocess.PIPE,stderr=asyncio.subprocess.PIPE,cwd=cwd,env=env,start_new_session=os.name!='nt')
+    task=asyncio.create_task(process.communicate(prompt.encode()))
+    deadline=asyncio.get_running_loop().time()+timeout
+    try:
+        while not task.done():
+            if await is_disconnected():raise asyncio.CancelledError()
+            if asyncio.get_running_loop().time()>deadline:raise TimeoutError('Architect request timed out.')
+            await asyncio.sleep(.2)
+        output,error=await task
+        if process.returncode:raise RuntimeError(provider_failure(output,error))
+        return output.decode()
+    finally:
+        if process.returncode is None:
+            try:
+                if os.name=='nt':process.terminate()
+                else:os.killpg(process.pid,signal.SIGTERM)
+            except ProcessLookupError:pass
+            try:await asyncio.wait_for(process.wait(),3)
+            except asyncio.TimeoutError:
+                try:
+                    if os.name=='nt':process.kill()
+                    else:os.killpg(process.pid,signal.SIGKILL)
+                except ProcessLookupError:pass
+                await process.wait()
+        if not task.done():task.cancel()
+        try:await task
+        except (asyncio.CancelledError,Exception):pass
+
+CLAUDE_EFFORTS=['low','medium','high','xhigh','max']
+# Claude Code accepts these model names; the list matches the current Claude family.
+CLAUDE_MODELS=[('claude-opus-5-5','Opus 5.5'),('claude-fable-5-1','Fable 5.1'),('claude-sonnet-5','Sonnet 5'),('claude-haiku-4-5-20251001','Haiku 4.5')]
+COPILOT_EFFORTS=['low','medium','high','xhigh','max']
+
+def models(provider):
+    """Models and thinking levels the provider's own CLI reports; empty list means type an ID."""
+    import subprocess
+    if provider=='claude-code':
+        return [{'id':i,'name':n,'efforts':CLAUDE_EFFORTS,'defaultEffort':'medium'} for i,n in CLAUDE_MODELS]
+    if provider=='codex' and shutil.which('codex'):
+        try:
+            done=subprocess.run(cli_command(['codex','debug','models']),capture_output=True,text=True,encoding='utf-8',errors='replace',timeout=15,stdin=subprocess.DEVNULL,env=account_environment())
+            data=json.loads(done.stdout)
+            return [{'id':m['slug'],'name':m.get('display_name',m['slug']),'efforts':[e['effort'] for e in m.get('supported_reasoning_levels',[])],'defaultEffort':m.get('default_reasoning_level')}
+                    for m in data.get('models',[]) if m.get('visibility','list')=='list']
+        except Exception:
+            return []
+    if provider=='gemini-cli' and shutil.which('gemini'):
+        return [{'id':'auto','name':'Gemini CLI (your configured model)','efforts':[],'defaultEffort':None}]
+    if provider=='copilot':
+        # The Copilot SDK path doesn't take a thinking level yet; offer only what we can honour.
+        return [{'id':'auto','name':'Auto (Copilot picks)','efforts':[],'defaultEffort':None}]
+    return []
+
+async def call_cli(provider,model,prompt,system,schema,is_disconnected,effort=None,images=None,timeout=150):
+    binary=shutil.which(SIGN_IN[provider][0])
+    if not binary:raise RuntimeError(f'Install and sign in with {SIGN_IN[provider][0]} first, or choose an API key.')
+    with tempfile.TemporaryDirectory(prefix='atforma-agent-') as cwd:
+        env=account_environment()
+        if provider=='claude-code':
+            args=[binary,'-p','--safe-mode','--strict-mcp-config','--tools','','--no-session-persistence','--output-format','json','--json-schema',json.dumps(schema),'--system-prompt',system]
+            if model not in ('default','auto'):args+=['--model',model]
+            if effort in CLAUDE_EFFORTS:args+=['--effort',effort]
+            if images:
+                args+=['--input-format','stream-json']
+                content=[{'type':'text','text':prompt}]+[{'type':'image','source':{'type':'base64','media_type':i['mime'],'data':i['data']}} for i in images]
+                prompt=json.dumps({'type':'user','message':{'role':'user','content':content}})+'\n'
+            result=json.loads(await communicate(args,prompt,cwd,is_disconnected,env,timeout=timeout))
+            if result.get('is_error'):raise RuntimeError(provider_failure(json.dumps(result)))
+            return result.get('structured_output') or extract_json(result.get('result',''))
+        if provider=='codex':
+            schema_path=Path(cwd)/'response-schema.json';schema_path.write_text(json.dumps(strict_schema(schema)))
+            args=[binary,'exec','--sandbox','read-only','--skip-git-repo-check','--ephemeral','--ignore-user-config','--ignore-rules','--disable','shell_tool','--disable','unified_exec','--disable','plugins','--disable','apps','--disable','browser_use','--disable','in_app_browser','--disable','code_mode_host','-c','approval_policy="never"','-c','web_search="disabled"','--output-schema',str(schema_path),'--color','never','-']
+            for index,item in enumerate(images or []):
+                image_path=Path(cwd)/f'attachment-{index}.{item["mime"].split("/")[1]}'
+                image_path.write_bytes(base64.b64decode(item['data']));image_path.chmod(0o600)
+                args+=['--image',str(image_path)]
+            if model not in ('default','auto'):args+=['--model',model]
+            if effort:args+=['-c',f'model_reasoning_effort="{effort}"']
+            return extract_json(await communicate(args,system+'\n\n'+prompt,cwd,is_disconnected,env,timeout=timeout))
+        if provider=='gemini-cli':
+            settings=Path(cwd)/'settings.json';settings.write_text(json.dumps({'tools':{'core':[]},'hooksConfig':{'enabled':False},'mcp':{'allowed':['atforma-no-servers']},'telemetry':{'enabled':False},'general':{'enableAutoUpdate':False,'sessionRetention':{'enabled':False}}}))
+            env['GEMINI_CLI_SYSTEM_SETTINGS_PATH']=str(settings)
+            policy=Path(cwd)/'deny-tools.toml';policy.write_text('[[rule]]\ntoolName = "*"\ndecision = "deny"\npriority = 999\n')
+            args=[binary,'--prompt',system,'--output-format','json','--approval-mode','plan','--extensions','none','--allowed-mcp-server-names','atforma-no-servers','--policy',str(policy)]
+            if model not in ('default','auto'):args+=['--model',model]
+            result=json.loads(await communicate(args,prompt,cwd,is_disconnected,env,timeout=timeout))
+            if result.get('error'):raise RuntimeError('Gemini request failed. Run gemini to sign in and check your model access.')
