@atmem/architect 0.0.0-stage → 0.2.0

package/server/voice_routes.py

@@ -0,0 +1,91 @@
+"""Local-only, session-authenticated dictation. The app boundary owns HTTP auth."""
+import asyncio, base64, io, json, os, shutil, wave
+from pathlib import Path
+from fastapi import APIRouter, HTTPException, Request
+from .settings import setting
+
+router=APIRouter()
+ROOT=Path(__file__).resolve().parent
+
+def configuration():
+    binary=shutil.which('whisper')
+    model=Path(setting('WHISPER_MODEL') or Path.home()/'.cache'/'whisper'/'tiny.en.pt')
+    if not binary or not model.is_file():return None
+    try: python=Path(binary).read_text().splitlines()[0].removeprefix('#!').strip()
+    except (OSError,IndexError,UnicodeError):return None
+    if not python.startswith('/') or not Path(python).is_file():return None
+    return python,model
+
+class LocalSpeech:
+    def __init__(self):self.process=None;self.lock=asyncio.Lock()
+    async def close(self):
+        p=self.process;self.process=None
+        if p and p.returncode is None:
+            p.terminate()
+            try:await asyncio.wait_for(p.wait(),3)
+            except asyncio.TimeoutError:p.kill();await p.wait()
+    async def ready(self):
+        config=configuration()
+        if not config:raise HTTPException(503,'Local voice is not prepared. Run python3 scripts/setup-voice.py, then try again.')
+        if self.process and self.process.returncode is None:return
+        python,model=config
+        self.process=await asyncio.create_subprocess_exec(python,str(ROOT/'voice_worker.py'),str(model),
+            stdin=asyncio.subprocess.PIPE,stdout=asyncio.subprocess.PIPE,stderr=asyncio.subprocess.DEVNULL,
+            limit=100000)
+        try:
+            hello=json.loads(await asyncio.wait_for(self.process.stdout.readline(),30))
+            if hello.get('ready') is not True:raise ValueError('worker startup')
+        except BaseException:
+            await self.close();raise
+    async def prepare(self):
+        async with self.lock:await self.ready()
+    async def transcribe(self,pcm):
+        # A first partial can arrive while the page is warming the model. Wait for
+        # that preparation instead of turning an ordinary warmup into a mic failure.
+        try:await asyncio.wait_for(self.lock.acquire(),35)
+        except asyncio.TimeoutError:raise HTTPException(503,'Local transcription is busy. Finish or stop another recording, then try again.')
+        try:
+            try:
+                await self.ready()
+                self.process.stdin.write((json.dumps({'pcm':base64.b64encode(pcm).decode()})+'\n').encode())
+                await self.process.stdin.drain()
+                result=json.loads(await asyncio.wait_for(self.process.stdout.readline(),25))
+                if not isinstance(result.get('text'),str):raise ValueError('worker reply')
+                return result['text']
+            except HTTPException:raise
+            except BaseException:
+                await self.close();raise
+        finally:self.lock.release()
+
+engine=LocalSpeech()
+
+@router.get('/api/voice/status')
+async def status():
+    return {'available':configuration() is not None,'engine':'local-whisper','audioStored':False,'maxSeconds':60}
+
+@router.post('/api/voice/prepare')
+async def prepare():
+    try:await engine.prepare();return {'ready':True}
+    except HTTPException:raise
+    except Exception:raise HTTPException(503,'Local speech recognition could not start. Check the Whisper installation.')
+
+@router.post('/api/voice/transcribe')
+async def transcribe(request:Request):
+    if request.headers.get('content-type','').split(';')[0]!='audio/wav':
+        raise HTTPException(415,'Send mono 16 kHz PCM WAV audio.')
+    body=await request.body()
+    if len(body)>1_920_100:raise HTTPException(413,'Voice clips are limited to 60 seconds.')
+    try:
+        with wave.open(io.BytesIO(body),'rb') as audio:
+            if (audio.getnchannels(),audio.getsampwidth(),audio.getframerate(),audio.getcomptype())!=(1,2,16000,'NONE'):
+                raise ValueError('format')
+            frames=audio.getnframes()
+            if not 1600<=frames<=960000:raise ValueError('duration')
+            pcm=audio.readframes(frames)
+            if len(pcm)!=frames*2:raise ValueError('truncated')
+    except (ValueError,EOFError,wave.Error):raise HTTPException(422,'Invalid audio. Use a mono 16 kHz PCM WAV clip of up to 60 seconds.')
+    try:
+        text=await engine.transcribe(pcm)
+        return {'text':text,'engine':'local-whisper','audioStored':False}
+    except HTTPException:raise
+    except Exception:raise HTTPException(503,'Local transcription was interrupted. Your message has not been sent.')

package/server/voice_worker.py

@@ -0,0 +1,26 @@
+"""Private local worker: bounded PCM requests via stdin, text via stdout. No audio files."""
+import base64, json, os, sys
+import numpy as np
+import torch
+import whisper
+
+torch.set_num_threads(4)
+model = whisper.load_model(sys.argv[1], device='cpu')  # Exact existing checkpoint; never downloads.
+print(json.dumps({'ready': True}), flush=True)
+for line in sys.stdin:
+    try:
+        payload=json.loads(line)
+        raw=base64.b64decode(payload['pcm'], validate=True)
+        if not 3200 <= len(raw) <= 1_920_000 or len(raw)%2:
+            raise ValueError('audio size')
+        samples=np.frombuffer(raw,dtype='<i2').astype(np.float32)/32768
+        if np.sqrt(np.mean(samples*samples)) < .003:
+            text=''
+        else:
+            result=model.transcribe(samples,language='en',fp16=False,temperature=0,
+                condition_on_previous_text=False,verbose=None)
+            text=' '.join(s['text'].strip() for s in result.get('segments',[])
+                if s.get('no_speech_prob',0)<.8).strip()
+        print(json.dumps({'text':text[:12000]}),flush=True)
+    except Exception:
+        print(json.dumps({'error':'Local transcription failed.'}),flush=True)

