agent-lifecycle-kit 1.83.0__tar.gz → 1.85.0__tar.gz

{agent_lifecycle_kit-1.83.0/src/agent_lifecycle_kit.egg-info → agent_lifecycle_kit-1.85.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-lifecycle-kit
-Version: 1.83.0
+Version: 1.85.0
 Summary: Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion.
 Author: Agent Lifecycle Kit contributors
 License: Apache-2.0
@@ -43,7 +43,7 @@ ALK provides a verifiable finish for external-agent work with proportionate cont
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==1.83.0`, and common `agent-lifecycle version` errors.
+It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==1.85.0`, and common `agent-lifecycle version` errors.
 
 For a quick start, run:
 
@@ -194,7 +194,7 @@ Adapter installation and support-level details live in [Adapter install](docs/ad
 
 - Start: [English documentation](docs/README.md), [Русская документация](docs/ru/README.md), [Install](docs/guides/install-and-first-run.md), [Quickstart](docs/guides/quickstart.md), [Beginner and advanced workflows](docs/guides/beginner-and-advanced-workflows.md), [Commands by task](docs/guides/commands-by-task.md), [Research workflow](docs/guides/research-workflow.md), [Lifecycle task scenarios](docs/guides/lifecycle-cookbook.md), and [Code review workflows](docs/guides/code-review-workflows.md).
 - Planning and adapters: [Issue to specification drafts](docs/guides/issue-to-spec.md), [Adapter install](docs/adapters/install.md), and [Adapter support matrix](docs/adapters/support-matrix.md).
-- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
+- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Public locators and redaction](docs/reference/public-locators-and-redaction.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
 - Quality and resources: [Reference-task evaluation](docs/reference/reference-task-evaluation.md), [model routing](docs/reference/model-routing.md), [quality-cost learning](docs/reference/quality-cost-learning.md), [performance and resource budgets](docs/reference/performance-and-resource-budgets.md), [lifecycle cost accounting](docs/reference/lifecycle-cost.md), [host-local token accounting](docs/reference/host-local-token-accounting.md), [process execution observability](docs/reference/process-execution-observability.md), [Usage export](docs/reference/usage-export.md), and [Evidence integrity](docs/reference/evidence-integrity.md).
 - Profiles and operations: [Project workflow presets](docs/reference/workflow-presets.md), [Project workflow profile](docs/reference/project-workflow-profile.md), [Read-only status views](docs/reference/read-only-status-view.md), [Adapter progress bridge](docs/reference/automatic-progress-bridge.md), [Sandbox boundaries](docs/reference/sandbox-boundaries.md), [Import mappers](docs/reference/import-mappers.md), [Episode retrieval](docs/reference/episode-retrieval.md), [Runner recovery](docs/reference/runner-recovery.md), [Cross-check profile](docs/reference/cross-check-profile.md), [Review Mesh](docs/reference/review-mesh.md), [Bug Forensics profile](docs/reference/bug-forensics.md), and [Bug Forensics context budget](docs/reference/bug-forensics-context-budget.md).
 - Release assets: [Task templates](templates/tasks/README.md), [Neutrality scanning](docs/reference/neutrality.md), and [Release security](docs/security/release-security.md).

{agent_lifecycle_kit-1.83.0 → agent_lifecycle_kit-1.85.0}/README.md

@@ -21,7 +21,7 @@ ALK provides a verifiable finish for external-agent work with proportionate cont
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==1.83.0`, and common `agent-lifecycle version` errors.
+It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==1.85.0`, and common `agent-lifecycle version` errors.
 
