phase-loop-runtime 0.7.2__tar.gz → 0.7.3__tar.gz

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.7.2
+Version: 0.7.3
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author: ViperJuice
 License-Expression: Apache-2.0

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phase-loop-runtime"  # PyPI dist name; NOT "agent-harness" (an unrelated third-party PyPI project)
-version = "0.7.2"
+version = "0.7.3"
 description = "Harness-neutral phase-loop orchestration runtime and CLI"
 readme = "README.md"
 requires-python = ">=3.10"

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/src/phase_loop_runtime/__init__.py

@@ -18,4 +18,4 @@ __all__ = [
     "state_ops",
 ]
 
-__version__ = "0.7.2"
+__version__ = "0.7.3"

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/src/phase_loop_runtime/cli.py

@@ -18,6 +18,7 @@ from .consiliency_scaffold import ScaffoldError, scaffold
 from .docs_freshness import scan_docs_freshness
 from .discovery import AmbiguousRoadmapError, find_plan_artifact, phase_source_bundle_diagnostic, resolve_repo, resolve_suite_command, select_roadmap
 from .events import append_event, read_events
+from .roadmap_authority import RoadmapAuthorityError, assert_roadmap_authorized
 from .git_topology import collect_git_topology
 from .handoff import handoff_metadata, write_tui_handoff
 from .install_status import build_install_status
@@ -859,6 +860,9 @@ def main(argv: list[str] | None = None) -> int:
             file=sys.stderr,
         )
         return 2
+    except RoadmapAuthorityError as exc:
+        print(f"phase-loop {command}: roadmap authority refusal — {exc}", file=sys.stderr)
+        return 2
 
 
 def _resolve_run_closeout_mode(args: argparse.Namespace, command: str) -> str:
@@ -1046,6 +1050,7 @@ def _main(parser: argparse.ArgumentParser, args: argparse.Namespace, command: st
             _warn_roadmap_validation(select_roadmap(repo, args.roadmap))
         return _evidence_audit_command(repo=repo, args=args, as_json=as_json)
     if command in {"run", "resume", "dry-run"} and bool(getattr(args, "reset_capability", False)):
+        assert_roadmap_authorized(repo, args.roadmap)
         clear_degradation(repo)
 
     if command == "execute":
@@ -1137,6 +1142,7 @@ def _main(parser: argparse.ArgumentParser, args: argparse.Namespace, command: st
                 )
         return 0
     if command == "migrate-handoffs":
+        assert_roadmap_authorized(repo, args.roadmap)
         records = migrate_handoffs(repo, apply=bool(getattr(args, "apply", False)))
         if as_json:
             print(records_to_json(records))
@@ -1145,8 +1151,10 @@ def _main(parser: argparse.ArgumentParser, args: argparse.Namespace, command: st
                 print(f"{record.status}\t{record.action}\t{record.skill_name}\t{record.source}\t{record.target}")
         return 1 if any(record.action == "blocked" for record in records) else 0
     if command == "migrate-events":
+        assert_roadmap_authorized(repo, args.roadmap)
         return _migrate_events_command(repo=repo, dry_run=bool(args.dry_run), backup_suffix=args.backup_suffix)
     if command == "archive-state":
+        assert_roadmap_authorized(repo, args.roadmap)
         print(render_archive_result(
             archive_state(repo, reason=getattr(args, "reason", None), dry_run=bool(getattr(args, "dry_run", False))),
             as_json=as_json,

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/src/phase_loop_runtime/discovery.py

@@ -39,6 +39,7 @@ from .models import (
 )
 from .pipeline_adapter.flag import reconcile_git_reality_enabled
 from .provenance import phase_sha256, roadmap_sha256
+from .roadmap_authority import active_authorized_roadmap, assert_roadmap_authorized
 from .runtime_paths import phase_loop_state_read_file
 
