engineering-platform 2.3.88__tar.gz → 2.3.89__tar.gz

{engineering_platform-2.3.88 → engineering_platform-2.3.89}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-platform
-Version: 2.3.88
+Version: 2.3.89
 Summary: Local-first Engineering Platform execution operations runtime
 Author: Peter van Tol
 License: MIT

{engineering_platform-2.3.88 → engineering_platform-2.3.89}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-platform"
-version = "2.3.88"
+version = "2.3.89"
 description = "Local-first Engineering Platform execution operations runtime"
 readme = "README.md"
 requires-python = ">=3.14,<3.15"

{engineering_platform-2.3.88 → engineering_platform-2.3.89}/src/engineering_platform/ENGINEERING_PLATFORM_CONFIG.json

@@ -3,7 +3,7 @@
   "platform": {
     "id": "engineering-platform",
     "name": "Engineering Platform",
-    "version": "2.3.88",
+    "version": "2.3.89",
     "generation": 2,
     "documentation_namespace": "engineering-platform",
     "capability_registry_version": 1

{engineering_platform-2.3.88 → engineering_platform-2.3.89}/src/engineering_platform/ENGINEERING_PLATFORM_VERSION.json

@@ -1,15 +1,15 @@
 {
   "bootstrap_contract": "2026.12",
   "checkpoint_format": 1,
-  "dashboard_version": "2.3.88",
+  "dashboard_version": "2.3.89",
   "handoff_protocol": 1,
   "memory_format": 2,
   "minimum_codex_cli": "0.146.0",
   "inbox_protocol": 1,
-  "platform_version": "2.3.88",
+  "platform_version": "2.3.89",
   "report_format": 2,
-  "runner_version": "2.3.88",
+  "runner_version": "2.3.89",
   "status_model": 1,
   "storage_schema": 45,
-  "watcher_version": "2.3.88"
+  "watcher_version": "2.3.89"
 }

{engineering_platform-2.3.88 → engineering_platform-2.3.89}/src/engineering_platform/central_operational_reset.py

@@ -36,7 +36,7 @@ from .storage import sqlite_connection
 
 PROFILE = "EP_CENTRAL_OPERATIONAL_HISTORY_V1"
 PLAN_VERSION = 2
-SCHEMA_VERSION = 71
+SCHEMA_VERSION = 72
 _OPERATION = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{7,127}")
 _INSTANCE_ID = re.compile(
     r"[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}"
@@ -66,6 +66,7 @@ INSTALLATION_AND_CONFIGURATION = frozenset({
     "ep_project_registrations", "ep_repository_registrations",
     "ep_agent_registrations", "ep_agent_repository_attachments",
     "ep_local_repository_bindings", "ep_external_producer_bindings",
+    "ep_assurance_target_selections",
     "execution_migration_provenance",
 })
 SECURITY_AND_AUTHORITY_LEDGER = frozenset({

{engineering_platform-2.3.88 → engineering_platform-2.3.89}/src/engineering_platform/execution_host.py

@@ -3898,12 +3898,14 @@ First implementation pull-request publication gate:
         try:
             with sqlite_connection(self.store.central_database) as connection:
                 grant = merge_delegation.load(connection, state.merge_delegation_id)
+                selection_current = bool(grant and merge_delegation.target_selection_permits(connection, grant))
         except (EngineeringStorageError, sqlite3.Error):
             return False
-        return bool(grant and grant.assurance_profile_id == "qualification-autonomous-qs"
-                    and grant.assurance_profile_revision == "1"
+        return bool(grant and selection_current and grant.assurance_profile_revision == "1"
                     and grant.github_repository == state.repository
-                    == merge_delegation.AUTONOMOUS_ASSURANCE_REPOSITORY)
+                    and (grant.assurance_profile_id == merge_delegation.REPOSITORY_ASSURANCE_ID
+                         or (grant.assurance_profile_id == "qualification-autonomous-qs"
+                             and state.repository == merge_delegation.AUTONOMOUS_ASSURANCE_REPOSITORY)))
 
