@topolo/cli 0.13.0 → 0.13.2

package/agent-packs/src/topolo_agent_pack/live.py

@@ -24,6 +24,7 @@ import urllib.parse
 import uuid
 
 from .storage import Library,PackError,atomic_json,canonical,read_json
+from .execution import load_gate, qualify_protocol
 
 def socket_path(lib):
     directory=pathlib.Path('/tmp')/('topolo-agent-pack-'+hashlib.sha256(str(lib.root).encode()).hexdigest()[:16])
@@ -68,11 +69,16 @@ class BackendProxy:
         self.pending=set();self.active_turns=set();self.initialized=False
         self.quiesced=False;self.output_task=None;self.closed=False
         self.token=secrets.token_hex(32);self.path=socket_path(lib)
+        self.execution=None;self.catalog_ready=asyncio.Event();self.catalog_id='topolo-catalog-'+uuid.uuid4().hex
+        self.catalog_rows=[];self.catalog_cursors=set()
 
     async def start_child(self):
         active=self.lib.active()
         if not active.get('runtime'): raise PackError('No selected managed runtime')
         self.runtime=active['runtime'];env=os.environ.copy()
+        self.execution=load_gate(self.runtime);self.catalog_ready.clear()
+        self.catalog_rows=[];self.catalog_cursors=set()
+        self.protocol=qualify_protocol(self.real) if self.execution else None
         env['CODEX_HOME']=str(pathlib.Path(self.runtime)/'home');env['CODEX_CLI_PATH']=self.real
         self.child=await asyncio.create_subprocess_exec(self.real,*self.args,env=env,stdin=asyncio.subprocess.PIPE,stdout=asyncio.subprocess.PIPE,limit=64*1024*1024)
         self.output_task=asyncio.create_task(self.output())
@@ -80,6 +86,23 @@ class BackendProxy:
     async def output(self):
         while line:=await self.child.stdout.readline():
             value=json.loads(line)
+            if value.get('id')==self.catalog_id:
+                self.pending.discard(self.catalog_id)
+                if self.execution and 'result' in value:
+                    result=value['result'];self.catalog_rows.extend(result['data'])
+                    cursor=result.get('nextCursor')
+                    if cursor:
+                        if cursor in self.catalog_cursors or len(self.catalog_cursors)>=20:
+                            self.execution.catalog={};self.catalog_ready.set();continue
+                        self.catalog_cursors.add(cursor)
+                        await self.request_catalog(cursor);continue
+                    self.execution.set_catalog({'data':self.catalog_rows})
+                self.catalog_ready.set();continue
+            if self.execution:
+                tracked=str(value.get('id')) in self.execution.pending
+                value=self.execution.reply(value);line=canonical(value)+b'\n'
+                if tracked:atomic_json(pathlib.Path(self.runtime)/'execution-proof.json',
+                                       {**self.execution.status(),'protocol':self.protocol})
             if 'id' in value and ('result' in value or 'error' in value):
                 self.pending.discard(str(value['id']))
                 if 'result' in value and isinstance(value['result'],dict) and 'userAgent' in value['result']: self.initialized=True
@@ -100,10 +123,34 @@ class BackendProxy:
                 raise PackError('Owned backend did not stop; no storage switch committed')
         if self.output_task: await self.output_task
 
+    async def forward(self,value):
+        if self.quiesced:
+            if 'id' in value:
+                sys.stdout.buffer.write(canonical({'id':value['id'],'error':{'code':-32000,'message':'Pack switch in progress; reconnecting backend'}})+b'\n');sys.stdout.buffer.flush()
+            return
+        if self.execution and value.get('method') in {'thread/resume','turn/start'} and (value.get('params') or {}).get('threadId') in self.execution.roles:
+            try:
+                await asyncio.wait_for(self.catalog_ready.wait(),10)
+                value=self.execution.prepare(value)
+            except (PackError,asyncio.TimeoutError) as exc:
+                sys.stdout.buffer.write(canonical({'id':value.get('id'),'error':{'code':-32000,'message':str(exc) or 'Native model catalog unavailable'}})+b'\n');sys.stdout.buffer.flush();return
+        if 'id' in value and 'method' in value:self.pending.add(str(value['id']))
+        self.child.stdin.write(canonical(value)+b'\n');await self.child.stdin.drain()
+        if self.execution and value.get('method')=='initialized':
+            await self.request_catalog()
+
+    async def request_catalog(self,cursor=None):
+        self.pending.add(self.catalog_id)
+        self.child.stdin.write(canonical({'id':self.catalog_id,'method':'model/list',
+            'params':{'includeHidden':True,**({'cursor':cursor} if cursor else {})}})+b'\n')
+        await self.child.stdin.drain()
+
     def status(self):
         return {'pid':os.getpid(),'childPid':self.child.pid if self.child else None,'desktopPid':os.getppid(),'runtime':self.runtime,
                 'quiesced':self.quiesced,'initialized':self.initialized,
-                'activeTurns':sorted(self.active_turns),'pendingRequests':len(self.pending)}
+                'activeTurns':sorted(self.active_turns),'pendingRequests':len(self.pending),
+                'executionPolicy':self.execution.status() if self.execution else {'state':'not-configured'},
+                'executionProtocol':self.protocol if self.execution else None}
 
