devagent-ignition 0.1.0__py3-none-any.whl

devagent_spatial/preflight.py

@@ -0,0 +1,140 @@
+"""Pre-deployment OFFLINE integrity/cross-project qualification. No Gateway access.
+
+This never claims Ignition runtime compatibility, live mapping, or FAT success.
+"""
+from __future__ import annotations
+import copy
+import hashlib
+import json
+import tempfile
+from pathlib import Path
+from .generator import build, BuildHold, ROOT
+from .qualification import audit
+from .model import qualify
+from .ignition_native import compile_candidate, verify_candidate, find_views, NativeHold
+from .ignition_project import compile_project, verify_project, CONFIRM
+
+EXAMPLES = ('single_floor', 'warehouse', 'water')
+SCHEMA = 'devagent.spatial.offline_preflight.v0.4'
+
+
+def _hash(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def preflight(*, reference_zip=None, reference_sha256=None, template_view=None):
+    results = []
+    def result(name, passed, detail):
+        results.append({'gate':name,'status':'PASS' if passed else 'HOLD','detail':detail})
+
+    with tempfile.TemporaryDirectory(prefix='devagent-preflight-') as base:
+        tmp = Path(base)
+        checked_models = {}
+        for name in EXAMPLES:
+            try:
+                model_path = ROOT/'examples'/f'{name}.json'
+                original_sha = _hash(model_path)
+                model = json.loads(model_path.read_text(encoding='utf-8'))
+                report = qualify(model)
+                if report['status']!='PASS_STATIC_CONTRACT_ONLY':
+                    raise ValueError('STATIC_CONTRACT_HOLD')
+                expected_floors = len({e.get('floor',1) for e in model['equipment']})
+                if name=='single_floor' and expected_floors != 1:
+                    raise ValueError('SINGLE_FLOOR_NOT_SINGLE')
+                out = tmp/name
+                res = build(model,out)
+                audited = audit(out,purpose='preview')
+                if res['status']!='PASS_STATIC_BUILD_ONLY' or audited['status']!='PASS_CONCEPT_PREVIEW_ONLY':
+                    raise ValueError('PREVIEW_AUDIT_HOLD')
+                if audited['equipment_count']!=len(model['equipment']) or audited['signals_proposed']!=len(model['signals']):
+                    raise ValueError('MODEL_COUNTS_DIFFER')
+                if original_sha!=_hash(model_path):
+                    raise ValueError('SOURCE_FILE_MUTATED')
+                checked_models[name]=model
+                result('PROJECT_'+name.upper(),True,{'assets':len(model['equipment']),
+                   'signals':len(model['signals']),'floors':expected_floors,
+                   'FAT':'NOT_EXECUTED','preview':'PASS_CONCEPT_ONLY'})
+            except (OSError,ValueError,BuildHold,KeyError,TypeError,RecursionError) as exc:
+                result('PROJECT_'+name.upper(),False,type(exc).__name__+': '+str(exc)[:100])
+
+        # Deliberately corrupt an already-built artifact and check the independent
+        # auditor fails closed. Re-hashing a changed file must not bypass semantic checks.
+        if (tmp/'single_floor'/'BUILD.json').exists():
+            try:
+                builddoc = tmp/'single_floor'/'BUILD.json'
+                payload = json.loads(builddoc.read_text())
+                payload['ignition_hmi'] = 'VERIFIED'
+                builddoc.write_text(json.dumps(payload,indent=2)+'\n')
+                checksum = tmp/'single_floor'/'SHA256SUMS.txt'
+                updated=[]
+                for line in checksum.read_text().splitlines():
+                    digest,relative=line.split('  ',1)
+                    if relative=='BUILD.json':digest=_hash(builddoc)
+                    updated.append(digest+'  '+relative)
+                checksum.write_text('\n'.join(updated)+'\n')
+                report=audit(tmp/'single_floor',purpose='preview')
+                result('REHASHED_FALSE_PRODUCTION_CLAIM_REJECTED',
+                       report['status']=='HOLD' and 'UNSUPPORTED_RUNTIME_CERTIFICATION' in report['issues'],
+                       report['issues'])
+            except (ValueError,OSError,KeyError) as exc:
+                result('REHASHED_FALSE_PRODUCTION_CLAIM_REJECTED',False,type(exc).__name__)
+        else:
+            result('REHASHED_FALSE_PRODUCTION_CLAIM_REJECTED',False,'NO_PREVIEW_BUILT')
+
+        for mutation in ('duplicate_asset','invalid_role','write_authority'):
+            try:
+                model=copy.deepcopy(checked_models['single_floor'])
+                if mutation=='duplicate_asset':model['equipment'].append(copy.deepcopy(model['equipment'][0]))
+                elif mutation=='invalid_role':model['signals'][0]['role']=[]
+                else:model['signals'][0]['write_authorized']=True
+                q=qualify(model)
+                result('REJECT_'+mutation.upper(),q['status']=='HOLD',
+                       [x['code'] for x in q['issues'] if x['severity']=='HOLD'])
+            except (ValueError,KeyError,TypeError) as exc:
+                result('REJECT_'+mutation.upper(),False,'EXCEPTION_'+type(exc).__name__)
+        if reference_zip is not None:
+            try:
+                if not reference_sha256 or not template_view:raise NativeHold('SHA_AND_TEMPLATE_REQUIRED')
+                reference_zip=Path(reference_zip)
+                if _hash(reference_zip)!=reference_sha256:raise NativeHold('SOURCE_SHA256_MISMATCH')
+                index=find_views(reference_zip)
+                if template_view not in index['views']:raise NativeHold('REFERENCE_VIEW_UNAVAILABLE')
+                dst=tmp/'native_candidate.zip'
+                status=compile_candidate(checked_models['single_floor'],reference_zip,
+                                         template_view,reference_sha256,dst)
+                verification=verify_candidate(checked_models['single_floor'],reference_zip,
+                                              template_view,reference_sha256,dst)
+                # Require a standalone, conservative project candidate for
+                # THREE materially different customer systems. Generated only
+                # in the transient test directory; never contacts a Gateway.