 
@@ -413,28 +414,33 @@ def select_roadmap(repo: Path, explicit: str | Path | None = None) -> Path:
         path = Path(explicit).expanduser()
         if not path.is_absolute():
             path = repo / path
+        authorized = assert_roadmap_authorized(repo, path)
         if not path.exists():
             raise FileNotFoundError(f"roadmap not found: {path}")
-        return path.resolve()
+        return authorized
+
+    authority_roadmap = active_authorized_roadmap(repo)
+    if authority_roadmap is not None:
+        return authority_roadmap
 
     state_roadmap = active_state_roadmap(repo)
     if state_roadmap is not None:
-        return state_roadmap
+        return assert_roadmap_authorized(repo, state_roadmap)
 
     manifest_roadmap = manifest_backed_roadmap(repo)
     if manifest_roadmap is not None:
-        return manifest_roadmap
+        return assert_roadmap_authorized(repo, manifest_roadmap)
 
     handoff = latest_handoff_roadmap(repo_identity(repo), "codex-phase-roadmap-builder")
     if handoff is not None:
-        return handoff
+        return assert_roadmap_authorized(repo, handoff)
 
     candidates = sorted((repo / "specs").glob("phase-plans-v*.md"))
     if not candidates:
         raise FileNotFoundError("no specs/phase-plans-v*.md roadmap found")
     if len(candidates) != 1:
         raise AmbiguousRoadmapError([c.resolve() for c in candidates])
-    return candidates[0].resolve()
+    return assert_roadmap_authorized(repo, candidates[0])
 
 
 def active_state_roadmap(repo: Path) -> Path | None:

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/src/phase_loop_runtime/events.py

@@ -8,6 +8,7 @@ from pathlib import Path
 from .closeout import phase_loop_closeout_diagnostic
 from .git_topology import attach_git_topology, collect_git_topology
 from .models import LoopEvent, WorkUnitEventMetadata
+from .roadmap_authority import assert_roadmap_authorized
 from .runtime_paths import ensure_phase_loop_excluded, phase_loop_event_file, phase_loop_event_read_files
 
 
@@ -20,16 +21,17 @@ def event_read_paths(repo: Path) -> tuple[Path, ...]:
 
 
 def append_event(repo: Path, event: LoopEvent) -> None:
-    ensure_phase_loop_excluded(repo)
     event = _event_with_closeout_metadata(event)
     event = attach_git_topology(repo, event)
-    path = event_path(repo)
-    path.parent.mkdir(parents=True, exist_ok=True)
-    _append_jsonl(path, event.to_json())
+    append_payload(
+        repo,
+        event.to_json(),
+        roadmap=event.roadmap,
+    )
 
 
 def append_work_unit_event(repo: Path, event: WorkUnitEventMetadata, *, roadmap: Path | None = None) -> None:
-    ensure_phase_loop_excluded(repo)
+    authorized_roadmap = assert_roadmap_authorized(repo, roadmap)
     payload = event.to_json()
     closeout = _extract_work_unit_closeout(payload)
     if closeout is not None:
@@ -37,7 +39,7 @@ def append_work_unit_event(repo: Path, event: WorkUnitEventMetadata, *, roadmap:
     payload.update(
         {
             "repo": str(repo),
-            "roadmap": str(roadmap or ""),
+            "roadmap": str(roadmap or authorized_roadmap or ""),
             "phase": event.identity.phase,
             "action": "work_unit",
             "status": event.status,
@@ -46,6 +48,17 @@ def append_work_unit_event(repo: Path, event: WorkUnitEventMetadata, *, roadmap:
             "git_topology": collect_git_topology(repo),
         }
     )
+    append_payload(repo, payload, roadmap=roadmap or authorized_roadmap)
+
+
+def append_payload(
+    repo: Path,
+    payload: dict,
+    *,
+    roadmap: str | Path | None,
+) -> None:
+    assert_roadmap_authorized(repo, roadmap)
+    ensure_phase_loop_excluded(repo)
     path = event_path(repo)
     path.parent.mkdir(parents=True, exist_ok=True)
     _append_jsonl(path, payload)

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/src/phase_loop_runtime/pipeline_adapter/ratification.py

@@ -6,7 +6,7 @@ from pathlib import Path
 from typing import Any
 
 from ..git_topology import collect_git_topology
-from ..runtime_paths import ensure_phase_loop_excluded, phase_loop_event_file
+from ..events import append_payload
 from ..models import utc_now
 from .merge_policy import MergePolicy
 