package/server/windows_snapshot.py

@@ -0,0 +1,119 @@
+"""Bounded Windows snapshots with held, no-reparse, read-sharing-only handles.
+
+All handles stay open until the complete tree is audited. Writers, replacements,
+reparse points, hard links and non-disk objects fail closed; nothing is executed.
+References: Microsoft CreateFileW and GetFileInformationByHandle documentation.
+"""
+import ctypes
+from ctypes import wintypes as w
+import hashlib
+import io
+import os
+from pathlib import Path
+import stat
+import zipfile
+from .engineering_sessions import SessionError
+
+
+def snapshot(workspace, *, excluded, max_bytes, max_files):
+    if os.name != 'nt':
+        raise SessionError('Windows snapshot handles require Windows')
+    kernel = ctypes.WinDLL('kernel32', use_last_error=True)
+    class Info(ctypes.Structure):
+        _fields_ = [('attributes', w.DWORD), ('created', w.FILETIME),
+                    ('accessed', w.FILETIME), ('written', w.FILETIME),
+                    ('volume', w.DWORD), ('size_hi', w.DWORD), ('size_lo', w.DWORD),
+                    ('links', w.DWORD), ('index_hi', w.DWORD), ('index_lo', w.DWORD)]
+    kernel.CreateFileW.argtypes = [w.LPCWSTR,w.DWORD,w.DWORD,w.LPVOID,w.DWORD,w.DWORD,w.HANDLE]
+    kernel.CreateFileW.restype = w.HANDLE
+    kernel.CloseHandle.argtypes = [w.HANDLE]
+    kernel.CloseHandle.restype = w.BOOL
+    kernel.GetFileInformationByHandle.argtypes = [w.HANDLE,ctypes.POINTER(Info)]
+    kernel.GetFileInformationByHandle.restype = w.BOOL
+    kernel.GetFileType.argtypes = [w.HANDLE]
+    kernel.GetFileType.restype = w.DWORD
+    kernel.GetFinalPathNameByHandleW.argtypes = [w.HANDLE,w.LPWSTR,w.DWORD,w.DWORD]
+    kernel.GetFinalPathNameByHandleW.restype = w.DWORD
+    kernel.ReadFile.argtypes = [w.HANDLE,w.LPVOID,w.DWORD,ctypes.POINTER(w.DWORD),w.LPVOID]
+    kernel.ReadFile.restype = w.BOOL
+    invalid = ctypes.c_void_p(-1).value
+    held, entries, exclusions, observed = [], [], [], {}
+    output, total = io.BytesIO(), 0
+    root = Path(workspace).absolute()
+    if str(root).startswith('\\\\'):
+        raise SessionError('Windows capture requires a local disk workspace')
+    def fail():
+        raise SessionError('Artifact contains a changed, linked or unavailable Windows entry; no package was saved')
+    def information(handle):
+        info=Info()
+        if not kernel.GetFileInformationByHandle(handle,ctypes.byref(info)):fail()
+        if info.attributes & 0x400 or kernel.GetFileType(handle)!=1:fail()
+        return info
+    def identity(info):
+        return (info.volume,info.index_hi,info.index_lo,info.attributes,info.links,
+                info.size_hi,info.size_lo,info.created.dwHighDateTime,info.created.dwLowDateTime,
+                info.written.dwHighDateTime,info.written.dwLowDateTime)
+    def open_entry(path):
+        # No FILE_SHARE_WRITE or FILE_SHARE_DELETE: retain every handle through audit.
+        handle=kernel.CreateFileW('\\\\?\\'+str(path),0x80000000,1,None,3,0x02200000,None)
+        if handle==invalid:fail()
+        held.append(handle)
+        info=information(handle)
+        actual=ctypes.create_unicode_buffer(32768)
+        length=kernel.GetFinalPathNameByHandleW(handle,actual,len(actual),0)
+        if not length or length>=len(actual) or os.path.normcase(actual.value)!=os.path.normcase('\\\\?\\'+str(path)):fail()
+        return handle,info
+    def names(path):
+        result=[]
+        for name in sorted(os.listdir(path)):
+            if name in excluded:continue
+            if name in {'.','..'} or name.endswith((' ','.')) or any(ord(c)<32 or c in '\\/:"<>|?*' for c in name):fail()
+            result.append(name)
+        return result
+    def walk(path,relative,handle,info,archive):
+        nonlocal total
+        observed[relative]=(path,handle,identity(info),None)
+        if info.attributes & 0x10:
+            children=names(path)
+            observed[relative]=(path,handle,identity(info),children)
+            exclusions.extend((relative+'/' if relative else '')+name for name in sorted(os.listdir(path)) if name in excluded)
+            for name in children:
+                child_relative=(relative+'/' if relative else '')+name
+                child,child_info=open_entry(path/name)
+                directory=bool(child_info.attributes & 0x10)
+                if len(entries)>=max_files:raise SessionError('Artifact entry limit exceeded; no partial package was saved')
+                if directory:
+                    entries.append({'path':child_relative+'/','kind':'directory'})
+                    item=zipfile.ZipInfo(child_relative+'/');item.external_attr=(stat.S_IFDIR|0o755)<<16
+                    archive.writestr(item,b'')
+                walk(path/name,child_relative,child,child_info,archive)
+        else:
+            size=(info.size_hi<<32)|info.size_lo
+            if info.links!=1 or total+size>max_bytes:fail()
+            content=bytearray()
+            while True:
+                buffer=ctypes.create_string_buffer(min(1_000_000,max_bytes-total-len(content)+1))
+                read=w.DWORD()
+                if not kernel.ReadFile(handle,buffer,len(buffer),ctypes.byref(read),None):fail()
+                if not read.value:break
+                content.extend(buffer.raw[:read.value])
+                if total+len(content)>max_bytes:fail()
+            if len(content)!=size or identity(information(handle))!=identity(info):fail()
+            entries.append({'path':relative,'kind':'file','bytes':size,'sha256':hashlib.sha256(content).hexdigest()})
+            item=zipfile.ZipInfo(relative);item.compress_type=zipfile.ZIP_DEFLATED
+            mode=0o755 if path.suffix.lower() in {'.sh','.exe'} else 0o644
+            item.external_attr=(stat.S_IFREG|mode)<<16
+            archive.writestr(item,content)
+            total+=size
+    try:
+        handle,info=open_entry(root)
+        if not info.attributes & 0x10:fail()
+        with zipfile.ZipFile(output,'w',compression=zipfile.ZIP_DEFLATED)as archive:
+            walk(root,'',handle,info,archive)
+        for path,handle,expected,children in observed.values():
+            if identity(information(handle))!=expected or children is not None and names(path)!=children:fail()
+        return output.getvalue(),entries,exclusions
+    except OSError:
+        fail()
+    finally:
+        for handle in reversed(held):kernel.CloseHandle(handle)

package/specs/028-convergence-evaluation/evidence/20261110-ibm-invoice-native/registry-structured/qualification.json

