fred-runtime 3.3.0__tar.gz → 3.3.2__tar.gz

{fred_runtime-3.3.0 → fred_runtime-3.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fred-runtime
-Version: 3.3.0
+Version: 3.3.2
 Summary: Runtime adapters and infrastructure wiring for Fred v2 agents.
 Author-email: Thales <noreply@thalesgroup.com>
 License: Apache-2.0
@@ -12,8 +12,8 @@ Classifier: Programming Language :: Python :: 3 :: Only
 Classifier: Operating System :: OS Independent
 Requires-Python: <3.13,>=3.12
 Description-Content-Type: text/markdown
-Requires-Dist: fred-core>=3.4.0
-Requires-Dist: fred-sdk>=3.3.0
+Requires-Dist: fred-core>=3.4.1
+Requires-Dist: fred-sdk>=3.3.1
 Requires-Dist: alembic>=1.18.4
 Requires-Dist: deepagents>=0.4.11
 Requires-Dist: httpx>=0.28.1
@@ -25,7 +25,7 @@ Requires-Dist: langfuse>=3.0.0
 Requires-Dist: requests<3,>=2.32
 Requires-Dist: PyYAML>=6.0
 Provides-Extra: app
-Requires-Dist: fastapi>=0.116; extra == "app"
+Requires-Dist: fastapi>=0.139.0; extra == "app"
 Provides-Extra: dev
 Requires-Dist: bandit>=1.8.6; extra == "dev"
 Requires-Dist: basedpyright==1.31.0; extra == "dev"

{fred_runtime-3.3.0 → fred_runtime-3.3.2}/fred_runtime/app/agent_app.py

@@ -56,6 +56,7 @@ from fastapi import APIRouter, Depends, FastAPI, HTTPException, Request, status
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import StreamingResponse
 from fred_core.common.config_loader import get_config
+from fred_core.common.team_id import is_personal_team_id, personal_team_id
 from fred_core.history.history_schema import ChatMessage
 from fred_core.kpi import KPIMiddleware
 from fred_core.kpi.kpi_writer_structures import KPIActor
@@ -63,9 +64,13 @@ from fred_core.logs.log_setup import log_setup
 from fred_core.logs.memory_log_store import RamLogStore
 from fred_core.security.models import AuthorizationError
 from fred_core.security.oidc import get_keycloak_client_id, get_keycloak_url
-from fred_core.security.rebac.rebac_engine import TeamPermission
+from fred_core.security.rebac.rebac_engine import (
+    ORGANIZATION_ID,
+    OrganizationPermission,
+    TeamPermission,
+)
 from fred_core.security.rebac.rebac_factory import rebac_factory
-from fred_core.security.structure import KeycloakUser
+from fred_core.security.structure import KeycloakUser, is_service_agent
 from fred_sdk.contracts.context import (
     AgentInvocationRequest,
     AgentInvocationResult,
@@ -110,6 +115,7 @@ from fred_runtime.react.react_runtime import ReActRuntime
 from fred_runtime.runtime_support.checkpoints import load_checkpoint
 
