topos-node 1.3.56__tar.gz → 1.4.0__tar.gz

{topos_node-1.3.56/topos_node.egg-info → topos_node-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: topos-node
-Version: 1.3.56
+Version: 1.4.0
 Summary: Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://topos.dialogues.ai
@@ -63,6 +63,7 @@ Provides-Extra: dev
 Requires-Dist: pytest~=9.0.3; extra == "dev"
 Requires-Dist: pytest-asyncio~=1.3.0; extra == "dev"
 Requires-Dist: httpx~=0.28.1; extra == "dev"
+Requires-Dist: hypothesis<7,>=6.100; extra == "dev"
 Dynamic: license-file
 
 <div align="center">

{topos_node-1.3.56 → topos_node-1.4.0}/pyproject.toml

@@ -9,7 +9,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "topos-node"
-version = "1.3.56"
+version = "1.4.0"
 description = "Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client"
 readme = "README.md"
 license = "Apache-2.0"
@@ -109,6 +109,7 @@ dev = [
   "pytest~=9.0.3",
   "pytest-asyncio~=1.3.0",
   "httpx~=0.28.1",
+  "hypothesis>=6.100,<7",
 ]
 
 [project.scripts]
@@ -168,6 +169,8 @@ markers = [
   "bhlr: black-hole leak-rate probe (entity black hole); tier-1 CI gate, must find zero leaks",
   "eval_nightly: statistical privacy eval (attacker advantage, minimality, latency); nightly",
   "eval_release: release-tier privacy eval (negotiation A/B, Pareto); run per release",
+  "fuzz: the permissions v2 property-based lane (Hypothesis; confidence program C5)",
+  "ordinal_ids_retired: run with p2a-v1/v2 releases refused, as the node does (tests/permissions_v2/conftest.py)",
 ]
 pythonpath = ["tests/gap/p3/engine", "tests/gap/p4/engine", "tests/gap/qq/engine", "tests/acceptance/wiki_mvp", "tests/evals/time_signal"]
 testpaths = ["tests"]

{topos_node-1.3.56 → topos_node-1.4.0}/shared/filtering.py

@@ -5,7 +5,7 @@ from datetime import datetime
 from enum import Enum
 from typing import Any, Dict, Iterable, List, Literal, Optional
 
-from pydantic import BaseModel, Field, field_validator, model_validator
+from pydantic import BaseModel, Field, StrictStr, field_validator, model_validator
 
 
 class FilterCategory(str, Enum):
@@ -530,6 +530,31 @@ class FilterManifest(BaseModel):
     manifest_version: int = Field(1, ge=1)
     filters: List[FilterInstance] = Field(default_factory=list)
     provenance: Optional[FilterManifestProvenance] = None
+    access_mode_ceiling: Optional[Literal["summary", "inference", "raw"]] = None
+    scope_table_allowlist: Optional[Dict[StrictStr, List[StrictStr]]] = None
+
+    @field_validator("access_mode_ceiling", mode="before")
+    @classmethod
+    def normalize_ceiling(cls, value: Any) -> Any:
+        # Mirror of the control plane's validator (ported from the held sharing
+        # hotfix 1dd65995; BEFORE_PROD_REVIEW P0-10). The query lane decodes stored
+        # grant envelopes through this model (topos/uma_filters.query_filter_manifest),
+        # so a stored ceiling whose spelling differs would otherwise raise here and
+        # fail that grant's reads instead of being read as the ceiling it names.
+        if isinstance(value, str):
+            value = value.strip().lower()
+            return value or None
+        return value
+
+    @field_validator("scope_table_allowlist")
+    @classmethod
+    def validate_scope_table_allowlist(cls, value):
+        if value is None:
+            return None
+        for scope, tables in value.items():
+            if not scope or scope != scope.strip() or any(not table or table != table.strip() for table in tables):
+                raise ValueError("scope/table IDs must be nonempty canonical strings")
+        return {scope: sorted(set(tables)) for scope, tables in value.items()}
 