 For a quick start, run:
 
@@ -172,7 +172,7 @@ Adapter installation and support-level details live in [Adapter install](docs/ad
 
 - Start: [English documentation](docs/README.md), [Русская документация](docs/ru/README.md), [Install](docs/guides/install-and-first-run.md), [Quickstart](docs/guides/quickstart.md), [Beginner and advanced workflows](docs/guides/beginner-and-advanced-workflows.md), [Commands by task](docs/guides/commands-by-task.md), [Research workflow](docs/guides/research-workflow.md), [Lifecycle task scenarios](docs/guides/lifecycle-cookbook.md), and [Code review workflows](docs/guides/code-review-workflows.md).
 - Planning and adapters: [Issue to specification drafts](docs/guides/issue-to-spec.md), [Adapter install](docs/adapters/install.md), and [Adapter support matrix](docs/adapters/support-matrix.md).
-- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
+- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Public locators and redaction](docs/reference/public-locators-and-redaction.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
 - Quality and resources: [Reference-task evaluation](docs/reference/reference-task-evaluation.md), [model routing](docs/reference/model-routing.md), [quality-cost learning](docs/reference/quality-cost-learning.md), [performance and resource budgets](docs/reference/performance-and-resource-budgets.md), [lifecycle cost accounting](docs/reference/lifecycle-cost.md), [host-local token accounting](docs/reference/host-local-token-accounting.md), [process execution observability](docs/reference/process-execution-observability.md), [Usage export](docs/reference/usage-export.md), and [Evidence integrity](docs/reference/evidence-integrity.md).
 - Profiles and operations: [Project workflow presets](docs/reference/workflow-presets.md), [Project workflow profile](docs/reference/project-workflow-profile.md), [Read-only status views](docs/reference/read-only-status-view.md), [Adapter progress bridge](docs/reference/automatic-progress-bridge.md), [Sandbox boundaries](docs/reference/sandbox-boundaries.md), [Import mappers](docs/reference/import-mappers.md), [Episode retrieval](docs/reference/episode-retrieval.md), [Runner recovery](docs/reference/runner-recovery.md), [Cross-check profile](docs/reference/cross-check-profile.md), [Review Mesh](docs/reference/review-mesh.md), [Bug Forensics profile](docs/reference/bug-forensics.md), and [Bug Forensics context budget](docs/reference/bug-forensics-context-budget.md).
 - Release assets: [Task templates](templates/tasks/README.md), [Neutrality scanning](docs/reference/neutrality.md), and [Release security](docs/security/release-security.md).

{agent_lifecycle_kit-1.83.0 → agent_lifecycle_kit-1.85.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-lifecycle-kit"
-version = "1.83.0"
+version = "1.85.0"
 description = "Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion."
 readme = "README.md"
 requires-python = ">=3.11,<3.15"

{agent_lifecycle_kit-1.83.0 → agent_lifecycle_kit-1.85.0}/src/agent_lifecycle/_version.py

@@ -1,3 +1,3 @@
 """Package version."""
 
-__version__ = "1.83.0"
+__version__ = "1.85.0"

agent_lifecycle_kit-1.85.0/src/agent_lifecycle/adapter_sessions/redaction.py

@@ -0,0 +1,12 @@
+"""Adapter-session compatibility facade for shared receipt redaction."""
+
+from __future__ import annotations
+
+from agent_lifecycle.contracts.process_redaction import (
+    normalize_public_locator,
+    redact_env_names,
+    redact_process_text,
+    redact_text,
+)
+
+__all__ = ["normalize_public_locator", "redact_env_names", "redact_process_text", "redact_text"]

{agent_lifecycle_kit-1.83.0 → agent_lifecycle_kit-1.85.0}/src/agent_lifecycle/adapter_sessions/workflow_bridge.py

@@ -12,6 +12,7 @@ from agent_lifecycle.contracts import canonical_digest, read_json_object
 from agent_lifecycle.policy.risk_execution import derive_risk_execution_profile
 from agent_lifecycle.resources import builtin_profile_path
 from agent_lifecycle.workflow import run_managed_lifecycle_step
+from agent_lifecycle.workflow.transition_contract import validate_action_catalog
 
 
 def managed_adapter_run(
@@ -72,7 +73,14 @@ def managed_adapter_run(
         )
         next_action = _risk_aware_next_action(next_action, risk_profile)
     state_identity = {**_state_identity(state_path), "taskId": task_id}
-    proof = _managed_proof("adapter run", adapter_id=adapter_id, task_id=task_id, state_identity=state_identity)
+    catalog = validate_action_catalog()
+    proof = _managed_proof(
+        "adapter run",
+        adapter_id=adapter_id,
+        task_id=task_id,
+        state_identity=state_identity,
+        action_catalog_digest=catalog["catalogDigest"],
+    )
     session = create_session(
         adapter_id=adapter_id,
         mode="MANAGED_TASK",
@@ -189,8 +197,15 @@ def _state_identity(state_path: Path) -> dict[str, Any]:
     }
 
