forge-autonomy 2.7.20__tar.gz → 2.7.22__tar.gz

{forge_autonomy-2.7.20/forge_autonomy.egg-info → forge_autonomy-2.7.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forge-autonomy
-Version: 2.7.20
+Version: 2.7.22
 Summary: Forge mission planning, producer contracts, and evidence interpretation runtime.
 Author: Forge maintainers
 License-Expression: Apache-2.0
@@ -123,6 +123,55 @@ The exact instance-ID comparison is consistency evidence, not a newly invented
 cryptographic peer identity; preflight reports the latter as `NOT_ASSERTED`.
 `CONFIGURED` is therefore never presented as `LIVE_READY`.
 
+## Operational-history reset
+
+Forge schema 38 provides a bounded, product-owned maintenance service under
+`forge server reset`. Start with the strictly read-only installed preview:
+
+```text
+forge --data-root "/path/to/Forge Server" server reset preview
+forge --data-root "/path/to/Forge Server" server reset status
+```
+
+The mutating `prepare`, `apply`, `resume`, `verify`, and `finish` commands are
+documented in the [operator runbook](docs/operations/FORGE_OPERATIONAL_RESET_RUNBOOK.md).
+They preserve instance/peer/provider/security/allocator bindings, use a verified
+SQLite-consistent private backup, fence owning writers durably and reject
+unknown tables/files/symlinks. They do not reset EP, create a Mission, rotate or
+print credentials, or provide arbitrary SQL/table deletion.
+
+## Deterministic runtime health evaluation
+
+Forge now provides a library-only, read-only health evaluator in
+[`forge.runtime.health`](forge/runtime/health.py). Callers supply an immutable
+component-registry projection, identity-bound observations, an explicit
+capability scope, and the evaluation time. The evaluator performs no discovery,
+probe, provider generation, Mission operation, peer submission, or domain
+mutation.
+
+Liveness and capability readiness remain separate. A green aggregate requires
+fresh passing liveness plus at least one enabled required readiness definition
+for every requested capability. Missing, stale, expired, timed-out, future, or
+wrong-identity required evidence fails closed. Optional failures degrade a
+ready scope, while a disabled optional relay is visible but does not block local
+readiness. Known mandatory failures take precedence over unknown evidence, and
+a required execution-peer outage blocks only capability scopes that depend on
+that peer.
+
+The stable public model includes `HealthIdentity`, `HealthCheckDefinition`,
+`HealthObservation`, and `evaluate_health`, with deterministic serialized
+HEALTHY, DEGRADED, UNAVAILABLE, and UNKNOWN results. This source delivery does
+not claim an HTTP/CLI endpoint, installed service, authenticated diagnostic
+surface, or completion of the broader FH roadmap and qualification nodes.
+Implementation PR #128 is merged at
+`1726f774cb42894d3d3386e80adee9444c7a7914`; its exact candidate
+`dcf1e7a14f54e9c0eac0e0f0f95550b561232987` also makes an observation stale
+when its age exactly equals its timeout, with focused coverage for both
+liveness and readiness. The separate, non-empty Finalization PR #129 is merged
+at `49596812cefb41250fab184f35dc2c28571e05e0`; its documentation delivery
+records the bounded handoff and reconciles current-state navigation without
+extending the evaluator's scope.
+
 ## Managed repository status
 
 Forge is the first-class repository [`pcvantol/forge`](https://github.com/pcvantol/forge),

{forge_autonomy-2.7.20 → forge_autonomy-2.7.22}/README.md

@@ -106,6 +106,55 @@ The exact instance-ID comparison is consistency evidence, not a newly invented
 cryptographic peer identity; preflight reports the latter as `NOT_ASSERTED`.
 `CONFIGURED` is therefore never presented as `LIVE_READY`.
 
