blun-king-cli 9.1.597 → 9.1.600

package/standard-skills/translate-native/integrations/website_localization_release_coordinator.py

@@ -19,13 +19,14 @@ from typing import Any, Callable, Mapping, Protocol
 
 
 SCHEMA = "blun.website-localization-release-coordinator.v1"
-EVIDENCE_REQUEST_SCHEMA = "blun.localization-quality-evidence-request.v5"
+EVIDENCE_REQUEST_SCHEMA = "blun.localization-quality-evidence-request.v14"
 EVIDENCE_RESPONSE_SCHEMA = "blun.localization-quality-evidence-response.v2"
 INDEPENDENT_MODEL_REVIEW_SCHEMA = "blun.independent-model-review.v1"
 EVIDENCE_STATE_SCHEMA = "blun.localization-quality-evidence-state.v1"
 TOKEN = re.compile(r"^[A-Za-z0-9_.:-]{1,256}$")
 ERROR_CODE = re.compile(r"^[a-z][a-z0-9_.-]{0,127}$")
 SHA256 = re.compile(r"^[0-9a-f]{64}$")
+REQUEST_ID = re.compile(r"^blun-l10n-evidence-[0-9a-f]{64}$")
 MAX_RECEIPT_LENGTH = 16_384
 MAX_ATTEMPTS = 20
 MAX_LEASE_SECONDS = 3_600
@@ -36,6 +37,18 @@ _EVIDENCE_COLUMNS = (
     "next_attempt_at", "lease_owner", "lease_token", "lease_expires_at",
     "last_error_code", "created_at", "updated_at",
 )
+EVIDENCE_REQUEST_IDENTITY_FIELDS = (
+    "schema", "evidence_revision", "event_id", "plan_id", "job_id",
+    "result_sha256", "source_sha256", "target_sha256", "source_locale",
+    "target_locale", "content_type", "glossary_version", "policy_version",
+    "provider", "software_version", "review_confidence", "quality_profile",
+    "commercial_profile", "commercial_review", "commercial_review_routing",
+    "commercial_review_routing_contract_sha256",
+    "commercial_review_routing_contract",
+    "commercial_review_resolution_contract_sha256",
+    "commercial_review_resolution_contract", "human_review_required",
+    "independent_review_required",
+)
 
 
 def _load_module(name: str, path: Path):
@@ -137,9 +150,14 @@ class QualityEvidenceRequest:
     source_text: str
     target_text: str
     review_confidence: dict[str, str]
-    quality_profile: dict[str, str]
+    quality_profile: dict[str, Any]
     commercial_profile: str | None
     commercial_review: dict[str, Any] | None
+    commercial_review_routing: dict[str, Any] | None
+    commercial_review_routing_contract_sha256: str | None
+    commercial_review_routing_contract: dict[str, Any] | None
+    commercial_review_resolution_contract_sha256: str | None
+    commercial_review_resolution_contract: dict[str, Any] | None
     human_review_required: bool
     independent_review_required: bool
 
@@ -213,6 +231,107 @@ def _hash(value: str) -> str:
     return hashlib.sha256(value.encode("utf-8")).hexdigest()
 
