loki-mode 9.18.4 → 9.20.0

package/autonomy/receipt_jwt.py

@@ -0,0 +1,308 @@
+"""Per-job receipt attestation: a signed JWT plus a public JWKS.
+
+WHY THIS EXISTS, given receipts are ALREADY gpg-signable.
+
+`LOKI_PROOF_GPG_KEY` proves a receipt was produced by a holder of that gpg key,
+and for a LOCAL build that is the whole story: the operator already has the
+keyring. It does not survive the remote path. A submitter who ran
+`loki start --remote https://loki.corp` never had local access to the cluster,
+so "fetch our public key out of band and import it into gpg" is the step where
+independent verification actually stops happening.
+
+JWKS closes exactly that gap and nothing else: the verifier fetches
+`/.well-known/jwks.json` over the same TLS connection it already trusts for the
+API, and checks the signature with a stdlib-shaped algorithm. The receipt gains
+per-job identity binding gpg never carried -- job id, submitter and issue time
+as SIGNED claims, not prose in the body.
+
+TWO DESIGN CONSTRAINTS, both decided by code that already exists rather than by
+preference.
+
+1. THE RECEIVER SIGNS. NEVER THE WORKER. The worker executes model-directed
+   code and already holds ANTHROPIC_API_KEY and GITHUB_TOKEN
+   (helm/loki-mode/templates/worker-deployment.yaml). A signing key there would
+   let a build sign its own receipt, and a self-attested receipt attests to
+   nothing. The private key lives only in the receiver Deployment, matching the
+   rule stated at the top of templates/secret.yaml.
+
+2. `kid` AND A MULTI-KEY JWKS FROM DAY ONE. This is the half-built failure the
+   whole item was deferred over. With a single unlabeled key, the first rotation
+   makes every previously-issued receipt fail verification -- and a receipt that
+   fails verification is INDISTINGUISHABLE from a tampered one. That collapses
+   TAMPERED into UNCHECKED and destroys the four-verdict separation the trust
+   core is built on. So JWKS serves current AND retired keys, and every token
+   carries the `kid` that signed it.
+
+Ed25519 (EdDSA), not RSA: fixed-size keys, no parameter choices to get wrong,
+and `cryptography` is already a dependency. Signing is OPTIONAL and fail-open
+in the sense that matters -- no key configured means no `attestation` field and
+the receipt keeps its existing UNSIGNED verdict. It never means an unsigned
+receipt is presented as signed.
+"""
+
+import base64
+import json
+import logging
+import os
+from pathlib import Path
+
+try:
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+        Ed25519PrivateKey,
+        Ed25519PublicKey,
+    )
+    _CRYPTO_AVAILABLE = True
+except ImportError:  # pragma: no cover - exercised only on a stripped install
+    _CRYPTO_AVAILABLE = False
+
+
+def _b64url(data: bytes) -> str:
+    """base64url WITHOUT padding, per RFC 7515 section 2."""
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def _b64url_decode(data: str) -> bytes:
+    """Inverse of _b64url, restoring the stripped padding."""
+    pad = 4 - len(data) % 4
+    if pad != 4:
+        data += "=" * pad
+    return base64.urlsafe_b64decode(data)
+
+
+def compute_kid(public_key: "Ed25519PublicKey") -> str:
+    """Stable key id: the RFC 7638 JWK thumbprint of the public key.
+
+    Derived from the key itself rather than assigned by an operator, so the
+    same key always yields the same kid across restarts and redeploys. An
+    operator-chosen kid drifts between environments and silently breaks
+    verification of receipts issued before the drift.
+    """
+    raw = public_key.public_bytes(
+        encoding=serialization.Encoding.Raw,
+        format=serialization.PublicFormat.Raw,
+    )
+    # Members REQUIRED by RFC 7638 for OKP, lexicographic, no whitespace.
+    canonical = json.dumps(
+        {"crv": "Ed25519", "kty": "OKP", "x": _b64url(raw)},
+        separators=(",", ":"),
+        sort_keys=True,
+    ).encode("utf-8")
+    import hashlib
+
+    return _b64url(hashlib.sha256(canonical).digest())
+
+
+def _load_private_key(pem_bytes: bytes):
+    """Load an unencrypted Ed25519 private key from PEM, or None.
+
