agentevo-cloud 0.1.9__tar.gz → 0.2.8__tar.gz

{agentevo_cloud-0.1.9 → agentevo_cloud-0.2.8}/.gitignore

@@ -31,3 +31,6 @@ htmlcov/
 
 # Local-only Clerk publishable key (never commit)
 website/clerk.config.json
+
+# `agentevo report` default output (repo-root runs drop it here)
+agentevo-report.html

{agentevo_cloud-0.1.9 → agentevo_cloud-0.2.8}/LICENSE

@@ -3,7 +3,7 @@ Business Source License 1.1
 Parameters
 
 Licensor:         Agentevo
-Licensed Work:    agentevo-cloud 0.1.9
+Licensed Work:    agentevo-cloud 0.2.8
 Copyright Notice: Copyright (c) 2026 Agentevo
 
 Additional Use Grant:

agentevo_cloud-0.2.8/PKG-INFO

@@ -0,0 +1,165 @@
+Metadata-Version: 2.5
+Name: agentevo-cloud
+Version: 0.2.8
+Summary: Agentevo SaaS (TZ-3 control plane, TZ-4 managed intelligence): auth, metering, C2 APIs, workers.
+Project-URL: Homepage, https://agentevo.sh
+Project-URL: Documentation, https://agentevo.sh/#setup
+Author: Agentevo
+License-Expression: BUSL-1.1
+License-File: LICENSE
+Keywords: agent-memory,ai-agents,guardrails,skills
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Requires-Dist: agentevo-core==0.1.6
+Requires-Dist: agentevo-local==0.1.7
+Requires-Dist: anyio>=4
+Requires-Dist: cryptography>=44
+Requires-Dist: fastapi>=0.115
+Requires-Dist: pyjwt>=2.15
+Requires-Dist: uvicorn>=0.30
+Provides-Extra: encrypted
+Requires-Dist: sqlcipher3==0.6.3; extra == 'encrypted'
+Description-Content-Type: text/markdown
+
+# agentevo-cloud
+
+Agentevo SaaS planes: control API (TZ-3: auth, tenants, metering, sync) and
+managed intelligence API (TZ-4: tenant-scoped recall, async verify/compile jobs,
+analytics), plus the `agentevo-cloud` operator CLI (`provision`, `serve`,
+`jobs`, `webhooks`, `health`, `export`, `backup`, `privacy`).
+
+```sh
+python3 -m venv .venv  # Python 3.10+
+.venv/bin/pip install agentevo-cloud
+.venv/bin/agentevo-cloud provision --tenant t-1 --name demo --user u-1 --workspace main
+.venv/bin/agentevo-cloud serve
+```
+
+A virtualenv keeps `pip` off the system Python, which macOS Homebrew and
+Debian/Ubuntu refuse to modify (PEP 668).
+
+Part of [Agentevo](https://agentevo.sh).
+
+## Encrypted runtime release
+
+Cloud **0.2.8** is the pending source version for authenticated accepted event
+context, reviewed legacy transitions and the existing encrypted storage,
+provider and backup controls. Verified 0.2.7 artifacts and consumer seal remain
+preserved; 0.2.8 is not built/sealed/cold-installed yet. A local passing test alone
+does not establish publication, deployment or complete operating acceptance.
+
+The optional `encrypted` extra pins `sqlcipher3==0.6.3`. For source development,
+install it with `uv sync --frozen --package agentevo-cloud --extra encrypted`.
+After final publication, the package selection is
+`agentevo-cloud[encrypted]==0.2.8`; use the approved hashed, wheel-only consumer
+lock for a hosted image. Installation alone does not activate encryption.
+
+Select `AGENTEVO_DB_STORAGE=sqlcipher-v1`, an explicit public
+`AGENTEVO_DB_KEY_ID` and `AGENTEVO_DB_KEY_FILE` for every API, worker and
+operator process using the same database. The key file must contain exactly
+32 raw bytes, be owned by that runtime user with mode 0600, and be mounted from
+independently recoverable protected storage. No default key is supplied.
+Missing runtime, missing/wrong keys or a plaintext database in the encrypted
+profile are refused; the profile never falls back to plain SQLite. The default
+`plain` profile exists for legacy compatibility and does not encrypt live rows.
+
+Existing plaintext needs a separately verified new-file conversion; selecting
+the profile does not convert it. Preserve older plaintext recovery points
+under their reviewed retention policy, and keep the correct old database keys
+and independent archive/journal authority for encrypted recovery points.
+Native application and operator paths have local acceptance evidence. Linux
+image execution and independent operating custody remain separate gates. The
+source checkout contains the detailed design and conversion procedure in
+`docs/implementation/LIVE_DATABASE_ENCRYPTION.md`; public setup is at
+[Agentevo setup](https://agentevo.sh/#setup).
+
+## Private recovery controls
+
+Encrypted online snapshots support verified filesystem publication and
+recovery into a new private database. Recovery requires independent keys, the
+authenticated erasure journal, its independently trusted latest head and a
+current approved retention policy. The selected `sqlcipher-v1` profile encrypts
+live database storage; the legacy `plain` profile leaves searchable rows
