never4ga 0.1.0__py3-none-any.whl

never4ga/__init__.py

@@ -0,0 +1,15 @@
+"""Never4gA -- Markdown-first, local-first personal knowledge and context system."""
+
+from __future__ import annotations
+
+from importlib.metadata import PackageNotFoundError, version
+
+__all__ = ["__version__"]
+
+#: The installed package's version. `pyproject.toml` is the one place it is
+#: written; everything that reports a version reads it from here. A source
+#: tree imported without being installed has no metadata to read.
+try:
+    __version__ = version("never4ga")
+except PackageNotFoundError:
+    __version__ = "0+unknown"

never4ga/adapters/__init__.py

@@ -0,0 +1,6 @@
+"""Adapters.
+
+Provider-specific and backend-specific code lives here so that core concepts do
+not depend on provider APIs (core/05 section 5). Real backends sit beside
+in-memory fakes and null implementations of the same ports.
+"""

never4ga/adapters/clients/__init__.py

@@ -0,0 +1,7 @@
+"""Adapters for the agent clients installed on this machine."""
+
+from __future__ import annotations
+
+from never4ga.adapters.clients.mcp_registry import SubprocessClientRegistry
+
+__all__ = ["SubprocessClientRegistry"]

never4ga/adapters/clients/mcp_registry.py

@@ -0,0 +1,74 @@
+"""Registering an MCP server by asking the client to do it.
+
+Every client with a shipped descriptor has an ``mcp add`` verb of its own, and
+Never4gA calls it rather than writing the client's configuration file. The
+clients' file formats differ and are not reliably documented, so writing them
+would mean inventing structure. Calling the client's own verb leaves format
+changes, merge semantics and `core/09`'s "never overwrite an unmanaged MCP
+server" with the client. Nothing is overwritten because nothing here opens a
+file.
+
+**An adapter, because it runs a process.** Like `adapters/git` and
+`adapters/systemd`, this is an adapter because a service written against ports
+must not know that the machine has executables on it.
+
+**Nothing here decides.** It runs an argv somebody already approved and reports
+what happened. Whether to run one at all is `services/mcp_registration.py`, and
+whether *this* invocation applies is the caller's ``--apply``.
+"""
+
+from __future__ import annotations
+
+import subprocess
+from typing import Final
+
+from never4ga.domain.clients import ClientDescriptor
+from never4ga.ports.client_registry import RegistrationOutcome
+
+__all__ = ["SubprocessClientRegistry"]
+
+#: Long enough for a client to rewrite a config file, short enough that a
+#: hanging client does not hang the caller.
+TIMEOUT: Final = 30.0
+
+
+class SubprocessClientRegistry:
+    """Runs the client's own command, and never raises on its behalf."""
+
+    def register(
+        self, descriptor: ClientDescriptor, command: tuple[str, ...]
+    ) -> RegistrationOutcome:
+        return _run(descriptor, command)
+
+
+def _run(descriptor: ClientDescriptor, command: tuple[str, ...]) -> RegistrationOutcome:
+    try:
+        finished = subprocess.run(
+            list(command),
+            capture_output=True,
+            text=True,
+            timeout=TIMEOUT,
+            check=False,
+        )
+    except FileNotFoundError:
+        return RegistrationOutcome(
+            descriptor.client_id, command, ok=False, detail=f"{command[0]} is not on PATH"
+        )
+    except subprocess.TimeoutExpired:
+        return RegistrationOutcome(
+            descriptor.client_id,
+            command,
+            ok=False,
+            detail=f"{command[0]} did not finish within {TIMEOUT:.0f}s",
+        )
+    if finished.returncode != 0:
+        detail = (finished.stderr or finished.stdout or "").strip().splitlines()
+        return RegistrationOutcome(
+            descriptor.client_id,
+            command,
+            ok=False,
+            detail=detail[-1] if detail else f"exited {finished.returncode}",
+        )
+    return RegistrationOutcome(
+        descriptor.client_id, command, ok=True, detail=(finished.stdout or "").strip()
+    )

