graphite-code 0.3.0__py3-none-any.whl

graphite/routing/settings.py

@@ -0,0 +1,99 @@
+"""Conservative environment-backed settings for development routing."""
+from __future__ import annotations
+
+import math
+import os
+from dataclasses import asdict, dataclass
+from typing import Mapping
+
+
+class RoutingSettingsError(ValueError):
+    """A stable routing settings validation failure."""
+
+
+def _integer(env: Mapping[str, str], name: str, default: int, minimum: int, maximum: int) -> int:
+    raw = env.get(f"GRAPHITE_ROUTE_{name.upper()}")
+    if raw is None:
+        return default
+    try:
+        value = int(raw, 10)
+    except (TypeError, ValueError) as exc:
+        raise RoutingSettingsError(f"{name}_invalid") from exc
+    if value < minimum or value > maximum:
+        raise RoutingSettingsError(f"{name}_invalid")
+    return value
+
+
+def _float(env: Mapping[str, str], name: str, default: float, minimum: float, maximum: float) -> float:
+    raw = env.get(f"GRAPHITE_ROUTE_{name.upper()}")
+    if raw is None:
+        return default
+    try:
+        value = float(raw)
+    except (TypeError, ValueError) as exc:
+        raise RoutingSettingsError(f"{name}_invalid") from exc
+    if not math.isfinite(value) or value < minimum or value > maximum:
+        raise RoutingSettingsError(f"{name}_invalid")
+    return value
+
+
+def _boolean(env: Mapping[str, str], name: str, default: bool) -> bool:
+    raw = env.get(f"GRAPHITE_ROUTE_{name.upper()}")
+    if raw is None:
+        return default
+    normalized = raw.strip().casefold()
+    if normalized in {"1", "true", "yes", "on"}:
+        return True
+    if normalized in {"0", "false", "no", "off"}:
+        return False
+    raise RoutingSettingsError(f"{name}_invalid")
+
+
+@dataclass(frozen=True)
+class RoutingSettings:
+    max_context_bytes: int = 262_144
+    max_context_files: int = 32
+    max_input_tokens: int = 32_768
+    max_output_tokens: int = 4_096
+    request_timeout_seconds: float = 180.0
+    max_concurrency: int = 1
+    repository_quota_tokens: int = 2_000_000
+    machine_quota_tokens: int = 10_000_000
+    shadow_rate_percent: int = 0
+    shadow_quota_tokens: int = 200_000
+    approval_ttl_seconds: int = 300
+    retention_days: int = 90
+    aggregate_opt_in: bool = False
+    max_changed_files: int = 64
+    max_changed_bytes: int = 1_048_576
+
+    @classmethod
+    def from_env(cls, overrides: Mapping[str, str] | None = None) -> "RoutingSettings":
+        env = dict(os.environ)
+        if overrides:
+            env.update(overrides)
+        settings = cls(
+            max_context_bytes=_integer(env, "max_context_bytes", 262_144, 16_384, 4_194_304),
+            max_context_files=_integer(env, "max_context_files", 32, 1, 128),
+            max_input_tokens=_integer(env, "max_input_tokens", 32_768, 256, 262_144),
+            max_output_tokens=_integer(env, "max_output_tokens", 4_096, 1, 32_768),
+            request_timeout_seconds=_float(env, "request_timeout_seconds", 180.0, 5.0, 600.0),
+            max_concurrency=_integer(env, "max_concurrency", 1, 1, 1),
+            repository_quota_tokens=_integer(env, "repository_quota_tokens", 2_000_000, 10_000, 100_000_000),
+            machine_quota_tokens=_integer(env, "machine_quota_tokens", 10_000_000, 10_000, 1_000_000_000),
+            shadow_rate_percent=_integer(env, "shadow_rate_percent", 0, 0, 10),
+            shadow_quota_tokens=_integer(env, "shadow_quota_tokens", 200_000, 0, 10_000_000),
+            approval_ttl_seconds=_integer(env, "approval_ttl_seconds", 300, 30, 3_600),
+            retention_days=_integer(env, "retention_days", 90, 1, 3_650),
+            aggregate_opt_in=_boolean(env, "aggregate_opt_in", False),
+            max_changed_files=_integer(env, "max_changed_files", 64, 1, 10_000),
+            max_changed_bytes=_integer(
+                env, "max_changed_bytes", 1_048_576, 1_024, 104_857_600
+            ),
+        )
+        if settings.machine_quota_tokens < settings.repository_quota_tokens:
+            raise RoutingSettingsError("machine_quota_tokens_invalid")
+        return settings
+
+    def to_dict(self) -> dict[str, int | float | bool]:
+        return asdict(self)

graphite/routing/shadow.py

@@ -0,0 +1,201 @@
+"""Deterministic, separately authorized cross-provider review policy."""