 
-def _managed_proof(command: str, *, adapter_id: str, task_id: str, state_identity: dict[str, Any]) -> dict[str, Any]:
-    return {
+def _managed_proof(
+    command: str,
+    *,
+    adapter_id: str,
+    task_id: str,
+    state_identity: dict[str, Any],
+    action_catalog_digest: str | None = None,
+) -> dict[str, Any]:
+    proof = {
         "kind": "alk-managed-adapter-session",
         "status": "PASS",
         "command": command,
@@ -198,6 +213,9 @@ def _managed_proof(command: str, *, adapter_id: str, task_id: str, state_identit
         "taskId": task_id,
         "stateIdentity": state_identity,
     }
+    if action_catalog_digest is not None:
+        proof["actionCatalogDigest"] = action_catalog_digest
+    return proof
 
 
 def _risk_aware_next_action(next_action: Any, profile: dict[str, Any]) -> dict[str, Any]:

{agent_lifecycle_kit-1.83.0 → agent_lifecycle_kit-1.85.0}/src/agent_lifecycle/cli/dispatch_lifecycle.py

@@ -21,7 +21,8 @@ from agent_lifecycle.cli.progress_hooks import (
     maybe_emit_workflow_progress_hook,
     validate_workflow_progress_hook_request,
 )
-from agent_lifecycle.contracts import LifecycleError, read_json_object, write_json_create
+from agent_lifecycle.contracts import LifecycleError, canonical_digest, read_json_object, write_json_create
+from agent_lifecycle.contracts.lifecycle_action_catalog import COMPATIBILITY_COMMANDS
 from agent_lifecycle.runner import (
     build_runner_snapshot,
     initialize_runner_state,
@@ -404,7 +405,7 @@ def _dispatch_runner(args: argparse.Namespace) -> dict[str, Any]:
     runner_path = Path(args.runner)
     if args.runner_command == "start":
         workflow_state = read_json_object(Path(args.state), label="workflow state")
-        policy = load_runner_policy(Path(args.policy) if args.policy else None)
+        policy = load_runner_policy(Path(args.policy)) if args.policy else None
         runner_state = initialize_runner_state(
             workflow_state,
             policy=policy,
@@ -412,7 +413,10 @@ def _dispatch_runner(args: argparse.Namespace) -> dict[str, Any]:
             reason=args.reason,
         )
         write_runner_state_create(runner_path, runner_state)
-        return validate_runner_state(runner_state, workflow_state=workflow_state)
+        return _runner_compatibility_result(
+            validate_runner_state(runner_state, workflow_state=workflow_state),
+            command="runner start",
+        )
     runner_state = load_runner_state(runner_path)
     if args.runner_command == "status":
         status_workflow_state = read_json_object(Path(args.state), label="workflow state") if args.state else None
@@ -420,19 +424,25 @@ def _dispatch_runner(args: argparse.Namespace) -> dict[str, Any]:
             if status_workflow_state is None:
                 raise LifecycleError("missing-cli-argument", "runner status with --profile requires --state")
             profile = read_json_object(Path(args.profile), label="context profile")
-            return build_runner_snapshot(
-                runner_state,
-                status_workflow_state,
-                profile=profile,
-                window=args.target_window,
+            return _runner_compatibility_result(
+                build_runner_snapshot(
+                    runner_state,
+                    status_workflow_state,
+                    profile=profile,
+                    window=args.target_window,
+                ),
+                command="runner status",
             )
-        return validate_runner_state(runner_state, workflow_state=status_workflow_state)
+        return _runner_compatibility_result(
+            validate_runner_state(runner_state, workflow_state=status_workflow_state),
+            command="runner status",
+        )
     workflow_state = read_json_object(Path(args.state), label="workflow state")
     if args.runner_command == "transition":
         request = read_json_object(Path(args.request), label="runner transition request")
         payload = transition_runner(runner_state, workflow_state, request)
         write_runner_state(runner_path, payload["state"])
-        return payload["result"]
+        return _runner_compatibility_result(payload["result"], command="runner transition")
     if args.runner_command == "stop":
         payload = request_runner_stop(
             runner_state,
@@ -442,7 +452,7 @@ def _dispatch_runner(args: argparse.Namespace) -> dict[str, Any]:
             reason=args.reason,
         )
         write_runner_state(runner_path, payload["state"])
-        return payload["result"]
+        return _runner_compatibility_result(payload["result"], command="runner stop")
     if args.runner_command == "resume":
         payload = resume_runner(
             runner_state,
@@ -452,5 +462,23 @@ def _dispatch_runner(args: argparse.Namespace) -> dict[str, Any]:
             reason=args.reason,
         )
         write_runner_state(runner_path, payload["state"])
-        return payload["result"]
+        return _runner_compatibility_result(payload["result"], command="runner resume")
     raise LifecycleError("command-not-implemented", "runner command is not implemented")
+
+
+def _runner_compatibility_result(payload: dict[str, Any], *, command: str) -> dict[str, Any]:
+    """Mark legacy runner output without changing its historical meaning."""
+
+    classification = COMPATIBILITY_COMMANDS.get(command)
+    if classification is None:
+        raise LifecycleError("invalid-runner-command", "runner command is not in the compatibility catalog")
+    digest_keys = ("resultDigest", "snapshotDigest", "validationDigest")
+    digest_key = next((key for key in digest_keys if key in payload), "validationDigest")
+    body = {key: value for key, value in payload.items() if key not in digest_keys}
+    body["deprecation"] = {
+        "status": "DEPRECATED",
+        "command": command,
+        "replacement": classification["replacement"],
+        "workflowAuthority": "workflow-state-only",
+    }
+    return {**body, digest_key: canonical_digest(body)}

