forge-autonomy 2.8.1__tar.gz → 2.12.2__tar.gz

{forge_autonomy-2.8.1/forge_autonomy.egg-info → forge_autonomy-2.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forge-autonomy
-Version: 2.8.1
+Version: 2.12.2
 Summary: Forge mission planning, producer contracts, and evidence interpretation runtime.
 Author: Forge maintainers
 License-Expression: Apache-2.0

{forge_autonomy-2.8.1 → forge_autonomy-2.12.2}/forge/__main__.py

@@ -243,6 +243,12 @@ def main(argv: list[str] | None = None) -> int:
     configure_installation.add_argument("--timeout-seconds",type=float,default=10.0)
     installation_commands.add_parser("show")
     installation_commands.add_parser("preflight")
+    detach_installation = installation_commands.add_parser("detach")
+    detach_installation.add_argument("--operation-id", required=True)
+    detach_installation.add_argument("--expected-binding-id", required=True)
+    detach_installation.add_argument("--expected-configuration-revision", type=int, required=True)
+    installation_detach_status = installation_commands.add_parser("detach-status")
+    installation_detach_status.add_argument("--operation-id", required=True)
     execution_host = subparsers.add_parser("execution-host", help="manage the selected Execution Host peer")
     execution_host_commands = execution_host.add_subparsers(dest="execution_host_command", required=True)
     configure = execution_host_commands.add_parser("configure", help="persist one explicit EP peer binding")
@@ -560,6 +566,11 @@ def main(argv: list[str] | None = None) -> int:
                     endpoint=args.endpoint,ep_instance_id=args.expected_instance_id,consumer_id=args.consumer_id,
                     credential_reference=args.credential_reference,allow_loopback_http=args.allow_loopback_http,
                     timeout_seconds=args.timeout_seconds)
+            elif args.installation_peer_command == "detach":
+                result = service.detach(operation_id=args.operation_id,
+                    expected_binding_id=args.expected_binding_id,
+                    expected_configuration_revision=args.expected_configuration_revision)
+            elif args.installation_peer_command == "detach-status": result = service.detach_status(args.operation_id)
             elif args.installation_peer_command == "show": result = service.show()
             else: result = service.preflight()
             print(json.dumps(result,sort_keys=True))

forge_autonomy-2.12.2/forge/advisory_candidate_cli.py

@@ -0,0 +1,30 @@
+"""Private-token HTTP-equivalent Candidate commands; no admin fallback."""
+import argparse,json
+from pathlib import Path
+from .advisory_candidate_contract import CONTRACT
+from .advisory_candidate_grant import AdvisoryCandidateGrant
+from .advisory_candidate_service import AdvisoryCandidateService
+from .workspace_review_grant import _private_bytes
+
+def main(argv=None):
+    p=argparse.ArgumentParser(prog='forge-advisory-candidate');p.add_argument('--data-root',required=True);p.add_argument('--token-file',required=True);c=p.add_subparsers(dest='action',required=True);c.add_parser('capability')
+    source=c.add_parser('source');source.add_argument('--conversation-id',required=True);source.add_argument('--turn-id',required=True)
+    preview=c.add_parser('preview');preview.add_argument('--conversation-id',required=True);preview.add_argument('--proposal-id',required=True);preview.add_argument('--revision',type=int)
+    op=c.add_parser('operation');op.add_argument('--conversation-id',required=True);op.add_argument('--proposal-id',required=True);op.add_argument('--operation-id',required=True)
+    for name in ['save','register']:s=c.add_parser(name);s.add_argument('--request-file',required=True)
+    a=p.parse_args(argv)
+    try:
+        from .server_runtime import existing_instance
+        i=existing_instance(a.data_root);g=AdvisoryCandidateGrant(i.data_root,i.instance_id);t=Path(a.token_file)
+        if t.is_symlink() or t.stat().st_mode&0o077 or t.stat().st_size>256:raise ValueError('private token file required')
+        token='Bearer '+t.read_text().strip();service=AdvisoryCandidateService(i.data_root,g);method='GET';body=None
+        if a.action=='capability':target='/v1/advisory-candidates/capability'
+        elif a.action=='source':target='/v1/advisory-candidates/'+a.conversation_id+'/source/'+a.turn_id
+        elif a.action=='preview':target='/v1/advisory-candidates/'+a.conversation_id+'/proposals/'+a.proposal_id+('' if a.revision is None else '?revision='+str(a.revision))
+        elif a.action=='operation':target='/v1/advisory-candidates/'+a.conversation_id+'/proposals/'+a.proposal_id+'/registrations/'+a.operation_id
+        else:
+            body=json.loads(_private_bytes(Path(a.request_file)));method='POST';target='/v1/advisory-candidates/'+body['conversation_id']+'/proposals'+('' if a.action=='save' else '/'+body['proposal_id']+'/registrations')
+        status,out=service.handle(method,target,token,body);print(json.dumps(out,sort_keys=True));return 0 if status==200 else 1
+    except (OSError,ValueError,KeyError,RuntimeError):print(json.dumps({'contract_version':CONTRACT,'error':{'code':'CANDIDATE_CLI_UNAVAILABLE'}}));return 1
+
+if __name__=='__main__':raise SystemExit(main())