+from __future__ import annotations
+
+import secrets
+from dataclasses import dataclass, replace
+
+from .contracts import (
+    CapabilitySnapshot,
+    CliApprovalManifest,
+    PermissionMode,
+    ProviderId,
+    RiskTier,
+)
+from .storage import RepositoryStore
+
+
+@dataclass(frozen=True, slots=True)
+class ReviewCandidate:
+    snapshot: CapabilitySnapshot
+    reserved_tokens: int
+    independently_eligible: bool
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.snapshot, CapabilitySnapshot):
+            raise ValueError("review_snapshot_invalid")
+        if self.snapshot.profile.permission_mode is not PermissionMode.READ_ONLY:
+            raise ValueError("review_permission_invalid")
+        if (
+            isinstance(self.reserved_tokens, bool)
+            or not isinstance(self.reserved_tokens, int)
+            or not 2 <= self.reserved_tokens <= 294_912
+        ):
+            raise ValueError("reserved_tokens_invalid")
+        if not isinstance(self.independently_eligible, bool):
+            raise ValueError("eligibility_invalid")
+
+
+@dataclass(frozen=True, slots=True)
+class ReviewPlan:
+    candidate: ReviewCandidate
+    primary_diff_hash: str
+    authority: str = "separate_single_use_approval_required"
+
+
+@dataclass(frozen=True, slots=True)
+class BlindedComparison:
+    comparison_id: str
+    label_a_hash: str
+    label_b_hash: str
+
+    def to_dict(self) -> dict[str, str]:
+        return {
+            "comparison_id": self.comparison_id,
+            "label_a_hash": self.label_a_hash,
+            "label_b_hash": self.label_b_hash,
+        }
+
+
+def plan_cross_provider_review(
+    *,
+    primary_provider: ProviderId,
+    primary_diff_hash: str,
+    candidates: tuple[ReviewCandidate, ...],
+    risk: RiskTier,
+) -> ReviewPlan | None:
+    """Select one other-provider reviewer only for high-risk primary work."""
+    provider = ProviderId(primary_provider)
+    if RiskTier(risk) is not RiskTier.HIGH:
+        return None
+    if (
+        not isinstance(primary_diff_hash, str)
+        or len(primary_diff_hash) != 64
+        or any(character not in "0123456789abcdef" for character in primary_diff_hash)
+    ):
+        raise ValueError("primary_diff_hash_invalid")
+    eligible = sorted(
+        (
+            candidate
+            for candidate in candidates
+            if candidate.independently_eligible
+            and candidate.snapshot.profile.provider is not provider
+        ),
+        key=lambda item: (
+            item.reserved_tokens,
+            item.snapshot.profile.provider.value,
+            item.snapshot.profile.requested_model,
+            item.snapshot.profile.supported_efforts[0].value,
+            item.snapshot.digest,
+        ),
+    )
+    return None if not eligible else ReviewPlan(eligible[0], primary_diff_hash)
+
+
+def make_review_manifest(
+    primary: CliApprovalManifest,
+    plan: ReviewPlan,
+    *,
+    approval_id: str,
+    decision_id: str,
+    worktree_id: str,
+    issued_at: int,
+    expires_at: int,
+    nonce: str,
+) -> CliApprovalManifest:
+    """Derive a separately signable read-only manifest without primary authority reuse."""
