lisa-harness-kernel 0.1.0__tar.gz

lisa_harness_kernel-0.1.0/.gitignore

@@ -0,0 +1,33 @@
+# Python
+__pycache__/
+*.pyc
+*.pyo
+*.egg-info/
+dist/
+build/
+
+
+# Virtual environments
+.venv/
+
+# IDE
+.vscode/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Testing
+.import_linter_cache/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.lisa-tmp/
+coverage/
+.coverage
+.coverage.*
+htmlcov/
+
+# Outputs
+artifacts/
+.e2e/

lisa_harness_kernel-0.1.0/.instructions.md

@@ -0,0 +1,12 @@
+---
+name: Kernel Package
+applyTo: "kernel/**/*.py"
+description: Package-specific guidance for kernel work.
+---
+
+# Kernel package guidance
+
+- Keep the kernel runtime-neutral. Do not introduce host- or SDK-specific imports into kernel modules.
+- Preserve the existing contract-style abstractions in kernel modules rather than falling back to ad hoc state bags.
+- Follow the slice and turn-runner patterns already established in the package when changing orchestration behavior.
+- Keep handoff, approval, and routing logic explicit and testable.

lisa_harness_kernel-0.1.0/PKG-INFO

@@ -0,0 +1,22 @@
+Metadata-Version: 2.5
+Name: lisa-harness-kernel
+Version: 0.1.0
+Summary: Lisa kernel — runtime-neutral FSM engine, contracts, operation registry, and telemetry primitives
+Requires-Python: >=3.11
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: mcp>=2.0.0
+Requires-Dist: opentelemetry-api<2.0.0,>=1.40.0
+Requires-Dist: opentelemetry-sdk<2.0.0,>=1.40.0
+Requires-Dist: pydantic-settings>=2.3.0
+Requires-Dist: pydantic>=2.7.0
+Requires-Dist: python-dotenv>=1.0.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: tzdata>=2024.1; platform_system == 'Windows'
+Provides-Extra: dev
+Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
+Requires-Dist: pytest-cov>=6.0.0; extra == 'dev'
+Requires-Dist: pytest-mock>=3.14.0; extra == 'dev'
+Requires-Dist: pytest>=8.0.0; extra == 'dev'
+Requires-Dist: types-pyyaml>=6.0; extra == 'dev'
+Provides-Extra: memory
+Requires-Dist: sqlite-vec>=0.1.9; extra == 'memory'