     def to_storage_dict(self) -> Dict[str, Any]:
         return self.model_dump(exclude_none=True, mode="json")
@@ -591,21 +616,11 @@ def _merge_param_values(filter_id: str, existing: Dict[str, Any], incoming: Dict
             if end is None or str(incoming_end) < str(end):
                 merged["end"] = incoming_end
         return merged
-    if filter_id == "source_filter":
-        current = set(str(item) for item in merged.get("source_ids", []))
-        incoming_values = set(str(item) for item in incoming.get("source_ids", []))
-        if current and incoming_values:
-            merged["source_ids"] = sorted(current & incoming_values)
-        elif incoming_values:
-            merged["source_ids"] = sorted(incoming_values)
-        return merged
-    if filter_id == "column_allowlist":
-        current = set(str(item) for item in merged.get("fields", []))
-        incoming_values = set(str(item) for item in incoming.get("fields", []))
-        if current and incoming_values:
-            merged["fields"] = sorted(current & incoming_values)
-        elif incoming_values:
-            merged["fields"] = sorted(incoming_values)
+    if filter_id in {"source_filter", "column_allowlist"}:
+        key = "source_ids" if filter_id == "source_filter" else "fields"
+        # These are validated, required lists. Missing the entire filter means
+        # unrestricted; a present empty list is bottom and absorbs every meet.
+        merged[key] = sorted(set(merged[key]) & set(incoming[key]))
         return merged
     if filter_id == "column_blocklist":
         current = set(str(item) for item in merged.get("fields", []))
@@ -650,9 +665,20 @@ def merge_filter_manifests(
     provenance: Optional[FilterManifestProvenance] = None,
 ) -> FilterManifest:
     merged_instances: Dict[str, FilterInstance] = {}
+    ceiling = None
+    table_allowlist = None
     for manifest in manifests:
         if manifest is None:
             continue
+        if manifest.access_mode_ceiling is not None:
+            ranks = {"summary": 0, "inference": 1, "raw": 2}
+            if ceiling is None or ranks[manifest.access_mode_ceiling] < ranks[ceiling]:
+                ceiling = manifest.access_mode_ceiling
+        if manifest.scope_table_allowlist is not None:
+            if table_allowlist is None:
+                table_allowlist = {}
+            for scope, tables in manifest.scope_table_allowlist.items():
+                table_allowlist[scope] = sorted(set(tables) & set(table_allowlist[scope])) if scope in table_allowlist else sorted(set(tables))
         for item in manifest.filters:
             key = _manifest_merge_key(item)
             existing = merged_instances.get(key)
@@ -667,4 +693,6 @@ def merge_filter_manifests(
     return FilterManifest(
         filters=sorted(merged_instances.values(), key=lambda item: (_manifest_merge_key(item), item.filter_id)),
         provenance=provenance,
+        access_mode_ceiling=ceiling,
+        scope_table_allowlist=table_allowlist,
     )