 
+def _request_id_for_payload(payload: dict[str, Any]) -> str:
+    identity = {
+        field: payload[field]
+        for field in EVIDENCE_REQUEST_IDENTITY_FIELDS
+    }
+    return "blun-l10n-evidence-" + _hash(_canonical_json(identity))
+
+
+def _validated_request_payload(request: Any) -> dict[str, Any]:
+    if not isinstance(request, QualityEvidenceRequest):
+        raise LocalizationReleaseCoordinatorBlocked("evidence.request.invalid")
+    try:
+        payload = request.as_payload()
+    except Exception:
+        raise LocalizationReleaseCoordinatorBlocked("evidence.request.invalid") from None
+    if (
+        not isinstance(payload, dict)
+        or set(payload) != set(EVIDENCE_REQUEST_IDENTITY_FIELDS) | {
+            "request_id", "source_text", "target_text",
+        }
+        or payload.get("schema") != EVIDENCE_REQUEST_SCHEMA
+        or payload.get("request_id") != request.request_id
+        or not isinstance(request.request_id, str)
+        or REQUEST_ID.fullmatch(request.request_id) is None
+        or not isinstance(payload.get("source_text"), str)
+        or not isinstance(payload.get("target_text"), str)
+        or not isinstance(payload.get("source_sha256"), str)
+        or not isinstance(payload.get("target_sha256"), str)
+        or SHA256.fullmatch(payload["source_sha256"]) is None
+        or SHA256.fullmatch(payload["target_sha256"]) is None
+        or _hash(payload["source_text"]) != payload["source_sha256"]
+        or _hash(payload["target_text"]) != payload["target_sha256"]
+    ):
+        raise LocalizationReleaseCoordinatorBlocked("evidence.request.invalid")
+    if request.request_id != _request_id_for_payload(payload):
+        raise LocalizationReleaseCoordinatorBlocked(
+            "evidence.request_id.binding_mismatch",
+        )
+    commercial_review = payload["commercial_review"]
+    commercial_profile = payload["commercial_profile"]
+    try:
+        current_routing_contract = (
+            _CMS._COMMERCIAL.public_review_routing_contract(
+                commercial_profile,
+            )
+            if isinstance(commercial_profile, str)
+            and isinstance(commercial_review, dict)
+            else None
+        )
+        expected_routing_contract_sha256 = (
+            current_routing_contract["sha256"]
+            if current_routing_contract is not None
+            else None
+        )
+    except (KeyError, TypeError, ValueError):
+        raise LocalizationReleaseCoordinatorBlocked(
+            "evidence.request.invalid",
+        ) from None
+    expected_routing_contract = (
+        current_routing_contract
+        if isinstance(commercial_review, dict)
+        and commercial_review.get("status") == "review_required"
+        else None
+    )
+    if (
+        payload["commercial_review_routing_contract_sha256"]
+        != expected_routing_contract_sha256
+        or payload["commercial_review_routing_contract"]
+        != expected_routing_contract
+        or (
+            payload["commercial_review_routing"] is None
+        ) != (expected_routing_contract is None)
+    ):
+        raise LocalizationReleaseCoordinatorBlocked("evidence.request.invalid")
+    try:
+        expected_resolution_contract = (
+            _CMS._COMMERCIAL.public_review_resolution_contract(
+                commercial_profile,
+            )
+            if isinstance(commercial_review, dict)
+            and commercial_review.get("status") == "review_required"
+            else None
+        )
+    except (KeyError, TypeError, ValueError):
+        raise LocalizationReleaseCoordinatorBlocked(
+            "evidence.request.invalid",
+        ) from None
+    if (
+        payload["commercial_review_resolution_contract"]
+        != expected_resolution_contract
+        or payload["commercial_review_resolution_contract_sha256"]
+        != (
+            expected_resolution_contract["sha256"]
+            if expected_resolution_contract is not None
+            else None
+        )
+    ):
+        raise LocalizationReleaseCoordinatorBlocked("evidence.request.invalid")
+    return payload
+
+
 def _token(value: Any, code: str) -> str:
     if not isinstance(value, str) or TOKEN.fullmatch(value) is None:
         raise LocalizationReleaseCoordinatorBlocked(code)
@@ -309,15 +428,17 @@ class QualityEvidenceStateStore:
 