never4ga/adapters/fakes/__init__.py

@@ -0,0 +1,47 @@
+"""In-memory fakes.
+
+core/06 section 25 Tests A and C require that a fake backend can replace a real
+one without touching higher-level code. These fakes are shipped rather than
+confined to the test tree so that future backend adapters can be diffed against
+a known-good reference implementation of each contract.
+"""
+
+from never4ga.adapters.fakes.agent_adapter import FakeAgentAdapter
+from never4ga.adapters.fakes.document_store import InMemoryDocumentStore
+from never4ga.adapters.fakes.extension_registry import InMemoryExtensionRegistry
+from never4ga.adapters.fakes.graph_index import InMemoryGraphIndex
+from never4ga.adapters.fakes.index_state import InMemoryIndexState
+from never4ga.adapters.fakes.maintenance_findings import InMemoryMaintenanceFindings
+from never4ga.adapters.fakes.memory import FakeMemoryAugmentor
+from never4ga.adapters.fakes.metadata_index import InMemoryMetadataIndex
+from never4ga.adapters.fakes.repository_locator import FakeRepositoryLocator
+from never4ga.adapters.fakes.secret_store import InMemorySecretStore
+from never4ga.adapters.fakes.service_manager import FakeServiceManager
+from never4ga.adapters.fakes.text_index import InMemoryTextIndex
+from never4ga.adapters.fakes.tracker_cache import InMemoryTrackerCache
+from never4ga.adapters.fakes.vault_files import InMemoryVaultFileStore
+from never4ga.adapters.fakes.work_management import (
+    FakeWorkManagementProvider,
+    FakeWorkManagementWriter,
+)
+from never4ga.adapters.fakes.workspace_mappings import InMemoryWorkspaceMappingStore
+
+__all__ = [
+    "FakeAgentAdapter",
+    "FakeMemoryAugmentor",
+    "FakeRepositoryLocator",
+    "FakeServiceManager",
+    "FakeWorkManagementProvider",
+    "FakeWorkManagementWriter",
+    "InMemoryDocumentStore",
+    "InMemoryExtensionRegistry",
+    "InMemoryGraphIndex",
+    "InMemoryIndexState",
+    "InMemoryMaintenanceFindings",
+    "InMemoryMetadataIndex",
+    "InMemorySecretStore",
+    "InMemoryTextIndex",
+    "InMemoryTrackerCache",
+    "InMemoryVaultFileStore",
+    "InMemoryWorkspaceMappingStore",
+]

never4ga/adapters/fakes/agent_adapter.py

@@ -0,0 +1,38 @@
+"""Fake AgentAdapter -- reports a fixed set of discovered capabilities."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+from never4ga.domain.extensions import DiscoveredCapability, ExtensionClass
+from never4ga.ports.agent_adapter import AdapterDescription
+
+__all__ = ["FakeAgentAdapter"]
+
+
+class FakeAgentAdapter:
+    def __init__(
+        self,
+        client_id: str = "fake_client",
+        discovered: Sequence[DiscoveredCapability] = (),
+        supported_classes: frozenset[ExtensionClass] | None = None,
+    ) -> None:
+        self._client_id = client_id
+        self._discovered = tuple(discovered)
+        self._supported = supported_classes or frozenset(
+            {ExtensionClass.SKILL, ExtensionClass.MCP_SERVER}
+        )
+
+    @property
+    def client_id(self) -> str:
+        return self._client_id
+
+    def describe(self) -> AdapterDescription:
+        return AdapterDescription(
+            client_id=self._client_id,
+            display_name=self._client_id.replace("_", " ").title(),
+            supported_classes=self._supported,
+        )
+
+    def discover(self) -> Sequence[DiscoveredCapability]:
+        return self._discovered