+## Operational-history reset
+
+Forge schema 38 provides a bounded, product-owned maintenance service under
+`forge server reset`. Start with the strictly read-only installed preview:
+
+```text
+forge --data-root "/path/to/Forge Server" server reset preview
+forge --data-root "/path/to/Forge Server" server reset status
+```
+
+The mutating `prepare`, `apply`, `resume`, `verify`, and `finish` commands are
+documented in the [operator runbook](docs/operations/FORGE_OPERATIONAL_RESET_RUNBOOK.md).
+They preserve instance/peer/provider/security/allocator bindings, use a verified
+SQLite-consistent private backup, fence owning writers durably and reject
+unknown tables/files/symlinks. They do not reset EP, create a Mission, rotate or
+print credentials, or provide arbitrary SQL/table deletion.
+
+## Deterministic runtime health evaluation
+
+Forge now provides a library-only, read-only health evaluator in
+[`forge.runtime.health`](forge/runtime/health.py). Callers supply an immutable
+component-registry projection, identity-bound observations, an explicit
+capability scope, and the evaluation time. The evaluator performs no discovery,
+probe, provider generation, Mission operation, peer submission, or domain
+mutation.
+
+Liveness and capability readiness remain separate. A green aggregate requires
+fresh passing liveness plus at least one enabled required readiness definition
+for every requested capability. Missing, stale, expired, timed-out, future, or
+wrong-identity required evidence fails closed. Optional failures degrade a
+ready scope, while a disabled optional relay is visible but does not block local
+readiness. Known mandatory failures take precedence over unknown evidence, and
+a required execution-peer outage blocks only capability scopes that depend on
+that peer.
+
+The stable public model includes `HealthIdentity`, `HealthCheckDefinition`,
+`HealthObservation`, and `evaluate_health`, with deterministic serialized
+HEALTHY, DEGRADED, UNAVAILABLE, and UNKNOWN results. This source delivery does
+not claim an HTTP/CLI endpoint, installed service, authenticated diagnostic
+surface, or completion of the broader FH roadmap and qualification nodes.
+Implementation PR #128 is merged at
+`1726f774cb42894d3d3386e80adee9444c7a7914`; its exact candidate
+`dcf1e7a14f54e9c0eac0e0f0f95550b561232987` also makes an observation stale
+when its age exactly equals its timeout, with focused coverage for both
+liveness and readiness. The separate, non-empty Finalization PR #129 is merged
+at `49596812cefb41250fab184f35dc2c28571e05e0`; its documentation delivery
+records the bounded handoff and reconciles current-state navigation without
+extending the evaluator's scope.
+
 ## Managed repository status
 
 Forge is the first-class repository [`pcvantol/forge`](https://github.com/pcvantol/forge),