     @staticmethod
     def _binding(request: QualityEvidenceRequest) -> tuple[str, ...]:
-        if not isinstance(request, QualityEvidenceRequest):
-            raise LocalizationReleaseCoordinatorBlocked("evidence.request.invalid")
+        payload = _validated_request_payload(request)
         values = (
-            _token(request.request_id, "evidence.request_id.invalid"),
-            _token(request.event_id, "coordinator.event_id.invalid"),
-            _token(request.plan_id, "evidence.plan_id.invalid"),
-            _token(request.job_id, "evidence.job_id.invalid"),
-            request.result_sha256,
-            _token(request.evidence_revision, "coordinator.evidence_revision.invalid"),
+            payload["request_id"],
+            _token(payload["event_id"], "coordinator.event_id.invalid"),
+            _token(payload["plan_id"], "evidence.plan_id.invalid"),
+            _token(payload["job_id"], "evidence.job_id.invalid"),
+            payload["result_sha256"],
+            _token(
+                payload["evidence_revision"],
+                "coordinator.evidence_revision.invalid",
+            ),
         )
         if not isinstance(values[4], str) or SHA256.fullmatch(values[4]) is None:
             raise LocalizationReleaseCoordinatorBlocked("evidence.result_sha256.invalid")
@@ -656,6 +777,25 @@ def _request(
     result_sha256: str,
     evidence_revision: str,
 ) -> QualityEvidenceRequest:
+    commercial_profile = job.as_payload().get("commercial_profile")
+    commercial_review = json.loads(_canonical_json(result["commercial_review"]))
+    commercial_review_routing = json.loads(_canonical_json(
+        result["commercial_review_routing"],
+    ))
+    routing_contract = (
+        _CMS._COMMERCIAL.public_review_routing_contract(commercial_profile)
+        if commercial_profile is not None
+        and commercial_review["status"] == "review_required"
+        else None
+    )
+    resolution_contract = (
+        _CMS._COMMERCIAL.public_review_resolution_contract(
+            commercial_profile,
+        )
+        if commercial_profile is not None
+        and commercial_review["status"] == "review_required"
+        else None
+    )
     binding = {
         "schema": EVIDENCE_REQUEST_SCHEMA,
         "evidence_revision": evidence_revision,
@@ -674,12 +814,24 @@ def _request(
         "software_version": result["software_version"],
         "review_confidence": json.loads(_canonical_json(result["review_confidence"])),
         "quality_profile": json.loads(_canonical_json(result["quality_profile"])),
-        "commercial_profile": job.as_payload().get("commercial_profile"),
-        "commercial_review": json.loads(_canonical_json(result["commercial_review"])),
+        "commercial_profile": commercial_profile,
+        "commercial_review": commercial_review,
+        "commercial_review_routing": commercial_review_routing,
+        "commercial_review_routing_contract_sha256": result[
+            "commercial_review_routing_contract_sha256"
+        ],
+        "commercial_review_routing_contract": routing_contract,
+        "commercial_review_resolution_contract_sha256": (
+            result["commercial_review_resolution_contract_sha256"]
+            if commercial_review is not None
+            and commercial_review["status"] == "review_required"
+            else None
+        ),
+        "commercial_review_resolution_contract": resolution_contract,
         "human_review_required": result["human_review_required"],
         "independent_review_required": result["independent_review_required"],
     }
-    request_id = "blun-l10n-evidence-" + _hash(_canonical_json(binding))
+    request_id = _request_id_for_payload(binding)
     return QualityEvidenceRequest(
         **binding,
         request_id=request_id,
@@ -692,6 +844,7 @@ def _obtain_evidence(
     provider: Any,
     request: QualityEvidenceRequest,
 ) -> tuple[str, str | None, dict[str, Any] | None]:
+    _validated_request_payload(request)
     obtain = getattr(provider, "obtain", None)
     if not callable(obtain):
         raise LocalizationReleaseCoordinatorBlocked("evidence.provider.invalid")
@@ -949,6 +1102,8 @@ def run_next_release(
             quality_receipt,
             guarded_quality_verifier,
             approval_authority,
+            evidence_request_id=request.request_id,
+            evidence_revision=request.evidence_revision,
             now=approval_now,
             ttl_seconds=approval_ttl_seconds,
             human_review_receipt=human_receipt,

package/standard-skills/translate-native/integrations/website_localization_runner.py

@@ -136,6 +136,15 @@ def _retry_delay(attempt: int, base: float, maximum: float) -> float:
     return min(maximum, base * (2 ** min(attempt - 1, 30)))
 
