darwin-agentic-cloud 0.1.0__py3-none-any.whl

darwin/agenticcloud/server.py

@@ -0,0 +1,230 @@
+"""DAC HTTP server (FastAPI).
+
+Exposes the runtime over HTTP so any client — curl, a remote agent,
+another service — can request signed execution and query history.
+
+Endpoints:
+    GET  /healthz                          — liveness
+    GET  /v0/identity                      — server's public key + substrate id
+    POST /v0/run                           — execute workload, return signed attestation
+    POST /v0/attestations/verify           — verify a signed attestation
+    GET  /v0/attestations                  — list recent attestations
+    GET  /v0/attestations/{id}             — fetch a specific attestation
+    GET  /v0/attestations/stats            — aggregate stats
+"""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Any
+
+from fastapi import FastAPI, HTTPException, Query
+from pydantic import BaseModel, Field
+
+from darwin import agenticcloud as dac
+from darwin.agenticcloud.attestation import verify_attestation
+from darwin.agenticcloud.runtime import Runtime
+from darwin.agenticcloud.sandbox import SUBSTRATE_ID
+from darwin.agenticcloud.signing import Signer
+from darwin.agenticcloud.storage import AttestationStore
+from darwin.agenticcloud.types import WorkloadSpec
+
+
+# -------------------------------------------------------------------
+# Schemas
+# -------------------------------------------------------------------
+class RunRequest(BaseModel):
+    code: str = Field(..., description="Source code to execute.")
+    language: str = Field("python", description="Language: 'python' or 'node'.")
+    inputs: dict = Field(default_factory=dict, description="Optional inputs.")
+    cost_cap_usd: float = Field(0.01, ge=0, description="Cost ceiling in USD.")
+    timeout_sec: int = Field(30, ge=1, le=600, description="Timeout in seconds.")
+    memory_mb: int = Field(512, ge=64, le=8192, description="Memory limit in MB.")
+
+
+class RunResponse(BaseModel):
+    attestation: dict
+    signature_b64: str
+    public_key_b64: str
+
+
+class VerifyRequest(BaseModel):
+    attestation: dict
+    signature_b64: str
+    public_key_b64: str
+
+
+class VerifyResponse(BaseModel):
+    verified: bool
+
+
+class IdentityResponse(BaseModel):
+    key_id: str
+    public_key_b64: str
+    substrate_id: str
+    schema: str
+    version: str
+
+
+class AttestationSummary(BaseModel):
+    attestation_id: str
+    workload_id: str
+    signer_key_id: str
+    substrate_id: str
+    status: str
+    issued_at: float
+    cost_usd: float
+    wall_time_sec: float
+    schema_version: str
+
+
+class AttestationListResponse(BaseModel):
+    attestations: list[AttestationSummary]
+    count: int
+
+
+class AttestationStatsResponse(BaseModel):
+    total_count: int
+    total_cost_usd: float
+    by_status: dict[str, int]
+
+
+# -------------------------------------------------------------------
+# App factory
+# -------------------------------------------------------------------
+def create_app(runtime: Runtime | None = None) -> FastAPI:
+    """Build a FastAPI app with the given runtime (or a default one)."""