+                project_results=[]
+                for scenario,customer_model in checked_models.items():
+                    project_out=tmp/f'{scenario}-project.zip'
+                    project_name='DevAgent_'+scenario.upper()+'_LAB'
+                    pr=compile_project(customer_model,reference_zip,template_view,
+                        reference_sha256,project_name,project_out,CONFIRM)
+                    pv=verify_project(customer_model,reference_zip,template_view,
+                        reference_sha256,project_name,project_out)
+                    project_results.append({'scenario':scenario,'status':'PASS' if
+                        pr['status']==pv['status']=='PASS_OFFLINE_ISOLATED_PROJECT_CANDIDATE_ONLY'
+                        else 'HOLD','members':pv['members_verified']})
+                result('REFERENCE_NATIVE_OFFLINE',
+                       status['status']==verification['status']=='PASS_OFFLINE_NATIVE_VIEW_CANDIDATE_ONLY'
+                       and len(project_results)==len(EXAMPLES)
+                       and all(x['status']=='PASS' for x in project_results),
+                       {'source_sha256':reference_sha256,'native_import':'NOT_TESTED',
+                        'generated_project_candidates':project_results})
+            except (OSError,ValueError,KeyError,NativeHold,TypeError) as exc:
+                result('REFERENCE_NATIVE_OFFLINE',False,str(exc)[:160])
+        else:
+            result('REFERENCE_NATIVE_OFFLINE',False,'APPROVED_R9_NATIVE_EXPORT_REQUIRED')
+    return {
+        'schema':SCHEMA,
+        'status':'PASS_OFFLINE_PRETEST_ONLY' if all(r['status']=='PASS' for r in results if r['gate']!='REFERENCE_NATIVE_OFFLINE') else 'HOLD',
+        'production_release':'HOLD',
+        'ignition_project_import':'NOT_TESTED',
+        'native_reference':next(x['status'] for x in results if x['gate']=='REFERENCE_NATIVE_OFFLINE'),
+        'real_opc_ua':'NOT_TESTED','hmi_runtime':'NOT_TESTED','FAT':'NOT_EXECUTED',
+        'R9_design_parity':'NOT_VERIFIED',
+        'gates':results
+    }

devagent_spatial/preview_simulation.py

@@ -0,0 +1,189 @@
+"""Project-scoped, in-memory SYNTHETIC preview demonstration.
+
+This module NEVER talks to OPC UA, Ignition or PLCs, changes tags or asserts FAT
+qualification. It models conceptual material flow using only declared graph edges.
+Separate from real Studio R2's guarded tag readback workflow.
+"""
+from __future__ import annotations
+import datetime as dt
+import threading
+import time
+from collections import deque
+from .operations import evaluate, mapping_digest
+
+MAX_SECONDS = 900
+PREVIEW_PACES = {'slow':180.0, 'normal':120.0, 'fast':75.0}
+
+
+class PreviewSimulationHold(ValueError): pass
+
+
+def main_path(model):
+    """Longest declared acyclic handling path (deterministic branch selection)."""
+    equipment = {e['id']: e for e in model['equipment']}
+    handling = {k for k,e in equipment.items() if e['kind'] in ('conveyor','sorter','spiral','junction')}
+    if not handling:raise PreviewSimulationHold('NO_MATERIAL_HANDLING_ASSETS')
+    children = {k: [] for k in handling}
+    incoming = {k: 0 for k in handling}
+    for edge in model['connections']:
+        a,b = edge['from'],edge['to']
+        if a in handling and b in handling:
+            children[a].append(b);incoming[b]+=1
+    if not any(children.values()):raise PreviewSimulationHold('NO_DECLARED_MATERIAL_FLOW')
+    for paths in children.values():paths.sort()
+    # Never silently invent a path through missing or cyclic edges.