topos_node-1.4.0/tests/test_topos_home_hermeticity.py

@@ -0,0 +1,326 @@
+"""The default test lane must not touch anything under the owner's ``~/.topos``.
+
+``test_owner_database_hermeticity.py`` covers the database. This covers the rest of
+the directory: ``.env`` (identity, and since the dual-mint the owner key),
+``engine.sock`` (the owner socket the running node serves), ``cp_stamp_key.pub``,
+``ingestion/``, the active-profile marker and the logs.
+
+The hazard this file was written against (2026-09-18, MERGE_REHEARSAL.md §2.8
+items 4-5): ``tests/topos/test_engine_presence_messages.py`` starts the app with a
+control-plane URL, so the lifespan's dual-mint runs ``ensure_owner_key``. No
+conftest set ``TOPOS_ENV_FILE``, so that READ the owner's real ``~/.topos/.env`` and
+appended a minted ``TOPOS_OWNER_KEY`` when none was there. The same lifespan bound
+the owner socket at ``~/.topos/engine.sock``. The live-DB guard never fired,
+because it watches ``sqlite3.connect`` and nothing else. And the minted key stayed
+in ``os.environ`` and on the settings singleton, so every later test ran in owner
+mode.
+
+Every test here runs under a SCRATCH home. A hermeticity test that had to look at
+the real ``~/.topos`` to prove itself would be the bug it is guarding against.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import socket
+from pathlib import Path
+
+import pytest
+
+from tests import live_db_watch
+
+
+def _tree(root: Path) -> dict[str, tuple[str, int]]:
+    """Every path under ``root`` -> (content digest, mtime_ns). Sockets by kind."""
+    out: dict[str, tuple[str, int]] = {}
+    if not root.exists():
+        return out
+    for p in sorted(root.rglob("*")):
+        st = p.lstat()
+        rel = str(p.relative_to(root))
+        if p.is_socket():
+            out[rel] = ("<socket>", st.st_mtime_ns)
+        elif p.is_file():
+            out[rel] = (hashlib.sha256(p.read_bytes()).hexdigest(), st.st_mtime_ns)
+        else:
+            out[rel] = ("<dir>", 0)
+    return out
+
+
+@pytest.fixture
+def scratch_home(monkeypatch: pytest.MonkeyPatch):
+    """A home directory that looks like a developer's with a node on it.
+
+    Seeded with a ``.topos/.env`` that holds a TOPOS_KEY and NO owner key: exactly
+    the file the dual-mint appends to. HOME and ``Path.home`` both point here, so a
+    default that is not pinned lands in this tree instead of the real one, where
+    the test can see it.
+
+    Under /tmp, not tmp_path. macOS caps an AF_UNIX path at 104 bytes, and
+    ``<tmp_path>/.topos/engine.sock`` is longer, so under tmp_path an unpinned
+    owner socket fails to bind (silently, on the supervisor thread) and this
+    fixture would miss exactly the write it exists to see.
+    """
+    import shutil
+    import tempfile
+
+    home = Path(tempfile.mkdtemp(prefix="th-", dir="/tmp")).resolve()
+    (home / ".topos").mkdir(parents=True)
+    (home / ".topos" / ".env").write_text("TOPOS_KEY=tk_scratch_not_real\n")
+    # Keep Hugging Face on the real cache: a scratch HOME is otherwise a cold
+    # cache, and startup's scope-head warm downloads the head again (~100s).
+    monkeypatch.setenv(
+        "HF_HOME",
+        os.environ.get("HF_HOME") or str(live_db_watch.REAL_HOME / ".cache" / "huggingface"),
+    )
+    monkeypatch.setenv("HOME", str(home))
+    monkeypatch.setattr(Path, "home", classmethod(lambda cls: home))
+    yield home
+    shutil.rmtree(home, ignore_errors=True)
+
+
+async def _tree_after_settling(root: Path, before: dict, seconds: float = 3.0) -> dict:
+    """The tree once background startup threads had a chance to act.
+
+    The owner socket is bound by a supervisor THREAD (``topos.uds``), usually
+    after the lifespan has already returned, so an immediate snapshot misses it.
+    Returns as soon as anything changed; waits the full ``seconds`` otherwise.
+    """
+    import asyncio
+    import time
+
+    deadline = time.monotonic() + seconds
+    while True:
+        now = _tree(root)
+        if now != before or time.monotonic() >= deadline:
+            return now
+        await asyncio.sleep(0.05)
+
+
+def _fresh_owner_state() -> None:
+    """The state a developer's machine starts a test run in: no owner key anywhere.
+
+    Deliberately NOT through monkeypatch. Monkeypatch would put the previous values
+    back at teardown and hide the leak this file is also about; restoring owner
+    state is the conftest's job, and ``test_owner_mode_did_not_leak_*`` below checks
+    it did it.
+    """
+    from topos.config.settings import settings
+
+    os.environ.pop("TOPOS_OWNER_KEY", None)
+    settings.topos_owner_key = None
+
+
+async def _run_lifespan(monkeypatch: pytest.MonkeyPatch, tmp_path: Path, *, with_cp: bool) -> None:
+    from topos import app as app_module
+    from topos.config.settings import settings
+    from topos.testing.lifespan import LifespanManager
+
+    class _FakeControlPlaneClient:
+        def __init__(self, control_plane_url, api_key, handler, verify_ssl=True):
+            del control_plane_url, api_key, handler, verify_ssl
+
+        def start(self) -> None:
+            pass
+
+        async def stop(self) -> None:
+            pass
+
+        async def send_message(self, message) -> None:
+            del message
+
+    monkeypatch.setattr(
+        settings, "control_plane_url", "ws://example.test/ws/engine" if with_cp else None,
+        raising=False,
+    )
+    monkeypatch.setattr(settings, "topos_database_path", str(tmp_path / "engine.db"))
+    monkeypatch.setattr(app_module, "ControlPlaneClient", _FakeControlPlaneClient)
+    async with LifespanManager(app_module.app):
+        pass
+
+
+def test_conftest_pins_every_topos_home_default_outside_any_home() -> None:
+    """The pins exist, and none of them points into a home directory."""
+    from tests import topos_home_pin
+
+    real_topos = os.path.realpath(os.path.join(live_db_watch.REAL_HOME, ".topos"))
+    pinned = topos_home_pin.pinned_paths()
+    for env_name in topos_home_pin.PINNED_ENV:
+        value = os.environ.get(env_name)
+        assert value, f"{env_name} is not pinned"
+        assert os.path.realpath(value) == os.path.realpath(pinned[env_name]), env_name
+        assert not os.path.realpath(value).startswith(real_topos + os.sep), (env_name, value)
+
+    from topos import owner_key, relay_stamp, uds
+    from topos.storage.raw.file_store import active_ingestion_base
+
+    assert owner_key._env_path() == Path(pinned["TOPOS_ENV_FILE"])
+    assert uds.socket_path() == Path(pinned["TOPOS_UDS_PATH"])
+    assert active_ingestion_base() == Path(pinned["TOPOS_INGESTION_BASE_PATH"])
+    assert Path(os.path.expanduser(relay_stamp._PINNED_KEY_PATH)).is_relative_to(
+        topos_home_pin.pinned_root()
+    )
+
+
+@pytest.mark.asyncio
+async def test_presence_lifespan_with_a_control_plane_leaves_home_untouched(
+    scratch_home: Path, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """The exact hazard: control-plane URL set -> dual-mint -> ensure_owner_key.
+
+    Before the fix this appended ``TOPOS_OWNER_KEY=`` to ``$HOME/.topos/.env`` and
+    bound ``$HOME/.topos/engine.sock``.
+    """
+    _fresh_owner_state()
+    before = _tree(scratch_home)
+    await _run_lifespan(monkeypatch, tmp_path, with_cp=True)
+    after = await _tree_after_settling(scratch_home, before)
+    assert after == before, {
+        "created": sorted(set(after) - set(before)),
+        "changed": sorted(k for k in before if k in after and after[k] != before[k]),
+        "removed": sorted(set(before) - set(after)),
+    }
+    assert "TOPOS_OWNER_KEY" not in (scratch_home / ".topos" / ".env").read_text()
+
+
+@pytest.mark.asyncio
+async def test_plain_lifespan_leaves_home_untouched(
+    scratch_home: Path, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A full lifespan start with no control plane touches nothing under HOME either."""
+    before = _tree(scratch_home)
+    await _run_lifespan(monkeypatch, tmp_path, with_cp=False)
+    after = await _tree_after_settling(scratch_home, before)
+    assert after == before, {
+        "created": sorted(set(after) - set(before)),
+        "changed": sorted(k for k in before if k in after and after[k] != before[k]),
+    }
+
+
+@pytest.mark.asyncio
+async def test_owner_mode_leak_setup_mints_a_key(
+    scratch_home: Path, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """First half of a pair: arm owner mode the way the presence test does.
+
+    The mint lands in the PINNED env file (so this also proves the pin is what
+    ``ensure_owner_key`` reads), and the key is left on the process exactly as the
+    lifespan leaves it. The next test checks the conftest took it back off.
+    """
+    from tests import topos_home_pin
+    from topos.config.settings import settings
+
+    _fresh_owner_state()
+    await _run_lifespan(monkeypatch, tmp_path, with_cp=True)
+    assert settings.topos_owner_key, "the dual-mint did not run; this pair proves nothing"
+    assert os.environ.get("TOPOS_OWNER_KEY") == settings.topos_owner_key
+    pinned_env = Path(topos_home_pin.pinned_paths()["TOPOS_ENV_FILE"])
+    assert f"TOPOS_OWNER_KEY={settings.topos_owner_key}" in pinned_env.read_text()
+
+
+def test_owner_mode_did_not_leak_out_of_the_previous_test() -> None:
+    """Second half. Runs after the one above (file order); alone it passes trivially.
+
+    Before the fix two ``tests/topos/test_ingestion_sources.py`` tests got 403
+    ``owner_mode_required`` on the beta lineage because this was still set.
+    """
+    from topos.config.settings import settings
+
+    assert not settings.topos_owner_key
+    assert "TOPOS_OWNER_KEY" not in os.environ
+
+
+# -- the widened guard: any file operation under ~/.topos, not only sqlite ---------
+
+
+def test_the_file_guard_watches_the_real_topos_home() -> None:
+    """Snapshotted from the real home at import, before any test can move HOME."""
+    assert live_db_watch.file_guard_is_installed()
+    real = os.path.realpath(os.path.join(os.path.expanduser("~"), ".topos"))
+    # This test runs under the real HOME, so the two must agree.
+    assert real in live_db_watch.watched_roots()
+
+
+@pytest.mark.parametrize(
+    "operation, kind",
+    [
+        (lambda root: (root / ".env").read_text(), "read"),
+        (lambda root: (root / ".env").open("a").write("X=1\n"), "write"),
+        (lambda root: os.open(root / "new", os.O_WRONLY | os.O_CREAT), "write"),
+        (lambda root: os.open(root / ".env", os.O_RDONLY), "read"),
+        (lambda root: (root / "sub").mkdir(), "write"),
+        (lambda root: os.replace(root / ".env", root / "moved"), "write"),
+        (lambda root: os.remove(root / ".env"), "write"),
+        (lambda root: os.chmod(root / ".env", 0o600), "write"),
+    ],
+    ids=["read_text", "append", "os.open-create", "os.open-read", "mkdir", "replace", "remove", "chmod"],
+)
+def test_any_file_operation_under_owner_data_is_refused_and_recorded(
+    tmp_path: Path, operation, kind: str
+) -> None:
+    """Against a throwaway root armed as owner data, never the real one."""
+    root = tmp_path / "pretend-topos"
+    root.mkdir()
+    (root / ".env").write_text("TOPOS_KEY=tk_scratch_not_real\n")
+    before = _tree(root)
+    with live_db_watch.watching_root(root) as capture:
+        with pytest.raises(PermissionError) as excinfo:
+            operation(root)
+        found = capture.captured()
+    assert _tree(root) == before, "the refusal must land BEFORE the operation"
+    assert live_db_watch.ALLOW_ENV in str(excinfo.value)
+    assert len(found) == 1, found
+    assert found[0].kind == kind
+    assert found[0].path.startswith(os.path.realpath(root))
+    assert __file__ in found[0].origin
+
+
+def test_binding_a_unix_socket_under_owner_data_is_refused() -> None:
+    """The owner socket: binding one where the running node serves its own.
+
+    Under /tmp, not tmp_path: macOS caps an AF_UNIX path at 104 bytes and checks
+    that before the audit event fires, so a long tmp_path proves nothing.
+    """
+    import shutil
+    import tempfile
+
+    root = Path(tempfile.mkdtemp(prefix="th-", dir="/tmp")).resolve()
+    try:
+        with live_db_watch.watching_root(root) as capture:
+            s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+            try:
+                with pytest.raises(PermissionError):
+                    s.bind(str(root / "e.sock"))
+            finally:
+                s.close()
+            found = capture.captured()
+        assert not (root / "e.sock").exists()
+        assert [f.kind for f in found] == ["write"]
+    finally:
+        shutil.rmtree(root, ignore_errors=True)
+
+
+def test_operations_outside_owner_data_are_not_recorded(tmp_path: Path) -> None:
+    root = tmp_path / "pretend-topos"
+    root.mkdir()
+    elsewhere = tmp_path / "elsewhere.txt"
+    with live_db_watch.watching_root(root) as capture:
+        elsewhere.write_text("fine")
+        elsewhere.read_text()
+        found = capture.captured()
+    assert found == []
+
+
+def test_the_opt_out_downgrades_the_file_guard_to_recording(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Same escape hatch as the database guard: record everything, refuse nothing."""
+    root = tmp_path / "pretend-topos"
+    root.mkdir()
+    monkeypatch.setenv(live_db_watch.ALLOW_ENV, "1")
+    with live_db_watch.watching_root(root) as capture:
+        (root / "x").write_text("allowed")
+        found = capture.captured()
+    assert (root / "x").read_text() == "allowed"
+    assert [f.refused for f in found] == [False]

{topos_node-1.3.56 → topos_node-1.4.0}/topos/__version__.py

@@ -1,6 +1,6 @@
 """Topos Control Plane Version Information."""
 
-__version__ = "1.3.56"
-__version_info__ = (1, 3, 56)
+__version__ = "1.4.0"
+__version_info__ = (1, 4, 0)
 
 __all__ = ["__version__", "__version_info__"]

{topos_node-1.3.56 → topos_node-1.4.0}/topos/api/ingestion_api.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 from fastapi import APIRouter, Body, Depends, HTTPException, Request
 
-from ..auth import require_api_key
+from ..auth import require_api_key, require_owner_unless_legacy
 from ..ingestion.reprocess import reprocess_source
 from .ingestion_sources import ingest_source
 
@@ -19,7 +19,7 @@ async def report_progress() -> dict:
     return {"status": "stub"}
 
 
-@router.post("/ingestion/reprocess", dependencies=[Depends(require_api_key)])
+@router.post("/ingestion/reprocess", dependencies=[Depends(require_owner_unless_legacy)])
 async def ingestion_reprocess(payload: dict = Body(default_factory=dict)) -> dict:
     """Re-run raw→canonical for a source (optional newest-N via ``limit``).
 

{topos_node-1.3.56 → topos_node-1.4.0}/topos/api/ingestion_sources.py

@@ -8,7 +8,7 @@ from typing import Optional
 
 from fastapi import APIRouter, Body, Depends, Query, Request  # noqa: F401 Body used in put_signal_settings
 
-from ..auth import require_api_key
+from ..auth import require_api_key, require_owner_unless_legacy
 from ..core.state import get_db_connection
 from ..ingestion.ingest_helpers import ingest_file_payload, ingest_ui_payload, resolve_file_format
 from ..ingestion.local_sync import run_signal_upload
@@ -191,7 +191,7 @@ async def put_source_settings_endpoint(
     return {"status": "ok", "dataset_id": dataset_id, "source_id": source_id, **settings}
 
 
-@router.post("/sources/{source_id}/sync", dependencies=[Depends(require_api_key)])
+@router.post("/sources/{source_id}/sync", dependencies=[Depends(require_owner_unless_legacy)])
 async def sync_source(
     source_id: str,
     dataset_id: Optional[str] = Query(default=None, description="Dataset/owner scope for checkpoint and messages"),
@@ -262,7 +262,7 @@ async def get_job_progress(job_id: str):
     return {"status": "ok", **_progress_dict(job)}
 
 
-@router.post("/sources/signal/upload", dependencies=[Depends(require_api_key)])
+@router.post("/sources/signal/upload", dependencies=[Depends(require_owner_unless_legacy)])
 async def upload_signal_export(
     request: Request,
     dataset_id: Optional[str] = Query(default=None),

{topos_node-1.3.56 → topos_node-1.4.0}/topos/api/local_mcp.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import uuid
 
-from fastapi import APIRouter, Body, Depends
+from fastapi import APIRouter, Body, Depends, HTTPException
 
 from ..auth import resolve_request_principal
 from ..core.handlers import handle_control_plane_request
@@ -20,6 +20,22 @@ def _local_mcp_payload(extra: dict | None = None) -> dict:
     return p
 
 
+def _truth_door(msg_type: str):
+    """The truth routes' principal dependency: the handler's own door decision
+    (topos/query/truth_door.py), answered as an HTTP 403 before the route reads
+    the body instead of a 200 error body after it."""
+
+    def admitted(principal=Depends(resolve_request_principal)):  # noqa: B008
+        from ..query.truth_door import truth_door_refusal
+
+        refused = truth_door_refusal(principal, msg_type)
+        if refused:
+            raise HTTPException(status_code=refused["code"], detail=refused["error"])
+        return principal
+
+    return admitted
+
+
 @router.post("/list_database_tables")
 async def local_list_database_tables(principal=Depends(resolve_request_principal)) -> dict:  # noqa: B008
     """List tables (same as CP-forwarded tool). Requires Bearer TOPOS_KEY."""
@@ -33,12 +49,14 @@ async def local_list_database_tables(principal=Depends(resolve_request_principal
 @router.post("/verify_claim")
 async def local_verify_claim(
     body: dict = Body(default_factory=dict),
-    principal=Depends(resolve_request_principal),  # noqa: B008
+    principal=Depends(_truth_door("verify_claim")),  # noqa: B008
 ) -> dict:
-    """Same-device truth check (PLAN_TRUTHFULNESS_PLUGIN.md). Owner-key only;
-    mirrors the CP door: `app_id` is mandatory and `mode` is pinned to fun —
-    this route cannot reach a mode the registry doesn't ship. Body:
-    {"statement": "...", "app_id": "truth-mirror"}."""
+    """Same-device truth check (PLAN_TRUTHFULNESS_PLUGIN.md). The owner socket,
+    or an enrolled client the owner lists in TOPOS_TRUTH_CLIENT_ALLOWLIST; any
+    bearer on TCP otherwise gets 403 owner_mode_required — the owner key there
+    is a third party too. Mirrors the CP door: `app_id` is mandatory and `mode`
+    is pinned to fun, so this route cannot reach a mode the registry doesn't
+    ship. Body: {"statement": "...", "app_id": "truth-mirror"}."""
     statement = str(body.get("statement") or "").strip()
     app_id = str(body.get("app_id") or "").strip()
     if not statement or not app_id:
@@ -57,10 +75,10 @@ async def local_verify_claim(
 @router.post("/truth_prompts")
 async def local_truth_prompts(
     body: dict = Body(default_factory=dict),
-    principal=Depends(resolve_request_principal),  # noqa: B008
+    principal=Depends(_truth_door("truth_prompts")),  # noqa: B008
 ) -> dict:
     """Same-device "ask me" prompt seeds (fun aperture; topics only, no
-    stances). Body: {"app_id": "truth-mirror", "limit": 5}."""
+    stances). Same door as verify_claim. Body: {"app_id": "truth-mirror", "limit": 5}."""
     app_id = str(body.get("app_id") or "").strip()
     if not app_id:
         return {"status": "error", "error": "app_id required"}
@@ -79,11 +97,12 @@ async def local_truth_prompts(
 @router.post("/truth_seed_fact")
 async def local_truth_seed_fact(
     body: dict = Body(default_factory=dict),
-    principal=Depends(resolve_request_principal),  # noqa: B008
+    principal=Depends(_truth_door("truth_seed_fact")),  # noqa: B008
 ) -> dict:
     """Owner adds a fun fact to their own sheet (refused outside the fun
-    aperture). Body: {"predicate": "favorite_food", "value": "tacos",
-    "app_id": "truth-mirror"}."""
+    aperture). Owner socket only: the fact is stored as owner-stated, so no
+    enrolled client and no bearer on TCP may author it. Body:
+    {"predicate": "favorite_food", "value": "tacos", "app_id": "truth-mirror"}."""
     app_id = str(body.get("app_id") or "").strip()
     if not app_id:
         return {"status": "error", "error": "app_id required"}

