aac-cli 0.2.5__tar.gz → 0.2.6__tar.gz

{aac_cli-0.2.5/aac_cli.egg-info → aac_cli-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aac-cli
-Version: 0.2.5
+Version: 0.2.6
 Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
 Author: Agent Authority Cloud Project
 License-Expression: Apache-2.0
@@ -69,8 +69,13 @@ Python 3.11 or newer is required.
 
 Installing or upgrading `aac-cli` supplies both `aac` and `aeg`.
 Use the [AEG guide and command reference](https://cascadeauth.github.io/aac-starter-guide/aeg.html)
-for rendering local evidence, selecting a profile, and migrating an older
-standalone AEG installation.
+for listing local and central observations, rendering evidence, and selecting a profile.
+
+`aeg list --profile PROFILE --since 7d` discovers participant-visible central
+roots. Add `--events FILE` and/or `--actions FILE` for a hybrid listing with local
+task references and a `local`, `control-plane` or `both` source column. Omit the
+profile for offline local listing. Central fetches are bounded and expose
+continuation; forwarding remains best-effort. Local files are never uploaded.
 
 ## Guided setup using `aac init`
 
@@ -381,7 +386,7 @@ issues them for those names or checks supplied certificates against them; renewa
 keeps those names. Applying a different name set requires the installed certificate
 to cover it already: supplied issuers can issue a certificate covering both sets
 before the change. A CLI-issued agent needing new names must be created under a
-new name with the intended configuration. No old agent-record format is migrated.
+new name with the intended configuration.
 
 Central forwarding retains the local sink and sends only permitted metadata.
 It is asynchronous and best-effort; a local event does not prove central delivery.

{aac_cli-0.2.5 → aac_cli-0.2.6}/README.md

@@ -47,8 +47,13 @@ Python 3.11 or newer is required.
 
 Installing or upgrading `aac-cli` supplies both `aac` and `aeg`.
 Use the [AEG guide and command reference](https://cascadeauth.github.io/aac-starter-guide/aeg.html)
-for rendering local evidence, selecting a profile, and migrating an older
-standalone AEG installation.
+for listing local and central observations, rendering evidence, and selecting a profile.
+
+`aeg list --profile PROFILE --since 7d` discovers participant-visible central
+roots. Add `--events FILE` and/or `--actions FILE` for a hybrid listing with local
+task references and a `local`, `control-plane` or `both` source column. Omit the
+profile for offline local listing. Central fetches are bounded and expose
+continuation; forwarding remains best-effort. Local files are never uploaded.
 
 ## Guided setup using `aac init`
 
@@ -359,7 +364,7 @@ issues them for those names or checks supplied certificates against them; renewa
 keeps those names. Applying a different name set requires the installed certificate
 to cover it already: supplied issuers can issue a certificate covering both sets
 before the change. A CLI-issued agent needing new names must be created under a
-new name with the intended configuration. No old agent-record format is migrated.
+new name with the intended configuration.
 
 Central forwarding retains the local sink and sends only permitted metadata.
 It is asynchronous and best-effort; a local event does not prove central delivery.

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli/__init__.py

@@ -10,4 +10,4 @@ entrypoint (`aac_cli.cli:entrypoint`).
 # test in bin/tests/test_cli_version_parity.py. A literal keeps the
 # shipped code free of import-time metadata lookups (and their
 # not-installed failure mode).
-__version__ = "0.2.5"
+__version__ = "0.2.6"

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli/_aeg/cli.py

@@ -39,7 +39,7 @@ def parser(
     commands = result.add_subparsers(dest="command", required=True)
     render = commands.add_parser("render", help="Write a self-contained interactive HTML graph.")
     listing = commands.add_parser(
-        "list", help="List candidate roots from explicitly supplied local files."
+        "list", help="List roots from local files, a control-plane profile, or both."
     )
     for command in (render, listing):
         command.add_argument(
@@ -72,9 +72,18 @@ def parser(
     selector.add_argument("--root-token-id", metavar="ID")
     selector.add_argument("--mint-response", type=Path, metavar="FILE")
     render.add_argument("--output", type=Path, required=True, metavar="FILE")
-    listing.add_argument("--task-ref", help="Exact local task reference.")
+    listing.add_argument(
+        "--profile", help="Query this AAC CLI profile; with files, join by root ID."
+    )
+    listing.add_argument("--task-ref", help="Exact local task reference; requires local files.")
+    listing.add_argument("--limit", type=int, help="Central page size, 1..200 (default 50).")
+    listing.add_argument("--max-pages", type=int, help="Central fetch bound, 1..20 (default 1).")
+    listing.add_argument("--page-token", help="Continue central enumeration; omit --since.")
     time_start = listing.add_mutually_exclusive_group()
-    time_start.add_argument("--since", help="Look back from now, e.g. 24h or 7d.")
+    time_start.add_argument(
+        "--since",
+        help="Look back, e.g. 24h or 7d; online defaults to 24h, maximum 31d. Local also accepts m.",
+    )
     time_start.add_argument(
         "--from", dest="from_time", help="Inclusive ISO 8601 observation time with timezone."
     )
@@ -185,11 +194,21 @@ def _date(value: str) -> datetime:
         raise InputError(f"invalid time {value!r}; use ISO 8601 with timezone") from exc
 
