core-runtime-engine 11.5.1__py3-none-any.whl

core_runtime/core/contract_program.py

@@ -0,0 +1,131 @@
+"""Closed deterministic replay for the public validation-only contract language."""
+
+from __future__ import annotations
+
+import copy
+from collections.abc import Mapping
+from typing import Any, TypedDict
+
+from core_runtime.core.canonicalization import canonical_json_hash
+from core_runtime.core.contract_evaluator import evaluate_contract_payload, input_fingerprint
+from core_runtime.core.contract_program_registry import execute_registry_operation
+
+
+class ContractProgramExecution(TypedDict):
+    schema: str
+    status: str
+    authority: str
+    execution_authorized: bool
+    state_application_authorized: bool
+    program_fingerprint: str
+    input_fingerprint: str
+    emitted: list[dict[str, Any]]
+    staged_transitions: list[dict[str, str]]
+    errors: list[dict[str, str]]
+    execution_fingerprint: str
+
+
+def _error(code: str, message: str, field: str) -> dict[str, str]:
+    return {"code": code, "message": message, "field": field}
+
+
+def execute_contract_program(program: Mapping[str, Any], sealed_inputs: Mapping[str, Any]) -> ContractProgramExecution:
+    """Replay one closed program against caller-supplied sealed inputs.
+
+    This function neither reads external state nor applies transitions. A transition
+    instruction only records a candidate transition in the result for a separate,
+    explicitly authorized system to evaluate.
+    """
+
+    program_payload = copy.deepcopy(dict(program))
+    evaluation = evaluate_contract_payload(program_payload)
+    execution: dict[str, Any] = {
+        "schema": "core.contract_program_execution.v1",
+        "status": "rejected" if evaluation["status"] != "passed" else "passed",
+        "authority": "validation_only",
+        "execution_authorized": False,
+        "state_application_authorized": False,
+        "program_fingerprint": str(program_payload.get("fingerprint", "")),
+        "input_fingerprint": input_fingerprint(dict(sealed_inputs)),
+        "emitted": [],
+        "staged_transitions": [],
+        "errors": [],
+    }
+    if evaluation["status"] != "passed":
+        execution["errors"] = [
+            {"code": str(item["code"]), "message": str(item["message"]), "field": str(item["field"])}
+            for item in evaluation["errors"]
+        ]
+    else:
+        values: dict[str, Any] = {}
+        max_items = int(program_payload["limits"]["max_items"])
+        for index, instruction in enumerate(program_payload["instructions"]):
+            opcode = instruction["opcode"]
+            field = f"instructions[{index}]"
+            if opcode == "load":
+                key = instruction["key"]
+                if key not in sealed_inputs:
+                    execution["status"] = "insufficient_data"
+                    execution["errors"].append(_error("sealed_input_missing", "Required sealed input is absent.", f"{field}.key"))
+                    break
+                values[instruction["output"]] = copy.deepcopy(sealed_inputs[key])
+            elif opcode == "assert":
+                key = instruction["key"]
+                if key not in sealed_inputs:
+                    execution["status"] = "insufficient_data"
+                    execution["errors"].append(_error("sealed_input_missing", "Required sealed input is absent.", f"{field}.key"))
+                    break
+                if sealed_inputs[key] != instruction["equals"]:
+                    execution["status"] = "blocked"
+                    execution["errors"].append(_error("assertion_failed", "Sealed input does not match the declared assertion.", f"{field}.equals"))
+                    break
+            elif opcode == "derive":
+                keys = instruction["input_keys"]
+                if any(key not in values for key in keys):
+                    execution["status"] = "blocked"
+                    execution["errors"].append(_error("derived_input_missing", "Derivation requires a prior output key.", f"{field}.input_keys"))
+                    break
+                if instruction["operation"] == "copy":
+                    values[instruction["output"]] = copy.deepcopy(values[keys[0]])
+                elif instruction["operation"] == "registry":
+                    try:
+                        values[instruction["output"]] = execute_registry_operation(
+                            str(instruction["registry_key"]),
+                            [values[key] for key in keys],
+                        )
+                    except (KeyError, TypeError, ValueError) as exc:
+                        execution["status"] = "blocked"
+                        execution["errors"].append(