+    def visit(k, seen):
+        if k in seen:raise PreviewSimulationHold('CYCLIC_MATERIAL_FLOW_NEEDS_REVIEW')
+        options = [visit(c,seen|{k}) for c in children[k]]
+        return [k] + (max(options,key=lambda p:(len(p),tuple(p))) if options else [])
+    roots = sorted(k for k,n in incoming.items() if n == 0)
+    if not roots:raise PreviewSimulationHold('CYCLIC_MATERIAL_FLOW_OR_NO_ROOT')
+    return max((visit(r,set()) for r in roots),key=lambda p:(len(p),tuple(p)))
+
+
+class PreviewSimulator:
+    def __init__(self):
+        self._lock = threading.RLock()
+        self._runs = {}
+
+    def _get(self,pid,model):
+        run=self._runs.get(pid)
+        if run and run['digest']!=mapping_digest(model):
+            self._runs.pop(pid,None)
+            raise PreviewSimulationHold('PROJECT_MAPPING_CHANGED_SIMULATION_STOPPED')
+        if run and (time.monotonic()-run['created'])>MAX_SECONDS:
+            self._runs.pop(pid,None)
+            raise PreviewSimulationHold('SIMULATION_EXPIRED_RESTART_REQUIRED')
+        return run
+
+    def active(self,pid):
+        with self._lock:return pid in self._runs
+
+    def action(self,pid,model,action,*,fault_asset=None,pace=None):
+        with self._lock:
+            if action=='start':
+                if pace not in (None,*PREVIEW_PACES):raise PreviewSimulationHold('UNKNOWN_PREVIEW_PACE')
+                path=main_path(model)
+                self._runs[pid]={'digest':mapping_digest(model),'path':path,'created':time.monotonic(),
+                    'tick':time.monotonic(),'elapsed':0.,'duration':PREVIEW_PACES[pace or 'normal'],'paused':False,'fault_asset':None,
+                    'history':deque(maxlen=40),'scanned':0,'generation':0,'acknowledged':False}
+            elif action=='stop':
+                self._runs.pop(pid,None)
+                return {'status':'SYNTHETIC_PREVIEW_STOPPED','production':'HOLD','opc_writes':False}
+            else:
+                run=self._get(pid,model)
+                if not run:raise PreviewSimulationHold('START_SIMULATION_FIRST')
+                self._advance(run)
+                if action=='pause':run['paused']=not run['paused']
+                elif action=='operator-stop':run['paused']=True
+                elif action=='operator-start':
+                    if run['fault_asset'] is not None:raise PreviewSimulationHold('ACTIVE_FAULT_RESET_REQUIRED_BEFORE_START')
+                    run['paused']=False
+                elif action=='operator-reset':
+                    if not run['paused']:raise PreviewSimulationHold('STOP_BEFORE_SIMULATED_RESET')
+                    run['fault_asset']=None;run['acknowledged']=False
+                    run['elapsed']=0.0;run['history'].clear();run['tick']=time.monotonic()
+                elif action=='operator-ack':
+                    if run['fault_asset'] is None:raise PreviewSimulationHold('NO_ACTIVE_SIMULATED_FAULT_TO_ACK')
+                    if run['acknowledged']:raise PreviewSimulationHold('ALARM_ALREADY_ACKNOWLEDGED_IN_SIMULATION')
+                    run['acknowledged']=True
+                elif action=='fault':
+                    ids={s['asset_id'] for s in model['signals'] if s['role']=='fault' and s['datatype']=='Boolean'}
+                    if fault_asset not in ids:raise PreviewSimulationHold('UNKNOWN_FAULT_ASSET')
+                    run['fault_asset']=None if run['fault_asset']==fault_asset else fault_asset
+                    run['acknowledged']=False
+                else:raise PreviewSimulationHold('UNKNOWN_SIMULATION_ACTION')
+            run=self._runs[pid]
+            return {'status':'SYNTHETIC_PREVIEW_ACTIVE','paused':run['paused'],
+                'fault_asset':run['fault_asset'],'acknowledged':run['acknowledged'],'path':run['path'],'duration_seconds':run['duration'],'source':'IN_MEMORY_SYNTHETIC_NOT_OPC',
+                'production':'HOLD','opc_writes':False,'ignition':'NOT_VERIFIED'}
+
+    def _advance(self,run):
+        now=time.monotonic(); delta=max(0.,min(now-run['tick'],10.))
+        if not run['paused'] and run['fault_asset'] is None:run['elapsed']+=delta
+        run['tick']=now
+
+    def status(self,pid,model):
+        with self._lock:
+            run=self._get(pid,model)
+            if not run:return {'status':'SIMULATION_OFF','source':'NONE','opc_writes':False}
+            return {'status':'SYNTHETIC_PREVIEW_ACTIVE','paused':run['paused'],
+                'fault_asset':run['fault_asset'],'acknowledged':run['acknowledged'],'path':run['path'],'duration_seconds':run['duration'],
+                'source':'IN_MEMORY_SYNTHETIC_NOT_OPC','production':'HOLD','opc_writes':False}
+
+    def reading(self,pid,model):
+        with self._lock:
+            run=self._get(pid,model)
+            if not run:return {'status':'SIMULATION_OFF'}
+            self._advance(run)
+            duration=run['duration'] # slow, explicitly labeled conceptual traversal (no PLC speed claim)
+            parcels=[]
+            for n in range(3):
+                seconds=run['elapsed']-n*(duration/4)
+                if seconds < 0:continue
+                # A completed parcel exits; a NEW parcel enters on the next
+                # cycle. Reusing the same identity across a 1->0 progress wrap
+                # would teleport a parcel from the chute back to the infeed.
