flare-kernel 1.1.3__tar.gz → 1.1.4__tar.gz

{flare_kernel-1.1.3 → flare_kernel-1.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flare-kernel
-Version: 1.1.3
+Version: 1.1.4
 Summary: FLARE kernel runtime package
 License: Proprietary
 Classifier: Development Status :: 3 - Alpha

{flare_kernel-1.1.3 → flare_kernel-1.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "flare-kernel"
-version = "1.1.3"
+version = "1.1.4"
 description = "FLARE kernel runtime package"
 readme = "README.md"
 requires-python = ">=3.11"

{flare_kernel-1.1.3 → flare_kernel-1.1.4}/src/flare_kernel/router/kernel.py

@@ -11,6 +11,7 @@ from flare_kernel.contracts import (
     KernelResponse,
 )
 from flare_kernel.contracts.operation import ExternalOperationRequest, ExternalOperationResponse
+from flare_kernel.router.api.errors import ApiError
 from flare_kernel.router.api.auth_guard import require_route_scope, resolve_route_auth_context
 from flare_kernel.router.payload.action import (
     build_action_payload as build_action_payload_from_router,
@@ -40,77 +41,32 @@ from flare_kernel.router.kernel_facade.utils import _safe_session_id
 from flare_kernel.router.kernel_request_pipeline.action import (
     _build_mode_switch_reason,
     _resolve_command,
-    _resolve_current_mode,
-    _resolve_intent_override,
-    _resolve_manual_mode,
-    _resolve_request_mode,
 )
 from flare_kernel.router.kernel_request_pipeline.intake import (
-    _build_confirmed_fields_schema,
-    _build_missing_fields_schema,
-    _coerce_intent_escalation_policy,
-    _is_requirement_mode_explicit,
     _merge_intent_and_escalation_signal,
-    _normalize_stage_status,
-    _resolve_intent_escalation_policy,
     _resolve_intent_escalation_policy_with_source,
-    _resolve_requirement_intake_entry_recommendation,
-    _resolve_session_intent_stage,
-    _resolve_small_talk_intro_reply,
     _sync_session_intent_stage,
 )
 from flare_kernel.router.kernel_request_pipeline.intent_query import (
-    _build_retrieval_queries,
-    _resolve_intent_suggestion,
-    _resolve_request_intent,
-    _resolve_request_intent_with_ai,
     _should_force_requirement_clarification,
 )
 from flare_kernel.router.kernel_request_pipeline.intent_signal import (
-    _apply_escalation_mode_override,
     _build_intent_and_escalation_signal,
 )
-from flare_kernel.router.kernel_request_pipeline.session_binding import apply_session_binding_to_request
+from flare_kernel.router.kernel_request_pipeline.session_binding import (
+    SessionScopeBindingConflict,
+    apply_session_binding_to_request,
+)
 from flare_kernel.router.streaming.response.builder_transport import (
     fail_reserved_stream_run,
     reserve_stream_run,
 )
 from flare_kernel.router.intake.clarification import (
     build_requirement_clarification_message as _build_requirement_clarification_message,
-    build_requirement_collection_status as _build_requirement_collection_status,
-)
-from flare_kernel.router.intake.answer import (
-    normalize_field_value_payload as _normalize_field_value_payload,
-)
-from flare_kernel.router.intake.authority.core import (
-    hydrate_payload_from_authoritative_checkpoint as hydrate_payload_from_authoritative_checkpoint_state,
-    hydrate_payload_from_authoritative_intake_session as hydrate_payload_from_authoritative_intake_state,
-    normalize_intake_session_id as normalize_intake_session_id_from_authority,
-    resolve_intake_session_id as resolve_intake_session_id_from_authority,
-)
-from flare_kernel.router.intake.canonicalization import (
-    canonicalize_budget_value as _canonicalize_budget_value,
-    canonicalize_payload_fields as _canonicalize_payload_fields,
-    is_field_entity_confirmed as _is_field_entity_confirmed,
-)
-from flare_kernel.router.intake.extraction.core import (
-    extract_intake_fields_from_message as _extract_intake_fields_from_message,
-    merge_inferred_requirements as _merge_inferred_requirements,
-    merge_into_confirmed_fields as _merge_into_confirmed_fields,
-    merge_supplementary_fields as _merge_supplementary_fields,
-    normalize_extracted_field_values as _normalize_extracted_field_values,
-)
-from flare_kernel.router.intake.field_scope import (
-    resolve_intake_allowed_fields as resolve_intake_allowed_fields_from_router,
 )
 from flare_kernel.router.intake.payload_updates import (
-    apply_question_answer_payload as _apply_question_answer_payload,
-    apply_workspace_patch_payload as _apply_workspace_patch_payload,
     extract_quoted_terms as _extract_quoted_terms,
 )
-from flare_kernel.router.intake.status.core import (
-    build_structured_search_results as build_structured_search_results_from_intake_status,
-)
 from flare_kernel.router.kernel_route.execution import (
     build_kernel_action_response as build_kernel_action_response_from_router,
     build_kernel_run_response as build_kernel_run_response_from_router,
@@ -118,36 +74,13 @@ from flare_kernel.router.kernel_route.execution import (
 )
 from flare_kernel.router.kernel_stream_session import ensure_kernel_stream_session_id
 from flare_kernel.router.patch_contract import build_patch_event as _build_patch_event
-from flare_kernel.router.prompting import resolve_effective_command as _resolve_effective_command
-from flare_kernel.router.request.identity import (
-    resolve_project_id as resolve_project_id_from_router,
-    resolve_user_id as resolve_user_id_from_router,
-)
-from flare_kernel.router.retrieval.projection import (
-    resolve_retrieval_config as resolve_retrieval_config_from_router,
-)
-from flare_kernel.router.retrieval.search import (
-    search_knowledge_by_queries as _search_knowledge_by_queries,
-)
-from flare_kernel.router.text_safety import sanitize_customer_visible_text as _sanitize_customer_visible_text
 from flare_kernel.router.text_safety import (
     extract_user_message as _extract_user_message,
-    normalize_message_text as _normalize_message_text,
-    sanitize_product_name_for_prompt as _sanitize_product_name_for_prompt,
-)
-from flare_kernel.runtime.orchestration.analysis.router_runtime import (
-    resolve_analysis_route as resolve_analysis_route_from_runtime,
 )
 from flare_kernel.runtime import (
     build_kernel_runtime,
-    generate_llm_completion,
     get_logger,
-    load_intake_checkpoint,
-    load_intake_session_snapshot,
-    load_latest_intake_session_id,
     load_instance_profile,
-    persist_intake_checkpoint,
-    persist_intake_session_state,
     resolve_trace_id,
 )
 from flare_kernel.session_store import ensure_session, get_session
@@ -170,13 +103,30 @@ def _ensure_kernel_stream_session_id(req: KernelRequest) -> str:
     return ensure_kernel_stream_session_id(req, ensure_session_fn=ensure_session)
 
