programgarden-core 2.7.0__tar.gz → 3.0.0__tar.gz

{programgarden_core-2.7.0 → programgarden_core-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: programgarden-core
-Version: 2.7.0
+Version: 3.0.0
 Summary: ProgramGarden Core - 노드 기반 DSL 핵심 타입 정의
 License-Expression: AGPL-3.0-or-later
 Author: 프로그램동산
@@ -15,24 +15,8 @@ Requires-Dist: pydantic (>=2.0.1,<3.0.0)
 Requires-Dist: tzdata (>=2025.2,<2026.0)
 Description-Content-Type: text/markdown
 
-The 2.6.2 release candidate [futures minute alias correction](../../docs/futures-minute-alias-contract.md) aligns canonical minute periods with the existing one-page o3103 path and rejects unsupported hourly/adjustment claims. Complete-range coverage and consumer adoption are not implied.
-
-US regular-session requests can opt into SessionGateNode.exchange_calendar (XNYS/XNAS) for scheduled holidays and early closes. See [session gates](../../docs/session-gates-and-guarded-split.md).
-
 # ProgramGarden Core
 
-An unreleased [stock history interval correction](../../docs/stock-history-interval-contract.md)
-limits the overseas-stock catalog to its implemented g3204 periods and rejects
-unsupported intraday requests before execution. Package adoption is pending.
-
-Unreleased schema additions: OverseasFuturesContractInfoNode, SQLiteNode's opt-in
-storage_scope=execution, and SessionGateNode's XHKG calendar. See the
-[runtime contract](../../docs/futures-contract-details-and-rollover-state.md).
-
-The REST overseas-stock position catalog declares `sellable_qty`, matching the
-broker-reported capacity preserved by the engine. Missing evidence remains null;
-see [the contract](../../docs/overseas-stock-sellable-quantity.md).
-
 ProgramGarden은 AI 시대에 맞춰 파이썬을 모르는 투자자도 개인화된 시스템 트레이딩을 자동으로 수행할 수 있게 돕는 오픈소스입니다. 본 저장소는 노드 기반 DSL의 핵심 타입, 베이스 클래스, 레지스트리, i18n을 정의하는 "코어" 모듈입니다.
 
 - 문서(비개발자 빠른 시작): https://programgarden.gitbook.io/docs/invest/non_dev_quick_guide
@@ -119,44 +103,10 @@ programgarden_core/
 
 자세한 변경 사항은 `CHANGELOG.md`를 참고하세요.
 
-## Workflow PnL event contract
-
-Futures workflow PnL events preserve native gross estimates separately from
-accounting results. `workflow_*`, `other_*`, `total_*`, account and competition
-monetary/rate scalars remain null when accounting evidence is unavailable.
-`pnl_by_currency` contains gross price-change subtotals by contract currency;
-`monetary_positions` retains their basis/status and unmodified, unconfirmed
-`broker_pnl_amount`. No fee, FX, margin/equity return or verified contest score
-is inferred from these estimates. Actual zero and negative amounts are retained.
-`currency` is null for mixed or unavailable currencies. Consumers must handle
-nullable monetary fields and must not coerce them to zero.
-
-`WorkflowPnLEvent.personal_metrics` is an optional versioned envelope for retained
-local workflow executions. Version 1 includes `scope` (kind, product, provider,
-trading mode), timezone-aware `as_of`, `basis`, executed-order count/status,
-per-symbol/exchange/currency realized amounts/status, and unavailable MDD.
-It is unverified personal evidence, independent of whole-account contest results.
-Stock realized amounts are stored long-only FIFO gross values excluding fees;
-unknown currency stays null. Futures monetary values and portfolio MDD require
-accounting evidence absent from this ledger and remain null. Consumers must
-preserve null/status and use the latest cumulative observation, not sum dates.
-
 ## Workflow account boundary
 
