gini-toolkit 6.0.1.dev0__py3-none-any.whl

gini/services/persistence.py

@@ -0,0 +1,28 @@
+"""Project persistence — save/load a topology as a JSON project.
+
+Uses the domain model's own to_dict/from_dict, so the on-disk format is just the
+topology (devices + links + positions + properties) wrapped with a version. A legacy
+.gsav reader can be added later; this is the clean native format.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from ..domain.topology import Topology
+
+PROJECT_EXT = ".gini"
+FORMAT = "gini-project"
+VERSION = 1
+
+
+def save_project(topo: Topology, path: str | Path) -> None:
+    data = {"format": FORMAT, "version": VERSION, "topology": topo.to_dict()}
+    Path(path).write_text(json.dumps(data, indent=2))
+
+
+def load_project(path: str | Path) -> Topology:
+    data = json.loads(Path(path).read_text())
+    if data.get("format") != FORMAT:
+        raise ValueError(f"not a GINI project file: {path}")
+    return Topology.from_dict(data["topology"])

gini/services/probe_runner.py

@@ -0,0 +1,149 @@
+"""Docker-backed probe Runner — GINI's runtime as the behavioral oracle (Mac-side).
+
+Implements the `domain.probes.Runner` seam by exec'ing checks inside the running topology's
+containers via `docker compose exec` (the same compose project the orchestrator launched). This
+runs only where Docker + a live stack exist (the student's Mac), so it is written defensively:
+`available()` returns False whenever the stack isn't up, which keeps behavioral objectives
+`pending` rather than wrongly failed. Unit-tested logic lives with `domain.probes` (FakeRunner);
+this adapter is exercised in real Docker on the Mac.
+
+Service-name resolution: the compiler names each compose service after the device name
+(lowercased), so a probe's `src`/`dst` map to services; cloud-plane services reach each other by
+name over the shared network. Networking-plane addressing (by IP) is a Phase-2.x refinement.
+"""
+from __future__ import annotations
+
+import subprocess
+
+
+class DockerProbeRunner:
+    def __init__(self, orchestrator, *, timeout: float = 8.0) -> None:
+        self.orch = orchestrator            # services.orchestrator.Orchestrator (has _dc, status)
+        self.timeout = timeout
+        self._svc_cache: dict | None = None
+
+    # -- availability ------------------------------------------------------- #
+    def available(self) -> bool:
+        try:
+            states = self.orch.status()
+        except Exception:
+            return False
+        return any(str(s).startswith("running") for s in (states or {}).values())
+
+    def _service(self, name: str) -> str:
+        """Map a device name to its compose service. The orchestrator's status() keys ARE the
+        service names; match case-insensitively, else fall back to the lowercased name."""
+        if self._svc_cache is None:
+            try:
+                self._svc_cache = {k.lower(): k for k in (self.orch.status() or {})}
+            except Exception:
+                self._svc_cache = {}
+        return self._svc_cache.get(name.lower(), name.lower())
+
+    def _exec(self, service: str, argv: list[str]) -> tuple[int, str]:
+        cmd = [*self.orch._dc, "exec", "-T", service, *argv]
+        # `docker compose` (no -f) finds the project via the CWD — every orchestrator call runs in
+        # the workdir, so the probe MUST too, or `exec` can't find the running stack (a false
+        # negative: probes fail even though the containers are up and reachable).
+        wd = getattr(self.orch, "workdir", None)
+        try:
+            r = subprocess.run(cmd, cwd=str(wd) if wd else None,
+                               capture_output=True, text=True, timeout=self.timeout)
+            return r.returncode, (r.stdout or "") + (r.stderr or "")
+        except (FileNotFoundError, subprocess.TimeoutExpired, OSError):
+            return 124, ""
+
+    # -- probes ------------------------------------------------------------- #
+    def reach(self, src: str, dst: str, port: int | None = None) -> bool:
+        s, d = self._service(src), self._service(dst)
+        if port is None:            # L3 reachability via ICMP
+            code, _ = self._exec(s, ["ping", "-c", "1", "-W", "1", d])
+            return code == 0
+        # L4 reachability: a TCP connect using bash's /dev/tcp (no extra tools needed)
+        code, _ = self._exec(s, ["bash", "-lc", f"exec 3<>/dev/tcp/{d}/{port}"])
+        return code == 0
+
+    def http(self, src: str, dst: str, port: int) -> bool:
+        s, d = self._service(src), self._service(dst)
+        code, _ = self._exec(s, ["curl", "-fsS", "-m", "4", "-o", "/dev/null",
+                                 f"http://{d}:{port}/"])
+        return code == 0
+
+    def backends(self, lb: str) -> int:
+        """How many backends the load balancer is REALLY serving from — i.e. upstreams it was
+        configured with that are actually accepting connections right now. A config listing two
+        servers proves nothing; this proves the fan-out has somewhere to go.