+    An encrypted key is rejected rather than prompted for: the receiver starts
+    unattended in a pod and a passphrase prompt would hang startup rather than
+    fail it, which is the worse of the two outcomes.
+    """
+    try:
+        key = serialization.load_pem_private_key(pem_bytes, password=None)
+    except (ValueError, TypeError) as e:
+        logging.error("receipt signing: private key could not be loaded: %s", e)
+        return None
+    if not isinstance(key, Ed25519PrivateKey):
+        logging.error(
+            "receipt signing: key is %s, expected Ed25519 -- refusing to sign",
+            type(key).__name__,
+        )
+        return None
+    return key
+
+
+def load_signing_key():
+    """Return (private_key, kid) from env or a mounted file, or (None, "").
+
+    Mirrors load_api_token's precedence deliberately: LOKI_RECEIPT_SIGNING_KEY
+    then LOKI_RECEIPT_SIGNING_KEY_FILE, the normal Kubernetes mounted-secret
+    path. Absence is NOT an error -- it is the default, and it means receipts
+    stay UNSIGNED exactly as they were before this module existed.
+    """
+    if not _CRYPTO_AVAILABLE:
+        return None, ""
+    pem = os.environ.get("LOKI_RECEIPT_SIGNING_KEY", "").strip()
+    if pem:
+        key = _load_private_key(pem.encode("utf-8"))
+    else:
+        key_file = os.environ.get("LOKI_RECEIPT_SIGNING_KEY_FILE", "").strip()
+        if not key_file:
+            return None, ""
+        try:
+            key = _load_private_key(Path(key_file).read_bytes())
+        except OSError as e:
+            logging.error(
+                "receipt signing: cannot read LOKI_RECEIPT_SIGNING_KEY_FILE %s: %s",
+                key_file, e,
+            )
+            return None, ""
+    if key is None:
+        return None, ""
+    return key, compute_kid(key.public_key())
+
+
+def load_retired_public_keys():
+    """Public keys that must stay in JWKS so OLD receipts still verify.
+
+    THIS IS THE ROTATION STORY, and it is why the item was deferred until now.
+    LOKI_RECEIPT_RETIRED_PUBKEYS is a colon-separated list of PEM file paths.
+    After rotating, the operator moves the previous PUBLIC key here; receipts
+    it signed keep verifying, while nothing new is signed with it. Without this
+    a rotation would make every historical receipt read as unverifiable, which
+    a checker cannot distinguish from tampering.
+
+    A path that cannot be read is logged and skipped rather than fatal: one bad
+    path must not take down the whole endpoint and with it verification of
+    every OTHER key.
+    """
+    if not _CRYPTO_AVAILABLE:
+        return []
+    raw = os.environ.get("LOKI_RECEIPT_RETIRED_PUBKEYS", "").strip()
+    if not raw:
+        return []
+    out = []
+    for path in raw.split(":"):
+        path = path.strip()
+        if not path:
+            continue
+        try:
+            pub = serialization.load_pem_public_key(Path(path).read_bytes())
+        except (OSError, ValueError, TypeError) as e:
+            logging.error("receipt signing: skipping retired key %s: %s", path, e)
+            continue
+        if not isinstance(pub, Ed25519PublicKey):
+            logging.error("receipt signing: retired key %s is not Ed25519", path)
+            continue
+        out.append(pub)
+    return out
+
+
+def public_jwk(public_key: "Ed25519PublicKey", kid: str = "") -> dict:
+    """One JWKS entry. `use`/`alg` are set so a verifier need not infer them."""
+    raw = public_key.public_bytes(
+        encoding=serialization.Encoding.Raw,
+        format=serialization.PublicFormat.Raw,
+    )
+    return {
+        "kty": "OKP",
+        "crv": "Ed25519",
+        "x": _b64url(raw),
+        "use": "sig",
+        "alg": "EdDSA",
+        "kid": kid or compute_kid(public_key),
+    }
+
+
+def build_jwks(private_key=None, retired_public_keys=None) -> dict:
+    """The full public key set: the active key first, then retired ones.
+
+    Deduplicated by kid so listing a retired key that is still active does not
+    publish it twice -- a duplicate kid makes key selection ambiguous for a
+    verifier that stops at the first match.