 from ..common.structures import AgentSettingsLike
+from ..integrations.inprocess_toolkit_registry import build_inprocess_toolkit
 from ..integrations.v2_runtime.adapters import (
     CompositeToolInvoker,
     FredKnowledgeSearchToolInvoker,
@@ -1122,6 +1128,12 @@ async def _authorize_execution_or_raise(
     - security disabled (no authenticated user) → skip (dev/local).
     - ReBAC engine absent or disabled (Noop) → skip (identity-only dev posture);
       the C3 profile guarantees an enabled engine in classified deployments.
+    - a personal space (`personal-<uid>`) is intrinsic ownership, not a stored
+      OpenFGA tuple: a human caller acting on their own canonical
+      `personal_team_id(authenticated_user.uid)` is authorized without an OpenFGA
+      call; any other `personal-*` id (another user's space, or the bare
+      `"personal"` alias) is explicitly denied — never routed to OpenFGA (AUTHZ-05
+      item 8b watch item).
     - otherwise require the caller to hold `CAN_READ` on the requested team — the
       same relation the control-plane required before it would mint a grant. The
       team is caller-supplied but safe: OpenFGA only authorizes teams the user
@@ -1183,6 +1195,50 @@ async def _authorize_execution_or_raise(
                 "(runtime_context.team_id)"
             ),
         )
+    if is_service_agent(authenticated_user):
+        # Solution A (RFC EVAL-AUTH): a service identity (the evaluation worker) is
+        # recognized for execution, scoped to the request team_id, without any stored
+        # OpenFGA relation. Legitimacy is anchored upstream at campaign creation. The
+        # team_id is guaranteed non-None above, so this stays team-scoped (never global).
+        _emit_audit_event(
+            container,
+            "info",
+            "service_agent_authorized",
+            user_id=authenticated_user.uid,
+            team_id=team_id,
+            agent_instance_id=request.agent_instance_id,
+        )
+        return
+    if team_id == "personal" or is_personal_team_id(team_id):
+        # Personal spaces are intrinsic ownership (AUTHZ-05 item 8b): the id is
+        # derived from the JWT subject via `personal_team_id`, is never persisted
+        # as an OpenFGA tuple, and must never be resolved by OpenFGA. Only an
+        # exact match against the caller's own canonical id is authorized; any
+        # other personal-* id (another user's space) or the bare "personal"
+        # alias (ambiguous once ReBAC is active) is denied here, before OpenFGA
+        # ever sees it.
+        if team_id == personal_team_id(authenticated_user.uid):
+            _emit_audit_event(
+                container,
+                "info",
+                "personal_space_owner_authorized",
+                user_id=authenticated_user.uid,
+                team_id=team_id,
+                agent_instance_id=request.agent_instance_id,
+            )
+            return
+        _emit_audit_event(
+            container,
+            "warning",
+            "personal_space_denied",
+            user_id=authenticated_user.uid,
+            team_id=team_id,
+            agent_instance_id=request.agent_instance_id,
+        )
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"user {authenticated_user.uid!r} is not authorized for team {team_id!r}",
+        )
     try:
         await rebac.check_user_team_permission_or_raise(
             authenticated_user, TeamPermission.CAN_READ, team_id
@@ -1255,6 +1311,31 @@ async def _enforce_session_ownership(
     )
 
 
+async def _caller_can_manage_platform(caller: KeycloakUser | None) -> bool:
+    """True when the caller holds org-level ``can_manage_platform`` (CTRLP-12 C1).
+
+    The delete endpoints use this as an **admin branch**: a platform service
+    principal — e.g. the control-plane lifecycle worker erasing a conversation at
+    window expiry — may delete a session it does not personally own. Only the
+    per-user *ownership* check is waived; *authentication* stays enforced upstream
+    by ``_authenticated_user``.
+
+    Fails closed: returns False when there is no caller or when ReBAC is disabled
+    (dev/no-security), so ownership behaviour is unchanged there and the bypass
+    activates only when ReBAC is actually enforcing and the org permission is
+    granted. Reuses the AUTHZ-01 ``can_manage_platform`` permission — no second
+    bypass is forked.
+    """
+    if caller is None:
+        return False
+    rebac = get_runtime_context().config.rebac_engine
+    if rebac is None or not rebac.enabled:
+        return False
+    return await rebac.has_user_permission(
+        caller, OrganizationPermission.CAN_MANAGE_PLATFORM, ORGANIZATION_ID
+    )
+
+
 async def _authorize_and_resolve(
     request: RuntimeExecuteRequest,
     *,
@@ -2010,7 +2091,6 @@ async def _iterate_runtime_event_payloads(
         checkpoint_id=resolved_checkpoint_id,
         user_id=ctx.get("user_id"),
         team_id=resolved_team_id,
-        user_groups=ctx.get("user_groups"),
         language=ctx.get("language"),
         access_token=access_token,
         refresh_token=ctx.get("refresh_token"),
@@ -2036,6 +2116,10 @@ async def _iterate_runtime_event_payloads(
         # at prepare-execution and the frontend forwards it — but it was also
         # silently dropped here, so no agent ever received a selected prompt.
         context_prompt_text=ctx.get("context_prompt_text"),
+        # Rebuilt by the frontend from the attachments that currently exist.
+        # When the final file is deleted this is absent, so the per-turn runtime
+        # notice disappears without leaving a checkpointed system message behind.
+        attachments_markdown=ctx.get("attachments_markdown"),
     )
 