forge_autonomy-2.12.2/forge/advisory_candidate_contract.py

@@ -0,0 +1,78 @@
+"""Explicit user-authored Candidate fields and immutable advice provenance."""
+from .advisory_contract import digest,text,AdvisoryConflict
+from .approved_worklist import identifier
+from .models.mission_effect import MissionEffectPolicy
+from .lifecycle import MissionCandidate,MissionRecommendation
+
+CONTRACT='forge-advisory-candidate/v1'
+
+def revision(value):
+    if type(value) is not int or value<0:raise ValueError('invalid revision')
+    return value
+
+def hash_reference(value):
+    if not isinstance(value,str) or len(value)!=71 or not value.startswith('sha256:') or any(c not in '0123456789abcdef' for c in value[7:]):raise ValueError('invalid digest')
+    return value
+
+def exact(value,fields):
+    if not isinstance(value,dict) or set(value)!=set(fields.split()) or value.get('contract_version')!=CONTRACT:raise ValueError('closed Candidate contract required')
+    return value
+
+def fields(value):
+    names='title objective business_value engineering_value architectural_value rationale confidence scope exclusions acceptance_criteria architecture_constraints dependencies effect_policy'
+    if not isinstance(value,dict) or set(value)!=set(names.split()):raise ValueError('explicit structured fields required')
+    for k in ['title','objective','business_value','engineering_value','architectural_value','rationale']:text(value[k],1000 if k!='title' else 256)
+    if type(value['confidence']) is not int or not 0<=value['confidence']<=100:raise ValueError('explicit confidence required')
+    for k in ['scope','exclusions','acceptance_criteria','architecture_constraints','dependencies']:
+        a=value[k]
+        if not isinstance(a,list) or len(a)>8 or len(a)!=len(set(a)):raise ValueError('bounded unique fields required')
+        for v in a:text(v,1000)
+    if not value['scope'] or not value['acceptance_criteria'] or any(len(v.strip())<20 for v in value['acceptance_criteria']):raise ValueError('substantive scope and criteria required')
+    policy=MissionEffectPolicy.from_dict(value['effect_policy'])
+    if policy.mode in {'DOCUMENTATION_ONLY','ARCHITECTURE_DESIGN_ONLY'} and any(v.endswith('/') for v in policy.write_paths):raise ValueError('document proposals require exact document paths')
+    return value
+
+def proposal_request(value):
+    exact(value,'contract_version instance_id project_id repository_id conversation_id proposal_id turn_id expected_revision expected_conversation_revision context_revision fields')
+    for k in ['instance_id','project_id','repository_id','conversation_id','proposal_id','turn_id']:identifier(value[k])
+    revision(value['expected_revision']);revision(value['expected_conversation_revision']);hash_reference(value['context_revision']);fields(value['fields'])
+    return value
+
+def registration_request(value):
+    exact(value,'contract_version operation_id instance_id project_id repository_id conversation_id proposal_id proposal_revision proposal_digest expected_conversation_revision context_revision confirm')
+    for k in ['operation_id','instance_id','project_id','repository_id','conversation_id','proposal_id']:identifier(value[k])
+    if revision(value['proposal_revision'])<1:raise ValueError('proposal revision required')
+    revision(value['expected_conversation_revision']);hash_reference(value['proposal_digest']);hash_reference(value['context_revision'])
+    if value['confirm'] is not True:raise ValueError('explicit confirmation required')
+    return value
+
+def candidate_objects(proposal,key,occurred_at):
+    """Only declared user fields populate the existing governance models."""
+    if proposal.get('contract_version') == 'forge-chat-first-mission/v1':
+        from .mission_concept_registration import candidate_objects as generated_objects
+        return generated_objects(proposal,key,occurred_at)
+    f=fields(proposal['fields']);source=proposal['source'];rec_id='advice-recommendation-'+key[7:39];can_id='advice-candidate-'+key[7:39]
+    rec=MissionRecommendation(id=rec_id,title=f['title'],mission_origin=source['advisor_kind'].lower(),
+        business_summary=f['objective'],engineering_summary=f['objective'],business_value=f['business_value'],
+        engineering_value=f['engineering_value'],architectural_value=f['architectural_value'],
+        repository_evidence=tuple(source['evidence_references']),decision_evidence_reference=source['result_digest'],
+        dependencies=tuple(f['dependencies']),alternatives=(),confidence=f['confidence'],recommendation_timestamp=occurred_at,
+        known_constraints=tuple(f['exclusions']),evidence_references=(source['request_digest'],source['context_revision']))
+    candidate=MissionCandidate(id=can_id,recommendation_id=rec.id,title=f['title'],objective=f['objective'],
+        scope=tuple(f['scope']),acceptance_criteria=tuple(f['acceptance_criteria']),
+        architecture_constraints=tuple(f['architecture_constraints'])+tuple('EXCLUDED: '+v for v in f['exclusions']),
+        dependencies=tuple(f['dependencies']),effect_policy=MissionEffectPolicy.from_dict(f['effect_policy']))
+    return rec,candidate
+
+def registration_key(principal,proposal):
+    return digest([principal,proposal['project_id'],proposal['repository_id'],proposal['conversation_id'],proposal['proposal_id'],proposal['proposal_revision']])
+
+def registration_receipt(principal,operation_id,key,proposal,occurred_at):
+    if proposal.get('contract_version') == 'forge-chat-first-mission/v1':
+        from .mission_concept_registration import registration_receipt as generated_receipt
+        return generated_receipt(principal,operation_id,key,proposal,occurred_at)
+    from .approved_worklist import timestamp
+    timestamp(occurred_at)
+    if proposal['principal_reference']!=principal or registration_key(principal,proposal)!=key:raise ValueError('registration correlation differs')
+    rec,can=candidate_objects(proposal,key,occurred_at)
+    return {'contract_version':CONTRACT,'operation_id':identifier(operation_id),'principal_reference':principal,'registration_key':key,'proposal_digest':proposal['proposal_digest'],'proposal_revision':proposal['proposal_revision'],'source':proposal['source'],'candidate':can.to_dict(),'recommendation_id':rec.id,'candidate_digest':digest(can.to_dict()),'recommendation_digest':digest(rec.to_dict()),'registered_at':occurred_at,'status_at_registration':'RECOMMENDED','rationale':proposal['fields']['rationale']}

