topos-node 1.4.3__tar.gz → 1.5.0__tar.gz

{topos_node-1.4.3/topos_node.egg-info → topos_node-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: topos-node
-Version: 1.4.3
+Version: 1.5.0
 Summary: Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://topos.dialogues.ai

{topos_node-1.4.3 → topos_node-1.5.0}/pyproject.toml

@@ -9,7 +9,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "topos-node"
-version = "1.4.3"
+version = "1.5.0"
 description = "Topos personal AI engine (FastAPI): local data, sync, control plane WebSocket client"
 readme = "README.md"
 license = "Apache-2.0"

topos_node-1.5.0/tests/test_app_relay_wiring.py

@@ -0,0 +1,131 @@
+"""Review R1 (node), R-M8: the app hands relay frames to the dispatcher that applies the rules, and runs the pin thread.
+
+protects: both relay rules (a caller who is not the owner reaches only the share doors; a stamp that does not verify
+is refused) live in ``core.handlers.dispatch_relay_message``, and the retry of the first stamp-key pin lives in
+``relay_stamp.start_first_pin``. Whether a node applies any of it is decided by a few lines of ``topos/app.py``
+that no test ran: with ``_relay_dispatch`` rewritten to call ``handle_control_plane_request`` with the relay
+deferral (the handoff before the rules), or with ``start_first_pin()`` or ``stop_first_pin()`` removed, every nearby
+suite stayed green (the reviewer's mutant: 388 passed each time).
+
+This test starts the real app with a control plane address, takes the handler the app really gives its control-plane
+client, and sends it frames. No network: the client is a recorder, and the one request the pin thread makes is
+answered by a recorder that cannot be reached. Keys are made at run time; every id is invented.
+"""
+from __future__ import annotations
+
+import base64
+import threading
+import time
+
+import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from tests.test_topos_home_hermeticity import _fresh_owner_state, scratch_home  # noqa: F401 (fixture)
+
+KEY = Ed25519PrivateKey.generate()
+ANOTHER_KEY = Ed25519PrivateKey.generate()
+OWNER, SOMEONE_ELSE = "owner-1", "someone-else"
+
+
+def stamped(message, *, cls, acting, key=KEY):
+    from topos.relay_stamp import STAMP_FIELD, canonical_signing_payload
+
+    now = time.time()
+    stamp = {"v": 1, "cls": cls, "client_id": "some-client", "acting_user": acting, "iat": now, "exp": now + 100}
+    stamp["sig"] = base64.b64encode(key.sign(canonical_signing_payload(
+        stamp, msg_id=message["id"], msg_type=message["type"]))).decode("ascii")
+    return {**message, STAMP_FIELD: stamp}
+
+
+def pin_threads():
+    from topos import relay_stamp
+
+    return [thread for thread in threading.enumerate() if thread.name == relay_stamp.FIRST_PIN_THREAD and thread.is_alive()]
+
+
+@pytest.mark.asyncio
+async def test_the_app_gives_its_client_the_dispatcher_and_keeps_the_pin_thread(scratch_home, tmp_path, monkeypatch):  # noqa: F811
+    import httpx
+
+    from topos import app as app_module
+    from topos import relay_stamp
+    from topos.config.settings import settings
+    from topos.core.handlers.registry import HANDLERS
+    from topos.principal import OWNER_APP, THIRD_PARTY
+    from topos.testing.lifespan import LifespanManager
+
+    given, asked, reached = {}, [], []
+
+    class Client:
+        """Stands in for ControlPlaneClient: it keeps what the app hands it and connects to nothing."""
+
+        def __init__(self, control_plane_url, api_key, handler, verify_ssl=True):
+            given["handler"] = handler
+
+        def start(self) -> None:
