clm-kernel 0.0.0__py3-none-any.whl

clm/cross_cutting/cel_engine.py

@@ -0,0 +1,252 @@
+"""CEL Engine — CLM Expression Language evaluator with registry-based dispatch.
+
+Extracted from ``pcard.py`` in Sprint 127.1 and converted to registry-based
+dispatch in Sprint 127.2. This module is the canonical home for:
+
+    - ``CelOpRegistry`` — maps operation names to handler functions
+    - ``CelOpHandler`` — protocol for operation handlers
+    - ``_evaluate_cel()`` — delegates to the registry (6 lines)
+    - ``_smart_evaluate()`` — auto-detects CEL dict vs legacy string
+    - ``_resolve_arg()`` / ``_resolve_ref()`` — argument/reference resolution
+
+Each CEL operation (``string_concat``, ``compare``, ``db_query``, etc.) is
+implemented as a standalone function in :mod:`cel_ops` and registered at
+import time via ``_register_defaults()``.
+
+Adding a new operation requires exactly:
+    1. One function in ``cel_ops.py``
+    2. One ``register()`` call in ``_register_defaults()``
+    3. One entry in ``schema/cel_schema.yaml``
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from typing import Any
+
+# ---------------------------------------------------------------------------
+# Compiled regexes (module-level, compiled once)
+# ---------------------------------------------------------------------------
+
+_RE_SIMPLE_IDENTIFIER = re.compile(r"^[a-zA-Z_][a-zA-Z0-9_]*$")
+_RE_PYTHON_SYNTAX = re.compile(r"[()[\]{}.\"']")
+
+# ---------------------------------------------------------------------------
+# Deprecation logging (Sprint 126.1, loaded from schema in Sprint 127.4)
+# ---------------------------------------------------------------------------
+
+_DEP_LOGGER = logging.getLogger("clm.cel")
+
+
+_FALLBACK_DEPRECATED_FUNCS: set[str] = {
+    "operator.add", "operator.sub", "operator.mul",
+    "operator.truediv", "operator.mod", "str.join", "os.system",
+}
+
+
+def _load_deprecated_funcs() -> set[str]:
+    """Load the canonical deprecated-function list from cel_schema.yaml.
+
+    Sprint 132.5: only ImportError (bootstrap) falls back silently;
+    other failures log loudly instead of silently using the fallback.
+    """
+    try:
+        from clm.cross_cutting.cel_converter import load_schema
+        schema = load_schema()
+        call_def = schema.get("call", {})
+        funcs = set(call_def.get("deprecated_functions", []))
+        if not funcs:
+            _DEP_LOGGER.warning("[CEL_DEPRECATED] schema loaded but deprecated_functions is empty")
+        return funcs
+    except ImportError:
+        return _FALLBACK_DEPRECATED_FUNCS
+    except Exception as e:
+        _DEP_LOGGER.error("[CEL_DEPRECATED] schema load failed: %s — using fallback", e)
+        return _FALLBACK_DEPRECATED_FUNCS
+
+
+_DEPRECATED_FUNCS = _load_deprecated_funcs()
+
+
+# ---------------------------------------------------------------------------
+# CEL Operation Registry (Sprint 127.2)
+# ---------------------------------------------------------------------------
+
+class CelOpRegistry:
+    """Maps CEL operation names to handler functions.
+
+    Replaces the elif chain. Each handler receives the full CEL dict and
+    the evaluation context, and returns the result.
+    """
+
+    def __init__(self) -> None:
+        self._handlers: dict[str, Any] = {}
+
+    def register(self, op_name: str, handler: Any) -> None:
+        if op_name in self._handlers:
+            raise ValueError(f"CEL op '{op_name}' already registered")
+        self._handlers[op_name] = handler
+
+    def dispatch(self, cel: dict[str, Any], context: dict[str, Any]) -> Any:
+        op = cel.get("op")
+        if op is None:
+            raise ValueError(f"CEL dict missing 'op' field: {cel}")
+        handler = self._handlers.get(op)
+        if handler is None:
+            raise ValueError(f"Unknown CEL operation: {op}")
+        return handler(cel, context)
+
+    @property
+    def registered_ops(self) -> set[str]:
+        return set(self._handlers.keys())
+
+
+_DEFAULT_REGISTRY = CelOpRegistry()
+
+
+# ---------------------------------------------------------------------------
+# Argument / Reference Resolution
+# ---------------------------------------------------------------------------
+
+def _resolve_ref(ref_str: str, context: dict[str, Any]) -> Any:
+    """Resolve a dot-notation reference against the evaluation context.
