prismnetwork 0.3.0__tar.gz → 0.3.2__tar.gz

{prismnetwork-0.3.0 → prismnetwork-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.5
+Metadata-Version: 2.4
 Name: prismnetwork
-Version: 0.3.0
+Version: 0.3.2
 Summary: Headless GPU leasing on Prism Network for autonomous agents. Wallet-signature auth, on-chain USDG payment, SSH.
 Project-URL: Homepage, https://prismnetwork.tech
 Project-URL: Source, https://github.com/prismnetwork-tech/prism
@@ -26,7 +26,7 @@ pip install prismnetwork
 ```python
 from prismnetwork import PrismAgent, DEFAULT_IMAGE
 
-agent = PrismAgent(private_key=AGENT_KEY, escrow="0x62C042265991bEa17B07229322A01850974626dA")
+agent = PrismAgent(private_key=AGENT_KEY, escrow="0xfD4228eEEfC49e4b76A0CD40af9fdd546220B2FD")
 agent.authenticate()
 
 lease = agent.lease(image=DEFAULT_IMAGE, duration_seconds=600, min_vram_mib=16000)
@@ -45,6 +45,39 @@ per-second; each lease settles on-chain with a verifiable receipt.
 
 Read-only helpers: `offers()`, `balances()`, `leases()`, `quote(...)`, `access(id)`.
 
+## Which machine answered
+
+Every session `run()` opens checks the SSH host key on the far end, and
+`host_key_policy(lease.access)` says what that check was worth:
+
+```python
+from prismnetwork import host_key_policy
+
+host_key_policy(lease.access)
+# {"mode": "attested" | "reported" | "unverified", "fingerprint": ..., "source": ...}
+```
+
+`attested` means the fingerprint comes out of a hardware report whose signed data
+commits to the key the guest generated at boot. Prism walks that report and puts
+the fingerprint on the access grant, and the SDK refuses a session whose host key
+does not match it, so the operator cannot put a different machine on the other
+end. The report is checked in our control plane rather than here, so `attested`
+says we checked it and this client holds the session to what we published.
+
+`reported` means the node named the key on the signed report that opened
+access, which rules out the relay and the network path but not the operator,
+whose bond is what a dispute reaches instead.
+
+`unverified` means nobody published a key: capacity brokered from a public
+cloud has its host key generated by the cloud and never shown to the network, so
+the key is recorded on first sight and held for the rest of the lease.
+
+Your own `~/.ssh/known_hosts` is never touched. The record sits beside the
+lease's private key and is removed with it by `end_lease()`.
+
+`PrismAgent(..., require_host_key=True)` refuses to open a session on a lease
+that publishes no key, rather than trusting whichever machine answers first.
+
 ## Batch
 
 Pass `command=` to `lease()` and the node runs that one command and reports its
@@ -60,10 +93,27 @@ broker path has no signed result channel. Commands are capped at 8 KiB and outpu
 at 64 KiB per stream. `result(lease_id)` and `wait_for_result(lease_id)` read the
 output of an already-funded batch lease.
 
+## Paying an x402 endpoint
+
+Prism's pay-per-call endpoints take a transfer plus a signature over what the
+transfer buys, so a payment can only be redeemed against the request it was made
+for. `payment_header` builds the `X-PAYMENT` value:
+
+```python
+from prismnetwork import payment_header
+
+body = json.dumps({"model": "llama3.2:3b", "prompt": "what is a prism"}).encode()
+header = payment_header(agent.account, tx_hash, body)
+```
+
+Pass the bytes the request actually carries. `bound_message` and `hash_request`
+are exported for a client that builds the envelope itself; they produce the same
+message the Node SDK signs.
+
 The wallet needs USDG (`0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168`, 6 decimals) and
 native Robinhood-Chain gas.
 
-Requires `ssh` and `ssh-keygen` on `PATH`. Chain id 4663, RPC
+Requires `ssh`, `ssh-keygen` and `ssh-keyscan` on `PATH`. Chain id 4663, RPC
 `https://rpc.mainnet.chain.robinhood.com`.
 
 Prism is pre-production and unaudited. A permissionless supplier is not a trusted

prismnetwork-0.3.2/README.md

@@ -0,0 +1,106 @@
+# prismnetwork
+
+Headless GPU leasing on [Prism Network](https://prismnetwork.tech) for autonomous
+agents, the Python counterpart to `@prismnetwork/agent-sdk`. Give it a wallet; it
+authenticates with a signature, pays on-chain in USDG, provisions a GPU, and runs
+over SSH. No browser, no dashboard.