 Each workflow allows one account and one product through at most one broker
 connection. Additional connections produce `DUPLICATE_BROKER_NODE`, including
 unbound or cross-product nodes. Reuse one broker for all consumers. Account-free
-workflows and unrelated credentials remain supported. See
-[the shared contract](../../docs/workflow_account_policy.md).
-
-
-## Cancellation result contract (unreleased P4)
-
-CancelOrder metadata describes request acknowledgement (`accepted`,
-`confirmation_pending=true`), not final cancellation. Replacement orders require
-separate matching completion evidence. See
-[the cancellation contract](../../docs/cancellation-acknowledgements.md).
-
-Session windows and IfNode routing inside Split are described in
-[Session gates and guarded Split](../../docs/session-gates-and-guarded-split.md).
+workflows and unrelated credentials remain supported.
 

{programgarden_core-2.7.0 → programgarden_core-3.0.0}/README.md

@@ -1,21 +1,5 @@
-The 2.6.2 release candidate [futures minute alias correction](../../docs/futures-minute-alias-contract.md) aligns canonical minute periods with the existing one-page o3103 path and rejects unsupported hourly/adjustment claims. Complete-range coverage and consumer adoption are not implied.
-
-US regular-session requests can opt into SessionGateNode.exchange_calendar (XNYS/XNAS) for scheduled holidays and early closes. See [session gates](../../docs/session-gates-and-guarded-split.md).
-
 # ProgramGarden Core
 
-An unreleased [stock history interval correction](../../docs/stock-history-interval-contract.md)
-limits the overseas-stock catalog to its implemented g3204 periods and rejects
-unsupported intraday requests before execution. Package adoption is pending.
-
-Unreleased schema additions: OverseasFuturesContractInfoNode, SQLiteNode's opt-in
-storage_scope=execution, and SessionGateNode's XHKG calendar. See the
-[runtime contract](../../docs/futures-contract-details-and-rollover-state.md).
-
-The REST overseas-stock position catalog declares `sellable_qty`, matching the
-broker-reported capacity preserved by the engine. Missing evidence remains null;
-see [the contract](../../docs/overseas-stock-sellable-quantity.md).
-
 ProgramGarden은 AI 시대에 맞춰 파이썬을 모르는 투자자도 개인화된 시스템 트레이딩을 자동으로 수행할 수 있게 돕는 오픈소스입니다. 본 저장소는 노드 기반 DSL의 핵심 타입, 베이스 클래스, 레지스트리, i18n을 정의하는 "코어" 모듈입니다.
 
 - 문서(비개발자 빠른 시작): https://programgarden.gitbook.io/docs/invest/non_dev_quick_guide
@@ -102,43 +86,9 @@ programgarden_core/
 
 자세한 변경 사항은 `CHANGELOG.md`를 참고하세요.
 
-## Workflow PnL event contract
-
-Futures workflow PnL events preserve native gross estimates separately from
-accounting results. `workflow_*`, `other_*`, `total_*`, account and competition
-monetary/rate scalars remain null when accounting evidence is unavailable.
-`pnl_by_currency` contains gross price-change subtotals by contract currency;
-`monetary_positions` retains their basis/status and unmodified, unconfirmed
-`broker_pnl_amount`. No fee, FX, margin/equity return or verified contest score
-is inferred from these estimates. Actual zero and negative amounts are retained.
-`currency` is null for mixed or unavailable currencies. Consumers must handle
-nullable monetary fields and must not coerce them to zero.
-
-`WorkflowPnLEvent.personal_metrics` is an optional versioned envelope for retained
-local workflow executions. Version 1 includes `scope` (kind, product, provider,
-trading mode), timezone-aware `as_of`, `basis`, executed-order count/status,
-per-symbol/exchange/currency realized amounts/status, and unavailable MDD.
-It is unverified personal evidence, independent of whole-account contest results.
-Stock realized amounts are stored long-only FIFO gross values excluding fees;
-unknown currency stays null. Futures monetary values and portfolio MDD require
-accounting evidence absent from this ledger and remain null. Consumers must
-preserve null/status and use the latest cumulative observation, not sum dates.
-
 ## Workflow account boundary
 
