core-runtime 0.1.1__py3-none-any.whl

body/governance/intent_pattern_validators.py

@@ -0,0 +1,197 @@
+# src/body/governance/intent_pattern_validators.py
+"""
+Legacy CLI pattern validators for IntentGuard.
+
+DISTINCTION:
+- This file: String-based validation for CLI patterns (IntentGuard usage)
+- pattern_validator.py: AST-based validation for code generation
+
+DEPRECATION NOTICE:
+These validators are hardcoded Python logic and should be migrated to
+constitutional rules with engine-based verification. They remain here
+temporarily for backward compatibility during the transition.
+
+Migration target: .intent/policies/ with ast_gate or regex_gate engines.
+"""
+
+from __future__ import annotations
+
+from mind.governance.violation_report import ViolationReport
+from shared.logger import getLogger
+
+
+logger = getLogger(__name__)
+
+
+# ID: 5d89fc56-2fb5-45da-98f0-f813e8e79343
+class PatternValidators:
+    """
+    Legacy validators for code generation patterns.
+
+    These enforce conventions for generated code:
+    - inspect_pattern: Read-only commands (no --write, --apply, --force)
+    - action_pattern: Commands with explicit write parameter
+    - check_pattern: Pure check commands (no mutations)
+    - run_pattern: Run commands with write parameter
+
+    FUTURE: Migrate to constitutional rules in .intent/policies/
+    """
+
+    @staticmethod
+    # ID: 9f1df13c-5efe-47fc-b8ac-e7236ff5e9c7
+    def validate_inspect_pattern(code: str, target_path: str) -> list[ViolationReport]:
+        """
+        Validate inspect pattern: must be read-only.
+
+        Forbidden: --write, --apply, --force flags
+        """
+        violations: list[ViolationReport] = []
+        forbidden_params = [
+            "--write",
+            "--apply",
+            "--force",
+            "write:",
+            "apply:",
+            "force:",
+        ]
+
+        for param in forbidden_params:
+            if param in code:
+                violations.append(
+                    ViolationReport(
+                        rule_name="inspect_pattern_violation",
+                        path=target_path,
+                        message=f"Inspect pattern violation: Found forbidden parameter '{param}'.",
+                        severity="error",
+                        suggested_fix=f"Remove '{param}' - inspect commands must be read-only.",
+                        source_policy="pattern_vectorization",
+                    )
+                )
+
+        return violations
+
+    @staticmethod
+    # ID: 62c418d6-754b-4e4c-9f66-f7d35f5bd590
+    def validate_action_pattern(code: str, target_path: str) -> list[ViolationReport]:
+        """
+        Validate action pattern: must have write parameter defaulting to False.
+        """
+        violations: list[ViolationReport] = []
+
+        # Must have write parameter
+        if "write:" not in code and "write =" not in code:
+            violations.append(
+                ViolationReport(
+                    rule_name="action_pattern_violation",
+                    path=target_path,
+                    message="Action pattern violation: Missing required 'write' parameter.",
+                    severity="error",
+                    suggested_fix="Add 'write: bool = False' parameter to command.",
+                    source_policy="pattern_vectorization",
+                )
+            )
+
+        # Write must default to False
+        if "write: bool = True" in code or "write=True" in code:
+            violations.append(
+                ViolationReport(
+                    rule_name="action_pattern_violation",
+                    path=target_path,
+                    message="Action pattern violation: write parameter must default to False.",
+                    severity="error",
+                    suggested_fix="Change to 'write: bool = False'.",
+                    source_policy="pattern_vectorization",
+                )
+            )
+
+        return violations
+
+    @staticmethod
+    # ID: e9e8a09b-ce90-452a-9269-ae27a95b56d4
+    def validate_check_pattern(code: str, target_path: str) -> list[ViolationReport]:
+        """
+        Validate check pattern: must not modify state.