+readable in copied databases. Archive encryption does not establish live-data
+encryption or off-host custody. Protected application backups require their own
+archive key with different material from the online database key. Legacy gzip
+restore refuses encrypted or privacy-protected databases; use the authenticated
+operator recovery path with current independently retained authority instead.
+
+Optional `AGENTEVO_ERASURE_JOURNAL` and `AGENTEVO_ERASURE_KEY_FILE` configure the
+same authority for API, workers and operator commands. Protected databases refuse
+missing authority. Recorded erasures, revocations, consent and retention decisions
+are reconciled before restored data is used. Permission increases require a
+postcommit confirmation; uncertain decisions remain unavailable until explicit
+private operator resolution. `privacy authority-status`, `authority-resolve`,
+`authority-reject` and `reconcile` support that procedure without journal editing.
+
+Protected restore requires the source's protection marker and authenticated
+applied/minimum journal heads to exist already. Historical snapshots from before
+activation are refused; a new empty journal cannot prove earlier revocations.
+Review a current baseline before activation and preserve independently current
+authority. The guard cannot reconstruct unrecorded historical decisions.
+
+`privacy retention` defaults to a read-only approved-policy preview. Apply needs
+an explicitly activated matching policy and a fresh matching preview seal.
+Use `agentevo-cloud backup --help` and `agentevo-cloud privacy --help` for exact
+arguments. Keep previous artifacts, archive keys and journal verification keys
+for every retained recovery point. Unrecorded decisions before activation need a
+reviewed transition; real operating recovery remains a separate acceptance gate.
+
+## Queued job authorization
+
+Schema 29 records private accepted submitter authority for new asynchronous jobs.
+Workers recheck credential ancestry, membership and the required workspace and
+operation grants before claim and result application. Clerk work also checks the
+accepted public signing key, original expiry, exact current account link and
+fresh configured provider/session status. Provider outages defer work without
+applying a private result; withdrawn authority cancels it. Provider reads occur
+outside database/privacy fences. Session-event compilation needs a tenant-wide
+grant because its input events have no workspace attribution.
+
+Existing jobs keep an unknown submitter. Workers cancel unbound queued/running
+work with `JOB_AUTHORITY_UNKNOWN` and clear its private parameters/results;
+resubmit needed work through a currently authorized API. The migration never
+infers an owner or promotes old work to operator authority. Public job responses
+omit the private binding; account export includes sanitized attribution only.
+These local controls do not establish real-provider or deployed acceptance.
+
+## Accepted event evidence
+
+Schema30 retains bounded, screened canonical source/client time/environment/
+provenance for new event ingestion. A protected acceptance capsule binds exact
+context and payload bytes, tenant/session/sequence/type/classification and
+server receipt using the active independent journal verification key. Compiler
+input and result application reverify it; the original core event hash/wire is
+unchanged. Unconfigured context is explicit unattested evidence. Retain all
+verification keys needed by surviving events and recovery points.
+
+Ordinary protected upgrade with existing schema29 events refuses. It needs an
+explicit trusted-library transition bound to an externally reviewed exact
+missing-row baseline and current independent head; there is no automatic CLI,
+environment or SQL approval. Historical context staysNULL and its signed marker
+witnesses only observed absence. Restore never creates that approval and verifies
+retained capsules before publication. Do not strip evidence or downgrade the
+schema marker for rollback. The source checkout's
+`docs/implementation/PRIVACY_OPERATORS.md` documents the operating gate.
+
+Acceptance is not session closure, causal completeness, permission or event
+retirement. Finite events/audit/billing/snapshot retention remains refused;
+new release, real historical baseline/custody and final operating/deployed
+acceptance remain separate gates.
+
+## License
+
+Business Source License 1.1 — see the `LICENSE` file shipped with this
+package. Free for internal production use in your own infrastructure;
+converts to Apache-2.0 on the Change Date stated in the license.