lisa_harness_kernel-0.1.0/README.md

@@ -0,0 +1,137 @@
+# Kernel
+
+`lisa-harness-kernel` owns runtime-neutral typed contracts and the model/tool
+turn loop. It does not depend on another in-repository package. Hosts inject
+wiring through `TurnHooks` and `ContextSeams`; packs provide concrete
+capabilities.
+
+Start with [architecture and terminology](../docs/BOUNDARIES.md).
+Most application authors should use the [shared runtime](../runtime/README.md)
+rather than build a new composition root directly against kernel internals.
+
+## Module map
+
+Paths below are relative to [src/kernel](src/kernel/).
+
+| Module | Responsibility |
+| --- | --- |
+| [turn_runner](src/kernel/turn_runner/) | Shared completion/dispatch loop, transitions, continuations, outcomes |
+| [turn_phases](src/kernel/turn_phases/) | Lifecycle, prompts/schemas, routing hints, fork/delegate and completion contracts |
+| [turn_hooks](src/kernel/turn_hooks.py) | Host-injected callbacks and context seams |
+| [models](src/kernel/models.py) | Execution contexts/results, modes/stages, receipts, state/evidence, budgets |
+| [ipsar](src/kernel/ipsar.py) / [ipsar_fsm](src/kernel/ipsar_fsm.py) | Mode command parsing, catalogs, workflow/routing transitions |
+| [session_plan](src/kernel/session_plan.py) | Strict v2 schema and deterministic compilation |
+| [context](src/kernel/context/) | Evidence mapping, lanes, provenance, request fitting, public seam defaults |
+| [operations](src/kernel/operations/) | Runtime/declarative operation discovery and execution |
+| [tools](src/kernel/tools/) | Pack-tool registry, MCP pool, schema translation and synthetic aliases |
+| [seams](src/kernel/seams/) | Host-facing protocols and adapters |
+| [model_manifest](src/kernel/model_manifest.py) | Model roster validation and resolution |
+| [provider_contracts](src/kernel/provider_contracts.py) | Completion/embedding contracts and provider-neutral usage |
+| [execution_policy](src/kernel/execution_policy.py) / [execution_ledger](src/kernel/execution_ledger.py) | Resource bounds and consumed-work accounting |
+| [approval](src/kernel/approval.py) / [turn_continuation](src/kernel/turn_continuation.py) | Exact-action decisions and saved dispatch state |
+| [recovery](src/kernel/recovery.py) | Write-ahead work-item state and retry policy |
+| [workflow_position](src/kernel/workflow_position.py) / [workflow_view](src/kernel/workflow_view.py) | Typed planned/ad-hoc progress and thread-derived workflow state |
+| [slice](src/kernel/slice.py) | Pressure-derived opportunistic housekeeping budgets |
+| [intake](src/kernel/intake/) | Signal collector and processing contracts |
+| [testing](src/kernel/testing/) | Public stubs, extension harness, import-boundary support |
+
+Provider implementations live in the SDK; the kernel defines/discovers
+their gateway contracts. Content scanning lives in the SDK/catalog adapter;
+the kernel consumes catalogs and imports selected implementation modules.
+
+## Turn contract
+
+`run_turn` accepts a query, resolved mode/model context, budgets, hooks,
+and identity. The runtime normally prepares those inputs.
+
+1. Guard input and establish mode/workflow context.
+2. Run configured entry/pre-turn behavior, assemble instructions/evidence,
+   and prepare the allowed tool schemas.
+3. Resolve each iteration's model, fit the complete request, call it, and
+   account for provider usage.
+4. Dispatch authorized operations, pack tools, MCP tools, or intercepted
+   lifecycle actions; record outcomes and effect receipts.
+5. Evaluate explicit lifecycle policy: continue, transition, fork/delegate,
+   ask/yield, approval, pause/terminate, or complete.
+6. Guard output and run completion/persistence/post-turn hooks as applicable.
+
+Do not equate an answer string with successful action completion.
+`TurnResult` carries blocks, handoffs, stage transitions, child outcomes,
+approvals/yields, usage, receipts, and evidence needed by the host.
+
+See [mode/workflow routing](../docs/ROUTER_DESIGN.md),
+[context lifecycle](../docs/CONTEXT_LIFECYCLE.md),
+[token budgets](../docs/TOKEN_BUDGET.md), and the
+[invariant registry](../docs/lessons/turn-loop-invariants.md).
+
+## TurnHooks and ContextSeams
+
+[TurnHooks](src/kernel/turn_hooks.py) supplies model resolution/completion,
+prompt assembly, authorized operation/tool execution, catalogs/pool access,
+state/services/identity, workflow updates, persistence, and slices.
+Callbacks are integration seams, not permission to bypass registry policy.
+
+[`ContextSeams`](src/kernel/turn_runner/_seams.py) groups content registry, model policy, provider gateways,
+event bus, extension-item builder, and input/output guards.
+Public defaults live in [kernel.context](src/kernel/context/).
+Default content guards are **pass-through**. Applications needing filtering
+must install appropriate implementations.
+
+Input blocks prevent model work. Output guards can replace unsafe output;
+hosts must persist/deliver the permitted result, not leak the rejected text.
+Privacy also depends on authenticated identity, storage/retrieval filters,
+and delivery routing; it cannot be implemented by a prompt alone.
+
+For a custom composition, follow [host integration](../docs/HOST_INTEGRATION.md).
+Keep MCP lifecycle startup/use/shutdown in one task and event loop.
+
+## Dispatch and operation contracts
+
+Operations use `OperationExecutionContext` and return `OperationResult`.
+They can be Python (`.yml` + `.py`) or declarative (`.operation.md`).
+Pack tools use `ToolExecutionContext` / `ToolResult`.
+Operations interact with the host through `ctx.host`; do not use retired
+`ctx.runtime` examples.
+
+The kernel authorizes catalog capabilities, validates effects/limits, and
+uses declared tool surfaces for operation dispatch. Exposing a capability
+as an ambient default does not make it a required completion effect.
+Markdown operation definitions take precedence over a colocated Python
+definition; the Python file can supply the response model.
+
+External tools use the MCP pool; catalog/content access uses the content
+seams. In-process Python tools remain trusted code, not sandboxed merely
+because they were discovered through MCP.
+
+Use [operation authoring](../sdk/AUTHORING.md),
+[pack authoring](../docs/PACK_AUTHORING_GUIDE.md), and
+[approval policy](../docs/POLICY_GUIDE.md) for metadata and examples.
+
+## Slices and intake
+
+Slices are opportunistic, budgeted work. Budget grows with the elapsed gap
+since the previous slice:
+
+```text
+base_budget_ms + max_deferred_ms * (1 - 0.5^(gap_seconds / pressure_half_life_seconds))
+```
+
+The result is capped. Policies select pre-turn, post-turn, explicit, or
+disabled execution. This is not a continuously running scheduler.
+Hosts can separately schedule the one-shot intake process for ambient
+signal collection and processing; no cron/timer belongs inside the turn loop.
+
+## Testing and contribution
+
+From the workspace root:
+
+```sh
+uv run pytest kernel/tests kernel/src/kernel/context/tests -m "not live" -q
+```
+
+The kernel test support is public for pack/extension authors. Use injected
+fakes and isolated configuration; do not import private app modules or live
+external packs into kernel unit tests.
+
+See [testing](../docs/TESTING.md) for the full CI matrix/gates and
+[contributing](../CONTRIBUTING.md).

