agentevo-cloud 0.1.2__tar.gz → 0.1.4__tar.gz

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/LICENSE

@@ -3,7 +3,7 @@ Business Source License 1.1
 Parameters
 
 Licensor:         Agentevo
-Licensed Work:    agentevo-cloud 0.1.0
+Licensed Work:    agentevo-cloud 0.1.4
 Copyright Notice: Copyright (c) 2026 Agentevo
 
 Additional Use Grant:

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentevo-cloud
-Version: 0.1.2
+Version: 0.1.4
 Summary: Agentevo SaaS (TZ-3 control plane, TZ-4 managed intelligence): auth, metering, C2 APIs, workers.
 Project-URL: Homepage, https://agentevo.sh
 Author: Agentevo
@@ -9,7 +9,7 @@ License: Business Source License 1.1
         Parameters
         
         Licensor:         Agentevo
-        Licensed Work:    agentevo-cloud 0.1.0
+        Licensed Work:    agentevo-cloud 0.1.4
         Copyright Notice: Copyright (c) 2026 Agentevo
         
         Additional Use Grant:
@@ -125,3 +125,9 @@ agentevo-cloud serve
 ```
 
 Part of the Agentevo monorepo; see the [main README](../../README.md).
+
+## License
+
+Business Source License 1.1 — see [LICENSE](./LICENSE). Free for internal
+production use in your own infrastructure; converts to Apache-2.0 on the
+Change Date stated in the license.

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/README.md

@@ -12,3 +12,9 @@ agentevo-cloud serve
 ```
 
 Part of the Agentevo monorepo; see the [main README](../../README.md).
+
+## License
+
+Business Source License 1.1 — see [LICENSE](./LICENSE). Free for internal
+production use in your own infrastructure; converts to Apache-2.0 on the
+Change Date stated in the license.

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentevo-cloud"
-version = "0.1.2"
+version = "0.1.4"
 description = "Agentevo SaaS (TZ-3 control plane, TZ-4 managed intelligence): auth, metering, C2 APIs, workers."
 readme = "README.md"
 requires-python = ">=3.12"

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Agentevo SaaS control plane and managed intelligence APIs."""
 
 from agentevo_cloud.analytics import (

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/analytics.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Team analytics: tenant-scoped aggregates over the managed index.
 
 Spec grounding: PRD §15 ("record improved execution metrics"), PRD §16

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/app.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Cloud Control API: FastAPI factory, error model, and routes.
 
 Every route authenticates via Bearer tokens except /healthz and the auth
@@ -95,6 +96,7 @@ from agentevo_cloud.tokens import (
     hash_token,
     issue_pat,
     list_tokens,
+    require_workspace,
     revoke_token,
     rotate_refresh,
     verify_token,
@@ -538,9 +540,16 @@ def _client_ip(request: Request) -> str:
 
 
 def _auth_rate_limit(request: Request, conn: sqlite3.Connection, name: str) -> None:
-    """IP-keyed burst guard for the unauthenticated auth flows."""
+    """IP-keyed burst guard for the unauthenticated auth flows.
+
+    Commits the increment immediately: burst counters must survive the
+    request transaction's rollback-on-error, or failed guesses would never
+    count. Callers must run this before any request-conn writes (all do:
+    it gates handler entry, and dependencies only read).
+    """
     settings: Settings = request.app.state.settings
     check_rate_limit(conn, f"auth:{name}:{_client_ip(request)}", settings.rate_limit_per_minute)
+    conn.commit()
 
 
 def _idempotent(  # noqa: PLR0913, PLR0917 - idempotency carries request context
@@ -555,8 +564,15 @@ def _idempotent(  # noqa: PLR0913, PLR0917 - idempotency carries request context
 