+
+        The LB compiles to nginx, so read its upstream block, then probe each target from inside the
+        LB container itself (that's the path traffic would take)."""
+        import re
+        svc = self._service(lb)
+        code, out = self._exec(svc, ["sh", "-c",
+                                     "cat /etc/nginx/conf.d/*.conf /etc/nginx/nginx.conf 2>/dev/null"])
+        if code != 0 or not out:
+            return 0
+        targets = re.findall(r"^\s*server\s+([A-Za-z0-9._-]+):(\d+)\s*;", out, re.M)
+        live = 0
+        for host, port in targets:
+            # try a few tools — the image is alpine-ish and may have any of them
+            probe = (f"nc -z -w2 {host} {port} 2>/dev/null || "
+                     f"wget -q -T2 -O /dev/null http://{host}:{port}/ 2>/dev/null || "
+                     f"curl -fsS -m2 -o /dev/null http://{host}:{port}/ 2>/dev/null")
+            c, _ = self._exec(svc, ["sh", "-c", probe])
+            if c == 0:
+                live += 1
+        return live
+
+    def flow(self, ovs: str, match: str = "") -> bool:
+        """Did the controller ACTUALLY install flows on this switch? Reads the live OpenFlow table
+        from the gRouter (the OVS runs in --openflow mode) over its control socket — the exact same
+        path the Router Lab's flow view uses — and reuses the shipped parser.
+
+        `match` empty (or 'any') = "any flow at all is installed", which is the honest test that the
+        control plane did something. A non-empty match is a substring test against the entries."""
+        from ..domain.flowtable import flows
+        svc = self._service(ovs)
+        code, out = self._exec(svc, ["python3", "/build/grouter-build/grconsole.py",
+                                     f"/run/{svc}.ctl", "--once", "openflow entry all"])
+        if code != 0 or not out:
+            return False
+        try:
+            rows = flows(out)
+        except Exception:                            # noqa: BLE001 — a malformed dump is just "no proof"
+            return False
+        if not rows:
+            return False
+        if not match or match.lower() in ("any", "*"):
+            return True
+        needle = match.lower()
+        return any(needle in str(r).lower() for r in rows)
+
+
+class RuntimeRunner(DockerProbeRunner):
+    """DockerProbeRunner + `measure()` — the runtime half of an output check. It resolves
+    `measure(rider_type, metric)` by reading the LIVE measurement of the matching attached Source/Sink
+    from `get_results` (the streaming rider snapshots the grader has already started + let run). We
+    read the streaming session's reading rather than doing a one-shot capture, because `docker exec`
+    block-buffers output — a timeout-killed one-shot comes back empty even when the manual streaming
+    view sees packets. `get_results()` → {rider_id: snapshot}; `get_topology()` finds the rider."""
+
+    def __init__(self, orchestrator, get_topology, get_results, *, timeout: float = 8.0) -> None:
+        super().__init__(orchestrator, timeout=timeout)
+        self._get_topology = get_topology
+        self._get_results = get_results
+
+    def measure(self, rider_type: str, metric: str):
+        from ..domain.objectives import slot_match
+        base, _, slot = str(rider_type).partition("@")       # measure(packet_view@A, packets)
+        topo = self._get_topology()
+        results = self._get_results() or {}
+        for d in getattr(topo, "devices", {}).values():
+            if getattr(d, "type_key", None) != base:
+                continue
+            if not slot_match(getattr(d, "slot", ""), slot):
+                continue
+            snap = results.get(d.id)
+            m = (snap or {}).get("measurement") or {}
+            if metric in m:
+                return m.get(metric)
+        return None

gini/services/project.py

@@ -0,0 +1,217 @@
+"""Project = a folder holding a FAMILY of related experiments.
