cf-bootstrap-orchestrator 0.1.8__py3-none-any.whl

cf_bootstrap_orchestrator/__init__.py

@@ -0,0 +1,11 @@
+"""Standard-library-only profile installation orchestration boundary."""
+
+from pathlib import Path
+
+PACKAGE_DISTRIBUTION = "cf-bootstrap-orchestrator"
+PACKAGE_VERSION = "0.1.8"
+__version__ = PACKAGE_VERSION
+
+
+def semantic_files() -> tuple[Path, ...]:
+    return (Path(__file__).resolve().parent / "semantics" / "package.trig",)

cf_bootstrap_orchestrator/cli.py

@@ -0,0 +1,51 @@
+"""JSON-lines process entry point for the installation orchestrator."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+
+from .model import OrchestrationError, PROTOCOL, canonical, validate_result
+from .orchestrator import run
+
+
+def _response(identifier: object, **body: object) -> dict[str, object]:
+    return {"jsonrpc": "2.0", "protocol": PROTOCOL, "id": identifier, **body}
+
+
+def handle(value: object) -> dict[str, object]:
+    identifier = value.get("id") if isinstance(value, dict) else None
+    try:
+        if not isinstance(value, dict) or set(value) != {"jsonrpc", "protocol", "id", "method", "params"} or value.get("jsonrpc") != "2.0" or value.get("protocol") != PROTOCOL or value.get("method") != "installation/run" or not isinstance(value.get("id"), (str, int)) or isinstance(value.get("id"), bool):
+            raise OrchestrationError("INVALID_ENVELOPE", "orchestrator request envelope is invalid")
+        params = value["params"]
+        result = run(params)
+        bootstrap = params.get("bootstrap_request") if isinstance(params, dict) else None
+        profile = bootstrap.get("profile") if isinstance(bootstrap, dict) else None
+        if not isinstance(profile, str):
+            raise OrchestrationError("SCHEMA_INVALID", "orchestration profile is invalid")
+        return _response(identifier, result=validate_result(result, params))
+    except OrchestrationError as error:
+        return _response(identifier, error={"code": error.code, "message": str(error)})
+    except Exception:
+        if os.environ.get("CF_BOOTSTRAP_ORCHESTRATOR_DEBUG") == "1":
+            raise
+        return _response(identifier, error={"code": "INTERNAL_ERROR", "message": "install orchestration failed"})
+
+
+def main() -> int:
+    for line in sys.stdin:
+        try:
+            value = json.loads(line)
+        except json.JSONDecodeError:
+            response = _response(None, error={"code": "MALFORMED_JSON", "message": "request must be valid JSON"})
+        else:
+            response = handle(value)
+        sys.stdout.buffer.write(canonical(response))
+        sys.stdout.buffer.flush()
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

cf_bootstrap_orchestrator/discovery.py

@@ -0,0 +1,74 @@
+"""Metadata-only discovery for lower-level provider console scripts."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from importlib import metadata
+from pathlib import Path
+import re
+import sys
+
+
+class DiscoveryError(RuntimeError):
+    pass
+
+
+@dataclass(frozen=True)
+class Script:
+    name: str
+    distribution: str
+    target: str
+
+
+_SAFE = re.compile(r"[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?\Z")
+
+
+def _dist(entry: object) -> str:
+    value = getattr(getattr(entry, "dist", None), "metadata", {}).get("Name")
+    if not isinstance(value, str) or not value:
+        raise DiscoveryError("provider metadata has no distribution name")
+    return value
+
+
+def _entries(group: str) -> list[object]:
+    return [entry for dist in metadata.distributions() for entry in dist.entry_points if entry.group == group]
+
+
+def discover(group: str, name: str | None = None) -> tuple[Script, ...]:
+    custom = [item for item in _entries(group) if name is None or item.name == name]
+    console = _entries("console_scripts")
+    result: list[Script] = []
+    seen: set[str] = set()
+    for entry in custom:
+        if not isinstance(entry.name, str) or not _SAFE.fullmatch(entry.name) or entry.name in seen:
+            raise DiscoveryError("provider metadata contains an unsafe or duplicate name")
+        distribution = _dist(entry)
+        matches = [item for item in console if _dist(item) == distribution and item.value == entry.value]
+        if len(matches) != 1:
+            raise DiscoveryError("provider metadata has no unique matching console script")
+        result.append(Script(matches[0].name, distribution, entry.value))
+        seen.add(entry.name)
+    return tuple(sorted(result, key=lambda item: (item.name, item.distribution)))
+
+
+def one(group: str, name: str | None = None) -> Script:
+    values = discover(group, name)
+    if len(values) != 1:
+        raise DiscoveryError("exactly one provider is required")
+    return values[0]
+
+
+def executable(script: Script, scripts: Path | None = None) -> Path:
+    directory = (scripts or Path(sys.executable).parent).resolve()
+    candidates = [directory / script.name]
+    if sys.platform == "win32":
+        candidates.insert(0, directory / f"{script.name}.exe")
+    for candidate in candidates:
+        if candidate.is_file() and not candidate.is_symlink():
+            resolved = candidate.resolve()
+            try:
+                resolved.relative_to(directory)
+            except ValueError as error:
+                raise DiscoveryError("provider executable escaped Scripts") from error
+            return resolved
+    raise DiscoveryError("provider executable is not adjacent to the active interpreter")

