platformforge 0.3.2__tar.gz → 0.3.3__tar.gz

{platformforge-0.3.2 → platformforge-0.3.3}/.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read

{platformforge-0.3.2 → platformforge-0.3.3}/CHANGELOG.md

@@ -1,5 +1,11 @@
 # CHANGELOG
 
+## [0.3.3] — 2026-11-10
+
+### Fixed
+
+- Published the Cycle 2.7 security certification baseline.
+
 ## [0.3.2] — 2026-11-04
 
 ### Fixed

{platformforge-0.3.2 → platformforge-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: platformforge
-Version: 0.3.2
+Version: 0.3.3
 Summary: Agentic Platform Engineering intelligence platform — deterministic, offline-first, evidence-first
 Project-URL: Homepage, https://github.com/EdgarSocrates98/platform-forge
 Project-URL: Repository, https://github.com/EdgarSocrates98/platform-forge

platformforge-0.3.3/VERSION_DUMP.cycle-2.7.json

@@ -0,0 +1,9 @@
+{
+  "cycle": "2.7",
+  "repository": "platform-forge",
+  "version": "0.3.3",
+  "tag": "v0.3.3",
+  "source_commit": "ab2ff78f135f3248fbb2848a9e8fc66226b64bac",
+  "version_source": "pyproject.toml and platformforge.__version__",
+  "verified_at": "2026-11-10"
+}

{platformforge-0.3.2 → platformforge-0.3.3}/docs/economy-parity/FINAL-REPORT.md

@@ -8,7 +8,7 @@ Authority & Final Freeze Alignment.
 
 | Field | Value |
 |---|---|
-| validated_sha | `d0e2ee0d4f40b020b1311c4e92e9142a45cc2abd` — functional commit the canonical gates ran against |
+| validated_sha | `10e23ba73199c62f953c9b62b569a39245857b68` — functional commit the canonical gates ran against |
 | closure_sha | the receipt-only commit landing this file — self-referential, so its SHA is what `HEAD` reports after that commit; the committed receipt records `closure_sha: null` by design (§65) |
 | receipt | `VALIDATION-RECEIPT.json` — `platformforge/economy-validation-receipt/v1`, generated by `python scripts/validate.py --economy-receipt` (two-pass: skeleton → self-referential gates → final) |
 | gates | 14 canonical `economy-*` gates — names derived from `GATES` in `scripts/validate.py`, never hand-listed |

{platformforge-0.3.2 → platformforge-0.3.3}/docs/economy-parity/VALIDATION-RECEIPT.json