     def _recover_autonomous_pr_assurance(
         self, state: TransactionState, candidate: PullRequestEvidence,
@@ -4013,7 +4015,8 @@ First implementation pull-request publication gate:
                     (state.run_id,),
                 ).fetchone()
                 grant = merge_delegation.load(connection, state.merge_delegation_id)
-            if scope is None or grant is None or not isinstance(accepted, dict):
+                selection_current = bool(grant and merge_delegation.target_selection_permits(connection, grant))
+            if scope is None or grant is None or not selection_current or not isinstance(accepted, dict):
                 return None
             if Path(str(scope[2])).resolve() != self.root.resolve():
                 return None
@@ -4057,17 +4060,21 @@ First implementation pull-request publication gate:
             qualifier = getattr(self.github, "delegated_merge_qualification", None)
             if not callable(qualifier):
                 return None
-            autonomous_profile = (
-                grant.assurance_profile_id == "qualification-autonomous-qs"
-                and grant.assurance_profile_revision == "1"
-            )
+            autonomous_profile = (grant.assurance_profile_revision == "1" and
+                                  grant.assurance_profile_id in {
+                                      "qualification-autonomous-qs",
+                                      merge_delegation.REPOSITORY_ASSURANCE_ID})
             if grant.assurance_profile_id or grant.assurance_profile_revision:
                 if (not autonomous_profile
-                        or grant.github_repository != merge_delegation.AUTONOMOUS_ASSURANCE_REPOSITORY
+                        or (grant.assurance_profile_id == "qualification-autonomous-qs"
+                            and grant.github_repository != merge_delegation.AUTONOMOUS_ASSURANCE_REPOSITORY)
                         or not self._autonomous_merge_assurance_passes(state, expected_head)):
                     return None
+            selected_profile = (merge_delegation.REPOSITORY_ASSURANCE_PROFILE
+                                if grant.assurance_profile_id == merge_delegation.REPOSITORY_ASSURANCE_ID
+                                else merge_delegation.AUTONOMOUS_ASSURANCE_PROFILE)
             qualification = (qualifier(fresh.number, expected_head,
-                                      assurance_profile=merge_delegation.AUTONOMOUS_ASSURANCE_PROFILE)
+                                      assurance_profile=selected_profile)
                              if autonomous_profile else qualifier(fresh.number, expected_head))
             if (not isinstance(qualification, dict) or qualification.get("conclusion") != "PASS"
                     or qualification.get("exact_qualified_sha") != expected_head
@@ -4094,7 +4101,8 @@ First implementation pull-request publication gate:
                 return None
             with sqlite_connection(self.store.central_database) as connection:
                 current_grant = merge_delegation.load(connection, state.merge_delegation_id)
-            if (current_grant is None or not current_grant.permits(
+                current_selection = bool(current_grant and merge_delegation.target_selection_permits(connection, current_grant))
+            if (current_grant is None or not current_selection or not current_grant.permits(
                     project_id=str(scope[0]), repository_id=str(scope[1]),
                     mission_id=str(accepted.get("mission_id")), mission_revision=str(mission_revision),
                     role=state.transaction_kind, base_branch="main",
@@ -4108,7 +4116,9 @@ First implementation pull-request publication gate:
                 policy_reader = getattr(self.github, "_autonomous_effective_policy", None)
                 if not callable(policy_reader):
                     return None
-                current_policy = policy_reader()
+                current_policy = (policy_reader(assurance_profile=selected_profile)
+                                  if grant.assurance_profile_id == merge_delegation.REPOSITORY_ASSURANCE_ID
+                                  else policy_reader())
                 if (not isinstance(current_policy, dict)
                         or current_policy.get("digest") != current_grant.assurance_policy_digest):
                     return None
@@ -4118,7 +4128,21 @@ First implementation pull-request publication gate:
             attempted = replace(state, delegated_merge_attempt=attempt,
                                 delegated_merge_actor_reference=None)
             self.store.save(attempted)
-            self.github.merge(fresh.number, expected_head_sha=expected_head)
+            # Linearize revocation against the external merge call. A revoke
+            # committed before this lock is observed; one waiting for this lock
+            # can only commit after the bounded call has returned.
+            with sqlite_connection(self.store.central_database) as authority:
+                authority.execute("BEGIN IMMEDIATE")
+                final_grant = merge_delegation.load(authority, state.merge_delegation_id)
+                if (final_grant is None or not final_grant.permits(
+                        project_id=str(scope[0]), repository_id=str(scope[1]),
+                        mission_id=str(accepted.get("mission_id")),
+                        mission_revision=str(mission_revision),
+                        role=state.transaction_kind, base_branch="main")
+                        or not merge_delegation.target_selection_permits(authority, final_grant)
+                        or final_grant != current_grant):
+                    raise ValueError("merge authority changed before the external call")
+                self.github.merge(fresh.number, expected_head_sha=expected_head)
             merged = self.github.pull_request(fresh.number)
             self.repository.refresh_main_reference(self.root)
             if (merged.state == "MERGED" and merged.head_sha == expected_head

{engineering_platform-2.3.88 → engineering_platform-2.3.89}/src/engineering_platform/execution_repository.py