 
+def _current_job_binding(payload: dict[str, Any]) -> bool:
+    """Return False only for an expected current-worker binding rejection."""
+    try:
+        _WORKER._validated_job(payload)
+    except _WORKER.LocalizationWorkerBlocked:
+        return False
+    return True
+
+
 def run_next_localization_job(
     queue: Any,
     worker_id: str,
@@ -177,6 +186,7 @@ def run_next_localization_job(
     claim_arguments = {
         "now": _now(clock),
         "lease_seconds": lease_seconds,
+        "binding_validator": _current_job_binding,
     }
     if eligible_plan_ids is not None:
         claim_arguments["eligible_plan_ids"] = eligible_plan_ids

package/standard-skills/translate-native/integrations/website_localization_worker.py

@@ -20,10 +20,10 @@ from pathlib import Path
 from typing import Any, Callable, Mapping, Protocol
 
 
-WORKER_SCHEMA = "blun.website-localization-worker.v4"
+WORKER_SCHEMA = "blun.website-localization-worker.v9"
 CANDIDATE_SCHEMA = "blun.website-localization-candidate.v1"
 REVIEW_SCHEMA = "blun.website-localization-review.v2"
-RESULT_SCHEMA = "blun.website-localization-result.v5"
+RESULT_SCHEMA = "blun.website-localization-result.v10"
 MAX_TEXT_BYTES = 2_000_000
 MAX_FIELD_LENGTH = 2_000
 ERROR_CODE = re.compile(r"^[a-z][a-z0-9_.-]{0,127}$")
@@ -456,7 +456,7 @@ def _base_context(job: dict[str, Any], assets: LocalizationAssets) -> dict[str,
     }
     if any(quality_profile[name] != value for name, value in expected_quality.items()):
         raise LocalizationWorkerBlocked("quality_profile.binding_mismatch", retryable=False)
-    return {
+    context = {
         "job_id": job["job_id"],
         "target": job["target"],
         "content_type": job["content_type"],
@@ -468,6 +468,122 @@ def _base_context(job: dict[str, Any], assets: LocalizationAssets) -> dict[str,
         "protected_terms": list(assets.protected_terms),
         "quality_profile": quality_profile,
     }
+    if job["content_type"] == "commercial":
+        commercial_quality = _PLANNER.commercial_quality_profile_for(
+            job["target"]["locale"]
+        )
+        if job.get("commercial_quality_profile") != commercial_quality:
+            raise LocalizationWorkerBlocked(
+                "commercial_quality_profile.binding_mismatch",
+                retryable=False,
+            )
+        context["commercial_quality_profile"] = commercial_quality
+    return context
+
+
+def _commercial_review_evidence_contract(profile: str) -> dict[str, Any]:
+    """Resolve the exact public evidence contract before any provider access."""
+    try:
+        contract = _COMMERCIAL.public_review_evidence_contract(profile)
+        public_contract = _COMMERCIAL.public_profile(profile)[
+            "review_evidence_contract"
+        ]
+        if not isinstance(contract, dict) or not isinstance(
+            public_contract, dict
+        ):
+            raise TypeError
+        unsigned = dict(contract)
+        digest = unsigned.pop("sha256")
+    except (KeyError, TypeError, ValueError) as error:
+        raise LocalizationWorkerBlocked(
+            "commercial_review_evidence_contract.binding_mismatch",
+            retryable=False,
+        ) from error
+    if (
+        contract != public_contract
+        or contract.get("schema")
+        != _COMMERCIAL.REVIEW_EVIDENCE_CAPABILITIES_SCHEMA
+        or contract.get("result_schema") != profile
+        or contract.get("profile") != profile
+        or not isinstance(digest, str)
+        or len(digest) != 64
+        or digest != _hash_json(unsigned)
+    ):
+        raise LocalizationWorkerBlocked(
+            "commercial_review_evidence_contract.binding_mismatch",
+            retryable=False,
+        )
+    return json.loads(_canonical_json(contract))
+
+
+def _commercial_review_routing_contract(profile: str) -> dict[str, Any]:
+    """Resolve the exact private-routing contract before provider access."""
+    try:
+        contract = _COMMERCIAL.public_review_routing_contract(profile)
+        public_contract = _COMMERCIAL.public_profile(profile)[
+            "review_routing_contract"
+        ]
+        if not isinstance(contract, dict) or not isinstance(
+            public_contract, dict
+        ):
+            raise TypeError
+        unsigned = dict(contract)
+        digest = unsigned.pop("sha256")
+    except (KeyError, TypeError, ValueError) as error:
+        raise LocalizationWorkerBlocked(
+            "commercial_review_routing_contract.binding_mismatch",
+            retryable=False,
+        ) from error
+    if (
+        contract != public_contract
+        or contract.get("schema")
+        != _COMMERCIAL.REVIEW_ROUTING_CAPABILITIES_SCHEMA
+        or contract.get("result_schema") != _COMMERCIAL.REVIEW_ROUTING_SCHEMA
+        or contract.get("profile") != profile
+        or not isinstance(digest, str)
+        or len(digest) != 64
+        or digest != _hash_json(unsigned)
+    ):
+        raise LocalizationWorkerBlocked(
+            "commercial_review_routing_contract.binding_mismatch",
+            retryable=False,
+        )
+    return json.loads(_canonical_json(contract))
+
+
+def _commercial_review_resolution_contract(profile: str) -> dict[str, Any]:
+    """Resolve the exact public resolution contract before provider access."""
+    try:
+        contract = _COMMERCIAL.public_review_resolution_contract(profile)
+        public_contract = _COMMERCIAL.public_profile(profile)[
+            "review_resolution_contract"
+        ]
+        if not isinstance(contract, dict) or not isinstance(
+            public_contract, dict
+        ):
+            raise TypeError
+        unsigned = dict(contract)
+        digest = unsigned.pop("sha256")
+    except (KeyError, TypeError, ValueError) as error:
+        raise LocalizationWorkerBlocked(
+            "commercial_review_resolution_contract.binding_mismatch",
+            retryable=False,
+        ) from error
+    if (
+        contract != public_contract
+        or contract.get("schema")
+        != _COMMERCIAL.REVIEW_RESOLUTION_CAPABILITIES_SCHEMA
+        or contract.get("result_schema") != _COMMERCIAL.REVIEW_RESOLUTION_SCHEMA
+        or contract.get("profile") != profile
+        or not isinstance(digest, str)
+        or len(digest) != 64
+        or digest != _hash_json(unsigned)
+    ):
+        raise LocalizationWorkerBlocked(
+            "commercial_review_resolution_contract.binding_mismatch",
+            retryable=False,
+        )
+    return json.loads(_canonical_json(contract))
 
