forge-autonomy 2.7.25__tar.gz → 2.7.26__tar.gz

{forge_autonomy-2.7.25 → forge_autonomy-2.7.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forge-autonomy
-Version: 2.7.25
+Version: 2.7.26
 Summary: Forge mission planning, producer contracts, and evidence interpretation runtime.
 Author: Forge maintainers
 License-Expression: Apache-2.0

{forge_autonomy-2.7.25 → forge_autonomy-2.7.26}/forge/__main__.py

@@ -122,6 +122,29 @@ def main(argv: list[str] | None = None) -> int:
     finish_reset.add_argument("--verification-digest")
     finish_reset.add_argument("--cancel-before-apply", action="store_true")
     subparsers.add_parser("status", help="print read-only runtime status as JSON")
+    mission = subparsers.add_parser("mission", help="govern and run one selected Mission")
+    mission_commands = mission.add_subparsers(dest="mission_command", required=True)
+    for name, description in (
+        ("inspect", "validate Mission input and evidence fit without allocation"),
+        ("approve-business", "record canonical Business approval"),
+        ("approve-architecture", "record canonical Architecture approval"),
+        ("admit", "allocate and admit the canonically approved Mission"),
+    ):
+        command = mission_commands.add_parser(name, help=description)
+        command.add_argument("--input", required=True)
+    for name, description in (
+        ("run", "start once and control the selected Mission to a terminal or declared stop"),
+        ("reopen", "continue the same durable Mission execution"),
+        ("status", "read the exact Mission status and result"),
+        ("stop", "request a controlled foreground stop"),
+    ):
+        command = mission_commands.add_parser(name, help=description)
+        command.add_argument("--mission-id", required=True)
+        if name == "run":
+            command.add_argument("--repository-truth", required=True)
+        if name in {"run", "reopen"}:
+            command.add_argument("--poll-seconds", type=float, default=1.0)
+            command.add_argument("--maximum-wait-seconds", type=float, default=3600.0)
     execution_host = subparsers.add_parser("execution-host", help="manage the selected Execution Host peer")
     execution_host_commands = execution_host.add_subparsers(dest="execution_host_command", required=True)
     configure = execution_host_commands.add_parser("configure", help="persist one explicit EP peer binding")
@@ -159,6 +182,41 @@ def main(argv: list[str] | None = None) -> int:
         help="bounded interactive setup timeout in seconds (maximum: 120)",
     )
     args = parser.parse_args(argv)
+    if args.command == "mission":
+        from . import mission_cli
+        try:
+            command = args.mission_command
+            if command == "inspect":
+                result = mission_cli.inspect(args.input)
+            elif command in {"approve-business", "approve-architecture"}:
+                if args.data_root is None:
+                    raise ValueError("--data-root is required for Mission governance")
+                result = mission_cli.approve(args.data_root, args.input,
+                                             "business" if command == "approve-business" else "architecture")
+            elif command == "admit":
+                if args.data_root is None:
+                    raise ValueError("--data-root is required for Mission admission")
+                result = mission_cli.admit(args.data_root, args.input)
+            elif command == "status":
+                result = mission_cli.status(args.data_root, args.mission_id)
+            elif command == "stop":
+                result = mission_cli.stop(args.data_root, args.mission_id)
+            else:
+                if args.data_root is None:
+                    raise ValueError("--data-root is required for Mission execution")
+                result = mission_cli.run(args.data_root, args.mission_id,
+                    truth_path=args.repository_truth if command == "run" else None,
+                    poll_seconds=args.poll_seconds, maximum_wait_seconds=args.maximum_wait_seconds)
+            print(json.dumps(result, sort_keys=True))
+            if command == "inspect":
+                return 0 if result["status"] == "VALID" else 2
+            if command == "stop":
+                return 0 if result["stop_requested"] else 2
+            if command in {"run", "reopen"}:
+                return 0 if result["status"] == "COMPLETED" else 2
+            return 0
+        except (OSError, ValueError, KeyError, sqlite3.Error, RuntimeError, PermissionError) as error:
+            return _failure("mission " + args.mission_command, error)
     if args.command == "server" and args.server_command == "init":
         from .runtime import RuntimeBootstrap
         database = RuntimeBootstrap(data_root=args.data_root, forge_version=canonical_version()).open()