+            pass
+
+        async def stop(self) -> None:
+            pass
+
+        async def send_message(self, message) -> None:
+            pass
+
+        def set_device_info_snapshot(self, payload) -> None:
+            pass
+
+    def unreachable(url, **_options):
+        asked.append(url)
+        raise ConnectionError("the control plane cannot be reached")
+
+    async def recorder(message):
+        reached.append(message["id"])
+        return {"id": message["id"], "status": "ok", "payload": {}}
+
+    _fresh_owner_state()
+    monkeypatch.setattr(settings, "control_plane_url", "wss://cp.example/ws/engine", raising=False)
+    monkeypatch.setattr(settings, "topos_database_path", str(tmp_path / "engine.db"))
+    monkeypatch.setattr(app_module, "ControlPlaneClient", Client)
+    monkeypatch.setattr(relay_stamp, "_PINNED_KEY_PATH", str(tmp_path / "pin" / "cp_stamp_key.pub"))
+    monkeypatch.delenv("TOPOS_CP_STAMP_PUBKEY", raising=False)
+    monkeypatch.setattr(httpx, "get", unreachable)                    # the pin thread's one kind of request
+    monkeypatch.setitem(HANDLERS, "query", recorder)
+    refused = {"status": "error", "code": 403, "error": "owner_mode_required"}
+    assert pin_threads() == []
+
+    async with LifespanManager(app_module.app):
+        relay = given["handler"]                                      # what the app really gave its client
+        # The node holds no key and its control plane cannot be reached: the pin thread is alive and trying.
+        for _ in range(100):
+            if asked:
+                break
+            time.sleep(0.02)
+        assert asked == ["https://cp.example/v1/relay/stamp-public-key"]
+        assert len(pin_threads()) == 1
+        # ... and while it holds none, a stamped frame is refused, never read as "no stamp".
+        assert await relay(stamped({"id": "f0", "type": "query", "payload": {}}, cls=OWNER_APP, acting=OWNER)) == {
+            "id": "f0", **refused}
+        # Now it holds the control plane's key.
+        monkeypatch.setenv("TOPOS_CP_STAMP_PUBKEY", base64.b64encode(KEY.public_key().public_bytes_raw()).decode())
+        frame = {"type": "query", "payload": {}}
+        # A verified third party who is not this node's owner: only the share doors.
+        assert await relay(stamped({"id": "f1", **frame}, cls=THIRD_PARTY, acting=SOMEONE_ELSE)) == {"id": "f1", **refused}
+        # A stamp that does not verify (another key's): refused, not the relay deferral.
+        assert await relay(stamped({"id": "f2", **frame}, cls=OWNER_APP, acting=OWNER, key=ANOTHER_KEY)) == {
+            "id": "f2", **refused}
+        assert reached == []
+        # The controls: the owner's own app, and a frame with no stamp, reach the handler through the same door.
+        assert (await relay(stamped({"id": "f3", **frame}, cls=OWNER_APP, acting=OWNER)))["status"] == "ok"
+        assert (await relay({"id": "f4", **frame}))["status"] == "ok"
+        assert reached == ["f3", "f4"]
+        # No key again, as at start: from here only shutdown's stop can end the thread (with a key held it would
+        # end by itself at its next try, and this test would not notice a shutdown that forgot to stop it).
+        monkeypatch.delenv("TOPOS_CP_STAMP_PUBKEY")
+        assert len(pin_threads()) == 1
+
+    # Shutdown ended the tries at once: the thread is gone, not waiting out its next ten minutes.
+    for _ in range(250):
+        if not pin_threads():
+            break
+        time.sleep(0.02)
+    assert pin_threads() == []