+    rt = runtime or Runtime()
+    store: AttestationStore = rt.store
+
+    app = FastAPI(
+        title="Darwin Agentic Cloud",
+        description="Verifiable compute for AI agents with cryptographically signed attestations.",
+        version=dac.__version__,
+        docs_url="/docs/swagger",
+        redoc_url="/docs/redoc",
+    )
+
+    @app.get("/healthz", tags=["health"])
+    async def healthz() -> dict[str, str]:
+        return {"status": "ok"}
+
+    @app.get("/v0/identity", response_model=IdentityResponse, tags=["identity"])
+    async def identity() -> IdentityResponse:
+        signer: Signer = rt.signer
+        return IdentityResponse(
+            key_id=signer.key_id(),
+            public_key_b64=signer.public_key_b64(),
+            substrate_id=SUBSTRATE_ID,
+            schema=dac.ATTESTATION_SCHEMA,
+            version=dac.__version__,
+        )
+
+    @app.post("/v0/run", response_model=RunResponse, tags=["run"])
+    async def run(req: RunRequest) -> RunResponse:
+        spec = WorkloadSpec(
+            code=req.code,
+            language=req.language,
+            inputs=req.inputs,
+            cost_cap_usd=req.cost_cap_usd,
+            timeout_sec=req.timeout_sec,
+            memory_mb=req.memory_mb,
+        )
+        signed = await asyncio.to_thread(rt.run, spec)
+        return RunResponse(
+            attestation=signed.attestation,
+            signature_b64=signed.signature_b64,
+            public_key_b64=signed.public_key_b64,
+        )
+
+    @app.post("/v0/attestations/verify", response_model=VerifyResponse, tags=["attestations"])
+    async def verify(req: VerifyRequest) -> VerifyResponse:
+        try:
+            payload: dict[str, Any] = {
+                "attestation": req.attestation,
+                "signature_b64": req.signature_b64,
+                "public_key_b64": req.public_key_b64,
+            }
+            return VerifyResponse(verified=verify_attestation(payload))
+        except Exception as e:
+            raise HTTPException(status_code=400, detail=str(e)) from e
+
+    @app.get(
+        "/v0/attestations/stats",
+        response_model=AttestationStatsResponse,
+        tags=["attestations"],
+    )
+    async def stats() -> AttestationStatsResponse:
+        total = store.count()
+        total_cost = store.total_cost_usd()
+        by_status = {
+            "ok": len(store.list_by_status("ok", limit=10**9)),
+            "error": len(store.list_by_status("error", limit=10**9)),
+            "timeout": len(store.list_by_status("timeout", limit=10**9)),
+            "oom": len(store.list_by_status("oom", limit=10**9)),
+            "cost_exceeded": len(store.list_by_status("cost_exceeded", limit=10**9)),
+        }
+        return AttestationStatsResponse(
+            total_count=total,
+            total_cost_usd=total_cost,
+            by_status=by_status,
+        )
+
+    @app.get(
+        "/v0/attestations",
+        response_model=AttestationListResponse,
+        tags=["attestations"],
+    )
+    async def list_attestations(
+        limit: int = Query(20, ge=1, le=1000),
+        status: str | None = Query(None),
+    ) -> AttestationListResponse:
+        rows = (
+            store.list_by_status(status, limit=limit) if status else store.list_recent(limit=limit)
+        )
+        return AttestationListResponse(
+            attestations=[
+                AttestationSummary(
+                    attestation_id=r.attestation_id,
+                    workload_id=r.workload_id,
+                    signer_key_id=r.signer_key_id,
+                    substrate_id=r.substrate_id,
+                    status=r.status,
+                    issued_at=r.issued_at,
+                    cost_usd=r.cost_usd,
+                    wall_time_sec=r.wall_time_sec,
+                    schema_version=r.schema_version,
+                )
+                for r in rows
+            ],
+            count=len(rows),
+        )
+
+    @app.get("/v0/attestations/{attestation_id}", tags=["attestations"])
+    async def get_attestation(attestation_id: str) -> dict:
+        fetched = store.get(attestation_id)
+        if fetched is None:
+            raise HTTPException(status_code=404, detail="Attestation not found")
+        return fetched.signed_attestation
+
+    # Custom branded docs page (Material 3, dark, brand colors)
+    from pathlib import Path as _Path
+
+    from fastapi.responses import HTMLResponse
+
+    _TEMPLATE_PATH = _Path(__file__).parent / "templates" / "docs.html"
+
+    @app.get("/docs", response_class=HTMLResponse, include_in_schema=False)
+    async def custom_docs() -> HTMLResponse:
+        """Serve the branded Darwin docs page."""