forge_autonomy-2.7.26/forge/completion/host_control_observer.py

@@ -0,0 +1,164 @@
+"""Interpret EP-owned validation records without executing a command."""
+from __future__ import annotations
+
+from hashlib import sha256
+import json
+import re
+from typing import Any, Mapping
+
+from forge.models.criterion_observation import CriterionObservation, canonical_digest
+from forge.models.mission_completion import mission_criterion_id
+
+
+_DIGEST = re.compile(r"sha256:[0-9a-f]{64}\Z")
+
+
+def _canonical(value: object) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, allow_nan=False)
+
+
+def _valid_digest(value: object) -> bool:
+    return isinstance(value, str) and _DIGEST.fullmatch(value) is not None
+
+
+def approved_observation_selector(requirement) -> str | None:
+    """Identify an EP unittest observation from its exact approved binding."""
+    try:
+        command = json.loads(requirement.command)
+    except (TypeError, ValueError):
+        return None
+    if (not isinstance(command, list) or len(command) != 4
+            or command[:3] != ["{python}", "-m", "unittest"]
+            or not isinstance(command[3], str)):
+        return None
+    selector = command[3]
+    if (len(selector) > 100 or re.fullmatch(
+            r"[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)+", selector) is None):
+        return None
+    validation_id = "unittest_selector_" + sha256(selector.encode("utf-8")).hexdigest()[:16]
+    if (requirement.validation_id != validation_id
+            or requirement.control_identity != "python3 -m unittest " + selector
+            or requirement.control_category != "repository"
+            or requirement.validation_profile_version != "1.0"
+            or requirement.profile_reference != "validation-profile-registry:FULL@1.0"):
+        return None
+    return selector
+
+
+def _control_matches(requirement, context: Mapping[str, Any], run_id: str,
+                     validated_revision: str | None) -> tuple[bool, str, dict[str, object] | None]:
+    if not requirement.control_definition_digest:
+        return False, "APPROVED_CONTROL_DEFINITION_MISSING", None
+    version = context.get("contract_version")
+    if version not in {"1.0", "1.1"} or context.get("status") != "AVAILABLE":
+        return False, "HOST_CONTROL_EVIDENCE_UNAVAILABLE", None
+    currentness = context.get("currentness")
+    if (validated_revision is None or context.get("candidate_sha") != validated_revision
+            or context.get("profile_currentness_conflict") is not False
+            or not isinstance(currentness, int) or isinstance(currentness, bool) or currentness < 0
+            or not _valid_digest(context.get("profile_digest"))):
+        return False, "HOST_CONTROL_CANDIDATE_OR_PROFILE_MISMATCH", None
+    if (context.get("validation_profile_version") != requirement.validation_profile_version
+            or context.get("profile_reference") != requirement.profile_reference):
+        return False, "HOST_CONTROL_PROFILE_VERSION_MISMATCH", None
+    controls = context.get("controls")
+    required = context.get("required_validation_controls")
+    if not isinstance(controls, Mapping) or not isinstance(required, list):
+        return False, "HOST_CONTROL_BINDINGS_INVALID", None
+    observation_controls = context.get("observation_validation_controls", []) if version == "1.1" else []
+    if not isinstance(observation_controls, list):
+        return False, "HOST_CONTROL_BINDINGS_INVALID", None
+    required_binding = required.count(requirement.validation_id) == 1
+    observation_matches = [item for item in observation_controls
+                           if isinstance(item, Mapping)
+                           and item.get("validation_id") == requirement.validation_id]
+    observation_binding = (version == "1.1" and len(observation_matches) == 1
+                           and approved_observation_selector(requirement) is not None)
+    if required_binding == observation_binding:
+        return False, "HOST_CONTROL_BINDING_MISSING_OR_DUPLICATE", None
+    command_identity = json.loads(requirement.command)
+    definition = {"validation_profile_version": context["validation_profile_version"],
+                  "profile_reference": context["profile_reference"],
+                  "validation_id": requirement.validation_id,
+                  "category": requirement.control_category,
+                  "control_identity": requirement.control_identity,
+                  "command_identity": command_identity}
+    digest = "sha256:" + sha256(_canonical(definition).encode("utf-8")).hexdigest()
+    if digest != requirement.control_definition_digest:
+        return False, "HOST_CONTROL_DEFINITION_MISMATCH", None
+    control = (controls.get(requirement.validation_id) if required_binding
+               else observation_matches[0])
+    if not isinstance(control, Mapping):
+        return False, "HOST_CONTROL_RECORD_MISSING", None
+    if (control.get("validation_id") != requirement.validation_id