+
+A project is the unit of *context*: several experiments that belong together (build a LAN, route
+between two LANs, convert it to SDN) share one teacher's **brief** and one **Ask GINI conversation**,
+so the tutor remembers the whole arc instead of forgetting everything each time you move on. An
+*experiment* is one topology inside that project. Layout:
+
+    MyProject/
+      project.json          {name, brief, created, modified, current}
+      ai.json               {messages, history}   ← the shared Ask GINI transcript
+      experiments/
+        Basic LAN.gini      a topology (native .gini JSON — see persistence.py)
+        Routed LAN.gini
+        SDN.gini
+
+Two older shapes still open, and are migrated in place on first load:
+  * the single-experiment project folder (`topology.gini` at the root) — moved into
+    `experiments/` under the project's own name;
+  * a bare single-file `.gini` — still loads as a topology via persistence.py.
+
+Keeping experiments as separate files means each topology stays clean and shareable on its own,
+while the brief and the AI conversation live once, at the project level.
+"""
+from __future__ import annotations
+
+import json
+import re
+import time
+from pathlib import Path
+
+from ..domain.topology import Topology
+from .persistence import load_project as _load_topology
+from .persistence import save_project as _save_topology
+
+TOPOLOGY_FILE = "topology.gini"          # legacy single-experiment layout
+META_FILE = "project.json"
+AI_FILE = "ai.json"
+EXPERIMENTS_DIR = "experiments"
+EXT = ".gini"
+META_FORMAT = "gini-project-dir"
+META_VERSION = 2                         # v1 = one topology.gini at the root
+# A project's first experiment gets a neutral, numbered name — NEVER the project's own. Naming it
+# after the project made the experiment list read as though the project were an item inside itself.
+# The -01 suffix matches the Project-01 house style and invites Experiment-02, -03 alongside it.
+FIRST_EXPERIMENT = "Experiment-01"
+
+
+def _read_json(path: Path) -> dict:
+    try:
+        data = json.loads(Path(path).read_text())
+        return data if isinstance(data, dict) else {}
+    except Exception:                       # missing or malformed -> empty
+        return {}
+
+
+def safe_name(name: str) -> str:
+    """An experiment name that is safe as a filename but still human-readable on disk."""
+    s = re.sub(r'[/\\:*?"<>|]+', "-", (name or "").strip()).strip(". ")
+    return s or "Untitled"
+
+
+def is_project_dir(path) -> bool:
+    """True for a v2 project (experiments/) or a v1 one (topology.gini at the root)."""
+    p = Path(path)
+    if not p.is_dir():
+        return False
+    return (p / TOPOLOGY_FILE).exists() or (p / EXPERIMENTS_DIR).is_dir()
+
+
+def experiments_dir(path) -> Path:
+    return Path(path) / EXPERIMENTS_DIR
+
+
+# -- experiments ------------------------------------------------------------- #
+def list_experiments(path) -> list[dict]:
+    """Every experiment in the project, most-recently-modified first."""
+    d = experiments_dir(path)
+    out: list[dict] = []
+    if d.is_dir():
+        for f in d.glob(f"*{EXT}"):
+            out.append({"name": f.stem, "path": str(f), "modified": f.stat().st_mtime})
+    out.sort(key=lambda x: x["modified"], reverse=True)
+    return out
+
+
+def experiment_path(path, name: str) -> Path:
+    return experiments_dir(path) / f"{safe_name(name)}{EXT}"
+
+
+def save_experiment(path, topology: Topology, name: str) -> str:
+    """Write one experiment's topology into the project. Returns the file path."""
+    d = experiments_dir(path)
+    d.mkdir(parents=True, exist_ok=True)
+    fp = experiment_path(path, name)
+    _save_topology(topology, fp)
+    return str(fp)
+
+
+def load_experiment(path, name: str) -> Topology:
+    return _load_topology(experiment_path(path, name))
+
+
+def delete_experiment(path, name: str) -> bool:
+    fp = experiment_path(path, name)
+    if not fp.exists():
+        return False
+    fp.unlink()
+    meta = _read_json(Path(path) / META_FILE)
+    if meta.get("current") == safe_name(name):       # don't point at a file that's gone
+        meta["current"] = ""
+        (Path(path) / META_FILE).write_text(json.dumps(meta, indent=2))
+    return True
+
+
+def rename_experiment(path, old: str, new: str) -> bool:
+    src, dst = experiment_path(path, old), experiment_path(path, new)
+    if not src.exists() or dst.exists():
+        return False
+    src.rename(dst)
+    meta = _read_json(Path(path) / META_FILE)
+    if meta.get("current") == safe_name(old):
+        meta["current"] = safe_name(new)
+        (Path(path) / META_FILE).write_text(json.dumps(meta, indent=2))
+    return True
+
+
+# -- migration --------------------------------------------------------------- #
+def migrate_project(path) -> bool:
+    """v1 → v2 in place: move a root `topology.gini` into `experiments/<project name>.gini`.