 Each workflow allows one account and one product through at most one broker
 connection. Additional connections produce `DUPLICATE_BROKER_NODE`, including
 unbound or cross-product nodes. Reuse one broker for all consumers. Account-free
-workflows and unrelated credentials remain supported. See
-[the shared contract](../../docs/workflow_account_policy.md).
-
-
-## Cancellation result contract (unreleased P4)
-
-CancelOrder metadata describes request acknowledgement (`accepted`,
-`confirmation_pending=true`), not final cancellation. Replacement orders require
-separate matching completion evidence. See
-[the cancellation contract](../../docs/cancellation-acknowledgements.md).
-
-Session windows and IfNode routing inside Split are described in
-[Session gates and guarded Split](../../docs/session-gates-and-guarded-split.md).
+workflows and unrelated credentials remain supported.

{programgarden_core-2.7.0 → programgarden_core-3.0.0}/programgarden_core/bases/listener.py

@@ -346,7 +346,7 @@ class WorkflowPnLEvent:
     # 워크플로우 **비율**을 못 낸 사유. 값을 비우는 것만으로는 "안 샀다" 와 "증권사가
     # 평단·현재가를 안 보냈다" 가 구분되지 않는다 — 서버가 이 사유를 그대로 적재한다.
     # 어휘: no_workflow_positions | basis_unreported | price_unreported | no_tracker |
-    #       computation_failed (dsl-api RATE_UNAVAILABLE_REASONS 와 공용).
+    #       computation_failed (플랫폼의 수익률 미산출 사유 어휘와 공용).
     # 🔴 monetary_* 를 재사용하지 않는다 — 그건 선물 전용 계약이고, 주식 이벤트에서
     #    monetary_status is None 임을 고정하는 테스트가 있다.
     workflow_rate_unavailable_reason: Optional[str] = None

programgarden_core-3.0.0/programgarden_core/code_node.py

@@ -0,0 +1,29 @@
+"""Public stub of the CodeNode support module. The user-code screener and sandbox are
+not part of the open-source build; CodeNode is declared so workflows parse and pass
+structural validation, but execution refuses (see WorkflowExecutor)."""
+
+
+class CodeScreenResult:
+    """Structural-validation result. The open-source build performs no code screening."""
+
+    def __init__(self):
+        self.ok = True
+        self.error_code = None
+        self.message = None
+        self.suggestion = None
+        self.details = {}
+
+
+def compile_code_node(code="", node_id="code", *args, **kwargs):
+    return CodeScreenResult()
+
+
+DEFAULT_ALLOWED_IMPORTS: frozenset = frozenset({
+    "math", "cmath", "statistics", "decimal", "fractions", "numbers",
+    "random", "json", "re", "datetime", "time", "calendar",
+    "collections", "itertools", "functools",
+    "string", "textwrap", "unicodedata",
+    "heapq", "bisect", "array", "copy",
+    "dataclasses", "enum", "typing",
+    "hashlib", "hmac", "base64", "binascii", "zlib",
+})

{programgarden_core-2.7.0 → programgarden_core-3.0.0}/pyproject.toml

@@ -5,7 +5,7 @@ authors = [
 homepage = "https://programgarden.com"
 requires-python = ">=3.12"
 name = "programgarden-core"
-version = "2.7.0"
+version = "3.0.0"
 license = "AGPL-3.0-or-later"
 description = "ProgramGarden Core - 노드 기반 DSL 핵심 타입 정의"
 readme = "README.md"