 
+def _apply_canonical_session_scope(req: KernelRequest) -> KernelRequest:
+    try:
+        return apply_session_binding_to_request(req, load_session_fn=get_session)
+    except SessionScopeBindingConflict as exc:
+        raise ApiError(
+            code="SESSION_SCOPE_CONFLICT",
+            http_status=409,
+            message="session scope conflict",
+            description=str(exc),
+            context_fields=[exc.field_name],
+            retryable=False,
+            details={
+                "reason_codes": [f"{exc.field_name}_scope_conflict"],
+            },
+        ) from exc
+
+
 @router.post("/run", response_model=KernelResponse)
 async def kernel_run(
     req: KernelRequest,
     auth_context: AuthContext | None = Depends(resolve_route_auth_context),
 ) -> KernelResponse:
+    req = _apply_canonical_session_scope(req)
     _require_kernel_scope(auth_context, req, "kernel:run")
-    req = apply_session_binding_to_request(req, load_session_fn=get_session)
     return await handle_kernel_run_from_router(
         req,
         prepare_kernel_turn_context_fn=_prepare_kernel_turn_context,
@@ -198,8 +148,8 @@ async def kernel_action(
     req: KernelRequest,
     auth_context: AuthContext | None = Depends(resolve_route_auth_context),
 ) -> KernelResponse:
+    req = _apply_canonical_session_scope(req)
     _require_kernel_scope(auth_context, req, "kernel:action")
-    req = apply_session_binding_to_request(req, load_session_fn=get_session)
     return await handle_kernel_action_from_router(
         req,
         prepare_action_turn_context_fn=prepare_action_turn_context_from_router,
@@ -236,8 +186,8 @@ async def kernel_stream(
     req: KernelRequest,
     auth_context: AuthContext | None = Depends(resolve_route_auth_context),
 ) -> StreamingResponse:
+    req = _apply_canonical_session_scope(req)
     _require_kernel_scope(auth_context, req, "kernel:stream")
-    req = apply_session_binding_to_request(req, load_session_fn=get_session)
     req = req.model_copy(update={"trace_id": resolve_trace_id(req.trace_id)})
     return await handle_kernel_stream_from_router(
         req,