+    Returns True if anything moved. Safe to call on an already-migrated project."""
+    p = Path(path)
+    legacy = p / TOPOLOGY_FILE
+    if not legacy.exists():
+        return False
+    meta = _read_json(p / META_FILE)
+    name = FIRST_EXPERIMENT
+    d = experiments_dir(p)
+    d.mkdir(parents=True, exist_ok=True)
+    target = d / f"{name}{EXT}"
+    if not target.exists():
+        legacy.rename(target)
+    else:
+        legacy.unlink()                              # already migrated; drop the stale copy
+    meta.update({"format": META_FORMAT, "version": META_VERSION, "current": name,
+                 "name": meta.get("name") or p.name})
+    (p / META_FILE).write_text(json.dumps(meta, indent=2))
+    return True
+
+
+# -- project ----------------------------------------------------------------- #
+def save_project_dir(path, topology: Topology, *, name: str | None = None, brief: str = "",
+                     ai_state: dict | None = None, experiment: str | None = None) -> str:
+    """Write the project: the CURRENT experiment's topology plus the project-level brief and AI
+    conversation. `experiment` names the topology being saved (defaults to the project name, which
+    is what a freshly-created project uses). Returns the folder path."""
+    p = Path(path)
+    p.mkdir(parents=True, exist_ok=True)
+    prev = _read_json(p / META_FILE)
+    pname = name or topology.name or p.name
+    exp = safe_name(experiment or prev.get("current") or FIRST_EXPERIMENT)
+    save_experiment(p, topology, exp)
+    now = time.time()
+    meta = {
+        "format": META_FORMAT, "version": META_VERSION,
+        "name": pname,
+        "brief": brief or "",
+        "current": exp,
+        "created": prev.get("created", now),
+        "modified": now,
+    }
+    (p / META_FILE).write_text(json.dumps(meta, indent=2))
+    (p / AI_FILE).write_text(json.dumps(ai_state or {}, indent=2))
+    return str(p)
+
+
+def load_project_dir(path) -> dict:
+    """Return {topology, name, brief, ai_state, path, experiment, experiments} for a project.
+
+    `topology` is the *current* experiment. A v1 project is migrated first, so old projects open
+    unchanged from the user's point of view."""
+    p = Path(path)
+    migrate_project(p)
+    meta = _read_json(p / META_FILE)
+    pname = meta.get("name") or p.name
+    exps = list_experiments(p)
+    cur = meta.get("current") or ""
+    known = {e["name"] for e in exps}
+    if cur not in known:                             # missing/renamed -> newest, else a fresh one
+        cur = exps[0]["name"] if exps else FIRST_EXPERIMENT
+    try:
+        topo = load_experiment(p, cur)
+    except Exception:                                # noqa: BLE001 — an empty/new project
+        topo = Topology(cur)
+    return {
+        "topology": topo,
+        "name": pname,
+        "brief": meta.get("brief", ""),
+        "ai_state": _read_json(p / AI_FILE),
+        "path": str(p),
+        "experiment": cur,
+        "experiments": [e["name"] for e in exps] or [cur],
+    }
+
+
+def list_projects(projects_root) -> list[dict]:
+    """All project folders under `projects_root`, most-recently-modified first."""
+    root = Path(projects_root)
+    out: list[dict] = []
+    if root.is_dir():
+        for d in root.iterdir():
+            if is_project_dir(d):
+                meta = _read_json(d / META_FILE)
+                out.append({"name": meta.get("name", d.name), "path": str(d),
+                            "modified": meta.get("modified", 0),
+                            "experiments": len(list_experiments(d))})
+    out.sort(key=lambda x: x["modified"], reverse=True)
+    return out

gini/services/remote.py

@@ -0,0 +1,93 @@
+"""gBuilder's client for a remote GINI server (the Phase-3 transport).