 
-def _list(args, events) -> int:
+def _list(args, events, list_query) -> int:
+    if args.profile is not None:
+        if not args.profile.strip():
+            raise InputError("--profile must name an existing AAC CLI profile")
+        if args.task_ref is not None and not (args.events or args.actions):
+            raise InputError(
+                "--task-ref requires local files; the control plane stores no task references"
+            )
+        if list_query is None:
+            raise InputError("online listing requires the aeg command supplied by aac-cli")
+        return list_query(args, events)
     if not (args.events or args.actions):
-        raise InputError(
-            "local list requires --events and/or --actions; profile and hybrid listing belong to a later release"
-        )
+        raise InputError("supply --events, --actions and/or --profile to list roots")
+    if any(value is not None for value in (args.limit, args.max_pages, args.page_token)):
+        raise InputError("--limit, --max-pages and --page-token require --profile")
     start = _date(args.from_time) if args.from_time else None
     stop = _date(args.to_time) if args.to_time else None
     if args.since:
@@ -204,6 +223,13 @@ def _list(args, events) -> int:
             raise InputError("--since duration is outside supported range") from exc
     if start and stop and start > stop:
         raise InputError("--from/--since must precede --to")
+    rows, diagnostics = local_rows(events, args.task_ref, start, stop)
+    print_listing(args.output, rows, diagnostics)
+    return 0
+
+
+def local_rows(events, task_ref, start, stop):
+    """Select local activity, retaining older evidence for token/root correlation."""
     roots, mapping = roots_and_mapping(events)
     diagnostics = [
         f"{e.raw_event.get('_source', e.source)}: unmatched action {e.token_id}; supply sidecar root mapping"
@@ -230,7 +256,7 @@ def _list(args, events) -> int:
                 or (e.raw_event.get("action_payload") or {}).get("task_ref")
             }
         )
-        if args.task_ref and args.task_ref not in task_refs:
+        if task_ref is not None and task_ref not in task_refs:
             continue
         observed = [
             e
@@ -240,36 +266,68 @@ def _list(args, events) -> int:
         ]
         if not observed:
             continue
-        times = sorted(e.timestamp_iso for e in observed)
+        times = sorted(_date(e.timestamp_iso) for e in observed)
         rows.append(
             {
                 "root_token_id": root,
                 "task_refs": task_refs,
-                "first_observed": times[0],
-                "last_observed": times[-1],
+                "first_observed": times[0].isoformat(),
+                "last_observed": times[-1].isoformat(),
                 "sources": "local",
                 "evidence_sources": sorted(
                     {str(e.raw_event.get("_source", e.source)) for e in observed}
                 ),
             }
         )
-    if args.output == "json":
-        print(json.dumps({"chains": rows, "diagnostics": diagnostics}, indent=2))
+    return rows, diagnostics
+
+
+def print_listing(output, rows, diagnostics, coverage=None):
+    if output == "json":
+        body = {"chains": rows, "diagnostics": diagnostics}
+        if coverage is not None:
+            body.update(coverage)
+        print(json.dumps(body, indent=2))
     else:
+        if coverage is not None:
+            central = coverage["central"]
+            print(
+                "Central observations may be incomplete (best-effort forwarding; live pagination)."
+            )
+            if coverage["from"] is None or coverage["to"] is None:
+                print("Activity interval: unknown (continuation failed)")
+            else:
+                print(f"Activity interval: [{coverage['from']}, {coverage['to']})")
+            print(f"Central fetch: {central['status']}; {central['pages_fetched']} page(s).")
+            print("Sources describe this query; local does not mean never received centrally.")
+            print(
+                "Times and hop information are observed, not execution or business-completion totals."
+            )
         print("ROOT TOKEN ID | TASK REFERENCES | FIRST OBSERVED (UTC) | SOURCES")
         for row in rows:
             print(
-                f"{row['root_token_id']} | {', '.join(row['task_refs']) or '(unknown)'} | {row['first_observed']} | local"
+                f"{row['root_token_id']} | {', '.join(row['task_refs']) or '(unknown)'} | {row['first_observed']} | {row['sources']}"
             )
+        if coverage is not None and coverage["central"]["next_page_token"]:
+            cursor = coverage["central"]["next_page_token"]
+            if coverage["central"]["status"] == "failed":
+                print(
+                    f"Retry with --page-token {cursor} only if the failure was transient; "
+                    "otherwise restart the original query."
+                )
+            else:
+                print(
+                    f"Continue with --page-token {cursor} (same profile/files/filter; omit --since)."
+                )
     for diagnostic in diagnostics:
         print(diagnostic, file=sys.stderr)
-    return 0
 
 
 def main(
     argv: list[str] | None = None,
     *,
     query: Query | None = None,
+    list_query: Callable[[argparse.Namespace, list], int] | None = None,
     prog: str = "aeg",
     version_text: str = "shared AAC renderer",
 ) -> int:
@@ -280,7 +338,7 @@ def main(
         return (
             _render(args, events, query or _query)
             if args.command == "render"
-            else _list(args, events)
+            else _list(args, events, list_query)
         )
     except (InputError, ValueError, OSError) as exc:
         for diagnostic in unjoinable_diagnostics(events):