+            return extract_json(result.get('response',''))
+        # Official Copilot SDK provides tool exclusion and permission denial without --allow-all.
+        worker=Path(__file__).with_name('copilot_worker.py')
+        return extract_json(await communicate([sys.executable,str(worker)],json.dumps({'prompt':prompt,'system':system,'schema':strict_schema(schema),'model':model,'cwd':cwd,'cli':binary,'images':images or []}),cwd,is_disconnected,env,timeout=timeout))

package/server/local_validation.py

@@ -0,0 +1,236 @@
+"""Trusted controller for digest-bound local checks, outside the model worker.
+
+No public/raw-command endpoint. Operator-reviewed specs select cached immutable
+images and commands. Artifacts travel over stdin; no host directory/socket or
+credential is mounted. Container loopback works, external/host networking does not.
+This executes checks; requirement acceptance needs separately authored oracles.
+"""
+from dataclasses import dataclass
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import tempfile
+import threading
+import time
+import uuid
+
+
+# Only trusted bootstrap code runs with SETUID/SETGID. Untrusted source is copied as
+# root-owned read-only files, then all supplementary groups/root identity are dropped
+# before exec. Changing UID clears effective capabilities; no-new-privileges prevents
+# reacquisition. This policy requires native Linux-container qualification below.
+BOOTSTRAP = r'''
+import hashlib,io,json,os,pathlib,stat,sys,zipfile
+expected,command=json.loads(sys.argv[1])
+content=sys.stdin.buffer.read(64000001)
+if len(content)>64000000 or hashlib.sha256(content).hexdigest()!=expected:
+ raise RuntimeError('Immutable artifact digest/size mismatch')
+root=pathlib.Path('/work/source');root.mkdir()
+with zipfile.ZipFile(io.BytesIO(content)) as archive:
+ entries=archive.infolist()
+ if len(entries)>2000 or sum(e.file_size for e in entries)>64000000:
+  raise RuntimeError('Artifact bounds exceeded')
+ seen=set()
+ for entry in entries:
+  path=pathlib.PurePosixPath(entry.filename)
+  if path.is_absolute() or '..' in path.parts or '\\' in entry.filename or any(ord(c)<32 for c in entry.filename) or not path.parts or str(path) in seen:
+   raise RuntimeError('Unsafe or duplicate archive entry')
+  seen.add(str(path));mode=entry.external_attr>>16
+  if stat.S_IFMT(mode) not in (0,stat.S_IFREG,stat.S_IFDIR):
+   raise RuntimeError('Linked/special archive entry')
+  target=root.joinpath(*path.parts)
+  if entry.is_dir():target.mkdir(parents=True,exist_ok=True)
+  else:
+   target.parent.mkdir(parents=True,exist_ok=True)
+   target.write_bytes(archive.read(entry))
+   target.chmod(0o555 if mode & 0o111 else 0o444)
+ for directory in sorted((p for p in root.rglob('*') if p.is_dir()),reverse=True):directory.chmod(0o555)
+root.chmod(0o555)
+os.chdir(root)
+os.setgroups([]);os.setgid(65532);os.setuid(65532)
+if os.getuid()!=65532 or os.getgid()!=65532:raise RuntimeError('Validator identity was not dropped')
+os.execv(command[0],command)
+'''
+
+
+@dataclass(frozen=True)
+class ValidationSpec:
+    name: str
+    image: str
+    command: tuple[str, ...]
