pgc-compiler 2.0.0__py3-none-any.whl

compiler/governance_engine/assertions/handlers/assert_cc_no_implicit_chaining_v0.py

@@ -0,0 +1,89 @@
+"""
+ASSERT_CC_NO_IMPLICIT_CHAINING_V0 Handler
+
+Validates CC artifacts contain no orchestration logic:
+- No next_step field (explicit chaining)
+- No next field (state transitions)
+- No transitions field (workflow logic)
+- No flow field (control flow)
+- No conditional field (branching)
+- No loop field (iteration)
+
+CONSTITUTIONAL: Pure rule checker - reads pre-computed structure from context
+"""
+
+
+def execute(artifacts: list[dict], compilation_context: dict) -> dict:
+    """
+    Validate all CC artifacts for absence of orchestration logic against pre-computed analysis.
+
+    Args:
+        artifacts: All validated artifacts
+        compilation_context: Contains pre-computed cc_chaining
+
+    Returns:
+        {
+            "assert_count": int,
+            "violations": list[dict],  # Standardized schema
+            "status": "PASSED/FAILED"
+        }
+    """
+    violations = []
+    cc_count = 0
+
+    # STRICT INVERSION OF CONTROL: Compiler must provide complete context
+    cc_chaining = compilation_context.get("cc_chaining")
+
+    if cc_chaining is None:
+        return {
+            "assert_count": 0,
+            "violations": [{
+                "fqdn": "capability_contracts::ASSERT_CC_NO_IMPLICIT_CHAINING_V0",
+                "rule": "COMPILATION_CONTEXT_COMPLETE",
+                "message": "Compilation context missing cc_chaining",
+                "fix": "Compiler must pre-compute CC chaining analysis before assert phase"
+            }],
+            "status": "FAILED"
+        }
+
+    # Check rules against pre-computed structure
+    for artifact in artifacts:
+        if artifact.get("artifact_type") != "CC":
+            continue
+
+        cc_count += 1
+        fqdn = artifact["fqdn_id"]
+        chaining_result = cc_chaining.get(fqdn)
+
+        if not chaining_result:
+            violations.append({
+                "fqdn": fqdn,
+                "rule": "capability_contracts::INVARIANT_CC_NO_IMPLICIT_CHAINING_V0",
+                "message": "Missing chaining analysis for CC artifact",
+                "fix": "Compiler must analyze all CC artifacts"
+            })
+            continue
+
+        # Translate structural violations to standardized rule violations
+        if chaining_result.get("status") == "FAILED":
+            for structural_violation in chaining_result.get("violations", []):
+                violations.append({
+                    "fqdn": fqdn,
+                    "rule": "capability_contracts::INVARIANT_CC_NO_IMPLICIT_CHAINING_V0",
+                    "message": structural_violation.get("violation", "Unknown CC chaining violation"),
+                    "fix": structural_violation.get("fix", "Remove orchestration fields from CC")
+                })
+
+    # Return standardized result
+    if violations:
+        return {
+            "assert_count": cc_count,
+            "violations": violations,
+            "status": "FAILED"
+        }
+
+    return {
+        "assert_count": cc_count,
+        "violations": [],
+        "status": "PASSED"
+    }

compiler/governance_engine/assertions/handlers/assert_cc_no_missing_dependencies_v0.py