{flare_kernel-1.1.3 → flare_kernel-1.1.4}/src/flare_kernel/router/kernel_facade/canonical_state.py

@@ -24,8 +24,6 @@ from flare_kernel.router.intake.canonicalization import (
 from flare_kernel.router.intake.status.schema import (
     build_confirmed_fields_schema as _build_confirmed_fields_schema_from_router,
     build_missing_fields_schema as _build_missing_fields_schema_from_router,
-    coerce_intent_escalation_policy as _coerce_intent_escalation_policy_from_router,
-    normalize_stage_status as _normalize_stage_status_from_router,
 )
 from flare_kernel.router.kernel_facade.dependency_resolution import (
     resolve_canonical_state_dependencies,
@@ -35,8 +33,12 @@ from flare_kernel.router.kernel_facade.utils import (
     _map_external_mode,
     _safe_session_id,
 )
-from flare_kernel.router.kernel_flow_bindings.session_intent import (
-    resolve_session_intent_stage as _resolve_session_intent_stage_in_kernel_session_intent_flow,
+from flare_kernel.router.kernel_request_pipeline.intake_session_intent_bridge import (
+    _resolve_session_intent_stage as _resolve_session_intent_stage_from_request_pipeline,
+)
+from flare_kernel.router.kernel_request_pipeline.intake import (
+    _coerce_intent_escalation_policy,
+    _normalize_stage_status,
 )
 from flare_kernel.router.text_safety import (
     extract_user_message as _extract_user_message,
@@ -147,9 +149,9 @@ def _build_canonical_state(
         kernel_attr_fn=_kernel_attr,
         defaults={
             "map_external_mode_fn": _map_external_mode,
-            "resolve_session_intent_stage_fn": _resolve_session_intent_stage_in_kernel_session_intent_flow,
-            "coerce_intent_escalation_policy_fn": _coerce_intent_escalation_policy_from_router,
-            "normalize_stage_status_fn": _normalize_stage_status_from_router,
+            "resolve_session_intent_stage_fn": _resolve_session_intent_stage_from_request_pipeline,
+            "coerce_intent_escalation_policy_fn": _coerce_intent_escalation_policy,
+            "normalize_stage_status_fn": _normalize_stage_status,
             "build_confirmed_fields_schema_fn": _build_confirmed_fields_schema_from_router,
             "build_missing_fields_schema_fn": _build_missing_fields_schema_from_router,
             "is_field_entity_confirmed_fn": _is_field_entity_confirmed,

{flare_kernel-1.1.3 → flare_kernel-1.1.4}/src/flare_kernel/router/kernel_facade/orchestration.py