cf_bootstrap_orchestrator/model.py

@@ -0,0 +1,261 @@
+"""Strict public orchestration request and result validation."""
+
+from __future__ import annotations
+
+import hashlib
+import importlib.resources
+import json
+import sys
+from pathlib import Path
+import re
+from typing import Any
+
+REQUEST_SCHEMA = "cf.bootstrap.install-orchestration.request.v1"
+PROTOCOL = "cf.bootstrap.install-orchestrator.v1"
+RESULT_SCHEMA = "cogniflow.install.result.v3"
+_IRI = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*:[^\s]+\Z")
+_DIGEST = re.compile(r"sha256:[0-9a-f]{64}\Z")
+
+
+class OrchestrationError(ValueError):
+    def __init__(self, code: str, message: str):
+        super().__init__(message)
+        self.code = code
+
+
+def canonical(value: object) -> bytes:
+    return (json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
+
+
+def digest(value: object) -> str:
+    return "sha256:" + hashlib.sha256(canonical(value)).hexdigest()
+
+
+def _path(value: object, label: str) -> str:
+    if not isinstance(value, str) or not value or value != value.strip() or "\x00" in value:
+        raise OrchestrationError("SCHEMA_INVALID", f"{label} is invalid")
+    path = Path(value)
+    if not path.is_absolute() or path == Path(path.anchor) or ".." in path.parts:
+        raise OrchestrationError("SCHEMA_INVALID", f"{label} must be an absolute non-root path")
+    return str(path)
+
+
+def _under(left: str, right: str) -> bool:
+    try:
+        Path(left).resolve(strict=False).relative_to(Path(right).resolve(strict=False))
+        return True
+    except ValueError:
+        return False
+
+
+def _normal(name: object) -> str:
+    return re.sub(r"[-_.]+", "-", str(name)).lower()
+
+
+def _pypi_resolution_digest(resolver: dict[str, Any], environment: dict[str, Any], artifacts: list[dict[str, Any]]) -> str:
+    selected = [{key: item[key] for key in ("distribution", "normalized_distribution", "version", "filename", "sha256", "requested")} for item in sorted(artifacts, key=lambda item: (item["normalized_distribution"], item["version"], item["filename"]))]
+    value = {"pip_report_version": resolver["pip_report_version"], "pip_version": resolver["pip_version"], "environment": environment, "artifacts": selected}
+    raw = json.dumps(value, sort_keys=True, separators=(",", ":")).encode()
+    return "sha256:" + hashlib.sha256(raw).hexdigest()
+
+
+def validate_request(value: object) -> dict[str, Any]:
+    if not isinstance(value, dict) or value.get("schema") != REQUEST_SCHEMA:
+        raise OrchestrationError("SCHEMA_INVALID", "orchestration request fields are invalid")
+    bootstrap = value.get("bootstrap_request")
+    bootstrap_fields = {"schema", "instance_id", "installation_root", "cogniflow_home", "artifact_source", "profile"}
+    if not isinstance(bootstrap, dict) or set(bootstrap) != bootstrap_fields or bootstrap.get("schema") != "cf.bootstrap.request.v2":
+        raise OrchestrationError("SCHEMA_INVALID", "v2 bootstrap request is invalid")
+    profile = bootstrap.get("profile")
+    if not isinstance(profile, str) or not _IRI.fullmatch(profile):
+        raise OrchestrationError("SCHEMA_INVALID", "profile must be an explicit absolute IRI")
+    instance_id = bootstrap.get("instance_id")
+    if not isinstance(instance_id, str) or not re.fullmatch(r"[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?\Z", instance_id) or len(instance_id) > 64:
+        raise OrchestrationError("SCHEMA_INVALID", "instance_id is invalid")
+    paths = {key: _path(bootstrap[key], key) for key in ("installation_root", "cogniflow_home")}
+    paths["artifact_output_root"] = _path(value.get("artifact_output_root"), "artifact_output_root")
+    source = bootstrap["artifact_source"]
+    mode = source.get("mode") if isinstance(source, dict) else None
+    if mode == "local-repository":
+        fields = {"schema", "bootstrap_request", "artifact_output_root", "external_wheelhouse_path"}
+        if set(value) != fields or set(source) != {"mode", "checkout_path"}:
+            raise OrchestrationError("SCHEMA_INVALID", "local-repository fields are invalid")
+        paths["checkout_path"] = _path(source["checkout_path"], "checkout_path")
+        paths["external_wheelhouse_path"] = _path(value["external_wheelhouse_path"], "external_wheelhouse_path")
+        protected = ("installation_root", "cogniflow_home", "checkout_path")
+        for key in ("artifact_output_root", "external_wheelhouse_path"):
+            if any(_under(paths[key], paths[other]) or _under(paths[other], paths[key]) for other in protected):
+                raise OrchestrationError("ROOT_INVALID", f"{key} overlaps a protected root")
+        if _under(paths["artifact_output_root"], paths["external_wheelhouse_path"]) or _under(paths["external_wheelhouse_path"], paths["artifact_output_root"]):
+            raise OrchestrationError("ROOT_INVALID", "artifact output and external wheelhouse must be disjoint")
+    elif mode == "pypi":
+        fields = {"schema", "bootstrap_request", "artifact_output_root", "index_url"}
+        if set(value) != fields or set(source) != {"mode", "package", "version"}:
+            raise OrchestrationError("SCHEMA_INVALID", "pypi fields are invalid")
+        if not isinstance(source["package"], str) or not re.fullmatch(r"[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?\Z", source["package"]):
+            raise OrchestrationError("SCHEMA_INVALID", "pypi package is invalid")
+        if not isinstance(source["version"], str) or not re.fullmatch(r"[0-9]+(?:\.[0-9]+){0,2}(?:[-+][A-Za-z0-9.-]+)?\Z", source["version"]):
+            raise OrchestrationError("SCHEMA_INVALID", "pypi version is invalid")
+        if value["index_url"] != "https://pypi.org/simple":
+            raise OrchestrationError("SCHEMA_INVALID", "pypi index must be the public index")