@@ -360,10 +360,17 @@ class GhCliClient:
         except RuntimeError as error:
             raise RunnerError("Pull request Markdown could not be normalized.") from error
         return True
-    def _autonomous_effective_policy(self) -> dict[str, object]:
+    def _autonomous_effective_policy(self, *, assurance_profile: str = "qualification-autonomous-qs@1") -> dict[str, object]:
         """Read all active main rules and classic protection without inferring zero from errors."""
-        if self.repository != "pcvantol/forge-mission-qualification":
+        if (assurance_profile == "qualification-autonomous-qs@1"
+                and self.repository != "pcvantol/forge-mission-qualification"):
             raise RunnerError("Autonomous assurance profile has a different repository scope.")
+        if assurance_profile not in {"qualification-autonomous-qs@1", "repository-autonomous-qs@1"}:
+            raise RunnerError("Unknown delegated merge assurance profile.")
+        repository_profile = assurance_profile == "repository-autonomous-qs@1"
+        if repository_profile and (not isinstance(self.repository, str)
+                                   or re.fullmatch(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+", self.repository) is None):
+            raise RunnerError("Autonomous assurance requires an exact repository.")
         try:
             raw_rules = json.loads(self._github("api", f"repos/{self.repository}/rules/branches/main?per_page=100"))
         except (RuntimeError, json.JSONDecodeError) as error:
@@ -415,6 +422,13 @@ class GhCliClient:
         required_apps: dict[str, set[int]] = {}
         strict_values: list[bool] = []
         required_approvals: list[int] = []
+        required_thread_resolution = False
+        classic_conversations = classic.get("required_conversation_resolution") if classic else None
+        if repository_profile and classic_conversations is not None:
+            if (not isinstance(classic_conversations, dict)
+                    or not isinstance(classic_conversations.get("enabled"), bool)):
+                raise RunnerError("Classic review-thread policy is incomplete.")
+            required_thread_resolution = classic_conversations["enabled"]
         classic_checks = classic.get("required_status_checks") if classic else None
         if classic_checks is not None:
             if not isinstance(classic_checks, dict) or not isinstance(classic_checks.get("strict"), bool):
@@ -442,9 +456,10 @@ class GhCliClient:
             if (isinstance(count, bool) or not isinstance(count, int) or count < 0
                     or classic_reviews.get("require_code_owner_reviews") is True
                     or classic_reviews.get("require_last_push_approval") is True
-                    or classic_reviews.get("required_review_thread_resolution") is True):
+                    or (classic_reviews.get("required_review_thread_resolution") is True and not repository_profile)):
                 raise RunnerError("Classic review policy requires unsupported or unknown approval evidence.")
             required_approvals.append(count)
+            required_thread_resolution |= classic_reviews.get("required_review_thread_resolution") is True
         supported = {"required_status_checks", "pull_request", "non_fast_forward", "deletion", "required_linear_history"}
         for rule in verified_rules:
             rule_type, parameters = rule.get("type"), rule.get("parameters")
@@ -467,13 +482,28 @@ class GhCliClient:
             elif rule_type == "pull_request":
                 if not isinstance(parameters, dict):
                     raise RunnerError("Ruleset pull-request policy is incomplete.")
+                if repository_profile:
+                    supported_parameters = {
+                        "allowed_merge_methods", "dismiss_stale_reviews_on_push",
+                        "require_code_owner_review", "require_extra_approval_for_unattributed_changes",
+                        "require_last_push_approval", "required_approving_review_count",
+                        "required_review_thread_resolution", "required_reviewers",
+                    }
+                    if (set(parameters) - supported_parameters
+                            or parameters.get("require_extra_approval_for_unattributed_changes") is True
+                            or parameters.get("require_last_push_approval") is True
+                            or ("allowed_merge_methods" in parameters
+                                and (not isinstance(parameters["allowed_merge_methods"], list)
+                                     or "squash" not in parameters["allowed_merge_methods"]))):
+                        raise RunnerError("Ruleset pull-request policy has an unsupported merge condition.")
                 count = parameters.get("required_approving_review_count")
                 if (isinstance(count, bool) or not isinstance(count, int) or count < 0
                         or parameters.get("require_code_owner_review") is True
-                        or parameters.get("required_review_thread_resolution") is True
+                        or (parameters.get("required_review_thread_resolution") is True and not repository_profile)
                         or parameters.get("required_reviewers")):