+
+        Forbidden: write or apply parameters
+        """
+        violations: list[ViolationReport] = []
+
+        if "write:" in code or "apply:" in code:
+            violations.append(
+                ViolationReport(
+                    rule_name="check_pattern_violation",
+                    path=target_path,
+                    message="Check pattern violation: Check commands must not modify state.",
+                    severity="error",
+                    suggested_fix="Remove write/apply parameters.",
+                    source_policy="pattern_vectorization",
+                )
+            )
+
+        return violations
+
+    @staticmethod
+    # ID: 3f0486a3-59ce-4671-b07f-1a144b3d07d3
+    def validate_run_pattern(code: str, target_path: str) -> list[ViolationReport]:
+        """
+        Validate run pattern: must have write parameter.
+        """
+        violations: list[ViolationReport] = []
+
+        if "write:" not in code and "write =" not in code:
+            violations.append(
+                ViolationReport(
+                    rule_name="run_pattern_violation",
+                    path=target_path,
+                    message="Run pattern violation: Missing required 'write' parameter.",
+                    severity="error",
+                    suggested_fix="Add 'write: bool = False' parameter.",
+                    source_policy="pattern_vectorization",
+                )
+            )
+
+        return violations
+
+    @classmethod
+    # ID: 88f6ecff-74fe-469c-aa00-7fea3a8e1831
+    def validate(
+        cls,
+        code: str,
+        pattern_id: str,
+        component_type: str,
+        target_path: str = "",
+    ) -> list[ViolationReport]:
+        """Dispatch to the appropriate per-pattern validator by ``pattern_id``.
+
+        Issue #210: prior IntentGuard call invoked a method that did not
+        exist, raising AttributeError that was silently swallowed by a
+        broad except in build.tests. This classmethod is the canonical
+        entry point.
+
+        Returns an empty list when ``pattern_id`` does not correspond to
+        any per-pattern validator (e.g. ``"test_file"``). That is a
+        deliberate "no validator applies" signal — not a failure — and is
+        logged at INFO so the gap remains observable. Real validator
+        failures must surface as exceptions or violations from the
+        per-pattern validator itself, never as a silent empty list.
+
+        ``component_type`` is accepted for API stability with the existing
+        IntentGuard call shape but is currently unused — reserved for
+        future per-component-type dispatch.
+        """
+        dispatch = {
+            "inspect": cls.validate_inspect_pattern,
+            "action": cls.validate_action_pattern,
+            "check": cls.validate_check_pattern,
+            "run": cls.validate_run_pattern,
+        }
+        validator = dispatch.get(pattern_id)
+        if validator is None:
+            logger.info(
+                "PatternValidators: no validator for pattern_id=%r "
+                "(component_type=%r) — returning empty violations",
+                pattern_id,
+                component_type,
+            )
+            return []
+        return validator(code, target_path)

body/governance/key_management_service.py

@@ -0,0 +1,100 @@
+# src/body/governance/key_management_service.py
+"""
+Key Management Service - Body Layer Implementation.
+
+CONSTITUTIONAL ALIGNMENT (V2.3.0):
+- Relocated: Moved from Mind to Body to resolve architecture.mind.no_body_invocation.
+- Responsibility: Executes cryptographic key generation and governed persistence.
+- Governed: All writes route through FileService to maintain the audit trail.
+"""
+
+from __future__ import annotations
+
+import os
+from datetime import UTC, datetime
+
+import yaml
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import ed25519
+
+from body.services.file_service import FileService
+from shared.exceptions import CoreError
+from shared.logger import getLogger
+from shared.path_resolver import PathResolver
+
+
+logger = getLogger(__name__)
+
+
+# ID: 8a1d1403-b439-475e-a712-cc7c687f6cb9
+class KeyManagementError(CoreError):
+    """Raised when key management operations fail."""
+
+
+# ID: f8491062-091f-49e6-acbf-9b3ee994409e
+def keygen(
+    identity: str,
+    *,
+    path_resolver: PathResolver,
+    file_service: FileService,
+    allow_overwrite: bool = False,
+) -> None:
+    """
+    Generate a new Ed25519 key pair and persist it via the Body's FileService.