programgarden_core-2.7.0/programgarden_core/code_node.py

@@ -1,419 +0,0 @@
-"""ProgramGarden Core — CodeNode static compilation & AST security screening.
-
-This module is the single source of truth for the CodeNode security lists and
-the compile/screen pipeline. It is intentionally dependency-free (stdlib only)
-so it can be reused verbatim by:
-
-  1. `WorkflowResolver.validate()` — pre-flight structured errors before run.
-  2. `CodeNodeExecutor` / subprocess worker — screen again right before `exec`.
-  3. An external web-platform "share gate" server — re-run the same hard AST scan.
-
-Security model (see plan §2): CodeNode runs untrusted Python. Defense is layered:
-
-  * Layer 1 — scrubbed context (runtime, programgarden): the code never receives
-    credential accessors.
-  * Layer 2 — restricted builtins + AST denylist (THIS module): a curated
-    `__builtins__` (no eval/exec/open/getattr/...), a safe `__import__` gated by a
-    whitelist, and a static AST scan that rejects dangerous imports, builtin
-    calls, and introspection-escape dunders BEFORE any code runs.
-  * Layer 3 — binding seal (runtime, resolver): credentials cannot flow into
-    `data`/`params`.
-  * Layer 4 — subprocess isolation (runtime, programgarden): the code always runs
-    in a credential-free child process.
-
-`compile_code_node` NEVER executes the code — it only parses, screens, and
-compiles. Execution (exec + calling `execute`) is the runtime's responsibility.
-
-All user-facing strings are English (AI-chatbot consumer contract).
-"""
-from __future__ import annotations
-
-import ast
-import builtins as _builtins
-from dataclasses import dataclass, field
-from types import CodeType
-from typing import Any, Dict, List, Optional, Set, Tuple
-
-# Name of the entry-point coroutine the code text must define.
-EXECUTE_FN_NAME = "execute"
-
-# ⚠️ SECURITY POSTURE — READ THIS.
-# AST screening + restricted builtins CANNOT be a sound sandbox for CPython.
-# A determined attacker who can run Python can, in the general case, escape any
-# in-process denylist (this is a well-known result; see the pysandbox author's
-# own withdrawal). An adversarial audit of an earlier version of this file
-# reproduced RCE via `operator.attrgetter`, `random._os`, and string-obfuscated
-# dunders. The rules below are HARDENED defense-in-depth that close every
-# demonstrated vector and raise the bar substantially — but they are NOT a
-# containment guarantee. TRUE containment of untrusted code is the runtime's
-# job (subprocess with no in-memory keys) + the operator's job (per-user pod
-# isolation, no-egress NetworkPolicy, restricted file perms, scrubbed env).
-# Treat CodeNode as "run trusted code, defense-in-depth against mistakes and
-# opportunistic abuse", not "safe to run arbitrary hostile code".
-
-# ── Whitelist: modules importable from CodeNode code ────────────────────────
-# Pure-computation stdlib only. `operator` is deliberately EXCLUDED — its
-# attrgetter/methodcaller are getattr/dispatch substitutes. Modules that
-# re-export os/sys as public attributes (e.g. random._os, uuid.os) are still
-# covered by the attribute screen below, not by this set. The embedding app may
-# EXTEND this via `allowed_imports=` (e.g. numpy) but the default is minimal.
-DEFAULT_ALLOWED_IMPORTS: frozenset = frozenset({
-    "math", "cmath", "statistics", "decimal", "fractions", "numbers",
-    "random", "json", "re", "datetime", "time", "calendar",
-    "collections", "itertools", "functools",
-    "string", "textwrap", "unicodedata",
-    "heapq", "bisect", "array", "copy",
-    "dataclasses", "enum", "typing",
-    "hashlib", "hmac", "base64", "binascii", "zlib",
-})
-
-# ── Denylist: modules called out for a clearer error message ────────────────
-# Enforcement is whitelist-based (not in DEFAULT_ALLOWED_IMPORTS → blocked);
-# this set only makes the message explicit for well-known dangerous modules.
-FORBIDDEN_MODULES: frozenset = frozenset({
-    "os", "sys", "subprocess", "socket", "shutil", "importlib", "imp",