+
+```sh
+pip install prismnetwork
+```
+
+```python
+from prismnetwork import PrismAgent, DEFAULT_IMAGE
+
+agent = PrismAgent(private_key=AGENT_KEY, escrow="0xfD4228eEEfC49e4b76A0CD40af9fdd546220B2FD")
+agent.authenticate()
+
+lease = agent.lease(image=DEFAULT_IMAGE, duration_seconds=600, min_vram_mib=16000)
+out = agent.run(lease, "nvidia-smi")
+print(out["stdout"])
+agent.end_lease(lease)
+```
+
+## What it does
+
+`authenticate()` signs a challenge with the wallet and exchanges it for a bearer
+session. `lease()` gets a quote, funds an on-chain USDG escrow bound to the quote
+(`createLease`), waits for the GPU to provision, and returns SSH access. `run()`
+executes a command over SSH, retrying through the host's sshd warmup. Metering is
+per-second; each lease settles on-chain with a verifiable receipt.
+
+Read-only helpers: `offers()`, `balances()`, `leases()`, `quote(...)`, `access(id)`.
+
+## Which machine answered
+
+Every session `run()` opens checks the SSH host key on the far end, and
+`host_key_policy(lease.access)` says what that check was worth:
+
+```python
+from prismnetwork import host_key_policy
+
+host_key_policy(lease.access)
+# {"mode": "attested" | "reported" | "unverified", "fingerprint": ..., "source": ...}
+```
+
+`attested` means the fingerprint comes out of a hardware report whose signed data
+commits to the key the guest generated at boot. Prism walks that report and puts
+the fingerprint on the access grant, and the SDK refuses a session whose host key
+does not match it, so the operator cannot put a different machine on the other
+end. The report is checked in our control plane rather than here, so `attested`
+says we checked it and this client holds the session to what we published.
+
+`reported` means the node named the key on the signed report that opened
+access, which rules out the relay and the network path but not the operator,
+whose bond is what a dispute reaches instead.
+
+`unverified` means nobody published a key: capacity brokered from a public
+cloud has its host key generated by the cloud and never shown to the network, so
+the key is recorded on first sight and held for the rest of the lease.
+
+Your own `~/.ssh/known_hosts` is never touched. The record sits beside the
+lease's private key and is removed with it by `end_lease()`.
+
+`PrismAgent(..., require_host_key=True)` refuses to open a session on a lease
+that publishes no key, rather than trusting whichever machine answers first.
+
+## Batch
+
+Pass `command=` to `lease()` and the node runs that one command and reports its
+output instead of granting SSH access:
+
+```python
+batch = agent.lease(image=DEFAULT_IMAGE, duration_seconds=600, command="nvidia-smi")
+print(batch.result["stdout"])
+```
+
+Batch leases match only suppliers at trust class `isolated` or above, because the
+broker path has no signed result channel. Commands are capped at 8 KiB and output
+at 64 KiB per stream. `result(lease_id)` and `wait_for_result(lease_id)` read the
+output of an already-funded batch lease.
+
+## Paying an x402 endpoint
+
+Prism's pay-per-call endpoints take a transfer plus a signature over what the
+transfer buys, so a payment can only be redeemed against the request it was made
+for. `payment_header` builds the `X-PAYMENT` value:
+
+```python
+from prismnetwork import payment_header
+
+body = json.dumps({"model": "llama3.2:3b", "prompt": "what is a prism"}).encode()
+header = payment_header(agent.account, tx_hash, body)
+```
+
+Pass the bytes the request actually carries. `bound_message` and `hash_request`
+are exported for a client that builds the envelope itself; they produce the same
+message the Node SDK signs.
+
+The wallet needs USDG (`0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168`, 6 decimals) and
+native Robinhood-Chain gas.
+
+Requires `ssh`, `ssh-keygen` and `ssh-keyscan` on `PATH`. Chain id 4663, RPC
+`https://rpc.mainnet.chain.robinhood.com`.
+
+Prism is pre-production and unaudited. A permissionless supplier is not a trusted
+computing environment; do not lease with a wallet or workload you cannot lose.

{prismnetwork-0.3.0 → prismnetwork-0.3.2}/examples/quickstart.py

@@ -1,7 +1,7 @@
 """Authenticate a wallet, list GPUs, and optionally lease one and run a command.