+            or control.get("category") != requirement.control_category
+            or control.get("control_identity") != requirement.control_identity
+            or control.get("control_definition_digest") != digest
+            or control.get("required_for_profile") is not required_binding
+            or control.get("currentness") != currentness):
+        return False, "HOST_CONTROL_RECORD_CONFLICT", None
+    if (control.get("execution_status") != "EXECUTED" or control.get("result") != "PASS"
+            or control.get("evidence_authority") != "command_terminal"
+            or control.get("evidence_ref") != "command_terminal"
+            or control.get("exit_code") != 0
+            or not isinstance(control.get("command_id"), str) or not control["command_id"]):
+        return False, "HOST_CONTROL_NOT_EXECUTED_AND_PASSED", None
+    detail = control.get("result_detail")
+    if not isinstance(detail, Mapping):
+        return False, "HOST_CONTROL_RESULT_DETAIL_MISSING", None
+    if (detail.get("status") != "AVAILABLE" or detail.get("capture_status") != "AVAILABLE"
+            or detail.get("schema") != "deterministic-validation-result-detail-v1"
+            or detail.get("run_id") != run_id
+            or detail.get("command_id") != control["command_id"]
+            or detail.get("validation_id") != requirement.validation_id
+            or detail.get("exit_code") != 0
+            or not isinstance(detail.get("artifact_id"), str) or not detail["artifact_id"]
+            or not _valid_digest(detail.get("digest")) or not _valid_digest(detail.get("output_digest"))):
+        return False, "HOST_CONTROL_RESULT_DETAIL_INVALID", None
+    count = detail.get("test_count")
+    minimum_test_count = (max(1, requirement.minimum_test_count) if observation_binding
+                          else requirement.minimum_test_count)
+    if minimum_test_count and (not isinstance(count, int) or isinstance(count, bool)
+                               or count < minimum_test_count
+                               or detail.get("test_count_source") != "unittest_terminal_summary"):
+        return False, "HOST_CONTROL_TEST_COUNT_INSUFFICIENT", None
+    return True, "APPROVED_HOST_CONTROL_EXECUTED_AND_PASSED", {
+        "validation_id": requirement.validation_id, "control_identity": requirement.control_identity,
+        "control_definition_digest": digest, "validation_profile_version": requirement.validation_profile_version,
+        "profile_reference": requirement.profile_reference, "category": requirement.control_category,
+        "candidate_sha": validated_revision, "run_id": run_id, "command_id": control["command_id"],
+        "result_detail_digest": detail["digest"], "output_digest": detail["output_digest"],
+        "test_count": count, "execution_status": "EXECUTED", "result": "PASS", "exit_code": 0,
+    }
+
+
+class HostControlCriterionObserver:
+    def observe(self, mission, reference, evidence) -> tuple[CriterionObservation, ...]:
+        context = evidence.validation_controls
+        observations = []
+        for contract in mission.criterion_assessment_contracts:
+            for requirement in contract.requirements:
+                if requirement.kind != "host_control":
+                    continue
+                control_context = context if isinstance(context, Mapping) else {}
+                delivered = reference.repository_revision
+                candidate = reference.candidate_revision
+                if (contract.validity_policy == "current_revision" and candidate != delivered
+                        and control_context.get("candidate_sha") == candidate):
+                    valid, reason, measured = False, "HOST_CONTROL_DELIVERY_REVISION_NOT_VALIDATED", None
+                else:
+                    expected_revision = (delivered if contract.validity_policy == "current_revision" else
+                                         delivered if control_context.get("candidate_sha") == delivered else candidate)
+                    valid, reason, measured = _control_matches(
+                        requirement, control_context, evidence.host_run_id, expected_revision)
+                observations.append(CriterionObservation(
+                    mission.id, canonical_digest(mission.to_dict()), mission_criterion_id(mission.id, contract.criterion),
+                    contract.digest, requirement.requirement_id, reference.receipt_id, reference.action_id,
+                    reference.report_id, reference.repository_revision, reference.repository_evidence_digest,
+                    "host_control", requirement.control_identity, "ep-terminal-artifact",
+                    reference.repository_evidence_digest if valid else None,
+                    _canonical(measured) if valid else None, "PASS" if valid else "UNAVAILABLE", reason,
+                    requirement_digest=requirement.digest, candidate_revision=reference.candidate_revision,
+                    schema_version="1.1",
+                ))
+        return tuple(observations)