@@ -0,0 +1,89 @@
+"""
+ASSERT_CC_NO_MISSING_DEPENDENCIES_V0 - Handler
+
+Enforces INVARIANT_CC_NO_MISSING_DEPENDENCIES_V0 at compile time.
+
+Validates CC dependency ordering and reachability for all WF artifacts:
+- No forward references (CC_B references CC_C that appears later)
+- No cross-branch references (CC_B references CC_C on different branch)
+
+Validation Scope: ORDERING and REACHABILITY ONLY (not field existence, not FQDN resolution)
+
+CONSTITUTIONAL: Pure rule checker - reads pre-computed structure from context
+"""
+
+
+def execute(artifacts: list[dict], compilation_context: dict) -> dict:
+    """
+    Validate CC dependency ordering against pre-computed structural analysis.
+
+    Args:
+        artifacts: All validated artifacts
+        compilation_context: Contains pre-computed cc_dependencies
+
+    Returns:
+        {
+            "assert_count": int,
+            "violations": list[dict],  # Standardized schema
+            "status": "PASSED/FAILED"
+        }
+    """
+    violations = []
+    wf_count = 0
+
+    # STRICT INVERSION OF CONTROL: Compiler must provide complete context
+    cc_dependencies = compilation_context.get("cc_dependencies")
+
+    if cc_dependencies is None:
+        return {
+            "assert_count": 0,
+            "violations": [{
+                "fqdn": "capability_contracts::ASSERT_CC_NO_MISSING_DEPENDENCIES_V0",
+                "rule": "COMPILATION_CONTEXT_COMPLETE",
+                "message": "Compilation context missing cc_dependencies",
+                "fix": "Compiler must pre-compute CC dependency analysis before assert phase"
+            }],
+            "status": "FAILED"
+        }
+
+    # Check rules against pre-computed structure
+    for artifact in artifacts:
+        if artifact.get("artifact_type") != "WF":
+            continue
+
+        wf_count += 1
+        fqdn = artifact["fqdn_id"]
+        deps_result = cc_dependencies.get(fqdn)
+
+        if not deps_result:
+            violations.append({
+                "fqdn": fqdn,
+                "rule": "capability_contracts::INVARIANT_CC_NO_MISSING_DEPENDENCIES_V0",
+                "message": "Missing dependency analysis for WF artifact",
+                "fix": "Compiler must analyze all WF artifacts"
+            })
+            continue
+
+        # Translate structural violations to standardized rule violations
+        if deps_result.get("status") == "FAILED":
+            for structural_violation in deps_result.get("violations", []):
+                violations.append({
+                    "fqdn": fqdn,
+                    "rule": "capability_contracts::INVARIANT_CC_NO_MISSING_DEPENDENCIES_V0",
+                    "message": structural_violation.get("violation", "Unknown CC dependency violation"),
+                    "fix": structural_violation.get("fix", "Ensure all CC dependencies are satisfied")
+                })
+
+    # Return standardized result
+    if violations:
+        return {
+            "assert_count": wf_count,
+            "violations": violations,
+            "status": "FAILED"
+        }
+
+    return {
+        "assert_count": wf_count,
+        "violations": [],
+        "status": "PASSED"
+    }

compiler/governance_engine/assertions/handlers/assert_cc_no_unused_outputs_v0.py

@@ -0,0 +1,81 @@
+"""
+ASSERT_CC_NO_UNUSED_OUTPUTS_V0 - Handler
+
+Enforces INVARIANT_CC_NO_UNUSED_OUTPUTS_V0 at compile time.
+
+Detects unused CC outputs as code smell indicator:
+- Outputs produced but never consumed
+- Potential optimization opportunities
+- Incomplete workflow indicators
+
+Enforcement Level: WARNING (not ERROR)
+- Build succeeds with warnings
+- Warnings logged for author review
+
+CONSTITUTIONAL: Pure rule checker - reads pre-computed structure from context
+"""
+
+
+def execute(artifacts: list[dict], compilation_context: dict) -> dict:
+    """
+    Check for unused CC outputs against pre-computed structural analysis.
+
+    Args:
+        artifacts: All validated artifacts
+        compilation_context: Contains pre-computed cc_unused_outputs
+
+    Returns:
+        Assertion result with warnings (not violations)
+    """
+    wf_count = 0
+    all_warnings = []
+
+    # STRICT INVERSION OF CONTROL: Compiler must provide complete context
+    cc_unused_outputs = compilation_context.get("cc_unused_outputs")
+
+    if cc_unused_outputs is None:
+        return {
+            "assert_count": 0,
+            "violations": [{
+                "fqdn": "capability_contracts::ASSERT_CC_NO_UNUSED_OUTPUTS_V0",
+                "rule": "COMPILATION_CONTEXT_COMPLETE",
+                "message": "Compilation context missing cc_unused_outputs",
+                "fix": "Compiler must pre-compute CC unused outputs analysis before assert phase"
+            }],
+            "status": "FAILED"
+        }
+
+    # Check WF artifacts for unused outputs
+    for artifact in artifacts:
+        if artifact.get("artifact_type") != "WF":
+            continue
+
+        wf_count += 1
+
+    # Aggregate warnings from all per-WF analyses
+    for wf_fqdn, result in cc_unused_outputs.items():
+        warnings = result.get("warnings", [])
+        if warnings:
+            for warning in warnings:
+                all_warnings.append({
+                    "fqdn": wf_fqdn,
+                    "rule": "capability_contracts::INVARIANT_CC_NO_UNUSED_OUTPUTS_V0",
+                    "message": warning.get("violation", warning.get("message", "Unknown unused output warning")),
+                    "fix": warning.get("fix", "Remove unused output or connect it to a consumer")
+                })
+
+    if all_warnings:
+        return {
+            "assert_count": wf_count,
+            "violations": [],  # No violations - warnings are not blocking
+            "warnings": all_warnings,
+            "warning_count": len(all_warnings),
+            "status": "PASSED"  # PASSED with warnings
+        }
+
+    return {
+        "assert_count": wf_count,
+        "violations": [],
+        "warnings": [],
+        "status": "PASSED"
+    }