+        return HTMLResponse(_TEMPLATE_PATH.read_text(encoding="utf-8"))
+
+    @app.get("/", response_class=HTMLResponse, include_in_schema=False)
+    async def root() -> HTMLResponse:
+        """Root: redirect to the docs page."""
+        return HTMLResponse(_TEMPLATE_PATH.read_text(encoding="utf-8"))
+
+    return app
+
+
+app = create_app()

darwin/agenticcloud/signing.py

@@ -0,0 +1,100 @@
+"""Ed25519 signing for DAC attestations.
+
+Stores a local keypair at ~/.darwin/agenticcloud/keys/signing.pem. In production this
+gets swapped for Sigstore + OIDC, but the Signer interface stays the
+same so callers don't change.
+"""
+
+from __future__ import annotations
+
+import base64
+from pathlib import Path
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+    Ed25519PrivateKey,
+    Ed25519PublicKey,
+)
+
+from darwin.agenticcloud.hashing import sha256_hex
+
+
+def _default_key_dir() -> Path:
+    """Default keys directory, honoring DARWIN_STATE_DIR env var."""
+    import os
+
+    state_dir = os.environ.get("DARWIN_STATE_DIR")
+    if state_dir:
+        return Path(state_dir) / "keys"
+    return Path.home() / ".darwin" / "agenticcloud" / "keys"
+
+
+DEFAULT_KEY_DIR = _default_key_dir()
+DEFAULT_KEY_PATH = DEFAULT_KEY_DIR / "signing.pem"
+
+
+class Signer:
+    """Local Ed25519 signer."""
+
+    def __init__(self, key_path: Path | None = None) -> None:
+        self.key_path = key_path or DEFAULT_KEY_PATH
+        self._private_key = self._load_or_create()
+        self._public_key = self._private_key.public_key()
+
+    def _load_or_create(self) -> Ed25519PrivateKey:
+        if self.key_path.exists():
+            return self._load()
+        return self._create()
+
+    def _load(self) -> Ed25519PrivateKey:
+        with self.key_path.open("rb") as f:
+            key = serialization.load_pem_private_key(f.read(), password=None)
+        if not isinstance(key, Ed25519PrivateKey):
+            raise TypeError(f"Expected Ed25519 key at {self.key_path}, got {type(key).__name__}")
+        return key
+
+    def _create(self) -> Ed25519PrivateKey:
+        self.key_path.parent.mkdir(parents=True, exist_ok=True)
+        key = Ed25519PrivateKey.generate()
+        pem = key.private_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PrivateFormat.PKCS8,
+            encryption_algorithm=serialization.NoEncryption(),
+        )
+        self.key_path.write_bytes(pem)
+        self.key_path.chmod(0o600)
+        return key
+
+    def _public_key_raw(self) -> bytes:
+        return self._public_key.public_bytes(
+            encoding=serialization.Encoding.Raw,
+            format=serialization.PublicFormat.Raw,
+        )
+
+    def public_key_b64(self) -> str:
+        """Base64-encoded raw Ed25519 public key (32 bytes -> 44 chars)."""
+        return base64.b64encode(self._public_key_raw()).decode()
+
+    def key_id(self) -> str:
+        """Stable identifier for this signing key.
+
+        Format: dac-local-<first 16 hex chars of sha256(public_key)>
+        """
+        return "dac-local-" + sha256_hex(self._public_key_raw())[:16]
+
+    def sign(self, data: bytes) -> str:
+        """Sign data, return base64-encoded signature."""
+        sig = self._private_key.sign(data)
+        return base64.b64encode(sig).decode()
+
+
+def verify_signature(data: bytes, signature_b64: str, public_key_b64: str) -> bool:
+    """Verify a base64-encoded signature against base64 public key."""
+    try:
+        sig = base64.b64decode(signature_b64)
+        pub_raw = base64.b64decode(public_key_b64)
+        pub = Ed25519PublicKey.from_public_bytes(pub_raw)
+        pub.verify(sig, data)
+    except Exception:
+        return False
+    return True

darwin/agenticcloud/storage.py

@@ -0,0 +1,230 @@
+"""Persistent storage of attestations.