@@ -21,12 +21,11 @@ def emit_ratification_passed(
     ratification_gate: str,
     merge_policy: MergePolicy,
     audit: dict[str, Any],
+    *,
+    roadmap_path: Path | None = None,
 ) -> None:
     repo = Path(repo_root)
     payload = _payload(repo, roadmap_version, phase_alias, ratification_gate, merge_policy, audit)
-    ensure_phase_loop_excluded(repo)
-    event_path = phase_loop_event_file(repo)
-    event_path.parent.mkdir(parents=True, exist_ok=True)
     event = {
         "timestamp": utc_now(),
         "repo": str(repo),
@@ -40,8 +39,11 @@ def emit_ratification_passed(
         "payload": payload,
         "git_topology": collect_git_topology(repo),
     }
-    with event_path.open("a", encoding="utf-8") as handle:
-        handle.write(json.dumps(event, sort_keys=True) + "\n")
+    append_payload(
+        repo,
+        event,
+        roadmap=roadmap_path or repo / "specs" / f"phase-plans-{roadmap_version}.md",
+    )
 
     trigger = repo / TRIGGER_PATH
     trigger.parent.mkdir(parents=True, exist_ok=True)

phase_loop_runtime-0.7.3/src/phase_loop_runtime/roadmap_authority.py

@@ -0,0 +1,204 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import stat
+from pathlib import Path
+
+
+SCHEMA = "phase_loop_roadmap_authority.v1"
+REQUIRED_MARKER = "phase_loop_roadmap_authority_required.v1\n"
+LATCH_MARKER = "phase_loop_roadmap_authority_latched.v1\n"
+
+
+class RoadmapAuthorityError(RuntimeError):
+    pass
+
+
+def roadmap_authority_file(repo: Path) -> Path:
+    return _git_common_path(repo, "phase-loop-roadmap-authority.json")
+
+
+def roadmap_authority_required_file(repo: Path) -> Path:
+    return _git_common_path(repo, "phase-loop-roadmap-authority-required")
+
+
+def roadmap_authority_latch_file(repo: Path) -> Path:
+    return _git_common_path(repo, "phase-loop-roadmap-authority-latch")
+
+
+def roadmap_authority_worktree_latch_file(repo: Path) -> Path:
+    return repo.resolve() / ".phase-loop" / "roadmap-authority-latch"
+
+
+def _git_common_path(repo: Path, name: str) -> Path:
+    git_entry = repo.resolve() / ".git"
+    if git_entry.is_dir():
+        common = git_entry
+    elif git_entry.is_file():
+        try:
+            line = git_entry.read_text(encoding="utf-8").strip()
+            if not line.startswith("gitdir: "):
+                raise ValueError
+            git_dir = Path(line.removeprefix("gitdir: "))
+            git_dir = git_dir if git_dir.is_absolute() else (repo / git_dir).resolve()
+            commondir = git_dir / "commondir"
+            if commondir.exists():
+                common_value = commondir.read_text(encoding="utf-8").strip()
+                common_path = Path(common_value)
+                common = common_path if common_path.is_absolute() else (git_dir / common_path).resolve()
+            else:
+                common = git_dir
+        except (OSError, UnicodeDecodeError, ValueError) as error:
+            raise RoadmapAuthorityError("roadmap authority marker path unavailable") from error
+    else:
+        common = git_entry
+    return common / name
+
+
+def active_authorized_roadmap(repo: Path) -> Path | None:
+    return assert_roadmap_authorized(repo, None)
+
+
+def assert_roadmap_authorized(
+    repo: Path,
+    roadmap: str | Path | None,
+) -> Path | None:
+    root = repo.resolve()
+    authority_path = roadmap_authority_file(root)
+    if not authority_path.exists():
+        _require_authority_not_removed(root)
+        return _resolve_roadmap(root, roadmap) if roadmap is not None and str(roadmap).strip() else None
+    _require_authority_installed(root, authority_path)
+    authority = _read_authority(authority_path)
+    if authority["status"] != "active":
+        raise RoadmapAuthorityError("roadmap authority is blocked")
+    active = _bound_path(root, authority["active_roadmap"])
+    retired = {_bound_path(root, item["path"]): item for item in authority["retired_roadmaps"]}
+    for path, item in retired.items():
+        blob = _bound_common_blob(authority_path.parent, item["common_blob"])
+        _require_control_mode(blob, 0o400)
+        if not blob.is_file() or _sha256(blob) != item["sha256"]:
+            raise RoadmapAuthorityError(f"retired roadmap digest mismatch: {path}")
+    target = active if roadmap is None or str(roadmap).strip() == "" else _resolve_roadmap(root, roadmap)
+    if target in retired:
+        raise RoadmapAuthorityError(f"roadmap retired: {target}")
+    if target != active:
+        raise RoadmapAuthorityError(f"roadmap is not active: {target}")
+    if active.is_file():
+        if _sha256(active) != authority["active_roadmap_sha256"]:
+            raise RoadmapAuthorityError(f"roadmap authority digest mismatch: {active}")
+    else:
+        raise RoadmapAuthorityError(f"roadmap authority digest mismatch: {active}")