{forge_autonomy-2.7.25 → forge_autonomy-2.7.26}/forge/completion/mission.py

@@ -67,6 +67,34 @@ def _canonical_execution_references(
     return references
 
 
+def _host_control_observation_matches(observation, requirement, validity_policy: str) -> bool:
+    if (observation.schema_version != "1.1" or observation.result != "PASS"
+            or observation.reason != "APPROVED_HOST_CONTROL_EXECUTED_AND_PASSED"
+            or observation.content_digest != observation.repository_evidence_digest
+            or observation.observed_json is None):
+        return False
+    try:
+        record = json.loads(observation.observed_json)
+    except (TypeError, ValueError):
+        return False
+    return (isinstance(record, dict)
+            and record.get("validation_id") == requirement.validation_id
+            and record.get("control_identity") == requirement.control_identity
+            and record.get("control_definition_digest") == requirement.control_definition_digest
+            and record.get("validation_profile_version") == requirement.validation_profile_version
+            and record.get("profile_reference") == requirement.profile_reference
+            and record.get("category") == requirement.control_category
+            and (record.get("candidate_sha") == observation.repository_revision
+                 if validity_policy == "current_revision" else
+                 record.get("candidate_sha") in {observation.candidate_revision, observation.repository_revision})
+            and record.get("execution_status") == "EXECUTED"
+            and record.get("result") == "PASS" and record.get("exit_code") == 0
+            and (requirement.minimum_test_count == 0 or
+                 isinstance(record.get("test_count"), int)
+                 and not isinstance(record["test_count"], bool)
+                 and record["test_count"] >= requirement.minimum_test_count))
+
+
 class MissionCompletionEvaluator:
     """Interpret approved predicates over Forge-observed facts; never provider PASS."""
 
@@ -132,7 +160,31 @@ class MissionCompletionEvaluator:
                     if contract.validity_policy == "current_revision":
                         candidates = [obs for obs in candidates if obs.repository_revision == truth.revision]
                     source = mission.repository_evidence_source
-                    if requirement.kind != "repository_json":
+                    if requirement.kind == "host_control":
+                        if not requirement.control_definition_digest:
+                            result, why, matched = "UNSATISFIED", "UNSUPPORTED_AUTHORITATIVE_EVIDENCE_SOURCE", ()
+                        elif any(obs.source_kind != "host_control" or obs.source_identity != requirement.control_identity
+                                 or obs.artifact_path != "ep-terminal-artifact"
+                                 or obs.requirement_digest != requirement.digest or obs.json_pointer != ""
+                                 for obs in candidates):
+                            result, why, matched = "UNSATISFIED", "OBSERVATION_SOURCE_MISMATCH", ()
+                        elif not candidates:
+                            result, why, matched = "UNSATISFIED", "CURRENT_OBSERVATION_MISSING", ()
+                        else:
+                            if contract.validity_policy == "historical_delivery":
+                                passing = [obs for index, obs in enumerate(candidates)
+                                           if _host_control_observation_matches(obs, requirement, contract.validity_policy)
+                                           and not any(later.repository_revision == obs.repository_revision
+                                                       and not _host_control_observation_matches(later, requirement, contract.validity_policy)
+                                                       for later in candidates[index + 1:])]
+                                selected = passing[-1] if passing else candidates[-1]
+                            else:
+                                selected = candidates[-1]
+                            proven = _host_control_observation_matches(selected, requirement, contract.validity_policy)
+                            result = "PROVEN" if proven else "UNSATISFIED"
+                            why = "APPROVED_HOST_CONTROL_EXECUTED_AND_PASSED" if proven else selected.reason
+                            matched = (selected.id,)
+                    elif requirement.kind != "repository_json":
                         result, why, matched = "UNSATISFIED", "UNSUPPORTED_AUTHORITATIVE_EVIDENCE_SOURCE", ()
                     elif source is None:
                         result, why, matched = "UNSATISFIED", "APPROVED_REPOSITORY_SOURCE_MISSING", ()