forge_autonomy-2.12.2/forge/advisory_candidate_grant.py

@@ -0,0 +1,107 @@
+"""Separate owner capability for one conversation and exact Candidate proposal IDs."""
+from dataclasses import dataclass
+from pathlib import Path
+from datetime import UTC,datetime,timedelta
+from hashlib import sha256
+import argparse,json,secrets
+from .advisory_candidate_contract import CONTRACT
+from .advisory_grant import project_scope,conversation_path
+from .approved_worklist import identifier,timestamp
+from .workspace_review_grant import _locked,_private_bytes,_write_private,_new_token
+from .workspace_worklist_control_grant import current_operator
+
+@dataclass(frozen=True)
+class CandidatePrincipal:
+    principal_id:str
+    instance_id:str
+    project_id:str
+    repository_id:str
+    conversation_id:str
+    proposal_ids:tuple
+    grant_id:str
+    maximum_registrations:int
+    @property
+    def reference(self):return self.instance_id+':'+self.principal_id
+    @property
+    def conversation_ids(self):return (self.conversation_id,)
+    @property
+    def maximum_turns(self):return 8
+
+class AdvisoryCandidateGrant:
+    def __init__(self,root,instance_id):
+        self.root=Path(root);self.instance_id=identifier(instance_id);self.path=self.root/'credentials'/'advisory-candidate'/'grants.json'
+    def _records(self,missing=False):
+        if missing and not self.path.exists() and not self.path.is_symlink():return []
+        v=json.loads(_private_bytes(self.path));names=set('principal_id instance_id project_id repository_id conversation_id proposal_ids grant_id maximum_registrations expires_at state token_digest'.split())
+        if not isinstance(v,dict) or set(v)!={'contract_version','instance_id','records'} or v['contract_version']!=CONTRACT or v['instance_id']!=self.instance_id or not isinstance(v['records'],list) or len(v['records'])>64:raise ValueError('invalid Candidate grant store')
+        records=v['records'];seen=set()
+        for r in records:
+            if not isinstance(r,dict) or set(r)!=names:raise ValueError('invalid Candidate grant')
+            for k in ['principal_id','instance_id','project_id','repository_id','conversation_id','grant_id']:identifier(r[k])
+            timestamp(r['expires_at'])
+            if r['instance_id']!=self.instance_id or r['grant_id'] in seen or r['state'] not in {'ACTIVE','REVOKED'} or type(r['maximum_registrations']) is not int or not 1<=r['maximum_registrations']<=8:raise ValueError('invalid grant binding')
+            if not isinstance(r['proposal_ids'],list) or not 1<=len(r['proposal_ids'])<=16 or sorted(set(r['proposal_ids']))!=r['proposal_ids']:raise ValueError('bounded proposal identities required')
+            for v in r['proposal_ids']:identifier(v)
+            h=r['token_digest']
+            if not isinstance(h,str) or len(h)!=64 or any(c not in '0123456789abcdef' for c in h):raise ValueError('invalid token digest')
+            seen.add(r['grant_id'])
+        return records
+    def _save(self,records):
+        raw=json.dumps({'contract_version':CONTRACT,'instance_id':self.instance_id,'records':records},sort_keys=True).encode()
+        if len(raw)>65536:raise ValueError('grant capacity exhausted')
+        _write_private(self.path,raw)
+    def issue(self,*,principal_id,project_id,repository_id,conversation_id,proposal_ids,expires_at,maximum_registrations,token_path):
+        for v in [principal_id,project_id,repository_id,conversation_id]:identifier(v)
+        if not isinstance(proposal_ids,(tuple,list)) or not 1<=len(proposal_ids)<=16 or len(set(proposal_ids))!=len(proposal_ids):raise ValueError('bounded proposals required')
+        for v in proposal_ids:identifier(v)
+        if type(maximum_registrations) is not int or not 1<=maximum_registrations<=8 or not datetime.now(UTC)<timestamp(expires_at)<=datetime.now(UTC)+timedelta(days=30):raise ValueError('bounded grant required')
+        token_path=Path(token_path)
+        if token_path.resolve()==self.path.resolve():raise ValueError('token/store collision')
+        with _locked(self.path):
+            current_operator(self.root,self.instance_id);scope=project_scope(self.root,self.instance_id)