+
+    Sprint 133 §7.4: delegates to ``cel_resolver.resolve_ref`` for a single
+    implementation. The legacy ``dict``-based context path is preserved.
+    """
+    from clm.cross_cutting.cel_resolver import resolve_ref
+    return resolve_ref(ref_str, context)
+
+
+def _resolve_arg(arg: Any, context: dict[str, Any]) -> Any:
+    """Resolve a single CEL argument — literal, ref, nested op, or list."""
+    if isinstance(arg, list):
+        return [_resolve_arg(a, context) for a in arg]
+    if isinstance(arg, dict):
+        if "ref" in arg:
+            return _resolve_ref(arg["ref"], context)
+        elif "op" in arg:
+            return _evaluate_cel(arg, context)
+        else:
+            return arg
+    return arg
+
+
+# ---------------------------------------------------------------------------
+# CEL Evaluator (delegates to registry — Sprint 127.2)
+# ---------------------------------------------------------------------------
+
+def _evaluate_cel(cel: dict[str, Any], context: dict[str, Any]) -> Any:
+    """Evaluate a CEL operation descriptor via the default registry."""
+    if not isinstance(cel, dict):
+        return cel
+    return _DEFAULT_REGISTRY.dispatch(cel, context)
+
+
+def _evaluate_expr(expr: Any, context: dict[str, Any]) -> Any:
+    """Safely evaluate a Python expression string against *context*.
+
+    Sprint 132.5: simple identifiers and no-syntax strings pass through
+    without eval(); pure literals use ``ast.literal_eval``; full Python
+    expressions use ``eval()`` unless ``CLM_DISABLE_EVAL=1`` is set
+    (hardening knob for untrusted YAML).
+    """
+    import os as _os
+    expr_str = str(expr).strip()
+    if not expr_str:
+        return expr
+    # Handle simple cases without eval()
+    if _RE_SIMPLE_IDENTIFIER.match(expr_str):
+        # Python builtins
+        if expr_str == "True":
+            return True
+        if expr_str == "False":
+            return False
+        if expr_str == "None":
+            return None
+        # Could be a variable name in context, or just a plain string
+        if expr_str in context:
+            return context[expr_str]
+        return expr_str
+    if not _RE_PYTHON_SYNTAX.search(expr_str):
+        # No Python syntax characters — return as-is
+        return expr_str
+    # Try safe literal eval for quoted strings/numbers before falling back to eval()
+    try:
+        import ast
+        return ast.literal_eval(expr_str)
+    except (ValueError, SyntaxError):
+        pass
+    # Full Python expression — opt-out hardening via CLM_DISABLE_EVAL=1
+    if _os.environ.get("CLM_DISABLE_EVAL", "").lower() == "1":
+        raise ValueError(
+            f"Python eval() is disabled via CLM_DISABLE_EVAL=1. "
+            f"Migrate to CLM expression ops or unset the flag: {expr_str[:80]!r}"
+        )
+    # Sprint 133.4: escalate eval() usage to DeprecationWarning (was logger.warning)
+    import warnings
+    warnings.warn(
+        "eval() in CEL expressions is deprecated; migrate to CLM expression ops. "
+        f"Set CLM_DISABLE_EVAL=1 to hard-fail. Expression: {expr_str[:80]!r}",
+        DeprecationWarning,
+        stacklevel=2,
+    )
+    _DEP_LOGGER.warning("[CEL_EVAL] eval() invoked: %r", expr_str[:80])
+    return eval(expr_str, context)  # noqa: S307
+
+
+def _smart_evaluate(expr: Any, context: dict[str, Any]) -> Any:
+    """Auto-detect CEL dict vs legacy Python string and evaluate accordingly."""