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli/_aeg/data/renderer-source.json

@@ -1,8 +1,8 @@
 {
-  "content_sha256": "e444d19d48410200f040c05bba84d3e2426ecb5ba350430203cad5df74f4104d",
+  "content_sha256": "f0477c0f8e73bffe5e111842d8aca3f5745345acb8cb58bed911deba7d826798",
   "files": {
     "__init__.py": "80d80a1ba35353d271cddf02532801c60b57f5ec06fb268ae823747742ce8979",
-    "cli.py": "b413ca8fffa51f0874deeaad47c16a2bed4ce0ec769074dd566bba3e5480566b",
+    "cli.py": "8fa9605246ba0ddbd24e6034b9582049fac11df139d47ee9e2ee0f322ff53c4c",
     "data/action-taken-v1.json": "d863343afe7f314646a73cf063480a7e650f93857d2ed5ec3a7b1f9838671fdf",
     "data/predicates-v1.json": "35e83a29feada10e8cfbef7009245146a9717d4f4fd58d74124e0ec91ae922c8",
     "from_sidecar.py": "6ac023f6925a13e94e0fee762656a02ca98981f2add194b052e9014ca48e2219",

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli/aeg_cli.py

@@ -21,6 +21,7 @@ def main(argv: list[str] | None = None) -> int:
         return 0
     from ._aeg import cli
     from ._aeg.inputs import InputError, read_trace
+    from .aeg_list import list_chains
 
     def query(profile: str, root: str):
         from .trace_query import query_trace
@@ -30,7 +31,9 @@ def main(argv: list[str] | None = None) -> int:
         except (ValueError, TypeError) as exc:
             raise InputError(str(exc)) from exc
 
-    return cli.main(argv, query=query, prog="aeg", version_text=version_text())
+    return cli.main(
+        argv, query=query, list_query=list_chains, prog="aeg", version_text=version_text()
+    )
 
 
 def entrypoint() -> None:

aac_cli-0.2.6/aac_cli/aeg_list.py

@@ -0,0 +1,173 @@
+"""Bounded AEG discovery over the public chain-list JSON contract."""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+from ._aeg.cli import _date, local_rows, print_listing
+from ._aeg.inputs import InputError, token_id
+from .chain_list import query_params
+from .trace_query import query_chains
+
+
+def _observed_time(value) -> str:
+    if type(value) is not int:
+        raise ValueError("expected integer observation time")
+    return datetime.fromtimestamp(value, timezone.utc).isoformat()
+
+
+def _page(body, params, previous_root):
+    """Validate the complete page before adding any of its rows to the result."""
+    try:
+        if (
+            type(body["schema_version"]) is not int
+            or body["schema_version"] != 1
+            or body["pagination"] != "live"
+            or body["central_evidence"] != "best_effort"
+        ):
+            raise ValueError("expected chain-list JSON v1 with live/best-effort evidence")
+        if not isinstance(body["from"], str) or not isinstance(body["to"], str):
+            raise ValueError("expected resolved central interval")
+        window = query_params(
+            since=None,
+            start=body["from"],
+            end=body["to"],
+            limit=body["limit"],
+            page_token=None,
+        )
+        if type(body["limit"]) is not int:
+            raise ValueError("expected integer page limit")
+        if any(window[key] != value for key, value in params.items() if key != "cursor"):
+            raise ValueError("central response changed the requested interval or limit")
+        more, cursor = body["has_more"], body["next_page_token"]
+        if (
+            type(more) is not bool
+            or (more and (not isinstance(cursor, str) or not 1 <= len(cursor) <= 2048))
+            or (not more and cursor is not None)
+        ):
+            raise ValueError("invalid central continuation")
+        if not isinstance(body["chains"], list) or len(body["chains"]) > body["limit"]:
+            raise ValueError("invalid central page rows")
+        if more and not body["chains"]:
+            raise ValueError("empty central page has a continuation")
+        rows = []
+        for item in body["chains"]:
+            root = token_id(item["root_token_id"], "central root")
+            if root <= previous_root:
+                raise ValueError("central roots must advance in ascending order")
+            previous_root = root
+            first = _observed_time(item["first_event_unix_seconds"])
+            last = _observed_time(item["last_event_unix_seconds"])
+            if first > last:
+                raise ValueError("reversed central observation times")
+            for key in ("participant_tenant_ids", "event_categories", "outcomes"):
+                if not isinstance(item[key], list) or not all(
+                    isinstance(v, str) for v in item[key]
+                ):
+                    raise ValueError(f"invalid central {key}")
+            for key in ("observed_token_count", "max_observed_hop"):
+                if type(item[key]) is not int or item[key] < 0:
+                    raise ValueError(f"invalid central {key}")
+            rows.append(
+                {
+                    "root_token_id": root,
+                    "task_refs": [],
+                    "first_observed": first,
+                    "last_observed": last,
+                    "sources": "control-plane",
+                    "evidence_sources": ["control-plane"],
+                    "central_observations": item,
+                }
+            )
+        return window, rows, more, cursor, previous_root
+    except (KeyError, TypeError, ValueError, OverflowError, OSError) as exc:
+        raise InputError(f"incompatible chain-list JSON: {exc}") from exc
+
+
+def list_chains(args, events) -> int:
+    max_pages = args.max_pages if args.max_pages is not None else 1
+    if not 1 <= max_pages <= 20:
+        raise InputError("--max-pages must be between 1 and 20")
+    # Resolve relative time once before any I/O; reuse it for local input and
+    # every page. A bare cursor obtains its bound interval from the first page.
+    params = query_params(
+        since=args.since,
+        start=args.from_time,
+        end=args.to_time,
+        limit=args.limit,
+        page_token=args.page_token,
+    )
+    window = dict(params)
+    central_rows = []
+    diagnostics = []
+    pages = 0
+    more = None
+    cursor = args.page_token
+    status = "failed"
+    previous_root = ""
+    seen_cursors = {cursor} if cursor is not None else set()
+    for _ in range(max_pages):
+        try:
+            body = query_chains(args.profile, params)
+            next_window, rows, next_more, next_cursor, last_root = _page(
+                body, params, previous_root
+            )
+            if next_cursor is not None and next_cursor in seen_cursors:
+                raise InputError("incompatible chain-list JSON: repeated continuation")
+        except (ValueError, TypeError) as exc:
+            diagnostics.append(str(exc))
+            status = "failed"
+            break
+        window = next_window
+        central_rows.extend(rows)
+        pages += 1
+        more, cursor, previous_root = next_more, next_cursor, last_root
+        status = "more" if more else "exhausted"
+        if not more:
+            break
+        seen_cursors.add(cursor)
+        params = {**window, "cursor": cursor}
+
+    if "from" in window and "to" in window:
+        rows, local_diagnostics = local_rows(
+            events, args.task_ref, _date(window["from"]), _date(window["to"])
+        )
+        diagnostics.extend(local_diagnostics)
+    else:
+        rows = []
+        diagnostics.append(
+            "Continuation interval unavailable; local rows cannot be selected. Retry the original interval."
+        )
+    joined = {row["root_token_id"]: row for row in rows}
+    for central in central_rows:
+        root = central["root_token_id"]
+        local = joined.get(root)
+        if local is not None:
+            local.update(
+                {
+                    "sources": "both",
+                    "first_observed": min(local["first_observed"], central["first_observed"]),
+                    "last_observed": max(local["last_observed"], central["last_observed"]),
+                    "evidence_sources": sorted([*local["evidence_sources"], "control-plane"]),
+                    "central_observations": central["central_observations"],
+                }
+            )
+        elif args.task_ref is None:
+            joined[root] = central
+    coverage = {
+        "schema_version": 1,
+        "mode": "hybrid" if args.events or args.actions else "control-plane",
+        "from": window.get("from"),
+        "to": window.get("to"),
+        "central": {
+            "status": status,
+            "pages_fetched": pages,
+            "limit": int(window["limit"]) if "limit" in window else None,
+            "has_more": more,
+            "next_page_token": cursor,
+            "pagination": "live",
+            "evidence": "best_effort",
+        },
+    }
+    print_listing(args.output, [joined[root] for root in sorted(joined)], diagnostics, coverage)
+    return 4 if status == "failed" else 0