+    return target
+
+
+def _read_authority(path: Path) -> dict:
+    try:
+        value = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as error:
+        raise RoadmapAuthorityError(f"invalid roadmap authority: {path}") from error
+    if not isinstance(value, dict) or set(value) != {
+        "schema",
+        "status",
+        "active_roadmap",
+        "active_roadmap_sha256",
+        "retired_roadmaps",
+    }:
+        raise RoadmapAuthorityError(f"invalid roadmap authority schema: {path}")
+    if value["schema"] != SCHEMA or value["status"] not in {"blocked", "active"} or not _digest(value["active_roadmap_sha256"]):
+        raise RoadmapAuthorityError(f"invalid roadmap authority binding: {path}")
+    retired = value["retired_roadmaps"]
+    if not isinstance(retired, list):
+        raise RoadmapAuthorityError(f"invalid retired roadmap set: {path}")
+    seen: set[str] = set()
+    for item in retired:
+        if not isinstance(item, dict) or set(item) != {"path", "sha256", "common_blob"}:
+            raise RoadmapAuthorityError(f"invalid retired roadmap binding: {path}")
+        if not isinstance(item["path"], str) or item["path"] in seen or not _digest(item["sha256"]) or not isinstance(item["common_blob"], str) or not item["common_blob"]:
+            raise RoadmapAuthorityError(f"invalid retired roadmap binding: {path}")
+        seen.add(item["path"])
+    return value
+
+
+def _require_authority_not_removed(repo: Path) -> None:
+    marker = roadmap_authority_required_file(repo)
+    latch = roadmap_authority_latch_file(repo)
+    worktree_latch = roadmap_authority_worktree_latch_file(repo)
+    if not marker.exists() and not latch.exists() and not worktree_latch.exists():
+        return
+    if worktree_latch.exists():
+        _read_control_file(worktree_latch, LATCH_MARKER, 0o400)
+    if latch.exists():
+        _read_control_file(latch, LATCH_MARKER, 0o400)
+    if marker.exists():
+        _read_control_file(marker, REQUIRED_MARKER, 0o400)
+    raise RoadmapAuthorityError("required roadmap authority is missing")
+
+
+def _require_authority_installed(repo: Path, authority: Path) -> None:
+    _require_control_mode(authority, 0o600)
+    _read_control_file(roadmap_authority_worktree_latch_file(repo), LATCH_MARKER, 0o400)
+    _read_control_file(roadmap_authority_required_file(repo), REQUIRED_MARKER, 0o400)
+    _read_control_file(roadmap_authority_latch_file(repo), LATCH_MARKER, 0o400)
+
+
+def _read_control_file(path: Path, expected: str, mode: int) -> None:
+    try:
+        value = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError) as error:
+        raise RoadmapAuthorityError("invalid roadmap authority required marker") from error
+    if value != expected:
+        raise RoadmapAuthorityError("invalid roadmap authority required marker")
+    _require_control_mode(path, mode)
+
+
+def _require_control_mode(path: Path, mode: int) -> None:
+    try:
+        metadata = path.stat()
+        common_owner = path.parent.stat().st_uid
+    except OSError as error:
+        raise RoadmapAuthorityError("invalid roadmap authority control file") from error
+    if os.name == "nt":
+        return
+    if metadata.st_uid != common_owner or stat.S_IMODE(metadata.st_mode) != mode or metadata.st_uid != os.geteuid():
+        raise RoadmapAuthorityError("invalid roadmap authority control file")
+
+
+def _resolve_roadmap(repo: Path, roadmap: str | Path | None) -> Path:
+    if roadmap is None or str(roadmap).strip() == "":
+        raise RoadmapAuthorityError("roadmap authority requires a roadmap path")
+    path = Path(roadmap).expanduser()
+    return (path if path.is_absolute() else repo / path).resolve()
+
+
+def _bound_common_blob(common: Path, value: str) -> Path:
+    path = Path(value)
+    if path.is_absolute():
+        raise RoadmapAuthorityError("retired roadmap blob escapes git common directory")
+    resolved = (common / path).resolve()
+    try:
+        resolved.relative_to(common.resolve())
+    except ValueError as error:
+        raise RoadmapAuthorityError("retired roadmap blob escapes git common directory") from error
+    return resolved
+
+
+def _bound_path(repo: Path, value: object) -> Path:
+    if not isinstance(value, str) or not value or Path(value).is_absolute():
+        raise RoadmapAuthorityError("roadmap authority paths must be repository-relative")
+    path = (repo / value).resolve()
+    try:
+        path.relative_to(repo)
+    except ValueError as error:
+        raise RoadmapAuthorityError("roadmap authority path escapes repository") from error
+    return path
+
+
+def _sha256(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def _digest(value: object) -> bool:
+    return isinstance(value, str) and len(value) == 64 and all(character in "0123456789abcdef" for character in value)