+
+The GUI builds a topology and, in remote mode, hands it to this client, which sends it to
+the brokered GINI server over an authenticated HTTP API. The server compiles + policy-checks
++ runs it on the Kata host; metrics/startup come back the same way. Same shape as the local
+orchestrator path, so the canvas/compiler don't care which backend is active.
+
+`transport` is injectable — production uses the urllib HTTP transport below; tests pass a
+shim that calls `GiniServer.handle` directly, exercising the whole protocol without sockets.
+"""
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.request
+
+
+class RemoteClient:
+    def __init__(self, base_url: str = "", transport=None, token: str | None = None) -> None:
+        self.base_url = (base_url or "").rstrip("/")
+        self.token = token
+        self._transport = transport or self._http
+
+    # -- transport ---------------------------------------------------------- #
+    def _http(self, method: str, path: str, token: str | None, body: dict) -> tuple[int, dict]:
+        data = json.dumps(body or {}).encode() if method == "POST" else None
+        req = urllib.request.Request(self.base_url + path, data=data, method=method)
+        req.add_header("Content-Type", "application/json")
+        if token:
+            req.add_header("Authorization", "Bearer " + token)
+        try:
+            r = urllib.request.urlopen(req, timeout=30)
+            return r.getcode(), json.loads(r.read().decode() or "{}")
+        except urllib.error.HTTPError as e:
+            try:
+                return e.code, json.loads(e.read().decode() or "{}")
+            except Exception:                       # noqa: BLE001
+                return e.code, {"error": f"HTTP {e.code}"}
+        except Exception as e:                       # noqa: BLE001 — connection refused, DNS, …
+            return 0, {"error": str(e)}
+
+    def _call(self, method: str, path: str, body: dict | None = None) -> tuple[int, dict]:
+        return self._transport(method, path, self.token, body or {})
+
+    # -- API ---------------------------------------------------------------- #
+    def login(self, username: str, password: str) -> tuple[bool, str]:
+        st, body = self._transport("POST", "/login", None,
+                                   {"username": username, "password": password})
+        if st == 200 and body.get("token"):
+            self.token = body["token"]
+            return True, ""
+        return False, body.get("error", "login failed")
+
+    def run(self, topology) -> tuple[bool, str]:
+        """Start the lab on the server (returns once accepted — the launch runs async there,
+        because image pulls/builds can take minutes). Poll `wait_until_running` for the result."""
+        st, body = self._call("POST", "/run", {"topology": topology.to_dict()})
+        if st in (200, 202) and body.get("ok"):
+            return True, body.get("state", "starting")
+        return False, body.get("error", "run failed")
+
+    def run_state(self) -> dict:
+        """{'state': starting|running|error|stopped, 'message': ...}."""
+        return self._call("GET", "/status")[1].get("run", {})
+
+    def wait_until_running(self, timeout: float = 240, interval: float = 2.0) -> tuple[bool, str]:
+        """Poll until the server's launch finishes (or fails / times out)."""
+        import time
+        deadline = time.time() + timeout
+        while time.time() < deadline:
+            rs = self.run_state()
+            if rs.get("state") == "running":
+                return True, rs.get("message", "")
+            if rs.get("state") == "error":
+                return False, rs.get("message", "run failed")
+            time.sleep(interval)
+        return False, "timed out waiting for the lab to come up"
+
+    def stop(self) -> tuple[bool, str]:
+        st, body = self._call("POST", "/stop")
+        return st == 200, body.get("message") or body.get("error", "")
+
+    def status(self) -> dict:
+        return self._call("GET", "/status")[1].get("status", {})
+
+    def metrics(self) -> dict:
+        return self._call("GET", "/metrics")[1]      # {"stats": {...}, "startup": {...}}
+
+    def capabilities(self) -> dict:
+        return self._call("GET", "/capabilities")[1]  # {"kata": bool}
+
+    def kata_available(self) -> bool:
+        return bool(self.capabilities().get("kata"))

gini/services/rider_runner.py

@@ -0,0 +1,96 @@
+"""Docker-backed rider execution (Mac-side).