 
     PRISM_AGENT_KEY=0x<agent wallet private key> \\
-    PRISM_ESCROW=0x62C042265991bEa17B07229322A01850974626dA \\
+    PRISM_ESCROW=0xfD4228eEEfC49e4b76A0CD40af9fdd546220B2FD \\
     python quickstart.py
 
 By default this authenticates and lists GPUs without spending. Set PRISM_RUN_LEASE=1

{prismnetwork-0.3.0 → prismnetwork-0.3.2}/prismnetwork/__init__.py

@@ -6,8 +6,10 @@ from ._agent import (
     Lease,
     PrismAgent,
     PrismError,
+    host_key_policy,
 )
 
+from ._x402 import bound_message, hash_request, payment_header
 from .toolkit import DEFAULT_ESCROW, PrismToolset, agent_from_env
 
 __all__ = [
@@ -21,5 +23,9 @@ __all__ = [
     "DEFAULT_IMAGE",
     "TRUST_CLASSES",
     "USDG",
+    "host_key_policy",
+    "bound_message",
+    "hash_request",
+    "payment_header",
 ]
-__version__ = "0.3.0"
+__version__ = "0.3.2"

{prismnetwork-0.3.0 → prismnetwork-0.3.2}/prismnetwork/_agent.py

@@ -1,5 +1,8 @@
 from __future__ import annotations
 
+import base64
+import hashlib
+import os
 import re
 import shutil
 import subprocess
@@ -101,7 +104,8 @@ class PrismAgent:
     signature, pay on-chain in USDG, provision, and run over SSH."""
 
     def __init__(self, private_key: str, escrow: str,
-                 api_base: str = "https://prismnetwork.tech", rpc_url: str = ROBINHOOD_RPC):
+                 api_base: str = "https://prismnetwork.tech", rpc_url: str = ROBINHOOD_RPC,
+                 require_host_key: bool = False):
         if not escrow:
             raise ValueError("escrow address is required")
         if not isinstance(private_key, str) or not private_key.strip():
@@ -118,6 +122,11 @@ class PrismAgent:
         self._usdg = self.w3.eth.contract(address=USDG, abi=_ERC20)
         self._escrow = self.w3.eth.contract(address=self.escrow, abi=_ESCROW)
         self.session: str | None = None
+        # Off by default because most capacity publishes no host key, and
+        # refusing those leases would take the network's own supply away from
+        # callers who never asked for the guarantee. On, nothing runs anywhere
+        # the grant cannot name.
+        self.require_host_key = require_host_key
 
     @property
     def address(self) -> str:
@@ -288,18 +297,28 @@ class PrismAgent:
         if not a.get("ssh_host") or not a.get("ssh_port"):
             raise PrismError(400, "ssh_access_unavailable",
                              {"mode": a.get("mode"), "lease_id": lease.lease_id})
-        args = ["ssh", "-i", lease.key_path, "-p", str(a["ssh_port"]),
-                "-o", "StrictHostKeyChecking=no", "-o", "UserKnownHostsFile=/dev/null",
-                "-o", "BatchMode=yes", "-o", "ConnectTimeout=15",
-                f"{a.get('ssh_user', 'root')}@{a['ssh_host']}", command]
         last = None
         for attempt in range(connect_retries + 1):
             try:
-                p = subprocess.run(args, capture_output=True, text=True, timeout=timeout + 20,
-                                   input=stdin if stdin is not None else "")
-                res = {"code": p.returncode, "stdout": p.stdout.strip(), "stderr": p.stderr.strip()}
-            except subprocess.TimeoutExpired:
-                res = {"code": -1, "stdout": "", "stderr": "timed out"}
+                host_key = _host_key_args(a["ssh_host"], a["ssh_port"], lease.key_path, a,
+                                          self.require_host_key)
+            except PrismError as e:
+                # A box that is still coming up has nothing listening to read a
+                # key from, which is the same wait this loop already exists for.
+                # Being answered by the wrong machine is not a wait.