+    if isinstance(expr, dict) and "op" in expr:
+        return _evaluate_cel(expr, context)
+    return _evaluate_expr(expr, context)
+
+
+# ---------------------------------------------------------------------------
+# Default Registry Bootstrap
+# ---------------------------------------------------------------------------
+
+def _register_defaults() -> None:
+    """Register all built-in CEL operations from :mod:`cel_ops`."""
+    from clm.cross_cutting import cel_ops
+
+    _DEFAULT_REGISTRY.register("value_ref", cel_ops.op_value_ref)
+    _DEFAULT_REGISTRY.register("db_query", cel_ops.op_db_query)
+    _DEFAULT_REGISTRY.register("call", cel_ops.op_call)
+    _DEFAULT_REGISTRY.register("store", cel_ops.op_store)
+    _DEFAULT_REGISTRY.register("retrieve", cel_ops.op_retrieve)
+    _DEFAULT_REGISTRY.register("write_file", cel_ops.op_write_file)
+    _DEFAULT_REGISTRY.register("set_env", cel_ops.op_set_env)
+    _DEFAULT_REGISTRY.register("unset_env", cel_ops.op_unset_env)
+    _DEFAULT_REGISTRY.register("sleep", cel_ops.op_sleep)
+    _DEFAULT_REGISTRY.register("sequence", cel_ops.op_sequence)
+    _DEFAULT_REGISTRY.register("path_join", cel_ops.op_path_join)
+    _DEFAULT_REGISTRY.register("len", cel_ops.op_len)
+    _DEFAULT_REGISTRY.register("compare", cel_ops.op_compare)
+    _DEFAULT_REGISTRY.register("int_cast", cel_ops.op_int_cast)
+    _DEFAULT_REGISTRY.register("or_fallback", cel_ops.op_or_fallback)
+    _DEFAULT_REGISTRY.register("contains", cel_ops.op_contains)
+    _DEFAULT_REGISTRY.register("make_mcard_content", cel_ops.op_make_mcard_content)
+    _DEFAULT_REGISTRY.register("copy_file", cel_ops.op_copy_file)
+    _DEFAULT_REGISTRY.register("not_null", cel_ops.op_not_null)
+    _DEFAULT_REGISTRY.register("callable_check", cel_ops.op_callable_check)
+    _DEFAULT_REGISTRY.register("json_parse", cel_ops.op_json_parse)
+    _DEFAULT_REGISTRY.register("dict_get", cel_ops.op_dict_get)
+    _DEFAULT_REGISTRY.register("index", cel_ops.op_index)
+    _DEFAULT_REGISTRY.register("replace", cel_ops.op_replace)
+    _DEFAULT_REGISTRY.register("read_file", cel_ops.op_read_file)
+    _DEFAULT_REGISTRY.register("capture_output", cel_ops.op_capture_output)
+    _DEFAULT_REGISTRY.register("run_test_suite", cel_ops.op_run_test_suite)
+    _DEFAULT_REGISTRY.register("string_concat", cel_ops.op_string_concat)
+    _DEFAULT_REGISTRY.register("path_basename", cel_ops.op_path_basename)
+    _DEFAULT_REGISTRY.register("string_join", cel_ops.op_string_join)
+    # Sprint 131.4 — CLM expression sub-system: card & handle ops
+    _DEFAULT_REGISTRY.register("card:create", cel_ops.op_card_create)
+    _DEFAULT_REGISTRY.register("card:save", cel_ops.op_card_save)
+    _DEFAULT_REGISTRY.register("card:load", cel_ops.op_card_load)
+    _DEFAULT_REGISTRY.register("handle:resolve", cel_ops.op_handle_resolve)
+    _DEFAULT_REGISTRY.register("handle:get_history", cel_ops.op_handle_get_history)
+
+
+_register_defaults()

clm/cross_cutting/cel_ops.py

@@ -0,0 +1,72 @@
+"""CEL Operation Handlers — re-export shim (Sprint 133.2).
