topos-node 1.4.2__tar.gz → 1.4.4__tar.gz

{topos_node-1.4.2/topos_node.egg-info → topos_node-1.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: topos-node
-Version: 1.4.2
+Version: 1.4.4
 Summary: Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://topos.dialogues.ai

{topos_node-1.4.2 → topos_node-1.4.4}/pyproject.toml

@@ -9,7 +9,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "topos-node"
-version = "1.4.2"
+version = "1.4.4"
 description = "Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client"
 readme = "README.md"
 license = "Apache-2.0"

{topos_node-1.4.2 → topos_node-1.4.4}/tests/test_hub_pipeline_offline_first.py

@@ -181,26 +181,14 @@ def test_the_privacy_filter_loads_through_the_cache_first(calls, monkeypatch):
     assert kwargs == {"tokenizer": ("AutoTokenizer", repo), "device": "cpu"}
 
 
-def test_the_nsfw_classifier_loads_through_the_cache_first_and_keeps_every_label(
-    calls, monkeypatch
-):
+def test_the_nsfw_tag_loads_nothing(calls, monkeypatch):
+    """The NSFW tag is a rule now: no Hub call, no cache slot, no pipeline, whatever the text."""
     from topos.engine import model_cache
     from topos.sanitization import nsfw_classifier
 
-    repo = nsfw_classifier.DEFAULT_NSFW_CLASSIFIER_MODEL
     monkeypatch.setattr(model_cache, "get_model_cache", lambda: _PassThroughCache())
-
-    nsfw_classifier._get_pipeline(repo)
-
-    assert [(name, kw) for name, _repo, kw in calls.from_pretrained] == [
-        ("AutoTokenizer", {"local_files_only": True}),
-        ("AutoModelForSequenceClassification", {"local_files_only": True}),
-    ]
-    ((task, model, kwargs),) = calls.pipeline
-    assert task == "text-classification"
-    assert model == ("AutoModelForSequenceClassification", repo)
-    # top_k=None is what makes the classifier return both labels, not only the top one.
-    assert kwargs == {"tokenizer": ("AutoTokenizer", repo), "top_k": None}
+    assert nsfw_classifier.classify_nsfw_text("a pornographic film")[0] is True
+    assert calls.from_pretrained == [] and calls.pipeline == []
 
 
 def test_settings_switch_off_the_safetensors_conversion_probe():

{topos_node-1.4.2 → topos_node-1.4.4}/tests/test_lane_shards.py

@@ -137,6 +137,9 @@ def test_no_prefix_is_claimed_twice() -> None:
         ("tests/permissions_v2/test_evidence.py::test_x", "permissions_v2"),
         # the longer prefix wins over tests/permissions_v2/
         ("tests/permissions_v2/test_message_search_index.py::test_x", "message_search_gap"),
+        ("tests/permissions_v2/test_journal_family.py::test_x", "permissions_v2_families"),
+        # test_message_search_* stays with message_search_gap; test_search_* is the families slice
+        ("tests/permissions_v2/test_search_send_token.py::test_x", "permissions_v2_families"),
         ("tests/gap/p3/engine/test_x.py::TestY::test_z[a-b]", "message_search_gap"),
         ("tests/features/test_x.py::test_y", "features_topos_core"),
         ("tests/topos/test_x.py::test_y", "features_topos_core"),

{topos_node-1.4.2 → topos_node-1.4.4}/topos/__version__.py

@@ -1,6 +1,6 @@
 """Topos Control Plane Version Information."""
 