compiler/governance_engine/assertions/handlers/assert_cc_storage_op_conformance_v0.py

@@ -0,0 +1,74 @@
+"""
+ASSERT_CC_STORAGE_OP_CONFORMANCE_V0 Handler
+
+Validates that every CC pipeline step with a side_effect binding declares an op
+that exists in the target CS's core.policy.operations list.
+
+CONSTITUTIONAL: Pure rule checker — reads pre-computed structure from context.
+"""
+
+
+def execute(artifacts: list[dict], compilation_context: dict) -> dict:
+    """
+    Validate all CC op declarations against pre-computed CS operation conformance.
+
+    Args:
+        artifacts: All validated artifacts
+        compilation_context: Contains pre-computed cc_op_conformance
+
+    Returns:
+        {
+            "assert_count": int,
+            "violations": list[dict],
+            "status": "PASSED/FAILED"
+        }
+    """
+    violations = []
+    cc_count = 0
+
+    cc_op_conformance = compilation_context.get("cc_op_conformance")
+
+    if cc_op_conformance is None:
+        return {
+            "assert_count": 0,
+            "violations": [{
+                "fqdn": "capability_contracts::ASSERT_CC_STORAGE_OP_CONFORMANCE_V0",
+                "rule": "COMPILATION_CONTEXT_COMPLETE",
+                "message": "Compilation context missing cc_op_conformance",
+                "fix": "Compiler must pre-compute CC op conformance analysis before assert phase"
+            }],
+            "status": "FAILED"
+        }
+
+    for artifact in artifacts:
+        if artifact.get("artifact_type") != "CC":
+            continue
+
+        cc_count += 1
+        fqdn = artifact["fqdn_id"]
+        conformance_result = cc_op_conformance.get(fqdn)
+
+        if not conformance_result:
+            continue  # CC has no CS-binding steps — exempt
+
+        if conformance_result.get("status") == "FAILED":
+            for structural_violation in conformance_result.get("violations", []):
+                violations.append({
+                    "fqdn": fqdn,
+                    "rule": "capability_contracts::INVARIANT_CC_STORAGE_OP_CONFORMANCE_V0",
+                    "message": structural_violation.get("violation", "Unknown op conformance violation"),
+                    "fix": structural_violation.get("fix", "Correct op to match CS declared operations"),
+                })
+
+    if violations:
+        return {
+            "assert_count": cc_count,
+            "violations": violations,
+            "status": "FAILED"
+        }
+
+    return {
+        "assert_count": cc_count,
+        "violations": [],
+        "status": "PASSED"
+    }

compiler/governance_engine/assertions/handlers/assert_compiler_governance_declared_v0.py

