ciris-agent 1.7.7__py3-none-any.whl

ciris_engine/schemas/secrets/core.py

@@ -0,0 +1,267 @@
+"""
+Schemas for CIRIS Agent Secrets Management System.
+
+These schemas define the data structures for secure storage, detection,
+and management of sensitive information within the CIRIS pipeline.
+"""
+
+from datetime import datetime
+from enum import Enum
+from typing import Any, Dict, List, Literal, Optional
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from ciris_engine.schemas.runtime.enums import SensitivityLevel
+from ciris_engine.schemas.types import JSONDict
+
+
+class SecretType(str, Enum):
+    """Standard secret types with default detection patterns"""
+
+    API_KEYS = "api_keys"
+    BEARER_TOKENS = "bearer_tokens"
+    PASSWORDS = "passwords"
+    URLS_WITH_AUTH = "urls_with_auth"
+    PRIVATE_KEYS = "private_keys"
+    CREDIT_CARDS = "credit_cards"
+    SOCIAL_SECURITY = "social_security"
+    AWS_ACCESS_KEY = "aws_access_key"
+    AWS_SECRET_KEY = "aws_secret_key"
+    GITHUB_TOKEN = "github_token"
+    SLACK_TOKEN = "slack_token"
+    DISCORD_TOKEN = "discord_token"
+
+
+class SecretRecord(BaseModel):
+    """Encrypted secret storage record"""
+
+    secret_uuid: str = Field(..., description="UUID identifier for the secret")
+    encrypted_value: bytes = Field(..., description="AES-256-GCM encrypted secret value")
+    encryption_key_ref: str = Field(..., description="Reference to encryption key in secure store")
+    salt: bytes = Field(..., description="Cryptographic salt")
+    nonce: bytes = Field(..., description="AES-GCM nonce")
+
+    description: str = Field(..., description="Human-readable description")
+    sensitivity_level: SensitivityLevel = Field(..., description="Sensitivity level")
+    detected_pattern: str = Field(..., description="Pattern that detected this secret")
+    context_hint: str = Field(..., description="Safe context description")
+
+    created_at: datetime = Field(..., description="Creation timestamp")
+    last_accessed: Optional[datetime] = Field(None, description="Last access time")
+    access_count: int = Field(0, description="Number of times accessed")
+    source_message_id: Optional[str] = Field(None, description="Source message ID")
+
+    auto_decapsulate_for_actions: List[str] = Field(default_factory=list, description="Actions that can auto-decrypt")
+    manual_access_only: bool = Field(False, description="Require manual access")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class SecretReference(BaseModel):
+    """Non-sensitive reference to a stored secret for SystemSnapshot"""
+
+    uuid: str = Field(..., description="Secret UUID")
+    description: str = Field(..., description="Description")
+    context_hint: str = Field(..., description="Context hint")
+    sensitivity: str = Field(..., description="Sensitivity level")
+    detected_pattern: str = Field(..., description="Detection pattern")
+    auto_decapsulate_actions: List[str] = Field(..., description="Auto-decrypt actions")
+    created_at: datetime = Field(..., description="Creation time")
+    last_accessed: Optional[datetime] = Field(None, description="Last access")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class SecretAccessLog(BaseModel):
+    """Audit log for secret access"""
+
+    access_id: str = Field(..., description="Unique access identifier")
+    secret_uuid: str = Field(..., description="Secret that was accessed")
+    access_type: Literal["VIEW", "DECRYPT", "UPDATE", "DELETE", "STORE"] = Field(..., description="Access type")
+    accessor: str = Field(..., description="Who/what accessed the secret")
+    purpose: str = Field(..., description="Stated purpose for access")
+    timestamp: datetime = Field(..., description="Access timestamp")
+    source_ip: Optional[str] = Field(None, description="Source IP")
+    user_agent: Optional[str] = Field(None, description="User agent")
+    action_context: Optional[str] = Field(None, description="Action context")
+    success: bool = Field(True, description="Whether access succeeded")
+    failure_reason: Optional[str] = Field(None, description="Failure reason if any")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class DetectedSecret(BaseModel):
+    """Secret detected during filtering process"""
+
+    original_value: str = Field(..., description="Original secret value")
+    secret_uuid: str = Field(..., description="Generated UUID for this secret")
+    pattern_name: str = Field(..., description="Detection pattern that found this secret")
+    description: str = Field(..., description="Human-readable description")
+    sensitivity: SensitivityLevel = Field(..., description="Sensitivity level")
+    context_hint: str = Field(..., description="Safe context description")
+    replacement_text: str = Field(..., description="Text to replace secret with in context")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class SecretsFilterResult(BaseModel):
+    """Result of applying secrets filter to content"""
+
+    filtered_content: str = Field(..., description="Content with secrets replaced by references")
+    detected_secrets: List[DetectedSecret] = Field(default_factory=list, description="Detected secrets")
+    secrets_found: int = Field(default=0, description="Number of secrets found")
+    patterns_matched: List[str] = Field(default_factory=list, description="Patterns that matched")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class RecallSecretParams(BaseModel):
+    """Parameters for RECALL_SECRET tool"""
+
+    secret_uuid: str = Field(..., description="UUID of the secret to recall")
+    purpose: str = Field(..., description="Why the secret is needed (for audit)")