-__version__ = "1.4.2"
-__version_info__ = (1, 4, 2)
+__version__ = "1.4.4"
+__version_info__ = (1, 4, 4)
 
 __all__ = ["__version__", "__version_info__"]

{topos_node-1.4.2 → topos_node-1.4.4}/topos/analytics/person_graph.py

@@ -403,6 +403,15 @@ BAND_DISCUSSED = "discussed"
 BAND_AMBIENT = "ambient"
 BAND_ORDER = (BAND_CORE, BAND_NAMED, BAND_DISCUSSED, BAND_AMBIENT)
 
+#: How often a name has to come up before it belongs on the default graph.
+#:
+#: Same count as the reading lane (`person_reading.MIN_OWNER_ROWS`). A local model
+#: and a node on the picture are the same decision: people you message, and people
+#: named often in conversations you take part in. A name that merely appears in two
+#: connectors is exposure, not a relationship — that rule is what filled the graph
+#: with everybody a data source had ever mentioned.
+FREQUENT_MENTIONS = 5
+
 #: Sources whose rows are exposure rather than expression. Read from the SOURCE CONTRACT
 #: (`sources.registry.effective_posture`), never from a list of connector names — the first
 #: draft of this model ranked grow_journal > imessage > browser_visits, which is three
@@ -441,17 +450,38 @@ def classify_band(*, messaged: bool, owner_authored: int, distinct_sources: int,
 
     The reason is not decoration. "Seen once, on a page you visited" is falsifiable and the
     owner can correct it; a rank cannot be argued with.
+
+    Default-visible bands are core and named. Discussed and ambient stay in the
+    data and off the picture until the owner asks for them.
+
+    * core — you exchanged messages with them
+    * named — you wrote their name often, or it comes up often in conversations
+      you took part in (`FREQUENT_MENTIONS`, the reading lane's bar)
+    * discussed — a real mention, but not often enough to feature
+    * ambient — passing sightings, including a name that only shows up because
+      two different data sources both extracted it
     """
     if messaged:
         return BAND_CORE, "you exchange messages with them"
+    if owner_authored >= FREQUENT_MENTIONS:
+        times = "time" if owner_authored == 1 else "times"
+        return BAND_NAMED, f"you wrote their name {owner_authored} {times}"
+    if non_ambient_mentions >= FREQUENT_MENTIONS:
+        return BAND_NAMED, (
+            f"mentioned {non_ambient_mentions} times in things you took part in"
+        )
     if owner_authored > 0:
-        return BAND_NAMED, "you wrote their name down yourself"
-    if distinct_sources >= 2:
-        return BAND_NAMED, f"they turn up in {distinct_sources} different places"
-    if non_ambient_mentions > 0 and mention_count >= 2:
-        return BAND_DISCUSSED, f"mentioned {mention_count} times in things you took part in"
+        times = "time" if owner_authored == 1 else "times"
+        return BAND_DISCUSSED, f"you wrote their name {owner_authored} {times}"
     if non_ambient_mentions > 0:
-        return BAND_AMBIENT, "mentioned once, in something you took part in"
+        times = "time" if mention_count == 1 else "times"
+        return BAND_DISCUSSED, (
+            f"mentioned {mention_count} {times} in things you took part in"
+        )
+    if distinct_sources >= 2:
+        return BAND_AMBIENT, (
+            f"named in {distinct_sources} places, but you have not talked with them"
+        )
     return BAND_AMBIENT, ("seen once in passing" if mention_count <= 1
                           else f"seen {mention_count} times in passing, never discussed")
 

{topos_node-1.4.2 → topos_node-1.4.4}/topos/api/home_chat.py

@@ -57,7 +57,10 @@ async def get_home_chat_session(
     user_id: str = Query(..., min_length=1),
 ) -> Dict[str, Any]:
     conn = _get_conn()
-    row = home_chat_store.get_session(conn, user_id=user_id.strip(), session_id=session_id.strip())
+    try:
+        row = home_chat_store.get_session(conn, user_id=user_id.strip(), session_id=session_id.strip())
+    except ValueError as exc:
+        raise _map_store_error(exc) from exc
     if not row:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Session not found")
     return row

{topos_node-1.4.2 → topos_node-1.4.4}/topos/api/ingestion_sources.py

@@ -7,8 +7,9 @@ from datetime import datetime, timezone
 from typing import Optional
 
 from fastapi import APIRouter, Body, Depends, Query, Request  # noqa: F401 Body used in put_signal_settings
+from fastapi.security import HTTPAuthorizationCredentials
 