+                            _error("registry_operation_rejected", str(exc), f"{field}.registry_key")
+                        )
+                        break
+                else:
+                    values[instruction["output"]] = len(keys)
+            elif opcode == "transition":
+                execution["staged_transitions"].append(
+                    {
+                        "transition_id": instruction["transition_id"],
+                        "before_ref": instruction["before_ref"],
+                        "after_ref": instruction["after_ref"],
+                        "reversibility_class": instruction["reversibility_class"],
+                    }
+                )
+            elif opcode == "emit":
+                key = instruction["value_key"]
+                if key not in values:
+                    execution["status"] = "blocked"
+                    execution["errors"].append(_error("emitted_value_missing", "Emit requires a prior output key.", f"{field}.value_key"))
+                    break
+                execution["emitted"].append({"code": instruction["code"], "value": copy.deepcopy(values[key])})
+            elif opcode == "halt":
+                execution["status"] = instruction["status"]
+
+            if len(values) > max_items:
+                execution["status"] = "blocked"
+                execution["errors"].append(_error("runtime_item_limit_exceeded", "Runtime output count exceeds max_items.", "limits.max_items"))
+                break
+
+    if execution["status"] != "passed":
+        execution["staged_transitions"] = []
+    execution["execution_fingerprint"] = f"sha256:{canonical_json_hash(execution)}"
+    return execution  # type: ignore[return-value]

core_runtime/core/contract_program_registry.py

@@ -0,0 +1,104 @@
+"""Finite registry-only operations for the isolated ContractProgram fork.
+
+This module deliberately exposes a small, versioned operation surface.  It is
+not a dynamic evaluator and it never loads executable configuration from a
+declaration.
+"""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Mapping, Sequence
+from typing import Any
+
+REGISTRY_VERSION = "core.contract_program.registry.v1"
+REGISTRY_KEYS = frozenset(
+    {
+        "rank.quantity.v1",
+        "member.scale_adapter.v1",
+        "regex.grammar_context.v1",
+    }
+)
+OPERATION_ALLOWLIST = frozenset(
+    {
+        "equals",
+        "distinct_count",
+        "is_nonempty_string",
+        "rank_of",
+        "min_of",
+        "compare",
+        "logical_and",
+        "logical_or",
+        "logical_not",
+        "member_of",
+        "regex_match",
+    }
+)
+FORBIDDEN_CONSTRUCTS = frozenset(
+    {"loop", "branch", "jump", "dynamic_import", "eval", "callback", "inline_policy"}
+)
+
+_GRAMMARS = {
+    "qualified_ref": re.compile(r"^[a-z][a-z0-9_.-]{2,}:[^\s]{3,}$", re.IGNORECASE),
+    "identifier": re.compile(r"^[A-Za-z][A-Za-z0-9_.-]{0,127}$"),
+}
+
+
+class RegistryOperationError(ValueError):
+    """Raised when a candidate requests an operation outside the registry."""
+
+
+def _require_arity(inputs: Sequence[Any], expected: int) -> None:
+    if len(inputs) != expected:
+        raise RegistryOperationError(f"registry operation requires {expected} inputs")
+
+
+def execute_registry_operation(registry_key: str, inputs: Sequence[Any]) -> Any:
+    """Execute one deterministic, allowlisted registry operation."""
+
+    if registry_key not in REGISTRY_KEYS:
+        raise RegistryOperationError(f"unknown registry key: {registry_key!r}")
+    if not isinstance(inputs, Sequence) or isinstance(inputs, (str, bytes)):
+        raise RegistryOperationError("registry inputs must be a finite sequence")
+
+    if registry_key == "rank.quantity.v1":
+        _require_arity(inputs, 1)
+        value = inputs[0]
+        if isinstance(value, bool) or not isinstance(value, int) or value < 0:
+            raise RegistryOperationError("quantity rank must be a non-negative integer")
+        return value
+
+    if registry_key == "member.scale_adapter.v1":
+        _require_arity(inputs, 4)
+        adapter_from, adapter_to, requested_from, requested_to = inputs
+        return adapter_from == requested_from and adapter_to == requested_to
+
+    _require_arity(inputs, 2)
+    value, grammar_name = inputs
+    if not isinstance(value, str) or not isinstance(grammar_name, str):
+        return False
+    grammar = _GRAMMARS.get(grammar_name)
+    if grammar is None:
+        raise RegistryOperationError(f"unknown grammar context: {grammar_name!r}")
+    return bool(grammar.fullmatch(value))
+
+
+def validate_registry_program(program: Mapping[str, Any]) -> list[str]:
+    """Return deterministic profile errors for a candidate program."""