{agent_lifecycle_kit-1.83.0 → agent_lifecycle_kit-1.85.0}/src/agent_lifecycle/cli/lifecycle_parsers.py

@@ -6,6 +6,7 @@ import argparse
 
 from agent_lifecycle.adapter_sessions import START_MODES
 from agent_lifecycle.cli.progress_hooks import add_progress_hook_args
+from agent_lifecycle.contracts.lifecycle_action_catalog import COMPATIBILITY_COMMANDS
 from agent_lifecycle.contracts.review_mesh_schemas import REVIEW_MESH_MODE_IDS
 from agent_lifecycle.resources import builtin_profile_path
 from agent_lifecycle.review_mesh.operator_templates import REVIEW_MESH_OPERATOR_TEMPLATE_IDS
@@ -466,7 +467,13 @@ def _add_model_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentPa
 
 
 def _add_runner_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) -> None:
-    runner = subparsers.add_parser("runner", help="controlled execution-loop commands")
+    runner = subparsers.add_parser(
+        "runner",
+        help=(
+            f"deprecated compatibility journal commands ({len(COMPATIBILITY_COMMANDS)}); "
+            "use workflow commands for lifecycle authority"
+        ),
+    )
     runner_sub = runner.add_subparsers(dest="runner_command", required=True)
     runner_start = runner_sub.add_parser("start")
     runner_start.add_argument("--state", required=True)

agent_lifecycle_kit-1.85.0/src/agent_lifecycle/contracts/lifecycle_action_catalog.py

