core-runtime 0.1.1__py3-none-any.whl

will/workers/violation_remediator_proposal.py

@@ -0,0 +1,328 @@
+# src/will/workers/violation_remediator_proposal.py
+"""
+Proposal creation, active-proposal dedup index, and circuit-breaker
+gate for ViolationRemediatorWorker.
+
+Collaborator module. Owns three operations that ViolationRemediatorWorker
+calls from its run loop:
+
+- create_proposal: build a Proposal from a (ref_id, ref_kind, findings) group,
+  validate it, persist via ProposalRepository, auto-approve through
+  ProposalStateManager when risk classification says safe, and return the
+  proposal_id. Safe proposals land in APPROVED status so the consumer worker
+  can pick them up without a separate human approval step (ADR-035 D1;
+  per-finding scope keyed by (action_id, file_path) for atomic actions, or
+  by flow_id alone for flows).
+- get_active_proposal_id_by_action_file: load all proposals in active states
+  ({DRAFT, PENDING, APPROVED, EXECUTING}) and return a
+  (ref_id, file_path) → proposal_id map keyed for the dedup-subsume check
+  (ADR-035 D2). Earliest by Proposal.created_at wins — the original anchor
+  whose existence caused subsequent dedup-subsume decisions. The dedup-
+  subsume path records the subsuming proposal_id on the resolved finding's
+  payload as the audit linkage (URS Q1.F / ADR-015 D4).
+- check_circuit_breaker: opens a short-lived session and returns the
+  ADR-038 consecutive-identical-failure streak count for a
+  (ref_id, file_path) before the next proposal is minted. Fail-soft on
+  DB error: returns (0, None, None, None) so the breaker degrades
+  toward retry rather than silent rejection on transient infra.
+
+Implements:
+  ADR-035 — per-finding proposal scoping (one proposal per (action, file))
+  ADR-010 — Finding→Proposal linkage on the happy path
+  ADR-038 — circuit-breaker context (this module produces the proposal that
+            the breaker counts failures on; the trip itself lives in
+            circuit_breaker.py)
+
+Dependencies are acquired lazily inside each function via the body service
+registry — same pattern as proposal_consumer_revival.mark_proposal_failed,
+which is the precedent for proposal-row mutations from a will collaborator
+module. No file writes, no LLM calls. No Worker reference required —
+nothing in this module posts to the blackboard.
+
+LAYER: will/workers — internal collaborator of ViolationRemediatorWorker.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from shared.logger import getLogger
+from will.autonomy.proposal import (
+    Proposal,
+    ProposalAction,
+    ProposalScope,
+    ProposalStatus,
+)
+from will.workers.circuit_breaker import recent_consecutive_identical_count
+
+
+logger = getLogger(__name__)
+
+
+_ACTIVE_STATUSES: frozenset[ProposalStatus] = frozenset(
+    {
+        ProposalStatus.DRAFT,
+        ProposalStatus.PENDING,
+        ProposalStatus.APPROVED,
+        ProposalStatus.EXECUTING,
+    }
+)
+
+
+def _entry_id(finding: dict[str, Any]) -> str:
+    """Extract the blackboard-entry id from a finding dict.
+
+    Findings arriving from BlackboardService carry either 'id' or 'entry_id'
+    depending on the serialization path; both are accepted. Raises
+    ValueError if neither is present.
+    """
+    value = finding.get("id") or finding.get("entry_id")
+    if value is None:
+        raise ValueError(f"Finding has neither 'id' nor 'entry_id': {finding!r}")
+    return str(value)
+
+
+# ID: f922189d-4c9d-478b-ab6f-6bf179221773
+async def create_proposal(
+    ref_id: str,
+    ref_kind: str,
+    findings: list[dict[str, Any]],
+) -> str | None:
+    """Create and persist a Proposal for the given remediation reference.
+
+    ref_kind selects the ProposalAction shape: "action" produces
+    ProposalAction(action_id=ref_id, ...) and "flow" produces
+    ProposalAction(flow_id=ref_id, ...). The two are mutually exclusive
+    per ProposalAction.__post_init__.
+
+    Safe proposals (approval_required=False) are auto-approved through
+    ProposalStateManager so the row carries approval_authority
+    (URS NFR.5; ADR-015 D6) and the consumer worker can execute without
+    a separate approval step. Proposals requiring human approval stay
+    in DRAFT.