+
+    errors: list[str] = []
+    instructions = program.get("instructions", [])
+    if not isinstance(instructions, list):
+        return ["instructions must be a list"]
+    for index, instruction in enumerate(instructions):
+        if not isinstance(instruction, Mapping):
+            errors.append(f"instructions[{index}] is not an object")
+            continue
+        for key in FORBIDDEN_CONSTRUCTS:
+            if key in instruction:
+                errors.append(f"forbidden construct {key!r} at instructions[{index}]")
+        if instruction.get("opcode") == "derive" and instruction.get("operation") == "registry":
+            registry_key = instruction.get("registry_key")
+            if registry_key not in REGISTRY_KEYS:
+                errors.append(f"unknown registry key at instructions[{index}]")
+    return errors

core_runtime/core/contract_program_v2.py

@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+"""ContractProgram v2 — Contract-Oriented Reproducible Evaluation.
+
+Traverses 6 eslabones (PERFIL→VOCABULARIO→QUERYSPEC→RESULTADO→VISTA→EVIDENCIA),
+validates DSK declarations at each crossing, emits one of 9 verdicts.
+
+Deterministic. No LLM. Same input → same verdict.
+"""
+from __future__ import annotations
+import hashlib, json, sys
+from typing import Any
+
+SCHEMA_VERSION = "core.contract_program.v2"
+ESLABONES = ["PERFIL", "VOCABULARIO", "QUERYSPEC", "RESULTADO", "VISTA", "EVIDENCIA"]
+VERDICTS = [
+    "pass", "incomplete", "scale_violation", "authority_violation",
+    "loss_undeclared", "temporal_violation", "translation_missing",
+    "intent_unconfirmed", "aborted"
+]
+
+
+def evaluate_contract_v2(contract: dict[str, Any]) -> dict[str, Any]:
+    """Evaluate a ContractProgram v2 contract. Returns verdict + findings."""
+    findings: list[dict[str, str]] = []
+
+    # Validate structure
+    eslabones = contract.get("eslabones", [])
+    if len(eslabones) != 6:
+        findings.append({"eslabon": "ALL", "code": "incomplete", "detail": f"expected 6 eslabones, got {len(eslabones)}"})
+        return _result(contract, "incomplete", findings)
+
+    # Check order and names
+    for i, expected_name in enumerate(ESLABONES):
+        eslabon = eslabones[i] if i < len(eslabones) else {}
+        name = eslabon.get("name", "")
+        if name != expected_name:
+            findings.append({"eslabon": f"order_{i}", "code": "incomplete",
+                            "detail": f"position {i} expected {expected_name}, got {name}"})
+
+    if any(f["code"] == "incomplete" for f in findings):
+        return _result(contract, "incomplete", findings)
+
+    # Validate DSK declarations at each crossing
+    for eslabon in eslabones:
+        name = eslabon.get("name", "")
+        dsk = eslabon.get("dsk_declaration", {})
+
+        # Check composition_rule
+        if not dsk.get("composition_rule"):
+            findings.append({"eslabon": name, "code": "scale_violation",
+                            "detail": "missing composition_rule"})
+
+        # Check declared_loss
+        loss = dsk.get("declared_loss", {})
+        if not loss.get("properties") or not loss.get("evidence_refs"):
+            findings.append({"eslabon": name, "code": "loss_undeclared",
+                            "detail": "declared_loss missing properties or evidence_refs"})
+
+        # Check authority_ceiling
+        auth = dsk.get("authority_ceiling", "")
+        if auth not in ("reference_only", "advisory_only", "domain_authoritative", "externally_validated"):
+            findings.append({"eslabon": name, "code": "authority_violation",
+                            "detail": f"invalid authority_ceiling: {auth}"})
+
+        # Check temporal_invariant if present
+        ti = dsk.get("temporal_invariant")
+        if ti is not None:
+            if not ti.get("captured_at") or not ti.get("valid_until"):
+                findings.append({"eslabon": name, "code": "temporal_violation",
+                                "detail": "temporal_invariant missing captured_at or valid_until"})
+
+        # Check translation_map if present
+        tm = dsk.get("translation_map")
+        if tm is not None:
+            if not tm.get("source_field") or not tm.get("target_field"):