+        if any(_under(paths["artifact_output_root"], paths[key]) or _under(paths[key], paths["artifact_output_root"]) for key in ("installation_root", "cogniflow_home")):
+            raise OrchestrationError("ROOT_INVALID", "artifact output overlaps a protected root")
+    else:
+        raise OrchestrationError("PROFILED_SOURCE_UNAVAILABLE", "artifact source mode is unsupported")
+    if paths["installation_root"] == paths["cogniflow_home"] or _under(paths["installation_root"], paths["cogniflow_home"]) or _under(paths["cogniflow_home"], paths["installation_root"]):
+        raise OrchestrationError("ROOT_INVALID", "installation root and Cogniflow home must be disjoint")
+    return value
+
+
+def validate_result(value: object, request: object) -> dict[str, Any]:
+    request = validate_request(request)
+    bootstrap = request["bootstrap_request"]
+    profile = bootstrap["profile"]
+    fields = {"schema", "status", "profile", "selection_digest", "plan", "artifact_resolution", "post_handoff_resolution", "instance", "handoff", "profile_installation"}
+    if not isinstance(value, dict) or set(value) != fields or value.get("schema") != RESULT_SCHEMA or value.get("status") not in {"ready", "unchanged"} or value.get("profile") != profile or not isinstance(value.get("selection_digest"), str) or not _DIGEST.fullmatch(value["selection_digest"]):
+        raise OrchestrationError("RESULT_INVALID", "orchestrator result is invalid")
+    plan = value["plan"]
+    plan_fields = {"schema", "instance_id", "installation_root", "cogniflow_home", "artifact_source", "profile", "stages"}
+    if (not isinstance(plan, dict) or set(plan) != plan_fields or plan.get("schema") != "cf.bootstrap.plan.v2"
+            or any(plan.get(key) != bootstrap.get(key) for key in ("instance_id", "installation_root", "cogniflow_home", "artifact_source", "profile"))):
+        raise OrchestrationError("RESULT_INVALID", "result plan is not bound to the submitted request")
+    resolution = value["artifact_resolution"]
+    post_resolution = value["post_handoff_resolution"]
+    if not isinstance(resolution, dict) or not isinstance(resolution.get("artifact_set"), dict) or not isinstance(post_resolution, dict) or not isinstance(post_resolution.get("artifact_set"), dict):
+        raise OrchestrationError("RESULT_INVALID", "result resolution is invalid")
+    artifact_set = resolution["artifact_set"]
+    post_set = post_resolution["artifact_set"]
+    mode = plan["artifact_source"].get("mode")
+    try:
+        release_bytes = importlib.resources.files("cogniflow").joinpath("release-profile.json").read_bytes()
+        release_profile = json.loads(release_bytes)
+    except (OSError, ValueError, json.JSONDecodeError) as error:
+        raise OrchestrationError("RESULT_INVALID", "authoritative release profile is unavailable") from error
+    release_distributions = release_profile.get("distributions") if isinstance(release_profile, dict) else None
+    if not isinstance(release_distributions, list):
+        raise OrchestrationError("RESULT_INVALID", "release distribution authority is invalid")
+    expected_first_party = {_normal(item.get("name")): str(item.get("version")) for item in release_distributions if isinstance(item, dict)}
+    if len(expected_first_party) != len(release_distributions):
+        raise OrchestrationError("RESULT_INVALID", "release distribution authority is ambiguous")
+    if mode == "local-repository":
+        if (resolution.get("schema") != "cf.bootstrap.local-artifact-resolution.v2" or resolution.get("wheelhouse_path") != request["artifact_output_root"]
+                or artifact_set.get("schema") != "cf.bootstrap.artifact-set.v2" or artifact_set.get("profile") != profile
+                or artifact_set.get("plan_digest") != digest(plan) or artifact_set.get("selection_digest") != value["selection_digest"]
+                or post_set.get("plan_digest") != digest(plan) or post_set.get("profile") != profile):
+            raise OrchestrationError("RESULT_INVALID", "result local selection binding is invalid")
+    elif mode == "pypi":
+        source = plan["artifact_source"]
+        root = artifact_set.get("root_requirement")
+        resolver = artifact_set.get("resolver")
+        environment = artifact_set.get("target_environment")
+        artifacts = artifact_set.get("artifacts")
+        artifact_set_fields = {"schema", "source_mode", "root_requirement", "resolver", "target_environment", "resolution_digest", "lock_sha256", "artifacts"}
+        artifact_fields = {"distribution", "normalized_distribution", "version", "filename", "sha256", "size_bytes", "requested"}
+        environment_fields = {"implementation_name", "implementation_version", "os_name", "platform_machine", "platform_system", "python_full_version", "python_version", "platform_python_implementation", "sys_platform"}
+        if (set(resolution) != {"schema", "wheelhouse_path", "artifact_set", "lock_filename"} or resolution.get("schema") != "cf.bootstrap.pypi-artifact-resolution.v1"
+                or resolution.get("wheelhouse_path") != request["artifact_output_root"] or resolution.get("lock_filename") != "requirements.lock"
+                or set(artifact_set) != artifact_set_fields or artifact_set.get("schema") != "cf.bootstrap.pypi-artifact-set.v1" or artifact_set.get("source_mode") != "pypi"
+                or not isinstance(root, dict) or set(root) != {"distribution", "normalized_distribution", "version"}
+                or root.get("distribution") != source.get("package") or root.get("version") != source.get("version") or root.get("normalized_distribution") != _normal(source.get("package"))
+                or not isinstance(resolver, dict) or set(resolver) != {"pip_report_version", "pip_version"} or resolver.get("pip_report_version") != "1" or not isinstance(resolver.get("pip_version"), str) or not resolver["pip_version"]
