fleetmesh-node 0.2.0__py3-none-any.whl

node/planes/services/compute_wire/messages.py

@@ -0,0 +1,320 @@
+"""compute/1.0 and /1.1 wire message types, ComputeWireError and the make_* builders.
+
+Separate because the message vocabulary is needed by sealing, verification and the session alike and has no dependencies of its own beyond fleetmesh_core.crypto.
+"""
+from __future__ import annotations
+
+import uuid
+from typing import Any, Mapping, Optional, Sequence
+
+from fleetmesh_core.wire.wire_types import (
+    ComputeAcceptBody, ComputeCancelBody, ComputeProgressBody, ComputeQuoteBody, ComputeRefuteBody,
+    ComputeMode, ComputeSealedBody, ComputeSettledBody, ComputeStreamBody, Message, ProgressState,
+    ProofFailure, SealedVerify,
+)
+
+PIURI: str = 'https://fleetmesh.org/compute/1.0'
+PIURI_V11: str = 'https://fleetmesh.org/compute/1.1'
+QUOTE_TYPE: str = 'https://fleetmesh.org/compute/1.0/quote'
+ACCEPT_TYPE: str = 'https://fleetmesh.org/compute/1.0/accept'
+SEALED_TYPE: str = 'https://fleetmesh.org/compute/1.0/sealed'
+SETTLED_TYPE: str = 'https://fleetmesh.org/compute/1.0/settled'
+REFUTE_TYPE: str = 'https://fleetmesh.org/compute/1.0/refute'
+STREAM_TYPE: str = 'https://fleetmesh.org/compute/1.1/stream'
+PROGRESS_TYPE: str = 'https://fleetmesh.org/compute/1.1/progress'
+CANCEL_TYPE: str = 'https://fleetmesh.org/compute/1.1/cancel'
+
+MESSAGES: tuple[str, ...] = (
+    'quote', 'accept', 'sealed', 'settled', 'refute', 'stream', 'progress', 'cancel'
+)
+
+
+class ComputeWireError(Exception):
+    """Raised when a wire message or lifecycle transition is invalid."""
+
+
+# -------------------------------------------------------------------------
+# DIDComm compute/1.0 Message Builders
+# -------------------------------------------------------------------------
+def make_quote(
+    from_did: str,
+    to_did: str | Sequence[str],
+    ask_id: str,
+    price_msat: int,
+    invoice: str,
+    payment_hash: str,
+    thid: Optional[str] = None,
+    estimated_duration_s: Optional[int] = None,
+    created_time: Optional[int] = None,
+    msg_id: Optional[str] = None,
+) -> Message[ComputeQuoteBody]:
+    """Construct a DIDComm compute/1.0/quote message."""
+    to_list = [to_did] if isinstance(to_did, str) else list(to_did)
+    body: ComputeQuoteBody = {
+        'ask': ask_id,
+        'price_msat': int(price_msat),
+        'invoice': invoice,
+        'payment_hash': payment_hash,
+    }
+    if estimated_duration_s is not None:
+        body['estimated_duration_s'] = int(estimated_duration_s)
+
+    msg: Message[ComputeQuoteBody] = {
+        'id': msg_id or str(uuid.uuid4()),
+        'type': QUOTE_TYPE,
+        'from': from_did,
+        'to': to_list,
+        'body': body,
+    }
+    if thid:
+        msg['thid'] = thid
+    if created_time is not None:
+        msg['created_time'] = int(created_time)
+    return msg
+
+
+def make_accept(
+    from_did: str,
+    to_did: str | Sequence[str],
+    thid: str,
+    payment_hash: str,
+    job_payload: Mapping[str, Any],
+    input_key: Optional[str] = None,
+    created_time: Optional[int] = None,
+    msg_id: Optional[str] = None,
+) -> Message[ComputeAcceptBody]:
+    """Construct a DIDComm compute/1.0/accept message."""