lisa_harness_kernel-0.1.0/pyproject.toml

@@ -0,0 +1,47 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/kernel"]
+
+[project]
+name = "lisa-harness-kernel"
+version = "0.1.0"
+description = "Lisa kernel — runtime-neutral FSM engine, contracts, operation registry, and telemetry primitives"
+requires-python = ">=3.11"
+
+dependencies = [
+    "pydantic>=2.7.0",
+    "pydantic-settings>=2.3.0",
+    "pyyaml>=6.0",
+    "opentelemetry-api>=1.40.0,<2.0.0",
+    "opentelemetry-sdk>=1.40.0,<2.0.0",
+    "httpx>=0.27.0",
+    "python-dotenv>=1.0.0",
+    "mcp>=2.0.0",
+    # On Windows, Python's zoneinfo has no system tz database, so the
+    # tzdata package is required for IANA timezone resolution.
+    "tzdata>=2024.1; platform_system == 'Windows'",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0.0",
+    "pytest-asyncio>=0.23.0",
+    "pytest-cov>=6.0.0",
+    "pytest-mock>=3.14.0",
+    "types-PyYAML>=6.0",
+]
+memory = [
+    "sqlite-vec>=0.1.9",
+]
+
+[tool.pytest.ini_options]
+pythonpath = ["src"]
+testpaths = ["tests"]
+markers = [
+    "live: hits real external signal or provider APIs and prints a tester-visible summary",
+    "integration: multi-module in-process test; may require local services",
+    "eval: deterministic agent regression evals (no model calls, no I/O)",
+]

lisa_harness_kernel-0.1.0/src/kernel/__init__.py

@@ -0,0 +1,5 @@
+"""Lisa kernel — runtime-neutral engine for conversational AI agents.
+
+The kernel owns all contracts, abstractions, and core built-ins. It imports
+nothing from host apps or higher-layer SDK packages.
+"""