@@ -0,0 +1,72 @@
+{
+  "kind": "ibm-generated-source-local-qualification",
+  "checks": [
+    {
+      "name": "block_776f726b7370616365-dependency-closure",
+      "passed": true,
+      "exitCode": 0,
+      "error": null,
+      "logSha256": "7cdf86c11be8cd2bd27e079b9eaf3e1a49e67fd3859d15322472a4c2cd670aaf"
+    },
+    {
+      "name": "block_776f726b7370616365-runtime",
+      "passed": true,
+      "exitCode": 0,
+      "error": null,
+      "logSha256": "e4a87143fa2b5fcad8312a350ec9bfa971d8e09a657b9949f2ca21c087789bda"
+    },
+    {
+      "name": "provider-init",
+      "passed": true,
+      "exitCode": 0,
+      "error": null,
+      "logSha256": "4dd3e891182a46feed67ba9f9071884ed31574ba3279bc8fbc1a8b86867d69e3"
+    },
+    {
+      "name": "provider-schema",
+      "passed": true,
+      "exitCode": 0,
+      "error": null,
+      "logSha256": "624bd9c40454b477e270d3078d4f93fae51fe8cd939b1b0da055f03794c336fe"
+    },
+    {
+      "name": "provider-mocks",
+      "passed": true,
+      "exitCode": 0,
+      "error": null,
+      "logSha256": "bb92f233a7936f4de6a41314bb2881369aaa623d150a82eb78f43a7b339798c5"
+    }
+  ],
+  "passed": true,
+  "cloudOperations": false,
+  "artifactHashes": {
+    "applications/block_776f726b7370616365/ibm_structured.py": "e1ee0f1bc06f4b6f15954d9d53e4ce0f218cf791ea6098b95a7fccb77b112fda",
+    "applications/block_776f726b7370616365/ibm_acceptance.py": "1dae539a44bc4878a9ce5b1552f2e8758512625058247a88e3762c9464c20379",
+    "applications/block_776f726b7370616365/structured_output.py": "432c730c54bd7dcae7b52fb73edc67d2e7b44b890e68254fdee832cb4c2304bc",
+    "applications/block_776f726b7370616365/structured_http.py": "fae1e7d092c1d17e90cb2af41aeb19ce786b38a1a813427197b1ad56dd0006ab",
+    "applications/block_776f726b7370616365/http_acceptance.py": "bd9ed35d684e1b3139b13f2cda948e1008b71d518080257382139c12e7cfa44e",
+    "applications/block_776f726b7370616365/export_contract_acceptance.py": "da3e116e83592fac21287eebb23805c5b2c876464b84348586a0d0fa417b8445",
+    "applications/block_776f726b7370616365/policy_review.py": "66d56df0dcab7df4ef85c35cc8a0ddbc7e71f8b31179db4916898c9ea5c4e947",
+    "applications/block_776f726b7370616365/web/index.html": "acc94cd6ca367c30b16b313ec6f79e33b9c0525fdf1e7c9078a9ee3d106b3b55",
+    "applications/block_776f726b7370616365/web/app.css": "b8a25941eaaa678e871b7f0b9ce6c9729680955bc55cf8ac231b12d18bb4bb8c",
+    "applications/block_776f726b7370616365/web/app.js": "35e3cf9badd3d69a8653e1787e3a0b40ec6bbfaaf1d8e33f9dbbe78643a8184a",
+    "applications/block_776f726b7370616365/output-contract.json": "ddbb7e23a60d0d9b3504a5ae419d756e03d12e955f20c188f81c4e5800fa33bf",
+    "applications/block_776f726b7370616365/requirements.lock": "5f1c4a8a5e6913bcabb02f7ecfbbeed46d662d0d69e75be289285906607b28ac",
+    "applications/block_776f726b7370616365/dependency-sources.json": "4c9fc025adc10ff43708c84f34cfa50a9f36eeb7ea77ae0a240bcc7c3f73ebe7",
+    "applications/block_776f726b7370616365/test-requirements.lock": "54894d4de170917d97979422e764854555ad23ff16c253128540602cc1791bf0",
+    "applications/block_776f726b7370616365/test-dependency-sources.json": "8a4c9c3daff2e034da95e9dad9916d46cb7eb1b228b2f940c7e200698f9c1a64",
+    "applications/block_776f726b7370616365/container-base.json": "b2adfde9b3215f7f0299806e211b49438be95ea3c2b995e905452cce2dfd0650",
+    "applications/block_776f726b7370616365/Dockerfile": "89e80555673c3d5b8c46d6101a2c256a5fd1ab94350a1fd971338b06c3ee9f72",
+    "applications/block_776f726b7370616365/.dockerignore": "29166c81d104dea78a0a4ea844ed15161843c68c726baf32952ab72f84f12bf4",
+    "applications/block_776f726b7370616365/BUILD.md": "ba89ea7d249c8237b4e5e9502af0757a7f345ef3140254395b8088caec8f5118",
+    ".terraform.lock.hcl": "022cd3d744cf400f91bc98094840a94eb8e652d67447d744db359be463a3cdb1",
+    "main.tf.json": "acc18e4f2a10015ef140d8cf6939e5a9f65a5bc9a73b25c3cbb46dc6547bcda6",
+    "resource-schedule.json": "5b9c183deb64cca36f410bd55f2a70ff2167767edade395ace2be57becf6c72c",
+    "deployment.tfvars.json.example": "dc09b358146fd0298f748de15b209642373629566d0d52c30a1d8879610573c0",
+    ".gitignore": "8168883c9173f4d7fe176e5e8ebdc1dfb569fd81efd2e3da0a207e7f27e1dd95",
+    "tests/ibm-structured.tftest.hcl": "621fbc196133d3f2ddae78a882842554109a00ba53cc5ef858056dc0cb20e3b2",
+    "README.md": "cf23af0d5732b986f63655295688e84c4ac24be2605f32ee55c52fc4ab80e75a",
+    "generation-quality.json": "d85052d36245473287c2de14b11f4851006097694ffbe32ceed8bf1cd83fef6d"
+  },
+  "boundary": "Emitted Python 3.13 source, real cryptographic/ASGI tests with scripted provider key/model/policy transport and denied external sockets; native Terraform schemas and mock plans. No container image startup/scan, provider account plan, identity sign-in/MFA/revocation, real model-quality test or deployment."
+}

package/specs/028-convergence-evaluation/evidence/20261110-invoice-runtime/durable-current/receipt.json