+                if e.code != "host_key_unavailable":
+                    raise
+                res = {"code": 255, "stdout": "", "stderr": f"ssh: {e.code}"}
+            else:
+                args = ["ssh", "-i", lease.key_path, "-p", str(a["ssh_port"]), *host_key,
+                        "-o", "BatchMode=yes", "-o", "ConnectTimeout=15",
+                        f"{a.get('ssh_user', 'root')}@{a['ssh_host']}", command]
+                try:
+                    p = subprocess.run(args, capture_output=True, text=True, timeout=timeout + 20,
+                                       input=stdin if stdin is not None else "")
+                    res = {"code": p.returncode, "stdout": p.stdout.strip(), "stderr": p.stderr.strip()}
+                except subprocess.TimeoutExpired:
+                    res = {"code": -1, "stdout": "", "stderr": "timed out"}
             if not _is_ssh_warmup(res):
                 return res
             last = res
@@ -401,6 +420,129 @@ def _safe_json(res):
         return None
 
 
+# Checking which machine answered.
+#
+# A lease hands the renter an address and a private key. Until the host key on
+# the other end is checked, anything that can reach that address can take the
+# session, read the work and answer as if it were the GPU. What the network can
+# say about that key differs by where the capacity came from, so the decision is
+# made here rather than defaulted: a grant that names a fingerprint is checked
+# before the session opens, and a grant that names none has its key recorded on
+# first sight and held for the rest of the lease. The record lives beside the
+# lease's private key and goes when the lease does; the caller's own
+# ~/.ssh/known_hosts is never touched.
+
+_SCAN_TIMEOUT = 10
+
+
+def host_key_policy(access: dict | None) -> dict:
+    """What the network is willing to say about the machine behind a grant.
+
+    ``attested`` is the only one that survives a hostile operator: the
+    fingerprint comes out of a report the processor signed. ``reported`` is the
+    operator's word under their bonded device key, which rules out everyone
+    between them and the renter. ``unverified`` means nobody published a key and
+    the first connection decides.
+    """
+    fingerprint = (access or {}).get("channel_key_fingerprint")
+    if not fingerprint:
+        return {"mode": "unverified", "fingerprint": None, "source": None}
+    source = access.get("channel_key_source")
+    return {
+        "mode": "attested" if source == "snp_report" else "reported",
+        "fingerprint": fingerprint,
+        "source": source,
+    }
+
+
+def _known_hosts_path(key_path: str) -> str:
+    return os.path.join(os.path.dirname(key_path), "known_hosts")
+
+
+def _known_hosts_fingerprint(line: str) -> str | None:
+    """The ``ssh-keygen -lf`` form of the key in a known_hosts line. The control
+    plane publishes fingerprints in exactly this form, so the two are compared
+    as strings."""
+    fields = line.strip().split()
+    if len(fields) < 3:
+        return None
+    try:
+        raw = base64.b64decode(fields[2], validate=True)
+    except Exception:
+        return None
+    if not raw:
+        return None
+    return "SHA256:" + base64.b64encode(hashlib.sha256(raw).digest()).decode().rstrip("=")
+
+
+def _host_field(host: str, port) -> str:
+    return str(host) if int(port) == 22 else f"[{host}]:{port}"
+
+
+def _already_pinned(path: str, host: str, port, fingerprint: str) -> bool:
+    # The relay hands out a fresh local port for every session, so a record that
+    # names the right key under the wrong address is a record ssh will refuse to
+    # use. Both halves have to match for the scan to be worth skipping.
+    try:
+        with open(path) as handle:
+            lines = handle.read().splitlines()
+    except OSError:
+        return False
+    return any(line.split()[:1] == [_host_field(host, port)]
+               and _known_hosts_fingerprint(line) == fingerprint for line in lines if line.strip())
+
+
+def _pin_host_key(host: str, port, fingerprint: str, path: str) -> None:
+    """Read the host key off the wire and record it only if it is the one the
+    grant named.
+
+    Done as a separate exchange before ssh runs, because a fingerprint cannot be
+    turned into a known_hosts entry without the key itself, and letting ssh learn
+    the key first would mean trusting it to find out whether it should have.
+    ``ssh-keyscan`` reads the key the server offers and hangs up, so nothing the
+    machine could use is sent.
+    """
+    if _already_pinned(path, host, port, fingerprint):
+        return
+    try:
+        scan = subprocess.run(["ssh-keyscan", "-T", str(_SCAN_TIMEOUT), "-p", str(port), str(host)],
+                              capture_output=True, text=True, timeout=_SCAN_TIMEOUT + 5)
+        offered = [l for l in scan.stdout.splitlines() if l and not l.startswith("#")]
+    except (OSError, subprocess.TimeoutExpired) as e:
+        raise PrismError(503, "host_key_unavailable", {"host": host, "port": port, "cause": str(e)}) from e
+    if not offered:
+        raise PrismError(503, "host_key_unavailable",
+                         {"host": host, "port": port, "cause": (scan.stderr or "").strip()[:200]})
+    for line in offered:
+        if _known_hosts_fingerprint(line) == fingerprint:
+            # Only the key that matched. Writing everything the machine offered
+            # would pin keys nobody vouched for alongside the one that was
+            # checked.