+                findings.append({"eslabon": name, "code": "translation_missing",
+                                "detail": "translation_map missing source_field or target_field"})
+
+        # Check paraphrase_intent if present
+        pi = dsk.get("paraphrase_intent")
+        if pi is not None:
+            if pi.get("confirmed_by") not in ("operator", "agent"):
+                findings.append({"eslabon": name, "code": "intent_unconfirmed",
+                                "detail": f"paraphrase_intent.confirmed_by={pi.get('confirmed_by')!r} invalid"})
+            elif pi.get("confirmed_by") == "agent":
+                findings.append({"eslabon": name, "code": "intent_unconfirmed",
+                                "detail": "paraphrase_intent.confirmed_by=agent (not operator)"})
+
+    # Determine verdict from findings
+    if not findings:
+        verdict = "pass"
+    else:
+        # First non-pass finding determines verdict
+        verdict = findings[0]["code"]
+        if verdict not in VERDICTS:
+            verdict = "aborted"
+
+    return _result(contract, verdict, findings)
+
+
+def _result(contract: dict, verdict: str, findings: list[dict]) -> dict[str, Any]:
+    payload = json.dumps(contract, sort_keys=True)
+    fp = "sha256:" + hashlib.sha256(payload.encode()).hexdigest()
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "contract_id": contract.get("contract_id", ""),
+        "verdict": verdict,
+        "findings": findings,
+        "fingerprint": fp,
+        "deterministic": True,
+        "llm_used": False,
+    }
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) < 2:
+        print("Usage: contract_program_v2.py <contract.json>", file=sys.stderr)
+        return 1
+    contract = json.load(open(argv[1]))
+    result = evaluate_contract_v2(contract)
+    print(json.dumps(result, indent=2, sort_keys=True))
+    return 0 if result["verdict"] == "pass" else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

core_runtime/core/dsk_v3.py

@@ -0,0 +1,142 @@
+"""Deterministic Scale Kernel v3 evaluator.
+
+The kernel validates one typed scale crossing. It never calls a provider,
+consults a domain or increases the authority declared by the input.
+"""
+
+from __future__ import annotations
+
+import json
+from decimal import Decimal, InvalidOperation
+from importlib.resources import files
+from pathlib import Path
+from typing import Any
+
+from jsonschema import Draft7Validator
+
+from core_runtime.core.rule_anchor import canonical_fingerprint
+
+SCHEMA_VERSION = "core.dsk.v3"
+SCHEMA_PATH = files("core_runtime").joinpath("data", "schemas", "core", "dsk.v3.json")
+STATUSES = ("pass", "invalid", "insufficient_data", "blocked")
+
+
+def _error(code: str, message: str, field: str | None = None) -> dict[str, str]:
+    result = {"code": code, "message": message}
+    if field is not None:
+        result["field"] = field
+    return result
+
+
+def _decimal(value: Any) -> Decimal:
+    if isinstance(value, bool):
+        raise InvalidOperation
+    return Decimal(str(value))
+
+
+def _decimal_text(value: Decimal) -> str:
+    if value == 0:
+        return "0"
+    return format(value.normalize(), "f")
+
+
+def _decimal_places(value: Decimal) -> int:
+    text = _decimal_text(value)
+    return len(text.partition(".")[2])
+
+
+def _envelope(payload: dict[str, Any], status: str, errors: list[dict[str, str]], **extra: Any) -> dict[str, Any]:
+    result: dict[str, Any] = {
+        "schema": SCHEMA_VERSION,
+        "status": status,
+        "errors": errors,
+        "fingerprint": canonical_fingerprint(payload),
+        "deterministic": True,
+        "llm_used": False,
+    }
+    result.update(extra)
+    return result
+
+
+def _schema_errors(payload: Any) -> list[dict[str, str]]:
+    schema = json.loads(SCHEMA_PATH.read_text(encoding="utf-8"))
+    return [
+        _error("schema_validation_error", item.message, ".".join(map(str, item.absolute_path)) or "$")
+        for item in sorted(Draft7Validator(schema).iter_errors(payload), key=lambda item: list(item.absolute_path))
+    ]
+
+
+def evaluate_dsk_v3(payload: dict[str, Any]) -> dict[str, Any]:
+    """Evaluate a DSK v3 declaration and return the standard CORE envelope."""