+            if (scope['project_id'],scope['repository_id'])!=(project_id,repository_id):raise PermissionError('foreign project')
+            path=conversation_path(self.root,self.instance_id,project_id,repository_id,conversation_id)
+            if path.exists() or path.is_symlink():
+                if json.loads(_private_bytes(path))['principal_reference']!=self.instance_id+':'+principal_id:raise PermissionError('foreign advice owner')
+            records=self._records(True)
+            if len(records)>=64:raise ValueError('grant capacity exhausted')
+            token=secrets.token_urlsafe(48);r={**scope,'principal_id':principal_id,'conversation_id':conversation_id,'proposal_ids':sorted(proposal_ids),'grant_id':'candidate-'+secrets.token_hex(16),'maximum_registrations':maximum_registrations,'expires_at':expires_at,'state':'ACTIVE','token_digest':sha256(token.encode()).hexdigest()}
+            _new_token(token_path,token)
+            try:self._save([*records,r])
+            except Exception:token_path.unlink(missing_ok=True);raise
+            return {k:v for k,v in r.items() if k!='token_digest'}
+    def revoke(self,grant_id):
+        identifier(grant_id)
+        with _locked(self.path):
+            current_operator(self.root,self.instance_id);records=self._records();r=next((r for r in records if r['grant_id']==grant_id),None)
+            if r is None:raise ValueError('unknown grant')
+            r['state']='REVOKED';self._save(records);return {'grant_id':grant_id,'state':'REVOKED'}
+    def authenticate(self,authorization):
+        if not isinstance(authorization,str) or not authorization.startswith('Bearer '):return None
+        token=authorization[7:]
+        if not token or len(token)>256 or any(ord(c)<33 or ord(c)>126 for c in token):return None
+        try:
+            r=next((r for r in self._records() if secrets.compare_digest(r['token_digest'],sha256(token.encode()).hexdigest())),None)
+            if r is None or r['state']!='ACTIVE' or timestamp(r['expires_at'])<=datetime.now(UTC):return None
+            return CandidatePrincipal(**{k:r[k] for k in CandidatePrincipal.__dataclass_fields__ if k!='proposal_ids'},proposal_ids=tuple(r['proposal_ids']))
+        except (OSError,ValueError,KeyError,TypeError):return None
+    def authorize(self,authorization,conversation_id=None,proposal_id=None):
+        p=self.authenticate(authorization)
+        if p is None:raise PermissionError('Candidate credential unavailable')
+        current_operator(self.root,self.instance_id)
+        if project_scope(self.root,self.instance_id)!={k:getattr(p,k) for k in ['instance_id','project_id','repository_id']}:raise PermissionError('project changed')
+        if conversation_id is not None and conversation_id!=p.conversation_id or proposal_id is not None and proposal_id not in p.proposal_ids:raise PermissionError('foreign proposal scope')
+        return p
+
+def main(argv=None):
+    parser=argparse.ArgumentParser(prog='forge-advisory-candidate-grant');parser.add_argument('--data-root',required=True);c=parser.add_subparsers(dest='action',required=True);i=c.add_parser('issue')
+    for k in ['principal-id','project-id','repository-id','conversation-id','expires-at','token-file']:i.add_argument('--'+k,required=True)
+    i.add_argument('--proposal-id',action='append',required=True);i.add_argument('--maximum-registrations',type=int,default=1);r=c.add_parser('revoke');r.add_argument('--grant-id',required=True);a=parser.parse_args(argv)
+    try:
+        from .server_runtime import existing_instance
+        instance=existing_instance(a.data_root);g=AdvisoryCandidateGrant(instance.data_root,instance.instance_id)
+        out=g.revoke(a.grant_id) if a.action=='revoke' else g.issue(principal_id=a.principal_id,project_id=a.project_id,repository_id=a.repository_id,conversation_id=a.conversation_id,proposal_ids=a.proposal_id,expires_at=a.expires_at,maximum_registrations=a.maximum_registrations,token_path=a.token_file)
+        print(json.dumps(out,sort_keys=True));return 0
+    except (OSError,ValueError,RuntimeError,PermissionError):print(json.dumps({'contract_version':CONTRACT,'error':{'code':'CANDIDATE_GRANT_UNAVAILABLE'}}));return 1
+
+if __name__=='__main__':raise SystemExit(main())