     Anonymous bootstrap flows (device start, CI exchange) share the empty
     tenant namespace; their responses carry no tenant data before approval.
+    Their replays are additionally scoped by client IP, so one anonymous
+    client reusing a generic key cannot replay another client's live
+    device codes. Stored replays withhold single-view secrets (issuance
+    responses keep ids/scopes/expiry only); the live response is
+    unaffected.
     """
     route = f"{request.method} {request.url.path}"
+    if not tenant_id:
+        route = f"{_client_ip(request)} {route}"
     if key is not None:
         replay = idempotency_lookup(conn, tenant_id, route, key, body)
         if replay is not None:
@@ -573,7 +589,7 @@ def _idempotent(  # noqa: PLR0913, PLR0917 - idempotency carries request context
             key,
             body=body,
             status_code=status,
-            response=payload,
+            response=_scrub_replay_secrets(payload),
             ttl=timedelta(seconds=settings.idempotency_ttl_seconds),
         )
         if raced is not None:
@@ -619,6 +635,8 @@ def _issue_token(
             user_id=principal.user_id or "",
             workspaces=workspaces,
             ttl=ttl,
+            grantor_scopes=list(principal.scopes),
+            grantor_workspaces=list(principal.workspaces),
         )
         audit(
             conn,
@@ -639,6 +657,19 @@ def _issue_token(
     return _idempotent(request, conn, principal.tenant_id, idempotency_key, body, compute)
 
 
+#: Top-level response keys withheld from the idempotency replay store.
+#: Single-view issuance secrets must not persist in plaintext for the key
+#: TTL: replays of issuance routes return metadata (ids, scopes, expiry)
+#: without the secret itself. (Request bodies are hash-compared, never
+#: stored; short-lived device/user codes stay stored: retry UX needs them.)
+_SECRET_REPLAY_KEYS = frozenset({"secret", "access_token", "refresh_token", "token"})
+
+
+def _scrub_replay_secrets(payload: dict[str, Any]) -> dict[str, Any]:
+    """Copy ``payload`` minus single-view credential fields."""
+    return {key: value for key, value in payload.items() if key not in _SECRET_REPLAY_KEYS}
+
+
 def _list_tokens(
     principal: Principal = Depends(CONTROL_READ),
     conn: sqlite3.Connection = Depends(get_conn),
@@ -1625,9 +1656,13 @@ def _body_target(body: dict[str, Any]) -> TrustState:
 
 
 def _managed_or_404(
-    conn: sqlite3.Connection, tenant_id: str, object_id: str, version: int
+    conn: sqlite3.Connection,
+    tenant_id: str,
+    object_id: str,
+    version: int,
+    principal: Principal,
 ) -> ManagedObject:
-    """One indexed version, tenant-scoped (404 reveals nothing across tenants)."""
+    """One indexed version, tenant- and workspace-scoped (404 reveals nothing)."""
     target = get_managed(conn, tenant_id, object_id, version)
     if target is None:
         raise AgentevoError(
@@ -1635,6 +1670,7 @@ def _managed_or_404(
             "unknown object version",
             {"object_id": object_id, "version": version},
         )
+    require_workspace(principal, target.workspace_id)
     return target
 
 
@@ -1649,7 +1685,7 @@ def _verify_object(  # noqa: PLR0913, PLR0917 - handler carries route context
     version = _body_version(body)
     environment = body.get("environment")
     parse_environment(environment)
-    _managed_or_404(conn, principal.tenant_id, object_id, version)
+    target = _managed_or_404(conn, principal.tenant_id, object_id, version, principal)
     params = {} if environment is None else {"environment": environment}
 
     def compute() -> tuple[int, dict[str, Any]]:
@@ -1660,6 +1696,7 @@ def _verify_object(  # noqa: PLR0913, PLR0917 - handler carries route context
             object_id=object_id,
             version=version,
             params=params,
+            workspace_id=target.workspace_id,
         )
         audit(
             conn,
@@ -1685,7 +1722,7 @@ def _revalidate_object(  # noqa: PLR0913, PLR0917 - handler carries route contex
     version = _body_version(body)
     environment = body.get("environment")
     parse_environment(environment)
-    target = _managed_or_404(conn, principal.tenant_id, object_id, version)
+    target = _managed_or_404(conn, principal.tenant_id, object_id, version, principal)
     if target.state not in _REVALIDATABLE_STATES:
         raise AgentevoError(
             ErrorCode.CONFLICT,
@@ -1704,6 +1741,7 @@ def _revalidate_object(  # noqa: PLR0913, PLR0917 - handler carries route contex
             object_id=object_id,
             version=version,
             params=params,
+            workspace_id=target.workspace_id,
         )
         audit(
             conn,
@@ -1724,7 +1762,7 @@ def _get_object_version(
     principal: Principal = Depends(RECALL_READ),
     conn: sqlite3.Connection = Depends(get_conn),
 ) -> dict[str, Any]:
-    return _managed_or_404(conn, principal.tenant_id, object_id, version).to_dict()
+    return _managed_or_404(conn, principal.tenant_id, object_id, version, principal).to_dict()
 