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli/agent_layout.py

@@ -29,9 +29,6 @@ from aac_cli.material_cases import MATERIAL_ISSUED_HERE, MATERIAL_SUPPLIED
 
 TENANTS_DIRECTORY = "tenants"
 AGENTS_DIRECTORY = "agents"
-# 0.1.x kept the same material under `workspaces/`. 0.2.0 is a clean break: an
-# old folder is recognised only so the CLI can say so in one line (B270).
-LEGACY_AGENTS_DIRECTORY = "workspaces"
 
 # Where the container layout expects the mounted directories (matches the
 # public starter guide's Docker recipe so B240 can reuse its mounts).
@@ -249,21 +246,6 @@ def agent_paths(name: str, home: Path | None = None) -> AgentPaths:
     return AgentPaths(name=name, root=(home or cli_home()) / AGENTS_DIRECTORY / name)
 
 
-def legacy_agent_directory(name: str, home: Path | None = None) -> Path:
-    """Where 0.1.x kept this name's material. Read only to refuse it (B270)."""
-    return (home or cli_home()) / LEGACY_AGENTS_DIRECTORY / name
-
-
-def refuse_legacy_directory(name: str, home: Path | None = None) -> None:
-    """One line, no migration: development material is disposable by design."""
-    legacy = legacy_agent_directory(name, home)
-    if legacy.exists():
-        raise CliConfigError(
-            f"{legacy} is from an older CLI and is not migrated; create a new agent with "
-            f"`aac init --agent {name}` after deleting it, or choose another name"
-        )
-
-
 def tenant_paths(tenant_id: str, home: Path | None = None) -> TenantPaths:
     if not CANONICAL_TENANT_ID_PATTERN.fullmatch(tenant_id):
         raise CliConfigError(f"tenant id {tenant_id!r} is not canonical; refusing to derive a path")

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli/agent_record.py

@@ -153,7 +153,7 @@ def read_record(path: Path) -> AgentRecord:
         raise CliConfigError(
             f"agent record {path} has an unsupported schema_version; "
             f"this CLI understands version {RECORD_SCHEMA_VERSION}. Create a fresh agent "
-            "under a different name; no old record is migrated or removed."
+            "under a different name. The existing record is unchanged."
         )
     try:
         record = AgentRecord(**document)