+    platform: str = 'linux/amd64'
+    timeout_seconds: int = 60
+    bootstrap_python: str = '/usr/local/bin/python3'
+    isolation_profile: str = 'standard-v1'
+    runtime_environment: tuple[tuple[str,str], ...] = ()
+    executable_scratch: bool = False
+
+    def __post_init__(self):
+        if not isinstance(self.name,str) or not re.fullmatch(r'[a-z][a-z0-9_-]{2,79}',self.name):raise ValueError('Invalid trusted validator name')
+        if not isinstance(self.image,str) or not re.fullmatch(r'sha256:[a-f0-9]{64}',self.image):raise ValueError('Use a cached immutable image ID')
+        if self.platform not in {'linux/amd64','linux/arm64'}:raise ValueError('Unqualified container platform')
+        if not isinstance(self.command,tuple) or not self.command or not all(isinstance(x,str) and x and '\0' not in x for x in self.command) or not self.command[0].startswith('/'):
+            raise ValueError('Register an explicit trusted validator executable/argument vector')
+        if type(self.timeout_seconds) is not int or not 1<=self.timeout_seconds<=300:raise ValueError('Validator time budget must be bounded')
+        if not isinstance(self.bootstrap_python,str) or not self.bootstrap_python.startswith('/') or '\0' in self.bootstrap_python:
+            raise ValueError('Register an absolute Python bootstrap executable in the reviewed image')
+        if self.isolation_profile not in {'standard-v1','chromium-userns-v1','postgresql-local-v1'}:raise ValueError('Unreviewed validator isolation profile')
+        if type(self.executable_scratch)is not bool:raise ValueError('Executable dependency scratch requires an explicit operator boolean')
+        if self.executable_scratch and self.isolation_profile=='chromium-userns-v1':raise ValueError('Executable dependency scratch is not qualified with the browser profile')
+        if not isinstance(self.runtime_environment,tuple) or any(not isinstance(pair,tuple) or len(pair)!=2 or not isinstance(pair[0],str) or pair[0] not in {'ATMEM_PLAYWRIGHT_MODULE','PLAYWRIGHT_BROWSERS_PATH'} or not isinstance(pair[1],str) or not pair[1].startswith('/') or any(ord(c)<32 for c in pair[1]) for pair in self.runtime_environment) or len({pair[0] for pair in self.runtime_environment})!=len(self.runtime_environment):
+            raise ValueError('Register only explicit image-local runtime module/browser paths')
+
+
+def validation_test_runner(spec):
+    command=spec.command
+    if spec.isolation_profile=='postgresql-local-v1' and command[1:3]==('-I','/opt/atmem/sql_validation.py'):
+        command=(command[0],*command[3:])
+    if command[1:3]==('-m','unittest'):return 'unittest'
+    if Path(command[0]).name in {'node','nodejs'}and command[1:2]==('--test',):return 'node:test'
+    return 'operator_registered'
+
+
+class DockerValidationWorker:
+    REVIEWED_PROFILES={'chromium-userns-v1':'e53c15d248f57bceec0a3a16fad1b4ab0d05a7bddb455f86a60e2dba5612cdf7'}
+
+    def __init__(self, endpoint, *, binary='docker', max_output_bytes=256000, isolation_profiles=None):
+        if not isinstance(endpoint,str) or not endpoint.startswith('unix:///') or not Path(endpoint[7:]).is_socket():
+            raise ValueError('Use an explicitly registered local Docker Unix socket')
+        if type(max_output_bytes) is not int or not 1024<=max_output_bytes<=1000000:
+            raise ValueError('Validator output budget must be bounded')
+        self.endpoint,self.binary,self.max_output_bytes=endpoint,binary,max_output_bytes
+        profiles={} if isolation_profiles is None else isolation_profiles
+        if not isinstance(profiles,dict) or set(profiles)-set(self.REVIEWED_PROFILES):raise ValueError('Register reviewed isolation profiles only')
+        self.isolation_profiles={}
+        for name,entry in profiles.items():
+            if not isinstance(entry,dict) or set(entry)!={'path','sha256'} or entry['sha256']!=self.REVIEWED_PROFILES[name] or not isinstance(entry['path'],str) or not Path(entry['path']).is_absolute() or Path(entry['path']).is_symlink():raise ValueError('A reviewed pinned local isolation policy is required')
+            if Path(entry['path']).stat().st_size>64000:raise ValueError('Isolation policy exceeds its explicit size limit')
+            content=Path(entry['path']).read_bytes()
+            if len(content)>64000 or hashlib.sha256(content).hexdigest()!=entry['sha256'] or json.loads(content).get('defaultAction')!='SCMP_ACT_ERRNO':raise ValueError('Isolation policy does not match its reviewed bytes')
+            self.isolation_profiles[name]=content
+        self.policy_digest=hashlib.sha256(json.dumps({'code':hashlib.sha256(Path(__file__).read_bytes()).hexdigest(),'profiles':{name:hashlib.sha256(content).hexdigest() for name,content in self.isolation_profiles.items()}},sort_keys=True).encode()).hexdigest()
+        self.identity_digest=hashlib.sha256(endpoint.encode()).hexdigest()
+
+    def supports(self,spec):return spec.isolation_profile in {'standard-v1','postgresql-local-v1'} or spec.isolation_profile in self.isolation_profiles
+
+    def run(self, archive, expected_digest, spec: ValidationSpec, *, execution_id=None, cancel_event=None):
+        if not isinstance(archive,bytes) or len(archive)>64000000 or hashlib.sha256(archive).hexdigest()!=expected_digest:
+            raise ValueError('Digest-bound artifact bytes are required')
+        if not self.supports(spec):raise RuntimeError('The reviewed isolation profile is unavailable; no fallback was used')
+        execution=uuid.UUID(execution_id) if execution_id is not None else uuid.uuid4()
+        ident='atmem-validator-'+execution.hex
+        started=time.monotonic()
+        with tempfile.TemporaryDirectory(prefix='atmem-validator-control-') as folder:
+            config=Path(folder)/'docker';config.mkdir()
+            (config/'config.json').write_text('{}')
+            env={'PATH':os.environ.get('PATH',''),'HOME':folder,'DOCKER_CONFIG':str(config),'DOCKER_HOST':self.endpoint}
+            prefix=[self.binary,'--host',self.endpoint,'--config',str(config)]
+            # Local image lookup only: never pull or evaluate a model Dockerfile.