+                cycle=int(seconds//duration)
+                phase=(seconds%duration)/duration
+                parcels.append({'id':f'LAB-{n+1:02d}-C{cycle:04d}',
+                                'progress':round(phase,6),'path':run['path']})
+            # Conceptual machine-specific virtual port sensors. These are NEVER
+            # customer OPC UA photoeye signals, even if the names resemble PE IN/OUT.
+            # Use a long enough conceptual gate for 1-second UI polls to observe it.
+            gates={asset:{'in':False,'out':False} for asset in run['path']}
+            length=len(run['path'])
+            for parcel in parcels:
+                scaled=parcel['progress']*length
+                index=min(length-1,int(scaled))
+                local=scaled-index
+                asset=run['path'][index]
+                gates[asset]['in'] |= local <= .23
+                gates[asset]['out'] |= local >= .77
+            virtual_pe=[{'asset_id':asset,'pe_in':v['in'],'pe_out':v['out']}
+                        for asset,v in gates.items()]
+            # Project example photoeyes have no machine IN/OUT binding. Synthetic
+            # visualization MAY associate them by nearest declared same-floor route
+            # station; this is explicitly NOT a physical installation mapping.
+            equipment={e['id']:e for e in model['equipment']}
+            virtual_sensor_owners={}
+            for sensor in model['equipment']:
+                if sensor['kind']!='photoeye':continue
+                candidates=[( (sensor['position']['x']-equipment[k]['position']['x'])**2+
+                               (sensor['position']['z']-equipment[k]['position']['z'])**2,
+                               k) for k in run['path'] if equipment[k]['floor']==sensor['floor']]
+                if candidates:virtual_sensor_owners[sensor['id']]=min(candidates)[1]
+            at=dt.datetime.now(dt.timezone.utc)
+            # monotonic wall-clock for the operations engine, even on rapid requests
+            if run['history']:
+                prev=dt.datetime.fromisoformat(run['history'][-1]['at'])
+                if at<=prev:at=prev+dt.timedelta(microseconds=1)
+            timestamp=at.isoformat()
+            values=[]
+            signal_roles={s['id']:s for s in model['signals']}
+            for signal in model['signals']:
+                role=signal['role'];dtype=signal['datatype'];asset=signal['asset_id']
+                if dtype=='Boolean':
+                    on=(role=='run_feedback' and not run['paused'] and run['fault_asset'] is None)
+                    if role=='fault':on=(asset==run['fault_asset'])
+                    if role=='photoeye_blocked':
+                        owner=virtual_sensor_owners.get(asset)
+                        on=bool(owner and (gates[owner]['in'] or gates[owner]['out']))
+                    value=not on if signal.get('polarity','') in ('active_low','ACTIVE_LOW') and role in ('fault','photoeye_blocked') else on
+                elif dtype=='Int32':
+                    value=int(run['elapsed']//duration) if role in ('scan_count','delivered_count') else 0
+                elif dtype=='Double':value=38.0 if not run['paused'] and run['fault_asset'] is None else 0.0
+                elif dtype=='String':value='GOOD_READ' if role=='scanner_result' else 'LAB-DEMO'
+                else:raise PreviewSimulationHold('UNSUPPORTED_SIGNAL_TYPE')
+                values.append({'signal_id':signal['id'],'namespace_uri':signal['source']['namespace_uri'],
+                    'node_id':signal['source']['node_id'],'datatype':dtype,'quality':'GOOD',
+                    'source_timestamp':timestamp,'value':value})
+            run['history'].append({'at':timestamp,'observations':values})
+            receipt=evaluate(model,list(run['history']),origin='SYNTHETIC_OFFLINE_FIXTURE')
+            return {'status':'PASS_SYNTHETIC_PREVIEW_ONLY','source':'IN_MEMORY_SYNTHETIC_NOT_OPC',
+                'authority':'PROJECT_SCOPED_DEMO_ONLY','receipt':receipt,'parcels':parcels,
+                'virtual_pe':virtual_pe,'virtual_pe_source':'CONCEPTUAL_SYNTHETIC_PORTS_NOT_MAPPED',
+                'acknowledged':run['acknowledged'],
+                'paused':run['paused'],'fault_asset':run['fault_asset'],
+                'ignition':'NOT_VERIFIED','opc_verified':False,'production':'HOLD','opc_writes':False,
+                'hmi_fat':'NOT_VERIFIED'}

devagent_spatial/project_package.py

@@ -0,0 +1,101 @@
+"""Read-only customer project ZIP intake: reviewable Creator fields, never executable artifacts.