{forge_autonomy-2.7.25 → forge_autonomy-2.7.26}/forge/execution/loop.py

@@ -19,7 +19,7 @@ from forge.dispatcher import MissionDispatcher
 from forge.governance import ApprovalRecord, ExecutionPolicy, ExecutionPolicyKind, PauseBoundary, execution_policy_for_profile
 from forge.models.action import EngineeringAction, EngineeringActionStatus
 from forge.models.architecture_mission import ArchitectureMission
-from forge.models.execution_host import ExecutionHost, ExecutionHostEvidence
+from forge.models.execution_host import ExecutionEvidenceOutcome, ExecutionHost, ExecutionHostEvidence
 from forge.models.producer import RepositoryRevisionBinding
 from forge.models.mission_completion import (MissionCompletionEvidence,
                                               MissionCriterionEvaluationStatus)
@@ -134,6 +134,7 @@ class ExecutionLoop:
         completion_evaluator: MissionCompletionEvaluator | None = None,
         runtime_database: RuntimeDatabase | None = None,
         repository_revision_binding_factory: RepositoryRevisionBindingFactory | None = None,
+        keep_running: Callable[[], bool] | None = None,
     ) -> None:
         if not all((host_id, workspace_id, repository_id)):
             raise ExecutionLoopError("execution host, workspace, and repository identities are required")
@@ -150,14 +151,19 @@ class ExecutionLoop:
         self._completion_evaluator = completion_evaluator or MissionCompletionEvaluator()
         self._runtime_database = runtime_database
         self._repository_revision_binding_factory = repository_revision_binding_factory
+        self._keep_running = keep_running or (lambda: True)
 
     def run(self) -> MissionExecutionState | None:
         """Run the one dispatched Mission until terminal or awaiting host evidence."""
+        if not self._keep_running():
+            return None
         record = self._dispatcher.dispatch()
         if record is None:
             return None
         state = self._states.get(record.mission_id)
         state = self._states.set_execution_policy(state.mission_id, self._execution_policy.to_dict(), occurred_at=self._clock())
+        if not self._keep_running():
+            return state
         if state.status is MissionExecutionStatus.CREATED:
             try:
                 state = self._plan(state)
@@ -209,6 +215,8 @@ class ExecutionLoop:
                approval: ApprovalRecord | None = None) -> MissionExecutionState:
         """Resume durable work; a blocked or failed Action needs explicit authority."""
         state = self._states.get(mission_id)
+        if not self._keep_running():
+            return state
         if state.status is MissionExecutionStatus.AWAITING_APPROVAL:
             if approval is None:
                 raise ExecutionLoopError("governance-paused Mission requires an approval record")
@@ -241,6 +249,27 @@ class ExecutionLoop:
             raise ExecutionLoopError("recovery authorization is valid only for blocked or failed Missions")
         return self.run() if self._dispatcher.resume() else self._runner().run(mission_id)
 
+    def resume_existing_successor(self, mission_id: str) -> MissionExecutionState:
+        """Retry an assessed continuation whose approved next Action already exists."""
+        state = self._states.get(mission_id)
+        marker = state.resume.get("terminal_continuation")
+        remaining = tuple(item for item in state.actions if item["status"] != EngineeringActionStatus.COMPLETE.value)
+        if (state.status is not MissionExecutionStatus.BLOCKED
+                or state.waiting_reason != "mission_criteria_unmet_no_valid_successor"
+                or not isinstance(marker, Mapping) or marker.get("phase") != "ASSESSED"
+                or marker.get("mission_complete") is not False
+                or not remaining
+                or any(item["status"] != EngineeringActionStatus.READY.value for item in remaining)
+                or state.execution_evidence is None
+                or state.execution_evidence.get("outcome") != ExecutionEvidenceOutcome.COMPLETE.value):
+            raise ExecutionLoopError("existing-successor continuation is unavailable for this Mission")
+        state = self._states.transition(
+            mission_id, MissionExecutionStatus.ACTIVE, occurred_at=self._clock(),
+            reason="existing_successor_continuation_requested",
+        )
+        self._dispatcher.recover(mission_id)
+        return self._runner().run(mission_id)
+
     def approve_delegation(self, mission_id: str, delegation_id: str, approval: ApprovalRecord) -> MissionExecutionState:
         """Record governance approval for one exact delegation without invoking a provider."""
         state = self._states.get(mission_id)
@@ -289,6 +318,8 @@ class ExecutionLoop:
         if input_value.mission.id != state.mission_id:
             raise ExecutionLoopError("planner input must belong to the active Mission")
         plan, derivation = self._select_plan(input_value, state)
+        if not self._keep_running():
+            return state
         return self._persist_planned_result(state, plan, derivation)
 