+
+Every signed attestation is written to a local SQLite database so it
+can be queried and audited later. This is what turns DAC from a
+stateless RPC into an evidentiary system of record.
+
+Schema is intentionally minimal for v0:
+- attestations: the full signed payload, plus indexed columns we'd
+  reasonably query by (issued_at, signer_key_id, status, workload_id,
+  substrate_id, attestation_id).
+
+The 'signed_attestation_json' column holds the entire SignedAttestation
+as JSON so verification is independent of schema changes — you can
+always re-verify a stored attestation by deserializing that column.
+
+In v0.2 we'll add a SQLAlchemy-backed Postgres implementation behind
+the same AttestationStore interface for multi-tenant deployments.
+"""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+from collections.abc import Iterator
+from contextlib import contextmanager
+from dataclasses import dataclass
+from pathlib import Path
+
+from darwin.agenticcloud.types import SignedAttestation
+
+
+def _default_db_path() -> Path:
+    """Return the default attestation DB path, honoring DARWIN_STATE_DIR."""
+    import os
+
+    state_dir = os.environ.get("DARWIN_STATE_DIR")
+    if state_dir:
+        return Path(state_dir) / "attestations.db"
+    return Path.home() / ".darwin" / "agenticcloud" / "attestations.db"
+
+
+DEFAULT_DB_PATH = _default_db_path()
+
+SCHEMA = """
+CREATE TABLE IF NOT EXISTS attestations (
+    attestation_id        TEXT PRIMARY KEY,
+    workload_id           TEXT NOT NULL,
+    signer_key_id         TEXT NOT NULL,
+    substrate_id          TEXT NOT NULL,
+    status                TEXT NOT NULL,
+    issued_at             REAL NOT NULL,
+    cost_usd              REAL NOT NULL,
+    wall_time_sec         REAL NOT NULL,
+    schema_version        TEXT NOT NULL,
+    signed_attestation_json TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_attestations_issued_at
+    ON attestations(issued_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_attestations_workload_id
+    ON attestations(workload_id);
+
+CREATE INDEX IF NOT EXISTS idx_attestations_signer_key_id
+    ON attestations(signer_key_id);
+
+CREATE INDEX IF NOT EXISTS idx_attestations_status
+    ON attestations(status);
+"""
+
+
+@dataclass(frozen=True)
+class StoredAttestation:
+    """A row in the attestations table, returned by queries."""
+
+    attestation_id: str
+    workload_id: str
+    signer_key_id: str
+    substrate_id: str
+    status: str
+    issued_at: float
+    cost_usd: float
+    wall_time_sec: float
+    schema_version: str
+    signed_attestation: dict  # the full SignedAttestation re-hydrated
+
+
+class AttestationStore:
+    """SQLite-backed attestation store.
+
+    Thread-safe at the connection level via SQLite's serialized access.
+    For higher concurrency in v0.2 we move to a connection pool or
+    swap the backend to Postgres.
+    """
+
+    def __init__(self, db_path: Path | None = None) -> None:
+        self.db_path = db_path or DEFAULT_DB_PATH
+        self.db_path.parent.mkdir(parents=True, exist_ok=True)
+        self._init_schema()
+
+    def _init_schema(self) -> None:
+        with self._connect() as conn:
+            conn.executescript(SCHEMA)
+
+    @contextmanager
+    def _connect(self) -> Iterator[sqlite3.Connection]:
+        conn = sqlite3.connect(self.db_path, isolation_level=None)
+        conn.row_factory = sqlite3.Row
+        try:
+            yield conn
+        finally:
+            conn.close()
+
+    # -------------------------------------------------------------
+    # Writes
+    # -------------------------------------------------------------
+    def save(self, signed: SignedAttestation) -> None:
+        """Persist a signed attestation. Idempotent on attestation_id."""