+                or not isinstance(environment, dict) or set(environment) != environment_fields or any(not isinstance(item, str) or not item for item in environment.values())
+                or not isinstance(artifact_set.get("resolution_digest"), str) or not _DIGEST.fullmatch(artifact_set["resolution_digest"])
+                or not isinstance(artifact_set.get("lock_sha256"), str) or not re.fullmatch(r"[0-9a-f]{64}", artifact_set["lock_sha256"])
+                or not isinstance(artifacts, list) or not artifacts or any(not isinstance(item, dict) or set(item) != artifact_fields for item in artifacts)):
+            raise OrchestrationError("RESULT_INVALID", "result PyPI selection binding is invalid")
+        normalized: set[str] = set()
+        filenames: set[str] = set()
+        requested: list[dict[str, Any]] = []
+        for item in artifacts:
+            filename = item["filename"]
+            wheel = filename[:-4].split("-") if isinstance(filename, str) and filename.endswith(".whl") else []
+            name = _normal(item["distribution"])
+            if (not isinstance(item["distribution"], str) or not item["distribution"] or item["normalized_distribution"] != name
+                    or not isinstance(item["version"], str) or not item["version"] or len(wheel) < 5 or _normal(wheel[0]) != name or wheel[1] != item["version"]
+                    or Path(filename).name != filename or filename in filenames or name in normalized
+                    or not re.fullmatch(r"[0-9a-f]{64}", str(item["sha256"])) or type(item["size_bytes"]) is not int or item["size_bytes"] <= 0 or type(item["requested"]) is not bool):
+                raise OrchestrationError("RESULT_INVALID", "result PyPI artifact identity is invalid")
+            normalized.add(name)
+            filenames.add(filename)
+            if item["requested"]:
+                requested.append(item)
+        if (len(requested) != 1 or requested[0]["normalized_distribution"] != root["normalized_distribution"] or requested[0]["version"] != root["version"]
+                or artifact_set["resolution_digest"] != _pypi_resolution_digest(resolver, environment, artifacts)
+                or value["selection_digest"] != digest(artifact_set) or post_resolution != resolution):
+            raise OrchestrationError("RESULT_INVALID", "result PyPI selection binding is invalid")
+        artifact_first_party = {name: str(item["version"]) for name, item in ((_normal(item["distribution"]), item) for item in artifacts) if name.startswith(("cf-", "cogniflow"))}
+        if artifact_first_party != expected_first_party:
+            raise OrchestrationError("RESULT_INVALID", "public artifact closure differs from the release profile")
+    else:
+        raise OrchestrationError("RESULT_INVALID", "result source mode is invalid")
+    instance = value["instance"]
+    root_path = Path(plan["installation_root"]).resolve()
+    expected_python = root_path / "environment" / ("Scripts/python.exe" if sys.platform == "win32" else "bin/python")
+    instance_fields = {"schema", "status", "marker", "installation_root", "environment_root", "python_executable", "installed_distributions", "profile", "selection_digest"}
+    expected_instance_schema = "cf.bootstrap.instance-apply.result.v1" if mode == "pypi" else "cf.bootstrap.instance-apply.result.v2"
+    if (not isinstance(instance, dict) or set(instance) != instance_fields or instance.get("schema") != expected_instance_schema or instance.get("status") not in {"ready", "unchanged"} or instance.get("profile") != profile
+            or instance.get("marker") != str(root_path / ".cogniflow-instance.json") or instance.get("installation_root") != str(root_path) or instance.get("environment_root") != str(root_path / "environment")
+            or instance.get("python_executable") != str(expected_python) or instance.get("selection_digest") != value["selection_digest"]
+            or not isinstance(instance.get("installed_distributions"), list)):
+        raise OrchestrationError("RESULT_INVALID", "result instance binding is invalid")
+    installed: dict[str, str] = {}
+    for item in instance["installed_distributions"]:
+        if not isinstance(item, dict) or set(item) != {"name", "version"} or not isinstance(item["name"], str) or not isinstance(item["version"], str) or _normal(item["name"]) in installed:
+            raise OrchestrationError("RESULT_INVALID", "result installed inventory is invalid")
+        installed[_normal(item["name"])] = item["version"]
+    if mode == "pypi":
+        installed_first_party = {name: version for name, version in installed.items() if name.startswith(("cf-", "cogniflow"))}
+        accepted = {_normal(item["distribution"]): str(item["version"]) for item in artifact_set["artifacts"]}
+        if installed_first_party != expected_first_party or any(installed.get(name) != version for name, version in accepted.items()):
+            raise OrchestrationError("RESULT_INVALID", "result installed inventory differs from the accepted public closure")
+    handoff = value["handoff"]
+    receipt = handoff.get("handoff_receipt") if isinstance(handoff, dict) else None
+    if (not isinstance(handoff, dict) or set(handoff) != {"schema", "status", "handoff_receipt"} or handoff.get("schema") != "cf.bootstrap.service-handoff.result.v2" or handoff.get("status") != "accepted" or not isinstance(receipt, dict)
+            or receipt.get("instance_id") != plan["instance_id"] or receipt.get("profile") != profile or receipt.get("installation_root") != str(root_path)
+            or receipt.get("target_python") != str(expected_python) or receipt.get("cogniflow_home") != str(Path(plan["cogniflow_home"]).resolve())
+            or receipt.get("plan_digest") != digest(plan) or receipt.get("bootstrap_host_artifact_set_digest") != digest(artifact_set)
+            or receipt.get("bootstrap_selection_digest") != value["selection_digest"] or receipt.get("post_handoff_artifact_set_digest") != digest(post_set)