+            inspect=subprocess.run([*prefix,'image','inspect',spec.image,'--format','{{.Id}}'],
+                                   env=env,capture_output=True,text=True,timeout=15)
+            if inspect.returncode!=0 or inspect.stdout.strip()!=spec.image:
+                raise RuntimeError('The reviewed local image/platform is unavailable; no image was pulled')
+            platform=subprocess.run([*prefix,'image','inspect','--platform',spec.platform,spec.image,'--format','{{.Os}}/{{.Architecture}} {{.Id}}'],
+                                    env=env,capture_output=True,text=True,timeout=15)
+            selection=platform.stdout.strip().split()
+            if platform.returncode!=0 or len(selection)!=2 or selection[0]!=spec.platform or not re.fullmatch(r'sha256:[a-f0-9]{64}',selection[1]):
+                raise RuntimeError('The reviewed cached platform is unavailable; no fallback or image pull was used')
+            browser=spec.isolation_profile=='chromium-userns-v1'
+            postgres=spec.isolation_profile=='postgresql-local-v1'
+            security=[]
+            if browser:
+                policy=Path(folder)/'reviewed-seccomp.json';policy.write_bytes(self.isolation_profiles[spec.isolation_profile])
+                security=['--security-opt','seccomp='+str(policy)]
+            runtime_env=[part for name,value in spec.runtime_environment for part in ['--env',name+'='+value]]
+            dependency_scratch=['--tmpfs','/dependencies:rw,exec,nosuid,nodev,size=128m,mode=1777','--env','TMPDIR=/dependencies','--env','ATMEM_TEST_DEPENDENCY_ROOT=/dependencies']if spec.executable_scratch else []
+            command=[*prefix,'run','--pull','never','--rm','--name',ident,'--platform',spec.platform,
+                '--network','none','--read-only','--cap-drop','ALL','--cap-add','SETUID','--cap-add','SETGID',
+                '--security-opt','no-new-privileges',*security,'--pids-limit','128' if browser else '64','--memory','512m' if browser or postgres else '256m','--cpus','1',
+                '--tmpfs','/work:rw,noexec,nosuid,nodev,size=128m,mode=0755',
+                '--tmpfs',f'/tmp:rw,noexec,nosuid,nodev,size={192 if postgres else 64 if browser else 32}m,mode=1777',
+                '--env','HOME=/tmp','--env','PYTHONDONTWRITEBYTECODE=1','--env','AWS_EC2_METADATA_DISABLED=true',
+                *runtime_env,*dependency_scratch,'--entrypoint',spec.bootstrap_python,'-i',spec.image,'-I','-c',BOOTSTRAP,
+                json.dumps([expected_digest,list(spec.command)])]
+            log=Path(folder)/'output.log'
+            reason=None
+            with log.open('wb') as output:
+                process=subprocess.Popen(command,env=env,stdin=subprocess.PIPE,stdout=output,stderr=subprocess.STDOUT)
+                def send():
+                    try:process.stdin.write(archive)
+                    except (BrokenPipeError,OSError):pass
+                    finally:
+                        try:process.stdin.close()
+                        except (BrokenPipeError,OSError):pass
+                writer=threading.Thread(target=send,daemon=True);writer.start()
+                try:
+                    while process.poll() is None:
+                        if cancel_event is not None and cancel_event.is_set():reason='cancelled';break
+                        if time.monotonic()-started>spec.timeout_seconds:reason='timeout';break
+                        if log.stat().st_size>self.max_output_bytes:reason='output_limit';break
+                        time.sleep(.05)
+                finally:
+                    def cleanup():
+                        nonlocal reason
+                        try:
+                            subprocess.run([*prefix,'rm','-f',ident],env=env,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=15)
+                        except (OSError,subprocess.TimeoutExpired):reason='container_cleanup_unconfirmed'
+                    if reason:
+                        cleanup()
+                    try:process.wait(timeout=10)
+                    except subprocess.TimeoutExpired:process.kill();process.wait()
+                    writer.join(timeout=2)
+                    cleanup()
+            with log.open('rb') as output:raw=output.read(self.max_output_bytes+1)
+            truncated=len(raw)>self.max_output_bytes
+            text=raw[:self.max_output_bytes].decode('utf-8',errors='replace')
+            runner=validation_test_runner(spec)
+            unittest=runner=='unittest'
+            node_tests=runner=='node:test'
+            skips=re.search(r'OK \(skipped=(\d+)\)',text) if unittest else None
+            skipped=int(skips.group(1)) if skips else 0
+            count=re.search(r'Ran (\d+) tests? in ',text) if unittest else None
+            if node_tests:
+                totals=re.findall(r'^(?:#\s*|ℹ\s*)tests\s+(\d+)\s*$',text,re.MULTILINE)
+                skip_counts=re.findall(r'^(?:#\s*|ℹ\s*)skipped\s+(\d+)\s*$',text,re.MULTILINE)
+                executed=int(totals[-1]) if totals else None
+                skipped=int(skip_counts[-1]) if skip_counts else 0
+            else:executed=int(count.group(1)) if count else None
+            if postgres and process.returncode==69 and 'ATMEM_SQL_FIXTURE_UNAVAILABLE' in text and reason is None:
+                reason='sql_fixture_unavailable'
+            missing_tests=(unittest or node_tests) and (executed is None or executed==0)
+            status='failed' if reason or truncated or process.returncode or missing_tests else 'incomplete' if skipped else 'passed'
+            return {'validator':spec.name,'artifactSha256':expected_digest,'imageId':spec.image,
+                'runtimeConfigImageId':selection[1],
+                'platform':spec.platform,'isolationProfile':spec.isolation_profile,'runtimeEnvironment':dict(spec.runtime_environment),'command':list(spec.command),'status':status,'exitCode':process.returncode,
+                'executableScratch':spec.executable_scratch,
+                'skipped':skipped,'testsReported':executed,
+                'reason':reason or ('output_limit' if truncated else 'no_tests_reported' if missing_tests else None),'output':text,
+                'outputTruncated':truncated,'durationSeconds':round(time.monotonic()-started,3),
+                'evidenceLevel':'local_container_check','cloudOperations':False,
+                'boundary':'Exact immutable source in a cached Linux image, root-owned read-only inputs and nonroot check process, isolated loopback/network-none with no host mounts/socket/credentials. Check execution is not independent semantic or whole-system acceptance.'}
+
+    def recover(self, execution_id):
+        """Remove only this journaled validator container after supervisor loss.
+
+        A failed daemon query is uncertainty, not proof the prior work stopped.
+        Never replay a check as part of recovery.