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/src/phase_loop_runtime/runner.py

@@ -68,6 +68,7 @@ from .closeout_evidence_audit import audit_closeout_evidence
 from .closeout import build_phase_loop_closeout, phase_loop_closeout_diagnostic
 from .consiliency_gates import scan_consiliency_gates
 from .docs_freshness import scan_docs_freshness
+from .roadmap_authority import active_authorized_roadmap
 from .closeout_validation import validate_produced_gates
 from .discovery import (
     PLAN_RE,
@@ -101,7 +102,7 @@ from .discovery import (
     verification_commands_from_plan,
 )
 from .dispatch_lock import DispatchLock, DispatchLockContention
-from .events import append_event, event_path, read_events
+from .events import append_event, append_payload, event_path, read_events
 from .fleet_metrics import record_phase_fleet_metrics
 from .evidence_audit import run_tier3_runner_audit
 from .evidence_audit_config import EvidenceAuditConfigError, load_evidence_audit_config
@@ -482,7 +483,7 @@ def _branchgov_orphan_blocker_before_dispatch(
     from .pipeline_adapter.branch_ops import roadmap_orphaned_by_branchgov
     from .pipeline_adapter.flag import branchgov_override_explicit
 
-    if branchgov_override_explicit():
+    if branchgov_override_explicit() and active_authorized_roadmap(repo) is None:
         return None
 
     roadmap_version = _roadmap_version(roadmap)
@@ -686,6 +687,7 @@ def _emit_ratification_if_reached(
             ratification_gate,
             merge_policy,
             _ratification_audit_payload(child_automation),
+            roadmap_path=roadmap,
         )
     except Exception as exc:
         return {
@@ -1753,8 +1755,8 @@ def run_loop(
                         provenance=branchgov_provenance,
                         preflight="roadmap_orphan",
                         next_action=(
-                            "Push the roadmap to the pipeline-branch base, or pass "
-                            "--allow-branchgov to switch anyway, before dispatch."
+                            "Push the roadmap to the pipeline-branch base before dispatch; "
+                            "authority-pinned roadmaps cannot be orphaned with --allow-branchgov."
                         ),
                     )
                     return (_DispatchOutcome("break", None), None)
@@ -6127,8 +6129,6 @@ def _append_tier3_audit_event(
     reasoning_effort: str,
     source: str,
 ) -> None:
-    path = event_path(repo)
-    path.parent.mkdir(parents=True, exist_ok=True)
     payload = {
         "timestamp": utc_now(),
         "repo": str(repo),
@@ -6144,8 +6144,7 @@ def _append_tier3_audit_event(
         "schema_version": 2,
         **event_provenance(roadmap, phase),
     }
-    with path.open("a", encoding="utf-8") as handle:
-        handle.write(json.dumps(payload, sort_keys=True) + "\n")
+    append_payload(repo, payload, roadmap=roadmap)
 
 
 def _attach_work_unit_metric(

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/src/phase_loop_runtime/state.py