{topos_node-1.4.3 → topos_node-1.5.0}/tests/test_owner_database_hermeticity.py

@@ -389,8 +389,8 @@ def test_the_known_owner_database_modules_are_still_marked() -> None:
     """
     known = (
         "tests/gap/qq/engine/test_en_qq_eval_queries.py",
-        "tests/query/test_d13_grantee_tier_matrix.py",
-        "tests/query/test_selector_live_entity_grant.py",
+        # 1.5.0 (N8) deleted two of the six with the pipeline's grantee branches they drove:
+        # tests/query/test_d13_grantee_tier_matrix.py and tests/query/test_selector_live_entity_grant.py.
         "tests/adversarial/test_scope_break_iteration2_live_engine.py",
         "tests/adversarial/test_scope_break_iteration3b_handler_grantee.py",
         "tests/release/iteration4/test_live_engine_pressure.py",

{topos_node-1.4.3 → topos_node-1.5.0}/topos/__version__.py

@@ -1,6 +1,6 @@
 """Topos Control Plane Version Information."""
 
-__version__ = "1.4.3"
-__version_info__ = (1, 4, 3)
+__version__ = "1.5.0"
+__version_info__ = (1, 5, 0)
 
 __all__ = ["__version__", "__version_info__"]

{topos_node-1.4.3 → topos_node-1.5.0}/topos/api/permissions_ai_chat_capture.py

@@ -19,7 +19,7 @@ from fastapi.responses import JSONResponse
 from topos.auth import resolve_request_principal
 from topos.permissions_v2.canonical import PolicyError
 
-router = APIRouter(prefix="/v1/permissions-beta/v2/ai-chat/capture-attestation",
+router = APIRouter(prefix="/v1/sharing/ai-chat/capture-attestation",
                    tags=["permissions-owner-ai-chat-capture"])
 
 _NO_STORE = {"Cache-Control": "no-store"}

{topos_node-1.4.3 → topos_node-1.5.0}/topos/api/permissions_capture_receipts.py

@@ -28,7 +28,7 @@ from topos.auth import resolve_request_principal
 
 from .permissions_ai_chat_capture import _require_owner_socket, _respond
 
-router = APIRouter(prefix="/v1/permissions-beta/v2/capture-attestation", tags=["permissions-owner-capture"])
+router = APIRouter(prefix="/v1/sharing/capture-attestation", tags=["permissions-owner-capture"])
 
 
 def _node_resource_id():

{topos_node-1.4.3 → topos_node-1.5.0}/topos/api/permissions_identity.py

@@ -6,7 +6,7 @@ from topos.auth import resolve_request_principal
 from topos.permissions_v2.canonical import MAX_BYTES, PolicyError, parse_json
 from topos.permissions_v2.identity_dispatch import execute_signed_identity_command
 
-router = APIRouter(prefix="/v1/permissions-beta/v2/identity", tags=["permissions-beta-owner-identity"])
+router = APIRouter(prefix="/v1/sharing/identity", tags=["permissions-beta-owner-identity"])
 
 
 @router.post("/command")

{topos_node-1.4.3 → topos_node-1.5.0}/topos/api/permissions_ingestion.py

@@ -6,7 +6,7 @@ from topos.auth import resolve_request_principal
 from topos.permissions_v2.canonical import MAX_BYTES, PolicyError, parse_json
 from topos.permissions_v2.ingest_dispatch import execute_signed_ingest
 
-router = APIRouter(prefix="/v1/permissions-beta/v2/ingestion", tags=["permissions-beta-owner-ingestion"])
+router = APIRouter(prefix="/v1/sharing/ingestion", tags=["permissions-beta-owner-ingestion"])
 
 
 @router.post("/command")

{topos_node-1.4.3 → topos_node-1.5.0}/topos/api/permissions_native_probe.py

@@ -10,7 +10,7 @@ from topos.auth import resolve_request_principal
 from topos.permissions_v2.canonical import PolicyError
 from topos.permissions_v2.contract import Identifier, StrictModel
 
-router = APIRouter(prefix='/v1/permissions-beta/v2/imessage', tags=['permissions-owner-maintenance'])
+router = APIRouter(prefix='/v1/sharing/imessage', tags=['permissions-owner-maintenance'])
 
 
 class NativeProbeRequest(StrictModel):
@@ -283,7 +283,7 @@ def _resync_search(runtime) -> dict:
     the refresh has already committed.
     """
     import logging
-    import os
+    from topos.permissions_v2 import switches
     from topos.storage.db.write_gate import with_db_write
     log = logging.getLogger(__name__)
     out = {'protection_synced': False, 'grants': 0, 'ready': 0}
@@ -295,7 +295,7 @@ def _resync_search(runtime) -> dict:
     except Exception as exc:  # noqa: BLE001 -- class name only
         log.warning('native refresh protection sync failed (%s)', type(exc).__name__)
         return out
-    if os.environ.get('TOPOS_PERMISSIONS_V2_MESSAGE_SEARCH_ENABLED', '').lower() != 'true':
+    if not switches.on(switches.MESSAGE_SEARCH):
         return out
     try:
         index = runtime.message_search_index()

{topos_node-1.4.3 → topos_node-1.5.0}/topos/api/permissions_search_maintenance.py

@@ -4,7 +4,7 @@ from fastapi import APIRouter, Depends, HTTPException
 from topos.auth import resolve_request_principal
 from topos.core.handlers.permissions_v2 import handle_permissions_v2_message_search_rebuild
 
-router = APIRouter(prefix="/v1/permissions-beta/v2/message-search", tags=["permissions-owner-maintenance"])
+router = APIRouter(prefix="/v1/sharing/message-search", tags=["permissions-owner-maintenance"])
 
 
 @router.post("/rebuild")

{topos_node-1.4.3 → topos_node-1.5.0}/topos/api/permissions_source_installs.py

@@ -22,7 +22,7 @@ from topos.permissions_v2.canonical import PolicyError
 from .permissions_ai_chat_capture import _NO_STORE, _require_owner_socket
 from .permissions_capture_receipts import _node_resource_id
 
