cf-bootstrap-source-local 0.1.0__py3-none-any.whl

cf_bootstrap_source_local/__init__.py

@@ -0,0 +1,20 @@
+"""Offline local repository artifact resolution and package semantics."""
+
+from pathlib import Path
+
+PACKAGE_DISTRIBUTION = "cf-bootstrap-source-local"
+PYTHON_PACKAGE = "cf_bootstrap_source_local"
+PACKAGE_VERSION = "0.1.0"
+__version__ = "0.1.0"
+
+
+def package_root() -> Path:
+    return Path(__file__).resolve().parent
+
+
+def semantics_dir() -> Path:
+    return package_root() / "semantics"
+
+
+def semantic_files() -> tuple[Path, ...]:
+    return (semantics_dir() / "package.trig",)

cf_bootstrap_source_local/artifacts.py

@@ -0,0 +1,191 @@
+"""Wheel validation and canonical artifact manifest handling."""
+
+from __future__ import annotations
+
+import base64
+import csv
+import hashlib
+import json
+from pathlib import Path
+import re
+import stat
+from pathlib import PurePosixPath
+
+import zipfile
+
+from .inventory import NativeProject, Project
+from .model import ResolverError, normalize_distribution
+
+
+def _safe_zip_name(name: str) -> bool:
+    if not name or "\\" in name or name.startswith(("/", "//")) or re.match(r"^[A-Za-z]:", name):
+        return False
+    parts = name.split("/")
+    return all(part not in {"", ".", ".."} for part in parts) and str(PurePosixPath(name)) == name
+
+
+def _validate_record(archive: zipfile.ZipFile, names: list[str], record_name: str) -> None:
+    rows = list(csv.reader(archive.read(record_name).decode("utf-8").splitlines()))
+    if any(len(row) != 3 for row in rows) or len({row[0] for row in rows}) != len(rows):
+        raise ResolverError("ARTIFACT_INVALID", "wheel RECORD is malformed")
+    indexed = {row[0]: row for row in rows}
+    if set(indexed) != set(names):
+        raise ResolverError("ARTIFACT_INVALID", "wheel RECORD does not cover wheel contents")
+    for name in names:
+        row = indexed[name]
+        if name == record_name:
+            if row[1] or row[2]:
+                raise ResolverError("ARTIFACT_INVALID", "wheel RECORD self-entry is invalid")
+            continue
+        content = archive.read(name)
+        expected_hash = "sha256=" + base64.urlsafe_b64encode(hashlib.sha256(content).digest()).rstrip(b"=").decode("ascii")
+        if row[1] != expected_hash or row[2] != str(len(content)):
+            raise ResolverError("ARTIFACT_INVALID", "wheel RECORD hash or size is invalid")
+
+
+def validate_wheel(path: Path, project: Project) -> dict[str, object]:
+    if path.suffix != ".whl":
+        raise ResolverError("ARTIFACT_INVALID", "build produced a non-wheel artifact")
+    expected_prefix = f"{project.normalized_name.replace('-', '_')}-{project.version.replace('-', '_')}"
+    if not path.name.startswith(expected_prefix + "-"):
+        raise ResolverError("ARTIFACT_INVALID", "wheel filename does not match source project")
+    raw_wheel = path.read_bytes()
+    end = raw_wheel.rfind(b"PK\x05\x06")
+    if end < 0 or end + 22 > len(raw_wheel) or end + 22 + int.from_bytes(raw_wheel[end + 20:end + 22], "little") != len(raw_wheel):
+        raise ResolverError("ARTIFACT_INVALID", "wheel contains trailing or malformed ZIP data")
+    try:
+        with zipfile.ZipFile(path) as archive:
+            names = archive.namelist()
+            if len(names) != len(set(names)) or any(not _safe_zip_name(name) for name in names):
+                raise ResolverError("ARTIFACT_INVALID", "wheel has unsafe or duplicate entries")
+            dist_infos = [name for name in names if name.endswith(".dist-info/METADATA")]
+            if len(dist_infos) != 1:
+                raise ResolverError("ARTIFACT_INVALID", "wheel must contain one METADATA")
+            prefix = dist_infos[0][:-len("METADATA")]
+            required = {prefix + "WHEEL", prefix + "RECORD"}
+            if not required.issubset(names) or any(name.endswith((".pth", "direct_url.json")) for name in names):
+                raise ResolverError("ARTIFACT_INVALID", "wheel metadata is incomplete or unsafe")