                     raise RunnerError("Ruleset review policy requires unsupported or unknown approval evidence.")
                 required_approvals.append(count)
+                required_thread_resolution |= parameters.get("required_review_thread_resolution") is True
         if not required_checks or not strict_values or not all(strict_values):
             raise RunnerError("Autonomous assurance requires strict protected status checks.")
         effective_rule_types = {rule.get("type") for rule in verified_rules}
@@ -484,16 +514,74 @@ class GhCliClient:
         policy = {"source": "github-effective-main", "classic": classic,
                   "rulesets": verified_rules, "required_checks": sorted(required_checks),
                   "required_apps": {name: sorted(apps) for name, apps in sorted(required_apps.items())},
-                  "required_approvals": max(required_approvals, default=0), "strict_checks": True}
-        policy["digest"] = "sha256:" + hashlib.sha256(json.dumps(policy, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+                  "required_approvals": max(required_approvals, default=0), "strict_checks": True,
+                  "required_thread_resolution": required_thread_resolution}
+        if repository_profile:
+            # GitHub embeds observation URLs and other changing metadata in
+            # protection responses. Bind only the effective rule semantics.
+            classic_binding = None
+            if classic is not None:
+                classic_binding = {
+                    "enforce_admins": classic["enforce_admins"]["enabled"],
+                    "allow_force_pushes": classic["allow_force_pushes"]["enabled"],
+                    "allow_deletions": classic["allow_deletions"]["enabled"],
+                    "required_conversation_resolution": None if classic_conversations is None
+                        else classic_conversations["enabled"],
+                    "required_status_checks": None if classic_checks is None else {
+                        "strict": classic_checks["strict"],
+                        "contexts": sorted(classic_checks["contexts"]),
+                        "checks": sorted(({"context": item["context"],
+                                           "app_id": item.get("app_id")}
+                                          for item in classic_checks["checks"]),
+                                         key=lambda item: (item["context"], str(item["app_id"]))),
+                    },
+                    "required_pull_request_reviews": None if classic_reviews is None else {
+                        "required_approving_review_count": classic_reviews["required_approving_review_count"],
+                        "dismiss_stale_reviews": classic_reviews.get("dismiss_stale_reviews", False),
+                        "require_code_owner_reviews": classic_reviews.get("require_code_owner_reviews", False),
+                        "require_last_push_approval": classic_reviews.get("require_last_push_approval", False),
+                        "required_review_thread_resolution": classic_reviews.get("required_review_thread_resolution", False),
+                    },
+                }
+            stable_rules = []
+            for item in verified_rules:
+                parameters = item.get("parameters")
+                if isinstance(parameters, dict):
+                    parameters = dict(parameters)
+                    if item["type"] == "required_status_checks":
+                        parameters["required_status_checks"] = sorted(
+                            parameters["required_status_checks"],
+                            key=lambda check: (check["context"], str(check.get("integration_id"))))
+                    elif item["type"] == "pull_request" and "allowed_merge_methods" in parameters:
+                        parameters["allowed_merge_methods"] = sorted(parameters["allowed_merge_methods"])
+                stable_rules.append({"ruleset_id": item["ruleset_id"],
+                                     "type": item["type"], "parameters": parameters})
+            policy_binding = {
+                "version": "repository-effective-main/v1",
+                "repository": self.repository,
+                "classic": classic_binding,
+                "rulesets": sorted(stable_rules,
+                                    key=lambda item: (item["ruleset_id"], item["type"],
+                                                      json.dumps(item["parameters"], sort_keys=True))),
+                "required_checks": policy["required_checks"],
+                "required_apps": policy["required_apps"],
+                "required_approvals": policy["required_approvals"],
+                "required_thread_resolution": required_thread_resolution,
+                "strict_checks": True,
+            }
+        else:
+            # Preserve the original synthetic profile's immutable digest semantics.
+            policy_binding = {key: value for key, value in policy.items()
+                              if key != "required_thread_resolution"}
+        policy["digest"] = "sha256:" + hashlib.sha256(json.dumps(policy_binding, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
         return policy
 