@@ -6,15 +6,9 @@ from typing import Any, Callable
 
 from flare_kernel.contracts import KernelRequest
 from flare_kernel.runtime import persist_intake_checkpoint, persist_intake_session_state
-from flare_kernel.router.intake.entry_policy import (
-    resolve_requirement_intake_entry_recommendation as _resolve_requirement_intake_entry_recommendation_from_router,
-)
 from flare_kernel.router.intake.payload_updates import (
     extract_quoted_terms as _extract_quoted_terms,
 )
-from flare_kernel.router.intake.status.schema import (
-    coerce_intent_escalation_policy as _coerce_intent_escalation_policy_from_router,
-)
 from flare_kernel.router.intake.state_persistence import (
     persist_authoritative_intake_state as persist_authoritative_intake_state_from_router,
 )
@@ -24,12 +18,13 @@ from flare_kernel.router.kernel_facade.dependency_resolution import (
     resolve_prompt_dependencies,
 )
 from flare_kernel.router.kernel_facade.utils import _kernel_attr
-from flare_kernel.router.kernel_flow_bindings.session_intent import (
-    resolve_session_intent_stage as _resolve_session_intent_stage_in_kernel_session_intent_flow,
-)
 from flare_kernel.router.kernel_request_pipeline.action import _resolve_command
 from flare_kernel.router.kernel_request_pipeline.intake import (
-    _merge_intent_and_escalation_signal,
+    _coerce_intent_escalation_policy,
+    _resolve_requirement_intake_entry_recommendation,
+)
+from flare_kernel.router.kernel_request_pipeline.intake_session_intent_bridge import (
+    _resolve_session_intent_stage,
 )
 from flare_kernel.router.orchestration.status.builder import (
     build_orchestration_status as build_orchestration_status_from_router,
@@ -170,9 +165,9 @@ def _build_orchestration_status(
         extract_user_message_fn=extract_user_message_fn,
         kernel_attr_fn=_kernel_attr,
         defaults={
-            "resolve_requirement_intake_entry_recommendation_fn": _resolve_requirement_intake_entry_recommendation_from_router,
-            "resolve_session_intent_stage_fn": _resolve_session_intent_stage_in_kernel_session_intent_flow,
-            "coerce_intent_escalation_policy_fn": _coerce_intent_escalation_policy_from_router,
+            "resolve_requirement_intake_entry_recommendation_fn": _resolve_requirement_intake_entry_recommendation,
+            "resolve_session_intent_stage_fn": _resolve_session_intent_stage,
+            "coerce_intent_escalation_policy_fn": _coerce_intent_escalation_policy,
             "extract_user_message_fn": _extract_user_message,
         },
     )

{flare_kernel-1.1.3 → flare_kernel-1.1.4}/src/flare_kernel/router/kernel_facade/payload_enrichment.py

@@ -56,13 +56,11 @@ from flare_kernel.router.kernel_facade.source_ref_hydration import (
 from flare_kernel.router.payload.enrichment import (
     enrich_payload as enrich_payload_from_router,
 )
-from flare_kernel.router.kernel_request_pipeline.action import _resolve_command
-from flare_kernel.router.mode.resolution import (
-    resolve_current_mode as _resolve_current_mode_from_router,
-    resolve_manual_mode as _resolve_manual_mode_from_router,
-)
-from flare_kernel.router.request.intent_resolution import (
-    resolve_intent_override as _resolve_intent_override_from_router,
+from flare_kernel.router.kernel_request_pipeline.action import (
+    _resolve_command,
+    _resolve_current_mode,
+    _resolve_intent_override,
+    _resolve_manual_mode,
 )
 from flare_kernel.router.text_safety import extract_user_message as _extract_user_message
 
@@ -215,9 +213,9 @@ def _enrich_payload(
             "merge_supplementary_fields_fn": _merge_supplementary_fields,
             "merge_inferred_requirements_fn": _merge_inferred_requirements,
             "canonicalize_payload_fields_fn": _canonicalize_payload_fields,
-            "resolve_intent_override_fn": _resolve_intent_override_from_router,
-            "resolve_manual_mode_fn": _resolve_manual_mode_from_router,
-            "resolve_current_mode_fn": _resolve_current_mode_from_router,
+            "resolve_intent_override_fn": _resolve_intent_override,
+            "resolve_manual_mode_fn": _resolve_manual_mode,
+            "resolve_current_mode_fn": _resolve_current_mode,
         },
     )
     return enrich_kernel_payload_flow(

flare_kernel-1.1.4/src/flare_kernel/router/kernel_request_pipeline/session_binding.py