@@ -11,75 +11,75 @@
     "economy-agentic": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_agents_waste.py tests/test_economy_evals.py -k uniqueness or debate or duplication or fanout or waste or stagnant",
-      "seconds": 2.32
+      "seconds": 4.81
     },
     "economy-budget": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_contracts.py -k budget or limit or protected or dimension",
-      "seconds": 1.61
+      "seconds": 1.46
     },
     "economy-cache": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_cache.py",
-      "seconds": 1.91
+      "seconds": 2.15
     },
     "economy-closure": {
       "ok": true,
       "reproduce": "python -c import sys\nfrom pathlib import Path\nreq = {'docs/economy-parity/FINAL-REPORT.md':\n         ['validated_sha', 'remote_ci', 'known gap'],\n       'docs/economy-parity/FINAL-MATRIX.md':\n         ['validated', 'externally-unverified'],\n       'docs/economy-parity/ECONOMY-BENCHMARKS.md':\n         ['Control Plane Overhead', 'End-to-End'],\n       'docs/economy/ROUTING.md':\n         ['decide', 'advisory'],\n       'docs/economy-parity/POLISH-BASELINE.md': ['drift']}\nbad = []\nfor f, needles in req.items():\n    p = Path(f)\n    if not p.is_file(): bad.append(('missing', f)); continue\n    txt = p.read_text()\n    for n in needles:\n        if n not in txt: bad.append((f, n))\nm = Path('docs/economy-parity/FINAL-MATRIX.md').read_text()\nif '\\n' + '|' in m and ' fully-production' in m:\n    bad.append(('matrix', 'overclaimed status'))\nif bad: print(bad); sys.exit(1)\nprint('closure docs coherent')\n && pytest -q tests/test_economy_closure.py",
-      "seconds": 2.36
+      "seconds": 2.37
     },
     "economy-context": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_gateway.py -k TestGateway or TestLazy or TestRole or Suff",
-      "seconds": 1.75
+      "seconds": 1.7
     },
     "economy-contracts": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_contracts.py tests/test_economy_v2.py",
-      "seconds": 2.13
+      "seconds": 2.42
     },
     "economy-evals": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_evals.py",
-      "seconds": 2.06
+      "seconds": 1.87
     },
     "economy-qpt": {
       "ok": true,
       "reproduce": "pytest -q tests/test_qpt_v2.py tests/test_economy_fleet_qpt.py",
-      "seconds": 2.82
+      "seconds": 5.43
     },
     "economy-receipt": {
       "ok": true,
       "reproduce": "python -c import json, re, subprocess, sys\nfrom pathlib import Path\nsys.path.insert(0, 'scripts')\nimport validate as V\np = Path(V.ECONOMY_RECEIPT_PATH)\nif not p.is_file():\n    print('missing receipt:', p); sys.exit(1)\nr = json.loads(p.read_text())\nbad = []\nif r.get('schema') != V.ECONOMY_RECEIPT_SCHEMA:\n    bad.append(('schema', r.get('schema')))\nvs = r.get('validated_sha') or ''\nok_sha = subprocess.run(['git','cat-file','-e',\n    vs + '^{commit}'], capture_output=True).returncode == 0\nif not ok_sha: bad.append(('validated_sha-not-a-commit', vs))\nhead = subprocess.run(['git','rev-parse','HEAD'],\n    capture_output=True, text=True).stdout.strip()\n# PR merge ref: HEAD^2 is the pushed branch tip \u2014 the Option-A\n# pair (functional commit + receipt commit) sits one level down.\nhead2 = subprocess.run(['git','rev-parse','HEAD^2'],\n    capture_output=True, text=True).stdout.strip()\nbase = head2 if __import__('re').fullmatch(r'[0-9a-f]{40}', head2) else head\nhead1 = subprocess.run(['git','rev-parse', base + '~1'],\n    capture_output=True, text=True).stdout.strip()\nif vs not in (base, head1):\n    bad.append(('validated_sha-stale', vs, head))\ncanon = set(V._economy_gate_names())\nextra = set(r.get('gates', {})) - canon\nif extra: bad.append(('noncanonical-gates', sorted(extra)))\npat = re.compile('tests/' + r'\\S+' + r'\\.py')\nfor g, e in r.get('gates', {}).items():\n    for t in pat.findall(e.get('reproduce') or ''):\n        if not Path(t).is_file():\n            bad.append(('dead-reproduce-path', g, t))\nif r.get('verdict') not in ('validated', 'failed'):\n    bad.append(('verdict', r.get('verdict')))\nif bad: print(bad); sys.exit(1)\nprint('receipt coherent:', len(r['gates']), 'gates,',\n      'sha bound')\n",
-      "seconds": 0.3
+      "seconds": 0.29
     },
     "economy-reconcile": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_gateway.py tests/test_economy_evals.py -k reconcil or mismatch or unobserved",
-      "seconds": 1.77
+      "seconds": 1.6
     },
     "economy-resume": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_gateway.py -k resume or checkpoint",
-      "seconds": 1.57
+      "seconds": 1.52
     },
     "economy-routing": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_evals.py -k routing or profile or champion or simple_task",
-      "seconds": 1.7
+      "seconds": 1.52
     },
     "economy-surface": {
       "ok": true,
       "reproduce": "python -c import subprocess, sys\ncmds = [\n [sys.executable,'-m','platformforge','economy','doctor'],\n [sys.executable,'-m','platformforge','economy','checkpoint','--run-id','gate',\n  '--spent','{\"tokens\":1}'],\n [sys.executable,'-m','platformforge','economy','resume','--run-id','gate'],\n [sys.executable,'-m','platformforge','economy','reconcile',\n  '--planned','{\"tokens\":1}','--observed','{\"tokens\":2}'],\n [sys.executable,'-m','platformforge','economy','explain','--run-id','gate'],\n [sys.executable,'-m','platformforge','cache','stats'],\n [sys.executable,'-m','platformforge','cache','gc'],\n [sys.executable,'-m','platformforge','context','capsule','--task','t',\n  '--facts','[{\"fact_id\":\"f\"}]'],\n [sys.executable,'-m','platformforge','context','gc'],\n [sys.executable,'-m','platformforge','routing','explain','--signal','{}'],\n [sys.executable,'-m','platformforge','routing','compare',\n  '--champion','{}','--challenger','{}'],\n]\nfor c in cmds:\n    r = subprocess.run(c, capture_output=True)\n    if r.returncode not in (0, 2):\n        print('FAIL', c, r.returncode, r.stderr[-300:])\n        sys.exit(1)\nprint('all economy verbs respond')\n",
-      "seconds": 5.66
+      "seconds": 6.83
     },
     "economy-verification": {
       "ok": true,
       "reproduce": "pytest -q tests/test_economy_pricing_verify.py",
-      "seconds": 1.74
+      "seconds": 1.66
     }
   },
-  "generated_at": "2026-11-04T21:08:20Z",
+  "generated_at": "2026-11-10T01:47:49Z",
   "kind": "platformforge/economy-validation-receipt/1",
   "known_gaps": [
     "real provider pricing catalog not bundled (declared-rates engine only, by design)",
@@ -93,7 +93,7 @@
   "remote_ci": "not independently verified",
   "schema": "platformforge/economy-validation-receipt/v1",
   "spec": "prompt_evo_economy.md",
-  "validated_sha": "402620b7603f1dcbc00c4d6246d67a9428c6361b",
+  "validated_sha": "73979f488654acadbf97bb8b0604bd095499366e",
   "validator": "scripts/validate.py",
   "validator_version": "economy-validation-receipt/v1",
   "verdict": "validated"