-from ..auth import require_api_key, require_owner_unless_legacy
+from ..auth import bearer_scheme, require_api_key, require_owner_unless_legacy, resolve_request_principal
 from ..core.state import get_db_connection
 from ..ingestion.ingest_helpers import ingest_file_payload, ingest_ui_payload, resolve_file_format
 from ..ingestion.local_sync import run_signal_upload
@@ -57,8 +58,14 @@ async def ingest_source(
     source = REGISTRY.get(source_id)
     if not source:
         return {"status": "error", "error": "unknown source_id"}
+    # The door that wrote these rows, from the credential, never the body
+    # (features/provenance/writer_class.py). This route has no principal
+    # contextvar of its own, so the helpers are told explicitly.
+    from ..auth import resolve_request_writer_class
+    from ..features.provenance.writer_class import WRITER_OWNER_IMPORT
 
     if is_file_delivery(source):
+        writer_class = await resolve_request_writer_class(request, owner_class=WRITER_OWNER_IMPORT)
         file = None
         if request.headers.get("content-type", "").startswith("multipart/"):
             form = await request.form()
@@ -91,6 +98,7 @@ async def ingest_source(
                 file_path=file_path,
                 source_id=source_id,
                 file_format=resolve_file_format(source_definition=source, file_path=file_path),
+                writer_class=writer_class,
             )
         payload_bytes = await file.read()
         guard = await submit_usage_guard_check(
@@ -109,6 +117,7 @@ async def ingest_source(
             file_bytes=payload_bytes,
             source_id=source_id,
             file_format=resolve_file_format(source_definition=source),
+            writer_class=writer_class,
         )
 
     if accepts_app_ingest(source):
@@ -124,6 +133,7 @@ async def ingest_source(
             schema_id=source.schema_id,
             payload=payload,
             source_id=source_id,  # Pass source_id to enable direct processing
+            writer_class=await resolve_request_writer_class(request),
         )
 
     if source.delivery == DELIVERY_LOCAL_SYNC:
@@ -136,10 +146,26 @@ async def ingest_source(
     return {"status": "error", "error": "unsupported source type"}
 
 
+async def _proof_standing_as(principal, action: str, body) -> dict:
+    """The owner's standing iMessage attestation through this door, as the websocket door runs it
+    (``core.handlers.sources._proof_standing``), under the request's own principal. ``imessage_standing``
+    refuses anyone but the owner on the owner's channels (``owner_authority_required``)."""
+    from ..core.handlers.sources import _proof_standing
+    from ..principal import reset_principal, set_principal
+
+    token = set_principal(principal)
+    try:
+        return await asyncio.to_thread(_proof_standing, action, body)
+    finally:
+        reset_principal(token)
+
+
 @router.get("/sources/{source_id}/settings", dependencies=[Depends(require_api_key)])
 async def get_source_settings_endpoint(
     source_id: str,
+    request: Request,
     dataset_id: Optional[str] = Query(default=None),
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(bearer_scheme),
 ):
     """Get source settings: enabled, last_sync_at, last_error (for local_sync: imessage, signal)."""
     source = REGISTRY.get(source_id)
@@ -151,16 +177,43 @@ async def get_source_settings_endpoint(
     if not conn:
         return {"status": "error", "error": "Database not available"}
     settings = get_source_settings(conn, dataset_id, source_id)
-    return {"status": "ok", "dataset_id": dataset_id, "source_id": source_id, **settings}
+    sync_settings = await asyncio.to_thread(_sync_settings_in_worker, dataset_id, source_id)
+    if source_id == "imessage":
+        # The standing attestation's state is the owner's to see (the websocket door's rule).
+        principal = resolve_request_principal(request, credentials)
+        if principal is not None and principal.cls == "owner_app":
+            sync_settings["proof_standing"] = await _proof_standing_as(principal, "status", None)
+    return {"status": "ok", "dataset_id": dataset_id, "source_id": source_id, **settings, **sync_settings}
+
+
+def _sync_settings_in_worker(dataset_id: str, source_id: str, changes: Optional[dict] = None) -> dict:
+    """Save (when ``changes``) and describe the sync schedule, on this thread's own connection.
+
+    The same fields the websocket door returns, so the two doors cannot drift.
+    """
+    from ..ingestion.local_sync_schedule import describe_sync_settings, put_schedule
+
+    own = get_db_connection()
+    if own is None:
+        return {}
+    if changes is not None:
+        put_schedule(own, dataset_id, source_id, changes)
+    return describe_sync_settings(own, dataset_id, source_id)
 
