ltcai 11.5.2 → 11.7.0

package/lattice_brain/portability/constants.py

@@ -1,93 +0,0 @@
-"""Formats, gates and the vocabulary the portability surfaces agree on.
-
-Everything here is a literal or a gate: no I/O, no graph, no service. Keeping
-it in one leaf module is what lets the file helpers, the sharing surface and
-the backup surface all import the same constants without importing each other.
-"""
-
-from __future__ import annotations
-
-from ..gates import FeatureGate
-from ..utils import utc_now_iso
-
-FORMAT = "latticeai.kg.export"
-FORMAT_VERSION = 1
-BACKUP_FORMAT = "latticeai.kg.backup"
-
-# ── selective subgraph share (v11.1.0 prototype, off by default) ─────────────
-#: Logical format of a *partial* bundle: a chosen slice of the graph plus its
-#: provenance, signed by this device. Deliberately distinct from ``FORMAT`` so
-#: the whole-graph importer can never be handed a subgraph by accident.
-SUBGRAPH_FORMAT = "latticeai.kg.subgraph"
-SUBGRAPH_FORMAT_VERSION = 1
-#: Encrypted on-disk envelope for the same bundle, reusing the ``.latticebrain``
-#: passphrase mechanism (PBKDF2-SHA256 + AES-256-GCM) from ``archive.py``.
-SUBGRAPH_ARCHIVE_FORMAT = "latticebrain.subgraph"
-#: Opt-in gate. Off unless the operator sets it: sharing knowledge with another
-#: Brain is a network act, and local-first means those are never on by default.
-BRAIN_NETWORK_ENV = "LATTICEAI_BRAIN_NETWORK"
-_TRUTHY = frozenset({"1", "true", "yes", "on"})
-#: How a bundle can be encrypted. ``passphrase`` needs a secret agreed out of
-#: band; ``recipient_public_key`` needs nothing secret to travel at all.
-ENCRYPTION_MODES = ("passphrase", "recipient_public_key")
-#: A received bundle becomes review items, never a merge. The cap keeps one
-#: peer from flooding the inbox; what it dropped is reported, not hidden.
-SUBGRAPH_PROPOSAL_CAP = 200
-#: Review-queue vocabulary. ``kg_change_digest`` is the existing source for
-#: "the graph would change"; the kind distinguishes shared-subgraph items.
-SUBGRAPH_REVIEW_SOURCE = "kg_change_digest"
-SUBGRAPH_REVIEW_KIND = "shared_subgraph_node"
-#: Mirrors ``services.review_queue.OPEN_STATUSES``. Duplicated as a literal
-#: rather than imported because ``lattice_brain`` must not depend on the
-#: ``latticeai`` service layer; the review sink is injected, not imported.
-_OPEN_REVIEW_STATUSES = frozenset({"pending", "snoozed"})
-
-BRAIN_NETWORK_DISABLED_DETAIL = (
-    "Brain Network sharing is off. It is opt-in by design: set "
-    f"{BRAIN_NETWORK_ENV}=1 to enable selective subgraph export and receipt."
-)
-
-
-#: The share gate, resolved when it is asked. The environment variable is still
-#: the default answer — an untouched install behaves exactly as it did — but a
-#: settings surface can now bind a resolver and move it without a restart.
-BRAIN_NETWORK_GATE = FeatureGate(
-    BRAIN_NETWORK_ENV,
-    default=False,
-    name="brain_network",
-    detail=BRAIN_NETWORK_DISABLED_DETAIL,
-)
-
-
-class BrainNetworkDisabled(PermissionError):
-    """Raised when a share surface is used while the opt-in flag is off."""
-
-    def __init__(self, detail: str = BRAIN_NETWORK_DISABLED_DETAIL) -> None:
-        super().__init__(detail)
-
-
-def brain_network_enabled() -> bool:
-    """True only when the operator explicitly opted in (default: off)."""
-    return BRAIN_NETWORK_GATE.enabled()
-
-
-def require_brain_network() -> None:
-    if not brain_network_enabled():
-        raise BrainNetworkDisabled()
-
-
-def _stamp() -> str:
-    return utc_now_iso().replace(":", "").replace("-", "").replace(".", "")[:15]
-
-
-#: Sender-identifying fields stripped from a shared bundle by default. The
-#: knowledge travels; "which account, on which machine, at which path" does not.
-_REDACTED_FIELDS = frozenset({"owner", "user_email", "source_uri", "permissions"})
-#: The signed payload's key set. One tuple so export and verify can never
-#: disagree about what the digest covers.
-_PAYLOAD_KEYS = (
-    "nodes", "chunk_nodes", "edges", "chunks", "knowledge_sources", "provenance",
-)
-#: Node types a one-hop expansion never admits — they describe the sender
-#: (identity, local paths), not the knowledge being shared.
-_NEIGHBOR_EXCLUDED_TYPES = frozenset({"Person", "Source"})