+
+Sprint 133.2 decomposed this 432-line module into 4 domain-specific modules:
+    - ``cel_ops_state.py`` — value_ref, store, retrieve, dict_get, index, len,
+      not_null, callable_check, json_parse, int_cast, or_fallback, sequence
+    - ``cel_ops_files.py`` — write_file, set_env, unset_env, sleep, read_file,
+      copy_file, run_test_suite, capture_output
+    - ``cel_ops_strings.py`` — path_join, path_basename, string_concat,
+      string_join, replace, compare, contains, _COMPARE_OPS
+    - ``cel_ops_db.py`` — db_query, call, make_mcard_content, card:create,
+      card:save, card:load, handle:resolve, handle:get_history
+
+This file remains as a re-export shim so ``cel_engine._register_defaults()``
+can import all ops via ``cel_ops.op_*`` attribute access.
+"""
+from clm.cross_cutting.cel_ops_db import (
+    op_call,
+    op_card_create,
+    op_card_load,
+    op_card_save,
+    op_db_query,
+    op_handle_get_history,
+    op_handle_resolve,
+    op_make_mcard_content,
+)
+from clm.cross_cutting.cel_ops_files import (
+    op_capture_output,
+    op_copy_file,
+    op_read_file,
+    op_run_test_suite,
+    op_set_env,
+    op_sleep,
+    op_unset_env,
+    op_write_file,
+)
+from clm.cross_cutting.cel_ops_state import (
+    op_callable_check,
+    op_dict_get,
+    op_index,
+    op_int_cast,
+    op_json_parse,
+    op_len,
+    op_not_null,
+    op_or_fallback,
+    op_retrieve,
+    op_sequence,
+    op_store,
+    op_value_ref,
+)
+from clm.cross_cutting.cel_ops_strings import (
+    _COMPARE_OPS,
+    op_compare,
+    op_contains,
+    op_path_basename,
+    op_path_join,
+    op_replace,
+    op_string_concat,
+    op_string_join,
+)
+
+__all__ = [
+    "op_value_ref", "op_db_query", "op_call", "op_store", "op_retrieve",
+    "op_write_file", "op_set_env", "op_unset_env", "op_sleep", "op_sequence",
+    "op_path_join", "op_len", "op_compare", "op_int_cast", "op_or_fallback",
+    "op_contains", "op_make_mcard_content", "op_copy_file", "op_not_null",
+    "op_callable_check", "op_json_parse", "op_dict_get", "op_index",
+    "op_replace", "op_read_file", "op_capture_output", "op_run_test_suite",
+    "op_string_concat", "op_path_basename", "op_string_join",
+    "op_card_create", "op_card_save", "op_card_load",
+    "op_handle_resolve", "op_handle_get_history",
+    "_COMPARE_OPS",
+]

clm/cross_cutting/cel_ops_db.py

@@ -0,0 +1,157 @@
+"""CEL database, call, and card/handle ops (Sprint 133.2).
+
+Extracted from ``cel_ops.py``. Operations for DB queries, function calls
+(including deprecated Python-bound passthroughs), MCard generation, and
+CLM expression sub-system card/handle operations (Sprint 131.4).
+"""
+from clm.cross_cutting.cel_engine import (
+    _DEP_LOGGER,
+    _DEPRECATED_FUNCS,
+    _resolve_arg,
+)
+
+
+def _resolve_card_content(ctx: dict, card_hash: str, pillar: str = "execution_log") -> str | None:
+    """Single source of truth for fetching card content by hash (Sprint 132.3 §7.4).
+
+    Uses ``repo.get_card_content`` when a repo is available, else falls
+    back to raw SQL via ``ctx["db"]``.
+    """
+    repo = ctx.get("repo")
+    if repo is not None:
+        return repo.get_card_content(card_hash, pillar)
+    raw = ctx["db"].execute(pillar, "SELECT content FROM card WHERE hash = ?;", [card_hash])
+    return raw.strip() if raw else None
+
+
+def _resolve_handle_hash(ctx: dict, handle: str, pillar: str = "execution_log") -> str:
+    """Single source of truth for resolving a handle to its current hash (Sprint 132.3 §7.4).