+            with open(os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600), "w") as handle:
+                handle.write(line + "\n")
+            return
+    raise PrismError(502, "host_key_mismatch", {
+        "expected": fingerprint,
+        "offered": [f for f in (_known_hosts_fingerprint(l) for l in offered) if f],
+        "hint": "the machine answering is not the one the lease names; nothing was sent to it",
+    })
+
+
+def _host_key_args(host, port, key_path: str, access: dict | None, require_host_key: bool) -> list:
+    """The ssh options that make the connection check the machine it reaches."""
+    path = _known_hosts_path(key_path)
+    policy = host_key_policy(access)
+    if policy["fingerprint"] is None:
+        if require_host_key:
+            raise PrismError(400, "host_key_unpublished", {
+                "mode": (access or {}).get("mode"),
+                "hint": "this lease publishes no host key, so which machine answers cannot be checked",
+            })
+        return ["-o", f"UserKnownHostsFile={path}", "-o", "StrictHostKeyChecking=accept-new"]
+    _pin_host_key(host, port, policy["fingerprint"], path)
+    return ["-o", f"UserKnownHostsFile={path}", "-o", "StrictHostKeyChecking=yes"]
+
+
 def _is_ssh_warmup(res: dict) -> bool:
     if res["code"] != 255:
         return False

prismnetwork-0.3.2/prismnetwork/_x402.py

@@ -0,0 +1,48 @@
+"""What a payer signs on Prism's legacy x402 rail.
+
+The transfer is already on chain by the time the header is sent, so the header
+only says who made it. Signing the transaction hash alone proves who paid and
+not what for: anyone who read the header in flight could put their own command
+in front of it and spend someone else's transfer. The request travels inside the
+signed message, and the endpoint checks it against the request that arrived.
+
+This is the construction the Node SDK signs in ``sdk/x402.mjs``, and
+``tests/test_x402.py`` holds the two against each other.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+
+from eth_account.messages import encode_defunct
+
+
+def hash_request(payload) -> str:
+    """The digest both sides compare: the command for a job, the request bytes
+    for a generation. Text is hashed as UTF-8, which is how it goes on the wire."""
+    data = payload.encode("utf-8") if isinstance(payload, str) else bytes(payload)
+    return hashlib.sha256(data).hexdigest()
+
+
+def bound_message(tx_hash: str, request_hash: str) -> str:
+    return f"prism-x402:v2\n{str(tx_hash).lower()}\n{request_hash}"
+
+
+def payment_header(account, tx_hash: str, body, network: str | None = None) -> str:
+    """The ``X-PAYMENT`` value for one paid request: the transfer that funded it,
+    and a signature over that transfer together with the exact bytes being sent.
+
+    ``body`` has to be the bytes the request actually carries. Re-encoding a dict
+    here would sign something the endpoint never receives.
+    """
+    signed = account.sign_message(encode_defunct(text=bound_message(tx_hash, hash_request(body))))
+    signature = signed.signature.hex()
+    envelope = {
+        "txHash": tx_hash,
+        "signature": signature if signature.startswith("0x") else "0x" + signature,
+    }
+    if network:
+        envelope["network"] = network
+    return base64.b64encode(json.dumps(envelope, separators=(",", ":")).encode("utf-8")).decode("ascii")

{prismnetwork-0.3.0 → prismnetwork-0.3.2}/prismnetwork/toolkit.py

@@ -22,7 +22,7 @@ import requests
 
 from ._agent import DEFAULT_IMAGE, MAX_COMMAND_BYTES, TRUST_CLASSES, Lease, PrismAgent, PrismError
 
-DEFAULT_ESCROW = "0x62C042265991bEa17B07229322A01850974626dA"
+DEFAULT_ESCROW = "0xfD4228eEEfC49e4b76A0CD40af9fdd546220B2FD"
 PUBLIC_API = "https://api.prismnetwork.tech"
 
 NO_WALLET = (

{prismnetwork-0.3.0 → prismnetwork-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "prismnetwork"
-version = "0.3.0"
+version = "0.3.2"
 description = "Headless GPU leasing on Prism Network for autonomous agents. Wallet-signature auth, on-chain USDG payment, SSH."
 readme = "README.md"
 requires-python = ">=3.10"

prismnetwork-0.3.2/tests/test_hostkey.py

@@ -0,0 +1,128 @@
+"""What a renter's client does about the machine on the other end of a lease."""