+    """
+    keys, seen = [], set()
+    if private_key is not None:
+        jwk = public_jwk(private_key.public_key())
+        keys.append(jwk)
+        seen.add(jwk["kid"])
+    for pub in retired_public_keys or []:
+        jwk = public_jwk(pub)
+        if jwk["kid"] in seen:
+            continue
+        keys.append(jwk)
+        seen.add(jwk["kid"])
+    return {"keys": keys}
+
+
+def sign_attestation(private_key, kid, *, job_id, run_id, receipt_hash,
+                     submitter="", issued_at=None, issuer=""):
+    """Return a compact JWT binding a receipt hash to a job identity.
+
+    The signed claims are what gpg could never carry: WHICH job produced this
+    receipt, WHO submitted it, and WHEN. `receipt_hash` is the integrity hash
+    the receipt already computes over itself with `verification` stripped, so
+    the JWT attests to the same bytes a checker independently recomputes --
+    signing a different digest would let the two disagree while both look
+    valid.
+
+    Returns "" when signing is not configured. The caller must treat that as
+    UNSIGNED and must not present the receipt as attested.
+    """
+    if private_key is None or not kid:
+        return ""
+    if issued_at is None:
+        import time
+        issued_at = int(time.time())
+    header = {"alg": "EdDSA", "typ": "JWT", "kid": kid}
+    payload = {
+        "job_id": job_id,
+        "run_id": run_id,
+        "receipt_sha256": receipt_hash,
+        "iat": issued_at,
+    }
+    # Optional claims are omitted rather than emitted empty: a present-but-blank
+    # `sub` reads as "an anonymous submitter was recorded" instead of "no
+    # submitter identity was available".
+    if submitter:
+        payload["sub"] = submitter
+    if issuer:
+        payload["iss"] = issuer
+    signing_input = (
+        _b64url(json.dumps(header, separators=(",", ":"), sort_keys=True).encode())
+        + "."
+        + _b64url(json.dumps(payload, separators=(",", ":"), sort_keys=True).encode())
+    )
+    try:
+        sig = private_key.sign(signing_input.encode("ascii"))
+    except Exception as e:  # pragma: no cover - key validated at load
+        logging.error("receipt signing: sign failed: %s", e)
+        return ""
+    return signing_input + "." + _b64url(sig)
+
+
+def verify_attestation(token: str, jwks: dict):
+    """Verify a compact JWT against a JWKS. Returns (ok, claims_or_reason).
+
+    Present so the CLI and tests check tokens the same way a third party would,
+    against the published key set only -- never against the private key, which
+    would pass even if JWKS published the wrong thing.
+
+    Selection is by `kid`. A token whose kid is absent from the set is REFUSED
+    rather than tried against every key: trying all of them would make a
+    rotated-away receipt indistinguishable from one signed by an unpublished
+    key.
+    """
+    if not _CRYPTO_AVAILABLE:
+        return False, "cryptography is not installed"
+    parts = token.split(".")
+    if len(parts) != 3:
+        return False, "malformed token"
+    try:
+        header = json.loads(_b64url_decode(parts[0]))
+        payload = json.loads(_b64url_decode(parts[1]))
+        sig = _b64url_decode(parts[2])
+    except (ValueError, json.JSONDecodeError):
+        return False, "malformed token"
+    if header.get("alg") != "EdDSA":
+        # Refusing an unexpected alg is what blocks the classic "alg: none" and
+        # algorithm-substitution attacks.
+        return False, "unexpected alg: %s" % header.get("alg")
+    kid = header.get("kid", "")
+    if not kid:
+        return False, "token carries no kid"
+    match = None
+    for jwk in jwks.get("keys", []):
+        if jwk.get("kid") == kid:
+            match = jwk
+            break
+    if match is None:
+        return False, "no published key with kid %s" % kid
+    try:
+        pub = Ed25519PublicKey.from_public_bytes(_b64url_decode(match["x"]))
+        pub.verify(sig, (parts[0] + "." + parts[1]).encode("ascii"))
+    except Exception:
+        return False, "signature does not verify"
+    return True, payload