@@ -0,0 +1,149 @@
+"""Apply persisted session domain binding to kernel requests."""
+
+from __future__ import annotations
+
+from typing import Any, Callable
+
+from flare_kernel.contracts import KernelRequest
+
+
+class SessionScopeBindingConflict(ValueError):
+    """Raised when request scope conflicts with the persisted session scope."""
+
+    def __init__(self, *, field_name: str, persisted_value: str, requested_value: str) -> None:
+        super().__init__(f"{field_name} conflicts with persisted session scope")
+        self.field_name = field_name
+        self.persisted_value = persisted_value
+        self.requested_value = requested_value
+
+
+def _text(value: Any) -> str:
+    return str(value or "").strip()
+
+
+def _is_missing_top_level(value: Any) -> bool:
+    return _text(value).lower() in {"", "default"}
+
+
+def _mapping(value: Any) -> dict[str, Any]:
+    return value if isinstance(value, dict) else {}
+
+
+def _load_session(load_session_fn: Callable[..., object], session_id: str) -> dict[str, Any]:
+    try:
+        record = load_session_fn(session_id=session_id)
+    except TypeError:
+        record = load_session_fn(session_id)
+    return _mapping(record)
+
+
+def _bind_scope_value(
+    *,
+    field_name: str,
+    persisted_value: Any,
+    top_level_value: Any,
+    payload_value: Any,
+) -> str:
+    persisted = _text(persisted_value)
+    requested = next(
+        (value for value in (_text(top_level_value), _text(payload_value)) if value),
+        "",
+    )
+    conflicting = next(
+        (
+            value
+            for value in (_text(top_level_value), _text(payload_value))
+            if persisted and value and value != persisted
+        ),
+        "",
+    )
+    if conflicting:
+        raise SessionScopeBindingConflict(
+            field_name=field_name,
+            persisted_value=persisted,
+            requested_value=conflicting,
+        )
+    return persisted or requested
+
+
+def _scope_updates(req: KernelRequest, record: dict[str, Any], payload: dict[str, Any]) -> dict[str, Any]:
+    project_id = _bind_scope_value(
+        field_name="project_id",
+        persisted_value=record.get("project_id"),
+        top_level_value=req.project_id,
+        payload_value=payload.get("project_id"),
+    )
+    user_id = _bind_scope_value(
+        field_name="user_id",
+        persisted_value=record.get("user_id"),
+        top_level_value=req.user_id,
+        payload_value=payload.get("user_id"),
+    )
+    return {
+        **({"project_id": project_id} if project_id else {}),
+        **({"user_id": user_id} if user_id else {}),
+    }
+
+
+def _domain_updates(req: KernelRequest, record: dict[str, Any]) -> dict[str, Any]:
+    instance_id = _text(record.get("instance_id"))
+    domain_pack_version = _text(record.get("domain_pack_version"))
+    return {
+        **({"instance_id": instance_id} if instance_id and _is_missing_top_level(req.instance_id) else {}),
+        **({
+            "domain_pack_version": domain_pack_version,
+        } if domain_pack_version and _is_missing_top_level(req.domain_pack_version) else {}),
+    }
+
+
+def _payload_updates(
+    req: KernelRequest,
+    record: dict[str, Any],
+    payload: dict[str, Any],
+    updates: dict[str, Any],
+) -> dict[str, Any]:
+    instance_id = _text(record.get("instance_id"))
+    domain_pack_version = _text(record.get("domain_pack_version"))
+    domain_pack_domain = _text(record.get("domain_pack_domain"))
+    return {
+        **payload,
+        **({"project_id": updates["project_id"]} if updates.get("project_id") else {}),
+        **({"user_id": updates["user_id"]} if updates.get("user_id") else {}),
+        **({
+            "domain_pack_domain": domain_pack_domain,
+        } if domain_pack_domain and not _text(payload.get("domain_pack_domain")) and not _text(payload.get("domain")) else {}),
+        **({
+            "domain_pack_version": updates.get("domain_pack_version", req.domain_pack_version),
+        } if domain_pack_version and not _text(payload.get("domain_pack_version")) else {}),
+        **({
+            "instance_id": updates.get("instance_id", req.instance_id),
+        } if instance_id and not _text(payload.get("instance_id")) else {}),
+    }
+
+
+def apply_session_binding_to_request(
+    req: KernelRequest,
+    *,
+    load_session_fn: Callable[..., object],
+) -> KernelRequest:
+    """Fill missing request domain binding from persisted session metadata."""
+
+    session_id = _text(req.session_id)
+    if not session_id:
+        return req
+    record = _load_session(load_session_fn, session_id)
+    if not record:
+        return req
+    payload = dict(_mapping(req.payload))
+    updates = {**_scope_updates(req, record, payload), **_domain_updates(req, record)}
+    updated_payload = _payload_updates(req, record, payload, updates)
+    final_updates = {
+        **updates,
+        **({"payload": updated_payload} if updated_payload != _mapping(req.payload) else {}),
+    }
+    if not final_updates:
+        return req
+    return req.model_copy(update=final_updates)
+
+
+__all__ = ["SessionScopeBindingConflict", "apply_session_binding_to_request"]