-    "ctypes", "cffi", "gc", "inspect", "pathlib", "glob", "tempfile", "io",
-    "urllib", "http", "requests", "ftplib", "smtplib", "asyncio",
-    "multiprocessing", "threading", "concurrent", "_thread", "operator",
-    "builtins", "marshal", "pickle", "shelve", "dbm", "sqlite3",
-    "code", "codeop", "pty", "resource", "signal", "mmap", "fcntl",
-    "platform", "webbrowser", "ssl", "select", "selectors", "uuid",
-})
-
-# ── Denylist: builtin names that must never be called or aliased ────────────
-FORBIDDEN_BUILTINS: frozenset = frozenset({
-    "eval", "exec", "compile", "open", "__import__",
-    "getattr", "setattr", "delattr",
-    "globals", "locals", "vars",
-    "input", "breakpoint", "help", "memoryview",
-    "exit", "quit", "__build_class__",
-})
-
-# ── Denylist: dangerous PUBLIC attribute names (module re-exports & escapes) ──
-# Many stdlib modules re-export `os`/`sys` as public attributes (statistics.sys,
-# uuid.os, ...) — walking those reaches os.system. `mro`/`modules`/`system`/etc.
-# are the follow-on hops. Blocking these attribute NAMES (in addition to the
-# blanket underscore rule below) severs the module-attribute escape path.
-FORBIDDEN_ATTR_NAMES: frozenset = frozenset({
-    "os", "sys", "subprocess", "socket", "builtins", "importlib",
-    "modules", "system", "popen", "spawn", "spawnl", "spawnv", "spawnve",
-    "fork", "forkpty", "execv", "execve", "execl", "execlp", "execvp",
-    "mro", "import_module", "load_module", "reload", "getattr", "setattr",
-    "delattr", "globals", "environ", "getenv", "putenv", "connect",
-    "urlopen", "call", "run", "check_output", "Popen", "loader", "spec",
-})
-
-# ── Denylist: introspection-escape / exfiltration dunders & frame attrs ──────
-# NOTE: enforcement is the underscore rule in _scan_ast — any ATTRIBUTE beginning
-# with '_' is rejected (subsumes every dunder and private module re-export like
-# random._os); STRING literals are rejected when they contain a dunder or name a
-# blocked attribute re-export (bare single-underscore data-key strings such as
-# "_partial_failure" are allowed). This explicit set is retained for message clarity.
-FORBIDDEN_DUNDERS: frozenset = frozenset({
-    "__class__", "__bases__", "__base__", "__subclasses__", "__mro__",
-    "__globals__", "__code__", "__closure__", "__func__", "__self__",
-    "__dict__", "__getattribute__", "__setattr__", "__delattr__",
-    "__reduce__", "__reduce_ex__", "__builtins__", "__import__",
-    "__loader__", "__spec__", "__init_subclass__", "__subclasshook__",
-    "__getattr__", "__wrapped__", "__objclass__",
-    "gi_frame", "gi_code", "cr_frame", "cr_code", "ag_frame",
-    "f_back", "f_globals", "f_locals", "f_builtins", "tb_frame",
-})
-
-# Format replacement-field that performs attribute access, e.g. "{0.__class__}"
-# or "{x.sys}" — used to walk attributes via str.format without an AST Attribute
-# node. Rejected wholesale in string constants.
-import re as _re
-_FORMAT_ATTR_RE = _re.compile(r"\{[^{}]*\.[^{}]*\}")
-
-
-@dataclass
-class CodeScreenResult:
-    """Structured outcome of `compile_code_node`. `ok=False` carries an
-    AI-chatbot-consumable error (code + message + suggestion + location)."""
-
-    ok: bool
-    code_object: Optional[CodeType] = None
-    error_code: Optional[str] = None       # one of CODE_NODE_SYNTAX_ERROR / _FORBIDDEN / _NO_EXECUTE
-    message: Optional[str] = None
-    suggestion: Optional[str] = None
-    line: Optional[int] = None
-    offset: Optional[int] = None
-    details: Dict[str, Any] = field(default_factory=dict)
-
-
-def _module_root(name: Optional[str]) -> str:
-    return (name or "").split(".")[0]
-
-
-def _scan_ast(tree: ast.AST, allowed_imports: Set[str]) -> List[Dict[str, Any]]:
-    """Return a list of violation dicts (empty when clean).
-
-    Each violation: {kind, name, line, col, reason}. `kind` ∈
-    {import, builtin, dunder}.
-    """
-    violations: List[Dict[str, Any]] = []
-
-    for node in ast.walk(tree):
-        # ── Imports (whitelist-enforced) ──
-        if isinstance(node, ast.Import):