+    to_list = [to_did] if isinstance(to_did, str) else list(to_did)
+    body: ComputeAcceptBody = {
+        'payment_hash': payment_hash,
+        'held': True,
+        'job': dict(job_payload),
+    }
+    if input_key is not None:
+        body['input_key'] = input_key
+
+    msg: Message[ComputeAcceptBody] = {
+        'id': msg_id or str(uuid.uuid4()),
+        'type': ACCEPT_TYPE,
+        'from': from_did,
+        'to': to_list,
+        'thid': thid,
+        'body': body,
+    }
+    if created_time is not None:
+        msg['created_time'] = int(created_time)
+    return msg
+
+
+def make_sealed(
+    from_did: str,
+    to_did: str | Sequence[str],
+    thid: str,
+    ciphertext: str,
+    payment_hash: str,
+    result: str,
+    fuel_used: int,
+    verify: Optional[SealedVerify] = None,
+    created_time: Optional[int] = None,
+    msg_id: Optional[str] = None,
+) -> Message[ComputeSealedBody]:
+    """Construct a DIDComm compute/1.0/sealed message."""
+    to_list = [to_did] if isinstance(to_did, str) else list(to_did)
+    body: ComputeSealedBody = {
+        'ciphertext': ciphertext,
+        'payment_hash': payment_hash,
+        'result': result,
+        'fuel_used': int(fuel_used),
+    }
+    if verify is not None:
+        body['verify'] = verify
+
+    msg: Message[ComputeSealedBody] = {
+        'id': msg_id or str(uuid.uuid4()),
+        'type': SEALED_TYPE,
+        'from': from_did,
+        'to': to_list,
+        'thid': thid,
+        'body': body,
+    }
+    if created_time is not None:
+        msg['created_time'] = int(created_time)
+    return msg
+
+
+def make_settled(
+    from_did: str,
+    to_did: str | Sequence[str],
+    thid: str,
+    payment_preimage: str,
+    receipt_event: Optional[str] = None,
+    created_time: Optional[int] = None,
+    msg_id: Optional[str] = None,
+) -> Message[ComputeSettledBody]:
+    """Construct a DIDComm compute/1.0/settled message."""
+    to_list = [to_did] if isinstance(to_did, str) else list(to_did)
+    body: ComputeSettledBody = {
+        'payment_preimage': payment_preimage,
+    }
+    if receipt_event is not None:
+        body['receipt_event'] = receipt_event
+
+    msg: Message[ComputeSettledBody] = {
+        'id': msg_id or str(uuid.uuid4()),
+        'type': SETTLED_TYPE,
+        'from': from_did,
+        'to': to_list,
+        'thid': thid,
+        'body': body,
+    }
+    if created_time is not None:
+        msg['created_time'] = int(created_time)
+    return msg
+
+
+def make_refute(
+    from_did: str,
+    to_did: str | Sequence[str],
+    thid: str,
+    job_receipt: str,
+    mode: ComputeMode,
+    claimed_result: Optional[str] = None,
+    actual_result: Optional[str] = None,
+    wasi_profile_digest: Optional[str] = None,
+    engine: Optional[str] = None,
+    engine_version: Optional[str] = None,
+    proof_failure: Optional[ProofFailure] = None,
+    created_time: Optional[int] = None,
+    msg_id: Optional[str] = None,
+) -> Message[ComputeRefuteBody]:
+    """Construct a DIDComm compute/1.0/refute message."""
+    to_list = [to_did] if isinstance(to_did, str) else list(to_did)
+    body: ComputeRefuteBody = {
+        'job_receipt': job_receipt,
+        'mode': mode,
+    }
+    if claimed_result is not None:
+        body['claimed_result'] = claimed_result
+    if actual_result is not None:
+        body['actual_result'] = actual_result
+    if wasi_profile_digest is not None:
+        body['wasi_profile_digest'] = wasi_profile_digest
+    if engine is not None:
+        body['engine'] = engine
+    if engine_version is not None:
+        body['engine_version'] = engine_version
+    if proof_failure is not None:
+        body['proof_failure'] = proof_failure
+
+    msg: Message[ComputeRefuteBody] = {
+        'id': msg_id or str(uuid.uuid4()),
+        'type': REFUTE_TYPE,
+        'from': from_did,
+        'to': to_list,
+        'thid': thid,
+        'body': body,
+    }
+    if created_time is not None:
+        msg['created_time'] = int(created_time)
+    return msg
+
+
+def make_stream_chunk(
+    from_did: str,
+    to_did: str | Sequence[str],
+    thid: str,
+    seq: int,
+    delta: str,
+    is_final: bool = False,
+    counters: Optional[Mapping[str, Any]] = None,
+    created_time: Optional[int] = None,
+    msg_id: Optional[str] = None,
+) -> Message[ComputeStreamBody]:
+    """Construct a DIDComm compute/1.1/stream chunk message."""