platformforge-0.3.3/forge.agentic.json

@@ -0,0 +1,87 @@
+{
+  "schema": "forge/SpecialistAgenticManifest/v1",
+  "provider": "platform-forge",
+  "version": "0.3.3",
+  "cli": "platformforge",
+  "cli_entry": "platformforge.cli.main:main",
+  "workflows": [
+    {
+      "id": "analyze",
+      "mode": "DIRECT_CAPABILITY",
+      "command": [
+        "{cli}",
+        "analyze",
+        "{target}"
+      ],
+      "description": "Analyze platform/IaC surfaces",
+      "read_only": true
+    },
+    {
+      "id": "doctor",
+      "mode": "DIAGNOSTIC_ONLY",
+      "command": [
+        "{cli}",
+        "doctor"
+      ],
+      "description": "Environment health",
+      "read_only": true
+    }
+  ],
+  "skills": [],
+  "agents": [
+    "pf-extractor",
+    "pf-graph-builder",
+    "pf-inventory",
+    "pf-judge",
+    "pf-reconciler",
+    "pf-simulator",
+    "pf-synthesizer",
+    "pf-verifier",
+    "platform-adversarial-critic",
+    "platform-ai-infra-specialist",
+    "platform-architecture-reviewer",
+    "platform-aws-specialist",
+    "platform-capacity-specialist",
+    "platform-change-coordinator",
+    "platform-crossplane-specialist",
+    "platform-debate-referee",
+    "platform-economy-reviewer",
+    "platform-evidence-reviewer",
+    "platform-federation-specialist",
+    "platform-finops-specialist",
+    "platform-fleet-coordinator",
+    "platform-fleet-specialist",
+    "platform-gitops-specialist",
+    "platform-graph-specialist",
+    "platform-iac-specialist",
+    "platform-incident-coordinator",
+    "platform-kubernetes-specialist",
+    "platform-operations-safety-reviewer",
+    "platform-optimization-coordinator",
+    "platform-orchestrator",
+    "platform-planner",
+    "platform-policy-specialist",
+    "platform-privacy-reviewer",
+    "platform-product-coordinator",
+    "platform-product-specialist",
+    "platform-release-guardian",
+    "platform-security-reviewer",
+    "platform-security-specialist",
+    "platform-sre-specialist",
+    "platform-task-spec-reviewer",
+    "platform-verifier"
+  ],
+  "coordinators": [],
+  "mcp_command": [
+    "platformforge-mcp"
+  ],
+  "host_adapters": [
+    "claude",
+    "devin",
+    "codex",
+    "copilot"
+  ],
+  "requires_network": false,
+  "requires_credentials": false,
+  "read_only_default": true
+}