forge_autonomy-2.12.2/forge/advisory_candidate_service.py

@@ -0,0 +1,197 @@
+"""A bounded explicit proposal-to-Candidate bridge over canonical governance."""
+from contextlib import contextmanager
+from datetime import UTC,datetime
+from pathlib import Path
+import json,sqlite3,os
+from urllib.parse import urlsplit,parse_qs
+from .advisory_candidate_contract import CONTRACT,exact,fields,proposal_request,registration_request,candidate_objects,revision,hash_reference,registration_key,registration_receipt
+from .advisory_contract import digest,AdvisoryConflict
+from .advisory_service import AdvisoryService,conversation_lock
+from .advisory_grant import conversation_path
+from .advisory_context import AdvisoryContext
+from .approved_worklist import identifier
+from .workspace_review_grant import _private_bytes,_write_private,_locked
+from .lifecycle import RecommendationLifecycleStore,LifecycleError
+from .worklist_control import control_runtime
+
+class AdvisoryCandidateService:
+    def __init__(self,root,grant):self.root=Path(root);self.grant=grant
+    def _path(self,p,proposal_id):return self.root/'advisory'/'candidate-proposals'/(digest([p.instance_id,p.project_id,p.repository_id,p.conversation_id,proposal_id])[7:]+'.json')
+    def _source(self,token,p,turn_id):
+        value=AdvisoryService(self.root,self.grant,'unused-for-read').read(token,p.conversation_id,turn_id)
+        t=value['original_turn']
+        if t['status']!='COMPLETE' or t['execution']!='CONFIRMED' or t['outcome']['output'] is None:raise AdvisoryConflict('ADVICE_NOT_COMPLETE')
+        _,current=AdvisoryService(self.root,self.grant,'unused-for-read').context(p,t['request']['selected_sources'])
+        if current!=t['request']['context_revision']:raise AdvisoryConflict('SOURCE_CONTEXT_CHANGED')
+        return {'turn_id':turn_id,'session_id':t['session_id'],'invocation_id':t['invocation_id'],'request_digest':t['request_digest'],
+                'result_digest':t['outcome']['result_digest'],'advisor_kind':t['request']['advisor_kind'],
+                'context_revision':current,'conversation_revision':value['current_revision'],
+                'selected_sources':t['request']['selected_sources'],'evidence_references':t['context']['evidence_references'],
+                'advice_summary':t['outcome']['output']['summary']}
+    @contextmanager
+    def _lease(self,token,conversation_id,proposal_id):
+        p=self.grant.authorize(token,conversation_id,proposal_id)
+        path=conversation_path(self.root,p.instance_id,p.project_id,p.repository_id,p.conversation_id)
+        with conversation_lock(path),_locked(self.grant.path),_locked(AdvisoryContext(self.root,p.instance_id).path):
+            yield self.grant.authorize(token,conversation_id,proposal_id)
+    def _load(self,token,p,proposal_id,create=False):
+        path=self._path(p,proposal_id)
+        if create and not path.exists() and not path.is_symlink():
+            return {'contract_version':CONTRACT,'principal_reference':p.reference,'scope':{k:getattr(p,k) for k in ['instance_id','project_id','repository_id']},'conversation_id':p.conversation_id,'proposal_id':proposal_id,'maximum_registrations':p.maximum_registrations,'creation_grant_id':p.grant_id,'revisions':[]}
+        try:v=json.loads(_private_bytes(path))
+        except FileNotFoundError:raise
+        except (OSError,ValueError):raise RuntimeError('private proposal unavailable') from None
+        if isinstance(v,dict) and v.get('principal_reference')!=p.reference:raise PermissionError('foreign proposal owner')
+        if (not isinstance(v,dict) or set(v)!=set('contract_version principal_reference scope conversation_id proposal_id maximum_registrations creation_grant_id revisions'.split()) or v['contract_version']!=CONTRACT or v['scope']!={k:getattr(p,k) for k in ['instance_id','project_id','repository_id']} or v['proposal_id']!=proposal_id or v['conversation_id']!=p.conversation_id or type(v['maximum_registrations']) is not int or not 1<=v['maximum_registrations']<=8 or not isinstance(v['revisions'],list) or not 1<=len(v['revisions'])<=8):raise RuntimeError('stored proposal binding invalid')
+        creation=next((r for r in self.grant._records() if r['grant_id']==v['creation_grant_id']),None)
+        if creation is None or creation['maximum_registrations']!=v['maximum_registrations'] or creation['principal_id']!=p.principal_id or creation['conversation_id']!=p.conversation_id or proposal_id not in creation['proposal_ids'] or any(creation[k]!=getattr(p,k) for k in ['instance_id','project_id','repository_id']):raise RuntimeError('original proposal allowance unavailable')
+        for n,d in enumerate(v['revisions'],1):
+            if not isinstance(d,dict) or set(d)!=set('contract_version principal_reference instance_id project_id repository_id conversation_id proposal_id proposal_revision source fields field_origins proposal_digest'.split()):raise RuntimeError('stored proposal shape invalid')
+            if type(d['proposal_revision']) is not int or d['proposal_revision']!=n or d['contract_version']!=CONTRACT or d['principal_reference']!=p.reference or d['proposal_id']!=proposal_id or d['conversation_id']!=p.conversation_id or any(d[k]!=getattr(p,k) for k in ['instance_id','project_id','repository_id']):raise RuntimeError('stored proposal identity invalid')
+            if d['field_origins']!={'fields':'EXPLICIT_USER','source.advice_summary':'VALIDATED_ADVICE'}:raise RuntimeError('stored field origins invalid')
+            try:fields(d['fields']);actual=self._source(token,p,d['source']['turn_id'])
+            except (ValueError,TypeError,KeyError):raise RuntimeError('stored proposal fields invalid') from None
+            old={k:x for k,x in d['source'].items() if k!='conversation_revision'}
+            if old!={k:x for k,x in actual.items() if k!='conversation_revision'} or type(d['source']['conversation_revision']) is not int or not 1<=d['source']['conversation_revision']<=actual['conversation_revision']:raise RuntimeError('stored source provenance invalid')
+            if digest({k:x for k,x in d.items() if k!='proposal_digest'})!=d['proposal_digest']:raise RuntimeError('stored proposal digest invalid')
+        return v
+    def _save(self,p,proposal_id,value):
+        path=self._path(p,proposal_id)
+        if not path.exists() and len(list(path.parent.glob('*.json')))>=64:raise AdvisoryConflict('PROPOSAL_CAPACITY_EXHAUSTED')
+        raw=json.dumps(value,sort_keys=True,ensure_ascii=True).encode()