+    decrypt: bool = Field(default=False, description="Whether to decrypt the secret value")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class SecretPattern(BaseModel):
+    """Pattern for detecting secrets"""
+
+    name: str = Field(..., description="Pattern name")
+    pattern: str = Field(..., description="Regex pattern")
+    description: str = Field(..., description="What this pattern detects")
+    sensitivity: SensitivityLevel = Field(..., description="Default sensitivity")
+    enabled: bool = Field(True, description="Whether pattern is active")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+def _default_secret_patterns() -> List[SecretPattern]:
+    """Default secret detection patterns."""
+    return [
+        SecretPattern(
+            name="api_key",
+            pattern=r"(?i)(api[_\-]?key|apikey)\s*[:=]\s*['\"]?([A-Za-z0-9\-_]{20,})['\"]?",
+            description="API Key",
+            sensitivity=SensitivityLevel.HIGH,
+            enabled=True,
+        ),
+        SecretPattern(
+            name="bearer_token",
+            pattern=r"(?i)bearer\s+([A-Za-z0-9\-_.~+/]+={0,2})",
+            description="Bearer Token",
+            sensitivity=SensitivityLevel.HIGH,
+            enabled=True,
+        ),
+        SecretPattern(
+            name="private_key",
+            pattern=r"-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----",
+            description="Private Key",
+            sensitivity=SensitivityLevel.CRITICAL,
+            enabled=True,
+        ),
+    ]
+
+
+class SecretsDetectionConfig(BaseModel):
+    """Configuration for secrets detection"""
+
+    enabled: bool = Field(True, description="Whether detection is enabled")
+    patterns: List[SecretPattern] = Field(default_factory=_default_secret_patterns, description="Detection patterns")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class UpdateSecretsFilterParams(BaseModel):
+    """Parameters for UPDATE_SECRETS_FILTER tool"""
+
+    operation: Literal["add_pattern", "remove_pattern", "update_pattern", "get_current"] = Field(
+        ..., description="Operation to perform"
+    )
+
+    pattern: Optional[SecretPattern] = Field(None, description="Pattern for add/update operations")
+    pattern_name: Optional[str] = Field(None, description="Pattern name for remove/update")
+    config_updates: Optional[Dict[str, str]] = Field(None, description="Configuration updates")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class SecretStorageConfig(BaseModel):
+    """Configuration for secret storage"""
+
+    encryption_algorithm: str = Field("AES-256-GCM", description="Encryption algorithm")
+    key_derivation_function: str = Field("PBKDF2", description="KDF algorithm")
+    key_iterations: int = Field(100000, description="KDF iterations")
+    auto_expire_days: Optional[int] = Field(None, description="Auto-expiry in days")
+    require_mfa: bool = Field(False, description="Require MFA for access")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class SecretMetrics(BaseModel):
+    """Metrics for secret management"""
+
+    total_secrets: int = Field(..., description="Total stored secrets")
+    secrets_by_type: Dict[str, int] = Field(..., description="Count by type")
+    secrets_by_sensitivity: Dict[str, int] = Field(..., description="Count by sensitivity")
+    access_count_last_day: int = Field(..., description="Accesses in last 24h")
+    detection_count_last_day: int = Field(..., description="Detections in last 24h")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class PatternStats(BaseModel):
+    """Statistics about active patterns."""
+
+    total_patterns: int = Field(0, description="Total number of patterns")
+    default_patterns: int = Field(0, description="Number of active default patterns")
+    custom_patterns: int = Field(0, description="Number of custom patterns")
+    disabled_patterns: int = Field(0, description="Number of disabled patterns")
+    builtin_patterns: bool = Field(True, description="Whether builtin patterns are enabled")
+    filter_version: str = Field("v1.0", description="Filter version")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class ConfigExport(BaseModel):
+    """Exported configuration data."""
+
+    filter_id: str = Field("config_based", description="Filter identifier")
+    version: int = Field(1, description="Configuration version")
+    builtin_patterns_enabled: bool = Field(True, description="Whether builtin patterns are enabled")
+    custom_patterns: List[SecretPattern] = Field(default_factory=list, description="Custom patterns")
+    disabled_patterns: List[str] = Field(default_factory=list, description="Disabled pattern names")
+    sensitivity_overrides: JSONDict = Field(default_factory=dict, description="Sensitivity overrides")
+    require_confirmation_for: List[str] = Field(default_factory=list, description="Actions requiring confirmation")
+    auto_decrypt_for_actions: List[str] = Field(default_factory=list, description="Actions that auto-decrypt")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class FilterConfigUpdate(BaseModel):
+    """Update to filter configuration."""
+
+    updates: JSONDict = Field(..., description="Configuration updates to apply")
+    update_type: str = Field("config", description="Type of update")
+    validation_errors: List[str] = Field(default_factory=list, description="Validation errors if any")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+__all__ = [
+    "SecretType",
+    "SecretRecord",
+    "SecretReference",
+    "SecretAccessLog",
+    "DetectedSecret",
+    "SecretsFilterResult",
+    "RecallSecretParams",
+    "SecretPattern",
+    "UpdateSecretsFilterParams",
+    "SecretStorageConfig",
+    "SecretMetrics",
+    "PatternStats",
+    "ConfigExport",
+    "FilterConfigUpdate",
+]