{platformforge-0.3.2 → platformforge-0.3.3}/forge.json

@@ -12,8 +12,9 @@
     "mcp"
   ],
   "lab": {
+    "extras": [],
     "command": [
-      "{checkout}/.venv/bin/python",
+      "{python}",
       "scripts/lab/platformforge_lab.py",
       "--checkout",
       "{checkout}",

{platformforge-0.3.2 → platformforge-0.3.3}/platformforge/__init__.py

@@ -4,4 +4,4 @@ Deterministic-first, offline-first, evidence-first. The core never imports
 LLM SDKs, cloud SDKs, or MCP — those live behind optional adapters.
 """
 
-__version__ = "0.3.2"
+__version__ = "0.3.3"

{platformforge-0.3.2 → platformforge-0.3.3}/platformforge/context/capsule.py

@@ -14,6 +14,7 @@ SCHEMA = "platformforge/context-capsule/v1"
 
 SCOPES = ("repository", "resource", "cluster", "fleet", "incident",
           "operation", "service")            # §68
+CLASSIFICATIONS = ("public", "internal", "confidential", "restricted")
 
 # §111 — compression/projection may never strip these from a capsule.
 ESSENTIAL_FIELDS = ("facts", "findings", "open_questions")
@@ -26,6 +27,7 @@ class ContextCapsule:
     summary: str = ""
     task: str = ""
     scope: str = "repository"
+    classification: str = "internal"
     facts: list[Any] = field(default_factory=list)
     findings: list[Any] = field(default_factory=list)
     rules: list[str] = field(default_factory=list)
@@ -35,18 +37,24 @@ class ContextCapsule:
     open_questions: list[str] = field(default_factory=list)
     budget: dict[str, Any] = field(default_factory=dict)
     expandable: dict[str, str] = field(default_factory=dict)
+    warnings: list[str] = field(default_factory=list)
     # section name → context:// uri with full detail (§62)
 
     def __post_init__(self) -> None:
         if self.scope not in SCOPES:
             raise ValueError(f"scope {self.scope!r} not in {SCOPES}")
+        if self.classification not in CLASSIFICATIONS:
+            raise ValueError(
+                f"classification {self.classification!r} not in {CLASSIFICATIONS}"
+            )
 
     def to_dict(self) -> dict[str, Any]:
         return asdict(self)
 
     def serialize(self) -> bytes:
         return json.dumps(self.to_dict(), sort_keys=True,
-                          separators=(",", ":"), default=str).encode()
+                          separators=(",", ":"), ensure_ascii=False,
+                          default=str).encode("utf-8")
 
     @property
     def byte_size(self) -> int:

{platformforge-0.3.2 → platformforge-0.3.3}/platformforge/context/gateway.py

@@ -12,14 +12,17 @@ Essential evidence that cannot fit the budget is a refusal
 from __future__ import annotations
 
 import json
+import os
+import tempfile
 import time
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 
-from platformforge.context.capsule import ContextCapsule
+from platformforge.context.capsule import CLASSIFICATIONS, SCOPES, ContextCapsule
 from platformforge.context.refs import ContextRef
 from platformforge.context.sufficiency import ContextSufficiencyResult, Sufficiency, assess
+from platformforge.core.redaction import redact_text
 from platformforge.economy.cache import CacheStore
 from platformforge.economy.ledger import EconomyLedger, ToolUsageEntry
 
@@ -45,6 +48,7 @@ ROLE_SECTIONS: dict[str, tuple[str, ...]] = {
 class ContextRequest:
     task: str
     scope: str = "repository"
+    classification: str = "internal"
     budget_bytes: int | None = None          # soft context budget
     essential_bytes: int | None = None       # §235 — must-fit floor
     required_sections: list[str] = field(default_factory=list)
@@ -71,6 +75,11 @@ class ContextGateway:
     # -- build (pipeline §58) ------------------------------------------
     def build(self, req: ContextRequest) -> dict[str, Any]:
         t0 = time.monotonic()
+        schema_error = _validate_request(req)
+        if schema_error:
+            return {"refusal": "PF-CONTEXT-SCHEMA", "reason": schema_error}
+        if not req.task.strip():
+            return {"refusal": "PF-CONTEXT-SCHEMA", "reason": "task is required"}
         # 1–2. task + scope are inputs; 3–4. search/graph expansion is the
         # caller's job (facts/findings arrive already extracted — the
         # gateway assembles, it does not analyze).
@@ -83,15 +92,32 @@ class ContextGateway:
             "finding_id", f.get("rule_id", json.dumps(f, sort_keys=True,
                                                     default=str))))
 