+        """
+        name='atmem-validator-'+uuid.UUID(execution_id).hex
+        with tempfile.TemporaryDirectory(prefix='atmem-validator-recover-') as folder:
+            config=Path(folder)/'docker';config.mkdir();(config/'config.json').write_text('{}')
+            env={'PATH':os.environ.get('PATH',''),'HOME':folder,'DOCKER_CONFIG':str(config),'DOCKER_HOST':self.endpoint}
+            prefix=[self.binary,'--host',self.endpoint,'--config',str(config)]
+            def present():
+                result=subprocess.run([*prefix,'container','ls','-a','--filter',f'name=^/{name}$','--format','{{.Names}}'],env=env,capture_output=True,text=True,timeout=15)
+                if result.returncode:raise RuntimeError('Validator cleanup could not be confirmed')
+                names=result.stdout.splitlines()
+                if names not in ([],[name]):raise RuntimeError('Unexpected validator recovery result')
+                return bool(names)
+            if present():
+                result=subprocess.run([*prefix,'rm','-f',name],env=env,capture_output=True,timeout=15)
+                if result.returncode:raise RuntimeError('Validator cleanup could not be confirmed')
+            if present():raise RuntimeError('Validator cleanup could not be confirmed')
+        return {'cleanupConfirmed':True,'workReplayed':False}

package/server/memory-requirements.lock

@@ -0,0 +1,181 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile --universal --python-version 3.13 server/memory-requirements.txt --generate-hashes --output-file server/memory-requirements.lock
+atflows==0.1.4 \
+    --hash=sha256:2ada812488a9f22368975936fbafdcbe066a147bc88ae949213fef3724ce5261 \
+    --hash=sha256:d277f0aba85cbc82229cefd2aeb87b81548e4cd1f0276f2c8b4c758ecec4b36b
+    # via
+    #   -r server/memory-requirements.txt
+    #   atmem
+atmem==2.3.10 \
+    --hash=sha256:e89f27ed6d9624cc4cb4e6d59286b48e53e430d2f2019737973488c3d43956cc \
+    --hash=sha256:f2e152ea2e710759fcb145cef34a33af5e173e0ef883aa2d75a5c01692a57c36
+    # via -r server/memory-requirements.txt
+atmem-atbot==0.1.1 \
+    --hash=sha256:0b47efeda0ca46c4f3bcaa6ce4adabf7b5094841d788f3cfee783d668a6a03d1 \
+    --hash=sha256:9c6cd216dd23b79c712b21a7e671c78ad771b78a961489e1b3d183174a93771f
+    # via
+    #   -r server/memory-requirements.txt
+    #   atmem
+cffi==2.1.1 \
+    --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \
+    --hash=sha256:06c72bb76605a4b0cd0aad6930b69d4baf7dd5d806cfc409b824191099700e66 \
+    --hash=sha256:0beceaabe56af686895136a2de78db54ecd8e4046b236b8fd6d6cb61389e9bf2 \
+    --hash=sha256:154852545011f779917b11c78db2358d095da62a9a172b78ad0a583ee5adc0d0 \
+    --hash=sha256:194cffa889098ced9976c3fc6340305e43f6303657d298da55366907c05c22d6 \
+    --hash=sha256:19ee6127ee34de7d83ce3d371ebc5ed91addbdcc39f9ab15ce4eb35a4e534971 \
+    --hash=sha256:1a18a57b58cfb21fc28d72e876acf10eaed67a1ed96226f92af4df681d571c4c \
+    --hash=sha256:1aa5645c30469b09530c4ebca77ebf8f17618293c58f8549cb1a543a50236e7d \
+    --hash=sha256:1dea0e4d7d4f11f619fe8c1d76caf49e24405b4b5743c0e3be16a500ecd930c9 \
+    --hash=sha256:208f941bb9d18e768138677f0a6d2ce01f590df56043dda1df1535ac57c88517 \
+    --hash=sha256:210019b6c7cf07f081b4c54635c8cf744377001350e29cc0f81c4377b4797735 \
+    --hash=sha256:246fa40ce8645a614ff682e0b70f37134e460eaf93a775e0cbe3cca585a67a80 \
+    --hash=sha256:25792eac27877609e7bb06d42ff88278a6624fff2ba9bbb523c09616b117e80f \
+    --hash=sha256:27350daa11d4f10c540e6e89dada4c54feb7256ad03e9a4dc075ebad7ba360d1 \
+    --hash=sha256:28907ab9bfb6aa13184cfc17c6b8e1023c5ab6fd7076d8c20a35e59fe04f8f29 \
+    --hash=sha256:2ae64be792b8966f2c69538199728b290e34726562896df1e5dc8ffd8d8188e8 \
+    --hash=sha256:31348097ff5bbe827ccc41795d4dd099d9f0625e7def00ee653c137a490c2a6c \
+    --hash=sha256:3143d81e29e1e20a9ce10901ec369012947876596f75a222235965f2b7ae832e \
+    --hash=sha256:3222ba5d678f80a030e6afbcc33dc1ae5cb45facabb61cee2c7016b8432fde48 \