@@ -0,0 +1,61 @@
+{
+  "kind": "local-durable-workflow-core",
+  "recordedAt": "2026-11-09T23:58:36.893280+00:00",
+  "passed": true,
+  "tests": 54,
+  "seconds": 12.997,
+  "python": "3.13.14 (main, Jun 10 2026, 12:24:04) [Clang 21.0.0 (clang-2100.0.123.102)]",
+  "postgresVersion": "17.11",
+  "schemaVersion": 1,
+  "schemaSha256": "fe15a655c14eeda37bc3e4e60f0270de7bcb86d79ea9da4577246dca15806e59",
+  "queueVersion": "3.10.0",
+  "sourceHashes": {
+    "scripts/initialize-durable-fixture.py": "1bbca33ca680b2ed69f75ccc9da2bdd8aaf02c79e00a6b9979f71f1c88ace82f",
+    "scripts/qualify-durable-runtime.py": "a106ff913b0146b108b3d94a5199b4abe8011fcc7f72a9d1113cc6c886424b8a",
+    "scripts/setup-durable-runtime.py": "d916a93910a1ac2e24ac63f6ab96561f0a5d98727383b010376f3d467271131f",
+    "scripts/start-durable-fixture.py": "eb4f609c5bd00bde2ca560d495f80c62fdf88088a65bf564239ee216d991a2cc",
+    "src/runtime/approved_http_destination.py": "dbe62ce035d16c8e2988d2672d25be8597d963bab6b0fc969aa59b240d0aa442",
+    "src/runtime/durable-python-lock.json": "dbaa350d227c74f4acf046a27d878f3fa78ce762a5c58ba832b70c20a083cf87",
+    "src/runtime/durable_workflow.py": "5d31e1de487d2522c706cfbebcad5e880ce762a859b8804b23e86bb3df074675",
+    "src/runtime/postgres-qualification-lock.json": "bc475f763854dc4b1ea3afc930ad312aad1b76d93f69fad8244207c6aadf0b45",
+    "src/runtime/workflow_contract.py": "e662aeb89bcd4eac9c34b32b6a154de8a1758ae089eee71f0642d27e1b413eb4",
+    "src/runtime/workflow_database.py": "178b03c7b10bd56b6eb431366b57416dc8059db1a2cec4657de2f2c4cc8d0799",
+    "src/runtime/workflow_errors.py": "753d82e5a788ac459cb2b106c078af86cd90077886cda42767a36f62159fd19b",
+    "src/runtime/workflow_process_stage.py": "b1d6f7fd8aa679107f2ae4c1ec885c1693ee84422e6cb1af20d6f43a06ff31f6",
+    "src/runtime/workflow_schema.sql": "fe15a655c14eeda37bc3e4e60f0270de7bcb86d79ea9da4577246dca15806e59",
+    "src/runtime/workflow_worker.py": "c1a6f368eb42128a9648f4c324a5891c87daf6b9723951e74fb3f07963640f69",
+    "tests/runtime/durable_crash_acceptance.py": "bd1c0acd58972da8b04db1b2d0f0fa570a2223791ce399ebe750d59f1d92e197",
+    "tests/runtime/durable_fixture_tasks.py": "f9a20d3aad51ab69e4e4092c20d6f84b097fcbef5c9a3eccf4baa0420cd82515",
+    "tests/runtime/durable_http_acceptance.py": "4ef564c4e4a1120867789f48d85d21e5d19f06a978e5c01cb5a3ec96ddb75c17",
+    "tests/runtime/durable_postgres_acceptance.py": "6e8a9d26eb41611963245ab8d4fad3767d908843050ca47021128a9c55d94be3",
+    "tests/runtime/durable_privileges_acceptance.py": "fff2903ef7c7a9f951e980691f6e812b0dc55f0bece9d08b100c01282e730ebb",
+    "tests/runtime/durable_recovery_acceptance.py": "008ddb5739ac6a4d71f20e374ffb69ccf04a9f18bb2225b12367cdf6763dcaf9",
+    "tests/runtime/durable_restricted_worker_acceptance.py": "2934ffab683c87d3467f6a74ede7ae6c1b00613c53de900b7dc3d8f706168f77",
+    "tests/runtime/durable_stage_acceptance.py": "56319b3d6ff64bddc84a27535d495f41fd5a42c29be62221940198203f05acee",
+    "tests/runtime/durable_tls_deadline_acceptance.py": "65f28bb754b6ca944353623afb39a4665705d8c09fd0cb9763e35a935d759ed1",
+    "tests/runtime/durable_worker_acceptance.py": "9f8bcce3760186a37c8ca35b8ca8d7de14f0ba49f0dd6691fac178fd4cff55aa",
+    "tests/runtime/durable_worker_process.py": "ab224adac36773db78cc7f732319a03ea31c1a8153b791c75a0189d5aee466f8",
+    "tests/runtime/invoice_document_acceptance.py": "a170a5af6aeedde0a86f516a50286bcaf3eb7bb743b97c38bc8c78e8a3331410",
+    "tests/runtime/invoice_extraction_acceptance.py": "783b00b4cb127cfe6594a0b22bc10ffc1ee68a03b477c60c87be1837e7b01bce",
+    "tests/runtime/invoice_http_acceptance.py": "078595b3e5c4f026916204e82b769b08dba73265a7bd99b9b2d3e129346112ab",
+    "tests/runtime/invoice_storage_acceptance.py": "b4a0ae395d3299353f1a97eac4989e5522e015f677605d4f2c24d1a4f202ef13",
+    "tests/runtime/workflow_stage_child_fixture.py": "14747c71b2b7bfbe71c6d05026dfb79c655f9d4b35af8439eaced4b3d57a3f50",
+    "tests/runtime/workflow_tls_destination_fixture.py": "9924ccafb80af31250d6f2fa9913731a46ba6ee9bc0b90661f2daa211944e79a"
+  },
+  "sourcesUnchangedDuringChecks": true,
+  "checks": [
+    {
+      "check": "dependency-check",
+      "exitCode": 0,
+      "log": "dependency-check.log"
+    },
+    {
+      "check": "workflow-acceptance",
+      "exitCode": 0,
+      "log": "workflow-acceptance.log"
+    }
+  ],
+  "evidenceBoundary": "Real local PostgreSQL, native queue workers, restricted local DB logins, SIGKILL replacements, loopback TLS and child process deadlines; synthetic processors and destinations. No native cloud/IdP/PDF/model/vendor, complete project, backup/restore, full matrix or deployment claim.",
+  "cloudOperations": false,
+  "full28CaseAcceptanceComplete": false
+}