{forge_autonomy-2.7.20 → forge_autonomy-2.7.22}/forge/__main__.py

@@ -93,6 +93,33 @@ def main(argv: list[str] | None = None) -> int:
     server_commands = server.add_subparsers(dest="server_command", required=True)
     server_commands.add_parser("init", help="create and validate the configured Forge data root")
     server_commands.add_parser("status", help="print read-only runtime status as JSON")
+    reset = server_commands.add_parser("reset", help="operate the Forge-owned operational-history reset")
+    reset_commands = reset.add_subparsers(dest="reset_command", required=True)
+    reset_commands.add_parser("preview", help="inspect a read-only reset plan")
+    prepare_reset = reset_commands.add_parser("prepare", help="authorize maintenance and create a verified backup")
+    prepare_reset.add_argument("--operation-id", required=True)
+    prepare_reset.add_argument("--plan-digest", required=True)
+    prepare_reset.add_argument("--acknowledge-operational-fk", action="append", default=[])
+    for name, help_text in (
+        ("apply", "apply the authorized destructive reset"),
+        ("verify", "verify reset integrity and preserved bindings"),
+    ):
+        reset_action = reset_commands.add_parser(name, help=help_text)
+        reset_action.add_argument("--operation-id", required=True)
+        reset_action.add_argument("--plan-digest", required=True)
+        reset_action.add_argument("--request-digest", required=True)
+        reset_action.add_argument("--backup-digest", required=True)
+    reset_status = reset_commands.add_parser("status", help="read durable reset status")
+    reset_status.add_argument("--operation-id")
+    resume_reset = reset_commands.add_parser("resume", help="reconcile the same interrupted reset operation")
+    resume_reset.add_argument("--operation-id", required=True)
+    resume_reset.add_argument("--plan-digest", required=True)
+    resume_reset.add_argument("--request-digest", required=True)
+    resume_reset.add_argument("--backup-digest")
+    finish_reset = reset_commands.add_parser("finish", help="safely leave durable maintenance")
+    finish_reset.add_argument("--operation-id", required=True)
+    finish_reset.add_argument("--verification-digest")
+    finish_reset.add_argument("--cancel-before-apply", action="store_true")
     subparsers.add_parser("status", help="print read-only runtime status as JSON")
     execution_host = subparsers.add_parser("execution-host", help="manage the selected Execution Host peer")
     execution_host_commands = execution_host.add_subparsers(dest="execution_host_command", required=True)
@@ -140,6 +167,63 @@ def main(argv: list[str] | None = None) -> int:
             database.close()
     elif args.command == "status" or (args.command == "server" and args.server_command == "status"):
         print(json.dumps(_status(args.data_root), sort_keys=True))
+    elif args.command == "server" and args.server_command == "reset":
+        from .runtime.operational_reset import ForgeOperationalResetService, OperationalResetError
+        service = ForgeOperationalResetService(args.data_root)
+        try:
+            if args.reset_command == "preview":
+                result = service.preview()
+            elif args.reset_command == "prepare":
+                result = service.prepare(
+                    operation_id=args.operation_id,
+                    expected_plan_digest=args.plan_digest,
+                    acknowledge_operational_fk=args.acknowledge_operational_fk,
+                )
+            elif args.reset_command in {"apply", "verify"}:
+                result = getattr(service, args.reset_command)(
+                    operation_id=args.operation_id, plan_digest=args.plan_digest,
+                    request_digest=args.request_digest, backup_digest=args.backup_digest,
+                )
+            elif args.reset_command == "status":
+                result = service.status(operation_id=args.operation_id)
+            elif args.reset_command == "resume":
+                result = service.resume(
+                    operation_id=args.operation_id, plan_digest=args.plan_digest,
+                    request_digest=args.request_digest, backup_digest=args.backup_digest,
+                )
+            else:
+                result = service.finish(
+                    operation_id=args.operation_id, verification_digest=args.verification_digest,
+                    cancel_before_apply=args.cancel_before_apply,
+                )
+            print(json.dumps(service.operator_envelope(args.reset_command, result), sort_keys=True))
+        except (OperationalResetError, OSError, sqlite3.Error, PermissionError, ValueError) as error:
+            finding = {"code": type(error).__name__, "message": str(error)}
+            failure = {
+                "operation_id": getattr(args, "operation_id", None),
+                "state": "ERROR", "allowed": False, "blockers": [finding],
+                "error": str(error),
+            }
+            try:
+                envelope = service.operator_envelope(args.reset_command, failure)
+            except Exception:
+                # Even an unreadable target retains the coordinator's stable
+                # top-level contract; no success or target identity is guessed.
+                envelope = {
+                    "contract_version": "operational-reset-v1", "product": "forge",
+                    "command": args.reset_command, "operation_id": failure["operation_id"],
+                    "state": "ERROR", "allowed": False,
+                    "target": {
+                        "instance_id": None, "database_path": str(service.database_path),
+                        "database_identity": None, "schema_version": None,
+                    },
+                    "profile": "forge-operational-history-v1", "dataset_generation": None,
+                    "plan_digest": None, "relevant_revision_digest": None,
+                    "backup": None, "counts": {}, "blockers": [finding], "integrity": {},
+                    "preserved_bindings_digest": None, "details": failure,
+                }
+            print(json.dumps(envelope, sort_keys=True))
+            return 1
     elif args.command == "execution-host":
         try:
             if args.execution_host_command == "credential-access":