package/autonomy/run.sh

@@ -12393,6 +12393,36 @@ auto_generate_docs_if_needed() {
     # never pushed). Wrap it in a timeout; docs are non-gating, so on timeout we
     # warn and continue to the gate (which scores whatever docs exist).
     local _doc_to="${LOKI_DOCS_TIMEOUT:-${LOKI_GATE_TIMEOUT:-300}}"
+    # SCALE THE BUDGET TO WHAT THERE IS TO DOCUMENT. Measured on a graded
+    # single-file build (hard-1-order-api): 2.8 min of iteration work, 13.4 min
+    # wall clock, and 5.0 of those minutes were THIS step timing out at 300s
+    # over one 20-line Python file -- 37% of the build spent generating an
+    # eight-file architecture suite for a project that has one module.
+    #
+    # The simple-tier fast-path above did not catch it: detect_complexity reads
+    # PRD PROSE (288 words, 3 sections) rather than build effort, so a
+    # tersely-specified one-function task classifies "standard". Rather than
+    # move those thresholds -- they also drive iteration caps and model tiers --
+    # this bounds the WASTE directly, where the cost actually is.
+    #
+    # Only ever LOWERS the budget, and only when the operator did not set one.
+    # A big project keeps the full 300s. Counting is capped so the find itself
+    # cannot become the new cost.
+    if [ -z "${LOKI_DOCS_TIMEOUT:-}" ]; then
+        local _doc_src=0
+        _doc_src=$(find "$project_dir" -type f \
+            \( -name '*.py' -o -name '*.js' -o -name '*.ts' -o -name '*.tsx' \
+               -o -name '*.go' -o -name '*.rs' -o -name '*.java' \) \
+            -not -path '*/node_modules/*' -not -path '*/.loki/*' \
+            -not -path '*/.git/*' -not -path '*/dist/*' 2>/dev/null | head -40 | wc -l | tr -d ' ')
+        _doc_src="${_doc_src:-0}"
+        # <=3 source files cannot need an architecture suite. 90s still allows a
+        # README + USAGE pass, which is all the gate asks of a small project.
+        if [ "$_doc_src" -le 3 ] && [ "$_doc_to" -gt 90 ]; then
+            log_info "Auto-documentation: ${_doc_src} source file(s) -- capping generation at 90s (was ${_doc_to}s)"
+            _doc_to=90
+        fi
+    fi
     local _doc_cmd=()
     if command -v gtimeout >/dev/null 2>&1; then
         _doc_cmd=(gtimeout "${_doc_to}s")

package/autonomy/trigger-server.py

@@ -51,6 +51,35 @@ import time
 from datetime import datetime
 from pathlib import Path
 
+# Receipt attestation. Imported by path because trigger-server.py runs as a
+# script from an arbitrary cwd, so a bare `import receipt_jwt` would depend on
+# the caller's directory. An ImportError is NOT fatal: signing is optional, and
+# a server that refused to start without it would turn an optional feature into
+# a hard dependency on `cryptography`.
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+try:
+    from receipt_jwt import (
+        build_jwks,
+        load_retired_public_keys,
+        load_signing_key,
+        sign_attestation,
+    )
+    _ATTESTATION_AVAILABLE = True
+except ImportError:  # pragma: no cover - only on a stripped install
+    _ATTESTATION_AVAILABLE = False
+
+    def build_jwks(private_key=None, retired_public_keys=None):
+        return {"keys": []}
+
+    def load_signing_key():
+        return None, ""
+
+    def load_retired_public_keys():
+        return []
+
+    def sign_attestation(*_a, **_k):
+        return ""
+
 
 # A GitHub repository full_name is "owner/repo". Both segments are restricted to
 # the characters GitHub itself allows (letters, digits, dot, underscore, dash).
@@ -757,6 +786,38 @@ class Dispatcher:
                 return "", "unknown job id"
             return self._resolve_proof_id(entry)
 