+            _validate_record(archive, names, prefix + "RECORD")
+            metadata = archive.read(dist_infos[0]).decode("utf-8")
+            fields = dict(re.findall(r"^(Name|Version): (.+)$", metadata, re.MULTILINE))
+            if fields.get("Name") is None or fields.get("Version") is None:
+                raise ResolverError("ARTIFACT_INVALID", "wheel metadata lacks name or version")
+            if project.normalized_name != normalize_distribution(fields["Name"]) or fields["Version"] != project.version:
+                raise ResolverError("ARTIFACT_INVALID", "wheel metadata does not match source project")
+            if re.search(r"(?im)^editable(?:-project)?\s*:", metadata) or str(project.path.resolve()) in metadata:
+                raise ResolverError("ARTIFACT_INVALID", "wheel contains editable or checkout metadata")
+    except zipfile.BadZipFile as error:
+        raise ResolverError("ARTIFACT_INVALID", "wheel is not a valid zip archive") from error
+    digest = hashlib.sha256(raw_wheel).hexdigest()
+    return {"distribution": project.name, "normalized_distribution": project.normalized_name, "version": project.version, "filename": path.name, "sha256": digest, "size_bytes": path.stat().st_size, "source_project": project.relative}
+
+
+def validate_native_wheel(path: Path, project: NativeProject) -> dict[str, object]:
+    from .native import _platform
+    _, platform_tag, suffix = _platform()
+    wheel_name = project.normalized_name.replace("-", "_")
+    expected = f"{wheel_name}-{project.version}-py3-none-{platform_tag}.whl"
+    if path.name != expected:
+        raise ResolverError("ARTIFACT_INVALID", "native wheel filename or platform tag is invalid")
+    try:
+        raw_wheel = path.read_bytes()
+        end = raw_wheel.rfind(b"PK\x05\x06")
+        if end < 0 or end + 22 > len(raw_wheel) or end + 22 + int.from_bytes(raw_wheel[end + 20:end + 22], "little") != len(raw_wheel):
+            raise ResolverError("ARTIFACT_INVALID", "wheel contains trailing or malformed ZIP data")
+        with zipfile.ZipFile(path) as archive:
+            names = archive.namelist()
+            dist = f"{wheel_name}-{project.version}.dist-info/"
+            executable_name = project.binary + ("-native" if project.normalized_name == "cogniflow-tui" else "")
+            executable = f"{wheel_name}-{project.version}.data/scripts/{executable_name}{suffix}"
+            expected_names = {dist + "METADATA", dist + "WHEEL", dist + "RECORD", executable}
+            if project.normalized_name in {"cf-service-mcp-server", "cogniflow-tui"}:
+                expected_names.add(dist + "NATIVE-AUTHORITY.json")
+            if project.normalized_name == "cogniflow-tui":
+                expected_names.update({dist + "entry_points.txt", "cogniflow_tui.py"})
+            if any(not _safe_zip_name(name) for name in names) or len(names) != len(set(names)) or len({name.casefold() for name in names}) != len(names) or set(names) != expected_names:
+                raise ResolverError("ARTIFACT_INVALID", "native wheel contains unsafe, duplicate, or unexpected payload")
+            for info in archive.infolist():
+                mode = (info.external_attr >> 16) & 0o170000
+                if stat.S_ISLNK(mode) or stat.S_ISDIR(mode) or info.filename.endswith("/"):
+                    raise ResolverError("ARTIFACT_INVALID", "native wheel contains a redirect or non-regular archive entry")
+            binary = archive.read(executable)
+            if (suffix and not binary.startswith(b"MZ")) or (not suffix and not binary.startswith(b"\x7fELF")) or str(project.crate_path.resolve()).encode() in binary:
+                raise ResolverError("ARTIFACT_INVALID", "native executable is not the expected checkout-independent binary")
+            if project.normalized_name in {"cf-service-mcp-server", "cogniflow-tui"}:
+                authority_raw = archive.read(dist + "NATIVE-AUTHORITY.json")
+                authority = json.loads(authority_raw)