 
 def _body_reason(body: dict[str, Any]) -> RevocationReason:
@@ -1768,12 +1806,17 @@ def _compile_experiences(
     workspace_id = parse_required_str(body.get("workspace_id"), "workspace_id")
     project_id = parse_required_str(body.get("project_id", DEFAULT_COMPILE_PROJECT), "project_id")
     ensure_workspace(conn, principal.tenant_id, workspace_id)
+    require_workspace(principal, workspace_id)
     require_searchable(conn, principal.tenant_id, workspace_id, "compile managed experiences")
     params = {"session_id": session_id, "workspace_id": workspace_id, "project_id": project_id}
 
     def compute() -> tuple[int, dict[str, Any]]:
         job = create_job(
-            conn, principal.tenant_id, JobType.COMPILE_EXPERIENCES.value, params=params
+            conn,
+            principal.tenant_id,
+            JobType.COMPILE_EXPERIENCES.value,
+            params=params,
+            workspace_id=workspace_id,
         )
         audit(
             conn,
@@ -1801,7 +1844,7 @@ def _compile_workflows(
     parse_fallbacks(body.get("fallbacks", {}))
     canary = parse_canary_steps(body.get("canary_steps", 1))
     rows = [
-        _compile_skill_row(conn, principal.tenant_id, object_id, version)
+        _compile_skill_row(conn, principal.tenant_id, object_id, version, principal)
         for object_id, version in refs
     ]
     if len({row.workspace_id for row in rows}) > 1:
@@ -1810,6 +1853,7 @@ def _compile_workflows(
             "cross-workspace compile rejected",
             {"workspaces": sorted({row.workspace_id for row in rows})},
         )
+    require_workspace(principal, rows[0].workspace_id)
     require_searchable(conn, principal.tenant_id, rows[0].workspace_id, "compile managed workflows")
     params: dict[str, Any] = {
         "skills": [{"object_id": row.object_id, "version": row.version} for row in rows],
@@ -1820,7 +1864,13 @@ def _compile_workflows(
     }
 
     def compute() -> tuple[int, dict[str, Any]]:
-        job = create_job(conn, principal.tenant_id, JobType.COMPILE_WORKFLOW.value, params=params)
+        job = create_job(
+            conn,
+            principal.tenant_id,
+            JobType.COMPILE_WORKFLOW.value,
+            params=params,
+            workspace_id=rows[0].workspace_id,
+        )
         audit(
             conn,
             principal.tenant_id,
@@ -1835,9 +1885,13 @@ def _compile_workflows(
 
 
 def _compile_skill_row(
-    conn: sqlite3.Connection, tenant_id: str, object_id: str, version: int
+    conn: sqlite3.Connection,
+    tenant_id: str,
+    object_id: str,
+    version: int,
+    principal: Principal,
 ) -> ManagedObject:
-    """One referenced skill (404 unknown; 409 unless SKILL plus Trusted)."""
+    """One referenced skill (404 unknown/out-of-scope; 409 unless SKILL plus Trusted)."""
     row = get_managed(conn, tenant_id, object_id, version)
     if row is None:
         raise AgentevoError(
@@ -1845,6 +1899,9 @@ def _compile_skill_row(
             "unknown object version",
             {"object_id": object_id, "version": version},
         )
+    # Scope before substance: the 409s below must never confirm an
+    # out-of-scope object's type or state to a scoped token.
+    require_workspace(principal, row.workspace_id)
     if row.object_type != LearnedObjectType.SKILL.value:
         raise AgentevoError(
             ErrorCode.CONFLICT,
@@ -1908,6 +1965,8 @@ def _get_job(
     if job is None:
         raise AgentevoError(ErrorCode.NOT_FOUND, "unknown job", {"job_id": job_id})
     _require_job_scope(principal, job.job_type)
+    if job.workspace_id is not None:
+        require_workspace(principal, job.workspace_id)
     return job.to_dict()
 
 
@@ -1927,7 +1986,9 @@ def _list_jobs(
         raise AgentevoError(
             ErrorCode.INVALID_ARGUMENT, f"unknown job state: {state}", {"state": state}
         )
-    jobs = list_jobs(conn, principal.tenant_id, state=state, limit=limit)
+    jobs = list_jobs(
+        conn, principal.tenant_id, state=state, limit=limit, workspaces=principal.workspaces
+    )
     return {"jobs": [job.to_dict() for job in jobs]}
 