-            for alias in node.names:
-                root = _module_root(alias.name)
-                if root not in allowed_imports:
-                    reason = (
-                        f"module '{alias.name}' is blocked (filesystem/process/network access)"
-                        if root in FORBIDDEN_MODULES
-                        else f"module '{alias.name}' is not in the allowed import list"
-                    )
-                    violations.append({
-                        "kind": "import", "name": alias.name,
-                        "line": node.lineno, "col": node.col_offset, "reason": reason,
-                    })
-        elif isinstance(node, ast.ImportFrom):
-            root = _module_root(node.module)
-            # `from . import x` (level>0) is always blocked — no package context.
-            if node.level and node.level > 0:
-                violations.append({
-                    "kind": "import", "name": node.module or ".",
-                    "line": node.lineno, "col": node.col_offset,
-                    "reason": "relative imports are not allowed in CodeNode",
-                })
-            elif root not in allowed_imports:
-                reason = (
-                    f"module '{node.module}' is blocked (filesystem/process/network access)"
-                    if root in FORBIDDEN_MODULES
-                    else f"module '{node.module}' is not in the allowed import list"
-                )
-                violations.append({
-                    "kind": "import", "name": node.module or "",
-                    "line": node.lineno, "col": node.col_offset, "reason": reason,
-                })
-
-        # ── Forbidden builtin names (call or alias) ──
-        elif isinstance(node, ast.Name):
-            if node.id in FORBIDDEN_BUILTINS:
-                violations.append({
-                    "kind": "builtin", "name": node.id,
-                    "line": node.lineno, "col": node.col_offset,
-                    "reason": f"use of '{node.id}' is not allowed",
-                })
-
-        # ── Attribute access screen ──
-        # (1) BLANKET: any attribute beginning with '_' is rejected — this
-        #     subsumes every dunder (__class__/__globals__/__subclasses__/...)
-        #     AND private module re-exports (random._os, random._urandom, ...).
-        # (2) A denylist of dangerous PUBLIC names (module re-exports & shell
-        #     hops): statistics.sys, uuid.os, x.system, x.modules, type().mro().
-        elif isinstance(node, ast.Attribute):
-            if node.attr.startswith("_"):
-                violations.append({
-                    "kind": "dunder", "name": node.attr,
-                    "line": node.lineno, "col": node.col_offset,
-                    "reason": f"access to underscore attribute '{node.attr}' is not allowed (introspection escape)",
-                })
-            elif node.attr in FORBIDDEN_ATTR_NAMES:
-                violations.append({
-                    "kind": "attr", "name": node.attr,
-                    "line": node.lineno, "col": node.col_offset,
-                    "reason": f"attribute '{node.attr}' access is not allowed (module/escape re-export)",
-                })
-
-        # ── String-constant screen ──
-        # Defeats attribute-walk via strings: getattr/attrgetter args, str.format
-        # attribute fields, subscript-string dunder access. Reject strings that
-        # start with '_', contain a dunder, name a dangerous attribute, or embed
-        # a format field with attribute access.
-        elif isinstance(node, ast.Constant) and isinstance(node.value, str):
-            v = node.value
-            bad = None
-            # A single leading underscore names a documented native data marker
-            # read as a dict key (e.g. balance["_partial_failure"], "_source"),
-            # so it is allowed. Still rejected: dunder-style names, and blocked
-            # public/underscored attribute re-exports ("os"/"sys"/"system"/"_os"/
-            # "_sys"... -> in FORBIDDEN_ATTR_NAMES via lstrip("_")), and attribute-