never4ga/adapters/fakes/document_store.py

@@ -0,0 +1,80 @@
+"""In-memory DocumentStore."""
+
+from __future__ import annotations
+
+from collections.abc import Collection, Iterator
+
+from never4ga.domain.document import ForeignNote, StoredDocument, UntrackedMarkdown, VaultPath
+from never4ga.domain.identity import ConceptId
+from never4ga.layout import is_foreign_note
+
+__all__ = ["InMemoryDocumentStore"]
+
+
+class InMemoryDocumentStore:
+    """A DocumentStore backed by dictionaries.
+
+    Used by contract tests and by higher-level tests that need canonical
+    documents without a temporary vault on disk.
+    """
+
+    def __init__(self) -> None:
+        self._by_id: dict[ConceptId, StoredDocument] = {}
+        self._id_by_path: dict[VaultPath, ConceptId] = {}
+        self._untracked: dict[VaultPath, UntrackedMarkdown] = {}
+
+    def get(self, concept_id: ConceptId) -> StoredDocument | None:
+        return self._by_id.get(concept_id)
+
+    def get_by_path(self, path: VaultPath) -> StoredDocument | None:
+        concept_id = self._id_by_path.get(path)
+        return self._by_id.get(concept_id) if concept_id is not None else None
+
+    def put(self, document: StoredDocument) -> None:
+        occupant = self._id_by_path.get(document.path)
+        if occupant is not None and occupant != document.concept_id:
+            raise ValueError(
+                f"path {document.path} is already occupied by {occupant}; "
+                "two documents cannot share one location"
+            )
+        previous = self._by_id.get(document.concept_id)
+        if previous is not None and previous.path != document.path:
+            # A move: identity is preserved, the old location is vacated.
+            self._id_by_path.pop(previous.path, None)
+        self._by_id[document.concept_id] = document
+        self._id_by_path[document.path] = document.concept_id
+        # Writing a concept where prose sat is adoption completing.
+        self._untracked.pop(document.path, None)
+
+    def delete(self, concept_id: ConceptId) -> None:
+        document = self._by_id.pop(concept_id, None)
+        if document is not None:
+            self._id_by_path.pop(document.path, None)
+
+    def iter_documents(self) -> Iterator[StoredDocument]:
+        return iter(list(self._by_id.values()))
+
+    def get_untracked(self, path: VaultPath) -> UntrackedMarkdown | None:
+        return self._untracked.get(path)
+
+    def place_untracked(self, untracked: UntrackedMarkdown) -> None:
+        """Seed hand-written Markdown, the way a person's editor would."""
+        self._untracked[untracked.path] = untracked
+
+    def remove_untracked(self, path: VaultPath) -> None:
+        """Delete hand-written Markdown, the way a person would."""
+        self._untracked.pop(path, None)
+
+    def iter_foreign_notes(self, directories: Collection[str]) -> Iterator[ForeignNote]:
+        """The seeded hand-written Markdown that sits in foreign material."""
+        for path in sorted(self._untracked):
+            if is_foreign_note(path, directories):
+                note = self.get_foreign_note(path)
+                assert note is not None
+                yield note
+
+    def get_foreign_note(self, path: VaultPath) -> ForeignNote | None:
+        untracked = self._untracked.get(path)
+        if untracked is None:
+            return None
+        return ForeignNote(path=path, frontmatter=untracked.frontmatter, body=untracked.body)

never4ga/adapters/fakes/extension_registry.py

@@ -0,0 +1,57 @@
+"""In-memory ExtensionRegistry.
+
+Storage and filtering only. The planning rules live in
+:func:`never4ga.domain.extensions.plan_capability_sync`: rules kept in a fake
+would be a property of the test double rather than of the system, and a service
+may not import an adapter to reach them.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+from never4ga.domain.extensions import (
+    DeploymentMode,
+    DiscoveredCapability,
+    ExtensionClass,
+    ExtensionRecord,
+    SyncPlan,
+    plan_capability_sync,
+)
+
+__all__ = ["InMemoryExtensionRegistry"]
+
+
+class InMemoryExtensionRegistry:
+    def __init__(self) -> None:
+        self._records: dict[str, ExtensionRecord] = {}
+
+    def register(self, record: ExtensionRecord) -> None:
+        self._records[record.capability_id] = record
+
+    def get(self, capability_id: str) -> ExtensionRecord | None:
+        return self._records.get(capability_id)
+
+    def list_records(
+        self,
+        *,
+        extension_class: ExtensionClass | None = None,
+        deployment_mode: DeploymentMode | None = None,
+        client_id: str | None = None,
+    ) -> Sequence[ExtensionRecord]:
+        records = [
+            record
+            for record in self._records.values()
+            if (extension_class is None or record.extension_class is extension_class)
+            and (deployment_mode is None or record.deployment_mode is deployment_mode)
+            and (client_id is None or record.is_enabled_for(client_id))
+        ]
+        records.sort(key=lambda record: record.capability_id)
+        return tuple(records)
+
+    def plan_sync(
+        self,
+        client_id: str,
+        discovered: Sequence[DiscoveredCapability],
+    ) -> SyncPlan:
+        return plan_capability_sync(client_id, self.list_records(), discovered)