-router = APIRouter(prefix="/v1/permissions-beta/v2/source-installs", tags=["permissions-owner-maintenance"])
+router = APIRouter(prefix="/v1/sharing/source-installs", tags=["permissions-owner-maintenance"])
 
 _INVALID = {"source_id_required", "install_id_required", "install_deactivation_unconfirmed"}
 _CONFLICT = {"install_not_active", "install_last_active"}

{topos_node-1.4.3 → topos_node-1.5.0}/topos/api/signal.py

@@ -730,11 +730,20 @@ async def blackhole_entity(
     (third-party MCP agents, routines, grantees) is denied, and content
     mentioning it may only be processed by the tier's secure model set.
     Raises a rebuild-needed notification before the rebuild runs (D4).
+
+    Marking an entry whose clean-up has not completed runs that clean-up: the
+    retry of one that failed. Such a mark never loosens the entry's tier
+    (`blackhole.start_waiting_clean_up`; review R1 node, R-B1).
+
+    For an entry the upgrade carried and the owner has not acted on, this is
+    the owner's act (third fix round, ruling P.3): it becomes a full entry and
+    its clean-up runs. `entity_id` may be the entry's own id; an id of that
+    shape that is no entry answers 404 and makes nothing (review R2-H3).
     """
     import asyncio
 
     from ..core.state import close_thread_db_connection
-    from ..features.lifecycle.blackhole import BlackholeStore
+    from ..features.lifecycle.blackhole import BlackholeStore, start_waiting_clean_up
     from ..features.lifecycle.blackhole_rebuild import rebuild_for_blackhole
 
     _entities_conn()  # fail fast with 503 before spawning the worker
@@ -744,23 +753,34 @@ async def blackhole_entity(
     def _blackhole():
         try:
             conn = _entities_conn()
-            result = BlackholeStore(conn).blackhole_entity(
-                entity_ref=entity_id,
-                processing_tier=processing_tier,
-                note=note,
-            )
+            store = BlackholeStore(conn)
+            result = start_waiting_clean_up(store, entity_id, processing_tier=processing_tier, note=note)
+            if result is None:
+                result = store.blackhole_entity(
+                    entity_ref=entity_id,
+                    processing_tier=processing_tier,
+                    note=note,
+                )
             # D4: the notification above was raised first, so the owner already
             # knows the hide is incomplete; now do the rebuild that makes it
             # true. Same worker / same connection — do not hop back to the loop
             # with a write-gate hold still possible.
-            if not result.get("already_blackholed"):
+            if not result.get("already_blackholed") or result.get("rebuild_state") != "complete":
                 result["rebuild"] = rebuild_for_blackhole(conn, entity_id).as_dict()
-            return result
+            # The entry as the list shows it now, then what this call itself answers (as the relay handler does).
+            from ..features.lifecycle.off_limits_list import describe
+
+            record = store.get(str(result.get("blackhole_id") or entity_id))
+            return {**(describe(conn, record) if record else {}),
+                    **{key: result[key] for key in ("already_blackholed", "notification_id", "rebuild")
+                       if key in result}}
         finally:
             close_thread_db_connection()
 
     try:
         return await asyncio.to_thread(_blackhole)
+    except LookupError as exc:
+        raise HTTPException(status_code=404, detail=str(exc))
     except ValueError as exc:
         raise HTTPException(status_code=400, detail=str(exc))
 
@@ -770,7 +790,10 @@ async def unblackhole_entity(
     entity_id: str,
     _api_key: str = Depends(require_api_key),
 ):
-    """Lift a black hole. Existing grants are not restored — normal permissions resume."""
+    """Lift a black hole. Existing grants are not restored — normal permissions resume.
+
+    `entity_id` may be the entry's own id: an entry with no linked entity, a
+    handle only or an id only is removed that way (review R2-H3)."""
     import asyncio
 
     from ..core.state import close_thread_db_connection
@@ -788,17 +811,19 @@ async def unblackhole_entity(
 
 
 @router.get("/blackholes")
-async def list_blackholes(_api_key: str = Depends(require_api_key)):
-    """The owner's off-limits list (mirrors the exclusions list in the drawer)."""
-    from ..features.lifecycle.blackhole import BlackholeStore
+async def list_blackholes(
+    preview: Optional[str] = Query(default=None, max_length=40),
+    _api_key: str = Depends(require_api_key),
+):
+    """The owner's off-limits list (mirrors the exclusions list in the drawer).
 