+
+from __future__ import annotations
+
+import os
+import shutil
+import socket
+import subprocess
+import tempfile
+import time
+import unittest
+
+from prismnetwork import PrismError, host_key_policy
+from prismnetwork._agent import _host_key_args, _known_hosts_fingerprint, _known_hosts_path
+
+SSHD = "/usr/sbin/sshd"
+
+
+def free_port() -> int:
+    with socket.socket() as probe:
+        probe.bind(("127.0.0.1", 0))
+        return probe.getsockname()[1]
+
+
+def reachable(port: int) -> bool:
+    with socket.socket() as probe:
+        probe.settimeout(0.2)
+        return probe.connect_ex(("127.0.0.1", port)) == 0
+
+
+def generate_key(directory: str, name: str) -> tuple:
+    path = os.path.join(directory, name)
+    subprocess.run(["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f", path], check=True)
+    listed = subprocess.run(["ssh-keygen", "-lf", path + ".pub"], capture_output=True, text=True, check=True)
+    return path, listed.stdout.split()[1]
+
+
+def serve_sshd(directory: str, host_key: str, port: int):
+    """A real sshd, because what is being tested is whether the key the network
+    named is the key the machine actually offers. Nothing logs in: ssh-keyscan
+    reads the host key out of the exchange and hangs up."""
+    config = os.path.join(directory, "sshd_config")
+    with open(config, "w") as handle:
+        handle.write(f"Port {port}\nListenAddress 127.0.0.1\nHostKey {host_key}\n"
+                     "PasswordAuthentication no\nStrictModes no\n")
+    child = subprocess.Popen([SSHD, "-D", "-e", "-f", config],
+                             stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    for _ in range(50):
+        if reachable(port):
+            return child
+        time.sleep(0.1)
+    child.kill()
+    raise AssertionError("sshd did not come up")
+
+
+def stop(child):
+    child.kill()
+    child.wait()
+
+
+class HostKeyTest(unittest.TestCase):
+    def setUp(self):
+        self.dir = tempfile.mkdtemp(prefix="prism-hostkey-")
+        self.addCleanup(shutil.rmtree, self.dir, True)
+        self.key_path = os.path.join(self.dir, "id_ed25519")
+        open(self.key_path, "w").close()
+        self.known = _known_hosts_path(self.key_path)
+
+    @unittest.skipUnless(os.path.exists(SSHD), "no sshd to serve a host key")
+    def test_a_published_fingerprint_is_checked_against_the_machine_that_answers(self):
+        served, fingerprint = generate_key(self.dir, "served")
+        port = free_port()
+        sshd = serve_sshd(self.dir, served, port)
+        self.addCleanup(stop, sshd)
+
+        args = _host_key_args("127.0.0.1", port, self.key_path,
+                              {"channel_key_fingerprint": fingerprint, "channel_key_source": "node_report"},
+                              False)
+        self.assertEqual(args, ["-o", f"UserKnownHostsFile={self.known}", "-o", "StrictHostKeyChecking=yes"])
+        with open(self.known) as handle:
+            recorded = handle.read().strip().splitlines()
+        self.assertEqual(len(recorded), 1, "only the key that was checked is recorded")
+        self.assertEqual(recorded[0].split()[0], f"[127.0.0.1]:{port}")
+        self.assertEqual(_known_hosts_fingerprint(recorded[0]), fingerprint)
+
+        # A grant naming a key the machine does not hold has to fail before
+        # anything is sent to it.