+
+    Returns proposal_id on success, None on validation or persistence
+    failure.
+    """
+    from body.services.service_registry import service_registry
+    from will.autonomy.proposal_repository import ProposalRepository
+    from will.autonomy.proposal_state_manager import ProposalStateManager
+
+    affected_files: list[str] = sorted(
+        {
+            f["payload"].get("file_path", "")
+            for f in findings
+            if f["payload"].get("file_path")
+        }
+    )
+
+    rules = sorted(
+        {
+            f["payload"].get("check_id") or f["payload"].get("rule", "unknown")
+            for f in findings
+        }
+    )
+
+    # finding_ids mirrors the entry_ids subsequently passed to
+    # defer_to_proposal in the worker run loop, making the proposal→finding
+    # read path symmetric with the finding→proposal write path. Consumed
+    # by ProposalExecutor when emitting consequence-log entries
+    # (proposal_executor.py:265-266). ADR-015 D7: forward-only — historical
+    # proposals predating this field are not backfilled.
+    finding_ids = [_entry_id(f) for f in findings]
+
+    # ADR-032+: omit file_path from parameters when the ref is a flow.
+    # Flows are codebase-wide operations; per-file file_path is a category
+    # mismatch. ADR-033's parameter-routing filter discards it at runtime,
+    # but persisting meaningless data here is confusing. Atomic actions
+    # keep file_path because ADR-035 makes (action_id, file_path) the
+    # proposal scope unit.
+    if affected_files:
+        proposal_actions = [
+            ProposalAction(
+                action_id=ref_id if ref_kind == "action" else None,
+                flow_id=ref_id if ref_kind == "flow" else None,
+                parameters=(
+                    {"write": True, "file_path": file_path}
+                    if ref_kind == "action"
+                    else {"write": True}
+                ),
+                order=order,
+            )
+            for order, file_path in enumerate(affected_files)
+        ]
+    else:
+        proposal_actions = [
+            ProposalAction(
+                action_id=ref_id if ref_kind == "action" else None,
+                flow_id=ref_id if ref_kind == "flow" else None,
+                parameters=(
+                    {"write": True, "file_path": None}
+                    if ref_kind == "action"
+                    else {"write": True}
+                ),
+                order=0,
+            )
+        ]
+
+    proposal = Proposal(
+        goal=(
+            f"Autonomous remediation: {ref_id} "
+            f"({len(findings)} violation(s) — rules: {', '.join(rules)})"
+        ),
+        actions=proposal_actions,
+        scope=ProposalScope(files=affected_files),
+        created_by="violation_remediator_worker",
+        constitutional_constraints={
+            "source": "blackboard_findings",
+            "rules": rules,
+            "affected_files_count": len(affected_files),
+            "finding_ids": finding_ids,
+        },
+    )
+
+    proposal.compute_risk()
+
+    is_valid, errors = proposal.validate()
+    if not is_valid:
+        logger.warning(
+            "ViolationRemediatorWorker: proposal for '%s' failed validation: %s",
+            ref_id,
+            errors,
+        )
+        return None
+
+    try:
+        async with service_registry.session() as session:
+            repo = ProposalRepository(session)
+            proposal_id = await repo.create(proposal)
+
+            if not proposal.approval_required:
+                state_manager = ProposalStateManager(session)
+                await state_manager.approve(
+                    proposal_id,
+                    approved_by="autonomous_self_promote",
+                    approval_authority="risk_classification.safe_auto_approval",
+                )
+                logger.info(
+                    "ViolationRemediatorWorker: proposal for '%s' auto-approved "
+                    "(risk=%s, approval_required=False)",
+                    ref_id,
+                    proposal.risk.overall_risk if proposal.risk else "unknown",
+                )
+            else:
+                logger.info(
+                    "ViolationRemediatorWorker: proposal for '%s' requires human "
+                    "approval (risk=%s) — created in DRAFT",
+                    ref_id,
+                    proposal.risk.overall_risk if proposal.risk else "unknown",
+                )
+
+            await session.commit()
+        return proposal_id
+    except Exception as e:
+        logger.error(
+            "ViolationRemediatorWorker: failed to persist proposal for '%s': %s",
+            ref_id,
+            e,
+        )
+        return None
+
+
+# ID: 18141610-fad9-423f-9b8f-cc81c6028f40
+async def get_active_proposal_id_by_action_file() -> dict[tuple[str, str | None], str]:
+    """Return (ref_id, file_path) → proposal_id for active proposals — ADR-035 D2.