+    def metrics(self):
+        """Queue depth and saturation, for autoscaling and for operators.
+
+        QUEUE DEPTH IS THE RIGHT SCALING SIGNAL HERE, AND CPU IS THE WRONG ONE.
+        A worker spends nearly all of a build waiting on a model API, so it is
+        idle by CPU measure while the backlog grows. An HPA on CPU would scale
+        DOWN a saturated cluster. Depth is the only metric that moves when work
+        is waiting.
+
+        `queue_saturation` is depth/maxsize, so a chart can target a fraction
+        without knowing the absolute size an operator configured.
+
+        Reads `_pending` under the same lock that writes it; `qsize()` is
+        approximate by design in CPython and is documented as such rather than
+        presented as exact.
+        """
+        with self._jobs_lock:
+            pending = self._pending
+            dispatched = self._dispatch_seq
+        depth = self.queue.qsize()
+        maxsize = self.queue.maxsize or 1
+        return {
+            "queue_depth": depth,
+            "queue_maxsize": maxsize,
+            "queue_saturation": round(depth / maxsize, 4),
+            "dispatched_total": dispatched,
+            "awaiting_receipt": pending,
+            "note": "queue_depth is approximate (queue.qsize semantics); scale on "
+                    "queue_saturation, never on CPU -- a worker blocked on a model "
+                    "call is idle by CPU measure while the backlog grows.",
+        }
+
     def submit(self, event_type, payload):
         """Enqueue an event. Returns True if accepted, False if the queue is full."""
         try:
@@ -811,6 +872,12 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
     # above: one authenticates GitHub, the other authenticates a human.
     api_token = ""
     dispatcher = None
+    # Ed25519 key that attests receipts, and the retired public keys that keep
+    # pre-rotation receipts verifiable. Both default to unconfigured, which
+    # means receipts stay UNSIGNED exactly as before this existed.
+    signing_key = None
+    signing_kid = ""
+    retired_pubkeys = ()
 
     # Cap the body we will read so a huge POST cannot exhaust memory.
     MAX_BODY_BYTES = 5 * 1024 * 1024
@@ -833,6 +900,10 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
                 "secret_configured": bool(self.secret),
                 "api_token_configured": bool(self.api_token),
             })
+        elif path == "/.well-known/jwks.json":
+            self._handle_jwks()
+        elif path == "/metrics":
+            self._handle_metrics()
         elif path.startswith("/jobs/") and path.endswith("/proof"):
             self._handle_job_proof(path[len("/jobs/"):-len("/proof")])
         elif path.startswith("/jobs/"):
@@ -885,6 +956,49 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
             return
         self._send_json(200, job)
 
+    def _handle_metrics(self):
+        """GET /metrics -- queue depth for autoscaling and for operators.
+
+        AUTHENTICATED, unlike /.well-known/jwks.json, and the difference is
+        deliberate. JWKS is public key material whose whole value is that
+        anyone can fetch it. Queue depth is operational posture: it reveals
+        load, capacity and whether a cluster is saturated. Publishing that
+        unauthenticated would hand an attacker a free saturation oracle.
+
+        In-cluster scrapers (an HPA adapter, Prometheus) present the same
+        bearer token as any other /jobs caller, so no new credential is
+        introduced for this.
+        """
+        if not self._check_api_auth():
+            return
+        if self.dispatcher is None:
+            self._send_json(503, {"error": "no dispatcher"})
+            return
+        self._send_json(200, self.dispatcher.metrics())
+
+    def _handle_jwks(self):
+        """GET /.well-known/jwks.json -- the public keys that sign receipts.
+
+        DELIBERATELY UNAUTHENTICATED, and that is the whole point. This is
+        public key material, and the value of an attested receipt is that a
+        third party can check it WITHOUT holding our API token. Requiring the
+        token here would mean only people we already trust could verify, which
+        is the same as not being verifiable at all.
+
+        Serves the active key plus any retired ones, so a receipt issued before
+        a rotation still verifies afterwards. Without that, rotating would make
+        every historical receipt read as unverifiable -- and a checker cannot
+        tell that apart from tampering.
+
+        Returns an empty key set (not a 404) when signing is unconfigured: the
+        endpoint exists and honestly reports that nothing is signed, which is
+        distinguishable from "this server has no such endpoint".
+        """
+        self._send_json(200, build_jwks(
+            private_key=self.signing_key,
+            retired_public_keys=self.retired_pubkeys,
+        ))
+
     def _handle_job_proof(self, job_id):
         """GET /jobs/<id>/proof -- that job's Evidence Receipt.
 