+
+Runs a Source/Sink INSIDE its donor container via `docker compose exec` — the same seam
+`probe_runner` uses — then reduces the raw output to a measurement with `domain.riders`. A rider has
+no container of its own, so there is nothing to launch: we exec its tool in the donor the student
+attached it to. Written defensively: `available()` is False when no stack is up, and a missing donor
+or a broken command returns an error dict rather than raising, so the UI can show it inline.
+"""
+from __future__ import annotations
+
+import subprocess
+
+from ..domain import riders as _riders
+
+
+class RiderRunner:
+    def __init__(self, orchestrator, *, timeout: float = 15.0) -> None:
+        self.orch = orchestrator            # services.orchestrator.Orchestrator (has _dc, status, workdir)
+        self.timeout = timeout
+        self._svc_cache: dict | None = None
+
+    def available(self) -> bool:
+        try:
+            states = self.orch.status()
+        except Exception:
+            return False
+        return any(str(s).startswith("running") for s in (states or {}).values())
+
+    def _service(self, name: str) -> str:
+        if self._svc_cache is None:
+            try:
+                self._svc_cache = {k.lower(): k for k in (self.orch.status() or {})}
+            except Exception:
+                self._svc_cache = {}
+        return self._svc_cache.get(name.lower(), name.lower())
+
+    def _exec(self, service: str, argv: list[str]) -> tuple[int, str]:
+        cmd = [*self.orch._dc, "exec", "-T", service, *argv]
+        wd = getattr(self.orch, "workdir", None)
+        try:
+            r = subprocess.run(cmd, cwd=str(wd) if wd else None,
+                               capture_output=True, text=True, timeout=self.timeout)
+            return r.returncode, (r.stdout or "") + (r.stderr or "")
+        except subprocess.TimeoutExpired as e:            # keep partial output, flag the timeout
+            partial = e.stdout if isinstance(e.stdout, str) else ""
+            return (0 if partial else 124), partial
+        except (FileNotFoundError, OSError):
+            return 124, ""
+
+    # pingable/curlable donor neighbours we can auto-target (reachable by service name)
+    _TARGETABLE = {"host", "router", "instance", "container", "kinstance", "web_app", "firewall"}
+
+    def _infer_target(self, topo, donor_id: str, rider_id: str) -> str:
+        """When a ping/http rider has no Target, pick a reachable name: a directly-wired neighbour of
+        the donor first (excluding riders), else any other targetable node on the board."""
+        donor = topo.devices.get(donor_id)
+        for nb in topo.neighbors(donor_id):            # prefer a direct network neighbour
+            if nb.id != rider_id and nb.type_key in self._TARGETABLE:
+                return nb.name
+        for d in topo.devices.values():                # else anything else pingable by name
+            if d.id not in (donor_id, rider_id) and d.type_key in self._TARGETABLE:
+                return d.name
+        return ""
+
+    def run(self, topo, rider_id: str) -> dict:
+        """Execute the rider on its donor and return
+        {ok, raw, measurement, summary, donor} — or {ok: False, error} on any problem."""
+        rider = topo.devices.get(rider_id)
+        if rider is None:
+            return {"ok": False, "error": "no such rider"}
+        donor = topo.donor_of(rider_id)
+        if donor is None:
+            return {"ok": False, "error": f"{rider.name} isn't attached to a donor yet."}
+
+        props = dict(rider.properties)
+        inferred = ""
+        if rider.type_key in ("ping_probe", "http_probe") and not (props.get("Target") or "").strip():
+            inferred = self._infer_target(topo, donor.id, rider_id)
+            if inferred:
+                props["Target"] = inferred
+        try:
+            argv = _riders.build_command(rider.type_key, props)
+        except _riders.RiderError as e:
+            return {"ok": False, "error": str(e)}
+        service = self._service(donor.name)
+        code, raw = self._exec(service, argv)
+        if not (raw or "").strip():
+            # never show a blank "no output" — say what ran and how it exited, so the cause is
+            # visible (missing tool, unresolved target, timeout, wrong donor service, …)
+            hint = "timed out" if code == 124 else f"exit {code}"
+            raw = (f"(no output — {hint})\n"
+                   f"$ docker compose exec {service} {' '.join(argv)}")
+        m = _riders.parse_measurement(rider.type_key, raw)
+        return {"ok": True, "code": code, "raw": raw, "measurement": m,
+                "summary": _riders.summarize(rider.type_key, m), "donor": donor.name,
+                "target": props.get("Target", ""), "inferred_target": inferred}