+    """
+    logger.info("🔑 Generating new key pair for identity: %s", identity)
+
+    # Resolve paths via the provided resolver
+    rel_key_dir = str(
+        path_resolver.intent_root.relative_to(path_resolver.repo_root) / "keys"
+    )
+
+    rel_private_key_path = f"{rel_key_dir}/private.key"
+    abs_private_key_path = path_resolver.repo_root / rel_private_key_path
+
+    # Safety Gate
+    if abs_private_key_path.exists() and not allow_overwrite:
+        raise KeyManagementError(
+            "A private key already exists. Use allow_overwrite to replace it.",
+            exit_code=1,
+        )
+
+    # 1. Generate the Identity (Computational Work)
+    private_key = ed25519.Ed25519PrivateKey.generate()
+    public_key = private_key.public_key()
+
+    pem_private = private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+
+    # 2. Persist via Governed Mutation Surface (Body Execution)
+    file_service.ensure_dir(rel_key_dir)
+    file_service.write_runtime_bytes(rel_private_key_path, pem_private)
+
+    # Set strict Unix permissions
+    if abs_private_key_path.exists():
+        os.chmod(abs_private_key_path, 0o600)
+
+    pem_public = public_key.public_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PublicFormat.SubjectPublicKeyInfo,
+    )
+
+    # 3. Output for the Operator
+    logger.info(
+        "\n✅ Private key saved securely via FileService to: %s", rel_private_key_path
+    )
+    logger.info(
+        "\n📋 Add the following YAML block to '.intent/constitution/approvers.yaml' under 'approvers':\n"
+    )
+
+    approver_data = {
+        "identity": identity,
+        "public_key": pem_public.decode("utf-8"),
+        "created_at": datetime.now(UTC).isoformat(),
+        "role": "maintainer",
+        "description": "Primary maintainer",
+    }
+    logger.info(yaml.dump([approver_data], indent=2, sort_keys=False))

body/governance/path_validator.py

@@ -0,0 +1,187 @@
+# src/body/governance/path_validator.py
+
+"""
+Path Validator - Body Layer Enforcement Service.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from body.governance.engine_dispatcher import EngineDispatcher
+from mind.governance.policy_rule import PolicyRule
+from mind.governance.violation_report import ViolationReport
+from shared.logger import getLogger
+from shared.models.constitutional_validation import ConstitutionalValidationResult
+from shared.utils.glob_match import matches_glob
+
+
+logger = getLogger(__name__)
+
+
+# ID: 14def661-c022-473c-8069-c127e5868fe6
+class PathValidator:
+    """
+    Validates file paths against constitutional rules.
+
+    Responsibilities:
+    - Pattern matching (glob-based)
+    - Rule application (engine dispatch or simple actions)
+    - Hard invariant enforcement (.intent writes)
+    """
+
+    # Aligned with .intent/rules/architecture/governance_basics.json
+    _READ_ONLY_RULE_ID = "governance.constitution.read_only"
+
+    def __init__(self, repo_path: Path, intent_root: Path, rules: list[PolicyRule]):
+        """
+        Initialize path validator.
+
+        Args:
+            repo_path: Repository root (absolute)
+            intent_root: Intent directory (absolute)
+            rules: Sorted list of policy rules
+        """
+        self.repo_path = repo_path.resolve()
+        self.intent_root = intent_root.resolve()
+        self.rules = rules
+
+    # -------------------------------------------------------------------------
+    # Public API
+    # -------------------------------------------------------------------------
+
+    # ID: 5a61b7ff-d43c-4ae7-820c-a26997d76937
+    def check_paths(self, proposed_paths: list[str]) -> ConstitutionalValidationResult:
+        """
+        Validate a set of proposed file operations.
+        """
+        violations: list[ViolationReport] = []
+
+        for path_str in proposed_paths:
+            abs_path = (self.repo_path / path_str).resolve()
+            violations.extend(self._check_single_path(abs_path, path_str))
+
+        return ConstitutionalValidationResult(
+            is_valid=len(violations) == 0, violations=violations, source="PathValidator"
+        )
+
+    def _check_single_path(self, path: Path, path_str: str) -> list[ViolationReport]:
+        """
+        Enforce constitutional rules against a single path.