+            or receipt.get("record_digest") != digest({key: item for key, item in receipt.items() if key != "record_digest"})
+            or (mode == "pypi" and (set(receipt) != {"schema", "instance_id", "installation_root", "target_python", "cogniflow_home", "artifact_source", "plan_digest", "bootstrap_host_artifact_set_digest", "profile", "bootstrap_selection_digest", "post_handoff_artifact_root", "post_handoff_artifact_set_digest", "post_handoff_selection_digest", "post_handoff_profile_digest", "post_handoff_catalog_digest", "post_handoff_repository_source_digest", "post_handoff_index_digest", "record_digest"}
+                or receipt.get("schema") != "cf.bootstrap.accepted-handoff.v3" or receipt.get("artifact_source") != plan["artifact_source"] or receipt.get("post_handoff_artifact_root") != str(Path(resolution["wheelhouse_path"]).resolve())
+                or receipt.get("post_handoff_selection_digest") != digest(post_set) or receipt.get("post_handoff_profile_digest") != digest(artifact_set) or receipt.get("post_handoff_catalog_digest") != digest(artifact_set)
+                or receipt.get("post_handoff_repository_source_digest") != digest(plan["artifact_source"]) or receipt.get("post_handoff_index_digest") != digest("https://pypi.org/simple") or "checkout_path" in receipt))
+            or (mode == "local-repository" and receipt.get("checkout_path") != plan["artifact_source"]["checkout_path"])):
+        raise OrchestrationError("RESULT_INVALID", "result handoff binding is invalid")
+    installation = value["profile_installation"]
+    if (not isinstance(installation, dict) or set(installation) != {"schema", "profile", "instance_id", "target_python", "plan_digest", "selection_digest", "release_profile_digest", "managed_tools", "preview", "installation"}
+            or installation.get("schema") != "cogniflow.profile-installation.result.v1" or installation.get("profile") != profile
+            or installation.get("instance_id") != plan["instance_id"] or installation.get("target_python") != str(expected_python)
+            or installation.get("plan_digest") != digest(plan) or installation.get("selection_digest") != value["selection_digest"] or not isinstance(installation.get("managed_tools"), dict)):
+        raise OrchestrationError("RESULT_INVALID", "profile installation binding is invalid")
+    if mode == "pypi":
+        service_fields = {"schema", "status", "profile", "selection_digest", "comparison", "artifact_set", "semantic_changes"}
+        desired = [{"name": str(item["distribution"]), "version": str(item["version"])} for item in artifact_set["artifacts"]]
+        for name, result, status in (("preview", installation["preview"], "preview"), ("installation", installation["installation"], "unchanged")):
+            comparison = result.get("comparison") if isinstance(result, dict) else None
+            if (not isinstance(result, dict) or set(result) != service_fields or result.get("schema") != "cf.installation-profile.result.v1" or result.get("status") != status
+                    or result.get("profile") != profile or result.get("selection_digest") != value["selection_digest"] or result.get("artifact_set") != artifact_set
+                    or not isinstance(comparison, dict) or comparison.get("desired") != desired or comparison.get("installed") != instance["installed_distributions"] or comparison.get("host") != instance["installed_distributions"]
+                    or comparison.get("added") != [] or comparison.get("changed") != [] or comparison.get("removed") != [] or comparison.get("unchanged") is not True):
+                raise OrchestrationError("RESULT_INVALID", f"profile installation {name} is not bound to the public closure")
+    if installation["release_profile_digest"] != "sha256:" + hashlib.sha256(release_bytes).hexdigest():
+        raise OrchestrationError("RESULT_INVALID", "profile installation release authority is invalid")
+    records = release_profile.get("managed_tools") if isinstance(release_profile, dict) else None
+    if not isinstance(records, list):
+        raise OrchestrationError("RESULT_INVALID", "managed-tool release authority is invalid")
+    platform_name = "windows" if sys.platform == "win32" else "linux"
+    selected = {item.get("name"): item for item in records if isinstance(item, dict)}
+    expected_release = {"java": selected.get(f"java-{platform_name}-x86_64"), "fuseki": selected.get("fuseki")}
+    managed = installation["managed_tools"]
+    if set(managed) != {"schema", "status", "java", "fuseki"} or managed.get("schema") != "cf.runtime.managed-tools.result.v1" or managed.get("status") not in {"ready", "unchanged"}:
+        raise OrchestrationError("RESULT_INVALID", "managed-tool evidence is invalid")
+    for name in ("java", "fuseki"):
+        evidence = managed[name]
+        authority = expected_release[name]
+        path_key = "executable" if name == "java" else "server_artifact"
+        expected_record = None if not isinstance(authority, dict) else {"name": name, "version": authority.get("version"), "platform": platform_name if name == "java" else "any", "architecture": "x86_64", "archive_format": "zip" if name == "fuseki" or platform_name == "windows" else "tar.gz", "url": authority.get("url"), "sha256": authority.get("sha256"), "size": authority.get("size")}
+        if (not isinstance(evidence, dict) or set(evidence) != {"version", "home", "artifact_sha256", "lock_record", "lock_digest", path_key}
+                or evidence.get("lock_record") != expected_record or evidence.get("version") != expected_record.get("version")
+                or evidence.get("artifact_sha256") != expected_record.get("sha256") or evidence.get("lock_digest") != digest(expected_record)):
+            raise OrchestrationError("RESULT_INVALID", "managed-tool evidence differs from the release authority")
+    return value