@@ -7,6 +7,7 @@ from pathlib import Path
 
 from .git_topology import attach_git_topology
 from .models import StateSnapshot, WorkUnitState, utc_now
+from .roadmap_authority import assert_roadmap_authorized
 from .runtime_paths import ensure_phase_loop_excluded, phase_loop_state_file, phase_loop_state_read_file
 
 
@@ -19,6 +20,7 @@ def state_read_path(repo: Path) -> Path:
 
 
 def write_state(repo: Path, snapshot: StateSnapshot) -> None:
+    assert_roadmap_authorized(repo, snapshot.roadmap)
     ensure_phase_loop_excluded(repo)
     snapshot = attach_git_topology(repo, snapshot)
     path = state_path(repo)

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/src/phase_loop_runtime/task_message_broker_client.py

@@ -8,7 +8,7 @@ import json
 import queue
 import re
 import threading
-from typing import BinaryIO, Callable
+from typing import BinaryIO, Callable, Mapping
 from urllib.error import HTTPError, URLError
 from urllib.parse import urlsplit
 from urllib.request import HTTPRedirectHandler, Request, build_opener
@@ -16,7 +16,12 @@ from urllib.request import HTTPRedirectHandler, Request, build_opener
 import rfc8785
 
 from .task_message_broker import decode_strict_json
-from .task_message_resolver import APPROVAL_CONTRACT_VERSIONS, FAILURE_CODES, TaskMessageResolverError
+from .task_message_resolver import (
+    APPROVAL_CONTRACT_VERSIONS,
+    FAILURE_CODES,
+    TaskMessageResolverError,
+    approval_source_identity,
+)
 
 
 COMMIT_SHA = re.compile(r"[0-9a-f]{40}")
@@ -254,13 +259,19 @@ class TaskMessageBrokerClient:
             canonical = rfc8785.dumps(approval_document)
         except (TypeError, ValueError, json.JSONDecodeError):
             return False
+        source_identity = (
+            approval_source_identity(approval_document)
+            if isinstance(approval_document, dict)
+            else None
+        )
         return (
-            isinstance(approval_document, dict)
+            isinstance(source_identity, Mapping)
             and approval_document.get("contract_version") in APPROVAL_CONTRACT_VERSIONS
             and approval_document.get("authorized") is True
-            and approval_document.get("source_thread_id") == thread_id
-            and approval_document.get("source_message_id") == message_id
-            and approval_document.get("source_message_sha256") == hashlib.sha256(message_bytes).hexdigest()
+            and source_identity.get("source_thread_id") == thread_id
+            and source_identity.get("source_message_id") == message_id
+            and source_identity.get("source_message_sha256") == hashlib.sha256(message_bytes).hexdigest()
+            and source_identity.get("approval_message_id", f"{message_id}-approval") == f"{message_id}-approval"
             and hashlib.sha256(message_bytes).hexdigest() == payload["message_sha256"]
             and hashlib.sha256(approval_body_bytes).hexdigest() == payload["approval_body_sha256"]
             and hashlib.sha256(canonical).hexdigest() == payload["approval_canonical_sha256"]

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/src/phase_loop_runtime/task_message_resolver.py

@@ -25,10 +25,22 @@ FAILURE_CODES = frozenset(
     }
 )
 APPROVAL_CLIENT_ID_SUFFIX = "-approval"
-APPROVAL_CONTRACT_VERSIONS = frozenset({
+TOP_LEVEL_SOURCE_CONTRACT_VERSIONS = frozenset({
     "embedding_provenance_deploy_approval.v2",
     "embedding_provenance_bootstrap_approval.v3",
 })
+NESTED_SOURCE_CONTRACT_VERSIONS = frozenset({
+    "gpu0_unit_install_approval.v1",
+    "gpu0_prov_fence_approval.v1",
+    "gpu0_fence_fm_ack.v1",
+})
+APPROVAL_CONTRACT_VERSIONS = TOP_LEVEL_SOURCE_CONTRACT_VERSIONS | NESTED_SOURCE_CONTRACT_VERSIONS
+SOURCE_IDENTITY_KEYS = frozenset({
+    "source_thread_id",
+    "source_message_id",
+    "source_message_sha256",
+})
+NESTED_SOURCE_IDENTITY_KEYS = SOURCE_IDENTITY_KEYS | {"approval_message_id"}
 
 
 def _decode_strict_json(value: bytes) -> Any:
@@ -50,6 +62,23 @@ def _decode_strict_json(value: bytes) -> Any:
     )
 