@@ -914,7 +1028,54 @@ class WebhookHandler(http.server.BaseHTTPRequestHandler):
                 "reason": reason or "the recorded receipt could not be read",
             })
             return
-        self._send_json(200, proof)
+        self._send_json(200, self._attest(proof, job_id, run_id))
+
+    def _attest(self, proof, job_id, run_id):
+        """Attach a signed attestation to a receipt, if signing is configured.
+
+        The JWT is bound to `verification.hash` -- the digest the receipt ALREADY
+        records over itself with `verification` stripped. Signing any other value
+        would let the attestation and the checker's own recomputation disagree
+        while both looked valid, which is worse than not signing at all.
+
+        The token is added under `verification.attestation`, which sits inside
+        the subtree the hash excludes. Putting it anywhere else would change the
+        bytes the hash covers and make every honest receipt read as tampered the
+        moment it was signed.
+
+        Returns the receipt UNCHANGED when signing is unconfigured or the hash
+        is missing. An unsigned receipt is a valid state with an existing
+        verdict; a receipt claiming an attestation it does not have is not.
+        """
+        if self.signing_key is None:
+            return proof
+        verification = proof.get("verification")
+        if not isinstance(verification, dict):
+            return proof
+        receipt_hash = verification.get("hash") or ""
+        if not receipt_hash:
+            # No self-recorded digest means there is nothing to bind to. Signing
+            # the whole body instead would attest to bytes the checker never
+            # recomputes, so the honest move is to leave it unsigned.
+            logging.warning(
+                "receipt attestation: run %s has no verification.hash; left UNSIGNED",
+                run_id,
+            )
+            return proof
+        token = sign_attestation(
+            self.signing_key, self.signing_kid,
+            job_id=job_id, run_id=run_id, receipt_hash=receipt_hash,
+        )
+        if not token:
+            return proof
+        # Copied rather than mutated: read_proof returns a fresh parse today, but
+        # a future cache would make in-place mutation compound tokens across
+        # requests.
+        out = dict(proof)
+        out["verification"] = dict(verification)
+        out["verification"]["attestation"] = token
+        out["verification"]["attestation_kid"] = self.signing_kid
+        return out
 
     def _read_body(self):
         """Read and return the request body, or None if it was refused.
@@ -1199,6 +1360,11 @@ def main():
     WebhookHandler.api_token = api_token
     WebhookHandler.dispatcher = dispatcher
 
+    signing_key, signing_kid = load_signing_key()
+    WebhookHandler.signing_key = signing_key
+    WebhookHandler.signing_kid = signing_kid
+    WebhookHandler.retired_pubkeys = tuple(load_retired_public_keys())
+
     server = ThreadingWebhookServer(("", port), WebhookHandler)
     write_pid_file()
 
@@ -1207,6 +1373,25 @@ def main():
     logging.info("Webhook endpoint: POST http://localhost:%d/webhook", port)
     logging.info("Health check: GET http://localhost:%d/health", port)
     logging.info("Submit endpoint: POST http://localhost:%d/jobs", port)
+    if signing_key is not None:
+        logging.info(
+            "Receipt attestation: ACTIVE (kid %s), public keys at "
+            "GET http://localhost:%d/.well-known/jwks.json%s",
+            signing_kid, port,
+            " (+%d retired)" % len(WebhookHandler.retired_pubkeys)
+            if WebhookHandler.retired_pubkeys else "",
+        )
+    elif not _ATTESTATION_AVAILABLE:
+        logging.info(
+            "Receipt attestation: unavailable (cryptography not installed); "
+            "receipts remain UNSIGNED"
+        )
+    else:
+        logging.info(
+            "Receipt attestation: not configured; receipts remain UNSIGNED. "
+            "Set LOKI_RECEIPT_SIGNING_KEY_FILE to let submitters verify a "
+            "receipt without trusting this server."
+        )
     logging.info("Workers: %d, queue size: %d", workers, queue_size)
     if not api_token:
         logging.warning(

package/dashboard/__init__.py

@@ -7,7 +7,7 @@ Modules:
     control: Session control API (start/stop/pause/resume)
 """
 
-__version__ = "9.18.4"
+__version__ = "9.20.0"
 
 # Expose the control app for easy import
 try: