topos-node 1.3.43__tar.gz → 1.3.45__tar.gz

{topos_node-1.3.43/topos_node.egg-info → topos_node-1.3.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: topos-node
-Version: 1.3.43
+Version: 1.3.45
 Summary: Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://topos.dialogues.ai

{topos_node-1.3.43 → topos_node-1.3.45}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "topos-node"
-version = "1.3.43"
+version = "1.3.45"
 description = "Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client"
 readme = "README.md"
 license = "Apache-2.0"

{topos_node-1.3.43 → topos_node-1.3.45}/topos/__version__.py

@@ -1,6 +1,6 @@
 """Topos Control Plane Version Information."""
 
-__version__ = "1.3.43"
-__version_info__ = (1, 3, 43)
+__version__ = "1.3.45"
+__version_info__ = (1, 3, 45)
 
 __all__ = ["__version__", "__version_info__"]

{topos_node-1.3.43 → topos_node-1.3.45}/topos/core/handlers/__init__.py

@@ -147,6 +147,7 @@ from .contacts_import import (  # noqa: F401
 from .common import logger
 from .registry import HANDLERS, OWNER_ONLY_MESSAGE_TYPES, handles  # noqa: F401
 from . import (  # noqa: F401  (imported for handler registration side effects)
+    aggregate,
     config,
     derivation,
     sources,

topos_node-1.3.45/topos/core/handlers/aggregate.py

@@ -0,0 +1,188 @@
+"""The ``aggregate`` verb — deterministic numbers over curated scope surfaces.
+
+The third verb of the query architecture: ``query`` retrieves, ``aggregate``
+counts. No model writes SQL; the surface is the curated registry in
+:mod:`topos.query.aggregate`. The handler owns its whole envelope because it
+bypasses the retrieval orchestrator: it builds the narrowing ledger, stamps
+honesty fields inside ``public_result`` (the model reads public_result, not
+the transport envelope), and walks ``validate_public_result`` itself.
+
+Principal policy (channel-verified, never read from the payload): grantee
+requests and THIRD_PARTY principals are denied — aggregates are statistical
+reads over the raw substrate, and the raw substrate is deny-by-default for
+non-native callers (S1). owner_app and owner_automation are served; the
+black-hole guard still excludes protected people for every caller class
+except the owner's own UI.
+"""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from typing import Any, Dict, Optional
+
+import topos.core.handlers as hub
+
+from ...principal import THIRD_PARTY, current_principal
+from ...features.lifecycle.blackhole_guard import guard_from_message
+from ...query.aggregate import (
+    AggregateParamError,
+    run_aggregate,
+    validate_aggregate_params,
+)
+from ...query.narrowing import (
+    CAUSE_GATE_VETOED,
+    CAUSE_NO_MATCH,
+    CAUSE_SCOPE_DENIED,
+    CAUSE_STORE_EMPTY,
+    STAGE_GRANT,
+    STAGE_RETRIEVAL,
+    NarrowingLedger,
+)
+from ...query.session_utils import validate_public_result
+from .registry import handles
+
+logger = logging.getLogger(__name__)
+
+
+def _deny(
+    req_id: Any,
+    reason: str,
+    *,
+    cause: str,
+    query_session_id: str,
+    detail: str = "",
+) -> Dict[str, Any]:
+    ledger = NarrowingLedger()
+    ledger.empty(cause, stage=STAGE_GRANT, reason=reason, detail=detail)
+    return {
+        "id": req_id,
+        "status": "ok",
+        "payload": {
+            "turn_outcome": "denied",
+            "deny_reason": reason,
+            "public_result": None,
+            "query_session_id": query_session_id,
+            "narrowing": {**ledger.as_public(), "result_empty": True},
+        },
+    }
+
+
+@handles("aggregate")
+async def handle_aggregate(message: Dict[str, Any]) -> Optional[Dict[str, Any]]:
+    req_id = message.get("id")
+    if not req_id:
+        return None
+    payload = message.get("payload") or {}
+    query_session_id = str(
+        payload.get("query_session_id") or f"agg_{uuid.uuid4()}"
+    )
+
+    # Grantee requests never reach this verb, and the flag is checked before
+    # anything else so the denial carries no scope-shaped information.
+    if bool(payload.get("is_grantee_request")) or payload.get("resource_id"):
+        return _deny(
+            req_id,
+            "aggregate_principal_denied",
+            cause=CAUSE_SCOPE_DENIED,
+            query_session_id=query_session_id,
+        )
+    principal = current_principal()
+    if principal is not None and principal.cls == THIRD_PARTY:
+        return _deny(
+            req_id,
+            "aggregate_principal_denied",
+            cause=CAUSE_SCOPE_DENIED,
+            query_session_id=query_session_id,
+        )
+
+    try:
+        spec = validate_aggregate_params(payload)
+    except AggregateParamError as exc:
+        cause = (
+            CAUSE_SCOPE_DENIED
+            if exc.reason == "aggregate_scope_unsupported"
+            else CAUSE_GATE_VETOED
+        )
+        return _deny(
+            req_id,
+            exc.reason,
+            cause=cause,
+            query_session_id=query_session_id,
+            detail=str(exc),
+        )
+
+    try:
+        conn = hub.get_db_connection()
+        if conn is None:
+            return {"id": req_id, "status": "error", "error": "no database"}
+
+        dataset_id = str(payload.get("dataset_id") or "")
+        dataset_resolved = False
+        if spec.scope.has_dataset_col:
+            # Messenger datasets are named by import runs, not {user}:default —
+            # live 2026-09-02 the naive fallback matched ZERO of 7,667 rows and
+            # a real count answered 0. resolve_messaging_dataset is the
+            # sanctioned fallback, and its contract requires surfacing the
+            # substitution: a silent one shows one dataset's numbers under
+            # another's name.
+            try:
+                from topos.analytics.dataset_resolution import resolve_messaging_dataset
+
+                dataset_id, dataset_resolved = resolve_messaging_dataset(conn, dataset_id)
+            except Exception:  # noqa: BLE001
+                pass
+
+        guard = guard_from_message(conn, message)
+        ledger = NarrowingLedger()
+        core = run_aggregate(conn, spec, guard=guard, dataset_id=dataset_id)
+        if dataset_resolved:
+            core["dataset_resolved"] = True
+
+        store_empty = bool(core.pop("store_empty", False))
+        if store_empty:
+            ledger.empty(
+                CAUSE_STORE_EMPTY,
+                stage=STAGE_RETRIEVAL,
+                reason="scope_stores_hold_no_rows",
+            )
+            core["empty_cause"] = CAUSE_STORE_EMPTY
+        elif not core.get("rows"):
+            ledger.empty(
+                CAUSE_NO_MATCH,
+                stage=STAGE_RETRIEVAL,
+                reason="no_row_matched_the_request",
+            )
+            core["empty_cause"] = CAUSE_NO_MATCH
+        else:
+            ledger.record(STAGE_RETRIEVAL, "contributed", "aggregate_lane")
+
+        validate_public_result(core)
+
+        try:
+            from .common import record_mcp_request
+
+            record_mcp_request(
+                conn,
+                "aggregate",
+                source="control_plane",
+                requester_id=str(payload.get("requester_id") or "") or None,
+            )
+        except Exception:  # noqa: BLE001
+            logger.debug("aggregate: audit record failed", exc_info=True)
+
+        result_empty = not core.get("rows")
+        return {
+            "id": req_id,
+            "status": "ok",
+            "payload": {
+                "turn_outcome": "live_query",
+                "public_result": core,
+                "scope_id": spec.scope_id,
+                "query_session_id": query_session_id,
+                "narrowing": {**ledger.as_public(), "result_empty": result_empty},
+            },
+        }
+    except Exception as exc:  # noqa: BLE001
+        logger.exception("aggregate failed")
+        return {"id": req_id, "status": "error", "error": str(exc)}

{topos_node-1.3.43 → topos_node-1.3.45}/topos/protocol/handled_message_types.json

@@ -1,6 +1,7 @@
 {
  "handled_message_types": [
   "advance_routine_next_run_at",
+  "aggregate",
   "app_ingest",
   "auto_resolve_source_contacts",
   "blackhole_check_text",

{topos_node-1.3.43 → topos_node-1.3.45}/topos/protocol/narrowing_vocabulary.json

@@ -44,6 +44,10 @@
     "windowed"
   ],
   "reasons": [
+    "aggregate_lane",
+    "aggregate_param_invalid",
+    "aggregate_principal_denied",
+    "aggregate_scope_unsupported",
     "access_mode_above_ceiling",
     "access_mode_invalid",
     "approval_required",