+
+No archive member is extracted or executed. Preview and FAT evidence files are ignored.
+AI review, PLC mapping and production approval remain independent.
+"""
+from __future__ import annotations
+import hashlib
+import io
+import re
+import zipfile
+from pathlib import PurePosixPath
+
+MAX_PACKAGE_BYTES = 8_000_000
+MAX_MEMBERS = 180
+MAX_EXPANDED_BYTES = 20_000_000
+MAX_INPUT_BYTES = 120_000
+MAX_PROJECTS = 4
+FILES = {
+    'equipment_csv': ('02_Equipment_IMPORT.csv','02_Equipment.csv','equipment.csv'),
+    'connections_csv': ('03_Connections_IMPORT.csv','03_Connections.csv','connections.csv'),
+    'signals_csv': ('04_Training_OPC_Signals_IMPORT.csv','04_Signals_DEMO_ONLY.csv','04_Training_OPC_Signals.csv','signals.csv'),
+    'requirements': ('06_Requirements_PASTE.txt','05_Requirements_15_Lines.txt','requirements.txt'),
+    'description': ('01_Project_Description_PASTE.txt','01_Project_Brief.txt','project.txt'),
+}
+class PackageHold(ValueError):
+    pass
+
+def inspect_package(name: str, raw: bytes) -> dict:
+    if not isinstance(name,str) or not name.lower().endswith('.zip') or not isinstance(raw,bytes):
+        raise PackageHold('PROJECT_PACKAGE_ZIP_REQUIRED')
+    if not 20 <= len(raw) <= MAX_PACKAGE_BYTES:
+        raise PackageHold('PROJECT_PACKAGE_SIZE_HOLD')
+    try:
+        with zipfile.ZipFile(io.BytesIO(raw)) as z:
+            members=z.infolist()
+            if not members or len(members)>MAX_MEMBERS or sum(m.file_size for m in members)>MAX_EXPANDED_BYTES:
+                raise PackageHold('PROJECT_PACKAGE_EXPANSION_LIMIT')
+            by_dir={}
+            seen=set()
+            for item in members:
+                filename=item.filename
+                path=PurePosixPath(filename)
+                if item.flag_bits & 1: raise PackageHold('PROJECT_PACKAGE_ENCRYPTED')
+                if item.create_system==3 and ((item.external_attr>>16)&0o170000)==0o120000:
+                    raise PackageHold('PROJECT_PACKAGE_SYMLINK_REJECTED')
+                if item.is_dir():continue
+                if (not filename or filename.startswith('/') or '\\' in filename or
+                    '..' in path.parts or any(part.startswith('.') for part in path.parts) or
+                    ':' in filename or item.file_size>MAX_EXPANDED_BYTES):
+                    raise PackageHold('PROJECT_PACKAGE_UNSAFE_PATH')
+                if filename in seen:raise PackageHold('PROJECT_PACKAGE_DUPLICATE_PATH')
+                seen.add(filename)
+                # Scan archive metadata only. HMI previews, executables, reports and reference models are ignored.
+                if path.name not in {v for names in FILES.values() for v in names}:continue
+                directory=path.parent.as_posix()
+                by_dir.setdefault(directory,{})[path.name]=item
+            options=[]
+            from .studio import from_wizard
+            from .model import qualify
+            for directory,available in sorted(by_dir.items()):
+                data={}
+                for field,names in FILES.items():
+                    chosen=next((n for n in names if n in available),None)
+                    if chosen:
+                        member=available[chosen]
+                        if member.file_size>MAX_INPUT_BYTES:raise PackageHold('PROJECT_INPUT_FILE_TOO_LARGE')
+                        try:data[field]=z.read(member).decode('utf-8-sig')
+                        except (UnicodeError,RuntimeError):raise PackageHold('PROJECT_INPUT_ENCODING_INVALID') from None
+                if not data.get('equipment_csv'):continue
+                label=PurePosixPath(directory).name or 'Customer project'
+                # Project name is a UI convenience, not an inferred equipment or identity.