-    store = BlackholeStore(_entities_conn())
-    from ..features.lifecycle.record_protection import RecordProtectionStore
+    Each row says whether the entry is carried and waiting, what to show it
+    as, and its clean-up's state in true words. `preview=<an entry's own id>`
+    adds what that entry's clean-up would withdraw, counted and not written
+    (`off_limits_list.listing`)."""
+    from ..features.lifecycle.off_limits_list import listing
 
-    return {"blackholes": store.list(), "notifications": store.notifications(state="open"),
-            "record_protection_supported": True,
-            "record_protection_tables": RecordProtectionStore(_entities_conn()).supported_tables(),
-            "records": RecordProtectionStore(_entities_conn()).list()}
+    return listing(_entities_conn(), preview=preview)
 
 
 class RecordBlackholeBody(BaseModel):

{topos_node-1.4.3 → topos_node-1.5.0}/topos/api/source_retention.py

@@ -19,7 +19,6 @@ whether the volume has room (``dry_run`` defaults to true); a real run refuses w
 from __future__ import annotations
 
 import asyncio
-import os
 from typing import Any, Dict, Optional
 
 from fastapi import APIRouter, Body, Depends, HTTPException
@@ -62,12 +61,14 @@ def _conn():
 async def _refresh_grant_indexes(principal) -> Dict[str, Any]:
     """The owner's own message-search rebuild, after the removal committed.
 
-    The same door as ``POST /v1/permissions-beta/v2/message-search/rebuild`` and the same
+    The same door as ``POST /v1/sharing/message-search/rebuild`` and the same
     switch as every owner change that can move what a grant releases. Without it, the
     index sweeper still drops any index whose member rows changed (fail closed), and a
     recipient search refuses until the next rebuild.
     """
-    if os.environ.get("TOPOS_PERMISSIONS_V2_MESSAGE_SEARCH_ENABLED", "").lower() != "true":
+    from topos.permissions_v2 import switches
+
+    if not switches.on(switches.MESSAGE_SEARCH):
         return {"status": "skipped", "reason": "message_search_disabled"}
     from topos.core.handlers.permissions_v2 import handle_permissions_v2_message_search_rebuild
     from topos.principal import reset_principal, set_principal

{topos_node-1.4.3 → topos_node-1.5.0}/topos/app.py

@@ -44,7 +44,6 @@ from .api import (
     source_retention as source_retention_routes,
     sources as sources_routes,
     sync as sync_routes,
-    uma_data as uma_data_routes,
     user_identity as user_identity_routes,
     usage as usage_routes,
     ui_config as ui_config_routes,
@@ -157,7 +156,6 @@ app.include_router(permissions_search_maintenance_routes.router)
 app.include_router(permissions_native_probe_routes.router)
 app.include_router(query_routes.router, prefix="/v1")
 app.include_router(messenger_analytics_routes.router, prefix="/v1")
-app.include_router(uma_data_routes.router)
 app.include_router(usage_routes.router)
 app.include_router(ui_config_routes.router)
 app.include_router(data_explorer_table_prefs_routes.router)
@@ -489,6 +487,7 @@ async def startup_event() -> None:
     try:
         # Owner decision 2: ring the control plane when the node's protection state moves, so it re-signs
         # the owner's unchanged grants without the owner's Sync click. Read-only; a no-op without the beta.
+        # It starts at once, retrying the sharing runtime's load until it loads (N4 decision 1).
         from .permissions_v2.protection_doorbell import start_at_startup as _start_protection_doorbell
 
         _start_protection_doorbell()
@@ -554,14 +553,16 @@ async def startup_event() -> None:
                 raise
         # Relay principal (P3): a message carrying a VERIFIED Ed25519 stamp
         # resolves to the CP's classification — a named third_party client
-        # (enrollable, elevatable) or the owner's native surface. Anything
-        # else keeps the CP_RELAY deferral: forwarded-id equality plus the
-        # CP-side containment, byte-identical to pre-P3 behavior, so a node
-        # and CP on different sides of this release keep working. Verification
-        # happens only on THIS channel — a stamp arriving over local HTTP is
-        # never parsed. The stamp is resolved INSIDE the dispatched coroutine —
-        # the client thread's contextvars do not cross run_coroutine_threadsafe,
-        # a wrapper closure does.
+        # (enrollable, elevatable) or the owner's native surface. A message
+        # with NO stamp keeps the CP_RELAY deferral: forwarded-id equality plus
+        # the CP-side containment, byte-identical to pre-P3 behavior. A message
+        # whose stamp is there but does not verify is refused (1.5.0, review
+        # S4 M1), and a verified third party who is not this node's owner
+        # reaches only the share doors (H1): see dispatch_relay_message.
+        # Verification happens only on THIS channel — a stamp arriving over
+        # local HTTP is never parsed. The stamp is resolved INSIDE the
+        # dispatched coroutine — the client thread's contextvars do not cross
+        # run_coroutine_threadsafe, a wrapper closure does.
         async def _relay_dispatch(message):
             from .core.handlers import dispatch_relay_message
 