+                records = authority.get("executables") if isinstance(authority, dict) and set(authority) == {"schema", "executables"} and authority.get("schema") == "stonecastle.native-authority.v1" else None
+                if not isinstance(records, list) or not records or authority_raw != json.dumps(authority, sort_keys=True, separators=(",", ":")).encode("utf-8"):
+                    raise ResolverError("NATIVE_AUTHORITY_INVALID", "native wheel authority is invalid")
+                if any(not isinstance(item, dict) or set(item) != {"normalized_distribution", "sha256"} or not isinstance(item["normalized_distribution"], str) or not isinstance(item["sha256"], str) or len(item["sha256"]) != 64 or any(char not in "0123456789abcdef" for char in item["sha256"]) for item in records):
+                    raise ResolverError("NATIVE_AUTHORITY_INVALID", "native wheel authority records are invalid")
+                identities = [item["normalized_distribution"] for item in records]
+                if identities != sorted(set(identities)) or (project.normalized_name == "cogniflow-tui" and identities != ["cogniflow-tui"]) or {item["normalized_distribution"]: item["sha256"] for item in records}.get(project.normalized_name) != hashlib.sha256(binary).hexdigest():
+                    raise ResolverError("NATIVE_AUTHORITY_INVALID", "native wheel executable is not bound to its distribution")
+            metadata = archive.read(dist + "METADATA").decode("utf-8")
+            wheel = archive.read(dist + "WHEEL").decode("utf-8")
+            if f"Name: {project.distribution}\n" not in metadata or f"Version: {project.version}\n" not in metadata or "Root-Is-Purelib: false\n" not in wheel or f"Tag: py3-none-{platform_tag}\n" not in wheel:
+                raise ResolverError("ARTIFACT_INVALID", "native wheel metadata is invalid")
+            if project.normalized_name == "cogniflow-tui":
+                target = "cogniflow_tui:main"
+                expected_entry_points = (
+                    f"[console_scripts]\n{project.entry_point} = {target}\n"
+                    f"[{project.discovery_group}]\n{project.entry_point} = {target}\n"
+                )
+                if archive.read(dist + "entry_points.txt").decode("ascii") != expected_entry_points:
+                    raise ResolverError("ARTIFACT_INVALID", "frontend entry-point metadata is invalid")
+            _validate_record(archive, names, dist + "RECORD")
+            mode = (archive.getinfo(executable).external_attr >> 16) & 0o777
+            if suffix == "" and mode != 0o755:
+                raise ResolverError("ARTIFACT_INVALID", "native executable permissions are invalid")
+            size_bytes = path.stat().st_size
+    except ResolverError:
+        raise
+    except (zipfile.BadZipFile, KeyError, UnicodeDecodeError, OSError, ValueError) as error:
+        raise ResolverError("ARTIFACT_INVALID", "native wheel archive is invalid") from error
+    return {"distribution": project.distribution, "normalized_distribution": project.normalized_name, "version": project.version, "filename": path.name, "sha256": hashlib.sha256(raw_wheel).hexdigest(), "size_bytes": size_bytes, "source_project": project.relative, "artifact_kind": "native", "wheel_tags": [f"py3-none-{platform_tag}"], "executable": executable, "discovery_group": project.discovery_group, "entry_point": project.entry_point}
+
+
+def native_executable_sha256(path: Path, project: NativeProject) -> str:
+    """Return the digest of the validated executable payload in a native wheel."""
+    artifact = validate_native_wheel(path, project)
+    try:
+        with zipfile.ZipFile(path) as archive:
+            payload = archive.read(str(artifact["executable"]))
+    except (OSError, KeyError, zipfile.BadZipFile) as error:
+        raise ResolverError("ARTIFACT_INVALID", "native executable payload is invalid") from error
+    return hashlib.sha256(payload).hexdigest()
+
+
+def native_authority(path: Path, projects: tuple[NativeProject, ...]) -> dict[str, str]:
+    """Read complete executable authority from the authenticated retained MCP wheel."""