+        safe_facts, fact_redacted = _redact_with_meta(facts)
+        safe_findings, finding_redacted = _redact_with_meta(findings)
+        safe_rules, rules_redacted = _redact_with_meta(req.rules)
+        safe_knowledge, knowledge_redacted = _redact_with_meta(req.knowledge_refs)
+        safe_graph, graph_redacted = _redact_with_meta(req.graph_refs)
+        safe_artifacts, artifacts_redacted = _redact_with_meta(req.artifact_refs)
+        safe_questions, questions_redacted = _redact_with_meta(req.open_questions)
+        redacted = any((fact_redacted, finding_redacted, rules_redacted,
+                        knowledge_redacted, graph_redacted, artifacts_redacted,
+                        questions_redacted))
+        warnings = [
+            "sensitive values were redacted before serialization"
+        ] if redacted else []
+
+        safe_task = _redact(req.task)
         capsule = ContextCapsule(
-            summary=f"{req.task} ({req.scope})",
-            task=req.task, scope=req.scope,
-            facts=facts, findings=findings, rules=req.rules,
-            knowledge_refs=req.knowledge_refs, graph_refs=req.graph_refs,
-            artifact_refs=req.artifact_refs,
-            open_questions=req.open_questions,
+            summary=f"{safe_task} ({req.scope})",
+            task=safe_task, scope=req.scope,
+            classification=req.classification,
+            facts=safe_facts, findings=safe_findings, rules=safe_rules,
+            knowledge_refs=safe_knowledge, graph_refs=safe_graph,
+            artifact_refs=safe_artifacts,
+            open_questions=safe_questions,
             budget={"budget_bytes": req.budget_bytes,
-                    "essential_bytes": req.essential_bytes})
+                    "essential_bytes": req.essential_bytes},
+            warnings=warnings)
 
         # 7. budget — essential evidence must fit or the capsule refuses
         size = capsule.byte_size
@@ -131,28 +157,63 @@ class ContextGateway:
 
     # -- lazy refs (§63–64) ---------------------------------------------
     def _persist(self, capsule: ContextCapsule) -> None:
-        # §224 — redact before persistence (the capsule holds refs; the
-        # payload sections may still carry sensitive text from callers)
-        blob = _redact(capsule.to_dict())
-        (self._store / f"{capsule.content_hash()}.json").write_text(
-            json.dumps(blob, sort_keys=True, default=str))
+        # The capsule is already redacted. Hash exactly the canonical bytes
+        # persisted so a ref is an integrity claim, never an authorization
+        # claim. Replace is atomic on the same filesystem.
+        blob = capsule.to_dict()
+        encoded = _canonical_bytes(blob)
+        digest = _digest(encoded)
+        if digest != capsule.content_hash():
+            raise ValueError("PF-CONTEXT-INTEGRITY: capsule hash is not canonical")
+        destination = self._store / f"{digest}.json"
+        fd, temporary = tempfile.mkstemp(
+            prefix=f".{digest}.", suffix=".tmp", dir=self._store
+        )
+        try:
+            with os.fdopen(fd, "wb") as handle:
+                handle.write(encoded)
+                handle.flush()
+                os.fsync(handle.fileno())
+            os.replace(temporary, destination)
+        finally:
+            try:
+                os.unlink(temporary)
+            except FileNotFoundError:
+                pass
 
     def inspect(self, ref: str) -> dict[str, Any]:
         """Resolve a `context://sha256/<hash>` ref to its stored capsule."""
-        digest = ContextRef.parse(ref).digest
+        try:
+            digest = ContextRef.parse(ref).digest
+        except (TypeError, ValueError):
+            return {"refusal": "PF-CONTEXT-REF-SCHEMA",
+                    "reason": "context reference must be context://sha256/<64 hex>"}
         p = self._store / f"{digest}.json"
         if not p.exists():
             return {"refusal": "PF-CONTEXT-REF-UNKNOWN",
                     "reason": f"no stored capsule for {ref}",
                     "unlock": "rebuild the context that minted the ref"}
-        return json.loads(p.read_text())
+        try:
+            blob = json.loads(p.read_bytes().decode("utf-8"))
+        except (OSError, UnicodeDecodeError, json.JSONDecodeError):
+            return {"refusal": "PF-CONTEXT-INTEGRITY",
+                    "reason": f"stored capsule is unreadable for {ref}"}
+        if _digest(_canonical_bytes(blob)) != digest:
+            return {"refusal": "PF-CONTEXT-INTEGRITY",
+                    "reason": f"stored capsule bytes do not match {ref}"}
+        return blob
 
