create-egregore 0.21.0 → 0.21.2

package/runtime/prime/egregore_runtime/identity_transfer.py

@@ -11,6 +11,7 @@ from dataclasses import replace
 import hashlib
 import json
 import os
+import re
 from pathlib import Path, PurePosixPath
 import tempfile
 from typing import Any, Mapping
@@ -101,6 +102,26 @@ def _changed_fields(fields: Mapping[str, Any], source_id: str, destination_id: s
     return updates
 
 
+def _malformed_transfer_candidate(markdown: str, source_id: str) -> bool:
+    """Identify an invalid document that could still require ownership transfer.
+
+    Existing memory can contain old or adversarial Markdown that is not a valid
+    Runtime artifact. Identity reconciliation must not fail because an unrelated
+    document is malformed, but it must fail closed when that document explicitly
+    names the current actor as a transferable owner.
+    """
+
+    if not source_id:
+        return False
+    actor = re.escape(source_id)
+    question = re.search(r"(?m)^type:\s*[\"']?question[\"']?\s*$", markdown)
+    recipient = re.search(rf"(?m)^to_actor_id:\s*[\"']?{actor}[\"']?\s*$", markdown)
+    thread = re.search(r"(?m)^type:\s*[\"']?thread[\"']?\s*$", markdown)
+    steward = re.search(rf"(?m)^steward_id:\s*[\"']?{actor}[\"']?\s*$", markdown)
+    stewards = re.search(rf"(?m)^steward_ids:\s*.*\b{actor}\b", markdown)
+    return bool((question and recipient) or (thread and (steward or stewards)))
+
+
 def _document(before: str, path: str, pair: Mapping[str, Any], transfer_id: str):
     fields, _ = split_frontmatter(before)
     updates = _changed_fields(fields, pair["source"]["actor_id"], pair["destination"]["actor_id"])
@@ -148,7 +169,18 @@ def _inventory(memory: Path, runtime, source: ActorContext, destination_id: str)
             if len(raw) > MAX_DOCUMENT_BYTES or size > MAX_SCAN_BYTES:
                 raise IdentityTransferError("ownership inventory exceeds its byte limit; retain the current identity")
             before = raw.decode("utf-8")
-            fields, _ = split_frontmatter(before)
+            try:
+                fields, _ = split_frontmatter(before)
+            except ValueError as error:
+                # A malformed legacy or test document outside the transfer
+                # contract must not block identity reconciliation. If it names
+                # the current owner, fail closed so ownership is never left
+                # half-transferred.
+                if _malformed_transfer_candidate(before, source.actor.actor_id):
+                    raise IdentityTransferError(
+                        f"ownership inventory cannot parse {relative}: {error}"
+                    ) from error
+                continue
             if (fields.get("org") or fields.get("org_id")) not in {None, source.profile.org_id}:
                 continue
             if _changed_fields(fields, source.actor.actor_id, destination_id):

package/runtime/prime/egregore_runtime/upgrade.py

@@ -17,6 +17,7 @@ from __future__ import annotations
 import json
 import os
 import re
+import signal
 import subprocess
 import sys
 import time
@@ -27,6 +28,8 @@ from typing import Any, Mapping
 from .adapters.qmd import QMD_VERSION, RERANKING_ENABLED, QmdLocalRetriever
 
 SCHEMA_VERSION = "egregore-runtime-upgrade/v1"
+_RENDERER_INSTALL_TIMEOUT_SECONDS = 180
+_RENDERER_TERMINATE_GRACE_SECONDS = 5
 
 # Stage keys in preparation order. Labels are the user-facing truth shown by
 # Settings; keep them in plain team language.
@@ -628,6 +631,54 @@ class UpgradeEngine:
         if probe.returncode != 0:
             self._fail(state, "node", "the selected Node runtime failed its version probe")
             return False
+        # Explicit Runtime preparation owns package provisioning. Preview and
+        # session startup only resolve installed renderers. Older candidates
+        # predate this helper and retain their original upgrade contract.
+        renderer_installer = (
+            Path(state.get("installed_path") or "")
+            / "runtime" / APPLY_TREE / "bin" / "artifact-renderer-install.sh"
+        )
+        if renderer_installer.is_file():
+            environment = {**os.environ, **self.retriever.environment}
+            environment["PATH"] = str(Path(node).parent) + os.pathsep + environment.get("PATH", "")
+            try:
+                with subprocess.Popen(
+                    ("bash", str(renderer_installer), "--root", str(self.repository_root)),
+                    stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
+                    cwd=self.repository_root, env=environment, start_new_session=True,
+                ) as renderer:
+                    try:
+                        stdout, stderr = renderer.communicate(timeout=_RENDERER_INSTALL_TIMEOUT_SECONDS)
+                    except subprocess.TimeoutExpired:
+                        # npm is a child of the installer shell. Stop the entire
+                        # group so its EXIT cleanup can run without an orphaned
+                        # package manager still writing into the staging tree.
+                        try:
+                            os.killpg(renderer.pid, signal.SIGTERM)
+                        except ProcessLookupError:
+                            pass
+                        try:
+                            renderer.communicate(timeout=_RENDERER_TERMINATE_GRACE_SECONDS)
+                        except subprocess.TimeoutExpired:
+                            pass
+                        finally:
+                            # A child may ignore TERM even after Bash exits.
+                            try:
+                                os.killpg(renderer.pid, signal.SIGKILL)
+                            except ProcessLookupError:
+                                pass
+                            renderer.communicate()
+                        raise
+            except subprocess.TimeoutExpired:
+                self._fail(state, "node", f"artifact renderer provisioning timed out after {_RENDERER_INSTALL_TIMEOUT_SECONDS} seconds; retry preparation")
+                return False
+            except OSError as exc:
+                self._fail(state, "node", f"artifact renderer provisioning failed: {exc}")
+                return False
+            if renderer.returncode != 0:
+                detail = (stderr or stdout).strip()
+                self._fail(state, "node", f"artifact renderer provisioning failed: {detail}")
+                return False
         self._mark(state, "node", "done", f"{probe.stdout.strip()} at instance-selected path")
         return True
 

package/runtime/prime/manifest.json

@@ -127,6 +127,8 @@
     "bin/agent.sh",
     "bin/api-call.sh",
     "bin/artifact-register.sh",
+    "bin/artifact-renderer-install.sh",
+    "bin/artifact-renderer.sh",
     "bin/artifact-writeback.sh",
     "bin/artifacts.sh",
     "bin/attendant.sh",
@@ -173,6 +175,8 @@
     "bin/issue.sh",
     "bin/knowledge.sh",
     "bin/lib/artifact-id.sh",
+    "bin/lib/artifact-renderer/dependencies-lock.json",
+    "bin/lib/artifact-renderer/dependencies.json",
     "bin/lib/config.sh",
     "bin/lib/context.sh",
     "bin/lib/dashboard-artifact.sh",