+    mcp = [project for project in projects if project.normalized_name == "cf-service-mcp-server"]
+    if len(mcp) != 1:
+        raise ResolverError("NATIVE_AUTHORITY_INVALID", "accepted native authority carrier is not unique")
+    project = mcp[0]
+    validate_native_wheel(path, project)
+    wheel_name = project.normalized_name.replace("-", "_")
+    member = f"{wheel_name}-{project.version}.dist-info/NATIVE-AUTHORITY.json"
+    try:
+        with zipfile.ZipFile(path) as archive:
+            raw = archive.read(member)
+        value = json.loads(raw)
+    except (OSError, KeyError, UnicodeDecodeError, json.JSONDecodeError, zipfile.BadZipFile) as error:
+        raise ResolverError("NATIVE_AUTHORITY_INVALID", "accepted native executable authority is invalid") from error
+    expected = {item.normalized_name for item in projects}
+    records = value.get("executables") if isinstance(value, dict) and value.get("schema") == "stonecastle.native-authority.v1" and set(value) == {"schema", "executables"} else None
+    if not isinstance(records, list):
+        raise ResolverError("NATIVE_AUTHORITY_INVALID", "accepted native executable authority is invalid")
+    authority: dict[str, str] = {}
+    for record in records:
+        if not isinstance(record, dict) or set(record) != {"normalized_distribution", "sha256"} or not isinstance(record.get("normalized_distribution"), str) or not isinstance(record.get("sha256"), str) or len(record["sha256"]) != 64 or any(char not in "0123456789abcdef" for char in record["sha256"]):
+            raise ResolverError("NATIVE_AUTHORITY_INVALID", "accepted native executable authority record is invalid")
+        name = record["normalized_distribution"]
+        if name in authority:
+            raise ResolverError("NATIVE_AUTHORITY_INVALID", "accepted native executable authority is ambiguous")
+        authority[name] = record["sha256"]
+    if set(authority) != expected or raw != json.dumps(value, sort_keys=True, separators=(",", ":")).encode("utf-8"):
+        raise ResolverError("NATIVE_AUTHORITY_INVALID", "accepted native executable authority is incomplete")
+    if authority[project.normalized_name] != native_executable_sha256(path, project):
+        raise ResolverError("NATIVE_AUTHORITY_INVALID", "accepted native authority carrier does not authenticate itself")
+    return authority

cf_bootstrap_source_local/build.py

@@ -0,0 +1,90 @@
+"""Offline wheel building from isolated source copies."""
+
+from __future__ import annotations
+
+import importlib.metadata
+import os
+import platform
+import re
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+
+from .artifacts import validate_wheel
+from .inventory import NativeProject, Project
+from .native import build_natives
+from .model import ResolverError, normalize_distribution
+
+
+_DIAGNOSTIC_LIMIT = 8192
+_TRUNCATED = " ...[truncated]"
+
+
+def _safe_diagnostic(value: object) -> str:
+    """Render captured pip output without leaking common credential forms."""
+    if isinstance(value, bytes):
+        text = value.decode("utf-8", errors="replace")
+    elif isinstance(value, str):
+        text = value.encode("utf-8", errors="replace").decode("utf-8")
+    else:
+        text = "" if value is None else "<non-text output>"
+    text = re.sub(r"(?i)\b(https?://)[^\s/?#@]+@", r"\1<redacted>@", text)
+    text = re.sub(r"(?i)([?&](?:token|access_token|api_key|password|secret|key)=)[^&#\s]+", r"\1<redacted>", text)
+    text = re.sub(r"(?i)(\bAuthorization:\s*(?:Bearer|Basic)\s+)[^\s]+", r"\1<redacted>", text)
+    text = re.sub(r"(?i)\b((?:token|password|api[_-]?key|secret)\s*[:=]\s*)[^\s]+", r"\1<redacted>", text)
+    text = "".join(character if character.isprintable() else " " for character in text)
+    if len(text) > _DIAGNOSTIC_LIMIT:
+        text = text[:_DIAGNOSTIC_LIMIT - len(_TRUNCATED)] + _TRUNCATED
+    return text
+
+
+def _failure_detail(project: Project, result: subprocess.CompletedProcess[str]) -> str:
+    try:
+        pip_version = importlib.metadata.version("pip")
+    except importlib.metadata.PackageNotFoundError:
+        pip_version = "unavailable"
+    return (
+        f"project={_safe_diagnostic(project.normalized_name)} ({_safe_diagnostic(project.relative)}); "