ciris_engine/schemas/secrets/service.py

@@ -0,0 +1,95 @@
+"""
+Schemas for secrets service operations.
+
+These schemas define the data structures used by the secrets service.
+"""
+
+from typing import Any, Dict, List, Optional
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from ciris_engine.schemas.types import JSONDict
+
+from ..runtime.enums import SensitivityLevel
+
+
+class SecretRecallResult(BaseModel):
+    """Result of secret recall operation."""
+
+    found: bool = Field(..., description="Whether the secret was found")
+    value: Optional[str] = Field(None, description="Decrypted secret value")
+    error: Optional[str] = Field(None, description="Error message if failed")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class DecapsulationContext(BaseModel):
+    """Context for decapsulating secrets in parameters."""
+
+    action_type: str = Field(..., description="Type of action being executed")
+    thought_id: str = Field(..., description="ID of thought executing the action")
+    user_id: Optional[str] = Field(None, description="ID of user if applicable")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class PatternConfig(BaseModel):
+    """Configuration for a secret detection pattern."""
+
+    name: str = Field(..., description="Pattern name")
+    pattern: str = Field(..., description="Regex pattern")
+    sensitivity: SensitivityLevel = Field(..., description="Sensitivity level")
+    enabled: bool = Field(True, description="Whether pattern is enabled")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class SensitivityConfig(BaseModel):
+    """Configuration for sensitivity levels."""
+
+    level: SensitivityLevel = Field(..., description="Sensitivity level")
+    redaction_enabled: bool = Field(True, description="Whether to redact at this level")
+    audit_enabled: bool = Field(True, description="Whether to audit at this level")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class FilterStats(BaseModel):
+    """Statistics from filter operations."""
+
+    patterns_updated: int = Field(0, description="Number of patterns updated")
+    sensitivity_levels_updated: int = Field(0, description="Number of sensitivity levels updated")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class FilterUpdateRequest(BaseModel):
+    """Request to update filter configuration."""
+
+    patterns: Optional[List[PatternConfig]] = Field(None, description="Pattern updates")
+    sensitivity_config: Optional[Dict[str, SensitivityConfig]] = Field(None, description="Sensitivity updates")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+class FilterUpdateResult(BaseModel):
+    """Result of filter update operation."""
+
+    success: bool = Field(..., description="Whether update succeeded")
+    error: Optional[str] = Field(None, description="Error message if failed")
+    results: Optional[List[JSONDict]] = Field(None, description="Update results as attribute dictionaries")
+    accessor: Optional[str] = Field(None, description="Accessor who performed update")
+    stats: Optional[FilterStats] = Field(None, description="Update statistics")
+
+    model_config = ConfigDict(extra="forbid")
+
+
+__all__ = [
+    "SecretRecallResult",
+    "DecapsulationContext",
+    "PatternConfig",
+    "SensitivityConfig",
+    "FilterStats",
+    "FilterUpdateRequest",
+    "FilterUpdateResult",
+]