cf_bootstrap_orchestrator/orchestrator.py

@@ -0,0 +1,172 @@
+"""The profile-driven Cogniflow installation sequence."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+
+from .discovery import executable, one
+from .model import OrchestrationError, digest, validate_request
+from .process import call
+
+BOOTSTRAP_GROUP = "cogniflow.bootstrap_providers.v1"
+RESOLVER_GROUP = "cogniflow.artifact_resolvers.v1"
+INSTANCE_GROUP = "cogniflow.instance_providers.v1"
+
+
+def _script(group: str, name: str | None = None) -> Path:
+    return executable(one(group, name))
+
+
+def _plan(request: dict[str, object]) -> dict[str, object]:
+    result = call(_script(BOOTSTRAP_GROUP, "cf-bootstrap-core-provider"), "cf.bootstrap.provider.v1", "bootstrap/plan", request, 30)
+    fields = {"schema", "instance_id", "installation_root", "cogniflow_home", "artifact_source", "profile", "stages"}
+    if set(result) != fields or result.get("schema") != "cf.bootstrap.plan.v2" or result.get("profile") != request.get("profile"):
+        raise OrchestrationError("PLAN_INVALID", "planner returned a non-canonical v2 plan")
+    names = ("validate-inputs", "select-artifact-source", "prepare-installation", "install-artifacts", "verify-installation", "handoff-to-service")
+    stages = result.get("stages")
+    if not isinstance(stages, list) or len(stages) != len(names) or any(not isinstance(stage, dict) or set(stage) != {"name", "ordinal", "handoff"} or stage.get("name") != name or stage.get("ordinal") != index or stage.get("handoff") is not (index == 5) for index, (stage, name) in enumerate(zip(stages, names))):
+        raise OrchestrationError("PLAN_INVALID", "planner returned non-canonical lifecycle stages")
+    return result
+
+
+def _resolve(plan: dict[str, object], output: str, external: str | None = None, *, phase: str = "bootstrap", index_url: str | None = None) -> dict[str, object]:
+    source = plan.get("artifact_source")
+    mode = source.get("mode") if isinstance(source, dict) else None
+    if mode == "pypi":
+        if external is not None or phase != "bootstrap" or index_url != "https://pypi.org/simple":
+            raise OrchestrationError("RESOLUTION_INVALID", "PyPI resolution inputs are invalid")
+        params = {"schema": "cf.bootstrap.pypi-artifact-resolution.request.v1", "bootstrap_plan": plan, "artifact_output_root": output, "index_url": index_url}
+        result = call(_script(RESOLVER_GROUP, "pypi"), "cf.bootstrap.artifact-resolver.v1", "artifacts/resolve", params, 900)
+        required = {"schema", "wheelhouse_path", "artifact_set", "lock_filename"}
+        artifact_set = result.get("artifact_set") if isinstance(result, dict) else None
+        root = artifact_set.get("root_requirement") if isinstance(artifact_set, dict) else None
+        if set(result) != required or result.get("schema") != "cf.bootstrap.pypi-artifact-resolution.v1" or result.get("wheelhouse_path") != output or result.get("lock_filename") != "requirements.lock" or not isinstance(artifact_set, dict) or artifact_set.get("schema") != "cf.bootstrap.pypi-artifact-set.v1" or artifact_set.get("source_mode") != "pypi" or not isinstance(root, dict) or root.get("distribution") != source.get("package") or root.get("version") != source.get("version"):
+            raise OrchestrationError("RESOLUTION_INVALID", "PyPI resolver returned an unbound result")
+        return result
+    if mode != "local-repository" or external is None or index_url is not None:
+        raise OrchestrationError("RESOLUTION_INVALID", "local resolution inputs are invalid")
+    params = {"schema": "cf.bootstrap.artifact-resolution.request.v2", "bootstrap_plan": plan, "artifact_output_root": output, "external_wheelhouse_path": external, "phase": phase}
+    result = call(_script(RESOLVER_GROUP, "local-repository"), "cf.bootstrap.artifact-resolver.v1", "artifacts/resolve", params, 900)
+    required = {"schema", "wheelhouse_path", "artifact_set", "selection", "provider_map", "evidence"}
+    if set(result) != required or result.get("schema") != "cf.bootstrap.local-artifact-resolution.v2" or result.get("wheelhouse_path") != output:
+        raise OrchestrationError("RESOLUTION_INVALID", "resolver returned a non-canonical v2 result")
+    artifact_set = result["artifact_set"]
+    if not isinstance(artifact_set, dict) or artifact_set.get("schema") != "cf.bootstrap.artifact-set.v2" or artifact_set.get("plan_digest") != digest(plan) or artifact_set.get("profile") != plan.get("profile") or artifact_set.get("selection_digest") != digest(result["selection"]):
+        raise OrchestrationError("RESOLUTION_INVALID", "resolver plan/profile/selection bindings are invalid")
+    evidence = result["evidence"]
+    if not isinstance(evidence, dict) or evidence.get("unselected_build_count") != 0 or evidence.get("native_selected") is not False:
+        raise OrchestrationError("RESOLUTION_INVALID", "resolver selected an unsafe artifact set")
+    artifacts = artifact_set.get("artifacts")
+    if not isinstance(artifacts, list) or any(isinstance(item, dict) and item.get("source_kind") == "external-wheelhouse" and str(item.get("normalized_distribution", "")).startswith("cf-") for item in artifacts):
+        raise OrchestrationError("RESOLUTION_INVALID", "resolver returned forbidden external artifacts")
+    return result
+
+
+def _apply(plan: dict[str, object], resolution: dict[str, object]) -> dict[str, object]:
+    pypi = plan["artifact_source"]["mode"] == "pypi"
+    keys = ("schema", "wheelhouse_path", "artifact_set", "lock_filename") if pypi else ("schema", "wheelhouse_path", "artifact_set")
+    params = {"schema": "cf.bootstrap.instance-apply.request.v1" if pypi else "cf.bootstrap.instance-apply.request.v2", "bootstrap_plan": plan, "artifact_resolution": {key: resolution[key] for key in keys}}
+    result = call(_script(INSTANCE_GROUP, "cf-bootstrap-instance-provider"), "cf.bootstrap.instance-provider.v1", "instance/apply", params, 900)
+    base = {"schema", "status", "marker", "installation_root", "environment_root", "python_executable", "installed_distributions"}
+    required = base if pypi else base | {"profile", "selection_digest"}
+    selection_digest = digest(resolution["artifact_set"]) if pypi else resolution["artifact_set"]["selection_digest"]
+    if set(result) != required or result.get("schema") != ("cf.bootstrap.instance-apply.result.v1" if pypi else "cf.bootstrap.instance-apply.result.v2") or result.get("status") not in {"ready", "unchanged"}:
+        raise OrchestrationError("INSTANCE_INVALID", "instance provider returned a non-canonical result")
+    result = {**result, "profile": plan["profile"], "selection_digest": selection_digest}
+    root = Path(str(result["installation_root"])).resolve()
+    environment = Path(str(result["environment_root"])).resolve()
+    python = Path(str(result["python_executable"])).resolve()
+    if root != Path(str(plan["installation_root"])).resolve() or environment != root / "environment" or python != environment / ("Scripts/python.exe" if sys.platform == "win32" else "bin/python"):
+        raise OrchestrationError("INSTANCE_INVALID", "instance provider returned an unbound target")
+    return result
+
+
+def _handoff(plan: dict[str, object], resolution: dict[str, object], instance: dict[str, object], post_handoff: dict[str, object] | None = None) -> dict[str, object]:
+    scripts = Path(str(instance["environment_root"])).resolve() / ("Scripts" if sys.platform == "win32" else "bin")
+    target = scripts / ("cf-bootstrap-instance-handoff.exe" if sys.platform == "win32" else "cf-bootstrap-instance-handoff")
+    if not target.is_file() or target.is_symlink() or target.resolve().parent != scripts.resolve():
+        raise OrchestrationError("HANDOFF_INVALID", "target handoff executable is not confined to the target Scripts directory")
+    artifact_set = resolution["artifact_set"]
+    post = post_handoff or resolution