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli/cli.py

@@ -146,7 +146,6 @@ from aac_cli.registration_state import (
     profile_registration_lock,
     read_registration_state,
     registration_state_path,
-    upgrade_registration_state,
     validate_tenant_domain,
     write_registration_state,
 )
@@ -666,12 +665,6 @@ def _cmd_tenant_register_locked(args: argparse.Namespace, profile: str) -> int:
     config = _resolve(args)
     normalized_admin_url = normalize_admin_url(config.admin_url)
     state = read_registration_state(profile, expected_admin_url=normalized_admin_url)
-    if state is not None and state.schema_version == 1:
-        # B121: v1 had no tenant_domains field. Upgrade only after the strict
-        # v1 reader verified its original digest and normalized empty-domain
-        # intent; every subsequent write is schema v2.
-        state = replace(upgrade_registration_state(state), updated_at=_utc_now())
-        write_registration_state(state)
     bound_tenant_id = read_profile_section(profile).get("tenant_id")
 
     if state is not None and state.state == "completed_credential_reissue_required":

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli/config.py

@@ -16,9 +16,8 @@ with ``AAC_CLI_HOME`` — tests and multi-account operators):
 
   ``main`` is the RESERVED baseline profile (§3.3): always the final
   selection fallback, virtual (built-in defaults) until
-  ``aac profile update main`` materializes it. The prototype-era
-  ``[default]`` baseline migrates to ``[main]`` on first config touch
-  (§8) — fail-closed when both exist with different values.
+  ``aac profile update main`` materializes it. Reading configuration
+  never changes the file or creates the CLI home (§8).
 
   TWO urls, not one base: the admin and data-plane surfaces genuinely
   live on different ports (Eng Spec §XVI) and 1C may split them into
@@ -59,7 +58,6 @@ import fcntl
 import json
 import os
 import re
-import sys
 import tempfile
 from collections.abc import Generator
 from contextlib import contextmanager
@@ -110,9 +108,6 @@ _DEFAULT_DATA_PLANE_URL = "http://127.0.0.1:9000"
 # selection fallback; virtual until materialized; create/delete refuse.
 RESERVED_BASELINE_PROFILE = "main"
 
-# The prototype-era baseline section name that §8 migrates to [main].
-_LEGACY_BASELINE_SECTION = "default"
-
 # Profile-name grammar, spec-exact (§5.3): 3–15 chars, lowercase
 # alphanumeric + single interior hyphens, at least one letter.
 PROFILE_NAME_PATTERN = re.compile(r"^(?=.{3,15}$)(?=.*[a-z])[a-z0-9]+(?:-[a-z0-9]+)*$")
@@ -260,8 +255,8 @@ def select_profile(profile_flag: str | None) -> ProfileSelection:
 
 
 # ---------------------------------------------------------------------------
-# Config file loading: parse → reject [DEFAULT] → migrate [default] →
-# validate names → guardrails. EVERY reader and writer goes through
+# Config file loading: parse → reject [DEFAULT] → validate names →
+# guardrails. EVERY reader and writer goes through
 # load_validated_config so no path can act on config the contract
 # rejects (Spec §5, §8).
 # ---------------------------------------------------------------------------
@@ -269,7 +264,7 @@ def select_profile(profile_flag: str | None) -> ProfileSelection:
 
 @contextmanager
 def _config_mutation_lock() -> Generator[None, None, None]:
-    """Serialize each config parse/migrate or read-modify-replace window."""
+    """Serialize each config writer's read-modify-replace window."""
     home = cli_home()
     home.mkdir(parents=True, exist_ok=True)
     home.chmod(0o700)
@@ -329,61 +324,6 @@ def _parse_config_text(config_path: Path) -> configparser.ConfigParser:
     return parser
 
 
-def _migrate_legacy_default_section(
-    parser: configparser.ConfigParser, config_path: Path
-) -> configparser.ConfigParser:
-    """§8: [default] → [main], atomically, on first config touch.
-
-    Three cases: rename when only [default] exists; drop [default]
-    when both exist with IDENTICAL values (report once); fail closed
-    when both exist with different values — the CLI must not guess,
-    merge, or discard either profile. The migration is a WRITE even on
-    read-only commands; that is deliberate spec behavior (§8) so every
-    PR 2 command observes the post-migration file.
-    """
-    # Guardrails already ran on the parsed file (review M1): §8 step 1
-    # validates WITHOUT modification, so an invalid file is rejected
-    # with exit 3 before this function ever rewrites it.
-    has_legacy = parser.has_section(_LEGACY_BASELINE_SECTION)
-    if not has_legacy:
-        return parser
-    has_main = parser.has_section(RESERVED_BASELINE_PROFILE)
-    if has_main:
-        legacy_items = dict(parser.items(_LEGACY_BASELINE_SECTION))
-        main_items = dict(parser.items(RESERVED_BASELINE_PROFILE))
-        if legacy_items != main_items:
-            raise CliConfigError(
-                f"config migration conflict in {config_path}: both "
-                f"[default] and [main] exist with DIFFERENT values. AAC "
-                f"will not guess which is authoritative. Fix by hand: "
-                f"edit the file, keep the values you want under [main], "
-                f"delete the [default] section, and re-run."
-            )
-    migrated = configparser.ConfigParser(interpolation=None)
-    for section in parser.sections():
-        if section == _LEGACY_BASELINE_SECTION:
-            if has_main:
-                continue  # identical duplicate — [main] already carries it
-            target = RESERVED_BASELINE_PROFILE
-        else:
-            target = section
-        migrated.add_section(target)
-        for key, value in parser.items(section):
-            migrated[target][key] = value
-    _write_parser_atomically(migrated, config_path)
-    if has_main:
-        print(
-            f"config migration: removed [default] (identical to [main]) in {config_path}",
-            file=sys.stderr,
-        )
-    else:
-        print(
-            f"config migration: renamed [default] to [main] in {config_path}",
-            file=sys.stderr,
-        )
-    return migrated
-
-
 def _enforce_guardrails(parser: configparser.ConfigParser, config_path: Path) -> None:
     """§5.2 bounded-complexity limits + §5.3 name grammar, fail closed.
 