+        if len(raw)>65536:raise AdvisoryConflict('PROPOSAL_CAPACITY_EXHAUSTED')
+        _write_private(path,raw)
+    @staticmethod
+    def _scope(p,r):
+        if any(r[k]!=getattr(p,k) for k in ['instance_id','project_id','repository_id','conversation_id']):raise PermissionError('foreign proposal scope')
+    @staticmethod
+    def _key(p,d):return registration_key(p.reference,d)
+    def _database_path(self,create=False):
+        path=self.root/'governance'/'candidates.sqlite'
+        if any(x.is_symlink() for x in [self.root,path.parent,path]) or path.resolve().parent.parent!=self.root.resolve():raise RuntimeError('canonical aggregate redirected')
+        if create and not path.exists():
+            path.parent.mkdir(mode=0o700,parents=True,exist_ok=True)
+            fd=os.open(path,os.O_WRONLY|os.O_CREAT|os.O_EXCL|getattr(os,'O_NOFOLLOW',0),0o600);os.close(fd)
+        return path
+    @contextmanager
+    def _read_store(self):
+        path=self._database_path()
+        if not path.exists():yield None;return
+        with RecommendationLifecycleStore.read_only(path) as store:yield store
+    @staticmethod
+    def _has_table(store,name):return store is not None and store._connection.execute('SELECT 1 FROM sqlite_master WHERE type=? AND name=?',('table',name)).fetchone() is not None
+    def _registered(self,store,p,d):
+        if not self._has_table(store,'advisory_candidate_registrations'):return None
+        value=store.candidate_registration(self._key(p,d),p.reference)
+        if value is not None:
+            if (set(value)!=set('contract_version operation_id principal_reference registration_key proposal_digest proposal_revision source candidate recommendation_id candidate_digest recommendation_digest registered_at status_at_registration rationale'.split()) or value['contract_version']!=CONTRACT or value['registration_key']!=self._key(p,d) or value['principal_reference']!=p.reference or value['proposal_digest']!=d['proposal_digest'] or value['proposal_revision']!=d['proposal_revision'] or value['source']!=d['source'] or value['status_at_registration']!='RECOMMENDED'):raise RuntimeError('registration provenance unavailable')
+            rec,can=candidate_objects(d,self._key(p,d),value['registered_at'])
+            if value['candidate']!=json.loads(json.dumps(can.to_dict())) or value['candidate_digest']!=digest(can.to_dict()) or value['recommendation_id']!=rec.id or value['recommendation_digest']!=digest(rec.to_dict()) or value['rationale']!=d['fields']['rationale']:raise RuntimeError('registration subject binding invalid')
+            # Current Candidate may legitimately change; original Recommendation is immutable.
+            original=store._connection.execute('SELECT document FROM recommendations WHERE recommendation_id=?',(rec.id,)).fetchone()
+            if original is None or digest(json.loads(original[0]))!=value['recommendation_digest']:raise RuntimeError('canonical recommendation differs')
+        return value
+    def _readback(self,token,p,d,receipt,recorded=False):
+        self.grant.authorize(token,p.conversation_id,d['proposal_id']);actual=self._source(token,p,d['source']['turn_id'])
+        with self._read_store() as store:
+            original=self._registered(store,p,d)
+            if receipt!=original:raise RuntimeError('canonical receipt differs')
+            can=store.get_candidate(receipt['candidate']['id']);rec=store.get_recommendation(receipt['recommendation_id'])
+            current={'candidate':can.to_dict(),'candidate_digest':digest(can.to_dict()),'recommendation_status':rec.status.value,'conversation_revision':actual['conversation_revision'],'source_fresh':actual==d['source'],'mission_allocation':store.allocation_for_recommendation(rec.id) is not None}
+        return {'contract_version':CONTRACT,'recorded':recorded,'original_receipt':receipt,'current':current}
+    def capability(self,token):
+        p=self.grant.authorize(token)
+        return {'contract_version':CONTRACT,**{k:getattr(p,k) for k in ['instance_id','project_id','repository_id','conversation_id']},'proposal_ids':list(p.proposal_ids),'maximum_registrations':p.maximum_registrations,'registration_authority':'CANDIDATE_ONLY_NO_APPROVAL_OR_EXECUTION','additional_model_calls':0,'maximum_proposals_per_instance':64,'maximum_revisions_per_proposal':8,'read_only':True}
+    def source(self,token,conversation_id,turn_id):
+        identifier(turn_id);p=self.grant.authorize(token,conversation_id)
+        return {'contract_version':CONTRACT,'source':self._source(token,p,turn_id),'read_only':True}
+    def save(self,token,r):
+        r=proposal_request(r)
+        with self._lease(token,r['conversation_id'],r['proposal_id']) as p:
+            self._scope(p,r);source=self._source(token,p,r['turn_id'])
+            if source['conversation_revision']!=r['expected_conversation_revision'] or source['context_revision']!=r['context_revision']:raise AdvisoryConflict('SOURCE_STALE')
+            v=self._load(token,p,r['proposal_id'],True)
+            if len(v['revisions'])!=r['expected_revision']:raise AdvisoryConflict('PROPOSAL_STALE')
+            if len(v['revisions'])>=8:raise AdvisoryConflict('PROPOSAL_CAPACITY_EXHAUSTED')
+            d={'contract_version':CONTRACT,'principal_reference':p.reference,**{k:getattr(p,k) for k in ['instance_id','project_id','repository_id','conversation_id']},'proposal_id':r['proposal_id'],'proposal_revision':len(v['revisions'])+1,'source':source,'fields':r['fields'],'field_origins':{'fields':'EXPLICIT_USER','source.advice_summary':'VALIDATED_ADVICE'}}
+            d['proposal_digest']=digest(d);candidate_objects(d,self._key(p,d),'preview-not-registered')
+            v['revisions'].append(d);self._save(p,r['proposal_id'],v)
+            return {'contract_version':CONTRACT,'proposal':d,'registered':False,'additional_model_calls':0}
+    def preview(self,token,conversation_id,proposal_id,number=None):
+        p=self.grant.authorize(token,conversation_id,proposal_id);v=self._load(token,p,proposal_id)
+        if number is None:number=len(v['revisions'])
+        if type(number) is not int or not 1<=number<=len(v['revisions']):raise FileNotFoundError('unknown proposal revision')
+        d=v['revisions'][number-1];_,can=candidate_objects(d,self._key(p,d),'preview-not-registered')
+        with self._read_store() as store:receipt=self._registered(store,p,d)
+        return {'contract_version':CONTRACT,'proposal':d,'latest_revision':len(v['revisions']),'candidate_preview':can.to_dict(),'registration':self._readback(token,p,d,receipt) if receipt else None,'read_only':True}