@@ -585,11 +586,13 @@ async def startup_event() -> None:
 
         # P5: pin the CP's stamp verification key on first boot (TOFU over the
         # same TLS channel the relay already trusts). Threaded: a slow or down
-        # CP must not delay startup; an existing pin is never overwritten.
-        from .relay_stamp import autopin_stamp_key
+        # CP must not delay startup; an existing pin is never overwritten. While
+        # the node holds no key the thread tries again, backed off (1.5.0: a
+        # stamp this node cannot check is refused, so "no key until the next
+        # restart" would refuse every stamped frame until then); shutdown ends it.
+        from .relay_stamp import start_first_pin
 
-        threading.Thread(target=autopin_stamp_key, name="topos-stamp-autopin",
-                         daemon=True).start()
+        start_first_pin()
 
         state.control_plane_client = ControlPlaneClient(
             control_plane_url=settings.topos_control_plane_url,
@@ -737,6 +740,10 @@ async def shutdown_event() -> None:
         state.engine_presence_task = None
     if state.control_plane_client:
         await state.control_plane_client.stop()
+    # The first-pin thread waits between tries; tell it the app is gone (never blocks).
+    from .relay_stamp import stop_first_pin
+
+    stop_first_pin()
     if state.hosted_pool_lease_task:
         state.hosted_pool_lease_task.cancel()
         try:

{topos_node-1.4.3 → topos_node-1.5.0}/topos/config/settings.py

@@ -143,14 +143,7 @@ class Settings(BaseSettings):
         validation_alias=AliasChoices("TOPOS_FACTS_LLM_MODEL", "FACTS_LLM_MODEL"),
     )
     engine_default_provider: str = Field("huggingface")
-    # §D minimizer runs on EVERY grantee query, so it uses a small/fast local model. The judge
-    # only runs in nightly privacy evals (F.4/CER semantic scoring), so it can be larger/slower.
-    disclosure_minimizer_model: str = Field(
-        "llama3.2:latest",
-        validation_alias=AliasChoices(
-            "TOPOS_DISCLOSURE_MINIMIZER_MODEL", "DISCLOSURE_MINIMIZER_MODEL"
-        ),
-    )
+    # Privacy judge is used by offline evaluation, not recipient reads.
     privacy_judge_model: str = Field(
         default_factory=lambda: tag_for_this_machine(DEFAULT_LOCAL_9B_MODEL),
         validation_alias=AliasChoices("TOPOS_PRIVACY_JUDGE_MODEL", "PRIVACY_JUDGE_MODEL"),

{topos_node-1.4.3 → topos_node-1.5.0}/topos/control_plane_client.py

@@ -577,10 +577,6 @@ class ControlPlaneClient:
 
     async def _handle_message(self, ws, data: Dict[str, Any]) -> None:
         msg_type = str(data.get("type") or "").strip().lower()
-        if msg_type == "permissions_v2_fact_read":
-            from .permissions_v2.fact_release_transport import dispatch_fact_message
-            await dispatch_fact_message(ws, data)
-            return
         if msg_type == "permissions_v2_message_search":
             # p2c-v1: checkpoints and signs under the node gates, then sends with them released.
             from .permissions_v2.search_transport import dispatch_message_search
@@ -591,11 +587,9 @@ class ControlPlaneClient:
             from .permissions_v2.search_transport import dispatch_message_search_batch
             await dispatch_message_search_batch(ws, data)
             return
-        if msg_type == "permissions_v2_source_read":
-            # This adapter owns the actual send while final evidence/authority
-            # gates remain held. Never return its contents into a later outbox.
-            from .permissions_v2.release_transport import dispatch_source_message
-            await dispatch_source_message(ws, data)
+        if msg_type in ("permissions_v2_answer_submit", "permissions_v2_answer_fetch"):
+            from .permissions_v2.answer_transport import dispatch_answer
+            await dispatch_answer(ws, data)
             return
         if msg_type == "ping":
             pong: Dict[str, Any] = {"type": "pong"}