+    post_set = post["artifact_set"]
+    source = plan["artifact_source"]
+    if source["mode"] == "pypi":
+        selection_digest = digest(artifact_set)
+        binding = {"cogniflow_home": plan["cogniflow_home"], "artifact_source": source, "post_handoff_artifact_root": str(Path(str(post["wheelhouse_path"])).resolve()), "post_handoff_artifact_set_digest": digest(post_set), "post_handoff_selection_digest": digest(post_set)}
+        request = {"schema": "cf.bootstrap.service-handoff.request.v3", "instance_id": plan["instance_id"], "installation_root": instance["installation_root"], "plan_digest": digest(plan), "artifact_set_digest": digest(artifact_set), "profile": plan["profile"], "selection_digest": selection_digest, **binding, "post_handoff_binding_digest": digest(binding)}
+    else:
+        binding = {"cogniflow_home": plan["cogniflow_home"], "checkout_path": source["checkout_path"], "post_handoff_artifact_root": str(Path(str(post["wheelhouse_path"])).resolve()), "post_handoff_artifact_set_digest": digest(post_set), "post_handoff_selection_digest": post_set["selection_digest"], "post_handoff_profile_digest": post_set["profile_digest"], "post_handoff_catalog_digest": post_set["catalog_digest"], "post_handoff_repository_source_digest": post_set["repository_source_digest"], "post_handoff_index_digest": post_set["index_digest"]}
+        request = {"schema": "cf.bootstrap.service-handoff.request.v2", "instance_id": plan["instance_id"], "installation_root": instance["installation_root"], "plan_digest": digest(plan), "artifact_set_digest": digest(artifact_set), "profile": plan["profile"], "profile_digest": artifact_set["profile_digest"], "selection_digest": artifact_set["selection_digest"], **binding, "post_handoff_binding_digest": digest(binding)}
+    try:
+        process = subprocess.Popen([str(target)], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=False)
+        stdout, stderr = process.communicate((json.dumps(request, sort_keys=True, separators=(",", ":")) + "\n").encode(), timeout=120)
+    except (OSError, subprocess.TimeoutExpired) as error:
+        if "process" in locals():
+            process.kill(); process.communicate()
+        raise OrchestrationError("HANDOFF_START_FAILED", "target handoff could not complete") from error
+    finally:
+        if "process" in locals():
+            for stream in (process.stdin, process.stdout, process.stderr):
+                if stream is not None:
+                    stream.close()
+    if process.returncode != 0 or stderr or stdout.count(b"\n") != 1 or not stdout.endswith(b"\n"):
+        raise OrchestrationError("HANDOFF_INVALID", "target handoff process or output was invalid")
+    try:
+        result = json.loads(stdout)
+    except json.JSONDecodeError as error:
+        raise OrchestrationError("HANDOFF_INVALID", "target handoff returned invalid JSON") from error
+    if not isinstance(result, dict) or result.get("schema") != "cf.bootstrap.service-handoff.result.v2" or result.get("status") != "accepted" or not isinstance(result.get("handoff_receipt"), dict):
+        raise OrchestrationError("HANDOFF_INVALID", "target handoff was not accepted")
+    receipt = result["handoff_receipt"]
+    if receipt.get("instance_id") != request["instance_id"] or receipt.get("plan_digest") != request["plan_digest"] or receipt.get("profile") != request["profile"] or receipt.get("installation_root") != request["installation_root"] or receipt.get("bootstrap_host_artifact_set_digest") != request["artifact_set_digest"] or receipt.get("bootstrap_selection_digest") != request["selection_digest"] or receipt.get("post_handoff_artifact_set_digest") != request["post_handoff_artifact_set_digest"] or receipt.get("post_handoff_selection_digest") != request["post_handoff_selection_digest"] or (source["mode"] == "pypi" and (receipt.get("schema") != "cf.bootstrap.accepted-handoff.v3" or receipt.get("artifact_source") != source or "checkout_path" in receipt)) or (source["mode"] == "local-repository" and receipt.get("checkout_path") != source["checkout_path"]):
+        raise OrchestrationError("HANDOFF_INVALID", "persisted accepted handoff is not bound to the request")
+    return result
+
+
+def _install_profile(plan: dict[str, object], instance: dict[str, object], handoff: dict[str, object], selection_digest: str) -> dict[str, object]:
+    service_client = __import__("cf_service_client", fromlist=["ServiceClient"])
+    release_module = __import__("cogniflow.release", fromlist=["load_profile", "profile_bytes"])
+    release = release_module.load_profile()
+    release_profile_digest = "sha256:" + hashlib.sha256(release_module.profile_bytes()).hexdigest()
+    runtime = __import__("cf_runtime", fromlist=["CogniflowHome", "ManagedTools"])
+    managed_module = __import__("cf_runtime.managed_tools", fromlist=["bind_release_lock"])
+    locked = managed_module.bind_release_lock([dict(item) for item in release.tools])
+    managed_tools = runtime.ManagedTools(runtime.CogniflowHome.at(plan["cogniflow_home"]), artifacts=locked).provision("21.0.10+7", "6.0.0")
+    inputs = {"profile": plan["profile"], "target_python": instance["python_executable"], "bootstrap_plan": plan, "handoff_receipt": handoff["handoff_receipt"]}
+    source = plan["artifact_source"]
+    inputs["checkout_path" if source["mode"] == "local-repository" else "artifact_source"] = source["checkout_path"] if source["mode"] == "local-repository" else source
+    client = service_client.ServiceClient.for_runtime("production", home=plan["cogniflow_home"])
+    if source["mode"] == "pypi":
+        preview_capability = "urn:cf:service:PublicPyPIProfileInstallationPreview"
+        install_capability = "urn:cf:service:PublicPyPIProfileInstallation"
+    else:
+        preview_capability = "urn:cf:service:ProfileInstallationPreview"
+        install_capability = "urn:cf:service:ProfileInstallation"
+    preview = client.call_service(preview_capability, inputs=inputs)
+    installation = client.call_service(install_capability, inputs=inputs)
+    if preview.is_error or installation.is_error:
+        raise OrchestrationError("PROFILE_INSTALL_FAILED", "service-driven profile installation failed")
+    return {"schema": "cogniflow.profile-installation.result.v1", "profile": plan["profile"], "instance_id": plan["instance_id"], "target_python": instance["python_executable"], "plan_digest": digest(plan), "selection_digest": selection_digest, "release_profile_digest": release_profile_digest, "managed_tools": managed_tools, "preview": preview.content, "installation": installation.content}
+
+
+def run(value: object) -> dict[str, object]:
+    request = validate_request(value)
+    plan = _plan(request["bootstrap_request"])
+    mode = plan["artifact_source"]["mode"]
+    if mode == "pypi":
+        resolution = _resolve(plan, str(request["artifact_output_root"]), index_url=str(request["index_url"]))
+        post_handoff = resolution
+    else:
+        external = str(request["external_wheelhouse_path"])
+        resolution = _resolve(plan, str(request["artifact_output_root"]), external)
+        output = Path(str(request["artifact_output_root"])).resolve()
+        post_handoff = _resolve(plan, str(output.with_name(output.name + "-post-handoff")), external, phase="post-handoff")
+    instance = _apply(plan, resolution)
+    selection_digest = digest(resolution["artifact_set"]) if mode == "pypi" else resolution["artifact_set"]["selection_digest"]
+    handoff = _handoff(plan, resolution, instance, post_handoff)
+    profile_installation = _install_profile(plan, instance, handoff, selection_digest)
+    return {"schema": "cogniflow.install.result.v3", "status": instance["status"], "profile": plan["profile"], "selection_digest": selection_digest, "plan": plan, "artifact_resolution": resolution, "post_handoff_resolution": post_handoff, "instance": instance, "handoff": handoff, "profile_installation": profile_installation}