+    --hash=sha256:3311ed60d36f83378794e1009ac6258bafbf81f7888b4caa7b35a521e3f95813 \
+    --hash=sha256:334644fbac4eff73d985a17a91226df55d0f394160c4cfb880e084c8f7161cac \
+    --hash=sha256:34e261f78cb6ceaaa36f42f2613f4380d94d9c759a9c73c769ee6e0247364632 \
+    --hash=sha256:363e05fa78e15116c3c32c210ee36884fd6b9afa6d440e47112c3bd511d64cb6 \
+    --hash=sha256:398aff33cee2767e3e781d2554c54bd0dff386bb437581e0d8011fde1a942ec1 \
+    --hash=sha256:3d22a20b1fb1632cc72c22f95f7b0d2961c3e1c235f245ba4c606c4771035659 \
+    --hash=sha256:42a494cee34437f05546455144f2b5d9ac09b1face62bcfce597d2e521066688 \
+    --hash=sha256:42e2f76b9455f5a9a844f770bf3e200ed3da0e15f5df3db9c31fe80b04b3d004 \
+    --hash=sha256:42f6930c31dc7f50732c9ae793c2786c7b6b044195967bbdde40bb9be81c4cc0 \
+    --hash=sha256:456a61fa52d579ebf9df2e9552ead5129855dbaff6c1e5a9b1bc408809bdc062 \
+    --hash=sha256:471cee653ae88de62096552e6d24ccb4a5adb8c8c9f10b5054d0122c15bf2779 \
+    --hash=sha256:49cbc70e6542d4ccccb936558d1064a8012541e78f821f955cff24e357776c94 \
+    --hash=sha256:4a7c934f7360e8cd64fe9efadcbd10c7c6364f531e432b9a4bf5ccbc9e0e8b50 \
+    --hash=sha256:4be96343e422f2dfcd12ab5c9f5aebe03f82f737c6bffeca6830b3875cb44aab \
+    --hash=sha256:4f42141fc14250de6dde5ee7ea4432be017252d91f19c5ad043c084cea629cac \
+    --hash=sha256:507a24c282e0f42f8ed737cf048572cbf580468da5555764a8331735e9c736b6 \
+    --hash=sha256:51b31d1c98274844cfd7838ce00bfc27c7423a4dc00fc0772fc3331c2cc90676 \
+    --hash=sha256:58acb8ab8e295e6c5ea12f888cbb13cf21511ef2a3303a23f4325c29d17fe5c1 \
+    --hash=sha256:5a59cc1c4442bc3d5c703bf720b51138d0bfc173618807c9ee2490a7541dd3d9 \
+    --hash=sha256:5bb4e7ea95dcd6a014a6fef62e62467d67d8e582326443f3d68e71d6320a9fcf \
+    --hash=sha256:5c58fe613dc5e5336357eff555824a314d8e43282600435c8d1cb6a7a2fedd13 \
+    --hash=sha256:5e7cecbaadb83884793e05828cee59b210b24583b9c7425d0ba6a754fe22eb4e \
+    --hash=sha256:616f097f2fe415bc92a247f02e11f634e1f9e9a83d327e3c915c15089c87869e \
+    --hash=sha256:63bbfd5ded17c4840ac07cd8f1c21ba9d9708141f840b324f422f41b207e3973 \
+    --hash=sha256:64faea20f4e2613363a1a9b9c7dd73058f3ecd00133a511e72ad7c511658f527 \
+    --hash=sha256:661c298b4821edebead0c91edd2b00374d67ad7c5a1f7a91d4442633b79d6a72 \
+    --hash=sha256:68e62fe11f30d5ca8289242866f0a5291402d8529ca2178ab8afc5c9694ae890 \
+    --hash=sha256:6a8dddef476fab96d066d578fc88526767b836ab5ab21754e1d5bf3879c31c7c \
+    --hash=sha256:6e192623c49c94421616a5778fba35cf0d5a8d000650c1967ef4448ee5cdd990 \
+    --hash=sha256:7225e4514edb64eb6740324353e0da0711954fd8d7da4576755b1c6e09b697cd \
+    --hash=sha256:75f80557d1389eddbd0de2681f6a390a0c5338c31ddaa821381c203fc3fd50d9 \
+    --hash=sha256:770de9db11e84213beec501cfcaa013b019820ca881e03344dea5844f7876d94 \
+    --hash=sha256:7750c6449dff7864bb9bb27ddfb0267756189201a3afc911d82b3caacd70dfc3 \
+    --hash=sha256:7bde5e4cc5c10140859842b9d383af292b22639a4dffb725314baf45968cef80 \
+    --hash=sha256:7ce713ace7c0e4520535b42b77eaa742c16dab813978064913e5a3cf82973b41 \
+    --hash=sha256:7da0c5eff80f0197f3b3d1232ec5a682a9325f4ae9016a78f5f5ca35f9ced1f5 \
+    --hash=sha256:7dbb61fe3a7699468030f71bbe5f8a0e326a151daa91beb11a6fc1f980c55e1c \
+    --hash=sha256:811bd1e21d32de12efca32393a0ab3f5133b54fce9bd44b8bd77ab07da14bf6a \
+    --hash=sha256:8ef53b2de9bcb9197d31854256575d59dbac0cba72ac627bb291ef5eceb74be4 \
+    --hash=sha256:937c0052c05a31ca1daf18de3158eed4dbfcb9cc107adbea227728d647be701e \
+    --hash=sha256:9d2055050ea716bd38b7f7f1579c275386646b4894c155a3e2f3cd62ed41b7c6 \
+    --hash=sha256:9f8d177621de5cb38ee3e731eda45d421db093ec0739f46a5594babda7987a98 \
+    --hash=sha256:a2d7755bef5a12ed488f4ef1f1b69ee9191d7396083b755a5d2295f6edb4768b \
+    --hash=sha256:a48d62ab9d6f4f98c983223a547af44be6ca3691074c31cecced6facd3ba2dc1 \
+    --hash=sha256:a4f00aa42f75d6e4595e8866e748cc1705adc0cddfeb2ca86d0d03993d63ba03 \