topos_node-1.4.0/topos/api/permissions_identity.py

@@ -0,0 +1,30 @@
+"""Owner socket access to the same signed identity command as the CP relay."""
+from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from topos.auth import resolve_request_principal
+from topos.permissions_v2.canonical import MAX_BYTES, PolicyError, parse_json
+from topos.permissions_v2.identity_dispatch import execute_signed_identity_command
+
+router = APIRouter(prefix="/v1/permissions-beta/v2/identity", tags=["permissions-beta-owner-identity"])
+
+
+@router.post("/command")
+async def command(request: Request, principal=Depends(resolve_request_principal)):
+    body = bytearray()
+    async for chunk in request.stream():
+        body.extend(chunk)
+        if len(body) > MAX_BYTES:
+            raise HTTPException(400, "identity_payload_invalid")
+    try:
+        payload = parse_json(bytes(body))
+        if not isinstance(payload, dict) or set(payload) != {"envelope"}:
+            raise PolicyError("identity_payload_invalid")
+        ack = await execute_signed_identity_command(payload["envelope"], principal=principal)
+        return JSONResponse({"ack": ack.model_dump()}, headers={"Cache-Control": "no-store"})
+    except PolicyError as exc:
+        code = 404 if exc.code in {"permissions_v2_disabled", "identity_attestations_disabled"} else 403
+        raise HTTPException(code, "identity_disabled" if code == 404 else "identity_authority_invalid",
+                            headers={"Cache-Control": "no-store"}) from None
+    except Exception:
+        raise HTTPException(503, "identity_unavailable", headers={"Cache-Control": "no-store"}) from None

topos_node-1.4.0/topos/api/permissions_ingestion.py

@@ -0,0 +1,30 @@
+"""Owner socket access to the same signed beta command as the CP relay."""
+from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi.responses import JSONResponse
+
+from topos.auth import resolve_request_principal
+from topos.permissions_v2.canonical import MAX_BYTES, PolicyError, parse_json
+from topos.permissions_v2.ingest_dispatch import execute_signed_ingest
+
+router = APIRouter(prefix="/v1/permissions-beta/v2/ingestion", tags=["permissions-beta-owner-ingestion"])
+
+
+@router.post("/command")
+async def command(request: Request, principal=Depends(resolve_request_principal)):
+    body = bytearray()
+    async for chunk in request.stream():
+        body.extend(chunk)
+        if len(body) > MAX_BYTES:
+            raise HTTPException(400, "ingest_payload_invalid")
+    try:
+        payload = parse_json(bytes(body))
+        if not isinstance(payload, dict) or set(payload) != {"envelope"}:
+            raise PolicyError("ingest_payload_invalid")
+        ack = await execute_signed_ingest(payload["envelope"], principal=principal)
+        return JSONResponse({"ack": ack.model_dump()}, headers={"Cache-Control": "no-store"})
+    except PolicyError as exc:
+        code = 404 if exc.code in {"permissions_v2_disabled", "ingest_snapshots_disabled"} else 403
+        raise HTTPException(code, "ingest_disabled" if code == 404 else "ingest_authority_invalid",
+                            headers={"Cache-Control": "no-store"}) from None
+    except Exception:
+        raise HTTPException(503, "ingest_unavailable", headers={"Cache-Control": "no-store"}) from None