 
 def run_localization_job(
@@ -490,8 +606,44 @@ def run_localization_job(
     locale = job["target"]["locale"]
     base = _base_context(job, assets)
     commercial = job["content_type"] == "commercial"
+    commercial_evidence_contract = None
+    commercial_routing_contract = None
+    commercial_resolution_contract = None
     if commercial:
         base["commercial_profile"] = job["commercial_profile"]
+        commercial_evidence_contract = _commercial_review_evidence_contract(
+            job["commercial_profile"]
+        )
+        if (
+            job["commercial_review_evidence_contract_sha256"]
+            != commercial_evidence_contract["sha256"]
+        ):
+            raise LocalizationWorkerBlocked(
+                "commercial_review_evidence_contract.binding_mismatch",
+                retryable=False,
+            )
+        commercial_routing_contract = _commercial_review_routing_contract(
+            job["commercial_profile"]
+        )
+        if (
+            job["commercial_review_routing_contract_sha256"]
+            != commercial_routing_contract["sha256"]
+        ):
+            raise LocalizationWorkerBlocked(
+                "commercial_review_routing_contract.binding_mismatch",
+                retryable=False,
+            )
+        commercial_resolution_contract = _commercial_review_resolution_contract(
+            job["commercial_profile"]
+        )
+        if (
+            job["commercial_review_resolution_contract_sha256"]
+            != commercial_resolution_contract["sha256"]
+        ):
+            raise LocalizationWorkerBlocked(
+                "commercial_review_resolution_contract.binding_mismatch",
+                retryable=False,
+            )
     full_glossary = [asdict(term) for term in assets.glossary]
     target_terms = [
         {"target": term.target}
@@ -563,6 +715,15 @@ def run_localization_job(
         "source": job["source"],
         "candidate": candidate,
         "glossary": full_glossary,
+        **(
+            {
+                "commercial_review_evidence_contract": (
+                    commercial_evidence_contract
+                ),
+            }
+            if commercial
+            else {}
+        ),
         "response_schema": {
             "schema": REVIEW_SCHEMA,
             "phase": "source_fidelity",
@@ -576,6 +737,7 @@ def run_localization_job(
     })
     fidelity_response, request_hash, response_hash = _invoke(provider, fidelity_request)
     commercial_summary = None
+    commercial_review_routing = None
     commercial_escalation_required = False
     if commercial:
         # Hash above binds the complete evidence, even though the ordinary
@@ -585,13 +747,36 @@ def run_localization_job(
         try:
             commercial_summary = _COMMERCIAL.validate_review(
                 commercial_review, job["source"]["text"], candidate,
-                job["commercial_profile"], allow_uncertain=True,
+                job["commercial_profile"],
+                target_locale=locale,
+                commercial_quality_profile_version=(
+                    job["commercial_quality_profile"]["version"]
+                ),
+                commercial_quality_profile_sha256=(
+                    job["commercial_quality_profile"]["sha256"]
+                ),
+                allow_uncertain=True,
             )
         except _COMMERCIAL.CommercialReviewBlocked as error:
             raise LocalizationWorkerBlocked(error.code, retryable=False) from None
         commercial_escalation_required = (
             commercial_summary["status"] == "review_required"
         )
+        if commercial_escalation_required:
+            try:
+                commercial_review_routing = (
+                    _COMMERCIAL.review_routing_context(
+                        commercial_review,
+                        job["source"]["text"],
+                        candidate,
+                        commercial_summary,
+                        job["commercial_profile"],
+                    )
+                )
+            except _COMMERCIAL.CommercialReviewBlocked as error:
+                raise LocalizationWorkerBlocked(
+                    error.code, retryable=False,
+                ) from None
     findings, fidelity_confidence = _review(
         fidelity_response,
         "source_fidelity",
@@ -625,6 +810,18 @@ def run_localization_job(
         )
     progress("integrity")
 