-            # walking format fields. getattr/attrgetter/operator/format are
-            # independently blocked, so a bare underscore data-key string cannot
-            # be turned into attribute access.
-            if "__" in v:
-                bad = "string literal contains a dunder (introspection escape)"
-            elif v.lstrip("_") in FORBIDDEN_ATTR_NAMES:
-                bad = f"string literal '{v}' names a blocked attribute (introspection escape)"
-            elif _FORMAT_ATTR_RE.search(v):
-                bad = "format string performs attribute access (introspection escape)"
-            if bad:
-                violations.append({
-                    "kind": "string", "name": v[:40],
-                    "line": node.lineno, "col": node.col_offset,
-                    "reason": bad,
-                })
-
-    return violations
-
-
-def _has_execute(tree: ast.Module) -> bool:
-    for node in tree.body:
-        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)) and node.name == EXECUTE_FN_NAME:
-            return True
-    return False
-
-
-def compile_code_node(
-    code: str,
-    node_id: str,
-    *,
-    screen: bool = True,
-    allowed_imports: Optional[Set[str]] = None,
-) -> CodeScreenResult:
-    """Parse, security-screen, and compile CodeNode source WITHOUT executing it.
-
-    Pipeline:
-      1. `ast.parse` — SyntaxError → CODE_NODE_SYNTAX_ERROR (line/offset).
-      2. AST denylist scan (when `screen=True`) — CODE_NODE_FORBIDDEN.
-      3. `execute` function must be defined — CODE_NODE_NO_EXECUTE.
-      4. `compile(filename=f'<code:{node_id}>')` — preserves traceback lines.
-
-    Args:
-        code: Python source text (must define `execute`).
-        node_id: node id, used only for the compiled filename (traceback anchor).
-        screen: run the AST denylist scan (always True in production).
-        allowed_imports: override the import whitelist (defaults to
-            DEFAULT_ALLOWED_IMPORTS). Enforced both here and by the runtime
-            safe `__import__`.
-
-    Returns:
-        CodeScreenResult — `ok=True` with `code_object`, or `ok=False` with a
-        structured, English, chatbot-consumable error. Never raises for
-        screening/syntax failures (they are returned as data).
-    """
-    allowed = set(allowed_imports) if allowed_imports is not None else set(DEFAULT_ALLOWED_IMPORTS)
-
-    if not isinstance(code, str) or not code.strip():
-        return CodeScreenResult(
-            ok=False,
-            error_code="CODE_NODE_SYNTAX_ERROR",
-            message="CodeNode 'code' is empty.",
-            suggestion="Provide Python source that defines `async def execute(data, params, context)`.",
-            line=1, offset=0,
-        )
-
-    # 1. Parse
-    try:
-        tree = ast.parse(code, filename=f"<code:{node_id}>", mode="exec")
-    except SyntaxError as e:
-        return CodeScreenResult(
-            ok=False,
-            error_code="CODE_NODE_SYNTAX_ERROR",
-            message=f"CodeNode syntax error: {e.msg}",
-            suggestion="Fix the Python syntax at the reported line/offset.",
-            line=e.lineno,
-            offset=e.offset,
-            details={"raw": str(e)},
-        )
-
-    # 2. Screen
-    if screen:
-        violations = _scan_ast(tree, allowed)
-        if violations:
-            first = violations[0]
-            names = sorted({v["name"] for v in violations})
-            return CodeScreenResult(
-                ok=False,
-                error_code="CODE_NODE_FORBIDDEN",
-                message=(
-                    f"CodeNode uses forbidden construct(s): {', '.join(names)} "
-                    f"({first['reason']})."
-                ),
-                suggestion=(
-                    "Remove the blocked import/builtin/introspection. CodeNode allows "
-                    "pure-computation stdlib only (math, statistics, json, datetime, ...); "
-                    "credentials, filesystem, network, subprocess, and object-graph "