+
+    Per-finding scoping (ADR-035 D1) makes the dedup unit (ref_id,
+    file_path), not ref_id alone. ref_id is action.action_id for atomic-
+    action proposals or action.flow_id for flow-based proposals.
+    file_path lives on action.parameters. The dedup-subsume path needs
+    the proposal_id (not just the ref_id) to record the linkage in the
+    subsumed finding's payload — URS Q1.F / ADR-015 D4.
+
+    Historical batch proposals (pre-ADR-035) with multiple ProposalActions
+    across different file_paths are handled correctly: each action
+    contributes its own (ref_id, file_path) entry.
+
+    When multiple active proposals share a (ref_id, file_path), the
+    earliest by Proposal.created_at wins — the original anchor whose
+    existence caused subsequent dedup-subsume decisions.
+
+    Fail-open: on exception returns an empty dict so the worker
+    proceeds without dedup rather than blocking remediation.
+    """
+    from body.services.service_registry import service_registry
+    from will.autonomy.proposal_repository import ProposalRepository
+
+    candidates: list[tuple[tuple[str, str | None], str, Any]] = []
+    try:
+        async with service_registry.session() as session:
+            repo = ProposalRepository(session)
+            for status in _ACTIVE_STATUSES:
+                proposals = await repo.list_by_status(status, limit=200)
+                for proposal in proposals:
+                    for action in proposal.actions:
+                        action_file_path = (
+                            action.parameters.get("file_path")
+                            if action.parameters
+                            else None
+                        )
+                        candidates.append(
+                            (
+                                (action.ref_id, action_file_path),
+                                proposal.proposal_id,
+                                proposal.created_at,
+                            )
+                        )
+    except Exception as e:
+        logger.warning(
+            "ViolationRemediatorWorker: could not load active proposals (%s). "
+            "Proceeding without deduplication.",
+            e,
+        )
+        return {}
+
+    candidates.sort(key=lambda t: t[2])
+    result: dict[tuple[str, str | None], str] = {}
+    for key, proposal_id, _created_at in candidates:
+        result.setdefault(key, proposal_id)
+    return result
+
+
+# ID: 856e5070-2566-4a25-be09-4c9ae9cf6964
+async def check_circuit_breaker(
+    *,
+    ref_id: str,
+    ref_kind: str,
+    file_path: str | None,
+    config: Any,
+) -> tuple[int, str | None, str | None, str | None]:
+    """ADR-038 consecutive-identical-failure streak for (ref_id, file_path).
+
+    Opens its own short-lived session so the breaker query does not
+    extend the lifetime of the ProposalRepository session that backs
+    create_proposal. Fail-soft: any DB error returns (0, None, None, None)
+    so the breaker degrades toward retry rather than silent rejection on
+    transient infra issues.
+    """
+    from body.services.service_registry import service_registry
+
+    try:
+        async with service_registry.session() as session:
+            return await recent_consecutive_identical_count(
+                session,
+                ref_id=ref_id,
+                ref_kind=ref_kind,
+                file_path=file_path,
+                config=config,
+            )
+    except Exception as exc:
+        logger.warning(
+            "ViolationRemediatorWorker: circuit-breaker session failed for "
+            "(%s, %s, %s): %s — proceeding without gate.",
+            ref_kind,
+            ref_id,
+            file_path,
+            exc,
+        )
+        return 0, None, None, None

will/workers/worker_shop_manager.py

@@ -0,0 +1,244 @@
+# src/will/workers/worker_shop_manager.py
+"""
+WorkerShopManager - Worker Liveness Supervisory Worker.
+
+Responsibility: Detect workers that have missed their declared heartbeat
+schedule and post a finding to the Blackboard for each silent or abandoned
+worker.
+
+Constitutional standing:
+- Declaration:      .intent/workers/worker_shop_manager.yaml
+- Class:            supervision
+- Phase:            audit
+- Permitted tools:  none — deterministic DB reads only
+- Approval:         false — findings are observations only
+- Schedule:         max_interval=120s, glide_off=12s (10% default)
+
+Self-scheduling: WorkerShopManager manages its own asyncio loop via run_loop().
+Sanctuary starts run_loop() once on bootstrap.