@@ -391,14 +331,10 @@ def _enforce_guardrails(parser: configparser.ConfigParser, config_path: Path) ->
     echoing the value (it may be sensitive). Limits are measured on the
     decoded Python strings configparser produced.
 
-    Runs BEFORE the §8 migration (review M1), so the parser may still
-    hold the legacy [default] section — it is the pre-migration
-    baseline and counts/validates like [main], never as a named
-    profile.
+    Only [main] is the baseline; every other section is a named profile.
     """
     sections = parser.sections()
-    baseline_sections = {RESERVED_BASELINE_PROFILE, _LEGACY_BASELINE_SECTION}
-    non_main = [s for s in sections if s not in baseline_sections]
+    non_main = [s for s in sections if s != RESERVED_BASELINE_PROFILE]
     if len(non_main) > MAX_PROFILE_COUNT - 1:
         raise CliConfigError(
             f"invalid config {config_path}: {len(non_main)} named profiles "
@@ -406,7 +342,7 @@ def _enforce_guardrails(parser: configparser.ConfigParser, config_path: Path) ->
             f"besides the reserved [main])"
         )
     for section in sections:
-        if section not in baseline_sections and not PROFILE_NAME_PATTERN.fullmatch(section):
+        if section != RESERVED_BASELINE_PROFILE and not PROFILE_NAME_PATTERN.fullmatch(section):
             raise CliConfigError(
                 f"invalid config {config_path}: section [{section}] is not "
                 f"a valid profile name — 3–15 characters, lowercase a–z, "
@@ -434,7 +370,7 @@ def _enforce_guardrails(parser: configparser.ConfigParser, config_path: Path) ->
                     f"character limit (value not shown)"
                 )
             if key == "tenant_id" and CANONICAL_TENANT_ID_PATTERN.fullmatch(value) is None:
-                # B154 PR 5 (Spec §5.4/§8.6): canonical validation is
+                # B154 PR 5 (Spec §5.4/§8): canonical validation is
                 # MANDATORY for every bound profile — the PR-2
                 # prototype-era compatibility (deprecation warning) is
                 # removed. Hand-edited values are untrusted input.
@@ -471,25 +407,16 @@ def validate_hosted_trust_domain(tenant_id: str | None, value: str) -> str:
 
 
 def _load_validated_config_unlocked() -> configparser.ConfigParser:
-    """THE config entry point: parse, validate, migrate, return.
-
-    Every reader and writer calls this, so migration runs on the first
-    PR 2 command that touches configuration (§8) and no code path ever
-    acts on config that fails the §5 contract. Validation precedes
-    migration (§8 step 1 / review M1): an over-limit or malformed file
-    is rejected without being rewritten.
-    """
+    """Parse and validate one config snapshot without modifying the filesystem."""
     config_path = cli_home() / "config"
     parser = _parse_config_text(config_path)
     _enforce_guardrails(parser, config_path)
-    parser = _migrate_legacy_default_section(parser, config_path)
     return parser
 
 
 def load_validated_config() -> configparser.ConfigParser:
-    """Validated atomic config snapshot; serializes the legacy migration."""
-    with _config_mutation_lock():
-        return _load_validated_config_unlocked()
+    """Read one snapshot; atomic replacement keeps concurrent writes untorn."""
+    return _load_validated_config_unlocked()
 
 
 def _write_parser_atomically(parser: configparser.ConfigParser, config_path: Path) -> None:

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli/init_cli.py

@@ -50,7 +50,6 @@ from aac_cli.agent_layout import (
     TenantPaths,
     agent_paths,
     pending_admin_key_paths,
-    refuse_legacy_directory,
     tenant_paths,
 )
 from aac_cli.agent_record import (
@@ -254,7 +253,6 @@ def _load_or_create_record(
     args: argparse.Namespace, agent: AgentPaths, profile: str, config: ResolvedConfig
 ) -> tuple[AgentRecord, str]:
     """Return (record, outcome) where outcome is 'created' or 'resumed'."""
-    refuse_legacy_directory(agent.name)
     root_problem = managed_path_problem(agent.root, root=cli_home(), kind="directory")
     if root_problem:
         raise CliConfigError(f"refusing to use agent {agent.name!r}: {root_problem}")
@@ -1790,7 +1788,6 @@ def _refresh_settings(
 
 def _configuration_preflight(args: argparse.Namespace, agent: AgentPaths) -> None:
     """Resolve immutable identity and validate input before any profile/remote write."""
-    refuse_legacy_directory(agent.name)
     recorded = read_record(agent.record) if agent.record.exists() else None
     args.accepted_config, args.accepted_https_cas = None, []
     if args.agent_config:

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli/registration_state.py

@@ -30,7 +30,7 @@ import sys
 import tempfile
 from collections.abc import Generator
 from contextlib import contextmanager
-from dataclasses import asdict, dataclass, replace
+from dataclasses import asdict, dataclass
 from pathlib import Path
 
 import httpx
@@ -58,13 +58,12 @@ __all__ = [
     "read_registration_state",
     "registration_state_exists",
     "registration_state_path",
-    "upgrade_registration_state",
     "validate_tenant_domain",
     "write_registration_state",
 ]
 
 SCHEMA_VERSION = 2
-SUPPORTED_SCHEMA_VERSIONS = frozenset({1, 2})
+SUPPORTED_SCHEMA_VERSIONS = frozenset({SCHEMA_VERSION})
 
 # The §9.2 visible warning field — the file is AAC-managed.
 STATE_FILE_WARNING = (
@@ -339,16 +338,8 @@ def _normalize_existing_registration_intent(
     )
 
 
-def _canonical_local_intent(
-    admin_url: str, intent: RegistrationIntent, *, schema_version: int = SCHEMA_VERSION
-) -> str:
+def _canonical_local_intent(admin_url: str, intent: RegistrationIntent) -> str:
     intent_fields = asdict(intent)
-    if schema_version == 1:
-        # Schema v1 predates B121. Its digest did not contain a business-domain
-        # collection; accepting it as empty preserves unresolved registrations.
-        intent_fields.pop("tenant_domains")
-    elif schema_version != 2:
-        raise CliConfigError(f"unsupported registration-state schema_version {schema_version}")
     public_pem = intent_fields.pop("tenant_admin_pubkey_pem")
     intent_fields["tenant_admin_key_id"] = _spki_key_id_from_normalized_pem(public_pem)
     return json.dumps(
@@ -362,29 +353,8 @@ def _canonical_local_intent(
     )
 
 
-def local_intent_sha256(
-    admin_url: str, intent: RegistrationIntent, *, schema_version: int = SCHEMA_VERSION
-) -> str:
-    return hashlib.sha256(
-        _canonical_local_intent(admin_url, intent, schema_version=schema_version).encode("utf-8")
-    ).hexdigest()
-
-
-def upgrade_registration_state(state: RegistrationState) -> RegistrationState:
-    """Upgrade a validated v1 state to v2 without changing its intent."""
-    if state.schema_version == SCHEMA_VERSION:
-        return state
-    if state.schema_version != 1:
-        raise CliConfigError(f"unsupported schema_version {state.schema_version!r}")
-    upgraded = replace(state, schema_version=SCHEMA_VERSION)
-    return replace(
-        upgraded,
-        local_intent_sha256=local_intent_sha256(
-            upgraded.control_plane_admin_url,
-            upgraded.registration_intent,
-            schema_version=SCHEMA_VERSION,
-        ),
-    )
+def local_intent_sha256(admin_url: str, intent: RegistrationIntent) -> str:
+    return hashlib.sha256(_canonical_local_intent(admin_url, intent).encode("utf-8")).hexdigest()
 
 
 def registration_state_dir() -> Path:
@@ -454,14 +424,13 @@ def _field_violation(state: RegistrationState) -> str | None:
     expected_digest = local_intent_sha256(
         state.control_plane_admin_url,
         state.registration_intent,
-        schema_version=state.schema_version,
     )
     if not hmac.compare_digest(state.local_intent_sha256, expected_digest):
         return "local_intent_sha256 does not match the frozen normalized intent"
     return None
 