+    --hash=sha256:a6e721d4b0e45d5b65e87534470e67b18dcd092c83f68fba09f152b9cbc061af \
+    --hash=sha256:a730a083190634c65cca36ba5f489531576ebd79bcd5c8e172130f6453127231 \
+    --hash=sha256:a931079504ecc49efed7744c476a5c343a92fabf66dec2db95edb1b2fdc770e2 \
+    --hash=sha256:aa9511c62d14da7aacc9b4bf51f3f697a621e83b2d6919008243c3aad168eea3 \
+    --hash=sha256:ab36d55f9ed2d067327667c2fea18dda018eb628dd6347aa01dda6cf1f5d3836 \
+    --hash=sha256:ad2c86c495b899d862ea0f4b42891b8713a3bd45dd4105c7fd51c2a72f39f3a5 \
+    --hash=sha256:aeae0e330c9f6acd681f647d46cefd30c29f93e3392882e792e82080c9691399 \
+    --hash=sha256:b0431303acaea1089ad4b3e9ce4e6518193def1118d4073ca848635ee4ea2e96 \
+    --hash=sha256:b5bdfd1c873d4e093aabc0ca84c4ca6dbc4f752afb5c86f146d9742580c9da2e \
+    --hash=sha256:baed1e86cc735622097354b9d1281406caf42ff42a886d29faa8e8d1630333be \
+    --hash=sha256:c1453022f490d2459a11819d83ad1d586e9ff65a12ac3e705ffebd46d3685dcf \
+    --hash=sha256:c26608d2222fb1e94487e4a387d85f13eb55d5ed725cb25a0c589ac4ee60e7bc \
+    --hash=sha256:c7659f22557c5a0bc4855cd635f55edec690cc008a40768527762cb9fb263455 \
+    --hash=sha256:c8c69575568085ba0b1b10c0249d779a214aea6f6522e949a0fc9fb0fcb449d0 \
+    --hash=sha256:c8d2c9fd1f2d16f780d15127abb050d13d1a76c03a4bd87d7e4980e45e511e12 \
+    --hash=sha256:ca82be1a1d406ecfe1d25dc16cb33488e5a16bf4438c9fb590484ea29d92478b \
+    --hash=sha256:cc572dace3f60ef98d7b12ff411d20f5362feb31a0439eab0085bbfd349982d7 \
+    --hash=sha256:d18e5ac0f2f03f4f518d3e23db0f0cad7faa1da8620e9c09461d443bbf6e6692 \
+    --hash=sha256:d28630f5854ab07ab1fd4aba756de52326c82e6be15d414b12793f1975048b54 \
+    --hash=sha256:d9c275eaacd24aa73f94ffd6de08fc3f932424d8b6c376f4bed7cde376fe7bc3 \
+    --hash=sha256:da0e573f9f97159390c89d9f1a9e41908b66d408cc5b58d08cf3847d844c531b \
+    --hash=sha256:dd31f52ea1086513bb9df30f8fcee9b8918323ae067a3d5b78bc826a000712be \
+    --hash=sha256:dddad92b554513a31f272570678ba307fb9f618f05e3d4a5eacafff9eae03e1d \
+    --hash=sha256:df423d40ee8654634421812bc3b196da3f9bd7d32929da813f8394c4348a5358 \
+    --hash=sha256:df913725b79db7bcf03448f36b7bf8815363417d5b58deecf9305e3e30f0f21a \
+    --hash=sha256:e0bcb7e0f677f543555d2adff3bf19c05f66cdb4796e5ff602442ab2fe3c4ef7 \
+    --hash=sha256:e2d65b31f36619cda3999b78b2aa9632e76b78448e7a56fc4240824200e7c4fc \
+    --hash=sha256:e6e8cff14d6fb0be70a09c0bdc58096f501952d04624ebf867e0e56da2df8960 \
+    --hash=sha256:f16c709686a78c727bbbf059f92b0bf41c6fc60deec706d2dc19f529175a6125 \
+    --hash=sha256:f24fb43132a4c6b4cb4eb029492919b2db645be6808d738f244fd146c03c32cb \
+    --hash=sha256:f53e442b08449d42821fa4a4fba000095af9f62742a500f978a9f557ec44339a \
+    --hash=sha256:f5cfbc5fe74540d335175b656c725d74d90e3730c626d92575eea35029d9afaa \
+    --hash=sha256:f81b3b8f3d4e343550fa4baa0e479bba9f2d29ce9c2e9b51d1ce1718d7442fcf \
+    --hash=sha256:f8ec5e643a9a937f64e1999eb9f75d072263751912dc5cd06d3c85f8f44be7c3 \
+    --hash=sha256:fb92203a88b3d3053034db775110081c49d28be6551923805e039924093761e4 \
+    --hash=sha256:fcd22650c908d7b7da162bbfaab594a1227a15d1643a98c68b122ac642fa2264
+    # via
+    #   -r server/memory-requirements.txt
+    #   cryptography
+cryptography==48.0.1 \
+    --hash=sha256:08a597acce1ff37f347400087776599e2348a3a8bc53b44120e463cd274efe4a \
+    --hash=sha256:09f73a725d582cef64b91281a322cd798d14a33b2b6f2b7ad9531dc336d84c02 \
+    --hash=sha256:0df56b056bc17c1b7d6821dfa65216e62bd232d8ab05eb3db44e71d235651471 \
+    --hash=sha256:0ee6ea481db1ab889cba043ec1eda17bb9c1ea79db6722f779c3667f9f70322f \
+    --hash=sha256:15254441469dd6bf027039453288e2072124f8b6603563f5d759e1c9b69273fa \
+    --hash=sha256:266f4ee051abb2f725b74ef8072b521ce1feacf685a3364fa6a6b45548db791a \
+    --hash=sha256:2c37f2461406063b417837f5f3daab668652acd82423efcd7f0a9f04be972de1 \
+    --hash=sha256:32143b24adb918f078134e1e230f1eb8cc04886b92c28b5f0041aaf3e5699225 \
+    --hash=sha256:33842cf0888951cef5bc7ac724ab844a42044c1727b967b7f8997289a0464f92 \