+
+LAYER: will/workers — supervisory worker. Reads worker_registry, reads
+.intent/workers/ declarations for scheduled workers. Writes to Blackboard
+only. No LLM. No file writes.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import re
+import time
+from typing import Any
+
+from shared.infrastructure.intent.operational_config import load_operational_config
+from shared.logger import getLogger
+from shared.workers.base import Worker
+from shared.workers.schedule import (
+    WorkerScheduleState,
+    load_worker_schedule_state,
+)
+
+
+logger = getLogger(__name__)
+
+_FINDING_SUBJECT = "worker.silent"
+
+_CFG = load_operational_config().workers.worker_shop
+
+# Strip non-ASCII characters that PostgreSQL SQL_ASCII encoding cannot store.
+# Worker names from .intent/workers/ YAML titles may contain Unicode dashes or
+# other decorative characters that cause UntranslatableCharacterError on insert.
+_NON_ASCII_RE = re.compile(r"[^\x09\x0A\x0D\x20-\x7E]")
+
+
+def _sanitize(value: str) -> str:
+    """Replace non-ASCII characters with '?' for SQL_ASCII database safety."""
+    if not isinstance(value, str):
+        return str(value)
+    return _NON_ASCII_RE.sub("?", value)
+
+
+# ID: c3e4f5a6-b7c8-4d9e-0f1a-2b3c4d5e6f7a
+class WorkerShopManager(Worker):
+    """
+    Governance worker. Reads worker_registry, computes per-worker liveness
+    thresholds from .intent/ declarations, and posts a finding for each
+    worker that has exceeded max_interval + glide_off since last heartbeat.
+
+    Uses deduplication — does not re-post a finding for a worker already
+    flagged as silent unless the previous finding is resolved.
+    """
+
+    declaration_name = "worker_shop_manager"
+
+    def __init__(self) -> None:
+        super().__init__()
+        schedule = self._declaration.get("mandate", {}).get("schedule", {})
+        self._max_interval: int = schedule.get("max_interval", 120)
+        self._glide_off: int = schedule.get(
+            "glide_off", max(int(self._max_interval * _CFG.glide_off_multiplier), 10)
+        )
+        # Per-worker schedule state loaded once per cycle from .intent/workers/.
+        # Sourced via the shared loader (ADR-041 D4) so the dashboard and
+        # health_log_service apply the same per-worker thresholds and the same
+        # orphan-skip rule as this supervisor.
+        self._schedule_state: WorkerScheduleState = WorkerScheduleState(
+            thresholds={},
+            active_uuids=frozenset(),
+            fallback_sec=_CFG.fallback_threshold_sec,
+        )
+
+    # -------------------------------------------------------------------------
+    # Self-scheduling entry point — called once by Sanctuary
+    # -------------------------------------------------------------------------
+
+    # ID: d4f5a6b7-c8d9-4e0f-1a2b-3c4d5e6f7a8b
+    async def run_loop(self) -> None:
+        """
+        Continuous self-scheduling loop. Runs one audit cycle per
+        max_interval seconds. Sanctuary calls this once on bootstrap.
+        """
+        logger.info(
+            "WorkerShopManager: starting loop (max_interval=%ds, glide_off=%ds)",
+            self._max_interval,
+            self._glide_off,
+        )
+        await self._register()
+
+        while True:
+            cycle_start = time.monotonic()
+            try:
+                await self.run()
+            except Exception as exc:
+                logger.error("WorkerShopManager: cycle failed: %s", exc, exc_info=True)
+                try:
+                    await self._post_entry(
+                        entry_type="report",
+                        subject="worker_shop_manager.cycle_error",
+                        payload={"error": _sanitize(str(exc))},
+                        status="abandoned",
+                    )
+                except Exception:
+                    logger.exception("WorkerShopManager: failed to post error report")
+
+            elapsed = time.monotonic() - cycle_start
+            await asyncio.sleep(max(self._max_interval - elapsed, 0))
+
+    # -------------------------------------------------------------------------
+    # Single audit cycle
+    # -------------------------------------------------------------------------
+
+    # ID: e5a6b7c8-d9e0-4f1a-2b3c-4d5e6f7a8b9c
+    async def run(self) -> None:
+        """
+        Execute one liveness audit cycle:
+        1. Post heartbeat
+        2. Load per-worker schedules from .intent/
+        3. Fetch registered workers from DB
+        4. For each worker exceeding threshold: post finding (deduplicated)
+        5. Resolve open findings whose worker has resumed heartbeating
+        6. Post completion report
+        """
+        from body.services.service_registry import service_registry
+
+        await self.post_heartbeat()
+
+        self._schedule_state = load_worker_schedule_state()
+        workers = await self._fetch_registered_workers(service_registry)
+        existing = await self._fetch_existing_findings(service_registry)
+
+        flagged = 0
+        flagged_subjects: set[str] = set()
+        for worker in workers:
+            # Sanitize worker_name — registry may contain non-ASCII characters
+            # from YAML titles (e.g. em dashes). SQL_ASCII encoding rejects them.
