create-egregore 0.21.4 → 0.21.6

package/runtime/claude/egregore_runtime/member_authority.py

@@ -0,0 +1,405 @@
+"""Request-local member authority above an injected trusted introspector.
+
+This module implements parsing, identity resolution and policy intersection.
+It does not issue credentials, call HTTP, read operator identity or provision
+members. The host supplies an authenticated introspector; every resolution and
+policy decision calls it again. Ownership, funding and actor parentage confer
+no permissions here.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Mapping, Sequence
+from dataclasses import dataclass, fields, replace
+from datetime import UTC, datetime, timedelta
+import re
+from typing import Any, Protocol
+from uuid import UUID
+
+from .contracts import (
+    AccountIdentity,
+    ActionAuthorizer,
+    ActorContext,
+    ActorIdentity,
+    ActorKind,
+    Capability,
+    EgregoreProfile,
+    Entitlements,
+    ExecutionAuthority,
+    OrgMembership,
+    Permission,
+    PolicyDecision,
+    RetrievalRequest,
+)
+from .errors import AuthorizationDenied
+
+
+SCHEMA = "egregore.member-authority/v1"
+_PERMISSIONS = frozenset({Permission.DISCOVER, Permission.READ, Permission.WRITE})
+_IDENTIFIER = re.compile(r"^[A-Za-z0-9._:-]{1,160}$")
+_PATH_PART = re.compile(r"^[A-Za-z0-9_.-]+$")
+
+
+class MemberAuthorityError(AuthorizationDenied):
+    """A bounded refusal that contains neither payload nor transport details."""
+
+    def __init__(self):
+        super().__init__("Authenticated member authority could not be verified.")
+
+
+def _require(value: bool) -> None:
+    if not value:
+        raise MemberAuthorityError()
+
+
+def _identifier(value: Any) -> str:
+    _require(isinstance(value, str) and _IDENTIFIER.fullmatch(value) is not None)
+    return value
+
+
+def _uuid(value: Any) -> str:
+    _require(isinstance(value, str))
+    try:
+        parsed = UUID(value)
+    except (ValueError, AttributeError):
+        raise MemberAuthorityError() from None
+    _require(parsed.int != 0 and str(parsed) == value)
+    return value
+
+
+def _text(value: Any, limit: int = 160) -> str:
+    _require(isinstance(value, str) and 0 < len(value) <= limit
+             and value == value.strip() and all(ord(c) >= 32 and ord(c) != 127 for c in value))
+    return value
+
+
+def _mapping(value: Any) -> Mapping:
+    _require(isinstance(value, Mapping))
+    return value
+
+
+def _strings(value: Any, *, limit: int = 32) -> tuple[str, ...]:
+    _require(isinstance(value, list) and len(value) <= limit)
+    result = tuple(_identifier(item) for item in value)
+    _require(len(set(result)) == len(result))
+    return result
+
+
+def _prefix(value: Any) -> str:
+    _require(isinstance(value, str) and len(value) <= 1024)
+    parts = value.split("/")
+    _require(parts[0] == "memory" and all(
+        part not in {"", ".", ".."} and _PATH_PART.fullmatch(part) for part in parts
+    ))
+    return value
+
+
+def _prefixes(value: Any) -> tuple[str, ...]:
+    _require(isinstance(value, list) and len(value) <= 64)
+    result = tuple(_prefix(item) for item in value)
+    _require(len(set(result)) == len(result))
+    return result
+
+
+def _utc(value: Any) -> datetime:
+    _require(isinstance(value, datetime) and value.tzinfo is not None
+             and value.utcoffset() == timedelta(0))
+    return value
+
+
+@dataclass(frozen=True, slots=True)
+class MemberAuthorityBinding:
+    member_account_id: str
+    member_actor_id: str
+    membership_id: str
+    org_id: str
+    executor_actor_id: str
+    worker_id: str
+    binding_id: str
+    audience: str
+    grant_id: str
+
+    def __post_init__(self) -> None:
+        for field in fields(self):
+            value = getattr(self, field.name)
+            # Connected instances may retain their immutable Local organization
+            # reference (migration 046). It must still match the host-selected
+            # reference exactly; the database UUID is not an interchangeable alias.
+            if field.name == "org_id" and isinstance(value, str) and re.fullmatch(r"org_[0-9a-f]{32}", value):
+                continue
+            (_identifier if field.name in {"worker_id", "audience"} else _uuid)(value)
+        _require(self.executor_actor_id != self.member_actor_id)
+
+
+class MemberIntrospector(Protocol):
+    def __call__(
+        self, *, expected: MemberAuthorityBinding, operation: str,
+    ) -> Mapping[str, Any]: ...
+
+
+@dataclass(frozen=True, slots=True)
+class VerifiedMemberAuthority:
+    expected: MemberAuthorityBinding
+    executor_kind: ActorKind
+    revision: str
+    expires_at: datetime
+    permissions: frozenset[Permission]
+    read_prefixes: tuple[str, ...]
+    write_prefixes: tuple[str, ...]
+    account_name: str
+    member_name: str
+    roles: tuple[str, ...]
+    teams: tuple[str, ...]
+    aliases: tuple[tuple[str, str], ...]
+    org_slug: str
+    org_name: str
+    org_revision: str
+    default_policy: str
+    default_context_budget: int
+    entitlement_plan: str
+    entitlement_capabilities: frozenset[Capability]
+    entitlement_source: str
+    entitlement_revision: str
+
+    @property
+    def execution(self) -> ExecutionAuthority:
+        return ExecutionAuthority(
+            **{field.name: getattr(self.expected, field.name) for field in fields(self.expected)},
+            executor_kind=self.executor_kind, revision=self.revision, expires_at=self.expires_at,
+        )
+
+    def actor_context(self, *, session_id: str, harness: str) -> ActorContext:
+        _text(session_id, 240)
+        _identifier(harness)
+        binding = self.expected
+        return ActorContext(
+            account=AccountIdentity(binding.member_account_id, self.account_name),
+            actor=ActorIdentity(
+                actor_id=binding.member_actor_id, kind=ActorKind.PERSON,
+                display_name=self.member_name, account_id=binding.member_account_id,
+                aliases=dict(self.aliases),
+            ),
+            profile=EgregoreProfile(
+                schema_version="egregore-profile/v1", org_id=binding.org_id,
+                slug=self.org_slug, name=self.org_name, revision=self.org_revision,
+                default_policy=self.default_policy,
+                default_context_budget=self.default_context_budget,