 
 @router.put("/sources/{source_id}/settings", dependencies=[Depends(require_api_key)])
 async def put_source_settings_endpoint(
     source_id: str,
+    request: Request,
     dataset_id: Optional[str] = Query(default=None),
     body: Optional[dict] = Body(default=None),
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(bearer_scheme),
 ):
-    """Set source settings (e.g. enabled, exclude_spam). Valid for local_sync sources (imessage, signal)."""
+    """Set source settings (e.g. enabled, exclude_spam, sync_schedule). Valid for local_sync sources (imessage, signal).
+
+    ``sync_schedule`` is owner-only, under the same rule as the sync route: it
+    makes the node sync on its own clock.
+    """
     source = REGISTRY.get(source_id)
     if not source:
         return {"status": "error", "error": "unknown source_id"}
@@ -173,22 +226,44 @@ async def put_source_settings_endpoint(
     enabled = body.get("enabled")
     posture_provided = "posture" in body
     exclude_spam_provided = "exclude_spam" in body
-    if enabled is None and not posture_provided and not exclude_spam_provided:
-        return {"status": "error", "error": "enabled, posture, or exclude_spam required in body"}
+    schedule_provided = "sync_schedule" in body
+    # The owner's standing iMessage attestation (owner decision 1), as on the websocket door.
+    standing_provided = "proof_standing" in body
+    if standing_provided and source_id != "imessage":
+        return {"status": "error", "error": "proof_standing only applies to imessage"}
+    if (enabled is None and not posture_provided and not exclude_spam_provided and not schedule_provided
+            and not standing_provided):
+        return {"status": "error", "error": "enabled, posture, exclude_spam, sync_schedule, or proof_standing required in body"}
+    if schedule_provided or standing_provided:
+        # Raises 403 owner_mode_required for any principal but the owner's.
+        require_owner_unless_legacy(request, credentials)
+    standing_request = body.get("proof_standing") if isinstance(body.get("proof_standing"), dict) else {}
+    if standing_provided and standing_request.get("action") not in ("status", "preview", "arm", "disarm"):
+        return {"status": "error", "error": "proof_standing.action must be status, preview, arm or disarm"}
     conn = get_db_connection()
     if not conn:
         return {"status": "error", "error": "Database not available"}
-    put_kwargs: dict = {"enabled": enabled}
-    if posture_provided:
-        put_kwargs["posture"] = body.get("posture")
-    if exclude_spam_provided:
-        put_kwargs["exclude_spam"] = bool(body.get("exclude_spam"))
     try:
-        put_source_settings(conn, dataset_id, source_id, **put_kwargs)
+        if enabled is not None or posture_provided or exclude_spam_provided:
+            put_kwargs: dict = {"enabled": enabled}
+            if posture_provided:
+                put_kwargs["posture"] = body.get("posture")
+            if exclude_spam_provided:
+                put_kwargs["exclude_spam"] = bool(body.get("exclude_spam"))
+            put_source_settings(conn, dataset_id, source_id, **put_kwargs)
+        sync_settings = await asyncio.to_thread(
+            _sync_settings_in_worker,
+            dataset_id,
+            source_id,
+            body.get("sync_schedule") if schedule_provided else None,
+        )
     except ValueError as exc:
         return {"status": "error", "error": str(exc)}
+    if standing_provided:
+        sync_settings["proof_standing"] = await _proof_standing_as(
+            resolve_request_principal(request, credentials), standing_request["action"], standing_request)
     settings = get_source_settings(conn, dataset_id, source_id) or {}
-    return {"status": "ok", "dataset_id": dataset_id, "source_id": source_id, **settings}
+    return {"status": "ok", "dataset_id": dataset_id, "source_id": source_id, **settings, **sync_settings}
 