@@ -0,0 +1,147 @@
+"""Closed catalog for workflow actions and compatibility commands.
+
+The catalog is deliberately data-only.  It is shared by projections and
+host gates, but it cannot be extended by a project profile or an adapter.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from agent_lifecycle.contracts.canonical import canonical_digest
+
+ACTION_CATALOG: dict[str, dict[str, Any]] = {
+    "none": {"hostActionRequired": False, "stateMutationRequired": False},
+    "blocked": {"hostActionRequired": True, "stateMutationRequired": False},
+    "start-execution": {"hostActionRequired": True, "stateMutationRequired": True},
+    "launch-tasks": {"hostActionRequired": True, "stateMutationRequired": False},
+    "wait-for-active-tasks": {"hostActionRequired": False, "stateMutationRequired": False},
+    "accept-task": {"hostActionRequired": True, "stateMutationRequired": False},
+    "wait-for-task-outcome": {"hostActionRequired": False, "stateMutationRequired": False},
+    "run-final-audit": {"hostActionRequired": True, "stateMutationRequired": False},
+    "final-audit-outcome": {"hostActionRequired": True, "stateMutationRequired": True},
+    "finalize-run": {"hostActionRequired": True, "stateMutationRequired": True},
+    "request-human-decision": {"hostActionRequired": True, "stateMutationRequired": False},
+    "record-budget-decision": {"hostActionRequired": True, "stateMutationRequired": True},
+    "record-external-action-receipt": {"hostActionRequired": True, "stateMutationRequired": True},
+    "request-execution-authorization": {"hostActionRequired": True, "stateMutationRequired": True},
+    "adopt-plan": {"hostActionRequired": True, "stateMutationRequired": True},
+}
+
+ACTION_TYPES = frozenset(ACTION_CATALOG)
+NON_MODEL_ACTION_TYPES = frozenset(
+    {
+        "adopt-plan",
+        "final-audit-outcome",
+        "request-human-decision",
+        "record-budget-decision",
+        "record-external-action-receipt",
+    }
+)
+
+OPERATION_ACTION_TYPES: dict[str, frozenset[str]] = {
+    "file-edit": frozenset({"launch-tasks"}),
+    "shell-command": frozenset({"launch-tasks"}),
+    "task-accept": frozenset({"accept-task"}),
+    "run-finalize": frozenset({"finalize-run"}),
+}
+
+WORKFLOW_PHASE_ACTION_TYPES: dict[str, frozenset[str]] = {
+    "AWAITING_AUTHORIZATION": frozenset({"request-execution-authorization"}),
+    "PLAN_ONLY": frozenset({"none"}),
+    "READY": frozenset({"start-execution"}),
+    "RUNNING": frozenset(
+        {
+            "launch-tasks",
+            "accept-task",
+            "wait-for-active-tasks",
+            "wait-for-task-outcome",
+            "request-human-decision",
+            "run-final-audit",
+        }
+    ),
+    "BLOCKED": frozenset({"adopt-plan", "request-human-decision", "none"}),
+    "WAITING_FOR_BUDGET_DECISION": frozenset({"record-budget-decision"}),
+    "WAITING_FOR_EXTERNAL_ACTION": frozenset({"record-external-action-receipt"}),
+    "FINAL_AUDIT": frozenset({"final-audit-outcome", "finalize-run"}),
+    "COMPLETE": frozenset({"none"}),
+    "FAILED": frozenset({"none"}),
+    "CANCELLED": frozenset({"none"}),
+}
+
+COMPATIBILITY_COMMANDS: dict[str, dict[str, str]] = {
+    "runner start": {"kind": "compatibility", "replacement": "workflow run"},
+    "runner status": {"kind": "compatibility", "replacement": "workflow status"},
+    "runner transition": {"kind": "compatibility", "replacement": "workflow task-*"},
+    "runner stop": {"kind": "compatibility", "replacement": "workflow pause"},
+    "runner resume": {"kind": "compatibility", "replacement": "workflow resume"},
+}
+
+
+def build_action(action_type: str, **fields: Any) -> dict[str, Any]:
+    """Build a projected action only if it belongs to the closed catalog."""
+
+    validate_action_type(action_type)
+    return {"type": action_type, **fields}
+
+
+def validate_action_type(action_type: Any) -> str:
+    if not isinstance(action_type, str) or action_type not in ACTION_TYPES:
+        raise ValueError(f"unsupported lifecycle action: {action_type!r}")
+    return action_type
+
+
+def action_requires_host(action_type: Any) -> bool:
+    return bool(ACTION_CATALOG.get(validate_action_type(action_type), {}).get("hostActionRequired"))
+
+
+def action_requires_state_mutation(action_type: Any) -> bool:
+    return bool(ACTION_CATALOG.get(validate_action_type(action_type), {}).get("stateMutationRequired"))
+
+
+def action_types_for_operation(operation: str) -> frozenset[str]:
+    return OPERATION_ACTION_TYPES.get(operation, frozenset())
+
+
+def validate_action_catalog() -> dict[str, Any]:
+    """Return deterministic catalog checks used by release validation."""
+
+    blockers: list[dict[str, Any]] = []
+    for phase, actions in WORKFLOW_PHASE_ACTION_TYPES.items():
+        unknown = sorted(set(actions).difference(ACTION_TYPES))
+        if unknown:
+            blockers.append({"code": "catalog-unknown-phase-action", "phase": phase, "actions": unknown})
+    for operation, actions in OPERATION_ACTION_TYPES.items():
+        unknown = sorted(set(actions).difference(ACTION_TYPES))
+        if unknown:
+            blockers.append({"code": "catalog-unknown-operation-action", "operation": operation, "actions": unknown})
+    for command, entry in COMPATIBILITY_COMMANDS.items():
+        if entry.get("kind") != "compatibility" or not entry.get("replacement"):
+            blockers.append({"code": "catalog-invalid-command-classification", "command": command})
+    body = {
+        "schemaVersion": "agent-lifecycle-action-catalog.v1",
+        "status": "PASS" if not blockers else "FAIL",
+        "actionTypes": sorted(ACTION_TYPES),
+        "workflowPhaseActions": {key: sorted(value) for key, value in sorted(WORKFLOW_PHASE_ACTION_TYPES.items())},
+        "operationActions": {key: sorted(value) for key, value in sorted(OPERATION_ACTION_TYPES.items())},
+        "compatibilityCommands": COMPATIBILITY_COMMANDS,
+        "blockers": blockers,
+        "productionPromotionClaimed": False,
+    }
+    return {**body, "catalogDigest": canonical_digest(body)}
+
+
+__all__ = [
+    "ACTION_CATALOG",
+    "ACTION_TYPES",
+    "COMPATIBILITY_COMMANDS",
+    "NON_MODEL_ACTION_TYPES",
+    "OPERATION_ACTION_TYPES",
+    "WORKFLOW_PHASE_ACTION_TYPES",
+    "action_requires_host",
+    "action_requires_state_mutation",
+    "action_types_for_operation",
+    "build_action",
+    "validate_action_catalog",
+    "validate_action_type",
+]