+        os.remove(self.known)
+        _, other = generate_key(self.dir, "other")
+        with self.assertRaises(PrismError) as caught:
+            _host_key_args("127.0.0.1", port, self.key_path, {"channel_key_fingerprint": other}, False)
+        self.assertEqual(caught.exception.code, "host_key_mismatch")
+        self.assertEqual(caught.exception.body["offered"], [fingerprint])
+        self.assertFalse(os.path.exists(self.known), "a machine that failed the check is not recorded")
+
+    def test_an_unreachable_box_reads_as_a_wait_rather_than_a_wrong_machine(self):
+        with self.assertRaises(PrismError) as caught:
+            _host_key_args("127.0.0.1", free_port(), self.key_path,
+                           {"channel_key_fingerprint": "SHA256:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU"},
+                           False)
+        self.assertEqual(caught.exception.code, "host_key_unavailable")
+
+    def test_a_lease_that_publishes_no_key_is_pinned_on_first_sight_or_refused(self):
+        args = _host_key_args("127.0.0.1", 2222, self.key_path, {"mode": "direct_ssh"}, False)
+        self.assertEqual(args, ["-o", f"UserKnownHostsFile={self.known}",
+                                "-o", "StrictHostKeyChecking=accept-new"])
+        self.assertNotIn("StrictHostKeyChecking=no", args)
+        self.assertNotIn("UserKnownHostsFile=/dev/null", args)
+
+        with self.assertRaises(PrismError) as caught:
+            _host_key_args("127.0.0.1", 2222, self.key_path, {"mode": "direct_ssh"}, True)
+        self.assertEqual(caught.exception.code, "host_key_unpublished")
+
+    def test_the_grant_says_which_claim_it_is_making_about_the_host_key(self):
+        attested = {"channel_key_fingerprint": "SHA256:a", "channel_key_source": "snp_report"}
+        reported = {"channel_key_fingerprint": "SHA256:a", "channel_key_source": "node_report"}
+        self.assertEqual(host_key_policy(attested),
+                         {"mode": "attested", "fingerprint": "SHA256:a", "source": "snp_report"})
+        self.assertEqual(host_key_policy(reported),
+                         {"mode": "reported", "fingerprint": "SHA256:a", "source": "node_report"})
+        self.assertEqual(host_key_policy({"mode": "direct_ssh"}),
+                         {"mode": "unverified", "fingerprint": None, "source": None})
+        self.assertEqual(host_key_policy(None),
+                         {"mode": "unverified", "fingerprint": None, "source": None})
+
+
+if __name__ == "__main__":
+    unittest.main()

prismnetwork-0.3.2/tests/test_x402.py

@@ -0,0 +1,99 @@
+"""The payment binding, and whether this SDK signs the same bytes the Node one does."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import shutil
+import subprocess
+import unittest
+from pathlib import Path
+
+from eth_account import Account
+from eth_account.messages import encode_defunct
+
+from prismnetwork import bound_message, hash_request, payment_header
+
+TX = "0x" + "ab" * 32
+KEY = "0x" + "33" * 32
+
+# The Node definition these functions are a port of. Absent from an installed
+# wheel, present in a checkout, which is where the comparison is worth making.
+NODE_MODULE = Path(__file__).resolve().parents[2] / "sdk" / "x402.mjs"
+
+VECTORS = [
+    (TX, "nvidia-smi"),
+    (TX.upper().replace("0X", "0x"), "nvidia-smi"),
+    ("0x" + "0" * 64, ""),
+    (TX, '{"model":"llama3.2:3b","prompt":"quelle heure est-il à Paris"}'),
+    (TX, "\U0001f680 run it"),
+]
+
+
+def node_says(vectors):
+    """What ``sdk/x402.mjs`` produces for the same inputs, out of a real node."""
+    script = """
+        import { boundMessage, hashRequest } from %s;
+        const answers = JSON.parse(process.argv[1]).map(([tx, payload]) => [
+          hashRequest(payload),
+          boundMessage(tx, hashRequest(payload)),
+        ]);
+        console.log(JSON.stringify(answers));
+    """ % json.dumps(str(NODE_MODULE))
+    out = subprocess.run(
+        ["node", "--input-type=module", "-e", script, json.dumps(vectors)],
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    return json.loads(out.stdout)
+
+
+class BindingTest(unittest.TestCase):
+    def test_digest_is_a_plain_sha256_of_the_bytes_on_the_wire(self):
+        self.assertEqual(hash_request("nvidia-smi"), hashlib.sha256(b"nvidia-smi").hexdigest())
+        self.assertEqual(hash_request(b"nvidia-smi"), hash_request("nvidia-smi"))
+        self.assertEqual(hash_request("café"), hashlib.sha256("café".encode("utf-8")).hexdigest())
+
+    def test_message_names_its_version_the_transaction_and_the_request(self):
+        digest = hash_request("nvidia-smi")
+        self.assertEqual(bound_message(TX, digest), f"prism-x402:v2\n{TX}\n{digest}")
+        # A payer holding a checksummed hash and a server reading a lowercase one
+        # have to arrive at the same string.