{forge_autonomy-2.7.20 → forge_autonomy-2.7.22}/forge/provider_security.py

@@ -241,6 +241,12 @@ class PlanningProviderSecurityService:
         try:
             actual=self.invocation_policy(expected_policy.provider_id)
             if not self._same_policy(actual,expected_policy): raise PermissionError('canonical G011 policy changed before generation permit')
+            if connection.execute(
+                "SELECT 1 FROM operational_reset_tombstones "
+                "WHERE record_id=? AND record_kind IN ('generation_request_digest','token_request_digest')",
+                (request_digest,),
+            ).fetchone() is not None:
+                raise PermissionError('generation request identity was retired by an operational reset')
             connection.execute("INSERT INTO planning_provider_generation_permits VALUES (?,?,?,?,?,?,?,?)",(permit_id,actual.provider_id,actual.version,policy_digest,request_digest,'PENDING',now,now))
             self.db._append_operational_event(
                 component='forge_planning_provider', level='INFO',

{forge_autonomy-2.7.20 → forge_autonomy-2.7.22}/forge/runtime/__init__.py

@@ -9,6 +9,7 @@ from .database import (
     RuntimeDatabase,
     RuntimeDatabaseError,
     RuntimeIntegrityError,
+    RuntimeMaintenanceActive,
 )
 from .bootstrap import (
     RUNTIME_INSTANCE_VERSION,
@@ -26,11 +27,30 @@ from .bootstrap import (
 )
 from .data_root import DataRootError, DataRootResolver, RUNTIME_DIRECTORIES
 from .evidence import RuntimeDecisionEvidenceReference, RuntimeEvidence
+from .health import (
+    HEALTH_SCHEMA_REVISION,
+    CapabilityReadiness,
+    CheckApplicability,
+    CheckPurpose,
+    CheckState,
+    HealthCheckDefinition,
+    HealthEvaluation,
+    HealthIdentity,
+    HealthObservation,
+    HealthState,
+    LivenessEvaluation,
+    LivenessState,
+    ObservationFreshness,
+    ObservationState,
+    ReadinessState,
+    evaluate_health,
+)
 from .runner import BootstrapMissionRunner, MissionRunnerError, RuntimePromptFactory
 from .service import ForgeRuntimeService, RuntimeServiceTick
 
 __all__ = [
     "BootstrapMissionRunner", "MissionRunnerError", "RuntimePromptFactory", "ForgeRuntimeService", "RuntimeServiceTick",
-    "RUNTIME_SCHEMA_VERSION", "RuntimeDatabase", "RuntimeDatabaseError", "RuntimeIntegrityError", "RuntimeDecisionEvidenceReference", "RuntimeEvidence",
+    "RUNTIME_SCHEMA_VERSION", "RuntimeDatabase", "RuntimeDatabaseError", "RuntimeIntegrityError", "RuntimeMaintenanceActive", "RuntimeDecisionEvidenceReference", "RuntimeEvidence",
     "RUNTIME_INSTANCE_VERSION", "RUNTIME_INITIALIZATION_VERSION", "RuntimeBootstrap", "RuntimeIdentity", "RuntimeInstance", "RuntimeLocation", "RuntimePlacement", "RuntimeRecovery", "RuntimeResolutionError", "RuntimeResolver", "repository_identity", "repository_uuid", "DataRootError", "DataRootResolver", "RUNTIME_DIRECTORIES",
+    "HEALTH_SCHEMA_REVISION", "CapabilityReadiness", "CheckApplicability", "CheckPurpose", "CheckState", "HealthCheckDefinition", "HealthEvaluation", "HealthIdentity", "HealthObservation", "HealthState", "LivenessEvaluation", "LivenessState", "ObservationFreshness", "ObservationState", "ReadinessState", "evaluate_health",
 ]