ciris_engine/schemas/services/__init__.py

@@ -0,0 +1,33 @@
+"""Service schemas for contract-driven architecture."""
+
+from .metadata import ServiceMetadata
+from .requests import (
+    AuditRequest,
+    AuditResponse,
+    LLMRequest,
+    LLMResponse,
+    MemorizeRequest,
+    MemorizeResponse,
+    RecallRequest,
+    RecallResponse,
+    ServiceRequest,
+    ServiceResponse,
+    ToolExecutionRequest,
+    ToolExecutionResponse,
+)
+
+__all__ = [
+    "ServiceMetadata",
+    "ServiceRequest",
+    "ServiceResponse",
+    "MemorizeRequest",
+    "MemorizeResponse",
+    "RecallRequest",
+    "RecallResponse",
+    "ToolExecutionRequest",
+    "ToolExecutionResponse",
+    "LLMRequest",
+    "LLMResponse",
+    "AuditRequest",
+    "AuditResponse",
+]

ciris_engine/schemas/services/audit_summary_node.py

@@ -0,0 +1,172 @@
+"""
+Audit summary nodes for consolidating audit events.
+
+These nodes store a hash of audit events from each period to prove
+the audit trail existed without duplicating the permanent audit data.
+"""
+
+import hashlib
+import json
+from datetime import datetime, timezone
+from typing import Any, Dict, Optional, Union
+
+from pydantic import Field
+
+from ciris_engine.schemas.services.graph_core import GraphNode, GraphScope, NodeType
+from ciris_engine.schemas.services.graph_typed_nodes import TypedGraphNode, register_node_type
+from ciris_engine.schemas.types import JSONDict
+
+
+@register_node_type("AUDIT_SUMMARY")
+class AuditSummaryNode(TypedGraphNode):
+    """
+    Consolidated audit summary for a time period.
+
+    Stores a cryptographic hash of all audit events in the period
+    to prove the audit trail's existence and integrity without
+    duplicating the permanent audit records.
+    """
+
+    # Period information
+    period_start: datetime = Field(..., description="Start of the consolidation period")
+    period_end: datetime = Field(..., description="End of the consolidation period")
+    period_label: str = Field(..., description="Human-readable period label")
+
+    # Audit hash - the main purpose
+    audit_hash: str = Field(..., description="SHA-256 hash of all audit event IDs in chronological order")
+    hash_algorithm: str = Field(default="sha256", description="Algorithm used for hashing")
+
+    # Basic metrics (without storing actual events)
+    total_audit_events: int = Field(0, description="Total number of audit events")
+    events_by_type: Dict[str, int] = Field(default_factory=dict, description="Count of events by type")
+    events_by_actor: Dict[str, int] = Field(default_factory=dict, description="Count of events by actor")
+    events_by_service: Dict[str, int] = Field(default_factory=dict, description="Count of events by service")
+
+    # Security indicators
+    failed_auth_attempts: int = Field(0, description="Number of failed auth attempts")
+    permission_denials: int = Field(0, description="Number of permission denials")
+    emergency_shutdowns: int = Field(0, description="Number of emergency shutdowns")
+    config_changes: int = Field(0, description="Number of configuration changes")
+
+    # Summary metadata
+    first_event_id: Optional[str] = Field(None, description="ID of first event in period")
+    last_event_id: Optional[str] = Field(None, description="ID of last event in period")
+    source_correlation_count: int = Field(0, description="Number of AUDIT_EVENT correlations")
+    consolidation_timestamp: datetime = Field(
+        default_factory=lambda: datetime.now(timezone.utc), description="When this summary was created"
+    )
+
+    # Required TypedGraphNode fields
+    created_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+    updated_at: datetime = Field(default_factory=lambda: datetime.now(timezone.utc))
+    created_by: str = Field(default="TSDBConsolidationService")
+    updated_by: str = Field(default="TSDBConsolidationService")
+
+    # Graph node type
+    type: NodeType = Field(default=NodeType.TSDB_SUMMARY)
+    scope: GraphScope = Field(default=GraphScope.LOCAL)
+    id: str = Field(..., description="Node ID")
+    version: int = Field(default=1)
+    attributes: JSONDict = Field(default_factory=dict, description="Node attributes")
+
+    @staticmethod
+    def compute_audit_hash(event_ids: list[str], algorithm: str = "sha256") -> str:
+        """
+        Compute a cryptographic hash of audit event IDs.
+
+        Args:
+            event_ids: List of audit event IDs in chronological order
+            algorithm: Hash algorithm to use (default: sha256)
+
+        Returns:
+            Hex string of the hash
+        """
+        # Sort to ensure deterministic hash
+        sorted_ids = sorted(event_ids)
+
+        # Create hash