     binding = BoundRuntimeContext(
@@ -2195,6 +2279,7 @@ def _build_agent_router(
     async def get_kpi_turns(
         limit: int = 50,
         container: PodApplicationContext = Depends(get_pod_container),
+        caller: KeycloakUser | None = Depends(_authenticated_user),
     ) -> list[KpiTurnRecord]:
         """
         Return recent agent.turn_completed KPI events, newest first.
@@ -2209,7 +2294,20 @@ def _build_agent_router(
         - developers need to validate KPI emission from the CLI without
           Grafana or Prometheus; this exposes the pod-local ring buffer
         - max 200 entries retained in memory (oldest evicted automatically)
+
+        AUTHZ-05 review finding: item 8a's org-level CAN_READ_METRICS removal
+        does not apply here — unlike the tier-2 capability it replaced
+        (near-universal, protected nothing specific), this buffer holds
+        cross-user/cross-team data (session_id, exchange_id, user_id, team_id,
+        token counts) for every caller that has hit this pod, not just the
+        caller's own. Gated the same way as the sibling `get_audit_events`
+        below, on `CAN_MANAGE_PLATFORM`, not deleted outright.
         """
+        rebac = get_runtime_context().config.rebac_engine
+        if caller is not None and rebac is not None and rebac.enabled:
+            await rebac.check_user_permission_or_raise(
+                caller, OrganizationPermission.CAN_MANAGE_PLATFORM, ORGANIZATION_ID
+            )
         with container._kpi_turns_lock:
             events = list(container.kpi_turns_buffer)
         events.reverse()
@@ -2219,6 +2317,7 @@ def _build_agent_router(
     async def get_audit_events(
         limit: int = 50,
         container: PodApplicationContext = Depends(get_pod_container),
+        caller: KeycloakUser | None = Depends(_authenticated_user),
     ) -> list[AuditEventRecord]:
         """
         Return recent security audit events, newest first.
@@ -2233,6 +2332,11 @@ def _build_agent_router(
           this ring buffer so the CLI can query them directly
         - max 200 entries retained in memory
         """
+        rebac = get_runtime_context().config.rebac_engine
+        if caller is not None and rebac is not None and rebac.enabled:
+            await rebac.check_user_permission_or_raise(
+                caller, OrganizationPermission.CAN_MANAGE_PLATFORM, ORGANIZATION_ID
+            )
         with container._audit_events_lock:
             events = list(container.audit_events_buffer)
         events.reverse()
@@ -2392,6 +2496,11 @@ def _build_agent_router(
                 detail="No history store configured — session history is unavailable.",
             )
         caller_uid = caller.uid if caller is not None else None
+        if await _caller_can_manage_platform(caller):
+            # Platform admin (e.g. CTRLP-12 lifecycle erase-at-expiry): delete every
+            # row for the session, not just the caller's — ownership is waived,
+            # authentication stays enforced upstream.
+            caller_uid = None
         count = await history_store.delete_session(
             session_id=session_id, user_id=caller_uid
         )
@@ -2717,7 +2826,8 @@ def _build_agent_router(
         caller_uid = caller.uid if caller is not None else None
         history_store = _get_history_store_for_owned_access(caller)
         if (
-            caller_uid is not None
+            not await _caller_can_manage_platform(caller)
+            and caller_uid is not None
             and history_store is not None
             and not await history_store.session_belongs_to_user(session_id, caller_uid)
         ):
@@ -2925,8 +3035,10 @@ def _build_agent_router(
           stream closes. Do not rely on it as an end-of-turn signal here.
 