+
+    Uses ``repo.resolve_handle_hash`` when a repo is available, else falls
+    back to raw SQL via ``ctx["db"]``.
+    """
+    repo = ctx.get("repo")
+    if repo is not None:
+        return repo.resolve_handle_hash(handle, pillar)
+    raw = ctx["db"].execute(pillar, "SELECT current_hash FROM handle_registry WHERE handle = ?;", [handle])
+    return raw.strip() if raw else ""
+
+
+def op_db_query(cel: dict, ctx: dict):
+    pillar = _resolve_arg(cel["pillar"], ctx)
+    sql = _resolve_arg(cel["sql"], ctx)
+    params = cel.get("params")
+    if params is not None:
+        params = _resolve_arg(params, ctx)
+        result = ctx["db"].execute(pillar, sql, params)
+    else:
+        result = ctx["db"].execute(pillar, sql)
+    transform = cel.get("transform", "strip")
+    if transform == "strip" and isinstance(result, str):
+        result = result.strip()
+    if isinstance(result, str) and not result.strip() and not sql.strip().lower().startswith("select"):
+        return True
+    return result
+
+
+def op_call(cel: dict, ctx: dict):
+    func_name = cel["function"]
+    args = [_resolve_arg(a, ctx) for a in cel.get("args", [])]
+    kwargs = {k: _resolve_arg(v, ctx) for k, v in cel.get("kwargs", {}).items()}
+    if func_name in _DEPRECATED_FUNCS:
+        _DEP_LOGGER.warning(
+            "[CEL_DEPRECATED] %s is a Python-bound call; migrate to "
+            "string_concat/string_join/run_test_suite. Lint gate (sprint-126.5) "
+            "will fail CI on these.", func_name,
+        )
+    if func_name == "operator.add":
+        return args[0] + args[1]
+    if func_name == "operator.sub":
+        return args[0] - args[1]
+    if func_name == "operator.mul":
+        return args[0] * args[1]
+    if func_name == "operator.truediv":
+        return args[0] / args[1]
+    if func_name == "operator.mod":
+        return args[0] % args[1]
+    func = ctx
+    for part in func_name.split("."):
+        func = func[part] if isinstance(func, dict) else getattr(func, part)
+    result = func(*args, **kwargs)
+    if cel.get("default") is not None and result is None:
+        result = _resolve_arg(cel["default"], ctx)
+    return result
+
+
+def op_make_mcard_content(cel: dict, ctx: dict):
+    content_hash = _resolve_arg(cel["content_hash"], ctx)
+    content = _resolve_arg(cel["content"], ctx)
+    filename = _resolve_arg(cel.get("filename", "test.txt"), ctx)
+    mime_type = _resolve_arg(cel.get("mime_type", "text/plain"), ctx)
+    from clm.cross_cutting.mcard import make_mcard_content
+    return make_mcard_content(content_hash, content, filename, mime_type)
+
+
+def op_card_create(cel: dict, ctx: dict):
+    """CEL: card:create — instantiate a Card from properties (no DB write)."""
+    from clm.cross_cutting.mcard import Card
+    props = {k: _resolve_arg(v, ctx) for k, v in cel.items() if k != "op"}
+    return Card(**props)
+
+
+def op_card_save(cel: dict, ctx: dict):
+    """CEL: card:save — persist a Card (or value) under a handle (versioned)."""
+    from clm.cross_cutting.mcard import Card
+    repo = ctx.get("repo")
+    if repo is None:
+        raise RuntimeError("card:save requires repo in context")
+    card = _resolve_arg(cel["card"], ctx)
+    if not isinstance(card, Card):
+        card = Card(token_type="mcard", content=str(card))
+    handle = _resolve_arg(cel.get("handle", f"cel:card:{card.compute_hash()[:16]}"), ctx)
+    pillar = _resolve_arg(cel.get("pillar", "execution_log"), ctx)
+    repo.save_card_and_handle(handle, card.compute_hash(), card.to_yaml(), pillar,
+                              timestamp=card.g_time, replace=True)
+    return card.compute_hash()
+
+
+def op_card_load(cel: dict, ctx: dict):
+    """CEL: card:load — retrieve a card by hash."""
