engineering-platform 2.3.103__tar.gz → 2.3.104__tar.gz

{engineering_platform-2.3.103 → engineering_platform-2.3.104}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-platform
-Version: 2.3.103
+Version: 2.3.104
 Summary: Local-first Engineering Platform execution operations runtime
 Author: Peter van Tol
 License: MIT

{engineering_platform-2.3.103 → engineering_platform-2.3.104}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-platform"
-version = "2.3.103"
+version = "2.3.104"
 description = "Local-first Engineering Platform execution operations runtime"
 readme = "README.md"
 requires-python = ">=3.14,<3.15"

{engineering_platform-2.3.103 → engineering_platform-2.3.104}/src/engineering_platform/ENGINEERING_PLATFORM_CONFIG.json

@@ -3,7 +3,7 @@
   "platform": {
     "id": "engineering-platform",
     "name": "Engineering Platform",
-    "version": "2.3.103",
+    "version": "2.3.104",
     "generation": 2,
     "documentation_namespace": "engineering-platform",
     "capability_registry_version": 1

{engineering_platform-2.3.103 → engineering_platform-2.3.104}/src/engineering_platform/ENGINEERING_PLATFORM_VERSION.json

@@ -1,15 +1,15 @@
 {
   "bootstrap_contract": "2026.12",
   "checkpoint_format": 1,
-  "dashboard_version": "2.3.103",
+  "dashboard_version": "2.3.104",
   "handoff_protocol": 1,
   "memory_format": 2,
   "minimum_codex_cli": "0.146.0",
   "inbox_protocol": 1,
-  "platform_version": "2.3.103",
+  "platform_version": "2.3.104",
   "report_format": 2,
-  "runner_version": "2.3.103",
+  "runner_version": "2.3.104",
   "status_model": 1,
   "storage_schema": 45,
-  "watcher_version": "2.3.103"
+  "watcher_version": "2.3.104"
 }

{engineering_platform-2.3.103 → engineering_platform-2.3.104}/src/engineering_platform/platform_version.py

@@ -12,7 +12,7 @@ from .storage import ENGINEERING_STORAGE_SCHEMA_VERSION
 
 SEMVER = re.compile(r"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$")
 CONTRACT = re.compile(r"^(\d{4})\.(0[1-9]|1[0-2])$")
-CURRENT_PLATFORM_VERSION = "2.3.103"
+CURRENT_PLATFORM_VERSION = "2.3.104"
 MANIFEST_FIELDS = frozenset(
     {
         "platform_version",

{engineering_platform-2.3.103 → engineering_platform-2.3.104}/src/engineering_platform/system_instance_lifecycle.py

@@ -97,10 +97,22 @@ def _atomic_json(path: Path, value: Mapping[str, object]) -> None:
         temporary.unlink(missing_ok=True)
 
 
+def _assert_owned_mode(path: Path, details: os.stat_result) -> None:
+    if stat.S_IMODE(details.st_mode) & 0o022:
+        raise SystemInstanceLifecycleError(
+            f"EP preserved instance contains group/world-writable entry: {path}"
+        )
+
+
 def _regular_digest(path: Path) -> str:
     details = path.lstat()
     if path.is_symlink() or not stat.S_ISREG(details.st_mode):
         raise SystemInstanceLifecycleError(f"EP preserved instance contains unsafe entry: {path}")
+    _assert_owned_mode(path, details)
+    if details.st_nlink != 1:
+        raise SystemInstanceLifecycleError(
+            f"EP preserved instance contains non-exclusive hardlink: {path}"
+        )
     digest = hashlib.sha256()
     with path.open("rb") as stream:
         while True:
@@ -118,6 +130,7 @@ def _tree_digest(root: Path, *, ignored_roots: tuple[Path, ...] = ()) -> str:
         raise SystemInstanceLifecycleError("EP preserved instance root is unavailable") from error
     if root.is_symlink() or not stat.S_ISDIR(details.st_mode):
         raise SystemInstanceLifecycleError("EP preserved instance root is unsafe")
+    _assert_owned_mode(root, details)
     ignored: tuple[tuple[str, ...], ...] = tuple(
         path.relative_to(root).parts for path in ignored_roots
     )
@@ -137,6 +150,7 @@ def _tree_digest(root: Path, *, ignored_roots: tuple[Path, ...] = ()) -> str:
             info = path.lstat()
             if stat.S_ISLNK(info.st_mode) or not stat.S_ISDIR(info.st_mode):
                 raise SystemInstanceLifecycleError(f"EP preserved instance contains unsafe entry: {path}")
+            _assert_owned_mode(path, info)
             entries.append({
                 "path": str(path.relative_to(root)),
                 "kind": "DIRECTORY",
@@ -327,6 +341,7 @@ class SystemInstanceLifecycle:
                 raise SystemInstanceLifecycleError("EP preserved instance changed after terminal preserve")
             return receipt
         with _Lock(instance.lifecycle_lock):
+            _tree_digest(instance.root)
             self.controller.remove(instance)
             if self.controller.loaded(instance) or self.service_interpreter(instance) is not None:
                 raise SystemInstanceLifecycleError("EP preserved service was not fully removed")
@@ -441,6 +456,10 @@ class SystemInstanceLifecycle:
         if state.get("phase") == "COMPLETE":
             return state
         with _Lock(instance.lifecycle_lock):
+            _tree_digest(
+                instance.root,
+                ignored_roots=(instance.operations_root / operation_id,),
+            )
             self.controller.remove(instance)
             if self.controller.loaded(instance) or self.service_interpreter(instance) is not None:
                 raise SystemInstanceLifecycleError("EP purge service was not fully removed")

{engineering_platform-2.3.103 → engineering_platform-2.3.104}/src/engineering_platform/templates/workspace-config.json

@@ -3,7 +3,7 @@
   "platform": {
     "id": "engineering-platform",
     "name": "Engineering Platform",
-    "version": "2.3.103",
+    "version": "2.3.104",
     "generation": 2,
     "documentation_namespace": "engineering-platform",
     "capability_registry_version": 1

{engineering_platform-2.3.103 → engineering_platform-2.3.104}/src/engineering_platform.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-platform
-Version: 2.3.103
+Version: 2.3.104
 Summary: Local-first Engineering Platform execution operations runtime
 Author: Peter van Tol
 License: MIT