 
 @router.post("/sources/{source_id}/sync", dependencies=[Depends(require_owner_unless_legacy)])
@@ -291,12 +366,16 @@ async def upload_signal_export(
             file_bytes = await f.read()
     if not file_bytes:
         return {"status": "error", "error": "file required (multipart/form-data)"}
+    from ..auth import resolve_request_writer_class
+    from ..features.provenance.writer_class import WRITER_OWNER_IMPORT
+
     result = await asyncio.to_thread(
         run_signal_upload,
         dataset_id,
         file_bytes,
         my_phone_number=my_phone_number,
         owner_user_id=owner_user_id,
+        writer_class=await resolve_request_writer_class(request, owner_class=WRITER_OWNER_IMPORT),
     )
     return result
 

topos_node-1.4.4/topos/api/nsfw_maintenance.py

@@ -0,0 +1,106 @@
+"""Owner socket maintenance of the NSFW tags: the explicit-wording sweep, by hand, with counts.
+
+``POST /v1/privacy/nsfw-recheck`` on the node's owner socket only (the 0600 UDS; no bearer, no relay). Body, all
+optional: ``{"dry_run": true|false, "tables": [<table>, ...]}``. ``dry_run`` defaults to true: a bare POST
+evaluates every row of the three tables with the rule and answers what a write run would change, writing nothing.
+``"dry_run": false`` runs the same sweep the node runs for itself at startup (``topos.disclosure.nsfw_tags``),
+over every row, now. ``tables`` limits either to some of ``journal_entries``, ``conversation_messages`` and
+``ai_chat_messages``. The answer is counts (``nsfw_tags.COUNTS`` per table and in total); no id, text or
+matched word.
+
+``POST /v1/privacy/disclosure-check`` on the same socket counts the PII disclosure backlog the node's own sweep is
+working through (``topos.disclosure.disclosure_sweep``), and never writes.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Any, Optional
+
+from fastapi import APIRouter, Body, Depends, HTTPException
+from fastapi.responses import JSONResponse
+
+from topos.auth import resolve_request_principal
+
+router = APIRouter(prefix="/v1/privacy", tags=["privacy-owner-maintenance"])
+
+_NO_STORE = {"Cache-Control": "no-store"}
+_FIELDS = frozenset({"dry_run", "tables"})
+
+
+def _invalid() -> HTTPException:
+    return HTTPException(400, "nsfw_recheck_payload_invalid", headers=_NO_STORE)
+
+
+def _valid_tables(value: Any) -> bool:
+    from topos.disclosure.nsfw_tags import TABLES
+
+    return (type(value) is list and bool(value) and all(type(item) is str for item in value)
+            and len(set(value)) == len(value) and set(value) <= set(TABLES))
+
+
+@router.post("/nsfw-recheck")
+async def nsfw_recheck(payload: Optional[dict] = Body(None), principal=Depends(resolve_request_principal)):
+    from topos.principal import OWNER_APP
+
+    if principal is None or principal.cls != OWNER_APP or principal.channel != "uds":
+        raise HTTPException(403, "owner_socket_required", headers=_NO_STORE)
+    body = {} if payload is None else payload
+    if not isinstance(body, dict) or not set(body) <= _FIELDS:
+        raise _invalid()