@@ -0,0 +1,65 @@
+"""
+ASSERT_COMPILER_GOVERNANCE_DECLARED_V0 Handler
+
+Verifies CONSTITUTION_COMPILER_V0 is present in the compiled artifact set
+and declares a non-empty rules list — enforcing COMPILER_SELF_APPLICABLE.
+"""
+
+from typing import Any
+
+_COMPILER_CONSTITUTION_FQDN = "compiler::CONSTITUTION_COMPILER_V0"
+
+
+def execute(artifacts: list[dict], compilation_context: dict) -> dict:
+    """
+    Verify CONSTITUTION_COMPILER_V0 is present and well-formed.
+
+    Args:
+        artifacts: All compiled artifacts
+        compilation_context: Not used
+
+    Returns:
+        {
+            "assert_count": int,
+            "violations": list[dict],
+            "status": str
+        }
+    """
+    violations = []
+
+    # Locate CONSTITUTION_COMPILER_V0 in compiled set
+    constitution = next(
+        (a for a in artifacts if a.get("fqdn_id") == _COMPILER_CONSTITUTION_FQDN),
+        None,
+    )
+
+    if constitution is None:
+        violations.append({
+            "fqdn": _COMPILER_CONSTITUTION_FQDN,
+            "rule": "compiler::INVARIANT_COMPILER_GOVERNANCE_DECLARED_V0",
+            "message": (
+                f"COMPILER_SELF_APPLICABLE violated: {_COMPILER_CONSTITUTION_FQDN} "
+                "is absent from the compiled artifact set"
+            ),
+            "fix": (
+                "Ensure the STRUCTURE declaration includes compiler as a "
+                "governed boundary so CONSTITUTION_COMPILER_V0 is discovered and compiled"
+            ),
+        })
+    # The emptiness check that stood here is retired: SCHEMA_CONSTITUTION_V0 requires a
+    # non-empty rules list on every constitution, and ASSERT_GOVERNANCE_DECLARATION_RESOLVES_V0
+    # requires each rule to name a real enforcing invariant. Presence of the compiler
+    # constitution in the compiled set is the only claim left for this handler to make.
+
+    if violations:
+        return {
+            "assert_count": 1,
+            "violations": violations,
+            "status": "FAILED",
+        }
+
+    return {
+        "assert_count": 1,
+        "violations": [],
+        "status": "PASSED",
+    }

compiler/governance_engine/assertions/handlers/assert_compiler_no_execution_v0.py

@@ -0,0 +1,86 @@
+"""
+ASSERT_COMPILER_NO_EXECUTION_V0 Handler
+
+Verifies compiled CT and CS artifacts do not carry execution-time state fields
+in their materialized frontmatter.
+
+Execution-state fields are fields that would only be present in an artifact's
+frontmatter if the compiler invoked the artifact's implementation during compilation.
+Their presence is a constitutional violation.
+"""
+
+from typing import Any
+
+# Fields that indicate execution-time state contamination in compiled artifact frontmatter.
+# These fields are only produced by executing an artifact, not by declaring one.
+_EXECUTION_STATE_FIELDS = frozenset({
+    "trace_id",
+    "execution_result",
+    "runtime_output",
+    "invocation_id",
+    "execution_state",
+    "runtime_state",
+})
+
+
+def execute(artifacts: list[dict], compilation_context: dict) -> dict:
+    """
+    Verify CT and CS artifact frontmatter contains no execution-time state fields.
+
+    Args:
+        artifacts: All compiled artifacts
+        compilation_context: Not used
+
+    Returns:
+        {
+            "assert_count": int,
+            "violations": list[dict],
+            "status": str
+        }
+    """
+    violations = []
+    checked = 0
+
+    for artifact in artifacts:
+        artifact_type = artifact.get("artifact_type")
+        if artifact_type not in ("CT", "CS"):
+            continue
+
+        checked += 1
+        fqdn_id = artifact.get("fqdn_id", "<unknown>")
+        artifact_code = artifact.get("artifact_code", "<unknown>")
+        frontmatter = artifact.get("frontmatter", {})
+
+        # Check top-level frontmatter keys for execution-state fields
+        contaminated_fields = _EXECUTION_STATE_FIELDS & set(frontmatter.keys())
+
+        if contaminated_fields:
+            violations.append({
+                "fqdn": fqdn_id,
+                "artifact_code": artifact_code,
+                "artifact_type": artifact_type,
+                "contaminated_fields": sorted(contaminated_fields),
+                "rule": "compiler::INVARIANT_COMPILER_NO_EXECUTION_V0",
+                "message": (
+                    f"{artifact_type} artifact frontmatter contains execution-state fields: "
+                    f"{sorted(contaminated_fields)}"
+                ),
+                "fix": (
+                    "Remove execution-state fields from the artifact declaration. "
+                    "Compiled CT/CS artifacts must be pure declarations — "
+                    "execution outputs must not appear in compiled frontmatter."
+                ),
+            })
+
+    if violations:
+        return {
+            "assert_count": checked,
+            "violations": violations,
+            "status": "FAILED",
+        }
+
+    return {
+        "assert_count": checked,
+        "violations": [],
+        "status": "PASSED",
+    }