     def delegated_merge_qualification(self, number: int, head_sha: str, *, assurance_profile: str | None = None) -> dict[str, object]:
         """Fresh protected checks and independent head-bound GitHub reviews."""
-        autonomous = assurance_profile == "qualification-autonomous-qs@1"
+        autonomous = assurance_profile in {"qualification-autonomous-qs@1", "repository-autonomous-qs@1"}
         if assurance_profile is not None and not autonomous:
             raise RunnerError("Unknown delegated merge assurance profile.")
-        policy = self._autonomous_effective_policy() if autonomous else None
+        policy = self._autonomous_effective_policy(assurance_profile=assurance_profile) if autonomous else None
         if policy is None:
             checks = self.qualification_for_exact_head(number, head_sha)
         else:
@@ -506,12 +594,24 @@ class GhCliClient:
             if not isinstance(raw, dict) or raw.get("headRefOid") != head_sha or raw.get("baseRefName") != "main":
                 raise RunnerError("Autonomous PR qualification has a changed head or base.")
             rollup = raw.get("statusCheckRollup")
-            if not isinstance(rollup, list) or not rollup or any(
-                not isinstance(item, dict) or item.get("status") != "COMPLETED"
-                or item.get("conclusion") not in {"SUCCESS", "NEUTRAL", "SKIPPED"} for item in rollup
-            ):
+            if not isinstance(rollup, list) or not rollup:
                 raise RunnerError("Autonomous PR required checks are incomplete or failed.")
-            observed = {item.get("name") for item in rollup}
+            observed: set[str] = set()
+            for item in rollup:
+                if not isinstance(item, dict):
+                    raise RunnerError("Autonomous PR required checks are incomplete or failed.")
+                if item.get("__typename") == "StatusContext" or (
+                    "context" in item and "state" in item and "name" not in item
+                ):
+                    name = item.get("context")
+                    passed = item.get("state") == "SUCCESS"
+                else:
+                    name = item.get("name")
+                    passed = (item.get("status") == "COMPLETED" and
+                              item.get("conclusion") in {"SUCCESS", "NEUTRAL", "SKIPPED"})
+                if not isinstance(name, str) or not name or not passed:
+                    raise RunnerError("Autonomous PR required checks are incomplete or failed.")
+                observed.add(name)
             if not set(policy["required_checks"]) <= observed:
                 raise RunnerError("Autonomous PR is missing effective required checks.")
             if policy["required_apps"]:
@@ -562,17 +662,37 @@ class GhCliClient:
             raise RunnerError("Delegated merge requires protected independent review policy.")
         latest: dict[str, tuple[str, str]] = {}
         for review in reviews:
-            if not isinstance(review, dict):
-                continue
-            reviewer = (review.get("user") or {}).get("login")
-            if isinstance(reviewer, str) and reviewer:
-                latest[reviewer] = (str(review.get("state")), str(review.get("commit_id")))
+            if not isinstance(review, dict) or not isinstance(review.get("user"), dict):
+                raise RunnerError("Delegated merge review evidence is incomplete.")
+            reviewer = review["user"].get("login")
+            decision = review.get("state")
+            if not isinstance(reviewer, str) or not reviewer or not isinstance(decision, str):
+                raise RunnerError("Delegated merge review evidence is incomplete.")
+            latest[reviewer] = (decision, str(review.get("commit_id")))
+        if any(decision == "CHANGES_REQUESTED" for decision, _commit in latest.values()):
+            raise RunnerError("Delegated merge has an unresolved changes-requested review.")
         approvals = sorted(
             reviewer for reviewer, (decision, commit) in latest.items()
             if reviewer != author and decision == "APPROVED" and commit == head_sha
         )
         if len(approvals) < required:
             raise RunnerError("Delegated merge lacks required independent approvals for this exact head.")
+        if policy is not None and policy["required_thread_resolution"]:
+            owner, repository_name = self.repository.split("/", 1)
+            query = ("query { repository(owner:\"" + owner + "\",name:\"" + repository_name
+                     + "\") { pullRequest(number:" + str(number)
+                     + ") { reviewThreads(first:100) { totalCount nodes { isResolved } } } } }")
+            try:
+                response = json.loads(self._github("api", "graphql", "-f", "query=" + query))
+                threads = response["data"]["repository"]["pullRequest"]["reviewThreads"]
+            except (RuntimeError, ValueError, KeyError, TypeError) as error:
+                raise RunnerError("Required review-thread resolution could not be read.") from error
+            nodes = threads.get("nodes") if isinstance(threads, dict) else None
+            if (not isinstance(nodes, list) or not isinstance(threads.get("totalCount"), int)
+                    or threads["totalCount"] != len(nodes) or len(nodes) >= 100
+                    or any(not isinstance(item, dict) or item.get("isResolved") is not True
+                           for item in nodes)):
+                raise RunnerError("Delegated merge has unresolved or unreadable review threads.")
         return {**checks, "reviewers": approvals, "required_approvals": required}
 