never4ga/adapters/fakes/graph_index.py

@@ -0,0 +1,112 @@
+"""In-memory GraphIndex.
+
+Adjacency lists plus a breadth-first bounded walk -- structurally the same shape
+as the SQLite recursive-CTE traversal of core/06 section 14, which is why this
+fake can stand in for ``SQLiteGraphIndex``.
+"""
+
+from __future__ import annotations
+
+from collections import deque
+from collections.abc import Iterator, Sequence
+
+from never4ga.domain.capabilities import GraphIndexCapability
+from never4ga.domain.identity import ConceptId
+from never4ga.errors import CapabilityNotSupportedError
+from never4ga.ports.graph_index import Direction, GraphEdge, GraphNeighbor, GraphPathStep
+
+__all__ = ["InMemoryGraphIndex"]
+
+
+class InMemoryGraphIndex:
+    def __init__(self) -> None:
+        self._edges: list[GraphEdge] = []
+
+    @property
+    def capabilities(self) -> frozenset[GraphIndexCapability]:
+        # Deliberately a subset: core/06 section 13 expects the first backend to
+        # implement only part of the contract and to say so.
+        return frozenset({GraphIndexCapability.NEIGHBORS, GraphIndexCapability.RECURSIVE_TRAVERSAL})
+
+    def add_edge(self, edge: GraphEdge) -> None:
+        if edge not in self._edges:
+            self._edges.append(edge)
+
+    def replace_outgoing_edges(self, source: ConceptId, edges: Sequence[GraphEdge]) -> None:
+        self._edges = [edge for edge in self._edges if edge.source != source]
+        for edge in edges:
+            self.add_edge(edge)
+
+    def remove_document(self, concept_id: ConceptId) -> None:
+        self._edges = [
+            edge for edge in self._edges if edge.source != concept_id and edge.target != concept_id
+        ]
+
+    def _incident(
+        self,
+        concept_id: ConceptId,
+        direction: Direction,
+        relation_types: tuple[str, ...],
+    ) -> Iterator[GraphNeighbor]:
+        for edge in self._edges:
+            if relation_types and edge.relation_type not in relation_types:
+                continue
+            if edge.source == concept_id and direction in (Direction.OUTGOING, Direction.BOTH):
+                yield GraphNeighbor(edge.target, edge.relation_type, Direction.OUTGOING)
+            if edge.target == concept_id and direction in (Direction.INCOMING, Direction.BOTH):
+                yield GraphNeighbor(edge.source, edge.relation_type, Direction.INCOMING)
+
+    def neighbors(
+        self,
+        concept_id: ConceptId,
+        *,
+        direction: Direction = Direction.BOTH,
+        relation_types: tuple[str, ...] = (),
+        limit: int | None = None,
+    ) -> Sequence[GraphNeighbor]:
+        found = list(self._incident(concept_id, direction, relation_types))
+        return tuple(found[:limit] if limit is not None else found)
+
+    def traverse(
+        self,
+        start: ConceptId,
+        *,
+        max_depth: int,
+        direction: Direction = Direction.BOTH,
+        relation_types: tuple[str, ...] = (),
+    ) -> Sequence[GraphPathStep]:
+        if max_depth < 1:
+            raise ValueError(f"max_depth must be at least 1, got {max_depth}")
+        seen = {start}
+        steps: list[GraphPathStep] = []
+        frontier: deque[tuple[ConceptId, int]] = deque([(start, 0)])
+        while frontier:
+            node, depth = frontier.popleft()
+            if depth >= max_depth:
+                continue
+            for neighbor in self._incident(node, direction, relation_types):
+                if neighbor.concept_id in seen:
+                    continue
+                seen.add(neighbor.concept_id)
+                steps.append(
+                    GraphPathStep(
+                        concept_id=neighbor.concept_id,
+                        depth=depth + 1,
+                        relation_type=neighbor.relation_type,
+                        via=node,
+                    )
+                )
+                frontier.append((neighbor.concept_id, depth + 1))
+        return tuple(steps)
+
+    def shortest_path(
+        self,
+        start: ConceptId,
+        end: ConceptId,
+        *,
+        relation_types: tuple[str, ...] = (),
+    ) -> Sequence[GraphPathStep]:
+        raise CapabilityNotSupportedError("InMemoryGraphIndex does not support 'shortest_path'")
+
+    def clear(self) -> None:
+        self._edges.clear()