+    to_list = [to_did] if isinstance(to_did, str) else list(to_did)
+    body: ComputeStreamBody = {
+        'seq': int(seq),
+        'delta': str(delta),
+    }
+    if is_final:
+        body['is_final'] = True
+    if counters is not None:
+        body['counters'] = dict(counters)
+
+    msg: Message[ComputeStreamBody] = {
+        'id': msg_id or str(uuid.uuid4()),
+        'type': STREAM_TYPE,
+        'from': from_did,
+        'to': to_list,
+        'thid': thid,
+        'body': body,
+    }
+    if created_time is not None:
+        msg['created_time'] = int(created_time)
+    return msg
+
+
+def make_progress(
+    from_did: str,
+    to_did: str | Sequence[str],
+    thid: str,
+    state: ProgressState,
+    progress: Optional[float] = None,
+    elapsed_seconds: Optional[int] = None,
+    logs_tail: Optional[str] = None,
+    created_time: Optional[int] = None,
+    msg_id: Optional[str] = None,
+) -> Message[ComputeProgressBody]:
+    """Construct a DIDComm compute/1.1/progress message."""
+    to_list = [to_did] if isinstance(to_did, str) else list(to_did)
+    body: ComputeProgressBody = {
+        'state': state,
+    }
+    if progress is not None:
+        body['progress'] = float(progress)
+    if elapsed_seconds is not None:
+        body['elapsed_seconds'] = int(elapsed_seconds)
+    if logs_tail is not None:
+        body['logs_tail'] = str(logs_tail)
+
+    msg: Message[ComputeProgressBody] = {
+        'id': msg_id or str(uuid.uuid4()),
+        'type': PROGRESS_TYPE,
+        'from': from_did,
+        'to': to_list,
+        'thid': thid,
+        'body': body,
+    }
+    if created_time is not None:
+        msg['created_time'] = int(created_time)
+    return msg
+
+
+def make_cancel(
+    from_did: str,
+    to_did: str | Sequence[str],
+    thid: str,
+    reason: str,
+    penalty_msat: int = 0,
+    created_time: Optional[int] = None,
+    msg_id: Optional[str] = None,
+) -> Message[ComputeCancelBody]:
+    """Construct a DIDComm compute/1.1/cancel message."""
+    to_list = [to_did] if isinstance(to_did, str) else list(to_did)
+    body: ComputeCancelBody = {
+        'reason': str(reason),
+    }
+    if penalty_msat > 0:
+        body['penalty_msat'] = int(penalty_msat)
+
+    msg: Message[ComputeCancelBody] = {
+        'id': msg_id or str(uuid.uuid4()),
+        'type': CANCEL_TYPE,
+        'from': from_did,
+        'to': to_list,
+        'thid': thid,
+        'body': body,
+    }
+    if created_time is not None:
+        msg['created_time'] = int(created_time)
+    return msg

node/planes/services/compute_wire/sealing.py

@@ -0,0 +1,147 @@
+"""seal_result / open_sealed: symmetric sealing of a job result under a preimage.
+
+Separate because sealing is a self-contained primitive used by both the session and the dispute evaluator.
+"""
+from __future__ import annotations
+
+import hashlib
+import os
+from typing import Optional
+
+from fleetmesh_core.crypto import nip44
+from .messages import ComputeWireError
+
+
+from .types import SealedResult
+
+
+# -------------------------------------------------------------------------
+# Cryptographic Sealing & Accountable Settlement (Phase 4)
+# -------------------------------------------------------------------------
+def seal_result(raw_output: bytes | str, preimage_hex: Optional[str] = None) -> SealedResult:
+    """Encrypt raw output under 32-byte preimage k using NIP-44 v2 ChaCha20/HMAC.