         Security:
-        - For managed execution (agent_instance_id), an execution_grant issued by
-          control-plane is required. The runtime validates it structurally.
+        - There is no ExecutionGrant. Identity is the caller's Keycloak JWT; for
+          managed execution (agent_instance_id) the runtime authorizes each request
+          itself with a per-request ReBAC (OpenFGA) check on runtime_context.team_id.
+          The control plane issues no signed grant or capability token.
         - RBAC via Keycloak and REBAC via OpenFGA protect this endpoint.
 
         Architectural note:
@@ -3073,6 +3185,7 @@ def create_agent_app(
                     checkpointer=checkpointer,
                     history_store=history_store,
                     mcp_configuration=config.get_mcp_configuration(),
+                    inprocess_toolkit_factory=build_inprocess_toolkit,
                     control_plane_url=config.platform.control_plane_url,
                     rebac_engine=rebac_engine,
                     security_profile=(

{fred_runtime-3.3.0 → fred_runtime-3.3.2}/fred_runtime/common/mcp_runtime.py

@@ -18,8 +18,9 @@ from __future__ import annotations
 
 import asyncio
 import logging
+import time
 from collections.abc import Awaitable, Iterable
-from typing import Any, Callable, List, Optional, cast
+from typing import Any, Callable, List, Optional, Tuple, cast
 
 from fred_sdk.contracts.context import RuntimeContext as AgentRuntimeContext
 from fred_sdk.contracts.models import (
@@ -45,6 +46,105 @@ logger = logging.getLogger(__name__)
 MCP_CONNECT_MAX_ATTEMPTS = 3
 MCP_CONNECT_RETRY_BASE_DELAY_SECS = 0.5
 