package/lattice_brain/portability/fsops.py

@@ -1,138 +0,0 @@
-"""Atomic file swaps for restore, and the rollback that never masks a failure.
-
-A restore replaces a live SQLite database and a blob tree in place. Each helper
-here stages the new copy, keeps a pre-restore backup of what it is about to
-overwrite, and — on any failure — puts the old files back *best-effort* while
-always re-raising the original error. Recovery I/O that raises would hide the
-failure being reported, which is the bug these guards exist for.
-"""
-
-from __future__ import annotations
-
-import logging
-import os
-import shutil
-import sqlite3
-from contextlib import closing
-from pathlib import Path, PurePosixPath
-from typing import Optional
-
-from ..quiet import quiet
-from .constants import _stamp
-
-
-def _safe_zip_names(names) -> None:
-    for name in names:
-        path = PurePosixPath(name)
-        if path.is_absolute() or ".." in path.parts:
-            raise ValueError(f"Backup archive contains unsafe path: {name}")
-
-
-def _pre_restore_backup_dir(anchor: Path) -> Path:
-    backup_dir = anchor.parent / f"{anchor.name}.pre-restore-{_stamp()}"
-    index = 1
-    while backup_dir.exists():
-        backup_dir = anchor.parent / f"{anchor.name}.pre-restore-{_stamp()}-{index}"
-        index += 1
-    backup_dir.mkdir(parents=True)
-    return backup_dir
-
-
-def _sqlite_siblings(db_path: Path) -> tuple[Path, Path, Path]:
-    return (db_path, Path(str(db_path) + "-wal"), Path(str(db_path) + "-shm"))
-
-
-def _checkpoint_sqlite(db_path: Path) -> None:
-    if not db_path.exists():
-        return
-    try:
-        with closing(sqlite3.connect(str(db_path))) as conn, conn:
-            conn.execute("PRAGMA wal_checkpoint(FULL)")
-    except sqlite3.Error:
-        # Best-effort only. Existing sibling backup/restore still preserves
-        # the WAL files if a live connection prevents a checkpoint.
-        return
-
-
-def _restore_sibling(path: Path, backup: Path) -> None:
-    try:
-        shutil.copy2(backup, path)
-    except FileNotFoundError:
-        # The backup vanished (or never existed — transient -wal/-shm): the
-        # honest reconstruction is "no such sibling", never a crash that
-        # masks the error that triggered the rollback.
-        path.unlink(missing_ok=True)
-
-
-def _replace_sqlite_atomically(src: Path, dest: Path, backup_dir: Path) -> None:
-    dest.parent.mkdir(parents=True, exist_ok=True)
-    tmp = dest.parent / f".{dest.name}.restore-{_stamp()}-{os.getpid()}.tmp"
-    shutil.copyfile(src, tmp)
-    backups: dict[Path, Path] = {}
-    try:
-        _checkpoint_sqlite(dest)
-        # -wal/-shm are transient: another live connection can checkpoint and
-        # remove them between exists() and the copy/unlink. Treat a vanished
-        # sibling as "nothing to preserve" instead of crashing the restore.
-        for sibling in _sqlite_siblings(dest):
-            backup = backup_dir / sibling.name
-            try:
-                shutil.copy2(sibling, backup)
-            except FileNotFoundError:
-                quiet()
-                continue
-            backups[sibling] = backup
-        for sibling in _sqlite_siblings(dest)[1:]:
-            sibling.unlink(missing_ok=True)
-        os.replace(tmp, dest)
-    except Exception:
-        # Recovery I/O must never replace the swap error being reported —
-        # an exception raised here would mask it (the CI-observed
-        # "[Errno 2]" over the real failure). Best-effort restore, then
-        # always re-raise the original.
-        try:
-            tmp.unlink(missing_ok=True)
-        except OSError as cleanup_exc:
-            logging.warning("restore tmp cleanup failed: %s", cleanup_exc)
-        for sibling in _sqlite_siblings(dest):
-            try:
-                _restore_sibling(sibling, backups.get(sibling, backup_dir / sibling.name))
-            except OSError as rollback_exc:
-                logging.warning(
-                    "restore sibling rollback incomplete for %s: %s",
-                    sibling, rollback_exc,
-                )
-        raise
-
-
-def _rollback_sqlite_from_backup(dest: Path, backup_dir: Path) -> None:
-    for sibling in _sqlite_siblings(dest):
-        _restore_sibling(sibling, backup_dir / sibling.name)
-
-
-def _replace_tree_with_backup(src: Optional[Path], dest: Path, backup_dir: Path) -> None:
-    dest.parent.mkdir(parents=True, exist_ok=True)
-    staged = dest.parent / f".{dest.name}.restore-{_stamp()}-{os.getpid()}"
-    backup = backup_dir / dest.name
-    if src and src.exists():
-        shutil.copytree(src, staged)
-    else:
-        staged.mkdir(parents=True)
-    try:
-        if dest.exists():
-            shutil.copytree(dest, backup)
-            shutil.rmtree(dest)
-        os.replace(staged, dest)
-    except Exception:
-        # Same masking guard as the sqlite swap: rollback I/O is
-        # best-effort and the original failure always propagates.
-        try:
-            if staged.exists():
-                shutil.rmtree(staged)
-            if dest.exists():
-                shutil.rmtree(dest)
-            if backup.exists():
-                shutil.copytree(backup, dest)
-        except OSError as rollback_exc:
-            logging.warning("blob tree rollback incomplete: %s", rollback_exc)
-        raise