+    dry_run = body.get("dry_run", True)
+    tables = body.get("tables")
+    if type(dry_run) is not bool or (tables is not None and not _valid_tables(tables)):
+        raise _invalid()
+
+    def apply():
+        from topos.core.state import get_db_connection
+        from topos.disclosure.nsfw_tags import run_sweep
+        from topos.runtime_shutdown import is_shutdown_requested
+
+        return run_sweep(get_db_connection, dry_run=dry_run, tables=tables, stop=is_shutdown_requested,
+                         full=not dry_run)
+
+    try:
+        result = await asyncio.to_thread(apply)
+    except Exception:  # noqa: BLE001 -- no path, row or exception text leaves the node
+        raise HTTPException(503, "nsfw_recheck_unavailable", headers=_NO_STORE) from None
+    return JSONResponse(result, headers=_NO_STORE)
+
+
+_DISCLOSURE_FIELDS = frozenset({"tables", "mode"})
+
+
+@router.post("/disclosure-check")
+async def disclosure_check(payload: Optional[dict] = Body(None), principal=Depends(resolve_request_principal)):
+    """Counts of the PII disclosure backlog, on the owner socket only; never writes.
+
+    Body, all optional: ``{"tables": [<table>, ...], "mode": "verify"|"pending"}``. ``verify`` (the default) reads
+    every row of the disclosed tables and checks each field's hash against its text, as the node's own sweep does
+    (``topos.disclosure.disclosure_sweep``); ``pending`` counts only fields with no disclosure at all. The answer is
+    counts per table and in total (``missing`` and ``stale`` are what the sweep still has to redact); no id or text.
+    The sweep itself needs no command: it runs at startup and on its intervals.
+    """
+    from topos.principal import OWNER_APP
+
+    if principal is None or principal.cls != OWNER_APP or principal.channel != "uds":
+        raise HTTPException(403, "owner_socket_required", headers=_NO_STORE)
+    body = {} if payload is None else payload
+    if not isinstance(body, dict) or not set(body) <= _DISCLOSURE_FIELDS:
+        raise HTTPException(400, "disclosure_check_payload_invalid", headers=_NO_STORE)
+    from topos.disclosure.disclosure_sweep import MODES, run_sweep
+    from topos.disclosure.field_registry import PII_DISCLOSURE_FIELDS
+
+    tables = body.get("tables")
+    mode = body.get("mode", "verify")
+    if mode not in MODES or (tables is not None and not (
+            type(tables) is list and tables and all(type(t) is str for t in tables)
+            and len(set(tables)) == len(tables) and set(tables) <= set(PII_DISCLOSURE_FIELDS))):
+        raise HTTPException(400, "disclosure_check_payload_invalid", headers=_NO_STORE)
+    from topos.core.state import get_db_connection
+
+    try:
+        result = await run_sweep(get_db_connection, mode=mode, dry_run=True, tables=tables)
+    except Exception:  # noqa: BLE001 -- no path, row or exception text leaves the node
+        raise HTTPException(503, "disclosure_check_unavailable", headers=_NO_STORE) from None
+    return JSONResponse(result, headers=_NO_STORE)