+            ),
+            membership=OrgMembership(
+                binding.membership_id, binding.org_id, binding.member_actor_id,
+                roles=self.roles, teams=self.teams, status="active",
+            ),
+            entitlements=Entitlements(
+                self.entitlement_plan, self.entitlement_capabilities,
+                self.entitlement_source, self.entitlement_revision,
+            ),
+            session_id=session_id, harness=harness, execution=self.execution,
+        )
+
+
+def parse_member_authority(
+    payload: Mapping[str, Any], *, expected: MemberAuthorityBinding, now: datetime,
+) -> VerifiedMemberAuthority:
+    """Validate a fresh authenticated response against a host-selected binding."""
+    try:
+        _require(isinstance(expected, MemberAuthorityBinding))
+        _utc(now)
+        payload = _mapping(payload)
+        _require(payload.get("schema") == SCHEMA and payload.get("active") is True)
+        actual = MemberAuthorityBinding(**{
+            field.name: payload[field.name] for field in fields(expected)
+        })
+        _require(actual == expected)
+        kind = ActorKind(payload["executor_kind"])
+        _require(kind in {ActorKind.AGENT, ActorKind.SERVICE})
+        expires = _text(payload["expires_at"], 40)
+        expires_at = _utc(datetime.fromisoformat(expires.replace("Z", "+00:00")))
+        _require(expires_at > now)
+        operations = _strings(payload["operations"], limit=3)
+        permissions = frozenset(Permission(item) for item in operations)
+        _require(bool(permissions) and permissions <= _PERMISSIONS)
+        reads, writes = _prefixes(payload["read_prefixes"]), _prefixes(payload["write_prefixes"])
+        member, account = _mapping(payload["member"]), _mapping(payload["account"])
+        aliases = _mapping(member["aliases"])
+        _require(len(aliases) <= 16)
+        org, entitlement = _mapping(payload["organization"]), _mapping(payload["entitlements"])
+        budget = org["default_context_budget"]
+        _require(type(budget) is int and 1 <= budget <= 1_000_000)
+        return VerifiedMemberAuthority(
+            expected=actual, executor_kind=kind, revision=_identifier(payload["revision"]),
+            expires_at=expires_at, permissions=permissions,
+            read_prefixes=reads, write_prefixes=writes,
+            account_name=_text(account["display_name"]), member_name=_text(member["display_name"]),
+            roles=_strings(member["roles"]), teams=_strings(member["teams"]),
+            aliases=tuple(sorted((_identifier(key), _text(value)) for key, value in aliases.items())),
+            org_slug=_identifier(org["slug"]), org_name=_text(org["name"]),
+            org_revision=_text(org["revision"]), default_policy=_identifier(org["default_policy"]),
+            default_context_budget=budget, entitlement_plan=_identifier(entitlement["plan"]),
+            entitlement_capabilities=frozenset(Capability(item) for item in
+                                              _strings(entitlement["capabilities"])),
+            entitlement_source=_text(entitlement["source"]),
+            entitlement_revision=_text(entitlement["revision"]),
+        )
+    except MemberAuthorityError:
+        raise
+    except Exception:
+        raise MemberAuthorityError() from None
+
+
+def _now() -> datetime:
+    return datetime.now(UTC)
+
+
+@dataclass(frozen=True, slots=True)
+class AuthenticatedMemberResolver:
+    expected: MemberAuthorityBinding
+    introspect: MemberIntrospector
+    clock: Callable[[], datetime] = _now
+
+    def __post_init__(self) -> None:
+        _require(isinstance(self.expected, MemberAuthorityBinding)
+                 and callable(self.introspect) and callable(self.clock))
+
+    def _fresh(self, operation: str) -> VerifiedMemberAuthority:
+        try:
+            _require(operation in {"resolve", "discover", "read", "write"})
+            payload = self.introspect(expected=self.expected, operation=operation)
+            # Validate time after introspection, not before a potentially slow call.
+            return parse_member_authority(payload, expected=self.expected, now=self.clock())
+        except MemberAuthorityError:
+            raise
+        except Exception:
+            raise MemberAuthorityError() from None
+
+    def resolve(self, *, session_id: str, harness: str) -> ActorContext:
+        return self._fresh("resolve").actor_context(session_id=session_id, harness=harness)
+
+    def verify(self, actor: ActorContext, operation: str) -> VerifiedMemberAuthority:
+        """Verify current authority without trusting mutable presentation fields."""
+        try:
+            binding = self.expected
+            _require(isinstance(actor, ActorContext) and actor.account is not None
+                     and actor.membership is not None and isinstance(actor.execution, ExecutionAuthority))
+            _require(actor.account.account_id == actor.actor.account_id == binding.member_account_id
+                     and actor.actor.actor_id == actor.membership.actor_id == binding.member_actor_id
+                     and actor.profile.org_id == actor.membership.org_id == binding.org_id
+                     and actor.membership.membership_id == binding.membership_id
+                     and actor.membership.status == "active" and actor.actor.kind == ActorKind.PERSON)
+            _require(all(getattr(actor.execution, field.name) == getattr(binding, field.name)
+                         for field in fields(binding)))
+            verified = self._fresh(operation)
+            _require(actor.execution.executor_kind == verified.executor_kind)
+            return verified
+        except MemberAuthorityError:
+            raise
+        except Exception:
+            raise MemberAuthorityError() from None
+
+
+def _intersect(left: Sequence[str], right: Sequence[str]) -> tuple[str, ...]:
+    """Intersect segment prefixes; never expand an append grant into a write."""
+    result = set()
+    for first in left:
+        _prefix(first)
+        for second in right:
+            _prefix(second)
+            # Both sides are canonical memory prefixes, validated above.
+            # This is lexical segment containment, not filesystem traversal;
+            # keeping it here lets the hosted parser run without Local policy.