agentevo_cloud-0.2.8/README.md

@@ -0,0 +1,133 @@
+# agentevo-cloud
+
+Agentevo SaaS planes: control API (TZ-3: auth, tenants, metering, sync) and
+managed intelligence API (TZ-4: tenant-scoped recall, async verify/compile jobs,
+analytics), plus the `agentevo-cloud` operator CLI (`provision`, `serve`,
+`jobs`, `webhooks`, `health`, `export`, `backup`, `privacy`).
+
+```sh
+python3 -m venv .venv  # Python 3.10+
+.venv/bin/pip install agentevo-cloud
+.venv/bin/agentevo-cloud provision --tenant t-1 --name demo --user u-1 --workspace main
+.venv/bin/agentevo-cloud serve
+```
+
+A virtualenv keeps `pip` off the system Python, which macOS Homebrew and
+Debian/Ubuntu refuse to modify (PEP 668).
+
+Part of [Agentevo](https://agentevo.sh).
+
+## Encrypted runtime release
+
+Cloud **0.2.8** is the pending source version for authenticated accepted event
+context, reviewed legacy transitions and the existing encrypted storage,
+provider and backup controls. Verified 0.2.7 artifacts and consumer seal remain
+preserved; 0.2.8 is not built/sealed/cold-installed yet. A local passing test alone
+does not establish publication, deployment or complete operating acceptance.
+
+The optional `encrypted` extra pins `sqlcipher3==0.6.3`. For source development,
+install it with `uv sync --frozen --package agentevo-cloud --extra encrypted`.
+After final publication, the package selection is
+`agentevo-cloud[encrypted]==0.2.8`; use the approved hashed, wheel-only consumer
+lock for a hosted image. Installation alone does not activate encryption.
+
+Select `AGENTEVO_DB_STORAGE=sqlcipher-v1`, an explicit public
+`AGENTEVO_DB_KEY_ID` and `AGENTEVO_DB_KEY_FILE` for every API, worker and
+operator process using the same database. The key file must contain exactly
+32 raw bytes, be owned by that runtime user with mode 0600, and be mounted from
+independently recoverable protected storage. No default key is supplied.
+Missing runtime, missing/wrong keys or a plaintext database in the encrypted
+profile are refused; the profile never falls back to plain SQLite. The default
+`plain` profile exists for legacy compatibility and does not encrypt live rows.
+
+Existing plaintext needs a separately verified new-file conversion; selecting
+the profile does not convert it. Preserve older plaintext recovery points
+under their reviewed retention policy, and keep the correct old database keys
+and independent archive/journal authority for encrypted recovery points.
+Native application and operator paths have local acceptance evidence. Linux
+image execution and independent operating custody remain separate gates. The
+source checkout contains the detailed design and conversion procedure in
+`docs/implementation/LIVE_DATABASE_ENCRYPTION.md`; public setup is at
+[Agentevo setup](https://agentevo.sh/#setup).
+
+## Private recovery controls
+
+Encrypted online snapshots support verified filesystem publication and
+recovery into a new private database. Recovery requires independent keys, the
+authenticated erasure journal, its independently trusted latest head and a
+current approved retention policy. The selected `sqlcipher-v1` profile encrypts
+live database storage; the legacy `plain` profile leaves searchable rows
+readable in copied databases. Archive encryption does not establish live-data
+encryption or off-host custody. Protected application backups require their own
+archive key with different material from the online database key. Legacy gzip
+restore refuses encrypted or privacy-protected databases; use the authenticated
+operator recovery path with current independently retained authority instead.
+
+Optional `AGENTEVO_ERASURE_JOURNAL` and `AGENTEVO_ERASURE_KEY_FILE` configure the
+same authority for API, workers and operator commands. Protected databases refuse
+missing authority. Recorded erasures, revocations, consent and retention decisions
+are reconciled before restored data is used. Permission increases require a