+    def register(self,token,r):
+        r=registration_request(r)
+        with self._lease(token,r['conversation_id'],r['proposal_id']) as p:
+            self._scope(p,r);v=self._load(token,p,r['proposal_id'])
+            n=r['proposal_revision']
+            if n>len(v['revisions']):raise AdvisoryConflict('PROPOSAL_STALE')
+            d=v['revisions'][n-1]
+            if d['proposal_digest']!=r['proposal_digest']:raise AdvisoryConflict('PROPOSAL_STALE')
+            key=self._key(p,d)
+            with self._read_store() as store:
+                old=store.candidate_registration_intent(r['operation_id'],p.reference) if self._has_table(store,'advisory_candidate_intents') else None
+                receipt=self._registered(store,p,d)
+            if old is not None and old['request']!=r:raise AdvisoryConflict('OPERATION_PAYLOAD_CONFLICT')
+            if receipt is not None:
+                if old is None:
+                    actual=self._source(token,p,d['source']['turn_id'])
+                    if n!=len(v['revisions']) or actual!=d['source'] or r['expected_conversation_revision']!=actual['conversation_revision'] or r['context_revision']!=actual['context_revision']:raise AdvisoryConflict('SOURCE_OR_PROPOSAL_STALE')
+                    with control_runtime(self.root),RecommendationLifecycleStore(self._database_path()) as store:
+                        self.grant.authorize(token,p.conversation_id,d['proposal_id'])
+                        store.begin_candidate_registration(r['operation_id'],p.reference,key,{'request':r,'proposal':d,'registered_at':receipt['registered_at']},min(p.maximum_registrations,v['maximum_registrations']))
+                return self._readback(token,p,d,receipt)
+            actual=self._source(token,p,d['source']['turn_id'])
+            if n!=len(v['revisions']) or actual!=d['source'] or r['expected_conversation_revision']!=actual['conversation_revision'] or r['context_revision']!=actual['context_revision']:raise AdvisoryConflict('SOURCE_OR_PROPOSAL_STALE')
+            with control_runtime(self.root),RecommendationLifecycleStore(self._database_path(True)) as store:
+                p=self.grant.authorize(token,p.conversation_id,d['proposal_id']);actual=self._source(token,p,d['source']['turn_id'])
+                if actual!=d['source']:raise AdvisoryConflict('SOURCE_STALE')
+                intent=old or {'request':r,'proposal':d,'registered_at':datetime.now(UTC).isoformat()}
+                if intent['proposal']!=d:raise RuntimeError('intent proposal differs')
+                store.begin_candidate_registration(r['operation_id'],p.reference,key,intent,min(p.maximum_registrations,v['maximum_registrations']))
+                p=self.grant.authorize(token,p.conversation_id,d['proposal_id']);self._source(token,p,d['source']['turn_id'])
+                rec,can=candidate_objects(d,key,intent['registered_at'])
+                receipt=registration_receipt(p.reference,r['operation_id'],key,d,intent['registered_at'])
+                receipt,recorded=store.finish_candidate_registration(r['operation_id'],p.reference,key,rec,can,receipt)
+            return self._readback(token,p,d,receipt,recorded)
+    def operation(self,token,conversation_id,proposal_id,operation_id):
+        identifier(operation_id);p=self.grant.authorize(token,conversation_id,proposal_id)
+        with self._read_store() as store:op=store.candidate_registration_intent(operation_id,p.reference) if self._has_table(store,'advisory_candidate_intents') else None
+        if op is None:raise FileNotFoundError('unknown operation')
+        r=registration_request(op['request'])
+        if r['conversation_id']!=conversation_id or r['proposal_id']!=proposal_id:raise PermissionError('foreign operation')
+        v=self._load(token,p,proposal_id);d=v['revisions'][r['proposal_revision']-1]
+        if op['proposal']!=d or r['proposal_digest']!=d['proposal_digest']:raise RuntimeError('operation provenance differs')
+        with self._read_store() as store:receipt=self._registered(store,p,d)
+        return self._readback(token,p,d,receipt) if receipt else {'contract_version':CONTRACT,'state':'PENDING','operation_id':operation_id,'read_only':True}
+    def handle(self,method,target,token,body=None):
+        try:
+            if self.grant.authenticate(token) is None:return 401,{'contract_version':CONTRACT,'error':{'code':'CANDIDATE_AUTHENTICATION_REQUIRED'}}
+            parsed=urlsplit(target);a=parsed.path.split('/');q=parse_qs(parsed.query,keep_blank_values=True)
+            if method=='GET' and parsed.path=='/v1/advisory-candidates/capability' and not q:return 200,self.capability(token)
+            if len(a)>=4 and a[:3]==['','v1','advisory-candidates']:
+                conv=identifier(a[3])
+                if method=='GET' and len(a)==6 and a[4]=='source' and not q:return 200,self.source(token,conv,a[5])
+                if method=='POST' and len(a)==5 and a[4]=='proposals' and not q:
+                    if body['conversation_id']!=conv:raise PermissionError('route scope differs')
+                    return 200,self.save(token,body)
+                if len(a)>=6 and a[4]=='proposals':
+                    prop=identifier(a[5])
+                    if method=='GET' and len(a)==6 and set(q)<={'revision'} and len(q.get('revision',[]))<=1:
+                        return 200,self.preview(token,conv,prop,int(q['revision'][0]) if q else None)
+                    if method=='POST' and len(a)==7 and a[6]=='registrations' and not q:
+                        if body['conversation_id']!=conv or body['proposal_id']!=prop:raise PermissionError('route scope differs')
+                        return 200,self.register(token,body)
+                    if method=='GET' and len(a)==8 and a[6]=='registrations' and not q:return 200,self.operation(token,conv,prop,a[7])
+            raise PermissionError('Candidate grant does not authorize route')
+        except AdvisoryConflict as e:status=409;code=e.code
+        except PermissionError:status=403;code='CANDIDATE_SCOPE_DENIED'
+        except FileNotFoundError:status=404;code='CANDIDATE_SUBJECT_NOT_FOUND'
+        except LifecycleError:status=409;code='CANDIDATE_LIFECYCLE_CONFLICT'
+        except (ValueError,TypeError,KeyError,IndexError):status=400;code='CANDIDATE_REQUEST_INVALID'
+        except (RuntimeError,OSError,sqlite3.Error):status=503;code='CANDIDATE_SOURCE_UNAVAILABLE'
+        return status,{'contract_version':CONTRACT,'error':{'code':code}}