 
@@ -1942,6 +2003,8 @@ def _cancel_job(
     if job is None:
         raise AgentevoError(ErrorCode.NOT_FOUND, "unknown job", {"job_id": job_id})
     _require_job_scope(principal, job.job_type)
+    if job.workspace_id is not None:
+        require_workspace(principal, job.workspace_id)
 
     def compute() -> tuple[int, dict[str, Any]]:
         canceled = cancel_job(conn, principal.tenant_id, job_id)

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/cli.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Control-plane operator CLI: tenant provisioning, serving, and job driving."""
 
 from __future__ import annotations

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/config.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Cloud Control API settings (environment-driven, no secrets in code)."""
 
 from __future__ import annotations

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/db.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Control-plane storage: SQLite engine plus versioned migrations.
 
 The repository layer speaks plain SQL that stays portable to server RDBMS
@@ -16,7 +17,9 @@ from collections.abc import Callable, Iterator
 from contextlib import contextmanager, suppress
 from pathlib import Path
 
-SCHEMA_VERSION = 9
+from agentevo_core.errors import AgentevoError, ErrorCode
+
+SCHEMA_VERSION = 10
 
 #: Migration mutual exclusion. Five compose services share one SQLite file
 #: and migrate lazily on first use; without this, concurrent first-boots race
@@ -358,9 +361,46 @@ def _ensure_job_durability_columns(raw: sqlite3.Connection) -> None:
 
 _MIGRATION_FOLLOWUPS[8] = _ensure_job_durability_columns
 
-_SCHEMA_V9 = """
-CREATE UNIQUE INDEX IF NOT EXISTS uq_repo_links_repo ON repo_links (repo);
-"""
+_SCHEMA_V10 = "-- V10: job workspace scoping column (applied by followup).\n"
+
+
+def _ensure_job_workspace_column(raw: sqlite3.Connection) -> None:
+    """Add `jobs.workspace_id` unless a replay already did (NULL = legacy)."""
+    names = {row[1] for row in raw.execute("PRAGMA table_info(jobs)").fetchall()}
+    if "workspace_id" not in names:
+        raw.execute("ALTER TABLE jobs ADD COLUMN workspace_id TEXT")
+    raw.execute("CREATE INDEX IF NOT EXISTS idx_jobs_workspace ON jobs (tenant_id, workspace_id)")
+
+
+_MIGRATION_FOLLOWUPS[10] = _ensure_job_workspace_column
+
+_SCHEMA_V9 = "-- V9: globally-unique repo links (applied by followup).\n"
+
+
+def _ensure_unique_repo_index(raw: sqlite3.Connection) -> None:
+    """Create the global repo uniqueness index, or fail with operator guidance.
+
+    Pre-V9 databases keyed links by (tenant, repo): two tenants may share
+    one name. The bare index would abort boot with a raw IntegrityError;
+    detect the collision first and name the repos so the operator can
+    unlink all but one and restart. Fail-closed either way.
+    """
+    dupes = [
+        row[0]
+        for row in raw.execute(
+            "SELECT repo FROM repo_links GROUP BY repo HAVING COUNT(DISTINCT tenant_id) > 1"
+        ).fetchall()
+    ]
+    if dupes:
+        raise AgentevoError(
+            ErrorCode.CONFLICT,
+            "cannot migrate: repo linked by multiple tenants; unlink all but one, then restart",
+            {"repos": sorted(dupes)},
+        )
+    raw.execute("CREATE UNIQUE INDEX IF NOT EXISTS uq_repo_links_repo ON repo_links (repo)")
+
+
+_MIGRATION_FOLLOWUPS[9] = _ensure_unique_repo_index
 
 MIGRATIONS: tuple[tuple[int, str], ...] = (
     (1, _SCHEMA_V1),
@@ -372,6 +412,7 @@ MIGRATIONS: tuple[tuple[int, str], ...] = (
     (7, _SCHEMA_V7),
     (8, _SCHEMA_V8),
     (9, _SCHEMA_V9),
+    (10, _SCHEMA_V10),
 )
 
 

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/devices.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Workspace devices and the OAuth device authorization flow (RFC 8628).
 