+        f"python={_safe_diagnostic(sys.executable)}; python_version={platform.python_version()}; "
+        f"pip_version={pip_version}; exit_code={result.returncode}; "
+        f"stdout={_safe_diagnostic(result.stdout)}; stderr={_safe_diagnostic(result.stderr)}"
+    )
+
+
+def build(projects: tuple[Project, ...], staging: Path, natives: tuple[NativeProject, ...] = ()) -> list[dict[str, object]]:
+    wheel_dir = staging / "wheels"
+    wheel_dir.mkdir(parents=True)
+    artifacts: list[dict[str, object]] = []
+    for project in projects:
+        source = staging / "sources" / project.normalized_name
+        shutil.copytree(project.path, source, symlinks=True, ignore=shutil.ignore_patterns(".venv", ".git", "__pycache__", ".pytest_cache", "build", "dist", "*.egg-info", "*.whl", "*.tar.gz"))
+        for candidate in source.rglob("*"):
+            if candidate.is_symlink():
+                try:
+                    candidate.resolve().relative_to(source.resolve())
+                except ValueError as error:
+                    raise ResolverError("SOURCE_PROJECT_INVALID", "project symlink escapes source tree") from error
+        env = os.environ.copy()
+        env.update({"PIP_NO_INDEX": "1", "PIP_DISABLE_PIP_VERSION_CHECK": "1", "PIP_CONFIG_FILE": os.devnull, "PYTHONDONTWRITEBYTECODE": "1", "SOURCE_DATE_EPOCH": "315532800", "HOME": str(staging / "home"), "XDG_CACHE_HOME": str(staging / "cache")})
+        env.pop("PYTHONPATH", None)
+        try:
+            result = subprocess.run([sys.executable, "-m", "pip", "wheel", "--no-deps", "--no-build-isolation", "--no-index", "--disable-pip-version-check", "--wheel-dir", str(wheel_dir), str(source)], env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=120, check=False)
+        except FileNotFoundError as error:
+            raise ResolverError("BUILD_TOOL_UNAVAILABLE", "pip is unavailable in the active interpreter") from error
+        except subprocess.TimeoutExpired as error:
+            raise ResolverError("BUILD_FAILED", "wheel build timed out") from error
+        if result.returncode != 0:
+            stderr = result.stderr.decode("utf-8", errors="replace") if isinstance(result.stderr, bytes) else result.stderr or ""
+            detail = _failure_detail(project, result)
+            if "No module named pip" in stderr or "build backend" in stderr and "not found" in stderr:
+                raise ResolverError("BUILD_TOOL_UNAVAILABLE", f"required build tool is unavailable: {detail}")
+            raise ResolverError("BUILD_FAILED", f"offline wheel build failed: {detail}")
+        wheels = sorted(wheel_dir.glob("*.whl"))
+        matching = [wheel for wheel in wheels if project.normalized_name == normalize_distribution(wheel.name.split("-", 1)[0])]
+        if len(matching) != 1:
+            raise ResolverError("ARTIFACT_INVALID", "build did not produce exactly one wheel")
+        artifacts.append(validate_wheel(matching[0], project))
+    artifacts.extend(build_natives(natives, staging))
+    return artifacts

cf_bootstrap_source_local/capabilities.py

@@ -0,0 +1,91 @@
+"""Source-only capability provider discovery from indexed TriG semantics."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from rdflib import Dataset, Literal, RDF, URIRef
+
+from .inventory import Project
+from .model import ResolverError
+
+CF = URIRef("https://cogniflow.odea-project.org/cf#")
+SERVICE_OPERATION = CF + "ServiceOperation"
+OPERATION_CAPABILITY = CF + "hasOperationCapability"
+EXECUTION_AFFORDANCE = CF + "hasExecutionAffordance"
+VALUE = RDF.value
+EXECUTOR_PROTOCOL = CF + "hasExecutorProtocol"
+EXECUTOR_MODULE = CF + "hasExecutorModule"
+EXECUTOR_FUNCTION = CF + "hasExecutorFunction"
+PYTHON_EXECUTOR = CF + "PythonFunctionExecutorV1"
+
+
+def _single(dataset: Dataset, subject: object, predicate: URIRef, label: str, graph: object) -> object:
+    values = {obj for _, _, obj, _ in dataset.quads((subject, predicate, None, graph))}
+    if not values:
+        values = {obj for _, _, obj, _ in dataset.quads((subject, predicate, None, None))}
+    if len(values) != 1:
+        raise ResolverError("AFFORDANCE_INVALID", f"{label} must have exactly one value for {subject}")