     def merge(self, number: int, *, expected_head_sha: str | None = None) -> None:

{engineering_platform-2.3.88 → engineering_platform-2.3.89}/src/engineering_platform/merge_delegation.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
+import hashlib
 import re
 import sqlite3
 import subprocess
@@ -22,6 +23,8 @@ _REPOSITORY = re.compile(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+\Z")
 _ROLES = frozenset({"IMPLEMENTATION", "FINALIZATION", "RECONCILIATION"})
 AUTONOMOUS_ASSURANCE_PROFILE = "qualification-autonomous-qs@1"
 AUTONOMOUS_ASSURANCE_REPOSITORY = "pcvantol/forge-mission-qualification"
+REPOSITORY_ASSURANCE_PROFILE = "repository-autonomous-qs@1"
+REPOSITORY_ASSURANCE_ID = "repository-autonomous-qs"
 
 
 @dataclass(frozen=True)
@@ -41,6 +44,7 @@ class MergeDelegation:
     assurance_profile_id: str = ""
     assurance_profile_revision: str = ""
     assurance_policy_digest: str = ""
+    target_selection_revision: int = 0
 
     def permits(self, *, project_id: str, repository_id: str, mission_id: str,
                 mission_revision: str, role: str, base_branch: str,
@@ -77,16 +81,104 @@ def install_schema(connection: sqlite3.Connection) -> None:
         assurance_profile_id TEXT NOT NULL DEFAULT '',
         assurance_profile_revision TEXT NOT NULL DEFAULT '',
         assurance_policy_digest TEXT NOT NULL DEFAULT ''
+        ,target_selection_revision INTEGER NOT NULL DEFAULT 0
     )""")
+    install_selection_schema(connection)
     install_profile_guard(connection)
 
 
+def install_selection_schema(connection: sqlite3.Connection) -> None:
+    """Append-only owner decisions; revision zero means no decision."""
+    connection.execute("""CREATE TABLE IF NOT EXISTS ep_assurance_target_selections (
+        project_id TEXT NOT NULL, repository_id TEXT NOT NULL,
+        revision INTEGER NOT NULL CHECK(revision > 0),
+        github_repository TEXT NOT NULL, binding_digest TEXT NOT NULL,
+        profile_id TEXT NOT NULL,
+        profile_revision TEXT NOT NULL, actor_reference TEXT NOT NULL,
+        policy_digest TEXT NOT NULL, selected_at TEXT NOT NULL,
+        PRIMARY KEY(project_id,repository_id,revision)
+    )""")
+    for operation in ("UPDATE", "DELETE"):
+        connection.execute(f"""CREATE TRIGGER IF NOT EXISTS ep_assurance_target_selections_immutable_{operation.lower()}
+            BEFORE {operation} ON ep_assurance_target_selections
+            BEGIN SELECT RAISE(ABORT, 'assurance target selection is immutable'); END""")
+
+
+def target_selection(connection: sqlite3.Connection, project_id: str,
+                     repository_id: str) -> dict[str, object] | None:
+    row = connection.execute("""SELECT revision,github_repository,binding_digest,profile_id,
+        profile_revision,actor_reference,policy_digest,selected_at
+        FROM ep_assurance_target_selections WHERE project_id=? AND repository_id=?
+        ORDER BY revision DESC LIMIT 1""", (project_id, repository_id)).fetchone()
+    if row is None:
+        return None
+    return dict(zip(("revision", "github_repository", "binding_digest", "profile_id", "profile_revision",
+                     "actor_reference", "policy_digest", "selected_at"), row))
+
+
+def _current_binding_digest(connection: sqlite3.Connection, project_id: str,
+                            repository_id: str) -> str | None:
+    row = connection.execute("""SELECT local_root,updated_at FROM ep_local_repository_bindings
+        WHERE project_id=? AND repository_id=? AND state='BOUND'""",
+        (project_id, repository_id)).fetchone()
+    if row is None or not all(isinstance(value, str) and value for value in row):
+        return None
+    return "sha256:" + hashlib.sha256((row[0] + "\0" + row[1]).encode()).hexdigest()
+
+
+def select_target_profile(connection: sqlite3.Connection, *, project_id: str,
+                          repository_id: str, github_repository: str,
+                          actor_reference: str, policy_digest: str,
+                          expected_revision: int, revoke: bool = False) -> dict[str, object]:
+    """Record one owner decision after the caller checks actual registration and origin."""
+    current = target_selection(connection, project_id, repository_id)
+    binding_digest = (str(current["binding_digest"]) if revoke and current else
+                      _current_binding_digest(connection, project_id, repository_id))
+    revision = int(current["revision"]) if current else 0
+    if (not isinstance(expected_revision, int) or expected_revision != revision
+            or not actor_reference.startswith("local-uid:")
+            or _REPOSITORY.fullmatch(github_repository) is None
+            or binding_digest is None
+            or re.fullmatch(r"sha256:[0-9a-f]{64}", policy_digest) is None
+            or current is not None and current["github_repository"] != github_repository
+               and (revoke or current["profile_id"] != "")):
+        raise ValueError("target profile selection scope or revision changed")
+    profile_id, profile_revision = ("", "") if revoke else (REPOSITORY_ASSURANCE_ID, "1")
+    connection.execute("""INSERT INTO ep_assurance_target_selections
+        (project_id,repository_id,revision,github_repository,binding_digest,profile_id,
+         profile_revision,actor_reference,policy_digest,selected_at)
+        VALUES(?,?,?,?,?,?,?,?,?,?)""", (project_id, repository_id, revision + 1,
+        github_repository, binding_digest, profile_id, profile_revision, actor_reference, policy_digest,
+        datetime.now(timezone.utc).isoformat()))
+    result = target_selection(connection, project_id, repository_id)
+    assert result is not None
+    return result
+
+
+def target_selection_permits(connection: sqlite3.Connection, grant: MergeDelegation) -> bool:
+    if grant.assurance_profile_id != REPOSITORY_ASSURANCE_ID:
+        return grant.assurance_profile_id in ("", "qualification-autonomous-qs")
+    selected = target_selection(connection, grant.project_id, grant.repository_id)
+    return bool(selected and selected["revision"] == grant.target_selection_revision
+                and selected["github_repository"] == grant.github_repository
+                and selected["binding_digest"] == _current_binding_digest(
+                    connection, grant.project_id, grant.repository_id)
+                and selected["profile_id"] == grant.assurance_profile_id
+                and selected["profile_revision"] == grant.assurance_profile_revision
+                and selected["policy_digest"] == grant.assurance_policy_digest)
+
+
 def install_profile_guard(connection: sqlite3.Connection) -> None:
+    columns = {str(row[1]) for row in connection.execute("PRAGMA table_info(ep_merge_delegations)")}
+    if "target_selection_revision" not in columns:
+        connection.execute("ALTER TABLE ep_merge_delegations ADD COLUMN target_selection_revision INTEGER NOT NULL DEFAULT 0")
+    connection.execute("DROP TRIGGER IF EXISTS ep_merge_delegations_profile_immutable")
     connection.execute("""CREATE TRIGGER IF NOT EXISTS ep_merge_delegations_profile_immutable
-        BEFORE UPDATE OF assurance_profile_id, assurance_profile_revision, assurance_policy_digest ON ep_merge_delegations
+        BEFORE UPDATE OF assurance_profile_id, assurance_profile_revision, assurance_policy_digest, target_selection_revision ON ep_merge_delegations
         WHEN NEW.assurance_profile_id != OLD.assurance_profile_id
           OR NEW.assurance_profile_revision != OLD.assurance_profile_revision
           OR NEW.assurance_policy_digest != OLD.assurance_policy_digest
+          OR NEW.target_selection_revision != OLD.target_selection_revision
         BEGIN SELECT RAISE(ABORT, 'merge delegation assurance profile is immutable'); END""")
 