-                    "introspection are not available."
-                ),
-                line=first["line"],
-                offset=first["col"],
-                details={"violations": violations, "forbidden_names": names},
-            )
-
-    # 3. execute() must exist
-    if not _has_execute(tree):
-        return CodeScreenResult(
-            ok=False,
-            error_code="CODE_NODE_NO_EXECUTE",
-            message=f"CodeNode code must define a function named '{EXECUTE_FN_NAME}'.",
-            suggestion=(
-                "Define `async def execute(data, params, context):` (a plain "
-                "`def execute(...)` is also accepted and auto-wrapped)."
-            ),
-            line=1, offset=0,
-        )
-
-    # 4. Compile (never exec here)
-    try:
-        code_object = compile(tree, filename=f"<code:{node_id}>", mode="exec")
-    except (SyntaxError, ValueError) as e:  # e.g. too-deeply-nested
-        return CodeScreenResult(
-            ok=False,
-            error_code="CODE_NODE_SYNTAX_ERROR",
-            message=f"CodeNode failed to compile: {e}",
-            suggestion="Simplify the code so it compiles as a module.",
-            line=getattr(e, "lineno", 1) or 1,
-            offset=getattr(e, "offset", 0) or 0,
-            details={"raw": str(e)},
-        )
-
-    return CodeScreenResult(ok=True, code_object=code_object)
-
-
-# The real import machinery, captured once so the sandbox can delegate to it
-# after the whitelist check.
-_REAL_IMPORT = _builtins.__import__
-
-# Curated safe builtins — everything a pure-compute function needs, and nothing
-# that grants escape (no eval/exec/compile/open/getattr/setattr/globals/...).
-_SAFE_BUILTIN_NAMES: Tuple[str, ...] = (
-    "abs", "all", "any", "ascii", "bin", "bool", "bytearray", "bytes",
-    "callable", "chr", "complex", "dict", "divmod", "enumerate", "filter",
-    "float", "format", "frozenset", "hash", "hex", "int", "isinstance",
-    "issubclass", "iter", "len", "list", "map", "max", "min", "next", "oct",
-    "ord", "pow", "print", "range", "repr", "reversed", "round", "set",
-    "slice", "sorted", "str", "sum", "tuple", "type", "zip", "hasattr",
-    # exceptions & sentinels
-    "Exception", "BaseException", "ValueError", "TypeError", "KeyError",
-    "IndexError", "AttributeError", "ZeroDivisionError", "ArithmeticError",
-    "OverflowError", "RuntimeError", "StopIteration", "StopAsyncIteration",
-    "NotImplementedError", "AssertionError", "LookupError", "NameError",
-    "RecursionError", "FloatingPointError", "GeneratorExit", "KeyboardInterrupt",
-    "True", "False", "None", "NotImplemented", "Ellipsis",
-    "object", "property", "staticmethod", "classmethod", "super",
-    # __build_class__ is required for `class` statements in user code; it is not
-    # itself an escape vector (dunder screen blocks the dangerous follow-ups).
-    "__build_class__",
-)
-
-
-def build_restricted_builtins(allowed_imports: Optional[Set[str]] = None) -> Dict[str, Any]:
-    """Build the `__builtins__` dict used when exec-ing CodeNode source.
-
-    Contains only the curated safe builtins plus a whitelist-gated
-    `__import__`. Pure function (no exec, stdlib only) so it lives in core and
-    is reused by the runtime worker.
-    """
-    allowed = set(allowed_imports) if allowed_imports is not None else set(DEFAULT_ALLOWED_IMPORTS)
-
-    def _safe_import(name, globals=None, locals=None, fromlist=(), level=0):
-        if level and level != 0:
-            raise ImportError("relative imports are not allowed in CodeNode")
-        root = _module_root(name)
-        if root not in allowed:
-            raise ImportError(
-                f"import of '{name}' is not allowed in CodeNode "
-                f"(allowed: pure-computation stdlib only)"
-            )
-        return _REAL_IMPORT(name, globals, locals, fromlist, level)
-
-    safe: Dict[str, Any] = {}
-    for bn in _SAFE_BUILTIN_NAMES:
-        if hasattr(_builtins, bn):
-            safe[bn] = getattr(_builtins, bn)
-    safe["__import__"] = _safe_import
-    return safe