+    return next(iter(values))
+
+
+def _iri(value: object, label: str) -> str:
+    if not isinstance(value, URIRef):
+        raise ResolverError("CAPABILITY_INVALID", f"{label} must be an IRI")
+    return str(value)
+
+
+def discover(checkout: Path, projects: tuple[Project, ...], requested: tuple[str, ...] = ()) -> dict[str, dict[str, str]]:
+    by_relative = {project.relative: project for project in projects}
+    try:
+        index = json.loads((checkout / "stonecastle/stonecastle.index.json").read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as error:
+        raise ResolverError("SOURCE_INDEX_INVALID", "semantic index is unreadable") from error
+    providers: dict[str, dict[str, str]] = {}
+    for item in index.get("files", []):
+        if item.get("kind") != "service-semantics" or not isinstance(item.get("path"), str):
+            continue
+        path = checkout / item["path"]
+        relative_project = "/".join(item["path"].split("/")[:2])
+        project = by_relative.get(relative_project)
+        if project is None:
+            continue
+        if not path.is_file() or path.is_symlink():
+            raise ResolverError("CAPABILITY_INVALID", "service semantic file is not a regular indexed file")
+        dataset = Dataset()
+        try:
+            dataset.parse(path, format="trig")
+        except Exception as error:
+            raise ResolverError("CAPABILITY_INVALID", f"service semantic TriG is invalid: {item['path']}") from error
+        for operation, _, _, graph in dataset.quads((None, RDF.type, SERVICE_OPERATION, None)):
+            if not isinstance(operation, URIRef):
+                raise ResolverError("CAPABILITY_INVALID", "service operation must be an IRI")
+            capability_node = _single(dataset, operation, OPERATION_CAPABILITY, "operation capability", graph)
+            try:
+                capability = _iri(_single(dataset, capability_node, VALUE, "capability value", graph), "capability")
+            except ResolverError:
+                if isinstance(capability_node, URIRef) and str(capability_node) in requested:
+                    raise
+                continue
+            affordance = _single(dataset, operation, EXECUTION_AFFORDANCE, "execution affordance", graph)
+            protocol_node = _single(dataset, affordance, EXECUTOR_PROTOCOL, "executor protocol", graph)
+            protocol = _iri(_single(dataset, protocol_node, VALUE, "executor protocol value", graph), "executor protocol")
+            if protocol != str(PYTHON_EXECUTOR):
+                raise ResolverError("AFFORDANCE_INVALID", "unsupported executor protocol")
+            module_node = _single(dataset, affordance, EXECUTOR_MODULE, "executor module", graph)
+            function_node = _single(dataset, affordance, EXECUTOR_FUNCTION, "executor function", graph)
+            module = _single(dataset, module_node, VALUE, "executor module value", graph)
+            function = _single(dataset, function_node, VALUE, "executor function value", graph)
+            if not isinstance(module, Literal) or not isinstance(function, Literal) or not module.value or not function.value:
+                raise ResolverError("AFFORDANCE_INVALID", "executor module and function must be literals")
+            package_roots = [child.name for child in (project.path / "src").iterdir() if child.is_dir() and (child / "__init__.py").is_file()]
+            if not any(str(module).startswith(root + ".") for root in package_roots):
+                raise ResolverError("AFFORDANCE_INVALID", "executor module is outside owning distribution")
+            if capability in providers:
+                raise ResolverError("CAPABILITY_AMBIGUOUS", "capability has multiple providers")
+            providers[capability] = {"distribution": project.name, "source_project": project.relative, "operation": str(operation), "protocol": protocol, "module": str(module), "function": str(function)}
+    for capability in requested:
+        if capability not in providers:
+            raise ResolverError("CAPABILITY_NOT_FOUND", "requested capability has no provider")
+    return {key: providers[key] for key in sorted(providers)}