{agent_lifecycle_kit-1.83.0 → agent_lifecycle_kit-1.85.0}/src/agent_lifecycle/contracts/process_redaction.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import re
 
+from agent_lifecycle.contracts.public_locators import normalize_public_locator
 from agent_lifecycle.contracts.redaction import redact_text as _redact_text
 
 _POSIX_ABSOLUTE_PATH = re.compile(r"(?<![A-Za-z0-9_.:/-])/(?!/)[^\s\"'<>]+")
@@ -31,4 +32,4 @@ def redact_process_text(value: str) -> tuple[str, bool]:
     return redacted, changed or redacted != value
 
 
-__all__ = ["redact_env_names", "redact_process_text", "redact_text"]
+__all__ = ["normalize_public_locator", "redact_env_names", "redact_process_text", "redact_text"]

agent_lifecycle_kit-1.85.0/src/agent_lifecycle/contracts/public_locators.py

@@ -0,0 +1,161 @@
+"""Canonical, offline validation for public HTTP(S) evidence locators."""
+
+from __future__ import annotations
+
+import ipaddress
+import re
+from typing import Any
+from urllib.parse import SplitResult, urlsplit, urlunsplit
+
+from agent_lifecycle.contracts.errors import LifecycleError
+from agent_lifecycle.contracts.schema_builders import open_object_schema
+
+PUBLIC_LOCATOR_SCHEMA = "agent-public-evidence-locator.v1"
+MAX_PUBLIC_LOCATOR_BYTES = 4096
+PUBLIC_LOCATOR_SCHEMES = ("http", "https")
+
+_HOST_LABEL = re.compile(r"^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$")
+
+PUBLIC_LOCATOR_SCHEMAS: dict[str, dict[str, Any]] = {
+    PUBLIC_LOCATOR_SCHEMA: open_object_schema(
+        PUBLIC_LOCATOR_SCHEMA,
+        required=["schemaVersion", "status", "value", "scheme", "host"],
+        properties={
+            "status": {"const": "PASS"},
+            "value": {"type": "string", "minLength": 1, "maxLength": MAX_PUBLIC_LOCATOR_BYTES},
+            "scheme": {"enum": list(PUBLIC_LOCATOR_SCHEMES)},
+            "host": {"type": "string", "minLength": 1, "maxLength": 253},
+            "port": {"type": ["integer", "null"], "minimum": 1, "maximum": 65535},
+            "blockers": {"type": "array", "maxItems": 16, "items": {"type": "object"}},
+            "productionPromotionClaimed": {"const": False},
+        },
+    )
+}
+
+
+def normalize_public_locator(value: str, *, label: str = "public locator") -> str:
+    """Return one canonical HTTP(S) locator without granting network authority."""
+
+    parsed = _parse_public_locator(value, label=label)
+    hostname = _normalize_hostname(parsed.hostname, label=label)
+    port = _validated_port(parsed, label=label)
+    if port in {80, 443} and parsed.scheme.lower() == ("http" if port == 80 else "https"):
+        port = None
+    netloc = f"[{hostname}]" if ":" in hostname else hostname
+    if port is not None:
+        netloc = f"{netloc}:{port}"
+    normalized = urlunsplit((parsed.scheme.lower(), netloc, parsed.path, parsed.query, parsed.fragment))
+    if len(normalized.encode("utf-8")) > MAX_PUBLIC_LOCATOR_BYTES:
+        raise LifecycleError(
+            "public-locator-too-large",
+            f"{label}: locator exceeds {MAX_PUBLIC_LOCATOR_BYTES} bytes",
+        )
+    return normalized
+
+
+def validate_public_locator(value: Any, *, label: str = "public locator") -> dict[str, Any]:
+    """Return a stable validation envelope for one public locator."""
+
+    try:
+        normalized = normalize_public_locator(value, label=label)
+        parsed = urlsplit(normalized)
+        return {
+            "schemaVersion": PUBLIC_LOCATOR_SCHEMA,
+            "status": "PASS",
+            "value": normalized,
+            "scheme": parsed.scheme,
+            "host": parsed.hostname,
+            "port": parsed.port,
+            "blockers": [],
+            "productionPromotionClaimed": False,
+        }
+    except LifecycleError as exc:
+        body = {
+            "schemaVersion": PUBLIC_LOCATOR_SCHEMA,