never4ga/adapters/fakes/index_state.py

@@ -0,0 +1,56 @@
+"""In-memory IndexState.
+
+Lets a service test run the whole indexing pipeline with no database at all,
+which is what keeps the pipeline honest about depending on ports rather than on
+SQLite (core/06 section 25 test A).
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+from never4ga.domain.document import VaultPath
+from never4ga.domain.identity import ConceptId
+from never4ga.ports.index_state import IndexedDocument, IndexedPath, LinkRecord
+
+__all__ = ["InMemoryIndexState"]
+
+
+class InMemoryIndexState:
+    def __init__(self) -> None:
+        self._documents: dict[ConceptId, IndexedDocument] = {}
+        self._links: dict[ConceptId, tuple[LinkRecord, ...]] = {}
+        self._paths: dict[VaultPath, IndexedPath] = {}
+
+    def record(self, document: IndexedDocument) -> None:
+        self._documents[document.concept_id] = document
+
+    def forget(self, concept_id: ConceptId) -> None:
+        self._documents.pop(concept_id, None)
+        self._links.pop(concept_id, None)
+
+    def get(self, concept_id: ConceptId) -> IndexedDocument | None:
+        return self._documents.get(concept_id)
+
+    def indexed_documents(self) -> Sequence[IndexedDocument]:
+        return tuple(self._documents[key] for key in sorted(self._documents))
+
+    def replace_links(self, source: ConceptId, links: Sequence[LinkRecord]) -> None:
+        self._links[source] = tuple(links)
+
+    def links(self) -> Sequence[LinkRecord]:
+        return tuple(link for key in sorted(self._links) for link in self._links[key])
+
+    def record_path(self, record: IndexedPath) -> None:
+        self._paths[record.path] = record
+
+    def forget_path(self, path: VaultPath) -> None:
+        self._paths.pop(path, None)
+
+    def indexed_paths(self) -> Sequence[IndexedPath]:
+        return tuple(self._paths[key] for key in sorted(self._paths))
+
+    def clear(self) -> None:
+        self._documents.clear()
+        self._links.clear()
+        self._paths.clear()

never4ga/adapters/fakes/maintenance_findings.py

@@ -0,0 +1,44 @@
+"""An in-memory MaintenanceFindings, for tests and for a vault with no database."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from dataclasses import replace
+from datetime import datetime
+
+from never4ga.ports.maintenance_findings import MaintenanceFinding
+
+__all__ = ["InMemoryMaintenanceFindings"]
+
+
+class InMemoryMaintenanceFindings:
+    """A MaintenanceFindings over a list.
+
+    Closed findings are kept rather than dropped, so the store can answer "has
+    this been resolved before" the same way the SQLite one does. Nothing reads
+    that yet; keeping them costs a list entry and losing them would make the two
+    implementations disagree about a question somebody will eventually ask.
+    """
+
+    def __init__(self) -> None:
+        self._findings: list[MaintenanceFinding] = []
+
+    def open_findings(self) -> Sequence[MaintenanceFinding]:
+        return sorted(
+            (f for f in self._findings if f.is_open),
+            key=lambda f: (f.detected_at, f.fingerprint),
+        )
+
+    def record(self, finding: MaintenanceFinding) -> None:
+        if any(f.fingerprint == finding.fingerprint and f.is_open for f in self._findings):
+            return
+        self._findings.append(replace(finding, resolved_at=None))
+
+    def resolve(self, fingerprint: str, at: datetime) -> None:
+        self._findings = [
+            replace(f, resolved_at=at) if f.fingerprint == fingerprint and f.is_open else f
+            for f in self._findings
+        ]
+
+    def clear(self) -> None:
+        self._findings.clear()