lisa_harness_kernel-0.1.0/src/kernel/approval.py

@@ -0,0 +1,417 @@
+"""Exact-action approval contracts for catalog-backed effects.
+
+The kernel owns digest construction and receipt validation. Hosts own durable
+storage and approval UX through the :class:`ApprovalService` protocol.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import json
+import uuid
+from collections.abc import Mapping
+from datetime import UTC, datetime, timedelta
+from typing import Any, Literal, Protocol, runtime_checkable
+
+from pydantic import BaseModel, ConfigDict, Field
+
+__all__ = [
+    "ApprovalDecision",
+    "ApprovalIdentity",
+    "ApprovalInvocation",
+    "ApprovalReceipt",
+    "ApprovalRecord",
+    "ApprovalRequired",
+    "ApprovalService",
+    "ApprovalState",
+    "EffectKind",
+    "InMemoryApprovalService",
+    "build_approval_invocation",
+    "canonical_json",
+    "is_expired",
+    "render_approval_request",
+]
+
+EffectKind = Literal["read", "write", "execute", "external_write"]
+ApprovalState = Literal["pending", "approved", "denied", "consumed", "expired"]
+
+_DEFAULT_APPROVAL_TTL = timedelta(minutes=30)
+
+
+class _FrozenApprovalModel(BaseModel):
+    """Base contract for immutable approval values."""
+
+    model_config = ConfigDict(frozen=True)
+
+
+class ApprovalIdentity(_FrozenApprovalModel):
+    """Identity and session boundaries that scope an approval receipt."""
+
+    workspace_id: str = "default"
+    user_id: str = ""
+    user_slug: str = "default"
+    surface_type: str = "personal_dm"
+    surface_id: str = ""
+    memory_scope: str = "personal"
+    mode_id: str = ""
+    session_plan_digest: str = ""
+
+
+class ApprovalInvocation(_FrozenApprovalModel):
+    """A canonical effectful invocation that can be approved exactly once."""
+
+    request_id: str
+    target_kind: Literal["tool", "operation"]
+    target_id: str
+    pack_id: str = ""
+    effect: EffectKind
+    parameters: dict[str, Any] = Field(default_factory=dict)
+    identity: ApprovalIdentity
+    pack_config_fingerprint: str
+    session_plan_digest: str
+    action_digest: str
+    safe_preview: str
+    created_at: datetime
+    expires_at: datetime
+
+
+class ApprovalReceipt(_FrozenApprovalModel):
+    """Evidence that one exact pending invocation was approved."""
+
+    request_id: str
+    action_digest: str
+    identity: ApprovalIdentity
+    approved_at: datetime
+    expires_at: datetime
+
+
+class ApprovalDecision(_FrozenApprovalModel):
+    """An operator decision recorded against an approval request."""
+
+    request_id: str
+    state: ApprovalState
+    decided_at: datetime
+    identity: ApprovalIdentity
+    reason: str = ""
+
+
+class ApprovalRecord(BaseModel):
+    """Durable state for one requested action, owned by a host service."""
+
+    invocation: ApprovalInvocation
+    state: ApprovalState = "pending"
+    receipt: ApprovalReceipt | None = None
+    decision: ApprovalDecision | None = None
+
+
+class ApprovalUnavailable(RuntimeError):
+    """The receipt failed authoritative consumption; do not continue its saved batch."""
+
+
+class ApprovalRequired(RuntimeError):
+    """Interrupt execution until the host has approved the exact action."""
+
+    def __init__(self, invocation: ApprovalInvocation) -> None:
+        self.invocation = invocation
+        super().__init__(f"Approval required: {invocation.request_id}")
+
+
+@runtime_checkable
+class ApprovalService(Protocol):
+    """Host-owned durable approval service used by execution registries."""
+
+    async def request(self, invocation: ApprovalInvocation) -> ApprovalInvocation:
+        """Persist a new pending invocation and return it."""
+
+    async def approve(
+        self,
+        request_id: str,
+        identity: ApprovalIdentity,
+    ) -> ApprovalReceipt | None:
+        """Approve a matching pending invocation, or return ``None``."""
+
+    async def deny(
+        self,
+        request_id: str,
+        identity: ApprovalIdentity,
+        *,
+        reason: str = "",
+    ) -> bool:
+        """Deny a matching pending invocation."""
+
+    async def consume(
+        self,
+        request_id: str,
+        invocation: ApprovalInvocation,
+    ) -> ApprovalReceipt | None:
+        """Atomically consume a matching approved invocation once."""
+
+    async def get(self, request_id: str) -> ApprovalRecord | None:
+        """Return the persisted request state without changing it."""
+
+    async def list_pending(self, identity: ApprovalIdentity) -> list[ApprovalRecord]:
+        """Return non-expired pending records owned by ``identity``.
+
+        Hosts use this to detect affirmative-resume conditions (e.g. the
+        user typing "proceed" while a paused action awaits approval) and
+        to surface pending approvals in UIs. The identity match is exact.
+        """
+
+