+                name_text=('Imported '+label.replace('_',' ').replace('-',' '))[:90]
+                wizard={'name':name_text,'industry':'Unspecified Industry',
+                        'layout':'spatial_overview','palette':'r9_cyan',
+                        'description':data.get('description',''),
+                        'equipment_csv':data['equipment_csv'],
+                        'connections_csv':data.get('connections_csv','from,to\n'),
+                        'signals_csv':data.get('signals_csv','id,asset_id,role,datatype,namespace_uri,node_id,unit,polarity\n'),
+                        'requirements':data.get('requirements','')}
+                try:
+                    model=from_wizard(wizard)
+                    state=qualify(model)
+                except (ValueError,TypeError,KeyError):
+                    raise PackageHold('PROJECT_INPUT_SCHEMA_HOLD') from None
+                if state.get('status')!='PASS_STATIC_CONTRACT_ONLY':
+                    raise PackageHold('PROJECT_INPUT_VALIDATION_HOLD')
+                options.append({'id':str(len(options)),'label':label,
+                                'equipment':len(model['equipment']),
+                                'links':len(model['connections']),
+                                'signals':len(model['signals']),
+                                'requirements':len(model['requirements']),
+                                'training':any('TRAINING_ONLY' in s or 'training:' in s.lower() for s in [wizard['signals_csv']]),
+                                'wizard':wizard,
+                                'stage':'UNVERIFIED_CUSTOMER_INPUTS_ONLY'})
+                if len(options)>MAX_PROJECTS:raise PackageHold('TOO_MANY_PROJECTS_IN_PACKAGE')
+            if not options:raise PackageHold('NO_SUPPORTED_CUSTOMER_INPUT_BUNDLE')
+            return {'status':'REVIEW_REQUIRED','package_sha256':hashlib.sha256(raw).hexdigest(),
+                    'options':options,'production':'HOLD','ai_review':'NOT_RUN',
+                    'note':'Only customer input tables were inspected; generated HMI and FAT evidence in the ZIP were ignored.'}
+    except (zipfile.BadZipFile,zipfile.LargeZipFile,EOFError,RuntimeError) as ex:
+        raise PackageHold('PROJECT_PACKAGE_INVALID_ZIP') from ex

devagent_spatial/qualification.py

@@ -0,0 +1,152 @@
+"""Independent deterministic build audit. Never promotes a concept to live HMI qualification."""
+from __future__ import annotations
+import hashlib
+import json
+import re
+from pathlib import Path, PurePosixPath
+from .generator import enrich, fat_inventory, ROOT
+from .model import qualify, json_embed
+from .engineering_expertise import review as expert_review, LIBRARY_VERSION
+from .control_intents import control_plan
+
+ALLOWED = {
+ 'BUILD.json','SHA256SUMS.txt',
+ 'contracts/project.json','contracts/compiled-scene.json','contracts/design-system.json','contracts/operations-policy.json',
+ 'reports/static-validation.json','reports/fat-inventory.json','reports/engineering-review.json','reports/control-readiness.json',
+ 'viewer/index.html','viewer/equipment_controls.mjs','viewer/facility2d_core.mjs','viewer/facility2d_app.mjs','viewer/facility2d_simulation.mjs','viewer/facility2d.css','viewer/style.css','viewer/viewer.js','viewer/three_scene.js','viewer/flow_geometry.mjs','viewer/r9_transport.mjs','viewer/fallback_scene.js','viewer/operations_ui.js','viewer/runtime_feed.js',
+}
+VENDOR={'viewer/vendor/three.module.js','viewer/vendor/three.core.js','viewer/vendor/LICENSE-three.txt'}
+
+
+def _parse_json(path):
+    return json.loads(path.read_text(encoding='utf-8'))
+
+
+def audit(project_dir:Path, *, purpose:str='preview') -> dict:
+    """Validate artifact identity, content and traceability; never invent live evidence."""
+    if purpose not in ('preview','production'):
+        raise ValueError('INVALID_QUALIFICATION_PURPOSE')
+    root=Path(project_dir).expanduser().resolve()
+    issues=[]
+    def hold(code):issues.append(code)
+    if not root.is_dir():
+        return {'status':'HOLD','issues':['PROJECT_DIRECTORY_NOT_FOUND'],'purpose':purpose}
+    # No symlinks, unexpected files or unreadable paths. Files only from fixed allowlist.
+    present=set()
+    for f in root.rglob('*'):
+        if f.is_symlink():hold('SYMLINK_IN_ARTIFACT');continue
+        if f.is_file():present.add(f.relative_to(root).as_posix())
+        elif not f.is_dir():hold('UNEXPECTED_FILE_KIND')
+    if not ALLOWED.issubset(present):hold('REQUIRED_ARTIFACT_MISSING')
+    if not present.issubset(ALLOWED|VENDOR):hold('UNEXPECTED_ARTIFACT_FILE')
+    if present&VENDOR and present&VENDOR!=VENDOR:hold('INCOMPLETE_THREE_VENDOR')
+    if issues:
+        return {'status':'HOLD','purpose':purpose,'issues':sorted(set(issues)),'files_checked':0}
+    checksum_lines=(root/'SHA256SUMS.txt').read_text(encoding='utf-8').splitlines()
+    expected={}
+    for line in checksum_lines:
+        m=re.fullmatch(r'([0-9a-f]{64})  (.+)',line)
+        if not m:hold('INVALID_SHA256_MANIFEST');continue
+        h,relative=m.groups()
+        p=PurePosixPath(relative)
+        if p.is_absolute() or '..' in p.parts or relative in expected or '\\' in relative:
+            hold('UNSAFE_OR_DUPLICATE_MANIFEST_PATH');continue
+        expected[relative]=h
+    if set(expected)!=present-{'SHA256SUMS.txt'}:hold('SHA256_MANIFEST_COVERAGE_FAILURE')
+    for name,h in expected.items():
+        p=root/name
+        if p.is_file() and hashlib.sha256(p.read_bytes()).hexdigest()!=h:
+            hold('ARTIFACT_HASH_MISMATCH')
+    if issues:
+        return {'status':'HOLD','purpose':purpose,'issues':sorted(set(issues)),'files_checked':len(expected)}
+    # All issued preview resources are compiler-owned, not customer-authored JS.