-    def expand(self, ref: str, section: str = "") -> dict[str, Any]:
+    def expand(self, ref: str, section: str = "", *, principal: str = "",
+               allowed_classifications: tuple[str, ...] = ("public", "internal")) -> dict[str, Any]:
         """§63–64 — lazy expansion: return only the requested section
         (or the full capsule when section is empty)."""
         cap = self.inspect(ref)
         if "refusal" in cap:
             return cap
+        if cap.get("classification") in ("confidential", "restricted") and (
+                not principal or cap.get("classification") not in allowed_classifications):
+            return {"refusal": "PF-CONTEXT-AUTHORIZATION",
+                    "reason": "protected context requires an authorized principal and classification scope"}
         if section:
             if section not in cap:
                 return {"refusal": "PF-CONTEXT-SECTION-UNKNOWN",
@@ -211,6 +272,32 @@ def _dedup(items: list[dict[str, Any]], key) -> list[dict[str, Any]]:
     return out
 
 
+def _validate_request(req: ContextRequest) -> str:
+    """Validate the request boundary before touching or persisting payloads."""
+    if not isinstance(req.task, str):
+        return "task must be a string"
+    if req.scope not in SCOPES:
+        return f"scope must be one of {SCOPES}"
+    if req.classification not in CLASSIFICATIONS:
+        return f"classification must be one of {CLASSIFICATIONS}"
+    list_fields = (
+        "facts", "findings", "rules", "knowledge_refs", "graph_refs",
+        "artifact_refs", "open_questions", "required_sections",
+    )
+    for name in list_fields:
+        if not isinstance(getattr(req, name), list):
+            return f"{name} must be a list"
+    if not all(isinstance(section, str) and section for section in req.required_sections):
+        return "required_sections must contain non-empty strings"
+    for name in ("budget_bytes", "essential_bytes"):
+        value = getattr(req, name)
+        if value is not None and (
+            isinstance(value, bool) or not isinstance(value, int) or value < 0
+        ):
+            return f"{name} must be a non-negative integer or null"
+    return ""
+
+
 _SECRET_KEYS = ("password", "secret", "token", "api_key", "private_key",
                 "credential")
 
@@ -218,6 +305,8 @@ _SECRET_KEYS = ("password", "secret", "token", "api_key", "private_key",
 def _redact(obj: Any) -> Any:
     """§224 — boundary redaction before capsule persistence. Values whose
     key looks secret-shaped are replaced, never stored."""
+    if isinstance(obj, str):
+        return redact_text(obj)
     if isinstance(obj, dict):
         return {k: ("[REDACTED]" if any(s in str(k).lower()
                                         for s in _SECRET_KEYS)
@@ -225,3 +314,43 @@ def _redact(obj: Any) -> Any:
     if isinstance(obj, list):
         return [_redact(v) for v in obj]
     return obj
+
+
+def _redact_with_meta(obj: Any) -> tuple[Any, bool]:
+    """Redact recursively and report degradation instead of hiding it."""
+    if isinstance(obj, str):
+        safe = redact_text(obj)
+        return safe, safe != obj
+    if isinstance(obj, dict):
+        out: dict[Any, Any] = {}
+        changed = False
+        for key, value in obj.items():
+            if any(secret in str(key).lower() for secret in _SECRET_KEYS):
+                out[key] = "[REDACTED]"
+                changed = True
+            else:
+                out[key], child_changed = _redact_with_meta(value)
+                changed = changed or child_changed
+        return out, changed
+    if isinstance(obj, list):
+        values = []
+        changed = False
+        for value in obj:
+            safe, child_changed = _redact_with_meta(value)
+            values.append(safe)
+            changed = changed or child_changed
+        return values, changed
+    if isinstance(obj, tuple):
+        values, changed = _redact_with_meta(list(obj))
+        return values, changed
+    return obj, False
+
+
+def _canonical_bytes(value: Any) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"),
+                      ensure_ascii=False, default=str).encode("utf-8")
+
+
+def _digest(value: bytes) -> str:
+    import hashlib
+    return hashlib.sha256(value).hexdigest()