+        """
+        violations: list[ViolationReport] = []
+
+        # 1. THE CONSTITUTIONAL INVARIANT (Hard Guard)
+        hard = self._check_no_write_intent(path, path_str)
+        if hard is not None:
+            violations.append(hard)
+            return violations  # Stop checking if hard invariant is broken
+
+        # 2. POLICY RULES (Dynamic Guard)
+        violations.extend(self._check_policy_rules(path, path_str))
+
+        return violations
+
+    # -------------------------------------------------------------------------
+    # Hard Invariant
+    # -------------------------------------------------------------------------
+
+    def _check_no_write_intent(
+        self, abs_path: Path, rel_path_str: str
+    ) -> ViolationReport | None:
+        """
+        HARD INVARIANT: .intent/** is never writable by CORE.
+        Linked to Sovereign Rule: governance.constitution.read_only
+        """
+        try:
+            if abs_path == self.intent_root or self.intent_root in abs_path.parents:
+                # Find the actual rule in our rules list to get the authoritative text
+                rule = next(
+                    (r for r in self.rules if r.name == self._READ_ONLY_RULE_ID), None
+                )
+
+                return ViolationReport(
+                    rule_name=self._READ_ONLY_RULE_ID,
+                    path=rel_path_str,
+                    message=(
+                        rule.description
+                        if rule
+                        else "Writes to .intent/ are forbidden."
+                    ),
+                    severity="error",
+                    suggested_fix="Route changes through non-CORE mechanism.",
+                    source_policy="constitution_hard_invariant",
+                )
+        except Exception as e:
+            logger.error(
+                "Error enforcing .intent hard invariant for %s: %s", rel_path_str, e
+            )
+            return ViolationReport(
+                rule_name=self._READ_ONLY_RULE_ID,
+                path=rel_path_str,
+                message="Failed to evaluate .intent boundary. Fail-closed: forbidden.",
+                severity="error",
+                source_policy="constitution_hard_invariant",
+            )
+
+        return None
+
+    # -------------------------------------------------------------------------
+    # Policy Rule Enforcement
+    # -------------------------------------------------------------------------
+
+    def _check_policy_rules(self, path: Path, path_str: str) -> list[ViolationReport]:
+        """
+        Apply all matching constitutional rules to a path.
+        """
+        violations: list[ViolationReport] = []
+
+        for rule in self.rules:
+            # We already handled the Hard Invariant specifically above
+            if rule.name == self._READ_ONLY_RULE_ID:
+                continue
+
+            try:
+                if not self._matches_pattern(path_str, rule.pattern):
+                    continue
+
+                # Apply rule action (engine dispatch or simple deny/warn)
+                violations.extend(self._apply_rule_action(rule, path, path_str))
+
+            except Exception as e:
+                logger.error(
+                    "Error applying rule '%s' to %s: %s", rule.name, path_str, e
+                )
+
+        return violations
+
+    def _apply_rule_action(
+        self, rule: PolicyRule, path: Path, path_str: str
+    ) -> list[ViolationReport]:
+        """
+        Execute rule enforcement.
+        """
+        if rule.engine:
+            return EngineDispatcher.invoke_engine(rule, path, path_str)
+
+        if rule.action == "deny" or rule.severity in ("blocking", "error"):
+            return [
+                ViolationReport(
+                    rule_name=rule.name,
+                    path=path_str,
+                    message=rule.description,
+                    severity="error",
+                    source_policy=rule.source_policy,
+                )
+            ]
+
+        if rule.action == "warn":
+            logger.warning("Policy warning for %s: %s", path_str, rule.description)
+
+        return []
+
+    @staticmethod
+    def _matches_pattern(path: str, pattern: str) -> bool:
+        if not pattern:
+            return False
+        return matches_glob(path, pattern)