compiler/governance_engine/assertions/handlers/assert_concern_not_authority_v0.py

@@ -0,0 +1,51 @@
+"""
+ASSERT_CONCERN_NOT_AUTHORITY_V0 - Handler
+
+The set of declared concerns and the set of declared authorities must be disjoint.
+
+`2e` CA-6: "A concern classification MUST NOT constitute an authority or a jurisdiction."
+AUTHORITY_VS_CONCERN_RULING clause 2 states the same. The defect this was written for is a concern
+name promoted to a boundary — the surface carried twenty-six of them.
+
+This predicate was unwritable while concern and authority were one identifier: no check could
+distinguish an unlisted namespace from an illegitimate boundary. With separate carriers it is a set
+comparison.
+
+CONSTITUTIONAL: Pure rule checker — reads artifact frontmatter only
+"""
+
+RULE = "ASSERT_CONCERN_NOT_AUTHORITY_V0"
+
+
+def _fm(artifact: dict) -> dict:
+    return artifact.get("frontmatter") or {}
+
+
+def execute(artifacts: list[dict], compilation_context: dict) -> dict:
+    concerns = {c for a in artifacts if (c := _fm(a).get("concern"))}
+    violations = []
+    checked = 0
+    for a in artifacts:
+        authority = _fm(a).get("authority")
+        if not authority:
+            continue
+        checked += 1
+        if authority in concerns:
+            violations.append({
+                "fqdn": a.get("fqdn_id", "UNKNOWN"),
+                "rule": "federation::INVARIANT_CONCERN_NOT_AUTHORITY_V0",
+                "message": (
+                    f"declares authority {authority!r}, which is also declared as a concern. "
+                    f"A concern classification does not constitute an authority (2e CA-6)."
+                ),
+                "fix": (
+                    "Name the authority from which jurisdiction derives, not the subject governed. "
+                    "A concern may be governed without constituting a boundary."
+                ),
+            })
+
+    return {
+        "assert_count": checked,
+        "violations": violations,
+        "status": "FAILED" if violations else "PASSED",
+    }

compiler/governance_engine/assertions/handlers/assert_conformance_assertion_mode_valid_v0.py

@@ -0,0 +1,35 @@
+"""
+ASSERT_CONFORMANCE_ASSERTION_MODE_VALID_V0 Handler
+
+Parity stub for INVARIANT_CONFORMANCE_ASSERTION_MODE_VALID_V0.
+
+The closed-vocabulary enforcement (mode ∈ {exact, property, schema}, type constraints)
+is fully implemented in the VALIDATE_TEST_DATA compiler phase. This handler exists to
+satisfy the 1:1 INVARIANT/ASSERT parity invariant enforced by ASSERT_ASSERT_PARITY_V0.
+
+CONSTITUTIONAL: Pure rule checker — no side effects
+"""
+
+
+def execute(artifacts: list[dict], compilation_context: dict) -> dict:
+    """
+    Parity stub — enforcement delegated to VALIDATE_TEST_DATA phase.
+
+    Args:
+        artifacts: All validated artifacts
+        compilation_context: Compilation context (unused)
+
+    Returns:
+        {
+            "assert_count": int,
+            "violations": list[dict],
+            "status": "PASSED"
+        }
+    """
+    td_count = sum(1 for a in artifacts if a.get("artifact_type") == "TEST_DATA")
+
+    return {
+        "assert_count": td_count,
+        "violations": [],
+        "status": "PASSED",
+    }