+        if algorithm == "sha256":
+            hasher = hashlib.sha256()
+        else:
+            raise ValueError(f"Unsupported hash algorithm: {algorithm}")
+
+        # Hash the JSON representation for consistency
+        hasher.update(json.dumps(sorted_ids).encode("utf-8"))
+        return hasher.hexdigest()
+
+    def to_graph_node(self) -> GraphNode:
+        """Convert to GraphNode for storage."""
+        extra_fields = {
+            # Period info
+            "period_start": self.period_start.isoformat(),
+            "period_end": self.period_end.isoformat(),
+            "period_label": self.period_label,
+            # Audit hash
+            "audit_hash": self.audit_hash,
+            "hash_algorithm": self.hash_algorithm,
+            # Metrics
+            "total_audit_events": self.total_audit_events,
+            "events_by_type": self.events_by_type,
+            "events_by_actor": self.events_by_actor,
+            "events_by_service": self.events_by_service,
+            # Security indicators
+            "failed_auth_attempts": self.failed_auth_attempts,
+            "permission_denials": self.permission_denials,
+            "emergency_shutdowns": self.emergency_shutdowns,
+            "config_changes": self.config_changes,
+            # Metadata
+            "first_event_id": self.first_event_id,
+            "last_event_id": self.last_event_id,
+            "source_correlation_count": self.source_correlation_count,
+            "consolidation_timestamp": self.consolidation_timestamp.isoformat(),
+            # Type hint
+            "node_class": "AuditSummaryNode",
+        }
+
+        return GraphNode(
+            id=self.id,
+            type=self.type,
+            scope=self.scope,
+            attributes=extra_fields,
+            version=self.version,
+            updated_by=self.updated_by or "TSDBConsolidationService",
+            updated_at=self.updated_at or self.consolidation_timestamp,
+        )
+
+    @classmethod
+    def from_graph_node(cls, node: GraphNode) -> "AuditSummaryNode":
+        """Reconstruct from GraphNode."""
+        attrs = node.attributes if isinstance(node.attributes, dict) else {}
+
+        return cls(
+            # Base fields from GraphNode
+            id=node.id,
+            type=node.type,
+            scope=node.scope,
+            version=node.version,
+            updated_by=node.updated_by,
+            updated_at=node.updated_at,
+            # Period info
+            period_start=cls._deserialize_datetime(attrs.get("period_start")),
+            period_end=cls._deserialize_datetime(attrs.get("period_end")),
+            period_label=attrs.get("period_label", ""),
+            # Audit hash
+            audit_hash=attrs.get("audit_hash", ""),
+            hash_algorithm=attrs.get("hash_algorithm", "sha256"),
+            # Metrics
+            total_audit_events=attrs.get("total_audit_events", 0),
+            events_by_type=attrs.get("events_by_type", {}),
+            events_by_actor=attrs.get("events_by_actor", {}),
+            events_by_service=attrs.get("events_by_service", {}),
+            # Security indicators
+            failed_auth_attempts=attrs.get("failed_auth_attempts", 0),
+            permission_denials=attrs.get("permission_denials", 0),
+            emergency_shutdowns=attrs.get("emergency_shutdowns", 0),
+            config_changes=attrs.get("config_changes", 0),
+            # Metadata
+            first_event_id=attrs.get("first_event_id"),
+            last_event_id=attrs.get("last_event_id"),
+            source_correlation_count=attrs.get("source_correlation_count", 0),
+            consolidation_timestamp=cls._deserialize_datetime(attrs.get("consolidation_timestamp"))
+            or datetime.now(timezone.utc),
+        )

ciris_engine/schemas/services/authority/__init__.py

@@ -0,0 +1,39 @@
+"""Authority service schemas."""
+
+from ciris_engine.schemas.services.authority.jwt import (
+    JWTAlgorithm,
+    JWTClaims,
+    JWTHeader,
+    JWTToken,
+    JWTValidationResult,
+)
+from ciris_engine.schemas.services.authority.wise_authority import (
+    ApprovalRequestContext,
+    AuthenticationResult,
+    DeferralResolution,
+    OAuthConfig,
+    PendingDeferral,
+    PermissionEntry,
+    TokenVerification,
+    WAResource,
+    WAUpdate,
+)
+
+__all__ = [
+    # Wise Authority schemas
+    "PermissionEntry",
+    "ApprovalRequestContext",
+    "AuthenticationResult",
+    "WAUpdate",
+    "TokenVerification",
+    "PendingDeferral",
+    "DeferralResolution",
+    "WAResource",
+    "OAuthConfig",
+    # JWT schemas
+    "JWTAlgorithm",
+    "JWTHeader",
+    "JWTClaims",
+    "JWTToken",
+    "JWTValidationResult",
+]