+            if first == second or first.startswith(second + "/"):
+                result.add(first)
+            elif second.startswith(first + "/"):
+                result.add(second)
+    return tuple(sorted(result))
+
+
+@dataclass(frozen=True, slots=True)
+class MemberAuthorityPolicy:
+    resolver: AuthenticatedMemberResolver
+    base_policy_factory: Callable[[ActorContext], ActionAuthorizer]
+
+    def _denied(self, permission: Permission, reason: str, base=None) -> PolicyDecision:
+        if base is not None:
+            return replace(base, allowed=False, reasons=(reason,), scopes=(), resource_ids=(),
+                           read_prefixes=(), write_prefixes=(), append_prefixes=())
+        expected = self.resolver.expected
+        return PolicyDecision(False, expected.member_actor_id, expected.org_id, permission,
+                              "member-authority/v1", reasons=(reason,))
+
+    def _intersect_decision(self, base, verified, permission) -> PolicyDecision:
+        expected = self.resolver.expected
+        _require(isinstance(base, PolicyDecision) and base.actor_id == expected.member_actor_id
+                 and base.org_id == expected.org_id and base.permission == permission)
+        if not base.allowed:
+            return self._denied(permission, "Local policy denied this operation.", base)
+        # policy.check consumes prefix fields, not decision.permission. Return
+        # only the operation the base policy actually authorized, so a read
+        # decision cannot become a write or a discover-only grant expose bytes.
+        reads = verified.read_prefixes if (
+            permission in {Permission.DISCOVER, Permission.READ}
+            and Permission.READ in verified.permissions
+        ) else ()
+        writes = verified.write_prefixes if (
+            permission == Permission.WRITE and Permission.WRITE in verified.permissions
+        ) else ()
+        read = _intersect(base.read_prefixes, reads)
+        write = _intersect(base.write_prefixes, writes)
+        append = _intersect(base.append_prefixes, writes)
+        selected = read if permission in {Permission.READ, Permission.DISCOVER} else (*write, *append)
+        if not selected:
+            return self._denied(permission, "The member grant and local policy have no common scope.", base)
+        return replace(base, read_prefixes=read, write_prefixes=write, append_prefixes=append,
+                       scopes=_intersect(base.scopes, reads if permission != Permission.WRITE else writes))
+
+    def authorize_observe(self, actor: ActorContext, request: RetrievalRequest) -> PolicyDecision:
+        try:
+            verified = self.resolver.verify(actor, "read")
+            if not {Permission.DISCOVER, Permission.READ} <= verified.permissions:
+                return self._denied(Permission.READ, "The member grant does not permit discovery and reading.")
+            expected = self.resolver.expected
+            _require(request.org_id == expected.org_id and request.actor_id == expected.member_actor_id)
+            current = verified.actor_context(session_id=actor.session_id, harness=actor.harness)
+            base = self.base_policy_factory(current).authorize_observe(current, request)
+            return self._intersect_decision(base, verified, Permission.READ)
+        except Exception:
+            return self._denied(Permission.READ, "Authenticated member authority is unavailable.")
+
+    def authorize_action(
+        self, actor: ActorContext, permission: Permission, resource_ids: Sequence[str] = (),
+    ) -> PolicyDecision:
+        try:
+            _require(isinstance(permission, Permission) and permission in _PERMISSIONS)
+            verified = self.resolver.verify(actor, permission.value)
+            if permission not in verified.permissions or (
+                permission == Permission.DISCOVER and Permission.READ not in verified.permissions
+            ):
+                return self._denied(permission, "The member grant does not permit this operation.")
+            current = verified.actor_context(session_id=actor.session_id, harness=actor.harness)
+            authorizer = self.base_policy_factory(current)
+            base = authorizer.authorize_action(current, permission, resource_ids)
+            if permission == Permission.DISCOVER:
+                # Discovery exposes readable source metadata. Require the
+                # underlying policy's read decision as well as its discover
+                # decision, and retain the read decision's hold restrictions.
+                readable = authorizer.authorize_action(current, Permission.READ, resource_ids)
+                expected = self.resolver.expected
+                _require(isinstance(base, PolicyDecision) and isinstance(readable, PolicyDecision)
+                         and base.permission == Permission.DISCOVER and readable.permission == Permission.READ
+                         and base.actor_id == readable.actor_id == expected.member_actor_id
+                         and base.org_id == readable.org_id == expected.org_id)
+                if not base.allowed or not readable.allowed:
+                    return self._denied(permission, "Local policy denied discovery or reading.")
+                _require(base.policy_epoch == readable.policy_epoch and base.scope == readable.scope
+                         and base.memory_revision == readable.memory_revision)
+                resources = base.resource_ids or readable.resource_ids
+                if base.resource_ids and readable.resource_ids:
+                    resources = tuple(item for item in base.resource_ids if item in readable.resource_ids)
+                    if not resources:
+                        return self._denied(permission, "Local discovery and reading scopes do not overlap.")
+                base = replace(readable, permission=Permission.DISCOVER,
+                               resource_ids=resources,
+                               read_prefixes=_intersect(base.read_prefixes, readable.read_prefixes),
+                               scopes=_intersect(base.scopes, readable.scopes))
+            return self._intersect_decision(base, verified, permission)
+        except Exception:
+            return self._denied(permission, "Authenticated member authority is unavailable.")