+    from clm.cross_cutting.mcard import Card
+    card_hash = _resolve_arg(cel["hash"], ctx)
+    pillar = _resolve_arg(cel.get("pillar", "execution_log"), ctx)
+    content = _resolve_card_content(ctx, card_hash, pillar)
+    if not content:
+        raise ValueError(f"Card not found for hash: {card_hash}")
+    return Card.from_yaml(content)
+
+
+def op_handle_resolve(cel: dict, ctx: dict):
+    """CEL: handle:resolve — logical handle -> current Card."""
+    from clm.cross_cutting.mcard import Card
+    handle = _resolve_arg(cel["handle"], ctx)
+    pillar = _resolve_arg(cel.get("pillar", "execution_log"), ctx)
+    h = _resolve_handle_hash(ctx, handle, pillar)
+    if not h:
+        raise ValueError(f"Handle not registered: {handle}")
+    content = _resolve_card_content(ctx, h, pillar)
+    return Card.from_yaml(content) if content else None
+
+
+def op_handle_get_history(cel: dict, ctx: dict):
+    """CEL: handle:get_history — bitemporal version list of a handle."""
+    repo = ctx.get("repo")
+    handle = _resolve_arg(cel["handle"], ctx)
+    pillar = _resolve_arg(cel.get("pillar", "execution_log"), ctx)
+    if repo is not None and hasattr(repo, "get_handle_versions"):
+        return repo.get_handle_versions(handle, pillar)
+    raw = ctx["db"].execute(pillar,
+        "SELECT previous_hash, changed_at FROM handle_history WHERE handle = ? ORDER BY changed_at ASC;",
+        [handle])
+    history = []
+    for line in (raw or "").strip().split("\n"):
+        if not line.strip():
+            continue
+        prev, changed = line.split("|", 1)
+        history.append({"hash": prev, "changed_at": changed})
+    return history

clm/cross_cutting/cel_ops_files.py

@@ -0,0 +1,99 @@
+"""CEL environment and file ops (Sprint 133.2).
+
+Extracted from ``cel_ops.py``. Operations for env vars, file I/O, and
+subprocess test execution — all routed through EffectRegistry when available.
+"""
+import os
+import shutil
+
+from clm.cross_cutting.cel_engine import _evaluate_cel, _resolve_arg
+
+
+def op_write_file(cel: dict, ctx: dict):
+    path = _resolve_arg(cel["path"], ctx)
+    content = _resolve_arg(cel["content"], ctx)
+    effects = ctx.get("effects")
+    if effects is not None:
+        return effects.execute("write_file", path, content)
+    return ctx["write_file"](path, content)
+
+
+def op_set_env(cel: dict, ctx: dict):
+    var = cel["var"]
+    value = str(_resolve_arg(cel["value"], ctx))
+    effects = ctx.get("effects")
+    if effects is not None:
+        effects.execute("set_env", var, value)
+        return True
+    os.environ[var] = value
+    return True
+
+
+def op_unset_env(cel: dict, ctx: dict):
+    var = cel["var"]
+    effects = ctx.get("effects")
+    if effects is not None:
+        effects.execute("unset_env", var)
+        return True
+    os.environ.pop(var, None)
+    return True
+
+
+def op_sleep(cel: dict, ctx: dict):
+    import time
+    seconds = float(cel["seconds"])
+    time.sleep(seconds)
+    return True
+
+
+def op_read_file(cel: dict, ctx: dict):
+    path = _resolve_arg(cel["path"], ctx)
+    with open(path, encoding="utf-8") as f:
+        return f.read()
+
+
+def op_copy_file(cel: dict, ctx: dict):
+    src = _resolve_arg(cel["src"], ctx)
+    dest = _resolve_arg(cel["dest"], ctx)
+    effects = ctx.get("effects")
+    if effects is not None:
+        return effects.execute("copy_file", src, dest)