+    snapshot = plan.candidate.snapshot
+    if (
+        approval_id == primary.approval_id
+        or decision_id == primary.decision_id
+        or worktree_id == primary.worktree_id
+        or nonce == primary.nonce
+        or snapshot.profile.provider is primary.provider
+    ):
+        raise ValueError("review_approval_not_independent")
+    output = min(primary.max_output_tokens, plan.candidate.reserved_tokens - 1)
+    input_tokens = plan.candidate.reserved_tokens - output
+    return replace(
+        primary,
+        approval_id=approval_id,
+        decision_id=decision_id,
+        provider=snapshot.profile.provider,
+        requested_model=snapshot.profile.requested_model,
+        effective_model=snapshot.profile.effective_model,
+        effort=snapshot.profile.supported_efforts[0],
+        cli_executable_sha256=snapshot.identity.executable_sha256,
+        cli_version=snapshot.identity.cli_version,
+        adapter_protocol_version=snapshot.identity.adapter_protocol_version,
+        capability_snapshot_digest=snapshot.digest,
+        context_manifest_hash=plan.primary_diff_hash,
+        worktree_id=worktree_id,
+        permission_mode=PermissionMode.READ_ONLY,
+        max_input_tokens=input_tokens,
+        max_output_tokens=output,
+        policy_version="review-1",
+        issued_at=issued_at,
+        expires_at=expires_at,
+        nonce=nonce,
+    )
+
+
+def create_blinded_comparison(
+    store: RepositoryStore,
+    *,
+    comparison_id: str,
+    primary_execution_id: str,
+    shadow_execution_id: str,
+    primary_hash: str,
+    shadow_hash: str,
+    created_at: int,
+    swap: bool | None = None,
+) -> BlindedComparison:
+    label_a_is_shadow = bool(secrets.randbelow(2)) if swap is None else bool(swap)
+    label_a_hash, label_b_hash = (
+        (shadow_hash, primary_hash)
+        if label_a_is_shadow
+        else (primary_hash, shadow_hash)
+    )
+    store.create_blind_comparison(
+        comparison_id=comparison_id,
+        primary_execution_id=primary_execution_id,
+        shadow_execution_id=shadow_execution_id,
+        label_a_hash=label_a_hash,
+        label_b_hash=label_b_hash,
+        label_a_is_shadow=label_a_is_shadow,
+        created_at=created_at,
+    )
+    return BlindedComparison(comparison_id, label_a_hash, label_b_hash)
+
+
+def record_pairwise_verdict(
+    store: RepositoryStore, comparison_id: str, verdict: str, *, recorded_at: int
+) -> None:
+    if not store.record_blind_verdict(comparison_id, verdict, recorded_at):
+        raise ValueError("pairwise_verdict_invalid")
+
+
+def reveal_comparison(store: RepositoryStore, comparison_id: str) -> dict[str, object]:
+    row = store.blind_comparison(comparison_id)
+    if row is None:
+        raise ValueError("pairwise_comparison_missing")
+    verdict = row["verdict"]
+    if verdict is None:
+        raise ValueError("pairwise_verdict_missing")
+    winner: str | None = None
+    if verdict in {"a", "b"}:
+        a_is_shadow = bool(row["label_a_is_shadow"])
+        winner_is_shadow = a_is_shadow if verdict == "a" else not a_is_shadow
+        winner = str(
+            row["shadow_execution_id"]
+            if winner_is_shadow
+            else row["primary_execution_id"]
+        )
+    return {
+        "comparison_id": comparison_id,
+        "verdict": verdict,
+        "winner_execution_id": winner,
+        "primary_execution_id": row["primary_execution_id"],
+        "shadow_execution_id": row["shadow_execution_id"],
+        "provenance": "pairwise",
+        "autonomy_admissible": False,
+    }