+        self.assertEqual(bound_message(TX.upper().replace("0X", "0x"), digest), bound_message(TX, digest))
+
+    @unittest.skipUnless(shutil.which("node") and NODE_MODULE.exists(), "needs node and a checkout")
+    def test_the_two_sdks_sign_the_same_bytes(self):
+        mine = [[hash_request(payload), bound_message(tx, hash_request(payload))] for tx, payload in VECTORS]
+        self.assertEqual(mine, node_says(VECTORS))
+
+    def test_the_header_a_payer_sends_recovers_that_payer(self):
+        account = Account.from_key(KEY)
+        body = json.dumps({"model": "llama3.2:3b", "prompt": "hello"}).encode("utf-8")
+
+        envelope = json.loads(base64.b64decode(payment_header(account, TX, body)))
+        self.assertEqual(envelope["txHash"], TX)
+        self.assertNotIn("network", envelope)
+
+        signer = Account.recover_message(
+            encode_defunct(text=bound_message(TX, hash_request(body))), signature=envelope["signature"]
+        )
+        self.assertEqual(signer, account.address)
+
+        # The replay this closes: the same header sent back with a body of the
+        # reader's own choosing.
+        swapped = Account.recover_message(
+            encode_defunct(text=bound_message(TX, hash_request(b"something else"))),
+            signature=envelope["signature"],
+        )
+        self.assertNotEqual(swapped, account.address)
+
+    def test_a_named_network_travels_with_the_payment(self):
+        account = Account.from_key(KEY)
+        envelope = json.loads(base64.b64decode(payment_header(account, TX, b"{}", network="eip155:4663")))
+        self.assertEqual(envelope["network"], "eip155:4663")
+
+
+if __name__ == "__main__":
+    unittest.main()

prismnetwork-0.3.0/README.md

@@ -1,56 +0,0 @@
-# prismnetwork
-
-Headless GPU leasing on [Prism Network](https://prismnetwork.tech) for autonomous
-agents, the Python counterpart to `@prismnetwork/agent-sdk`. Give it a wallet; it
-authenticates with a signature, pays on-chain in USDG, provisions a GPU, and runs
-over SSH. No browser, no dashboard.
-
-```sh
-pip install prismnetwork
-```
-
-```python
-from prismnetwork import PrismAgent, DEFAULT_IMAGE
-
-agent = PrismAgent(private_key=AGENT_KEY, escrow="0x62C042265991bEa17B07229322A01850974626dA")
-agent.authenticate()
-
-lease = agent.lease(image=DEFAULT_IMAGE, duration_seconds=600, min_vram_mib=16000)
-out = agent.run(lease, "nvidia-smi")
-print(out["stdout"])
-agent.end_lease(lease)
-```
-
-## What it does
-
-`authenticate()` signs a challenge with the wallet and exchanges it for a bearer
-session. `lease()` gets a quote, funds an on-chain USDG escrow bound to the quote
-(`createLease`), waits for the GPU to provision, and returns SSH access. `run()`
-executes a command over SSH, retrying through the host's sshd warmup. Metering is
-per-second; each lease settles on-chain with a verifiable receipt.
-
-Read-only helpers: `offers()`, `balances()`, `leases()`, `quote(...)`, `access(id)`.
-
-## Batch
-
-Pass `command=` to `lease()` and the node runs that one command and reports its
-output instead of granting SSH access:
-
-```python
-batch = agent.lease(image=DEFAULT_IMAGE, duration_seconds=600, command="nvidia-smi")
-print(batch.result["stdout"])
-```
-
-Batch leases match only suppliers at trust class `isolated` or above, because the
-broker path has no signed result channel. Commands are capped at 8 KiB and output
-at 64 KiB per stream. `result(lease_id)` and `wait_for_result(lease_id)` read the
-output of an already-funded batch lease.
-
-The wallet needs USDG (`0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168`, 6 decimals) and
-native Robinhood-Chain gas.
-
-Requires `ssh` and `ssh-keygen` on `PATH`. Chain id 4663, RPC
-`https://rpc.mainnet.chain.robinhood.com`.
-
-Prism is pre-production and unaudited. A permissionless supplier is not a trusted
-computing environment; do not lease with a wallet or workload you cannot lose.