{flare_kernel-1.1.3 → flare_kernel-1.1.4}/src/flare_kernel.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flare-kernel
-Version: 1.1.3
+Version: 1.1.4
 Summary: FLARE kernel runtime package
 License: Proprietary
 Classifier: Development Status :: 3 - Alpha

{flare_kernel-1.1.3 → flare_kernel-1.1.4}/tests/test_auth_scope_guard.py

@@ -153,6 +153,62 @@ def test_scope_guard_rejects_missing_kernel_scope_before_execution(monkeypatch)
     assert response.json()["error"]["details"]["denied_scopes"] == ["kernel:run"]
 
 
+def test_kernel_stream_authorizes_against_persisted_session_scope(monkeypatch) -> None:
+    monkeypatch.setenv("FLARE_AUTH_ROUTE_GUARD_ENABLED", "1")
+    reset_store_for_testing()
+    session = create_session(
+        function_type="chat",
+        project_id="project-a",
+        title="Canonical scope",
+        user_id="user-a",
+    )
+    client = TestClient(create_app())
+
+    response = client.post(
+        "/kernel/stream",
+        headers=_auth_context_header(
+            scopes=["kernel:stream"],
+            project_id="project-b",
+            user_id="user-b",
+        ),
+        json={"session_id": session["session_id"], "content": "hello"},
+    )
+
+    assert response.status_code == 403
+    assert response.json()["error"]["details"]["reason_codes"] == ["project_id_scope_mismatch"]
+
+
+def test_kernel_stream_rejects_request_scope_conflicting_with_session(monkeypatch) -> None:
+    monkeypatch.setenv("FLARE_AUTH_ROUTE_GUARD_ENABLED", "1")
+    reset_store_for_testing()
+    session = create_session(
+        function_type="chat",
+        project_id="project-a",
+        title="Canonical scope",
+        user_id="user-a",
+    )
+    client = TestClient(create_app())
+
+    response = client.post(
+        "/kernel/stream",
+        headers=_auth_context_header(
+            scopes=["kernel:stream"],
+            project_id="project-a",
+            user_id="user-a",
+        ),
+        json={
+            "session_id": session["session_id"],
+            "project_id": "project-b",
+            "user_id": "user-b",
+            "content": "hello",
+        },
+    )
+
+    assert response.status_code == 409
+    assert response.json()["error"]["code"] == "SESSION_SCOPE_CONFLICT"
+    assert response.json()["error"]["details"]["reason_codes"] == ["project_id_scope_conflict"]
+
+
 def test_filter_payload_fields_keeps_allowed_nested_paths() -> None:
     payload = {
         "project_id": "project_auth",

{flare_kernel-1.1.3 → flare_kernel-1.1.4}/tests/test_intent_fast_general_qa.py

@@ -3,7 +3,10 @@ from __future__ import annotations
 import pytest
 
 from flare_kernel.contracts import KernelRequest
-from flare_kernel.router.kernel import _resolve_intent_suggestion, _resolve_request_intent_with_ai
+from flare_kernel.router.kernel_request_pipeline.intent_query import (
+    _resolve_intent_suggestion,
+    _resolve_request_intent_with_ai,
+)
 
 
 @pytest.mark.asyncio
@@ -11,7 +14,10 @@ async def test_request_intent_fast_general_qa_skips_llm(monkeypatch: pytest.Monk
     async def _unexpected_llm_call(*_args, **_kwargs):
         raise AssertionError("fast general QA should skip llm intent routing")
 