 
@@ -128,12 +220,25 @@ def reserve(connection: sqlite3.Connection, *, delegation_id: str, actor_referen
     now = datetime.now(timezone.utc)
     if expiry.tzinfo is None or not now < expiry <= now + timedelta(days=7):
         raise ValueError("merge delegation expiry must be within seven days")
-    if assurance_profile is not None and (
-        assurance_profile != AUTONOMOUS_ASSURANCE_PROFILE
-        or github_repository != AUTONOMOUS_ASSURANCE_REPOSITORY
-    ):
+    selection_revision = 0
+    if assurance_profile == AUTONOMOUS_ASSURANCE_PROFILE:
+        if github_repository != AUTONOMOUS_ASSURANCE_REPOSITORY:
+            raise ValueError("autonomous assurance profile is unavailable for this repository")
+        profile_id, profile_revision = "qualification-autonomous-qs", "1"
+    elif assurance_profile == REPOSITORY_ASSURANCE_PROFILE:
+        selection = target_selection(connection, project_id, repository_id)
+        if (selection is None or selection["github_repository"] != github_repository
+                or selection["binding_digest"] != _current_binding_digest(connection, project_id, repository_id)
+                or selection["profile_id"] != REPOSITORY_ASSURANCE_ID
+                or selection["profile_revision"] != "1"
+                or selection["policy_digest"] != assurance_policy_digest):
+            raise ValueError("repository assurance profile lacks a current owner selection")
+        selection_revision = int(selection["revision"])
+        profile_id, profile_revision = REPOSITORY_ASSURANCE_ID, "1"
+    elif assurance_profile is None:
+        profile_id, profile_revision = "", ""
+    else:
         raise ValueError("autonomous assurance profile is unavailable for this repository")
-    profile_id, profile_revision = ("qualification-autonomous-qs", "1") if assurance_profile else ("", "")
     if (assurance_profile and re.fullmatch(r"sha256:[0-9a-f]{64}", assurance_policy_digest) is None
             or not assurance_profile and assurance_policy_digest):
         raise ValueError("merge delegation assurance policy digest is invalid")
@@ -141,15 +246,17 @@ def reserve(connection: sqlite3.Connection, *, delegation_id: str, actor_referen
     connection.execute("""INSERT INTO ep_merge_delegations
         (delegation_id,actor_reference,project_id,repository_id,github_repository,mission_id,
          mission_revision,base_branch,roles,expires_at,created_at,activated_at,revoked_at,
-         assurance_profile_id,assurance_profile_revision,assurance_policy_digest)
-         VALUES(?,?,?,?,?,?,?,?,?,?,?,NULL,NULL,?,?,?)""", (
+         assurance_profile_id,assurance_profile_revision,assurance_policy_digest,target_selection_revision)
+         VALUES(?,?,?,?,?,?,?,?,?,?,?,NULL,NULL,?,?,?,?)""", (
         delegation_id, actor_reference.strip(), project_id, repository_id, github_repository, '',
         '', base_branch, json.dumps(selected), expires_at,
         datetime.now(timezone.utc).isoformat(), profile_id, profile_revision, assurance_policy_digest,
+        selection_revision,
     ))
     return MergeDelegation(delegation_id, actor_reference.strip(), project_id,
                            repository_id, github_repository, '', '', base_branch,
-                           selected, expires_at, None, None, profile_id, profile_revision, assurance_policy_digest)
+                           selected, expires_at, None, None, profile_id, profile_revision,
+                           assurance_policy_digest, selection_revision)
 