+postcommit confirmation; uncertain decisions remain unavailable until explicit
+private operator resolution. `privacy authority-status`, `authority-resolve`,
+`authority-reject` and `reconcile` support that procedure without journal editing.
+
+Protected restore requires the source's protection marker and authenticated
+applied/minimum journal heads to exist already. Historical snapshots from before
+activation are refused; a new empty journal cannot prove earlier revocations.
+Review a current baseline before activation and preserve independently current
+authority. The guard cannot reconstruct unrecorded historical decisions.
+
+`privacy retention` defaults to a read-only approved-policy preview. Apply needs
+an explicitly activated matching policy and a fresh matching preview seal.
+Use `agentevo-cloud backup --help` and `agentevo-cloud privacy --help` for exact
+arguments. Keep previous artifacts, archive keys and journal verification keys
+for every retained recovery point. Unrecorded decisions before activation need a
+reviewed transition; real operating recovery remains a separate acceptance gate.
+
+## Queued job authorization
+
+Schema 29 records private accepted submitter authority for new asynchronous jobs.
+Workers recheck credential ancestry, membership and the required workspace and
+operation grants before claim and result application. Clerk work also checks the
+accepted public signing key, original expiry, exact current account link and
+fresh configured provider/session status. Provider outages defer work without
+applying a private result; withdrawn authority cancels it. Provider reads occur
+outside database/privacy fences. Session-event compilation needs a tenant-wide
+grant because its input events have no workspace attribution.
+
+Existing jobs keep an unknown submitter. Workers cancel unbound queued/running
+work with `JOB_AUTHORITY_UNKNOWN` and clear its private parameters/results;
+resubmit needed work through a currently authorized API. The migration never
+infers an owner or promotes old work to operator authority. Public job responses
+omit the private binding; account export includes sanitized attribution only.
+These local controls do not establish real-provider or deployed acceptance.
+
+## Accepted event evidence
+
+Schema30 retains bounded, screened canonical source/client time/environment/
+provenance for new event ingestion. A protected acceptance capsule binds exact
+context and payload bytes, tenant/session/sequence/type/classification and
+server receipt using the active independent journal verification key. Compiler
+input and result application reverify it; the original core event hash/wire is
+unchanged. Unconfigured context is explicit unattested evidence. Retain all
+verification keys needed by surviving events and recovery points.
+
+Ordinary protected upgrade with existing schema29 events refuses. It needs an
+explicit trusted-library transition bound to an externally reviewed exact
+missing-row baseline and current independent head; there is no automatic CLI,
+environment or SQL approval. Historical context staysNULL and its signed marker
+witnesses only observed absence. Restore never creates that approval and verifies
+retained capsules before publication. Do not strip evidence or downgrade the
+schema marker for rollback. The source checkout's
+`docs/implementation/PRIVACY_OPERATORS.md` documents the operating gate.
+
+Acceptance is not session closure, causal completeness, permission or event
+retirement. Finite events/audit/billing/snapshot retention remains refused;
+new release, real historical baseline/custody and final operating/deployed
+acceptance remain separate gates.
+
+## License
+
+Business Source License 1.1 — see the `LICENSE` file shipped with this
+package. Free for internal production use in your own infrastructure;
+converts to Apache-2.0 on the Change Date stated in the license.