platformforge-0.3.3/platformforge/context/obsidian.py

@@ -0,0 +1,91 @@
+"""Read-only platform operations projection for federated Obsidian notes."""
+
+from __future__ import annotations
+
+import hashlib
+import re
+from datetime import datetime, timezone
+from typing import Any
+
+import yaml
+
+_SENSITIVE = ("secret", "token", "password", "credential", "access_key", "session_key")
+_SENSITIVE_TEXT = re.compile(
+    r"(?i)(\b(?:secret|token|password|credential|access[_-]?key|session[_-]?key)\s*[:=]\s*)([^\s,;]+)"
+)
+
+
+def _safe(value: Any, key: str = "") -> Any:
+    if any(marker in key.lower() for marker in _SENSITIVE):
+        return "[REDACTED]"
+    if isinstance(value, dict):
+        return {str(k): _safe(v, str(k)) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_safe(item, key) for item in value]
+    if isinstance(value, str):
+        return _SENSITIVE_TEXT.sub(r"\1[REDACTED]", value)
+    return value
+
+
+def _section(title: str, values: Any) -> list[str]:
+    safe = _safe(values)
+    if safe in (None, "", [], {}):
+        return [f"## {title}", "- None reported", ""]
+    return [f"## {title}", "```yaml", yaml.safe_dump(safe, sort_keys=True, allow_unicode=True).rstrip(), "```", ""]
+
+
+def build_obsidian_operations_review(
+    *,
+    title: str,
+    summary: str,
+    workspace: str,
+    vault_id: str,
+    incident: dict[str, Any] | None = None,
+    postmortem: dict[str, Any] | None = None,
+    runbooks: list[Any] | None = None,
+    terraform: list[Any] | None = None,
+    kubernetes: list[Any] | None = None,
+    adrs: list[Any] | None = None,
+    security_review: list[Any] | None = None,
+    note_path: str = "platform-operations/operations-review.md",
+    confidence: str = "unknown",
+    provenance: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    safe_title = str(_safe(title.strip() or "Platform operations review"))
+    safe_summary = str(_safe(summary.strip()))
+    metadata = _safe({
+        "type": "platform-operations-review",
+        "source": "platform-forge",
+        "classification": "internal",
+        "confidence": confidence,
+        "provenance": provenance or {},
+    })
+    lines = ["---", yaml.safe_dump(metadata, sort_keys=True, allow_unicode=True).rstrip(), "---",
+             f"# {safe_title}", "", safe_summary, ""]
+    lines += _section("Incident", incident)
+    lines += _section("Postmortem", postmortem)
+    lines += _section("Runbooks", runbooks)
+    lines += _section("Terraform", terraform)
+    lines += _section("Kubernetes", kubernetes)
+    lines += _section("ADRs", adrs)
+    lines += _section("Security review", security_review)
+    content = "\n".join(lines).rstrip() + "\n"
+    return {
+        "schema": "theforge/ObsidianNoteRef/v1",
+        "version": "v1",
+        "workspace": workspace,
+        "vault_id": vault_id,
+        "path": note_path,
+        "source": "platform-forge",
+        "classification": "internal",
+        "content_hash": hashlib.sha256(content.encode("utf-8")).hexdigest(),
+        "updated_at": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
+        "outcome": "projected",
+        "provenance": {"adapter": "platform-forge", **_safe(provenance or {})},
+        "content": content,
+        "warnings": [],
+        "unresolved": [],
+    }
+
+
+__all__ = ["build_obsidian_operations_review"]

{platformforge-0.3.2 → platformforge-0.3.3}/platformforge/context/refs.py

@@ -6,6 +6,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import string
 from dataclasses import dataclass
 from typing import Any
 
@@ -29,7 +30,7 @@ class ContextRef:
     def __post_init__(self) -> None:
         if self.scheme not in REF_SCHEMES:
             raise ValueError(f"unknown ref scheme {self.scheme!r}")
-        if len(self.digest) != 64:
+        if len(self.digest) != 64 or any(c not in string.hexdigits for c in self.digest):
             raise ValueError("ref digest must be sha256 (64 hex)")
 
     @property