+    --hash=sha256:3752f2dbc8f07a30aad2932c986cea495b03bb554887828225da104f732852b6 \
+    --hash=sha256:39489bfca54c7a1f6b297efcd8bc608ab92d16c4ca631b0cad4da46724588b24 \
+    --hash=sha256:3e4a1a3232eef2e6c732827d5722db29a0cc8b27af2a4d865b094cf954be9ca1 \
+    --hash=sha256:3fd2ca57062b241c856670b073487d2e86c4637937ca5601e48f97bf8e11fc8f \
+    --hash=sha256:42fcd8e26fe555d9b3577a135f5091fefa0aa4e99129c23fb56787a1bd4ada72 \
+    --hash=sha256:43c5835e2cb98c8733d86f57d6fc879b613f5c3478607281c3e36daffc6dd8a6 \
+    --hash=sha256:48fe40804d4caa2288f24e70ca8c64c42dd826da0ad7e4f1b41b2128d679e6c8 \
+    --hash=sha256:4ab0a343c807bbcd90c971cd1ecf072937cd01847a9e002bef88fb47ac6be577 \
+    --hash=sha256:4fdc69f8e4316bcf0c8c8ec1f26f285d12e8142d88d96c876a59a03be3f6ae67 \
+    --hash=sha256:6184ca7b174f28d7c703f1290d4b297217c45355f77a98f67e9b7f14549ac54a \
+    --hash=sha256:66fd0771e7b9c6dcd44cf1120690d2338d16d72795cf40cae2786a39eba65429 \
+    --hash=sha256:6b2c0c3e6ccf3ade7750f836ef3ee36eea250cc467d45c256895573ac08cc6f1 \
+    --hash=sha256:735824ec41b7f74a7c45fb1591349333e4c696cb6c044e5f46356e560143e4cd \
+    --hash=sha256:7e234ac052af99f2700826a5c29ea99d9c1b1f80341cde62d11c8154dc8e0bd9 \
+    --hash=sha256:869c3b8a53bfe27147832df48b32adadf558249d50e76cb3769d40e986b13265 \
+    --hash=sha256:86be3b1b0b6bf09482fb50a979c508d2950ed95f5621ec77f4e385962006b83a \
+    --hash=sha256:86fe77abb1bd87afb251d4d02ada7ecf53a32cee9b67d976abb2e45a13297475 \
+    --hash=sha256:88c852a0ae366e262e5a1744b685e6a433dc8788dd2a277e418bf4904203609d \
+    --hash=sha256:8ace4507d1e6533c125f4fac754f8bb8b6a74c08e92179dabd7e16571a3efbf3 \
+    --hash=sha256:92a46e1d638daa264ba2971c0b0489c9409787943efae4d60ffda3d091ef832c \
+    --hash=sha256:9621de99d2da096006b629979efd8ae7eb2d8b822488d0c89ee4000c306c59b1 \
+    --hash=sha256:9a49ca6c81417f6a5edb50375a60cccdd70fa0a91a5211829dbea74eba94d2ac \
+    --hash=sha256:9bd3f92d76217892b15df84ca256c2c113d386fdda7a7d8691aeeced976507c6 \
+    --hash=sha256:9de21387aa95e2a895823d0745b430bed4f33503ba9ab5e0b5311f33e37d66d2 \
+    --hash=sha256:b024e784ad6c077ee0147b35ea9cbfc1e34e1fd4c1dcca214c2794d73a12df08 \
+    --hash=sha256:b4e391975f038e66432328639620a4aff2d307513b004f1ca06d6225bced815c \
+    --hash=sha256:b74ca3b8e5ecdd833bf6a002ca41b4793bb27fb8f1c06ffaf2643c9e9140e31b \
+    --hash=sha256:b7a2d1a937a738a881737cec135a38bb61470589b17515b9f73f571d0ae10401 \
+    --hash=sha256:b9a32b876490d66c8bcc9963ef220199569748434ab01a9d6aaeabf88e7f5158 \
+    --hash=sha256:bd81490cd5801d755cf97bb68ac191f14b708470b1c7cf4580f669b9c9264cd8 \
+    --hash=sha256:c1400da5e32a43253392277eac7490a60e497d810a63dd5608d71bbd7af507c9 \
+    --hash=sha256:d069066deead00ac7f090be101be875a06855908f7ec004c27b8fefb4acfb411 \
+    --hash=sha256:d5d30989c6917b478b5817902e85fddaea2261efa8648383d965381ccb9e1ac4 \
+    --hash=sha256:df637c05205ea7c1d7fbcbe54bbfea648a52951155f997af13d895d0ecc96991 \
+    --hash=sha256:e361afba8918070d376df76f408a4f67fec0ee9cff81a99e48fe9a233ef59e17 \
+    --hash=sha256:eb86ce1af36fe65041b6db9a8bb064ee621a7e5fded0f80d475ec243477cd242 \
+    --hash=sha256:f0d27a5696721ef7a672b8c810f6aded391058e0b9486e63e6d93baf765da691 \
+    --hash=sha256:f2ceef93cb096aa3c4cc4b5c94ca6131f9196d28c64d6111533402a9b2054d41 \
+    --hash=sha256:f817adc181390bd54f2f700107a7419040fb7c1bdf2fc26f36551a06a68c3345 \
+    --hash=sha256:fe0180af5bf9236518a087e35bf2d9a347d5f5f51e63c579d683ddff424e3d46
+    # via
+    #   -r server/memory-requirements.txt
+    #   atmem
+pycparser==3.12 \
+    --hash=sha256:a076f3f489b39b43ed13563a1dafe42447445bec2e294154ec5c57fcdda4c85e \
+    --hash=sha256:f03387877eab82ce01bbdfd0ba7252ee55a90b1c708d5129e2ce915475cf1db6
+    # via
+    #   -r server/memory-requirements.txt
+    #   cffi

package/server/memory-requirements.txt

@@ -0,0 +1,6 @@
+atmem==2.3.10
+atmem-atbot==0.1.1
+atflows==0.1.4
+cryptography==48.0.1
+cffi==2.1.1
+pycparser==3.12