package/runtime/claude/egregore_runtime/upgrade.py

@@ -928,11 +928,27 @@ class UpgradeEngine:
         return all(isinstance(digest, str) and re.fullmatch(r"[a-f0-9]{64}", digest)
                    for digest in value["files"].values())
 
+    @staticmethod
+    def _committed_unchanged(instance: Path, relative: str) -> bool:
+        """Git tracks the path and nothing under it differs from HEAD."""
+        environment = {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
+        tracked = subprocess.run(["git", "-C", str(instance), "ls-files", "-z", "--", relative],
+                                 capture_output=True, text=True, timeout=5, env=environment, check=False)
+        status = subprocess.run(["git", "-C", str(instance), "status", "--porcelain", "-z",
+                                 "--untracked-files=all", "--", relative],
+                                capture_output=True, text=True, timeout=5, env=environment, check=False)
+        if tracked.returncode != 0 or status.returncode != 0 or not tracked.stdout.strip("\0"):
+            return False
+        return all(entry[3:].endswith(".pyc") and "/__pycache__/" in f"/{entry[3:]}"
+                   for entry in status.stdout.split("\0") if entry)
+
     def _legacy_template_baseline(self, instance: Path, *, previously_restored: bool) -> dict:
         """Recognize an unversioned template without claiming installed Runtime.
 