compiler/governance_engine/assertions/handlers/assert_cryptographic_trust_declared_v0.py

@@ -0,0 +1,51 @@
+"""
+ASSERT_CRYPTOGRAPHIC_TRUST_DECLARED_V0 Handler
+
+Enforces INVARIANT_CRYPTOGRAPHIC_TRUST_DECLARED_V0:
+Every compiled snapshot must declare exactly one active trust contract
+in the cryptographic_trust namespace.
+"""
+
+
+def execute(artifacts: list[dict], compilation_context: dict) -> dict:
+    contracts = [
+        a for a in artifacts
+        if a.get("namespace") == "cryptographic_trust"
+        and a.get("artifact_code", "").startswith("STRUCTURE_CRYPTOGRAPHIC_TRUST_")
+    ]
+
+    active = [
+        a for a in contracts
+        if a.get("frontmatter", {}).get("status") == "active"
+    ]
+
+    if len(active) == 1:
+        return {
+            "assert_count": len(contracts),
+            "violations": [],
+            "status": "PASSED",
+        }
+
+    violations = []
+
+    if len(active) == 0:
+        violations.append({
+            "fqdn": "cryptographic_trust::ASSERT_CRYPTOGRAPHIC_TRUST_DECLARED_V0",
+            "rule": "cryptographic_trust::INVARIANT_CRYPTOGRAPHIC_TRUST_DECLARED_V0",
+            "message": "No active trust contract found in FB_CRYPTOGRAPHIC_TRUST",
+            "fix": "Add a trust contract with status: active to cryptographic_trust/",
+        })
+    else:
+        active_codes = [a.get("artifact_code") for a in active]
+        violations.append({
+            "fqdn": "cryptographic_trust::ASSERT_CRYPTOGRAPHIC_TRUST_DECLARED_V0",
+            "rule": "cryptographic_trust::INVARIANT_CRYPTOGRAPHIC_TRUST_DECLARED_V0",
+            "message": f"Multiple active trust contracts found: {active_codes}. Exactly one is required.",
+            "fix": "Set status: active on exactly one trust contract; mark others inactive.",
+        })
+
+    return {
+        "assert_count": len(contracts),
+        "violations": violations,
+        "status": "FAILED",
+    }

compiler/governance_engine/assertions/handlers/assert_cs_isolated_execution_v0.py

@@ -0,0 +1,35 @@
+"""
+ASSERT_CS_ISOLATED_EXECUTION_V0 Handler
+
+Parity stub for INVARIANT_CS_ISOLATED_EXECUTION_V0.
+
+CS isolation enforcement (CS executes only through dedicated executors, never inline in
+CT or CC) is a runtime architectural invariant enforced by the execution engine's executor
+routing. This handler exists to satisfy 1:1 INVARIANT/ASSERT parity.
+
+CONSTITUTIONAL: Pure rule checker — no side effects
+"""
+
+
+def execute(artifacts: list[dict], compilation_context: dict) -> dict:
+    """
+    Parity stub — enforcement delegated to runtime executor routing.
+
+    Args:
+        artifacts: All validated artifacts
+        compilation_context: Compilation context (unused)
+
+    Returns:
+        {
+            "assert_count": int,
+            "violations": list[dict],
+            "status": "PASSED"
+        }
+    """
+    cs_count = sum(1 for a in artifacts if a.get("artifact_type") == "CS")
+
+    return {
+        "assert_count": cs_count,
+        "violations": [],
+        "status": "PASSED",
+    }