+def _find_pending_for_action(
+    records: Mapping[str, ApprovalRecord],
+    invocation: ApprovalInvocation,
+    *,
+    now: datetime,
+) -> ApprovalRecord | None:
+    """Return a non-expired pending record matching action_digest + identity.
+
+    The exact-action contract approves one canonical invocation once. When
+    a caller re-issues the same effectful action (same target, parameters,
+    pack config fingerprint, and owner identity) before the user has
+    decided, the service must not mint a fresh ``request_id`` — that would
+    strand the original pending request and force the user to re-approve a
+    new id on every retry. Returning the existing pending record preserves
+    the id the user already saw so a prior or future ``/approve <id>`` still
+    satisfies it. Only the ``pending`` state is idempotent; once approved or
+    consumed, a genuinely new request mints a new id.
+    """
+
+    for record in records.values():
+        if record.state != "pending":
+            continue
+        if is_expired(record.invocation, now=now):
+            continue
+        if record.invocation.action_digest == invocation.action_digest and _identity_matches(
+            record.invocation.identity, invocation.identity
+        ):
+            return record
+    return None
+
+
+def _canonicalize(value: Any) -> Any:
+    """Normalize supported JSON-like values into stable, safe digest input."""
+
+    if isinstance(value, BaseModel):
+        return _canonicalize(value.model_dump(mode="json"))
+    if isinstance(value, Mapping):
+        return {str(key): _canonicalize(item) for key, item in sorted(value.items())}
+    if isinstance(value, list | tuple):
+        return [_canonicalize(item) for item in value]
+    if isinstance(value, set | frozenset):
+        normalized = [_canonicalize(item) for item in value]
+        return sorted(normalized, key=lambda item: json.dumps(item, sort_keys=True))
+    return _canonicalize_scalar(value)
+
+
+def _canonicalize_scalar(value: Any) -> Any:
+    """Normalize a scalar leaf (datetime / None / str / int / float / bool)."""
+    if isinstance(value, datetime):
+        return value.astimezone(UTC).isoformat()
+    if value is None or isinstance(value, str | int | float | bool):
+        return value
+    return str(value)
+
+
+def canonical_json(value: Any) -> str:
+    """Return a deterministic JSON representation suitable for SHA-256 input."""
+
+    return json.dumps(
+        _canonicalize(value),
+        ensure_ascii=True,
+        sort_keys=True,
+        separators=(",", ":"),
+    )
+
+
+def _digest(value: Any) -> str:
+    return hashlib.sha256(canonical_json(value).encode("utf-8")).hexdigest()
+
+
+def build_approval_invocation(
+    *,
+    target_kind: Literal["tool", "operation"],
+    target_id: str,
+    pack_id: str,
+    effect: EffectKind,
+    parameters: Mapping[str, Any],
+    identity: ApprovalIdentity,
+    pack_config: Mapping[str, Any],
+    safe_preview: str = "",
+    now: datetime | None = None,
+    ttl: timedelta = _DEFAULT_APPROVAL_TTL,
+) -> ApprovalInvocation:
+    """Build an exact-action request from canonical validated inputs."""
+
+    created_at = now or datetime.now(UTC)
+    normalized_parameters = _canonicalize(parameters)
+    if not isinstance(normalized_parameters, dict):
+        normalized_parameters = {}
+    config_fingerprint = _digest(pack_config)
+    action_payload = {
+        "target_kind": target_kind,
+        "target_id": target_id,
+        "pack_id": pack_id,
+        "effect": effect,
+        "parameters": normalized_parameters,
+        "identity": identity,
+        "pack_config_fingerprint": config_fingerprint,
+        "session_plan_digest": identity.session_plan_digest,
+    }
+    return ApprovalInvocation(
+        request_id=uuid.uuid4().hex,
+        target_kind=target_kind,
+        target_id=target_id,
+        pack_id=pack_id,
+        effect=effect,
+        parameters=normalized_parameters,
+        identity=identity,
+        pack_config_fingerprint=config_fingerprint,
+        session_plan_digest=identity.session_plan_digest,
+        action_digest=_digest(action_payload),
+        safe_preview=safe_preview.strip() or f"{effect.replace('_', ' ')} {target_id}",
+        created_at=created_at,
+        expires_at=created_at + ttl,
+    )
+
+
+def is_expired(invocation: ApprovalInvocation, *, now: datetime | None = None) -> bool:
+    """Return whether an approval request has passed its expiry time."""
+
+    return (now or datetime.now(UTC)) >= invocation.expires_at
+
+
+def render_approval_request(invocation: ApprovalInvocation) -> str:
+    """Render the host-neutral user prompt for a paused action.
+
+    The kernel states the situation without command syntax: which action is
+    paused and that an operator decision is pending. Hosts own the *how* —