{forge_autonomy-2.8.1 → forge_autonomy-2.12.2}/forge/advisory_context.py

@@ -1,12 +1,13 @@
 """Owner-selected immutable public repository snapshots with current private ACL."""
 from pathlib import Path
+from datetime import UTC,datetime
 from hashlib import sha256
 import argparse
 import json
 import re
 from .advisory_contract import CONTRACT, digest, text, AdvisoryConflict
 from .advisory_grant import project_scope
-from .approved_worklist import identifier
+from .approved_worklist import identifier,timestamp
 from .completion.repository_observer import GitHubRepositoryArtifactReader
 from .execution_host_configuration import read_peer_configuration
 from .workspace_worklist_control_grant import current_operator
@@ -24,8 +25,10 @@ class AdvisoryContext:
         if not isinstance(records,list) or len(records)>16:raise RuntimeError('context catalog invalid')
         seen=set()
         for r in records:
-            if not isinstance(r,dict) or set(r)!=fields or r['state'] not in ('ACTIVE','REVOKED'):raise RuntimeError('context shape invalid')
-            try:identifier(r['source_id']);text(r['content'],2048)
+            if not isinstance(r,dict) or set(r) not in (fields,fields|{'observed_at'}) or r['state'] not in ('ACTIVE','REVOKED'):raise RuntimeError('context shape invalid')
+            try:
+                identifier(r['source_id']);text(r['content'],2048)
+                if 'observed_at' in r:timestamp(r['observed_at'])
             except (ValueError,TypeError):raise RuntimeError('context content invalid') from None
             if r['source_id'] in seen or r['content_digest']!='sha256:'+sha256(r['content'].encode()).hexdigest() or r['version']!=digest({k:v for k,v in r.items() if k not in ('state','version')}):raise RuntimeError('context provenance invalid')
             seen.add(r['source_id'])
@@ -44,7 +47,8 @@ class AdvisoryContext:
             text(content,2048);records=self._read(True)
             if any(r['source_id']==source_id for r in records) or len(records)>=16:raise ValueError('immutable source exists or capacity exhausted')
             r={'source_id':source_id,'scope':scope,'state':'ACTIVE','repository':binding.repository_identity,
-               'revision':revision,'path':path,'content':content,'content_digest':'sha256:'+sha256(content.encode()).hexdigest()}
+               'revision':revision,'path':path,'content':content,'content_digest':'sha256:'+sha256(content.encode()).hexdigest(),
+               'observed_at':datetime.now(UTC).isoformat()}
             r['version']=digest({k:v for k,v in r.items() if k!='state'});self._save([*records,r]);return self.metadata(r)
 
     def revoke(self,source_id):
@@ -60,7 +64,7 @@ class AdvisoryContext:
         _write_private(self.path,raw)
 
     @staticmethod
-    def metadata(r):return {k:v for k,v in r.items() if k not in ('content','scope')}
+    def metadata(r):return {k:v for k,v in r.items() if k not in ('content','scope','observed_at')}
 
     def available(self,p):
         scope={k:getattr(p,k) for k in ['instance_id','project_id','repository_id']}

{forge_autonomy-2.8.1 → forge_autonomy-2.12.2}/forge/advisory_provider.py

@@ -17,6 +17,13 @@ class AdvisoryNotStarted(PermissionError):pass
 class AdvisoryProviderUnavailable(RuntimeError):pass
 
 class AdvisoryProvider:
+    contract = CONTRACT
+    output_schema = OUTPUT_SCHEMA
+    instructions = INSTRUCTIONS
+
+    def validate_output(self, document, admitted):
+        return result(document, admitted, admitted['context']['evidence_references'])
+
     def __init__(self, runtime, provider_id):
         service=PlanningProviderSecurityService(runtime.database,None,runtime.repository.operators)
         try:self.configuration=CodexCliChatGPTSessionPlanningProviderConfiguration.from_canonical_session(service,provider_id)
@@ -31,13 +38,13 @@ class AdvisoryProvider:
             raise AdvisoryConflict('INVOCATION_UNRESOLVED')
         from .advisory_context import AdvisoryContext
         sources=AdvisoryContext(self.configuration.policy_service.db.path.parent,admitted['request']['instance_id']).selected(type('Scope',(),{k:admitted['request'][k] for k in ['instance_id','project_id','repository_id']})(),admitted['request']['selected_sources'])
-        prompt={'contract_version':CONTRACT,'request':admitted['request'],
+        prompt={'contract_version':self.contract,'request':admitted['request'],
                 'request_digest':admitted['request_digest'],'session_id':admitted['session_id'],
                 'invocation_id':admitted['invocation_id'],'context':admitted['context'],'selected_source_text':[{'reference':'advisory-source:'+r['source_id']+':'+r['version'],'content':r['content']} for r in sources],'prior_turns':history}
         # Conservative byte bound; observed usage remains separately enforced.
         if len(__import__('json').dumps(prompt).encode())>min(policy.input_token_bound,policy.context_token_bound):
             raise ValueError('advisory context exceeds configured bound')
-        binding={'request':prompt,'schema':OUTPUT_SCHEMA,'instructions':INSTRUCTIONS,'policy_digest':_policy_digest(policy)}
+        binding={'request':prompt,'schema':self.output_schema,'instructions':self.instructions,'policy_digest':_policy_digest(policy)}
         if len(__import__('json').dumps(binding).encode())>min(policy.input_token_bound,policy.context_token_bound):raise ValueError('advisory envelope exceeds configured bound')
         return policy,prompt,digest(binding)
 
@@ -60,7 +67,7 @@ class AdvisoryProvider:
                 authorize()
                 service._commit_generation_transport(permit,policy,_policy_digest(policy),generation_digest)
             except PermissionError as e:raise AdvisoryNotStarted('generation not started') from e
-            run=self.transport._run_read_only(policy,None,OUTPUT_SCHEMA,INSTRUCTIONS,prompt_document=prompt)
+            run=self.transport._run_read_only(policy,None,self.output_schema,self.instructions,prompt_document=prompt)
             d=run.diagnostic.document()
             confirmed=run.diagnostic.classification is CodexCliInvocationClassification.COMPLETED_VALID
             known_not_started=run.diagnostic.classification in {CodexCliInvocationClassification.NOT_STARTED,CodexCliInvocationClassification.REJECTED_BEFORE_GENERATION}
@@ -70,7 +77,7 @@ class AdvisoryProvider:
             if confirmed:
                 outcome['result_digest']=digest(run.document)
                 try:
-                    output=result(run.document,admitted,admitted['context']['evidence_references'])
+                    output=self.validate_output(run.document,admitted)
                     usage_error=_usage_policy_error(run.usage,policy)
                     if usage_error:outcome['error_code']='ADVICE_USAGE_NOT_REPORTED' if run.usage is None else 'ADVICE_USAGE_BOUND_EXCEEDED'
                     else:outcome['output']=output