package/lattice_brain/portability/service.py

@@ -1,41 +0,0 @@
-"""The composed portability service — state, availability, and the two halves.
-
-``KGPortabilityService`` owns the constructor state every surface reads
-(``_kg``, ``_data_dir``, ``_exports_dir``, ``_identity``, the lazily created
-recipient key) and inherits its behaviour from the sharing and backup mixins.
-Same public surface, same method resolution, in two readable files instead of
-one thousand-line one.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-from typing import Any
-
-from .backups import KGPortabilityBackupMixin
-from .sharing import KGPortabilitySharingMixin
-
-
-class KGPortabilityService(KGPortabilitySharingMixin, KGPortabilityBackupMixin):
-    def __init__(self, *, knowledge_graph: Any, data_dir, enable_graph: bool = True, device_identity: Any = None) -> None:
-        self._kg = knowledge_graph
-        self._data_dir = Path(data_dir)
-        self._enable = bool(enable_graph)
-        self._exports_dir = self._data_dir / "workspace_exports"
-        # v4 sovereignty: when a DeviceIdentity is wired, exports are signed
-        # and imports record origin provenance. Pre-v4 unsigned bundles stay
-        # importable locally (origin='unsigned-legacy') — signatures are
-        # mandatory only on the Brain Network peer path.
-        self._identity = device_identity
-        # The receiving X25519 key is created lazily: a Brain that never asks
-        # anyone to seal anything to it should not be minting key material on
-        # every startup (v11.2.0).
-        self._recipient: Any = None
-        self._recipient_loaded = False
-
-    def available(self) -> bool:
-        return self._enable and self._kg is not None
-
-    def _require(self) -> None:
-        if not self.available():
-            raise RuntimeError("Knowledge Graph is disabled (LATTICEAI_ENABLE_GRAPH).")