package/specs/029-general-purpose-engine/evidence/20261111-runtime-dependencies/sdk/receipt.json

@@ -0,0 +1,22 @@
+{
+  "passed": true,
+  "catalogSha256": "7d5397350e80330d09d1b2a8e838936d82b0dc3159680d26d064f459b0a269af",
+  "artifactSha256": "4dbff53c715e9f644d41a82e4cdc9e61f45048d80be8af3c11bf0c7d7bfb3c69",
+  "oracleSha256": "f8c997f0ed93feb6a44738bc8fcf0aa62d8aa40668e7ac922354eecd38514af4",
+  "results": [
+    {
+      "runtime": "lambda-python312-tests",
+      "status": "passed",
+      "imageId": "sha256:cdb746c1eb56b61de56e1b5e78f6194392eb00494a1bb257a592852e72d8314b",
+      "platform": "linux/arm64"
+    },
+    {
+      "runtime": "python-tests",
+      "status": "passed",
+      "imageId": "sha256:48d884813cf44e927cf64c5529dd630dd3b18338c6dc727991eef9b71e934a20",
+      "platform": "linux/amd64"
+    }
+  ],
+  "cloudOperations": false,
+  "scope": "Pinned pure-Python wheel dependency closure with explicit selected botocore service data, actual Lambda Python3.12 ARM64 and Python3.13 AMD64 execution. SDK operation/model/endpoints and local signed GET/mode/timestamp/denial/throttle/failure/one-attempt timeout contracts. This is SDK artifact qualification, not generated application safety gates, cloud account state, deployment or all-SDK service compatibility."
+}

package/src/ArchitectureActivity.jsx

@@ -0,0 +1,54 @@
+import {BrainActivity} from './BrainActivity.jsx';
+import React,{useEffect,useRef,useState,useId} from 'react';
+import {mergeArchitectureActivity,readArchitectureActivity} from './architecture-activity.mjs';
+import {architectureSteps,architectureActivityLabel} from './activity-presentation.mjs';
+import {ChatMessage} from './ChatMessage.jsx';
+import './architecture-activity.css';
+// A view of observed work, never a completion claim about the client's system.
+function TurnActivity({label,latest,steps=[],model,effort,working=false,failed=false,open,onOpenChange,onStop,children}){
+ const [expanded,setExpanded]=useState(false),id=useId();const shown=open??expanded;
+ const change=value=>{setExpanded(value);onOpenChange?.(value);};
+ useEffect(()=>{if(failed)change(true);},[failed]);
+ return <div className={'turn-activity'+(failed?' has-error':'')}>
+  <div className="turn-activity-row">
+   <button type="button" className="turn-activity-toggle" aria-expanded={shown} aria-controls={id} title={[model,effort].filter(Boolean).join(' · ')} onClick={()=>{change(!shown);}}>
+    <span aria-hidden="true" className={'turn-state-icon'+(working?' has-brain':'')}>{working?<BrainActivity size={22}/>:failed?'!':'›'}</span>
+    <span className="turn-activity-label" role="status" aria-live="polite">{label}</span>{latest&&<span className="turn-latest"> · {latest}</span>}
+    <span className="turn-chevron" aria-hidden="true">{shown?'⌄':'›'}</span>
+   </button>
+   {onStop&&working&&<button type="button" className="turn-inline-action" onClick={onStop}>Stop</button>}
+  </div>
+  <div id={id} hidden={!shown} className="turn-activity-details">
+   {(model||effort)&&<p className="turn-selection">{[model,effort].filter(Boolean).join(' · ')}</p>}
+   <ol>{steps.map(step=><li key={step.id} data-step={step.id}>{step.message?<ChatMessage text={step.text}/>:<p>{step.text}</p>}{step.detail&&<small>{step.detail}</small>}</li>)}</ol>
+   {children}
+  </div>
+ </div>;
+}
+
+export function ArchitectureTurn({turn,projectId,session,active,working,onStop,historyNumber}){
+ const [open,setOpen]=useState(false),[events,setEvents]=useState([]),[status,setStatus]=useState(null),[error,setError]=useState('');const cursor=useRef(0),observed=useRef([]);
+ useEffect(()=>{
+  if((!open&&!active)||!session?.architectureActivityEnabled)return;
+  let stopped=false,timer;const controller=new AbortController();
+  async function poll(){try{
+   const value=await readArchitectureActivity(session,projectId,turn.id,cursor.current,controller.signal);
+   if(stopped)return;const merged=mergeArchitectureActivity(observed.current,value.events);observed.current=merged;setEvents(merged);setStatus(value.state);setError('');
+   if(value.events.length)cursor.current=value.events.at(-1).sequence;
+   if(value.state==='running'||value.events.length===200)timer=setTimeout(poll,value.events.length===200?0:700);
+  }catch(e){if(!stopped&&e.name!=='AbortError'){setError(e.status===404?'Details not recorded for this turn.':e.message);if(e.status===404&&working)timer=setTimeout(poll,1000);}}}
+  void poll();return()=>{stopped=true;controller.abort();clearTimeout(timer);};
+ },[open,active,projectId,turn.id,turn.clientStatus,session?.token,session?.architectureActivityEnabled,working]);
+ const steps=architectureSteps(events),label=architectureActivityLabel(turn,status,active),failed=status==='failed'||turn.clientStatus==='failed';
+ return <div className="conversation-activity" data-turn={turn.id}><TurnActivity label={historyNumber?'Activity '+historyNumber+' · '+label:label} latest={active?steps.at(-1)?.text:undefined} steps={steps} model={turn.model} effort={turn.effort} working={active} failed={failed} open={open} onOpenChange={setOpen} onStop={active?onStop:undefined}>
+  {error&&<p role="status">{error}</p>}
+  {!session?.architectureActivityEnabled&&<p>Live details are unavailable from this service. The reply remains in chat.</p>}
+  {turn.detailsAvailable===false&&<p>Some activity details were not recorded. The returned response remains in chat.</p>}
+ </TurnActivity></div>;
+}
+export function EarlierArchitectureActivity({entries,projectId,session}){
+ const [open,setOpen]=useState(false);
+ return <details className="legacy-activity" open={open} onToggle={e=>setOpen(e.currentTarget.open)}><summary>{entries.length} earlier {entries.length===1?'turn':'turns'} · activity history</summary>
+  {open&&<><p>Recorded before activity was linked to individual replies.</p>{entries.toReversed().map(({turn,number})=><ArchitectureTurn key={projectId+':'+turn.id} turn={turn} projectId={projectId} session={session} active={false} working={false} historyNumber={number}/>)}</>}
+ </details>;
+}

package/src/ArchitectureWorkPanel.jsx

@@ -0,0 +1,39 @@
+import React,{useState,useMemo} from 'react';
+import {architectureWork,workContextIdentity} from './architecture-work.mjs';
+import {artifactWorkProjection} from './artifact-work.mjs';
+const labels={current:'Context current',changed:'Review again',missing:'Missing reference',unreviewed:'Not reviewed'};
+function WorkPanel({project,onChange,busy=false}){
+ const [error,setError]=useState('');
+ const result=useMemo(()=>{try{return {model:project?architectureWork(project):null,artifacts:project?artifactWorkProjection(project):null};}catch(e){return {error:e.message};}},[project]);
+ if(!project)return null;
+ if(result.error)return <p role="alert">Work context could not be read: {result.error}</p>;
+ const model=result.model;
+ const intents=model.entities.filter(e=>e.kind==='intent'&&e.value?.text?.trim()).length,requirements=model.entities.filter(e=>e.kind==='requirement').length;
+ const sourceName=id=>model.entities.find(e=>e.id===id)?.title||project.extensions?.architectureWork?.snapshots.findLast(s=>s.ref===id)?.value.title||id;
+ const priority={changed:0,missing:0,unreviewed:1,current:2};
+ const mappings=model.entities.filter(e=>['responsibility','delivery-unit','interface','implementation','assumption','decision','evidence','requirement','removed'].includes(e.kind)).sort((a,b)=>priority[a.contextStatus]-priority[b.contextStatus]);
+ function apply(change){onChange(change,project.id);setError('');}
+ return <details className="architecture-work"><summary>Architecture work context · {mappings.filter(e=>e.contextStatus==='changed'||e.contextStatus==='missing').length} need review</summary>
+  <p>Requirements, responsibilities, interfaces and implementation mappings share their change context. A current context is a recorded review; it does not establish that an implementation or test passed.</p>
+  <p>{intents} intent {intents===1?'source':'sources'} · {requirements} {requirements===1?'requirement':'requirements'}. Free-form engineering updates affect every mapping until reconciled.</p>
+  {mappings.length?<ul aria-label="Architecture work mappings">{mappings.map(e=><li key={e.id} data-work-ref={e.id}>
+   <strong>{e.title}</strong><span> · {e.kind} · {labels[e.contextStatus]}</span>
+   {e.value&&<details><summary>Sources and mapping details</summary><pre>{JSON.stringify({value:e.value,dependsOn:e.dependsOn,review:e.review},null,2)}</pre></details>}
+   {e.value?.source&&<small> · {e.value.source} · {e.value.agreement||'recorded'}</small>}
+   {e.changedRefs.length>0&&<p>Changed: {e.changedRefs.map(sourceName).join(', ')}</p>}
+   {e.missingRefs.length>0&&<p>Missing: {e.missingRefs.map(sourceName).join(', ')}</p>}
+   {onChange&&e.contextStatus!=='missing'&&<button disabled={busy} onClick={()=>{try{apply({kind:'review',ref:e.id,expectedContext:workContextIdentity(project,e.id)});}catch(e){setError(e.message);}}}>Record context review: {e.title}</button>}
+  </li>)}</ul>:<p>No responsibilities or implementation mappings recorded yet. Engineering can propose them without changing the existing diagram.</p>}
+  {result.artifacts.mappings.length>0&&<section aria-label="Linked artifact mappings">
+   <h3>Linked artifacts</h3><p>File and context references remain proposed. They do not establish that a test passed or that the implementation meets every requirement.</p>
+   <ul>{result.artifacts.mappings.map(m=><li key={m.id} data-artifact-mapping={m.artifactId}>
+    <strong>{m.contextStatus==='current'?'Saved context matches':m.contextStatus==='superseded'?'Earlier artifact retained':'Design changed; regenerate mappings'}</strong>
+    <span> · {m.records.length} proposed mappings · context revision {m.contextRevision}</span>
+    <details><summary>Artifact and file references</summary><pre>{JSON.stringify({artifactId:m.artifactId,artifactSha256:m.artifactSha256,contextSha256:m.contextSha256,files:m.files,changedRefs:m.changedRefs,scope:m.scope},null,2)}</pre></details>
+   </li>)}</ul>
+  </section>}
+  {error&&<p role="alert">{error}</p>}
+ </details>;
+}
+
+export const ArchitectureWorkPanel=React.memo(WorkPanel);

package/src/ArtifactChecks.jsx

@@ -0,0 +1,49 @@
+import React,{useEffect,useRef,useState} from 'react';
+import {engineeringCall} from './engineering-client.mjs';
+
+export function ArtifactChecks({session,projectId,sessionId,artifact,readOnly=false}){
+  const [catalog,setCatalog]=useState([]),[available,setAvailable]=useState(false),[checks,setChecks]=useState([]),
+    [error,setError]=useState(''),[busy,setBusy]=useState(false);
+  const live=useRef(true),locked=useRef(false);
+  const payload={projectId,sessionId,artifactId:artifact.id};
+  useEffect(()=>{live.current=true;return()=>{live.current=false;};},[]);
+  useEffect(()=>{
+    const controller=new AbortController();let stopped=false,timer;
+    async function poll(){try{
+      const [configuration,result]=await Promise.all([
+        engineeringCall(session,'validators',{projectId,sessionId},{signal:controller.signal}),
+        engineeringCall(session,'validation/list',payload,{signal:controller.signal})]);
+      if(stopped)return;
+      setCatalog(configuration.validators);setAvailable(configuration.available);setChecks(result.checks);
+    }catch(e){if(!stopped&&e.name!=='AbortError')setError(e.message);}
+    finally{if(!stopped)timer=setTimeout(poll,1200);}}
+    void poll();return()=>{stopped=true;clearTimeout(timer);controller.abort();};
+  },[projectId,sessionId,artifact.id,session.token]);
+  async function act(action,values){
+    if(locked.current)return;locked.current=true;setBusy(true);setError('');
+    try{const body=action==='validation/recover'?{projectId,sessionId,...values}:{...payload,...values};const result=await engineeringCall(session,action,body);if(live.current)setChecks(current=>[...current.filter(check=>check.id!==result.id),result]);}
+    catch(e){if(live.current)setError(e.message);}finally{locked.current=false;if(live.current)setBusy(false);}
+  }
+  return <section className="artifact-checks" aria-label="Captured package checks">
+    <h3>Check results</h3>
+    {!available&&<p>Independent checks have not run: no check runner is configured.</p>}
+    {!readOnly&&catalog.map(validator=>{
+      const previous=checks.filter(check=>check.validatorId===validator.id&&check.contractSha256===validator.contractSha256).at(-1);
+      const active=previous&&previous.state!=='finished';
+      return <button key={validator.id} disabled={busy||!available||validator.available===false||active} onClick={()=>void act('validation/start',{validatorId:validator.id,retry:!!previous})}>
+        {previous?.state==='finished'?'Run again: ':''}{validator.label}{validator.available===false?' · unavailable':''}{active?' · '+previous.state:''}
+      </button>;
+    })}
+    <ol>{checks.map(check=>{
+      const definition=catalog.find(validator=>validator.id===check.validatorId),outdated=!definition||(definition.contractSha256!=null&&definition.contractSha256!==check.contractSha256);
+      return <li key={check.id}>
+        <strong>{check.label} · {check.state==='finished'?check.result?.status||'incomplete':check.state.replaceAll('_',' ')}</strong>
+        {outdated&&<p>From a previous check definition; retained as historical evidence.</p>}
+        {check.result?.testsReported!=null&&<p>{check.result.testsReported} tests reported · {check.result.skipped||0} skipped</p>}
+        {!readOnly&&check.state==='recovery_required'&&<button disabled={busy} onClick={()=>void act('validation/recover',{checkId:check.id})}>Recover check</button>}
+        {check.result&&<><details><summary>Check output</summary><pre>{check.result.output||check.result.reason||'No output reported.'}</pre></details></>}
+      </li>;
+    })}</ol>
+    {error&&<p role="alert">{error}</p>}
+  </section>;
+}

package/src/BlockRequirements.jsx

@@ -0,0 +1,13 @@
+import React,{useState} from 'react';
+function RequirementCard({requirement,busy,onSave}){
+ const [editing,setEditing]=useState(false),[text,setText]=useState(requirement.statement),[error,setError]=useState('');
+ async function save(e){e.preventDefault();try{await onSave(requirement.id,text);setEditing(false);setError('');}catch(e){setError(e.message);}}
+ return <article className="block-requirement" aria-label={`Requirement ${requirement.id}`}>
+  {editing?<form onSubmit={save}><label>Requirement<textarea aria-label="Requirement text" maxLength={1000} value={text} onChange={e=>setText(e.target.value)}/></label><div className="block-review-actions"><button className="btn primary" disabled={busy||!text.trim()}>Save & re-evaluate</button><button type="button" className="btn ghost" disabled={busy} onClick={()=>setEditing(false)}>Cancel</button></div>{error&&<p role="alert">{error}</p>}</form>:<><p>{requirement.statement}</p><button className="link" disabled={busy} onClick={()=>{setText(requirement.statement);setEditing(true);}}>Edit requirement</button></>}
+  {requirement.measure&&<small>Acceptance target: {requirement.measure.metric} {requirement.measure.op} {String(requirement.measure.target)} {requirement.measure.unit}</small>}
+ </article>;
+}
+export function BlockRequirements({project,nodeId,busy,onSave}){
+ const needs=(project.needs||[]).filter(r=>r.links?.includes(nodeId));
+ return <section className="block-requirements" aria-label="Block requirements"><strong>Requirements for this block</strong>{needs.length?needs.map(r=><RequirementCard key={r.id} requirement={r} busy={busy} onSave={onSave}/>):<p className="muted">No requirements linked yet.</p>}<small>Saving updates local checks and requests an Architect review when connected. Linked blocks will need review again.</small></section>;
+}

package/src/BrainActivity.jsx

@@ -0,0 +1,11 @@
+import React,{useId} from 'react';
+// Brain artwork supplied by the user. Crop the wordmark for legibility at icon size.
+export function BrainActivity({size=24,active=true}){
+ const mask=useId();
+ return <svg className={`brain-activity${active?' is-active':''}`} width={size} height={size} viewBox="-150 -135 300 255" aria-hidden="true" focusable="false">
+  <defs><mask id={mask} maskUnits="userSpaceOnUse" x="-200" y="-200" width="400" height="400"><rect x="-200" y="-200" width="400" height="400" fill="#fff"/>{[false,true].map(mirror=><path key={String(mirror)} d="M124 -31 Q98 -30 90 -54 M79 -88 Q72 -66 50 -60" transform={mirror?'scale(-1 1)':undefined} stroke="#000" strokeWidth="9" strokeLinecap="round" fill="none"/>)}</mask></defs>
+  <g mask={`url(#${mask})`} fill="#F3A2B4">{[false,true].map(mirror=><path key={String(mirror)} d="M7 -104 A41.2 41.2 0 0 1 78.8 -87.95 A40.71 40.71 0 0 1 124.2 -31.16 A38 38 0 0 1 116.93 36.3 A42.22 42.22 0 0 1 60.09 85.83 A29.75 29.75 0 0 1 7 84 Z" transform={mirror?'scale(-1 1)':undefined}/>)}</g>
+  {[-47,47].map(x=><g key={x}><circle cx={x} cy="26" r="35" fill="#F3F7F7" stroke="#101314" strokeWidth="12"/><circle cx={x+5} cy="21" r="10.5" fill="#101314"/></g>)}
+  <path d="M-12 18 Q0 0 12 18" fill="none" stroke="#101314" strokeWidth="12" strokeLinecap="round"/>
+ </svg>;
+}

package/src/ChatMessage.jsx

@@ -0,0 +1,29 @@
+import React, {useId, useState} from 'react';
+// Small, non-HTML Markdown renderer: no remote images, raw HTML or executable URLs.
+function inline(text){return text.split(/(\*\*[^*]+\*\*|`[^`]+`|\[[^\]]+\]\(https?:\/\/[^\s)]+\))/g).map((part,i)=>{
+ if(part.startsWith('**')&&part.endsWith('**'))return <strong key={i}>{part.slice(2,-2)}</strong>;
+ if(part.startsWith('`')&&part.endsWith('`'))return <code key={i}>{part.slice(1,-1)}</code>;
+ const link=part.match(/^\[([^\]]+)\]\((https?:\/\/[^\s)]+)\)$/);if(link)return <a key={i} href={link[2]} target="_blank" rel="noopener noreferrer">{link[1]}</a>;
+ return part;
+});}
+export function messagePreview(text){
+ const words=text.trim().split(/\s+/);if(words.length<=20)return text;
+ const questions=text.split(/\n+/).map(line=>line.trim()).filter(line=>line.includes('?')).map(line=>line.match(/(?:^|[.!]\s+)([^.!]*\?)/)?.[1]||line.slice(0,line.indexOf('?')+1));
+ const question=questions.at(-1);if(question&&question.split(/\s+/).length<=20)return question;
+ return words.slice(0,20).join(' ')+'…';
+}
+export function ChatMessage({text='',concise=false}){
+ const [expanded,setExpanded]=useState(false);
+ const detailId=useId();
+ if(concise&&text.trim().split(/\s+/).length>20)return <div className="concise-answer"><div id={detailId}><ChatMessage text={expanded?text:messagePreview(text)}/></div><button type="button" className="link message-details" aria-expanded={expanded} aria-controls={detailId} onClick={()=>setExpanded(value=>!value)}>{expanded?'Less details':'More details'}</button></div>;
+
+ const lines=text.split('\n'),blocks=[];let i=0;
+ while(i<lines.length){
+  if(!lines[i].trim()){i++;continue;}
+  if(lines[i].startsWith('```')){const code=[];i++;while(i<lines.length&&!lines[i].startsWith('```'))code.push(lines[i++]);i++;blocks.push(<pre key={blocks.length}><code>{code.join('\n')}</code></pre>);continue;}
+  const heading=lines[i].match(/^#{1,6}\s+(.+)$/);if(heading){blocks.push(<h4 key={blocks.length}>{inline(heading[1])}</h4>);i++;continue;}
+  const list=lines[i].match(/^(?:[-*]|\d+[.)])\s+/);if(list){const ordered=/^\d/.test(list[0]),items=[];while(i<lines.length&&/^(?:[-*]|\d+[.)])\s+/.test(lines[i]))items.push(<li key={items.length}>{inline(lines[i++].replace(/^(?:[-*]|\d+[.)])\s+/,''))}</li>);blocks.push(ordered?<ol key={blocks.length}>{items}</ol>:<ul key={blocks.length}>{items}</ul>);continue;}
+  const paragraph=[];while(i<lines.length&&lines[i].trim()&&!/^(?:```|#{1,6}\s|[-*]\s|\d+[.)]\s)/.test(lines[i]))paragraph.push(lines[i++]);blocks.push(<p key={blocks.length}>{paragraph.map((line,j)=><React.Fragment key={j}>{j>0&&<br/>}{inline(line)}</React.Fragment>)}</p>);
+ }
+ return <div className="chat-markdown">{blocks}</div>;
+}

package/src/ChatResizeHandle.jsx

@@ -0,0 +1,6 @@
+import React from 'react';
+export function ChatResizeHandle({width,onChange}){
+ const max=()=>Math.max(320,Math.min(900,window.innerWidth-360));
+ const resize=value=>onChange(Math.round(Math.max(320,Math.min(max(),value))));
+ return <div className="chat-resize-handle" role="separator" aria-label="Resize chat panel" aria-orientation="vertical" aria-valuemin={320} aria-valuemax={max()} aria-valuenow={width} tabIndex={0} title="Drag to resize chat. Arrow keys resize; double-click resets." onDoubleClick={()=>resize(360)} onKeyDown={e=>{if(['ArrowLeft','ArrowRight','Home','End'].includes(e.key)){e.preventDefault();resize(e.key==='Home'?320:e.key==='End'?max():width+(e.key==='ArrowLeft'?32:-32));}}} onPointerDown={e=>{if(e.button!==0)return;e.preventDefault();e.currentTarget.setPointerCapture(e.pointerId);}} onPointerMove={e=>{if(e.currentTarget.hasPointerCapture(e.pointerId))resize(e.currentTarget.closest('.app').getBoundingClientRect().right-e.clientX);}} onPointerUp={e=>{if(e.currentTarget.hasPointerCapture(e.pointerId))e.currentTarget.releasePointerCapture(e.pointerId);}}/>;
+}