topos_node-1.4.4/topos/api/permissions_ai_chat_capture.py

@@ -0,0 +1,106 @@
+"""Owner socket: attest that pre-stamp AI-chat rows came from the owner's own capture app (OD-39).
+
+Rows the owner's capture app wrote before the node recorded writer classes carry
+no writer, so nothing on the row can tell them from a grantee's. The owner says
+so once, explicitly, and the node keeps the statement as an auditable receipt
+(``topos/permissions_v2/ai_chat_capture.py``); the rows themselves are never
+re-labelled. Two steps: ``preview`` returns counts and a digest of exactly the
+rows it would cover (no ids, no content); ``attest`` records a receipt only for
+that digest, with ``confirm: true``. ``revoke`` withdraws a receipt. Only the
+owner's socket may call any of them: an owner key over TCP, a relay message and a
+third party are refused.
+"""
+import asyncio
+import sqlite3
+
+from fastapi import APIRouter, Depends, HTTPException
+from fastapi.responses import JSONResponse
+
+from topos.auth import resolve_request_principal
+from topos.permissions_v2.canonical import PolicyError
+
+router = APIRouter(prefix="/v1/permissions-beta/v2/ai-chat/capture-attestation",
+                   tags=["permissions-owner-ai-chat-capture"])
+
+_NO_STORE = {"Cache-Control": "no-store"}
+_CONFLICT = {"capture_attestation_preview_stale", "capture_receipt_revoked"}
+_INVALID = {"capture_attestation_invalid", "capture_attestation_unconfirmed", "capture_receipt_unknown",
+            # The generalised receipts' named dataset (permissions_capture_receipts.py): not one install's to name.
+            "capture_attestation_dataset_unknown", "capture_attestation_dataset_not_this_node",
+            "capture_attestation_dataset_posture_unknown"}
+
+
+def _require_owner_socket(principal) -> None:
+    from topos.principal import OWNER_APP
+    if principal is None or principal.cls != OWNER_APP or principal.channel != "uds":
+        raise HTTPException(403, "owner_socket_required", headers=_NO_STORE)
+
+
+def _run(operation, *, write: bool):
+    """(owner_id, conn) -> result, on the served canonical database under the write gate."""
+    from topos.permissions_v2.runtime import get_runtime
+    from topos.storage.db.write_gate import with_db_write
+
+    runtime = get_runtime()
+    owner_id = runtime.protocol.ledger.identity.owner_id
+    path = runtime.protocol.canonical_database
+    with with_db_write():
+        conn = sqlite3.connect(path.as_uri() + ("?mode=rw" if write else "?mode=ro"), uri=True, timeout=30)
+        try:
+            conn.execute("BEGIN IMMEDIATE" if write else "BEGIN")
+            result = operation(owner_id, conn)
+            conn.commit() if write else conn.rollback()
+            return result
+        except BaseException:
+            conn.rollback()
+            raise
+        finally:
+            conn.close()
+
+
+async def _respond(operation, *, write: bool):
+    try:
+        result = await asyncio.to_thread(_run, operation, write=write)
+    except PolicyError as exc:
+        if exc.code in {"permissions_v2_disabled", "beta_configuration_required"}:
+            raise HTTPException(404, "permissions_v2_disabled", headers=_NO_STORE) from None
+        code = 409 if exc.code in _CONFLICT else 400 if exc.code in _INVALID else 403
+        raise HTTPException(code, exc.code, headers=_NO_STORE) from None
+    except HTTPException:
+        raise
+    except Exception:
+        raise HTTPException(503, "capture_attestation_unavailable", headers=_NO_STORE) from None
+    return JSONResponse(result, headers=_NO_STORE)
+
+
+@router.post("/preview")
+async def preview(payload: dict, principal=Depends(resolve_request_principal)):
+    from topos.permissions_v2 import ai_chat_capture
+    _require_owner_socket(principal)
+    return await _respond(lambda owner_id, conn: ai_chat_capture.preview(
+        conn, owner_id=owner_id, source_id=payload.get("source_id"), app_id=payload.get("app_id")), write=False)
+
+
+@router.post("/attest")
+async def attest(payload: dict, principal=Depends(resolve_request_principal)):
+    from topos.permissions_v2 import ai_chat_capture
+    _require_owner_socket(principal)
+    return await _respond(lambda owner_id, conn: ai_chat_capture.attest(
+        conn, owner_id=owner_id, source_id=payload.get("source_id"), app_id=payload.get("app_id"),
+        preview_digest=payload.get("preview_digest"), confirm=payload.get("confirm")), write=True)
+
+
+@router.post("/revoke")
+async def revoke(payload: dict, principal=Depends(resolve_request_principal)):
+    from topos.permissions_v2 import ai_chat_capture
+    _require_owner_socket(principal)
+    return await _respond(lambda owner_id, conn: ai_chat_capture.revoke(
+        conn, owner_id=owner_id, receipt_id=payload.get("receipt_id")), write=True)
+
+
+@router.get("/receipts")
+async def receipts(principal=Depends(resolve_request_principal)):
+    from topos.permissions_v2 import ai_chat_capture
+    _require_owner_socket(principal)
+    return await _respond(lambda owner_id, conn: {"receipts": ai_chat_capture.receipts(conn, owner_id=owner_id)},
+                          write=False)