+    shutil.copy(src, dest)
+    return True
+
+
+def op_run_test_suite(cel: dict, ctx: dict):
+    test_file = _resolve_arg(cel["test_file"], ctx)
+    test_path = os.path.join(ctx.get("clm_root", ""), test_file)
+    env = {k: str(_resolve_arg(v, ctx)) for k, v in cel.get("env", {}).items()}
+    timeout = cel.get("timeout", 300)
+    effects = ctx.get("effects")
+    if effects is not None:
+        return effects.execute("run_test_suite", test_path, ctx.get("clm_root", ""), env, timeout)
+    import subprocess
+
+    from clm.cross_cutting._test_runner import build_test_command
+    cmd_env = os.environ.copy()
+    cmd_env.update(env)
+    cmd = build_test_command(test_path, ctx.get("clm_root", ""))
+    proc = subprocess.Popen(cmd, env=cmd_env, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+    try:
+        proc.communicate(timeout=timeout)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        proc.communicate()
+    return proc.returncode
+
+
+def op_capture_output(cel: dict, ctx: dict):
+    import io
+    from contextlib import redirect_stderr, redirect_stdout
+    stream = cel.get("stream", "stdout")
+    buf = io.StringIO()
+    if stream == "stderr":
+        with redirect_stderr(buf):
+            _evaluate_cel(cel["operation"], ctx)
+    else:
+        with redirect_stdout(buf):
+            _evaluate_cel(cel["operation"], ctx)
+    return buf.getvalue()

clm/cross_cutting/cel_ops_state.py

@@ -0,0 +1,71 @@
+"""CEL state and data-structure ops (Sprint 133.2).
+
+Extracted from ``cel_ops.py``. Operations for storing/retrieving values,
+accessing dict/list elements, and type inspection.
+"""
+import json
+
+from clm.cross_cutting.cel_engine import _evaluate_cel, _resolve_arg
+
+
+def op_value_ref(cel: dict, ctx: dict):
+    name = cel["name"]
+    return ctx.get(name, name)
+
+
+def op_store(cel: dict, ctx: dict):
+    key = cel["key"]
+    value = _resolve_arg(cel["value"], ctx)
+    ctx["store"](key, value)
+    return value
+
+
+def op_retrieve(cel: dict, ctx: dict):
+    return ctx["retrieve"](cel["key"])
+
+
+def op_dict_get(cel: dict, ctx: dict):
+    value = _resolve_arg(cel["value"], ctx)
+    key = _resolve_arg(cel["key"], ctx)
+    default = _resolve_arg(cel.get("default"), ctx) if "default" in cel else None
+    return value.get(key, default) if isinstance(value, dict) else value[key]
+
+
+def op_index(cel: dict, ctx: dict):
+    value = _resolve_arg(cel["value"], ctx)
+    position = int(_resolve_arg(cel["position"], ctx))
+    return value[position]
+
+
+def op_len(cel: dict, ctx: dict):
+    value = _resolve_arg(cel["value"], ctx)
+    return len(value)
+
+
+def op_not_null(cel: dict, ctx: dict):
+    return _resolve_arg(cel["value"], ctx) is not None
+
+
+def op_callable_check(cel: dict, ctx: dict):
+    return callable(_resolve_arg(cel["value"], ctx))
+
+
+def op_json_parse(cel: dict, ctx: dict):
+    return json.loads(_resolve_arg(cel["value"], ctx))
+
+
+def op_int_cast(cel: dict, ctx: dict):
+    return int(_resolve_arg(cel["value"], ctx))
+
+
+def op_or_fallback(cel: dict, ctx: dict):
+    value = _resolve_arg(cel["value"], ctx)
+    fallback = _resolve_arg(cel["fallback"], ctx)
+    return value if value else fallback
+
+
+def op_sequence(cel: dict, ctx: dict):
+    result = None
+    for step in cel["steps"]:
+        result = _evaluate_cel(step, ctx)
+    return result if result is not None else True