 
+def approval_source_identity(approval: Mapping[str, Any]) -> Mapping[str, Any] | None:
+    """Select the exact source-identity location for a governed contract."""
+    contract_version = approval.get("contract_version")
+    if contract_version in TOP_LEVEL_SOURCE_CONTRACT_VERSIONS:
+        if "source" in approval or not SOURCE_IDENTITY_KEYS.issubset(approval):
+            return None
+        return approval
+    if contract_version not in NESTED_SOURCE_CONTRACT_VERSIONS:
+        return None
+    if any(key in approval for key in NESTED_SOURCE_IDENTITY_KEYS):
+        return None
+    source = approval.get("source")
+    if not isinstance(source, dict) or set(source) != NESTED_SOURCE_IDENTITY_KEYS:
+        return None
+    return source
+
+
 class TaskMessageResolverError(LookupError):
     """Fail-closed resolver result carrying only governed metadata."""
 
@@ -453,23 +482,25 @@ class CodexAppServerTaskMessageResolver:
             rfc8785.dumps(approval)
         except (TypeError, ValueError) as exc:
             raise self._error("approval_body_unavailable", thread_id, message_id) from exc
-        required_claims = {
-            "contract_version",
-            "authorized",
-            "source_thread_id",
-            "source_message_id",
-            "source_message_sha256",
-        }
         if (
-            not required_claims.issubset(approval)
-            or not isinstance(approval.get("contract_version"), str)
+            not isinstance(approval.get("contract_version"), str)
             or approval.get("contract_version") not in APPROVAL_CONTRACT_VERSIONS
             or approval.get("authorized") is not True
         ):
             raise self._error("approval_body_unavailable", thread_id, message_id)
-        if approval.get("source_thread_id") != thread_id or approval.get("source_message_id") != message_id:
+        source_identity = approval_source_identity(approval)
+        if source_identity is None:
+            raise self._error("approval_body_unavailable", thread_id, message_id)
+        if (
+            source_identity.get("source_thread_id") != thread_id
+            or source_identity.get("source_message_id") != message_id
+            or (
+                "approval_message_id" in source_identity
+                and source_identity.get("approval_message_id") != approval_message_id
+            )
+        ):
             raise self._error("source_identity_mismatch", thread_id, message_id)
-        if approval.get("source_message_sha256") != hashlib.sha256(message_bytes).hexdigest():
+        if source_identity.get("source_message_sha256") != hashlib.sha256(message_bytes).hexdigest():
             raise self._error("attestation_invalid", thread_id, message_id)
 
         source_started_at = source_turn.get("startedAt")

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/src/phase_loop_runtime.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.7.2
+Version: 0.7.3
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author: ViperJuice
 License-Expression: Apache-2.0

{phase_loop_runtime-0.7.2 → phase_loop_runtime-0.7.3}/src/phase_loop_runtime.egg-info/SOURCES.txt

@@ -79,6 +79,7 @@ src/phase_loop_runtime/release_guard.py
 src/phase_loop_runtime/render.py
 src/phase_loop_runtime/repo_validation.py
 src/phase_loop_runtime/review_summary.py
+src/phase_loop_runtime/roadmap_authority.py
 src/phase_loop_runtime/roadmap_lint.py
 src/phase_loop_runtime/route_log.py
 src/phase_loop_runtime/runner.py
@@ -684,6 +685,7 @@ tests/test_release_pin_autotrack.py
 tests/test_repo_validation.py
 tests/test_review_leg_sandbox.py
 tests/test_review_summary.py
+tests/test_roadmap_authority.py
 tests/test_route_log.py
 tests/test_route_policy_conformance.py
 tests/test_routing_invariants.py