+    # Even a rehashed output must not silently replace the approved R9 renderer.
+    for name in ('viewer.js','three_scene.js','r9_transport.mjs','flow_geometry.mjs','fallback_scene.js','operations_ui.js','runtime_feed.js','style.css','facility2d_core.mjs','facility2d_app.mjs','facility2d_simulation.mjs','facility2d.css','equipment_controls.mjs'):
+        if (root/'viewer'/name).read_bytes()!=(ROOT/'assets'/name).read_bytes():
+            hold('RENDERER_SOURCE_NOT_EQUAL_TO_ISSUED_COMPILER')
+    if issues:
+        return {'status':'HOLD','purpose':purpose,'issues':sorted(set(issues)),'files_checked':len(expected)}
+    try:
+        source=_parse_json(root/'contracts/project.json')
+        compiled=_parse_json(root/'contracts/compiled-scene.json')
+        validation=_parse_json(root/'reports/static-validation.json')
+        inventory=_parse_json(root/'reports/fat-inventory.json')
+        build=_parse_json(root/'BUILD.json')
+        design=_parse_json(root/'contracts/design-system.json')
+        operations_policy=_parse_json(root/'contracts/operations-policy.json')
+        engineering_review=_parse_json(root/'reports/engineering-review.json')
+        commands=_parse_json(root/'reports/control-readiness.json')
+    except (UnicodeError,ValueError,OSError) as e:
+        return {'status':'HOLD','purpose':purpose,'issues':['INVALID_ARTIFACT_JSON'],'detail':type(e).__name__}
+    fresh=qualify(source)
+    if fresh['status']!='PASS_STATIC_CONTRACT_ONLY' or validation!=fresh:hold('STATIC_VALIDATION_NOT_REPRODUCIBLE')
+    if compiled!=enrich(source):hold('COMPILED_SCENE_NOT_REPRODUCIBLE')
+    if commands!=control_plan(compiled):hold('COMMAND_INTENTS_NOT_REPRODUCIBLE')
+    if commands.get('runtime_command_authority')!='NONE' or commands.get('plc_opcua_writes')!='DISABLED' or any(x.get('enabled') is not False for x in commands.get('devices',[])):hold('UNAUTHORIZED_DEVICE_COMMAND_CLAIM')
+    if engineering_review!=expert_review(source):hold('ENGINEERING_REVIEW_NOT_REPRODUCIBLE')
+    if engineering_review.get('production')!='HOLD' or engineering_review.get('native_ignition_bindings')!='NOT_VERIFIED':
+        hold('ENGINEERING_REVIEW_UNSAFE_CLAIM')
+    if engineering_review.get('role_asset_mismatches'):hold('ENGINEERING_ROLE_ASSET_KIND_MISMATCH')
+    if build.get('industrial_knowledge_library')!=LIBRARY_VERSION or build.get('engineering_review')!='STATIC_INSTRUMENTATION_REVIEW_ONLY':
+        hold('INDUSTRIAL_KNOWLEDGE_LIBRARY_PROVENANCE_HOLD')
+    from .operations import policy as compute_operations_policy
+    try:
+        if operations_policy != compute_operations_policy(source):hold('OPERATIONS_POLICY_NOT_REPRODUCIBLE')
+    except (ValueError,KeyError,TypeError):hold('OPERATIONS_POLICY_INVALID')
+    if inventory.get('cases')!=fat_inventory(compiled) or inventory.get('execution')!='NOT_RUN':
+        hold('FAT_INVENTORY_NOT_REPRODUCIBLE')
+    if any(c.get('result')!='HOLD_NOT_EXECUTED' for c in inventory.get('cases',[])):
+        hold('UNSUPPORTED_FAT_PASS_CLAIM')
+    if design!=json.loads((ROOT/'design-system.json').read_text(encoding='utf8')):
+        hold('INVALID_DESIGN_SYSTEM')
+    if design.get('id')!='devagent_spatial_v1':hold('DESIGN_IDENTITY_MISMATCH')
+    if build.get('studio_to_hmi_runtime')!='READ_ONLY_AFTER_EXACT_MANIFEST_AND_PROTOCOL_PROBE' or build.get('hmi_runtime_source')!='ISOLATED_STUDIO_LAB_ONLY_NOT_IGNITION':
+        hold('STUDIO_HMI_SOURCE_AUTHORITY_CONTRACT_CHANGED')
+    if build.get('operations_mapping_digest')!=operations_policy.get('mapping_digest') or build.get('operations_intelligence')!='SOURCE_QUALIFIED_LAB_REPLAY_ONLY':
+        hold('OPERATIONS_POLICY_BINDING_UNSAFE')
+    if build.get('status')!='PASS_STATIC_BUILD_ONLY' or build.get('lab_controls')!='DISABLED' or build.get('device_control_intents')!='PRESENT_LOCKED_UNTIL_VERIFIED':