 Devices register public keys under TOFU: each ``(key_id, workspace)``
@@ -669,9 +670,11 @@ def _granted_workspace(
             {"workspace": requested},
         )
     if identity.workspaces and requested not in identity.workspaces:
+        # Same 404 as a missing workspace: a scoped approver must not learn
+        # whether the slug exists outside its grant (require_workspace rule).
         raise AgentevoError(
-            ErrorCode.FORBIDDEN,
-            "approver token is not valid for the requested workspace",
+            ErrorCode.NOT_FOUND,
+            f"unknown workspace: {requested}",
             {"workspace": requested},
         )
     return requested

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/events.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Managed experience ingest: sanitized C1/C2 event summaries.
 
 Spec: API §5/§7. ``POST /v1/events/batch`` carries up to 100 canonical

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/jobs.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Async job orchestration: durable verify/compile jobs with poll + webhooks.
 
 Spec: API §5/§9/§11/§23. Submissions return 202 with a queued job;
@@ -96,6 +97,7 @@ class Job:
     finished_at: str | None
     attempts: int = 0
     next_run_at: str | None = None
+    workspace_id: str | None = None
 
     def to_dict(self) -> dict[str, Any]:
         """Poll response shape (tenant omitted: derived server-side)."""
@@ -104,6 +106,7 @@ class Job:
             "type": self.job_type,
             "object_id": self.object_id,
             "version": self.version,
+            "workspace_id": self.workspace_id,
             "state": self.state,
             "params": self.params,
             "result": self.result,
@@ -156,8 +159,9 @@ def create_job(  # noqa: PLR0913 - submission carries job context
     version: int | None = None,
     params: dict[str, Any] | None = None,
     now: datetime | None = None,
+    workspace_id: str | None = None,
 ) -> Job:
-    """Queue one job (202 submission path)."""
+    """Queue one job (202 submission path; workspace stamps its scope)."""
     try:
         kind = JobType(job_type)
     except ValueError as exc:
@@ -169,7 +173,7 @@ def create_job(  # noqa: PLR0913 - submission carries job context
     payload = params or {}
     conn.execute(
         "INSERT INTO jobs (tenant_id, job_id, job_type, object_id, version,"
-        " state, params, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
+        " state, params, created_at, workspace_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
         (
             tenant_id,
             job_id,
@@ -179,6 +183,7 @@ def create_job(  # noqa: PLR0913 - submission carries job context
             JobState.QUEUED.value,
             _dump(payload),
             moment,
+            workspace_id,
         ),
     )
     return Job(
@@ -194,6 +199,7 @@ def create_job(  # noqa: PLR0913 - submission carries job context
         created_at=moment,
         started_at=None,
         finished_at=None,
+        workspace_id=workspace_id,
     )
 
 
@@ -206,23 +212,34 @@ def get_job(conn: sqlite3.Connection, tenant_id: str, job_id: str) -> Job | None
 
 
 def list_jobs(
-    conn: sqlite3.Connection, tenant_id: str, *, state: str | None = None, limit: int = 50
+    conn: sqlite3.Connection,
+    tenant_id: str,
+    *,
+    state: str | None = None,
+    limit: int = 50,
+    workspaces: tuple[str, ...] = (),
 ) -> list[Job]:
-    """Tenant jobs, newest first (operator listing)."""
+    """Tenant jobs, newest first (operator listing; scope-filtered)."""
     if not 1 <= limit <= LIST_JOBS_MAX:
         raise AgentevoError(
             ErrorCode.INVALID_ARGUMENT, f"limit must be within [1, {LIST_JOBS_MAX}]", {}
         )
-    if state is None:
-        rows = conn.execute(
-            "SELECT * FROM jobs WHERE tenant_id = ? ORDER BY created_at DESC LIMIT ?",
-            (tenant_id, limit),
-        ).fetchall()
-    else:
-        rows = conn.execute(
-            "SELECT * FROM jobs WHERE tenant_id = ? AND state = ? ORDER BY created_at DESC LIMIT ?",
-            (tenant_id, state, limit),
-        ).fetchall()
+    clauses = ["tenant_id = ?"]
+    params: list[Any] = [tenant_id]
+    if state is not None:
+        clauses.append("state = ?")
+        params.append(state)
+    if workspaces:
+        placeholders = ", ".join("?" for _ in workspaces)
+        clauses.append(f"workspace_id IN ({placeholders})")
+        params.extend(workspaces)
+    query = (
+        "SELECT * FROM jobs WHERE "  # noqa: S608 - static fragments + binds
+        + " AND ".join(clauses)
+        + " ORDER BY created_at DESC LIMIT ?"
+    )
+    params.append(limit)
+    rows = conn.execute(query, params).fetchall()
     return [_job_row(row) for row in rows]
 