+            worker_name = _sanitize(worker["worker_name"])
+            worker_uuid = str(worker["worker_uuid"])
+            seconds_silent = worker["seconds_silent"]
+
+            if worker_uuid not in self._schedule_state.active_uuids:
+                logger.debug(
+                    "WorkerShopManager: skipping orphan registry row "
+                    "%s (%s) — UUID not declared in any active worker YAML",
+                    worker_uuid,
+                    worker_name,
+                )
+                continue
+
+            threshold = self._schedule_state.thresholds.get(
+                worker_uuid, _CFG.fallback_threshold_sec
+            )
+
+            if seconds_silent > threshold:
+                subject = f"{_FINDING_SUBJECT}::{worker_uuid}"
+                flagged_subjects.add(subject)
+                if subject in existing:
+                    logger.debug(
+                        "WorkerShopManager: %s already flagged, skipping.", worker_name
+                    )
+                    continue
+
+                await self.post_observation(
+                    subject=subject,
+                    payload={
+                        "worker_name": worker_name,
+                        "worker_uuid": worker_uuid,
+                        "seconds_silent": seconds_silent,
+                        "threshold": threshold,
+                    },
+                    status="abandoned",
+                )
+                flagged += 1
+                logger.warning(
+                    "WorkerShopManager: %s silent for %ds (threshold=%ds)",
+                    worker_name,
+                    seconds_silent,
+                    threshold,
+                )
+
+        # Resolution pass — any open worker.silent finding whose subject is
+        # no longer over threshold means the worker has resumed heartbeating.
+        svc = await service_registry.get_blackboard_service()
+        resolved = 0
+        for subject, entry_id in existing.items():
+            if subject not in flagged_subjects:
+                await svc.resolve_entries([entry_id])
+                resolved += 1
+                logger.info(
+                    "WorkerShopManager: %s recovered — resolving open finding",
+                    subject,
+                )
+
+        await self.post_report(
+            subject="worker_shop_manager.run.complete",
+            payload={
+                "workers_checked": len(workers),
+                "flagged": flagged,
+                "resolved": resolved,
+            },
+        )
+        logger.info(
+            "WorkerShopManager: cycle complete — checked=%d flagged=%d resolved=%d",
+            len(workers),
+            flagged,
+            resolved,
+        )
+
+    # -------------------------------------------------------------------------
+    # DB reads
+    # -------------------------------------------------------------------------
+
+    async def _fetch_registered_workers(self, registry: Any) -> list[dict[str, Any]]:
+        """Return all active workers with seconds since last heartbeat."""
+        svc = await registry.get_worker_registry_service()
+        return await svc.fetch_registered_workers()
+
+    async def _fetch_existing_findings(self, registry: Any) -> dict[str, str]:
+        """
+        Return mapping of subject → entry_id for open worker.silent findings.
+
+        The entry_id is needed so the resolution pass in run() can call
+        resolve_entries() on findings whose worker has recovered.
+        """
+        svc = await registry.get_blackboard_service()
+        rows = await svc.fetch_open_findings(prefix=f"{_FINDING_SUBJECT}::%", limit=200)
+        return {row["subject"]: row["id"] for row in rows}

will/workflows/__init__.py

@@ -0,0 +1,23 @@
+# src/will/workflows/__init__.py
+"""
+Workflow Orchestrators - Constitutional Composition
+
+Workflows compose atomic actions into governed, multi-phase operations.
+Each workflow has:
+- Declared goal
+- Organized phases
+- Structured results
+- Full audit trail
+- Constitutional validation
+"""
+
+from __future__ import annotations
+
+from shared.models.workflow_models import WorkflowResult
+from will.workflows.dev_sync_workflow import DevSyncWorkflow
+
+
+__all__ = [
+    "DevSyncWorkflow",
+    "WorkflowResult",
+]