never4ga/adapters/fakes/memory.py

@@ -0,0 +1,58 @@
+"""In-memory MemoryAugmentor.
+
+It exists so the external-memory contract runs against a provider that actually
+returns candidates -- a null provider cannot demonstrate that provider identity
+stays separate from canonical identity (core/08 sections 6 and 15).
+"""
+
+from __future__ import annotations
+
+import itertools
+from collections.abc import Sequence
+
+from never4ga.domain.capabilities import MemoryCapability
+from never4ga.domain.identity import ExternalId
+from never4ga.domain.memory import IngestReceipt, MemoryCandidate, MemoryEpisode, MemoryQuery
+from never4ga.ports.work_management import ProviderHealth
+
+__all__ = ["FakeMemoryAugmentor"]
+
+
+class FakeMemoryAugmentor:
+    provider_id = "fake-memory"
+
+    def __init__(self, candidates: Sequence[MemoryCandidate] = ()) -> None:
+        self._candidates = list(candidates)
+        self._episodes: list[MemoryEpisode] = []
+        self._counter = itertools.count(1)
+
+    @property
+    def capabilities(self) -> frozenset[MemoryCapability]:
+        return frozenset({MemoryCapability.SEARCH, MemoryCapability.EPISODIC_INGEST})
+
+    @property
+    def ingested(self) -> Sequence[MemoryEpisode]:
+        return tuple(self._episodes)
+
+    def search(self, query: MemoryQuery) -> Sequence[MemoryCandidate]:
+        matches = [
+            candidate
+            for candidate in self._candidates
+            if not query.terms
+            or any(term.casefold() in candidate.text.casefold() for term in query.terms)
+        ]
+        if query.workspace_id is not None:
+            # A provider that cannot scope by workspace must not pretend it can;
+            # this one stores no workspace, so scoping is the caller's job.
+            pass
+        if query.limit is not None:
+            matches = matches[: query.limit]
+        return tuple(matches)
+
+    def ingest_episode(self, episode: MemoryEpisode) -> IngestReceipt:
+        self._episodes.append(episode)
+        external_id = ExternalId(provider=self.provider_id, value=f"ep-{next(self._counter)}")
+        return IngestReceipt(provider_id=self.provider_id, accepted=True, external_id=external_id)
+
+    def health(self) -> ProviderHealth:
+        return ProviderHealth(available=True)

never4ga/adapters/fakes/metadata_index.py

@@ -0,0 +1,59 @@
+"""In-memory MetadataIndex."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+from never4ga.domain.capabilities import MetadataIndexCapability
+from never4ga.domain.identity import ConceptId
+from never4ga.ports.metadata_index import MetadataQuery, MetadataRecord
+
+__all__ = ["InMemoryMetadataIndex"]
+
+
+class InMemoryMetadataIndex:
+    """A MetadataIndex backed by a dictionary, evaluating filters in Python."""
+
+    def __init__(self) -> None:
+        self._records: dict[ConceptId, MetadataRecord] = {}
+
+    @property
+    def capabilities(self) -> frozenset[MetadataIndexCapability]:
+        return frozenset({MetadataIndexCapability.SET_FILTERS})
+
+    def upsert(self, record: MetadataRecord) -> None:
+        self._records[record.concept_id] = record
+
+    def remove(self, concept_id: ConceptId) -> None:
+        self._records.pop(concept_id, None)
+
+    def get(self, concept_id: ConceptId) -> MetadataRecord | None:
+        return self._records.get(concept_id)
+
+    def query(self, query: MetadataQuery) -> Sequence[MetadataRecord]:
+        matches = [record for record in self._records.values() if _matches(record, query)]
+        # Deterministic ordering: identity is time-ordered, so this is insertion
+        # order in practice and stable across rebuilds.
+        matches.sort(key=lambda record: record.concept_id)
+        if query.limit is not None:
+            matches = matches[: query.limit]
+        return tuple(matches)
+
+    def clear(self) -> None:
+        self._records.clear()
+
+
+def _matches(record: MetadataRecord, query: MetadataQuery) -> bool:
+    scalar_filters = (
+        (query.types, record.concept_type),
+        (query.lifecycles, record.lifecycle),
+        (query.statuses, record.status),
+        (query.authorities, record.authority),
+    )
+    for allowed, value in scalar_filters:
+        if allowed and value not in allowed:
+            return False
+    if query.workspace_ids and record.workspace_id not in query.workspace_ids:
+        return False
+    set_filters = ((query.tags, record.tags), (query.domains, record.domains))
+    return all(not wanted or set(wanted) & set(held) for wanted, held in set_filters)