+            "status": "FAIL",
+            "value": value if isinstance(value, str) else None,
+            "scheme": None,
+            "host": None,
+            "port": None,
+            "blockers": [{"code": exc.code, "message": exc.message}],
+            "productionPromotionClaimed": False,
+        }
+        return body
+
+
+def require_public_locator(value: Any, *, label: str = "public locator") -> str:
+    """Validate a locator or raise its stable lifecycle error."""
+
+    return normalize_public_locator(value, label=label)
+
+
+def _parse_public_locator(value: Any, *, label: str) -> SplitResult:
+    if not isinstance(value, str) or not value:
+        raise LifecycleError("public-locator-required", f"{label}: HTTP(S) locator is required")
+    if len(value.encode("utf-8")) > MAX_PUBLIC_LOCATOR_BYTES:
+        raise LifecycleError(
+            "public-locator-too-large",
+            f"{label}: locator exceeds {MAX_PUBLIC_LOCATOR_BYTES} bytes",
+        )
+    if any(character.isspace() or ord(character) < 0x20 or ord(character) == 0x7F for character in value):
+        raise LifecycleError(
+            "public-locator-control-character", f"{label}: whitespace or control characters are not allowed"
+        )
+    try:
+        parsed = urlsplit(value)
+    except ValueError as exc:
+        raise LifecycleError("public-locator-invalid", f"{label}: locator cannot be parsed") from exc
+    scheme = parsed.scheme.lower()
+    if scheme not in PUBLIC_LOCATOR_SCHEMES:
+        raise LifecycleError("public-locator-scheme-unsupported", f"{label}: only HTTP(S) locators are allowed")
+    if parsed.username is not None or parsed.password is not None or "@" in parsed.netloc:
+        raise LifecycleError("public-locator-credentials-forbidden", f"{label}: URL credentials are not allowed")
+    try:
+        hostname = parsed.hostname
+    except ValueError as exc:
+        raise LifecycleError("public-locator-host-invalid", f"{label}: host is invalid") from exc
+    if not hostname:
+        raise LifecycleError("public-locator-host-required", f"{label}: host is required")
+    return parsed
+
+
+def _normalize_hostname(hostname: str | None, *, label: str) -> str:
+    if not hostname:
+        raise LifecycleError("public-locator-host-required", f"{label}: host is required")
+    host = hostname.rstrip(".")
+    if not host:
+        raise LifecycleError("public-locator-host-invalid", f"{label}: host is invalid")
+    if ":" in host:
+        try:
+            return ipaddress.IPv6Address(host).compressed.lower()
+        except ValueError as exc:
+            raise LifecycleError("public-locator-host-invalid", f"{label}: IPv6 host is invalid") from exc
+    try:
+        ascii_host = host.encode("idna").decode("ascii").lower()
+    except UnicodeError as exc:
+        raise LifecycleError("public-locator-host-invalid", f"{label}: host encoding is invalid") from exc
+    labels = ascii_host.split(".")
+    if len(ascii_host) > 253 or any(not _HOST_LABEL.fullmatch(part) for part in labels):
+        raise LifecycleError("public-locator-host-invalid", f"{label}: host is invalid")
+    return ascii_host
+
+
+def _validated_port(parsed: Any, *, label: str) -> int | None:
+    try:
+        port = parsed.port
+    except ValueError as exc:
+        raise LifecycleError("public-locator-port-invalid", f"{label}: port is invalid") from exc
+    if port is not None and not 1 <= port <= 65535:
+        raise LifecycleError("public-locator-port-invalid", f"{label}: port is invalid")
+    return port
+
+
+__all__ = [
+    "MAX_PUBLIC_LOCATOR_BYTES",
+    "PUBLIC_LOCATOR_SCHEMA",
+    "PUBLIC_LOCATOR_SCHEMAS",
+    "PUBLIC_LOCATOR_SCHEMES",
+    "normalize_public_locator",
+    "require_public_locator",
+    "validate_public_locator",
+]