+        a = signed.attestation
+        er = a["execution_result"]
+        signed_json = json.dumps(
+            {
+                "attestation": signed.attestation,
+                "signature_b64": signed.signature_b64,
+                "public_key_b64": signed.public_key_b64,
+            }
+        )
+        with self._connect() as conn:
+            conn.execute(
+                """
+                INSERT OR REPLACE INTO attestations (
+                    attestation_id, workload_id, signer_key_id, substrate_id,
+                    status, issued_at, cost_usd, wall_time_sec,
+                    schema_version, signed_attestation_json
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                """,
+                (
+                    a["attestation_id"],
+                    er["workload_id"],
+                    a["signer_key_id"],
+                    er["substrate_id"],
+                    er["status"],
+                    a["issued_at"],
+                    er["cost_usd"],
+                    er["wall_time_sec"],
+                    a["schema"],
+                    signed_json,
+                ),
+            )
+
+    # -------------------------------------------------------------
+    # Reads
+    # -------------------------------------------------------------
+    def get(self, attestation_id: str) -> StoredAttestation | None:
+        """Fetch a single attestation by ID. Returns None if not found."""
+        with self._connect() as conn:
+            row = conn.execute(
+                "SELECT * FROM attestations WHERE attestation_id = ?",
+                (attestation_id,),
+            ).fetchone()
+        return _row_to_stored(row) if row else None
+
+    def list_recent(self, limit: int = 50) -> list[StoredAttestation]:
+        """Return the most recent attestations, newest first."""
+        with self._connect() as conn:
+            rows = conn.execute(
+                "SELECT * FROM attestations ORDER BY issued_at DESC LIMIT ?",
+                (limit,),
+            ).fetchall()
+        return [_row_to_stored(r) for r in rows]
+
+    def list_by_status(self, status: str, limit: int = 50) -> list[StoredAttestation]:
+        """Return attestations with a given status (e.g. 'cost_exceeded')."""
+        with self._connect() as conn:
+            rows = conn.execute(
+                """
+                SELECT * FROM attestations
+                WHERE status = ?
+                ORDER BY issued_at DESC
+                LIMIT ?
+                """,
+                (status, limit),
+            ).fetchall()
+        return [_row_to_stored(r) for r in rows]
+
+    def list_by_signer(self, signer_key_id: str, limit: int = 50) -> list[StoredAttestation]:
+        """Return attestations issued by a given signer."""
+        with self._connect() as conn:
+            rows = conn.execute(
+                """
+                SELECT * FROM attestations
+                WHERE signer_key_id = ?
+                ORDER BY issued_at DESC
+                LIMIT ?
+                """,
+                (signer_key_id, limit),
+            ).fetchall()
+        return [_row_to_stored(r) for r in rows]
+
+    def count(self) -> int:
+        """Total number of stored attestations."""
+        with self._connect() as conn:
+            return conn.execute("SELECT COUNT(*) FROM attestations").fetchone()[0]
+
+    def total_cost_usd(self, signer_key_id: str | None = None) -> float:
+        """Sum of cost_usd across all (or one signer's) attestations."""
+        with self._connect() as conn:
+            if signer_key_id is None:
+                row = conn.execute("SELECT COALESCE(SUM(cost_usd), 0) FROM attestations").fetchone()
+            else:
+                row = conn.execute(
+                    "SELECT COALESCE(SUM(cost_usd), 0) FROM attestations WHERE signer_key_id = ?",
+                    (signer_key_id,),
+                ).fetchone()
+        return float(row[0])
+
+
+def _row_to_stored(row: sqlite3.Row) -> StoredAttestation:
+    return StoredAttestation(
+        attestation_id=row["attestation_id"],
+        workload_id=row["workload_id"],
+        signer_key_id=row["signer_key_id"],
+        substrate_id=row["substrate_id"],
+        status=row["status"],
+        issued_at=row["issued_at"],
+        cost_usd=row["cost_usd"],
+        wall_time_sec=row["wall_time_sec"],
+        schema_version=row["schema_version"],
+        signed_attestation=json.loads(row["signed_attestation_json"]),
+    )