     def resume_authorized_next_derivation(
@@ -333,6 +364,8 @@ class ExecutionLoop:
 
     def _persist_planned_result(self, state: MissionExecutionState, plan: MissionPlan,
                                 derivation: Mapping[str, Any] | None) -> MissionExecutionState:
+        if not self._keep_running():
+            return state
         actions = tuple(action for intent in plan.intents for action in intent.actions)
         if not actions:
             raise ExecutionLoopError("approved Mission planning produced no executable Engineering Actions")
@@ -540,7 +573,8 @@ class ExecutionLoop:
                                       clock=self._clock, correlation_id_factory=self._correlation_id_factory,
                                       completion_context=completion, replan_after_evidence=self._replan_after_evidence,
                                       evidence_progression_gate=self._pause_after_evidence,
-                                      repository_revision_binding_factory=self._repository_revision_binding_factory)
+                                      repository_revision_binding_factory=self._repository_revision_binding_factory,
+                                      keep_running=self._keep_running)
 
     def _pause_after_evidence(self, state: MissionExecutionState, actions: tuple[EngineeringAction, ...],
                               evidence: ExecutionHostEvidence, mission_complete: bool) -> MissionExecutionState | None:
@@ -596,8 +630,14 @@ class ExecutionLoop:
             return state
 
         self._assert_current_replan_evidence(state, replanning, evidence)
+        # An approved successor can already be part of the initial dynamic
+        # plan. Continue that immutable Action instead of deriving a duplicate.
+        if remaining:
+            return state
         self._assert_successor_bounds(state, replanning.mission)
         plan, derivation = self._select_plan(replanning, state)
+        if not self._keep_running():
+            return state
         assert derivation is not None
         previous_fingerprints = {
             item["work_fingerprint"] for record in state.planning_history
@@ -631,6 +671,8 @@ class ExecutionLoop:
         if isinstance(continuation, Mapping):
             resume["terminal_continuation"] = {**continuation, "phase": "SUCCESSOR_READY"}
         try:
+            if not self._keep_running():
+                return state
             return self._states.transition(
                 state.mission_id, MissionExecutionStatus.ACTIVE, occurred_at=self._clock(),
                 reason="dynamic_successor_materialized", intents=(*state.intents, *new_intents),

{forge_autonomy-2.7.25 → forge_autonomy-2.7.26}/forge/governance_authority.py

@@ -201,6 +201,7 @@ class ArchitecturePlanningEvidence:
     maximum_actions: int | None = None
     maximum_consecutive_no_progress_actions: int | None = None
     repository_evidence_source: ApprovedRepositoryEvidenceSource | None = None
+    mission_spec_digest: str | None = None
 
     def __post_init__(self) -> None:
         if not all((self.scope, self.write_scopes, self.non_goals, self.risk_inputs, self.human_gates,
@@ -211,6 +212,10 @@ class ArchitecturePlanningEvidence:
             self.criterion_assessment_contracts, self.maximum_actions,
             self.maximum_consecutive_no_progress_actions, self.repository_evidence_source,
         ))
+        if self.mission_spec_digest is not None and (not isinstance(self.mission_spec_digest, str)
+                or len(self.mission_spec_digest) != 71 or not self.mission_spec_digest.startswith("sha256:")
+                or any(character not in "0123456789abcdef" for character in self.mission_spec_digest[7:])):
+            raise ValueError("Mission specification digest is invalid")
 
     def to_dict(self) -> dict[str, object]:
         value = asdict(self)
@@ -227,6 +232,8 @@ class ArchitecturePlanningEvidence:
             value.pop("repository_evidence_source")
         else:
             value["repository_evidence_source"] = self.repository_evidence_source.to_dict()
+        if self.mission_spec_digest is None:
+            value.pop("mission_spec_digest")
         return value
 
     @property
@@ -271,6 +278,10 @@ class MissionPlanningEvidenceEnvelope:
                 raise ValueError("approval envelope has invalid, stale, conflicting, or cross-installation lineage")
         if planning.provenance_revision != subject_revision:
             raise ValueError("planning evidence revision is stale")
+        if planning.mission_spec_digest is not None and (
+                tuple(sorted(business.get("scope", ()))) != tuple(sorted(planning.scope))
+                or tuple(sorted(business.get("gates", ()))) != tuple(sorted(planning.human_gates))):
+            raise ValueError("Architecture planning exceeds or changes the exact Business-approved scope and gates")
         evidence = architecture.get("evidence")
         approved_digest = evidence.get("planning_digest") if isinstance(evidence, dict) else None
         if (planning.criterion_assessment_contracts and approved_digest is None