topos_node-1.4.4/topos/api/permissions_capture_receipts.py

@@ -0,0 +1,74 @@
+"""Owner socket: attest that rows of a canonical table other than AI chat are the owner's own (OD-50, OD-52).
+
+The journal table's rows carry no owner and, before September 2026, no writer, so
+nothing on a row can tell the owner's entry from one another writer sent to the
+same source. The owner says so once, explicitly, and the node keeps the
+statement as an auditable receipt (``topos/permissions_v2/capture_receipts.py``);
+the rows themselves are never re-labelled. The flow is OD-39's
+(``permissions_ai_chat_capture.py``) with the table named: ``preview`` returns
+counts and a digest of exactly the rows it would cover (no ids, no content);
+``attest`` records a receipt only for that digest, with ``confirm: true``;
+``revoke`` withdraws one. Only the owner's socket may call any of them.
+
+For the AI-chat export import (``table: ai_chat_messages``) both ``preview`` and
+``attest`` take an optional ``dataset_id``: the dataset of the one install of the
+source the owner names as the one the import came through (a source with two live
+installs certifies none by elimination). ``preview`` lists the source's candidate
+installs (id, date, dataset, declared posture, whether it may be named, rows a
+receipt naming it would cover); a dataset that is not one install's this owner may
+name is refused (``capture_attestation_dataset_unknown``), and so is one whose
+install is scoped to another node's topos than this node's own
+(``capture_attestation_dataset_not_this_node``) or declares no posture
+(``capture_attestation_dataset_posture_unknown``). Nothing here writes an install
+row.
+"""
+from fastapi import APIRouter, Depends
+
+from topos.auth import resolve_request_principal
+
+from .permissions_ai_chat_capture import _require_owner_socket, _respond
+
+router = APIRouter(prefix="/v1/permissions-beta/v2/capture-attestation", tags=["permissions-owner-capture"])
+
+
+def _node_resource_id():
+    """This node's own topos (its ledger identity's resource id): the only one a named install may be scoped to."""
+    from topos.permissions_v2.runtime import get_runtime
+    return getattr(get_runtime().protocol.ledger.identity, "resource_id", None)
+
+
+@router.post("/preview")
+async def preview(payload: dict, principal=Depends(resolve_request_principal)):
+    from topos.permissions_v2 import capture_receipts
+    _require_owner_socket(principal)
+    return await _respond(lambda owner_id, conn: capture_receipts.preview(
+        conn, owner_id=owner_id, table=payload.get("table"), source_id=payload.get("source_id"),
+        app_id=payload.get("app_id"), dataset_id=payload.get("dataset_id"), resource_id=_node_resource_id()),
+        write=False)
+
+
+@router.post("/attest")
+async def attest(payload: dict, principal=Depends(resolve_request_principal)):
+    from topos.permissions_v2 import capture_receipts
+    _require_owner_socket(principal)
+    return await _respond(lambda owner_id, conn: capture_receipts.attest(
+        conn, owner_id=owner_id, table=payload.get("table"), source_id=payload.get("source_id"),
+        app_id=payload.get("app_id"), preview_digest=payload.get("preview_digest"),
+        confirm=payload.get("confirm"), dataset_id=payload.get("dataset_id"), resource_id=_node_resource_id()),
+        write=True)
+
+
+@router.post("/revoke")
+async def revoke(payload: dict, principal=Depends(resolve_request_principal)):
+    from topos.permissions_v2 import capture_receipts
+    _require_owner_socket(principal)
+    return await _respond(lambda owner_id, conn: capture_receipts.revoke(
+        conn, owner_id=owner_id, receipt_id=payload.get("receipt_id")), write=True)
+
+
+@router.get("/receipts")
+async def receipts(principal=Depends(resolve_request_principal)):
+    from topos.permissions_v2 import capture_receipts
+    _require_owner_socket(principal)
+    return await _respond(lambda owner_id, conn: {"receipts": capture_receipts.receipts(conn, owner_id=owner_id)},
+                          write=False)