 
 def activate(connection: sqlite3.Connection, *, delegation_id: str,
@@ -165,6 +272,8 @@ def activate(connection: sqlite3.Connection, *, delegation_id: str,
     expiry = datetime.fromisoformat(grant.expires_at)
     if expiry <= datetime.now(timezone.utc):
         raise ValueError("Merge delegation has expired")
+    if not target_selection_permits(connection, grant):
+        raise ValueError("Merge delegation target selection is no longer current")
     changed = connection.execute("""UPDATE ep_merge_delegations SET mission_id=?,mission_revision=?,activated_at=?
         WHERE delegation_id=? AND activated_at IS NULL AND revoked_at IS NULL""",
         (mission_id, mission_revision, datetime.now(timezone.utc).isoformat(), delegation_id)).rowcount
@@ -180,7 +289,8 @@ def load(connection: sqlite3.Connection, delegation_id: str) -> MergeDelegation
         return None
     row = connection.execute("""SELECT delegation_id,actor_reference,project_id,
         repository_id,github_repository,mission_id,mission_revision,base_branch,roles,expires_at,
-        activated_at,revoked_at,assurance_profile_id,assurance_profile_revision,assurance_policy_digest
+        activated_at,revoked_at,assurance_profile_id,assurance_profile_revision,assurance_policy_digest,
+        target_selection_revision
         FROM ep_merge_delegations WHERE delegation_id=?""",
         (delegation_id,)).fetchone()
     if row is None:
@@ -192,14 +302,18 @@ def load(connection: sqlite3.Connection, delegation_id: str) -> MergeDelegation
         return None
     if not isinstance(roles, list) or not roles or any(role not in _ROLES for role in roles):
         return None
-    if (row[12], row[13]) not in {("", ""), ("qualification-autonomous-qs", "1")}:
+    if (row[12], row[13]) not in {("", ""), ("qualification-autonomous-qs", "1"),
+                                  (REPOSITORY_ASSURANCE_ID, "1")}:
         return None
-    if row[12] and row[4] != AUTONOMOUS_ASSURANCE_REPOSITORY:
+    if row[12] == "qualification-autonomous-qs" and row[4] != AUTONOMOUS_ASSURANCE_REPOSITORY:
         return None
     if (row[12] and re.fullmatch(r"sha256:[0-9a-f]{64}", row[14]) is None
             or not row[12] and row[14] != ""):
         return None
-    return MergeDelegation(*row[:8], tuple(roles), row[9], row[10], row[11], row[12], row[13], row[14])
+    if (not isinstance(row[15], int) or row[15] < 0
+            or (row[12] == REPOSITORY_ASSURANCE_ID) != (row[15] > 0)):
+        return None
+    return MergeDelegation(*row[:8], tuple(roles), row[9], row[10], row[11], row[12], row[13], row[14], row[15])
 
 
 def revoke(connection: sqlite3.Connection, delegation_id: str, *, actor_reference: str) -> bool:

{engineering_platform-2.3.88 → engineering_platform-2.3.89}/src/engineering_platform/platform_version.py

@@ -12,7 +12,7 @@ from .storage import ENGINEERING_STORAGE_SCHEMA_VERSION
 
 SEMVER = re.compile(r"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$")
 CONTRACT = re.compile(r"^(\d{4})\.(0[1-9]|1[0-2])$")
-CURRENT_PLATFORM_VERSION = "2.3.88"
+CURRENT_PLATFORM_VERSION = "2.3.89"
 MANIFEST_FIELDS = frozenset(
     {
         "platform_version",