+        hold('BUILD_CAPABILITY_CLAIM_UNSAFE')
+    if build.get('ignition_project_export')!='NOT_IMPLEMENTED' or build.get('live_opcua')!='NOT_VERIFIED' or build.get('ignition_hmi')!='NOT_VERIFIED':
+        hold('UNSUPPORTED_RUNTIME_CERTIFICATION')
+    embedded=(root/'viewer/index.html').read_text(encoding='utf-8')
+    match=re.search(r'<script\s+type="application/json"\s+id="project-data">(.*?)</script>',embedded,re.S)
+    try:
+        if match is None or json.loads(match.group(1))!=compiled:
+            hold('PREVIEW_MODEL_MISMATCH')
+    except ValueError:
+        hold('PREVIEW_MODEL_INVALID')
+    embedded_ops=re.search(r'<script\s+type="application/json"\s+id="operations-policy">(.*?)</script>', embedded, re.S)
+    try:
+        if embedded_ops is None or json.loads(embedded_ops.group(1))!=operations_policy:
+            hold('OPERATIONS_POLICY_PREVIEW_MISMATCH')
+    except ValueError:hold('OPERATIONS_POLICY_PREVIEW_INVALID')
+    embedded_controls=re.search(r'<script\s+type="application/json"\s+id="control-plan">(.*?)</script>',embedded,re.S)
+    try:
+        if embedded_controls is None or json.loads(embedded_controls.group(1))!=commands:hold('DEVICE_CONTROL_PLAN_PREVIEW_MISMATCH')
+    except ValueError:hold('DEVICE_CONTROL_PLAN_INVALID')
+    expected_html=(ROOT/'assets'/('facility2d_viewer.html' if source['layout']=='standard_2d_flow' else 'operator_viewer.html')).read_bytes().replace(
+        b'__EMBEDDED_PROJECT__', json_embed(compiled).encode('utf-8')).replace(
+        b'__EMBEDDED_OPERATIONS_POLICY__', json_embed(operations_policy).encode('utf-8')).replace(
+        b'__EMBEDDED_CONTROL_PLAN__', json_embed(commands).encode('utf-8'))
+    if (root/'viewer/index.html').read_bytes()!=expected_html:
+        hold('COMPILED_VIEW_HTML_NOT_EQUAL_TO_ISSUED_COMPILER')
+    if build.get('design_variant',source['layout'])!=source['layout']:hold('DESIGN_VARIANT_MISMATCH')
+    if (present&VENDOR==VENDOR)!=bool(build.get('three_vendor_bundled')):
+        hold('RENDERER_MANIFEST_MISMATCH')
+    if purpose=='production':
+        hold('NATIVE_IGNITION_COMPILER_NOT_IMPLEMENTED')
+        hold('LIVE_OPCUA_HMI_FAT_NOT_VERIFIED')
+        hold('CUSTOMER_ACCEPTANCE_NOT_VERIFIED')
+    return {
+        'schema':'devagent.spatial.artifact_qualification.v2',
+        'status':'HOLD' if issues else 'PASS_CONCEPT_PREVIEW_ONLY',
+        'purpose':purpose,
+        'issues':sorted(set(issues)),
+        'files_checked':len(expected),
+        'equipment_count':len(compiled.get('equipment',[])),
+        'signals_proposed':len(compiled.get('signals',[])),
+        'fat_unexecuted':len(inventory.get('cases',[])),
+        'ignition_native':'NOT_VERIFIED',
+        'physical_mapping':'NOT_VERIFIED',
+        'runtime_controls':'DISABLED',
+    }

devagent_spatial/strict_json.py

@@ -0,0 +1,29 @@
+"""Reject ambiguous/unserializable JSON before it enters engineering models."""
+from __future__ import annotations
+import json
+import math
+
+class ContractJSONError(ValueError):
+    pass
+
+
+def loads(raw: str | bytes):
+    def pairs(items):
+        obj = {}
+        for k, v in items:
+            if k in obj:
+                raise ContractJSONError('DUPLICATE_JSON_KEY: '+k[:80])
+            obj[k] = v
+        return obj
+
+    def finite(value):
+        n = float(value)
+        if not math.isfinite(n):
+            raise ContractJSONError('NONFINITE_JSON_NUMBER')
+        return n
+
+    try:
+        return json.loads(raw, object_pairs_hook=pairs, parse_float=finite,
+                          parse_constant=lambda val: (_ for _ in ()).throw(ContractJSONError('NONFINITE_JSON_CONSTANT')))
+    except (RecursionError, OverflowError) as exc:
+        raise ContractJSONError('JSON_COMPLEXITY_LIMIT') from exc