{forge_autonomy-2.7.25 → forge_autonomy-2.7.26}/forge/intake.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 import json
 from typing import Callable, Sequence
 
@@ -12,6 +12,7 @@ from forge.models.mission import EngineeringMission, MissionStatus
 from forge.models.architecture_mission import ArchitectureMission, ArchitectureMissionStatus
 from forge.state import MissionExecutionState, MissionExecutionStatus, MissionStateStore, MissionStateStoreError
 from forge.governance_authority import CanonicalGovernanceRepository, MissionPlanningEvidenceEnvelope
+from forge.models.criterion_observation import canonical_digest
 from forge.runtime.database import RuntimeDatabaseError
 
 
@@ -50,19 +51,7 @@ class MissionIntake:
         This is the canonical governance bridge.  It preserves the legacy
         bootstrap admission method below for its separately-versioned contract.
         """
-        self.validate_approved_evidence(envelope, repository)
-        if mission.status is not ArchitectureMissionStatus.APPROVED_FOR_ENGINEERING:
-            raise MissionIntakeError("Mission Intake requires an engineering-approved Architecture Mission")
-        planning = envelope.planning
-        if mission.criterion_assessment_contracts or planning.criterion_assessment_contracts:
-            if (mission.candidate_id != envelope.subject_id
-                    or tuple(sorted(mission.scope)) != tuple(sorted(planning.scope))
-                    or mission.architecture_review_reference != envelope.architecture_decision_id
-                    or mission.criterion_assessment_contracts != planning.criterion_assessment_contracts
-                    or mission.maximum_actions != planning.maximum_actions
-                    or mission.maximum_consecutive_no_progress_actions != planning.maximum_consecutive_no_progress_actions
-                    or mission.repository_evidence_source != planning.repository_evidence_source):
-                raise MissionIntakeError("Mission Intake criterion contract differs from canonical Architecture approval")
+        self.validate_canonical_mission_contract(mission, envelope, repository)
         source = "canonical-governance-envelope:" + envelope.digest
         allocation = repository.database._connection.execute(
             "SELECT mission_id FROM mission_id_allocations WHERE source = ?", (source,)
@@ -119,6 +108,29 @@ class MissionIntake:
             raise MissionIntakeError("Mission Intake could not create canonical Mission state") from error
         return MissionStateStore._decode(json.dumps(document, sort_keys=True, separators=(",", ":")))
 
+    def validate_canonical_mission_contract(
+        self, mission: ArchitectureMission, envelope: MissionPlanningEvidenceEnvelope,
+        repository: CanonicalGovernanceRepository,
+    ) -> None:
+        """Check all approval and Mission content before any allocation."""
+        self.validate_approved_evidence(envelope, repository)
+        if mission.status is not ArchitectureMissionStatus.APPROVED_FOR_ENGINEERING:
+            raise MissionIntakeError("Mission Intake requires an engineering-approved Architecture Mission")
+        planning = envelope.planning
+        if (planning.mission_spec_digest is not None
+                and planning.mission_spec_digest != canonical_digest(
+                    replace(mission, id="MISSION-PREVIEW").to_dict())):
+            raise MissionIntakeError("Mission content differs from the exact Architecture-approved specification")
+        if mission.criterion_assessment_contracts or planning.criterion_assessment_contracts:
+            if (mission.candidate_id != envelope.subject_id
+                    or tuple(sorted(mission.scope)) != tuple(sorted(planning.scope))
+                    or mission.architecture_review_reference != envelope.architecture_decision_id
+                    or mission.criterion_assessment_contracts != planning.criterion_assessment_contracts
+                    or mission.maximum_actions != planning.maximum_actions
+                    or mission.maximum_consecutive_no_progress_actions != planning.maximum_consecutive_no_progress_actions
+                    or mission.repository_evidence_source != planning.repository_evidence_source):
+                raise MissionIntakeError("Mission Intake criterion contract differs from canonical Architecture approval")
+
     def admit(
         self,
         mission: EngineeringMission,