 
-def _registration_intent_from_raw(raw: object, *, schema_version: int) -> RegistrationIntent:
+def _registration_intent_from_raw(raw: object) -> RegistrationIntent:
     if not isinstance(raw, dict):
         raise TypeError("registration_intent is not an object")
     expected = {
@@ -473,9 +442,8 @@ def _registration_intent_from_raw(raw: object, *, schema_version: int) -> Regist
         "agents",
         "tenant_admin_pubkey_pem",
         "admission",
+        "tenant_domains",
     }
-    if schema_version == 2:
-        expected.add("tenant_domains")
     if set(raw) != expected:
         raise TypeError(f"registration_intent fields differ (expected {sorted(expected)})")
     admission_raw = raw["admission"]
@@ -487,7 +455,7 @@ def _registration_intent_from_raw(raw: object, *, schema_version: int) -> Regist
         raise TypeError("registration_intent.admission has invalid fields")
     workloads_raw = raw["workloads"]
     domains_raw = raw["spiffe_trust_domains"]
-    tenant_domains_raw = raw.get("tenant_domains", [])
+    tenant_domains_raw = raw["tenant_domains"]
     agents_raw = raw["agents"]
     if (
         not isinstance(workloads_raw, list)
@@ -632,9 +600,7 @@ def read_registration_state(
             attempt_count=raw["attempt_count"],
             control_plane_admin_url=raw["control_plane_admin_url"],
             local_intent_sha256=raw["local_intent_sha256"],
-            registration_intent=_registration_intent_from_raw(
-                raw["registration_intent"], schema_version=raw_schema_version
-            ),
+            registration_intent=_registration_intent_from_raw(raw["registration_intent"]),
         )
     except (KeyError, TypeError, ValueError, CliConfigError) as exc:
         raise _reject(path, f"missing or mistyped field ({exc})") from exc
@@ -675,11 +641,6 @@ def write_registration_state(state: RegistrationState) -> Path:
             f"unsupported schema_version {state.schema_version!r}; "
             f"this CLI supports {sorted(SUPPORTED_SCHEMA_VERSIONS)}"
         )
-    if state.schema_version != SCHEMA_VERSION:
-        raise CliConfigError(
-            f"refusing to write legacy registration-state schema_version "
-            f"{state.schema_version}; upgrade to {SCHEMA_VERSION} first"
-        )
     violation = _field_violation(state)
     if violation is not None:
         raise CliConfigError(

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli/trace_query.py

@@ -10,20 +10,35 @@ import sys
 
 def query_trace(profile: str, root: str) -> dict:
     """Run the installed CLI's trace command in-process, without discovery."""
+    return _query(
+        ["chain", "show", f"--profile={profile}", f"--token-id={root}", "--output=json"],
+        "chain-show",
+    )
+
+
+def query_chains(profile: str, params: dict[str, str]) -> dict:
+    """Consume one public chain-list JSON page using the owning CLI."""
+    flags = {"from": "from", "to": "to", "limit": "limit", "cursor": "page-token"}
+    return _query(
+        ["chain", "list", f"--profile={profile}", "--output=json"]
+        + [f"--{flags[key]}={value}" for key, value in params.items()],
+        "chain-list",
+    )
+
+
+def _query(arguments: list[str], contract: str) -> dict:
     from .cli import main
 
     output, errors = io.StringIO(), io.StringIO()
     with contextlib.redirect_stdout(output), contextlib.redirect_stderr(errors):
-        code = main(
-            ["chain", "show", f"--profile={profile}", f"--token-id={root}", "--output=json"]
-        )
+        code = main(arguments)
     if code:
         raise ValueError(f"central query failed (aac exit {code}): {errors.getvalue().strip()}")
     sys.stderr.write(errors.getvalue())
     try:
         body = json.loads(output.getvalue())
         if not isinstance(body, dict):
-            raise ValueError("expected trace object")
+            raise ValueError("expected JSON object")
         return body
     except (ValueError, TypeError) as exc:
-        raise ValueError(f"incompatible chain-show JSON: {exc}") from exc
+        raise ValueError(f"incompatible {contract} JSON: {exc}") from exc

{aac_cli-0.2.5 → aac_cli-0.2.6/aac_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aac-cli
-Version: 0.2.5
+Version: 0.2.6
 Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
 Author: Agent Authority Cloud Project
 License-Expression: Apache-2.0
@@ -69,8 +69,13 @@ Python 3.11 or newer is required.
 
 Installing or upgrading `aac-cli` supplies both `aac` and `aeg`.
 Use the [AEG guide and command reference](https://cascadeauth.github.io/aac-starter-guide/aeg.html)
-for rendering local evidence, selecting a profile, and migrating an older
-standalone AEG installation.
+for listing local and central observations, rendering evidence, and selecting a profile.
+
+`aeg list --profile PROFILE --since 7d` discovers participant-visible central
+roots. Add `--events FILE` and/or `--actions FILE` for a hybrid listing with local
+task references and a `local`, `control-plane` or `both` source column. Omit the
+profile for offline local listing. Central fetches are bounded and expose
+continuation; forwarding remains best-effort. Local files are never uploaded.
 
 ## Guided setup using `aac init`
 
@@ -381,7 +386,7 @@ issues them for those names or checks supplied certificates against them; renewa
 keeps those names. Applying a different name set requires the installed certificate
 to cover it already: supplied issuers can issue a certificate covering both sets
 before the change. A CLI-issued agent needing new names must be created under a
-new name with the intended configuration. No old agent-record format is migrated.
+new name with the intended configuration.
 
 Central forwarding retains the local sink and sends only permitted metadata.
 It is asynchronous and best-effort; a local event does not prove central delivery.

{aac_cli-0.2.5 → aac_cli-0.2.6}/aac_cli.egg-info/SOURCES.txt

@@ -8,6 +8,7 @@ aac_cli/__init__.py
 aac_cli/__main__.py
 aac_cli/admin_key_pem.py
 aac_cli/aeg_cli.py
+aac_cli/aeg_list.py
 aac_cli/agent_cli.py
 aac_cli/agent_config.py
 aac_cli/agent_health.py

{aac_cli-0.2.5 → aac_cli-0.2.6}/pyproject.toml

@@ -32,7 +32,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aac-cli"
-version = "0.2.5"
+version = "0.2.6"
 description = "The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit)."
 readme = "README.md"
 requires-python = ">=3.11"