     async def control(self,reader,writer):
         try:
@@ -141,13 +188,7 @@ class BackendProxy:
             await asyncio.get_running_loop().connect_read_pipe(lambda:protocol,sys.stdin.buffer)
             while line:=await reader.readline():
                 value=json.loads(line)
-                if self.quiesced:
-                    # No new model work may start between quiesce and reconnect.
-                    if 'id' in value:
-                        sys.stdout.buffer.write(canonical({'id':value['id'],'error':{'code':-32000,'message':'Pack switch in progress; reconnecting backend'}})+b'\n');sys.stdout.buffer.flush()
-                    continue
-                if 'id' in value and 'method' in value: self.pending.add(str(value['id']))
-                self.child.stdin.write(line);await self.child.stdin.drain()
+                await self.forward(value)
         finally:
             await self.stop_child();server.close();await server.wait_closed()
             record=read_json(self.lib.root/'live-bridge.json',{})

package/agent-packs/src/topolo_agent_pack/policy.py

@@ -0,0 +1,92 @@
+"""Portable per-role execution intent, distinct from harness-applied settings.
+
+Rendering a policy never changes a session, permission grant, or pack revision.
+Adapters must independently apply and read back every required setting.
+"""
+import copy
+
+from .storage import PackError, component_key
+
+
+GROUPS = {'specialists': 'Topolo Specialists', 'operators': 'Topolo Operators',
+          'operator-skills': 'Operator Skills'}
+DEEP_ROLES = {'product-direction-01', 'product-direction-02', 'system-architecture-01',
+              'system-architecture-02', 'architecture', 'security-permissions-review',
+              'adversarial-qa', 'incident-triage', 'release-recovery', 'execution-readiness',
+              'privacy-and-agreement-review', 'workflow-integration-specialist',
+              'financial-evidence-specialist', 'accounting-evidence-review',
+              'access-and-privacy'}
+BUILD_ROLES = {'build-01', 'build-02', 'build-03', 'developer-environment-steward',
+               'platform-package-steward', 'worktree-retirement'}
+PROFILES = {
+    'intake': {'tier': 'reasoning', 'effort': 'medium', 'localAccess': 'read-only'},
+    'analysis': {'tier': 'reasoning', 'effort': 'high', 'localAccess': 'read-only'},
+    'review': {'tier': 'workhorse', 'effort': 'high', 'localAccess': 'read-only'},
+    'build': {'tier': 'workhorse', 'effort': 'high', 'localAccess': 'workspace-write'},
+    'operator': {'tier': 'workhorse', 'effort': 'medium', 'localAccess': 'workspace-write'},
+}
+MODELS = {'codex': {'reasoning': 'gpt-6-astra', 'workhorse': 'gpt-6.1-sol'},
+          'claude': {'reasoning': 'claude-opus-5-5', 'workhorse': 'claude-sonnet-5-5'}}
+
+
+def role_profile(agent):
+    explicit = agent.get('executionProfile')
+    if explicit is not None:
+        if explicit not in PROFILES:
+            raise PackError('Unknown execution profile for ' + component_key(agent))
+        return explicit
+    if agent['set'] == 'intakes':
+        return 'intake'
+    if agent['id'] in DEEP_ROLES:
+        return 'analysis'
+    if agent['id'] in BUILD_ROLES:
+        return 'build'
+    if agent['set'] == 'specialists':
+        return 'review'
+    return 'operator'
+
+
+def settings(agent, harness):
+    if harness not in MODELS:
+        raise PackError('Execution settings adapter is not qualified: ' + harness)
+    profile = role_profile(agent)
+    spec = PROFILES[profile]
+    model = MODELS[harness][spec['tier']]
+    if harness == 'codex':
+        native = {'model': model, 'model_reasoning_effort': spec['effort'],
+                  'approval_policy': 'on-request', 'approvals_reviewer': 'user',
+                  'sandbox_mode': spec['localAccess'],
+                  'sandbox_workspace_write': {'network_access': False, 'writable_roots': [],
+                                              'exclude_slash_tmp': True, 'exclude_tmpdir_env_var': True},
+                  'apps': {'_default': {'default_tools_approval_mode': 'writes'}}}
+    else:
+        native = {'model': model, 'effortLevel': spec['effort'],
+                  'permissions': {'defaultMode': 'acceptEdits' if profile == 'build' else 'default'}}
+    return {'profile': profile, 'nativeSettings': native,
+            'localAccessIntent': spec['localAccess'], 'applied': False,
+            # Claude Manual is an approval mode, not a read-only filesystem sandbox.
+            'requiresAdditionalLocalConfinement': harness == 'claude' and spec['localAccess'] == 'read-only'}
+
+
+def render(manifest, revision, agents, harnesses=('codex', 'claude')):
+    rows = []
+    for agent in agents:
+        rows.append({'key': component_key(agent), 'title': agent['title'],
+                     'sidebar': {'group': GROUPS.get(agent['set'], agent['set']),
+                                 'pinned': agent.get('pinned', False)},
+                     'harnesses': {h: settings(agent, h) for h in harnesses}})
+    return {'format': 'topolo-agent-execution-policy', 'schemaVersion': 1,
+            'pack': manifest['packId'], 'sourceRevision': revision, 'agents': rows,
+            'applied': False,
+            'contextPolicy': {'load': ['role charter', 'current task', 'relevant retrieved memory'],
+                              'sharedMemory': 'retrieve by task and user or organization scope',
+                              'history': 'preserve, do not copy between roles',
+                              'skills': 'load on demand', 'toolResults': 'bounded relevant excerpts',
+                              'idleModelTurns': False, 'backgroundPolling': False,
+                              'handoffs': 'one concise outcome with evidence references'},
+            'verification': {'required': ['session identity', 'sidebar membership', 'pins',
+                                          'model', 'effort', 'permissions', 'context identity'],
+                             'unsupportedSettings': 'refuse activation; never silently substitute'},
+            'authority': {'externalActions': 'existing human authorization and platform access controls',
+                          'packMembershipGrantsAuthority': False},
+            'profiles': copy.deepcopy(PROFILES)}