+# --- Cross-request connect/tool-list cache (perf) -----------------------------
+# BENCH-<pending id>: `_run_lifecycle` used to reconnect + re-list tools against
+# every configured MCP server on EVERY agent turn (measured: ~2-3s wall time for
+# a 7-server agent, with a near-instant mock LLM). `MultiServerMCPClient` itself
+# holds no persistent resources (see `_close_mcp_client_quietly` below), so the
+# per-turn cost was purely the repeated connect+list_tools round trips, not
+# anything a "closed" connection would have saved by staying open.
+#
+# This cache reuses the (client, tools) pair across turns for the SAME agent +
+# server set + access token, so repeat turns in a session (or across sessions
+# for the same user/dev token) skip the round trips entirely.
+#
+# Auth freshness on a cache hit: `langchain_mcp_adapters` reads `tool_interceptors`
+# (and per-server `headers`) live off the client instance at call time, not from a
+# snapshot frozen at discovery time (verified against langchain_mcp_adapters==0.3.0
+# — see `execute_tool`/`_build_interceptor_chain` in its `tools.py`). So on a cache
+# hit we mutate `client.tool_interceptors` IN PLACE (never reassign the list) to the
+# CURRENT request's own interceptors before handing the client back — every request
+# still gets its own live `ExpiredTokenRetryInterceptor` (bound to ITS OWN, live
+# `agent_instance`/token-refresh callback), even though the underlying connection +
+# discovered tool schemas are shared. Headers don't need the same treatment: the
+# cache key already includes the exact access_token string, so a cache hit implies
+# an identical token/header value already.
+#
+# Residual, accepted race: two truly concurrent requests for the SAME identity
+# (same cache key) could have request A's in-flight tool call pick up request B's
+# interceptor instance instead of its own. Both point at the same live user, so
+# this is never a cross-user leak — at worst a harmless same-identity mix-up.
+# Closing it fully would need a lock held for an entire turn's tool-calling phase,
+# which would serialize concurrent turns for the same user; not worth it.
+MCP_CLIENT_CACHE_TTL_SECS = 300.0
+_mcp_client_cache: dict[
+    Tuple[str, Tuple[str, ...], str], Tuple[MultiServerMCPClient, List[BaseTool], float]
+] = {}
+_mcp_client_cache_lock = asyncio.Lock()
+
+
+def _mcp_cache_key(
+    agent_id: str, servers: List[MCPServerConfiguration], access_token: str | None
+) -> Tuple[str, Tuple[str, ...], str]:
+    return (agent_id, tuple(sorted(s.id for s in servers)), access_token or "")
+
+
+def _prune_expired_mcp_cache_locked(now: float) -> None:
+    """
+    Drop every expired entry from `_mcp_client_cache`.
+
+    Why this exists:
+    - a cache hit only checks the ONE key being looked up; without this, any
+      OTHER key that expires (e.g. a rotated user token, an agent that stops
+      being used) stays resident in process memory forever — a real memory
+      leak over a long-running pod's life, and it keeps stale `Authorization`
+      headers (the cache key embeds the raw access_token) around indefinitely.
+
+    How to use it:
+    - call under `_mcp_client_cache_lock`, before a lookup or insert.
+    """
+    expired = [k for k, v in _mcp_client_cache.items() if v[2] <= now]
+    for k in expired:
+        del _mcp_client_cache[k]
+
+
+async def _get_or_connect_mcp_client(
+    *,
+    agent_id: str,
+    mcp_servers: List[MCPServerConfiguration],
+    runtime_context: AgentRuntimeContext,
+    tool_interceptors: list,
+) -> Tuple[MultiServerMCPClient, List[BaseTool]]:
+    key = _mcp_cache_key(agent_id, mcp_servers, runtime_context.access_token)
+    now = time.monotonic()
+
+    async with _mcp_client_cache_lock:
+        _prune_expired_mcp_cache_locked(now)
+        cached = _mcp_client_cache.get(key)
+        if cached is not None and cached[2] > now:
+            cached_client = cached[0]
+            # In-place mutation only — reassigning `.tool_interceptors` would not
+            # be seen by tool closures already vended from a prior get_tools()
+            # call (they hold a reference to the original list object).
+            cached_client.tool_interceptors[:] = tool_interceptors
+            logger.info(
+                "[MCP] agent=%s cache hit: reusing connected client (%d tools), "
+                "current request's interceptors swapped in.",
+                agent_id,
+                len(cached[1]),
+            )
+            return cached_client, cached[1]
+
+    client, tools = await get_connected_mcp_client_for_agent(
+        agent_id=agent_id,
+        mcp_servers=mcp_servers,
+        runtime_context=runtime_context,
+        tool_interceptors=tool_interceptors,
+    )
+    async with _mcp_client_cache_lock:
+        _mcp_client_cache[key] = (client, tools, now + MCP_CLIENT_CACHE_TTL_SECS)
+    return client, tools
+
 
 async def _close_mcp_client_quietly(client: Optional[MultiServerMCPClient]) -> None:
     if not client:
@@ -245,29 +345,23 @@ class MCPRuntime:
             if refresh_cb:
                 interceptors.append(ExpiredTokenRetryInterceptor(refresh_cb))
 