 
@@ -546,6 +563,8 @@ def _job_row(row: sqlite3.Row) -> Job:
         finished_at=row["finished_at"],
         attempts=row["attempts"],
         next_run_at=row["next_run_at"],
+        # NOTE: sqlite3.Row `in` scans values, so `.keys()` is required here.
+        workspace_id=row["workspace_id"] if "workspace_id" in row.keys() else None,  # noqa: SIM118
     )
 
 

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/managed.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Managed C2 registry: tenant-partitioned index over ingested sync deltas.
 
 Spec: API §8/§12, Data Flow §7 steps 5-7. Push ingest stores the

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/metering.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Request metering: quotas, monthly cycles, burst rate limits.
 
 Exactly the spec's billable set is metered: authenticated platform

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/oidc.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """OIDC/JWT verification shared by CI exchange and browser device approval.
 
 RS256 via the issuer JWKS is the production path (GitHub Actions for CI,

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/openapi.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """OpenAPI snapshot: regenerate the checked-in v1 contract (API §25).
 
 The checked-in ``openapi/openapi.v1.json`` is generated from the live app,

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/promote.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Managed promotion: Candidate -> Verified -> Trusted advancement.
 
 Spec: PRD §17/§19, API §20. Mirrors the local PromotionService gates over
@@ -24,7 +25,7 @@ from datetime import UTC, datetime
 from agentevo_cloud.jobs import JobState, JobType
 from agentevo_cloud.managed import ManagedObject, get_managed
 from agentevo_cloud.records import audit
-from agentevo_cloud.tokens import Principal
+from agentevo_cloud.tokens import Principal, require_workspace
 from agentevo_core.errors import AgentevoError, ErrorCode
 from agentevo_core.risk import RiskClass, requires_human_approval
 from agentevo_core.sync import DeltaKind
@@ -75,6 +76,7 @@ def promote_managed(  # noqa: PLR0913 - promotion carries object context
             "unknown object version",
             {"object_id": object_id, "version": version},
         )
+    require_workspace(principal, row.workspace_id)
     check_transition(TrustState(row.state), target)
     moment = now or datetime.now(UTC)
     tally = _tally(conn, principal.tenant_id, object_id, version)

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/recall.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Managed recall: tenant-scoped retrieval over the C2 index.
 
 Spec: API §8/§13. The server authenticates, derives tenant scope,

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/records.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Append-only audit log (BR-014) and idempotency-key store (API §15).
 
 Audit details carry C1 labels only — never request bodies, secrets, or

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/revoke.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Server-attested revocation: object-wide tombstones with full propagation.
 
 Spec: Data Flow §13, API §20. Revocation is the safety override: one
@@ -35,7 +36,7 @@ from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 from agentevo_cloud.managed import index_accepted
 from agentevo_cloud.records import audit
 from agentevo_cloud.sync import store_server_delta
-from agentevo_cloud.tokens import Principal
+from agentevo_cloud.tokens import Principal, require_workspace
 from agentevo_core.classification import Classification
 from agentevo_core.errors import AgentevoError, ErrorCode
 from agentevo_core.objects import LearnedObjectType
@@ -95,6 +96,8 @@ def revoke_object(
     ).fetchall()
     if not rows:
         raise AgentevoError(ErrorCode.NOT_FOUND, "unknown object", {"object_id": object_id})
+    for row in rows:
+        require_workspace(principal, row["workspace_id"])
     live = [row for row in rows if row["state"] not in _TERMINAL_REVOKE_STATES]
     moment = now or datetime.now(UTC)
     actor = principal.user_id or principal.token_id

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/screen.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Second-pass ingest screening: classification, C4 patterns, C3 evacuation.
 
 Spec: API §12/§17/§25, Data Flow §7. The local runtime minimizes and

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/sync.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Managed sync ingest: push validation, ordered store, pull pages.
 
 Spec: API §5/§12/§20. This module mirrors the ``LoopbackTransport``

{agentevo_cloud-0.1.2 → agentevo_cloud-0.1.4}/src/agentevo_cloud/tenants.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: BUSL-1.1
 """Tenants, memberships, workspaces, and plan entitlements.
 
 Plans: Free carries exactly 10,000 billable requests per monthly cycle