+    quality_result = {
+        "locale": locale,
+        "version": job["target"]["quality_profile_version"],
+        "sha256": job["target"]["quality_profile_sha256"],
+    }
+    if commercial:
+        quality_result["commercial"] = {
+            "profile": job["commercial_profile"],
+            "version": job["commercial_quality_profile"]["version"],
+            "sha256": job["commercial_quality_profile"]["sha256"],
+        }
+
     return {
         "schema": RESULT_SCHEMA,
         "worker_schema": WORKER_SCHEMA,
@@ -648,12 +845,19 @@ def run_localization_job(
             "target_native": native_confidence,
             "source_fidelity": fidelity_confidence,
         },
-        "quality_profile": {
-            "locale": locale,
-            "version": job["target"]["quality_profile_version"],
-            "sha256": job["target"]["quality_profile_sha256"],
-        },
+        "quality_profile": quality_result,
         "commercial_review": commercial_summary,
+        "commercial_review_routing": commercial_review_routing,
+        "commercial_review_routing_contract_sha256": (
+            commercial_routing_contract["sha256"]
+            if commercial_routing_contract is not None
+            else None
+        ),
+        "commercial_review_resolution_contract_sha256": (
+            commercial_resolution_contract["sha256"]
+            if commercial_resolution_contract is not None
+            else None
+        ),
         "human_review_required": job["content_type"] == "legal",
         "independent_review_required": (
             job["content_type"] != "legal"

package/standard-skills/translate-native/provenance.json

@@ -1,6 +1,6 @@
 {
   "name": "translate-native",
-  "version": "6.64.0",
-  "sourceCommit": "d5d350ba61a5ea7fa4efb2244abcfc191452a33f",
+  "version": "6.155.0",
+  "sourceCommit": "21efc66da8f77992c8c63ac0f145a106c31e7eb2",
   "sourceRepository": "https://github.com/Maykbiletti/translate-native"
 }