+
+    if not isinstance(payload, dict):
+        return _envelope({}, "invalid", [_error("payload_type_invalid", "DSK input must be an object.")])
+    schema_errors = _schema_errors(payload)
+    if schema_errors:
+        return _envelope(payload, "invalid", schema_errors)
+
+    crossing = payload["crossing"]
+    source = crossing["source"]
+    target = crossing["target"]
+    conversion = crossing["conversion"]
+    authority = payload["authority"]
+    if "value" not in source:
+        return _envelope(payload, "insufficient_data", [_error("source_value_missing", "source.value is required to evaluate the crossing.", "crossing.source.value")])
+
+    errors: list[dict[str, str]] = []
+    if source["unit"] != conversion["source_unit"] or target["unit"] != conversion["target_unit"]:
+        errors.append(_error("scale_violation", "Declared conversion units do not match the crossing endpoints.", "crossing.conversion"))
+
+    ceiling = authority["ceiling"]
+    if ceiling in {"domain_authoritative", "externally_validated"} and authority["source"] != "external_validator":
+        errors.append(_error("authority_non_amplification", "A scale crossing cannot create authority without an external validator.", "authority"))
+
+    try:
+        value = _decimal(source["value"])
+        converted = value * Decimal(conversion["numerator"]) / Decimal(conversion["denominator"])
+    except (InvalidOperation, ZeroDivisionError):
+        return _envelope(payload, "invalid", [_error("numeric_value_invalid", "Numeric values must be finite and deterministic.", "crossing.source.value")])
+
+    policies = payload.get("policies", {})
+    discrete = policies.get("discrete_multiple")
+    if discrete is not None and converted % Decimal(discrete["multiple"]) != 0:
+        errors.append(_error("discrete_multiple_violation", "Converted value is not an allowed discrete multiple.", "policies.discrete_multiple"))
+
+    resolution = policies.get("resolution")
+    if resolution is not None and _decimal_places(converted) > resolution["max_decimal_places"]:
+        errors.append(_error("resolution_violation", "Converted value exceeds the declared resolution.", "policies.resolution"))
+
+    threshold = policies.get("threshold")
+    if threshold is not None and converted < Decimal(str(threshold["minimum_value"])):
+        errors.append(_error("threshold_ineligible", "Threshold eligibility was not met; no authority is created.", "policies.threshold"))
+
+    if errors:
+        return _envelope(payload, "blocked", errors, authority_ceiling=ceiling)
+
+    return _envelope(
+        payload,
+        "pass",
+        [],
+        result={
+            "resource": target["resource"],
+            "unit": target["unit"],
+            "value": _decimal_text(converted),
+            "authority_ceiling": ceiling,
+            "composition_rule": crossing["composition_rule"],
+            "declared_loss": crossing["declared_loss"],
+        },
+    )
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) != 2:
+        print("Usage: dsk_v3.py <declaration.json>", file=__import__("sys").stderr)
+        return 2
+    payload = json.loads(Path(argv[1]).read_text(encoding="utf-8"))
+    result = evaluate_dsk_v3(payload)
+    print(json.dumps(result, indent=2, ensure_ascii=False, sort_keys=True))
+    return 0 if result["status"] == "pass" else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(__import__("sys").argv))