+    the runtime builds the structured ``data["approval"]`` payload (with
+    ``request_id``) for panel transports and appends the installed command
+    hints to the text for plain transports.
+    """
+
+    return (
+        f"Approval required for {invocation.safe_preview}.\n\n"
+        f"This action is paused until you approve or deny it "
+        f"(request {invocation.request_id})."
+    )
+
+
+def _identity_matches(expected: ApprovalIdentity, actual: ApprovalIdentity) -> bool:
+    return expected == actual
+
+
+class InMemoryApprovalService:
+    """Lock-protected approval service used by kernel tests and lightweight hosts."""
+
+    def __init__(self) -> None:
+        self._records: dict[str, ApprovalRecord] = {}
+        self._lock = asyncio.Lock()
+
+    async def request(self, invocation: ApprovalInvocation) -> ApprovalInvocation:
+        async with self._lock:
+            existing = _find_pending_for_action(self._records, invocation, now=datetime.now(UTC))
+            if existing is not None:
+                return existing.invocation
+            self._records.setdefault(invocation.request_id, ApprovalRecord(invocation=invocation))
+            return self._records[invocation.request_id].invocation
+
+    async def approve(
+        self,
+        request_id: str,
+        identity: ApprovalIdentity,
+    ) -> ApprovalReceipt | None:
+        async with self._lock:
+            record = self._records.get(request_id)
+            if record is None or not _identity_matches(record.invocation.identity, identity):
+                return None
+            if is_expired(record.invocation):
+                record.state = "expired"
+                return None
+            if record.state != "pending":
+                return None
+            receipt = ApprovalReceipt(
+                request_id=request_id,
+                action_digest=record.invocation.action_digest,
+                identity=identity,
+                approved_at=datetime.now(UTC),
+                expires_at=record.invocation.expires_at,
+            )
+            record.state = "approved"
+            record.receipt = receipt
+            record.decision = ApprovalDecision(
+                request_id=request_id,
+                state="approved",
+                decided_at=receipt.approved_at,
+                identity=identity,
+            )
+            return receipt
+
+    async def deny(
+        self,
+        request_id: str,
+        identity: ApprovalIdentity,
+        *,
+        reason: str = "",
+    ) -> bool:
+        async with self._lock:
+            record = self._records.get(request_id)
+            if record is None or not _identity_matches(record.invocation.identity, identity):
+                return False
+            if record.state != "pending":
+                return False
+            record.state = "denied"
+            record.decision = ApprovalDecision(
+                request_id=request_id,
+                state="denied",
+                decided_at=datetime.now(UTC),
+                identity=identity,
+                reason=reason.strip(),
+            )
+            return True
+
+    async def consume(
+        self,
+        request_id: str,
+        invocation: ApprovalInvocation,
+    ) -> ApprovalReceipt | None:
+        async with self._lock:
+            record = self._records.get(request_id)
+            if record is None:
+                return None
+            if is_expired(record.invocation):
+                record.state = "expired"
+                return None
+            if (
+                record.state != "approved"
+                or record.receipt is None
+                or record.receipt.action_digest != invocation.action_digest
+                or not _identity_matches(record.invocation.identity, invocation.identity)
+            ):
+                return None
+            receipt = record.receipt
+            record.state = "consumed"
+            record.decision = ApprovalDecision(
+                request_id=request_id,
+                state="consumed",
+                decided_at=datetime.now(UTC),
+                identity=invocation.identity,
+            )
+            return receipt
+
+    async def get(self, request_id: str) -> ApprovalRecord | None:
+        async with self._lock:
+            return self._records.get(request_id)
+
+    async def list_pending(self, identity: ApprovalIdentity) -> list[ApprovalRecord]:
+        async with self._lock:
+            now = datetime.now(UTC)
+            return [
+                record
+                for record in self._records.values()
+                if record.state == "pending"
+                and not is_expired(record.invocation, now=now)
+                and _identity_matches(record.invocation.identity, identity)
+            ]