         Git identifies provenance only. Dirty bytes are captured by the normal
         rollback archive, never reconstructed by checking out a Git revision.
+        Runtime files a framework update committed are template content; an
+        untracked or edited Runtime file is unreceipted installation evidence.
         """
         try:
             for receipt in _runtime_install_receipt_paths(instance):
@@ -940,10 +956,13 @@ class UpgradeEngine:
                     raise ValueError("installer evidence needs repair")
             for relative in ("bin/observe-context.sh", "bin/runtime-identity.sh", "bin/runtime-upgrade.sh"):
                 marker = instance / relative
-                if marker.exists() or marker.is_symlink():
+                if marker.is_symlink() or (marker.exists() and not self._committed_unchanged(instance, relative)):
                     raise ValueError("Runtime adapter evidence needs repair")
             core = instance / "egregore_runtime"
-            if core.exists() or core.is_symlink():
+            delivered = (not core.is_symlink() and core.is_dir()
+                         and not any(path.is_symlink() for path in core.rglob("*"))
+                         and self._committed_unchanged(instance, "egregore_runtime"))
+            if (core.exists() or core.is_symlink()) and not delivered:
                 # A completed legacy rollback removes added files, not their
                 # parent directories or Python's generated caches. Only a
                 # validated prior baseline permits these harmless remnants.
@@ -1522,6 +1541,26 @@ class UpgradeEngine:
             for relative in (CODEX_SETTINGS_ADAPTER, *NATIVE_SETTINGS_ADAPTERS)
             if relative in selected
         }
+        # Git cleanliness does not make a linked destination safe. Check every
+        # file and parent before opening the journal or backing up any bytes;
+        # copy2 follows destination links, including links inside a tracked tree.
+        # Preserved org-owned paths are not selected and remain untouched.
+        for relative in selected:
+            destination = instance / relative
+            # copy2 treats a directory destination as a container and appends
+            # the source basename, which could select an unchecked child link.
+            if destination.exists() and not destination.is_file():
+                raise UpgradeError(
+                    f"Runtime destination is not a regular file: {relative}; "
+                    "repair the destination before upgrading"
+                )
+            while destination != instance:
+                if destination.is_symlink():
+                    raise UpgradeError(
+                        f"Runtime destination contains a symbolic link: {destination.relative_to(instance)}; "
+                        "replace it with an instance-local file or directory before upgrading"
+                    )
+                destination = destination.parent
         # Journal opens the transaction BEFORE the first byte moves. From here
         # until the caller clears it, a crash is recoverable from the backup.
         journal = {

package/runtime/claude/manifest.json

@@ -144,7 +144,6 @@
     "bin/base-branch.sh",
     "bin/boundary.sh",
     "bin/branch-guard.cjs",
-    "bin/build-sealed-dataroom.mjs",
     "bin/capture-reconcile.sh",
     "bin/capture-run.sh",
     "bin/codex-install-skills.sh",
@@ -318,6 +317,7 @@
     "egregore_runtime/knowledge_cli.py",
     "egregore_runtime/lifecycle.py",
     "egregore_runtime/lifecycle_cli.py",
+    "egregore_runtime/member_authority.py",
     "egregore_runtime/notification_cli.py",
     "egregore_runtime/notifications.py",
     "egregore_runtime/observe.py",

package/runtime/codex/bin/handoff-run.sh

@@ -402,7 +402,7 @@ PID_MEMORY=$!
     if [ -f "$EMISSARY_CONFIG" ]; then
       EMISSARY_TOKEN=$(jq -r '.auth_token // empty' "$EMISSARY_CONFIG" 2>/dev/null)
     fi
-    EMISSARY_API_URL="${EMISSARY_API_URL:-https://egregore-production-55f2.up.railway.app/api/v1/emissary}"
+    EMISSARY_API_URL="${EMISSARY_API_URL:-https://api.egregore.xyz/api/v1/emissary}"
 
     # /handoff is an internal team primitive, not an implicit public-emissary
     # composer. Use the emissary route only for an explicit recipient, and make