cf_bootstrap_orchestrator/process.py

@@ -0,0 +1,66 @@
+"""Bounded JSON-lines subprocess calls used by the orchestrator."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+
+from .model import OrchestrationError, PROTOCOL, canonical
+
+
+def _identifier(value: object) -> str:
+    return "request-" + hashlib.sha256(canonical(value)).hexdigest()
+
+
+def call(executable: Path, protocol: str, method: str, params: dict[str, object], timeout: float) -> dict[str, object]:
+    identifier = _identifier(params)
+    request = {"jsonrpc": "2.0", "protocol": protocol, "id": identifier, "method": method, "params": params}
+    process: subprocess.Popen[bytes] | None = None
+    try:
+        process = subprocess.Popen([str(executable)], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=False)
+        stdout, stderr = process.communicate(canonical(request), timeout=timeout)
+    except subprocess.TimeoutExpired as error:
+        if process is not None:
+            process.kill()
+            process.communicate()
+        raise OrchestrationError("PROCESS_TIMEOUT", "provider process timed out") from error
+    except OSError as error:
+        raise OrchestrationError("PROCESS_START_FAILED", "provider process could not start") from error
+    finally:
+        if process is not None:
+            failures = []
+            for name, stream in (("stdin", process.stdin), ("stdout", process.stdout), ("stderr", process.stderr)):
+                if stream is not None:
+                    try:
+                        stream.close()
+                    except Exception as cleanup_error:
+                        failures.append(f"{name}: {cleanup_error}")
+            if failures:
+                primary = sys.exception()
+                if primary is not None:
+                    primary.add_note("provider pipe cleanup also failed: " + "; ".join(failures))
+                else:
+                    raise OrchestrationError("PROCESS_CLEANUP_FAILED", "; ".join(failures))
+    if process is None or process.returncode != 0 or stderr or stdout.count(b"\n") != 1 or not stdout.endswith(b"\n"):
+        raise OrchestrationError("PROCESS_INVALID", "provider process or output was invalid")
+    try:
+        response = json.loads(stdout)
+    except json.JSONDecodeError as error:
+        raise OrchestrationError("MALFORMED_JSON", "provider returned invalid JSON") from error
+    if not isinstance(response, dict) or set(response) not in ({"jsonrpc", "protocol", "id", "result"}, {"jsonrpc", "protocol", "id", "error"}) or response.get("jsonrpc") != "2.0" or response.get("protocol") != protocol or response.get("id") != identifier:
+        raise OrchestrationError("PROTOCOL_INVALID", "provider response identity was invalid")
+    if "error" in response:
+        error = response["error"]
+        if not isinstance(error, dict) or set(error) - {"code", "message", "details"} or not isinstance(error.get("code"), str) or not isinstance(error.get("message"), str):
+            raise OrchestrationError("PROTOCOL_INVALID", "provider returned an invalid structured error")
+        details = error.get("details")
+        diagnostic = details.get("diagnostic") if isinstance(details, dict) else None
+        message = f"{error['message']}: {diagnostic}" if isinstance(diagnostic, str) and diagnostic else error["message"]
+        raise OrchestrationError(error["code"], message)
+    result = response.get("result")
+    if not isinstance(result, dict):
+        raise OrchestrationError("RESULT_INVALID", "provider result was not an object")
+    return result

cf_bootstrap_orchestrator/semantics/package.trig

@@ -0,0 +1,13 @@
+@prefix cfpkg: <https://cogniflow.odea-project.org/cf#> .
+@prefix contribution: <urn:cf:contribution:> .
+@prefix pkg: <urn:cf:pkg:> .
+@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
+
+pkg:cf_bootstrap_orchestrator {
+  pkg:cf_bootstrap_orchestrator a cfpkg:CfPackage ;
+    cfpkg:hasPackageManifest [ a cfpkg:PackageManifest ; cfpkg:hasDistributionName [ a cfpkg:DistributionName ; rdf:value "cf-bootstrap-orchestrator" ] ; cfpkg:hasPythonPackageName [ a cfpkg:PythonPackageName ; rdf:value "cf_bootstrap_orchestrator" ] ; cfpkg:hasPackageVersion [ a cfpkg:PackageVersion ; rdf:value "0.1.8" ] ; cfpkg:hasImplementationLanguage [ a cfpkg:ImplementationLanguage ; rdf:value "Python" ] ] ;
+    cfpkg:hasPackageRole [ a cfpkg:PackageRole ; rdf:value cfpkg:SpecificationPackageRole ] ;
+    cfpkg:hasPackageContribution contribution:adopted_package ;
+    skos:prefLabel "cf-bootstrap-orchestrator" ; skos:definition "Profile-aware installation orchestration process." .
+}

cf_bootstrap_orchestrator-0.1.8.dist-info/METADATA

@@ -0,0 +1,6 @@
+Metadata-Version: 2.4
+Name: cf-bootstrap-orchestrator
+Version: 0.1.8
+Summary: Profile-aware Cogniflow installation orchestration boundary.
+License: GPL-3
+Requires-Python: >=3.11

cf_bootstrap_orchestrator-0.1.8.dist-info/RECORD

@@ -0,0 +1,11 @@
+cf_bootstrap_orchestrator/__init__.py,sha256=jHsf4pNtiKFJV9G2LVCyXcRosKhnNBDq2JLoB60HMXI,339
+cf_bootstrap_orchestrator/cli.py,sha256=lroqlMI_68nCCOIEQL76DAajZzAkWKugNHXkBTY-yRg,2242
+cf_bootstrap_orchestrator/discovery.py,sha256=qU29J3t-I2luX3JtyfviylTIZAI7RO2amG-cpMEyQuw,2765
+cf_bootstrap_orchestrator/model.py,sha256=X5Q5Vs7jXdRasx2GGbM-29btMp25Xxv12xX2P_CadRo,23626
+cf_bootstrap_orchestrator/orchestrator.py,sha256=lF-rw2mLmkRZ3a6MRmQ0GjqK9D4YjVOj_r4-BhAxdio,15950
+cf_bootstrap_orchestrator/process.py,sha256=Acp1popHNAGsHYg11dkx2XBJehpLs9-EQStCYbGgow4,3643
+cf_bootstrap_orchestrator/semantics/package.trig,sha256=5hsZww9ebkBTCalbtMydt7aaK3_bwTnfm2v6RriH5gE,1045
+cf_bootstrap_orchestrator-0.1.8.dist-info/METADATA,sha256=6D5U9iKX_9zro8gbVmmUJjYMUICeMcCVEDGzdTbnD24,178
+cf_bootstrap_orchestrator-0.1.8.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+cf_bootstrap_orchestrator-0.1.8.dist-info/entry_points.txt,sha256=H8XxWkfRx0_RsiJO4NiegwNC1X4rTNaNUs6D0oR6tkU,281
+cf_bootstrap_orchestrator-0.1.8.dist-info/RECORD,,

cf_bootstrap_orchestrator-0.1.8.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.31.0
+Root-Is-Purelib: true
+Tag: py3-none-any

cf_bootstrap_orchestrator-0.1.8.dist-info/entry_points.txt

@@ -0,0 +1,8 @@
+[console_scripts]
+cf-bootstrap-orchestrator = cf_bootstrap_orchestrator.cli:main
+
+[cogniflow.install_orchestrators.v1]
+cf-bootstrap-orchestrator = cf_bootstrap_orchestrator.cli:main
+
+[cogniflow.semantic_sources]
+cf-bootstrap-orchestrator = cf_bootstrap_orchestrator:semantic_files