{agent_lifecycle_kit-1.83.0 → agent_lifecycle_kit-1.85.0}/src/agent_lifecycle/contracts/redaction.py

@@ -3,9 +3,13 @@
 from __future__ import annotations
 
 import re
+from contextlib import suppress
 from typing import Any
 from urllib.parse import unquote_plus, urlsplit, urlunsplit
 
+from agent_lifecycle.contracts.errors import LifecycleError
+from agent_lifecycle.contracts.public_locators import normalize_public_locator
+
 REDACTED_VALUE = "<redacted>"
 LOCAL_PATH_REDACTION = "<local-path>"
 
@@ -88,10 +92,14 @@ def redact_text_with_stats(value: str) -> tuple[str, bool, dict[str, int]]:
     path_count = len(_LOCAL_PATH.findall(redacted))
     redacted = _LOCAL_PATH.sub(LOCAL_PATH_REDACTION, redacted)
     redacted = _restore_http_urls(redacted, urls)
-    return redacted, redacted != value, {
-        "secretLikeMarkersRedacted": secret_count,
-        "localPathsRedacted": path_count,
-    }
+    return (
+        redacted,
+        redacted != value,
+        {
+            "secretLikeMarkersRedacted": secret_count,
+            "localPathsRedacted": path_count,
+        },
+    )
 
 
 def contains_local_absolute_path(value: str) -> bool:
@@ -211,6 +219,9 @@ def _redact_http_url(value: str) -> tuple[str, int]:
     redacted, private_key_count = _replace_matches(_PRIVATE_KEY, redacted, REDACTED_VALUE)
     redacted, bearer_count = _replace_matches(_BEARER, redacted, f"Bearer {REDACTED_VALUE}")
     redacted, token_count = _replace_matches(_BARE_TOKEN, redacted, REDACTED_VALUE)
+    if "@" not in netloc:
+        with suppress(LifecycleError):
+            redacted = normalize_public_locator(redacted, label="redacted URL")
     return redacted, secret_count + private_key_count + bearer_count + token_count