-    monkeypatch.setattr("flare_kernel.router.kernel.generate_llm_completion", _unexpected_llm_call)
+    monkeypatch.setattr(
+        "flare_kernel.router.kernel_request_pipeline.intent_query.generate_llm_completion",
+        _unexpected_llm_call,
+    )
     request = KernelRequest(intent="default", payload={"message": "FLARE 现在用的是什么大模型？"})
 
     mode, source, confidence, reason = await _resolve_request_intent_with_ai(request, "trace_fast_qa")
@@ -27,7 +33,10 @@ async def test_intent_suggestion_fast_general_qa_skips_llm(monkeypatch: pytest.M
     async def _unexpected_llm_call(*_args, **_kwargs):
         raise AssertionError("fast general QA should skip llm intent suggestion")
 
-    monkeypatch.setattr("flare_kernel.router.kernel.generate_llm_completion", _unexpected_llm_call)
+    monkeypatch.setattr(
+        "flare_kernel.router.kernel_request_pipeline.intent_query.generate_llm_completion",
+        _unexpected_llm_call,
+    )
     request = KernelRequest(intent="default", payload={"message": "A100 和 H100 有什么区别？"})
 
     mode, confidence, reason, source = await _resolve_intent_suggestion(request, "trace_fast_suggestion")

{flare_kernel-1.1.3 → flare_kernel-1.1.4}/tests/test_session_domain_binding.py

@@ -1,7 +1,12 @@
 from __future__ import annotations
 
+import pytest
+
 from flare_kernel.contracts import KernelRequest
-from flare_kernel.router.kernel_request_pipeline.session_binding import apply_session_binding_to_request
+from flare_kernel.router.kernel_request_pipeline.session_binding import (
+    SessionScopeBindingConflict,
+    apply_session_binding_to_request,
+)
 
 
 def test_session_binding_fills_missing_request_domain_payload() -> None:
@@ -50,3 +55,45 @@ def test_session_binding_preserves_explicit_request_domain_payload() -> None:
     assert bound.instance_id == "custom"
     assert bound.domain_pack_version == "explicit"
     assert bound.payload["domain_pack_domain"] == "explicit_domain"
+
+
+def test_session_binding_hydrates_canonical_project_and_user_scope() -> None:
+    bound = apply_session_binding_to_request(
+        KernelRequest(session_id="session-scope"),
+        load_session_fn=lambda **_: {
+            "session_id": "session-scope",
+            "project_id": "project-a",
+            "user_id": "user-a",
+        },
+    )
+
+    assert bound.project_id == "project-a"
+    assert bound.user_id == "user-a"
+    assert bound.payload["project_id"] == "project-a"
+    assert bound.payload["user_id"] == "user-a"
+
+
+@pytest.mark.parametrize(
+    ("request_updates", "field_name", "requested_value"),
+    [
+        ({"project_id": "project-b"}, "project_id", "project-b"),
+        ({"payload": {"user_id": "user-b"}}, "user_id", "user-b"),
+    ],
+)
+def test_session_binding_rejects_conflicting_scope(
+    request_updates: dict[str, object],
+    field_name: str,
+    requested_value: str,
+) -> None:
+    with pytest.raises(SessionScopeBindingConflict) as captured:
+        apply_session_binding_to_request(
+            KernelRequest(session_id="session-scope", **request_updates),
+            load_session_fn=lambda **_: {
+                "session_id": "session-scope",
+                "project_id": "project-a",
+                "user_id": "user-a",
+            },
+        )
+
+    assert captured.value.field_name == field_name
+    assert captured.value.requested_value == requested_value

{flare_kernel-1.1.3 → flare_kernel-1.1.4}/tests/test_xiaocai_analysis_report_intent_first.py

@@ -5,7 +5,7 @@ from pathlib import Path
 import pytest
 
 from flare_kernel.contracts import KernelRequest
-from flare_kernel.router.kernel import _resolve_request_intent
+from flare_kernel.router.kernel_request_pipeline.intent_query import _resolve_request_intent
 from flare_kernel.runtime.domain.domain_pack_loader import _load_domain_pack_cached