-            new_client = await get_connected_mcp_client_for_agent(
+            new_client, tools = await _get_or_connect_mcp_client(
                 agent_id=self._agent_id,
                 mcp_servers=self.remote_servers,
                 runtime_context=runtime_context,
                 tool_interceptors=interceptors,
             )
             self.mcp_client = new_client
+            # `tools` were already fetched (per server) while connecting/validating
+            # above — reuse them instead of paying for a second get_tools() round
+            # trip against every server on every single turn.
             self.toolkit = McpToolkit(client=new_client, agent=self.agent_instance)
-            try:
-                # Pre-fetch tools once (async) and cache in toolkit for sync callers
-                tools = await new_client.get_tools()
-                self.toolkit.tools = tools
-                logger.info(
-                    "[MCP] agent=%s init: Prefetched and cached %d tools.",
-                    self._agent_id,
-                    len(tools),
-                )
-            except Exception:
-                logger.warning(
-                    "[MCP] agent=%s init: Failed to prefetch tools; toolkit will attempt best-effort discovery later.",
-                    self._agent_id,
-                    exc_info=True,
-                )
+            self.toolkit.tools = tools
+            logger.info(
+                "[MCP] agent=%s init: Connected and cached %d tools.",
+                self._agent_id,
+                len(tools),
+            )
             logger.info(
                 "[MCP] agent=%s init: Successfully built and connected client.",
                 self._agent_id,
@@ -375,7 +469,7 @@ class MCPRuntime:
             )
             return
         for server in self.inprocess_servers:
-            toolkit = factory(server.provider)
+            toolkit = factory(server.provider, self.agent_instance)
             if toolkit is None:
                 logger.warning(
                     "[MCP] agent=%s no toolkit built for provider=%s (server=%s)",

{fred_runtime-3.3.0 → fred_runtime-3.3.2}/fred_runtime/common/mcp_utils.py

@@ -25,7 +25,8 @@ Contract
 --------
 - Requires an `access_token_provider` (a callable) to fetch the user's token
   before connecting to any MCP server.
-- Returns a connected `MultiServerMCPClient`.
+- Returns a connected `MultiServerMCPClient` plus the tools already fetched
+  while validating each server (see `get_connected_mcp_client_for_agent`).
 - Raises `ExceptionGroup` if **any** server fails to connect.
 
 """
@@ -35,10 +36,11 @@ from __future__ import annotations
 import logging
 import time
 from datetime import timedelta
-from typing import Dict, List
+from typing import Dict, List, Tuple
 
 from fred_sdk.contracts.context import RuntimeContext
 from fred_sdk.contracts.models import MCPServerConfiguration
+from langchain_core.tools import BaseTool
 from langchain_mcp_adapters.client import MultiServerMCPClient
 from langchain_mcp_adapters.sessions import Connection, StreamableHttpConnection
 
@@ -184,10 +186,14 @@ async def get_connected_mcp_client_for_agent(
     *,
     tool_interceptors: list | None = None,
     # -----------------------------------------------
-) -> MultiServerMCPClient:
+) -> Tuple[MultiServerMCPClient, List[BaseTool]]:
     """
     Creates and connects the MultiServerMCPClient using the token provided by
     `access_token_provider`. Supports `streamable_http` and `stdio` transports.
+
+    Also returns the tools fetched per server during connection validation, so
+    callers don't have to pay for a second `get_tools()` round trip against
+    every server just to populate their toolkit (see mcp_runtime.py).
     """
 
     for s in mcp_servers:
@@ -262,10 +268,13 @@ async def get_connected_mcp_client_for_agent(
         connections, tool_interceptors=tool_interceptors or []
     )
 
-    # Validate connections by attempting to load tools per server
+    # Validate connections by attempting to load tools per server. This is also
+    # the ONLY tool-fetch round trip we make per server — the fetched tools are
+    # returned to the caller so `MCPRuntime._run_lifecycle` doesn't need to call
+    # `client.get_tools()` again across all servers right after this returns.
     exceptions: list[Exception] = []
     failure_messages: list[str] = []
-    total_tools = 0
+    fetched_tools: list[BaseTool] = []
     for server in mcp_servers:
         conn_entry = connections.get(server.id) or {}
         transport = conn_entry.get("transport", "unknown")
@@ -294,7 +303,7 @@ async def get_connected_mcp_client_for_agent(
                 len(tools),
                 dur_ms,
             )
-            total_tools += len(tools)
+            fetched_tools.extend(tools)
         except Exception as e:
             dur_ms = (time.perf_counter() - start) * 1000
             logger.warning(
@@ -328,6 +337,6 @@ async def get_connected_mcp_client_for_agent(
     logger.debug(
         "[MCP][%s] summary: all servers validated, total tools=%d",
         agent_id,
-        total_tools,
+        len(fetched_tools),
     )
-    return client
+    return client, fetched_tools