+
+    Returns dict containing:
+      ciphertext: base64-encoded encrypted payload
+      payment_hash: SHA-256(k) hex
+      payment_preimage: k as 64 hex characters
+      result: SHA-256 hash of raw_output bytes
+    """
+    if preimage_hex is None:
+        preimage_hex = os.urandom(32).hex()
+    k_bytes = bytes.fromhex(preimage_hex)
+    if len(k_bytes) != 32:
+        raise ComputeWireError('preimage must be 32 bytes')
+
+    payment_hash = hashlib.sha256(k_bytes).hexdigest()
+    raw_bytes = raw_output.encode('utf-8') if isinstance(raw_output, str) else raw_output
+    result_hash = hashlib.sha256(raw_bytes).hexdigest()
+
+    ciphertext = nip44.encrypt(raw_bytes, k_bytes)
+    return {
+        'ciphertext': ciphertext,
+        'payment_hash': payment_hash,
+        'payment_preimage': preimage_hex,
+        'result': result_hash,
+        'result_hash': result_hash,
+    }
+
+
+def open_sealed(
+    ciphertext: str,
+    preimage_hex: str,
+    expected_payment_hash: Optional[str] = None,
+    expected_result: Optional[str] = None,
+) -> tuple[bool, Optional[bytes], Optional[str]]:
+    """Decrypt sealed output with preimage k and verify SHA-256 hashes.
+
+    Returns (success, decrypted_bytes, failure_code).
+    Failure codes match fleetmesh_core/market.py admissible evidence:
+      - 'sealed-key-does-not-open'
+      - 'result-hash-mismatch-after-decrypt'
+      - 'payment-hash-mismatch'
+    """
+    try:
+        k_bytes = bytes.fromhex(preimage_hex)
+    except Exception:
+        return False, None, 'sealed-key-does-not-open'
+
+    if len(k_bytes) != 32:
+        return False, None, 'sealed-key-does-not-open'
+
+    if expected_payment_hash:
+        actual_payment_hash = hashlib.sha256(k_bytes).hexdigest()
+        if actual_payment_hash != expected_payment_hash:
+            return False, None, 'payment-hash-mismatch'
+
+    try:
+        decrypted = nip44.decrypt_bytes(ciphertext, k_bytes)
+    except Exception:
+        return False, None, 'sealed-key-does-not-open'
+
+    if expected_result:
+        actual_result_hash = hashlib.sha256(decrypted).hexdigest()
+        if actual_result_hash != expected_result:
+            return False, decrypted, 'result-hash-mismatch-after-decrypt'
+
+    return True, decrypted, None
+
+
+def encrypt_stream_frame(
+    session_key: bytes,
+    seq: int,
+    delta: str = '',
+    plaintext: Optional[str] = None,
+) -> str:
+    """Encrypt a streaming token delta with ChaCha20Poly1305.
+
+    Framing per non-deterministic-compute.md § 4.1:
+      Frame_i = ChaCha20Poly1305(k_session, seq_i || delta_text)
+    Nonce (12 bytes): 4 zero bytes + 8 bytes big-endian seq.
+    AAD: 8 bytes big-endian seq.
+    Returns: base64-encoded ciphertext (including 16-byte Poly1305 tag).
+    """
+    import base64
+    from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305
+
+    text = delta if plaintext is None else plaintext
+    if len(session_key) != 32:
+        raise ComputeWireError('session key must be 32 bytes')
+    if seq < 0:
+        raise ComputeWireError('stream seq cannot be negative')
+
+    nonce = b'\x00' * 4 + int(seq).to_bytes(8, 'big')
+    aad = int(seq).to_bytes(8, 'big')
+    cipher = ChaCha20Poly1305(session_key)
+    ct = cipher.encrypt(nonce, text.encode('utf-8'), aad)
+    return base64.b64encode(ct).decode('ascii')
+
+
+def decrypt_stream_frame(
+    session_key: bytes,
+    seq: int,
+    frame_b64: str = '',
+    ciphertext_b64: Optional[str] = None,
+) -> str:
+    """Decrypt a ChaCha20Poly1305 streaming token frame.
+
+    Returns decrypted delta string, or raises ComputeWireError if authentication fails.
+    """
+    import base64
+    from cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305
+
+    b64_in = frame_b64 if ciphertext_b64 is None else ciphertext_b64
+    if len(session_key) != 32:
+        raise ComputeWireError('session key must be 32 bytes')
+    if seq < 0:
+        raise ComputeWireError('stream seq cannot be negative')
+
+    nonce = b'\x00' * 4 + int(seq).to_bytes(8, 'big')
+    aad = int(seq).to_bytes(8, 'big')
+    cipher = ChaCha20Poly1305(session_key)
+    try:
+        raw_ct = base64.b64decode(b64_in.encode('ascii'))
+        pt = cipher.decrypt(nonce, raw_ct, aad)
+        return pt.decode('utf-8')
+    except Exception as e:
+        raise ComputeWireError(f'stream frame decryption failed at seq {seq}: {e}')