{fred_runtime-3.3.0 → fred_runtime-3.3.2}/fred_runtime/deep/deep_runtime.py

@@ -38,7 +38,7 @@ from langchain_core.tools import BaseTool
 from langgraph.types import Checkpointer
 
 from fred_runtime.react.react_prompting import (
-    build_guardrail_suffix as _build_guardrail_suffix,
+    compose_system_prompt as _compose_system_prompt,
 )
 from fred_runtime.react.react_prompting import (
     render_prompt_template as _render_prompt_template,
@@ -117,11 +117,17 @@ class DeepAgentRuntime(ReActRuntime):
             binding=binding,
             agent_id=self.definition.agent_id,
         )
-        system_prompt = (
-            f"{system_prompt}"
-            f"{_build_runtime_tool_prompt_suffix(bound_tools)}"
-            f"{_build_guardrail_suffix(self.definition)}"
-            f"{_filesystem_prompt_suffix(filesystem_tools_enabled=filesystem_tools_enabled)}"
+        system_prompt = _compose_system_prompt(
+            system_prompt,
+            binding=binding,
+            definition=self.definition,
+            agent_id=self.definition.agent_id,
+            tool_suffix=_build_runtime_tool_prompt_suffix(bound_tools),
+            runtime_suffixes=(
+                _filesystem_prompt_suffix(
+                    filesystem_tools_enabled=filesystem_tools_enabled
+                ),
+            ),
         )
         compiled_agent = _create_compiled_deep_agent(
             model=self._model,

{fred_runtime-3.3.0 → fred_runtime-3.3.2}/fred_runtime/graph/graph_runtime.py

@@ -1906,7 +1906,6 @@ def _graph_phase_timer(
     return metrics.timer(
         "app.phase_latency_ms",
         dims=dims,
-        groups=binding.runtime_context.user_groups,
     )
 
 

fred_runtime-3.3.2/fred_runtime/integrations/inprocess_toolkit_registry.py

@@ -0,0 +1,50 @@
+# Copyright Thales 2026
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""
+Registry mapping catalog `provider` keys to in-process MCP toolkits (MIGR-03.03).
+
+Why this module exists:
+- an MCP catalog server with `transport: inprocess` names a `provider`; the MCP
+  runtime asks this factory to build the matching toolkit for the current agent turn
+- keeping the mapping here (not in `agent_app`) lets the runtime wire a single
+  factory reference at startup without hardcoding provider knowledge in the boot path
+
+How to use it:
+- pass `build_inprocess_toolkit` as `RuntimeConfig.inprocess_toolkit_factory`
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from fred_runtime.integrations.kf_vector_search import (
+    KF_VECTOR_SEARCH_PROVIDER,
+    KfVectorSearchToolkit,
+)
+
+logger = logging.getLogger(__name__)
+
+
+def build_inprocess_toolkit(provider: str | None, agent: Any) -> Any | None:
+    """
+    Build the in-process toolkit for `provider`, bound to the current agent turn.
+
+    Returns None for an unknown or missing provider so the MCP runtime skips it with
+    a warning rather than failing the whole agent.
+    """
+    if provider == KF_VECTOR_SEARCH_PROVIDER:
+        return KfVectorSearchToolkit(agent=agent)
+    logger.warning("[MCP] unknown inprocess provider=%s; no toolkit built.", provider)
+    return None

fred_runtime-3.3.2/fred_runtime/integrations/kf_vector_search/__init__.py

@@ -0,0 +1,21 @@
+# Copyright Thales 2026
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""In-process Knowledge Flow vector-search MCP toolkit."""
+
+from fred_runtime.integrations.kf_vector_search.toolkit import (
+    KF_VECTOR_SEARCH_PROVIDER,
+    KfVectorSearchToolkit,
+)
+
+__all__ = ["KF_VECTOR_SEARCH_PROVIDER", "KfVectorSearchToolkit"]