validibot-shared 0.16.0__tar.gz → 0.18.0__tar.gz

{validibot_shared-0.16.0 → validibot_shared-0.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: validibot-shared
-Version: 0.16.0
+Version: 0.18.0
 Summary: Shared library for data interchange between Validibot and validator containers
 Project-URL: Homepage, https://validibot.com
 Project-URL: Documentation, https://docs.validibot.com
@@ -169,7 +169,7 @@ Supporting models include:
 | `InputFileItem` | File reference with URI, MIME type, role, exact size, SHA-256, and immutable storage version |
 | `ResourceFileItem` | Managed auxiliary file reference with safe name, URI, resource type, and byte identity |
 | `ValidatorInfo` | Validator identification (ID, type, version) |
-| `ExecutionContext` | Callback URL, execution bundle URI, timeout |
+| `ExecutionContext` | Attempt identity, callback nonce commitment, bundle URI, and timeout |
 | `ValidationMessage` | Individual finding (error, warning, info) |
 | `ValidationMetric` | Named numeric metric with optional unit |
 | `ValidationArtifact` | Output file reference (reports, logs, etc.) |
@@ -256,6 +256,9 @@ validibot_shared/
 ### Creating an Input Envelope
 
 ```python
+import secrets
+
+from validibot_shared.canonicalization import compute_callback_nonce_commitment
 from validibot_shared.energyplus import EnergyPlusInputEnvelope, EnergyPlusInputs
 from validibot_shared.validations.envelopes import (
     ATTEMPT_CONTRACT_VERSION,
@@ -268,6 +271,8 @@ from validibot_shared.validations.envelopes import (
     WorkflowInfo,
 )
 
+callback_nonce = secrets.token_urlsafe(32)
+
 envelope = EnergyPlusInputEnvelope(
     run_id="run-123",
     validator=ValidatorInfo(
@@ -295,6 +300,9 @@ envelope = EnergyPlusInputEnvelope(
     inputs=EnergyPlusInputs(timestep_per_hour=4),
     context=ExecutionContext(
         callback_url="https://api.example.com/callback",
+        callback_id="execution-attempt-attempt-123",
+        callback_nonce=callback_nonce,
+        callback_nonce_commitment=compute_callback_nonce_commitment(callback_nonce),
         execution_bundle_uri="gs://bucket/runs/org-123/run-123/attempts/attempt-123/",
         execution_attempt_id="attempt-123",
         step_run_id="step-run-789",

{validibot_shared-0.16.0 → validibot_shared-0.18.0}/README.md

@@ -136,7 +136,7 @@ Supporting models include:
 | `InputFileItem` | File reference with URI, MIME type, role, exact size, SHA-256, and immutable storage version |
 | `ResourceFileItem` | Managed auxiliary file reference with safe name, URI, resource type, and byte identity |
 | `ValidatorInfo` | Validator identification (ID, type, version) |
-| `ExecutionContext` | Callback URL, execution bundle URI, timeout |
+| `ExecutionContext` | Attempt identity, callback nonce commitment, bundle URI, and timeout |
 | `ValidationMessage` | Individual finding (error, warning, info) |
 | `ValidationMetric` | Named numeric metric with optional unit |
 | `ValidationArtifact` | Output file reference (reports, logs, etc.) |
@@ -223,6 +223,9 @@ validibot_shared/
 ### Creating an Input Envelope
 
 ```python
+import secrets
+
+from validibot_shared.canonicalization import compute_callback_nonce_commitment
 from validibot_shared.energyplus import EnergyPlusInputEnvelope, EnergyPlusInputs
 from validibot_shared.validations.envelopes import (
     ATTEMPT_CONTRACT_VERSION,
@@ -235,6 +238,8 @@ from validibot_shared.validations.envelopes import (
     WorkflowInfo,
 )
 
+callback_nonce = secrets.token_urlsafe(32)
+
 envelope = EnergyPlusInputEnvelope(
     run_id="run-123",
     validator=ValidatorInfo(
@@ -262,6 +267,9 @@ envelope = EnergyPlusInputEnvelope(
     inputs=EnergyPlusInputs(timestep_per_hour=4),
     context=ExecutionContext(
         callback_url="https://api.example.com/callback",
+        callback_id="execution-attempt-attempt-123",
+        callback_nonce=callback_nonce,
+        callback_nonce_commitment=compute_callback_nonce_commitment(callback_nonce),
         execution_bundle_uri="gs://bucket/runs/org-123/run-123/attempts/attempt-123/",
         execution_attempt_id="attempt-123",
         step_run_id="step-run-789",

{validibot_shared-0.16.0 → validibot_shared-0.18.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "validibot-shared"
-version = "0.16.0"
+version = "0.18.0"
 description = "Shared library for data interchange between Validibot and validator containers"
 readme = "README.md"
 license = { text = "MIT" }

validibot_shared-0.18.0/tests/test_callback_nonce_contract.py

@@ -0,0 +1,144 @@
+"""Tests for the strict callback nonce portion of the attempt contract.
+
+Asynchronous validator callbacks need both delivery idempotency and proof that
+the sender received the exact input envelope for one execution attempt. The
+callback ID supplies the first property; the per-attempt nonce supplies the
+second. These tests keep raw secrets out of model representations, require a
+matching public commitment, preserve synchronous no-callback operation, and
+reject the older attempt-v1 contract instead of silently accepting weaker
+authentication.
+"""
+
+from __future__ import annotations
+
+import pytest
+from pydantic import ValidationError
+
+from validibot_shared.canonicalization import compute_callback_nonce_commitment
+from validibot_shared.validations.envelopes import (
+    ATTEMPT_CONTRACT_VERSION,
+    ExecutionContext,
+    ValidationCallback,
+    ValidationOutputEnvelope,
+    ValidationStatus,
+)
+
+CALLBACK_NONCE = "A" * 43
+CALLBACK_COMMITMENT = compute_callback_nonce_commitment(CALLBACK_NONCE)
+
+
+def _context_kwargs() -> dict[str, object]:
+    """Return the non-secret fields required by one asynchronous attempt."""
+    return {
+        "execution_attempt_id": "attempt-1",
+        "step_run_id": "step-run-1",
+        "attempt_contract_version": ATTEMPT_CONTRACT_VERSION,
+        "expected_output_uri": "gs://bucket/attempt-1/output.json",
+        "callback_url": "https://example.com/callback",
+        "execution_bundle_uri": "gs://bucket/attempt-1/",
+    }
+
+
+def test_async_context_requires_callback_id_and_nonce_pair() -> None:
+    """An enabled callback must not validate with only public routing metadata."""
+    with pytest.raises(ValidationError, match="callback_id is required"):
+        ExecutionContext(**_context_kwargs())
+
+    with pytest.raises(ValidationError, match="required when callbacks are enabled"):
+        ExecutionContext(
+            **_context_kwargs(),
+            callback_id="execution-attempt-attempt-1",
+        )
+
+
+def test_context_requires_nonce_and_commitment_together() -> None:
+    """Neither half of the binding is meaningful without its matching partner."""
+    with pytest.raises(ValidationError, match="must be provided together"):
+        ExecutionContext(
+            **_context_kwargs(),
+            callback_id="execution-attempt-attempt-1",
+            callback_nonce=CALLBACK_NONCE,
+        )
+
+
+def test_context_rejects_commitment_unrelated_to_nonce() -> None:
+    """A mismatched commitment must fail before an envelope can be dispatched."""
+    with pytest.raises(ValidationError, match="does not match"):
+        ExecutionContext(
+            **_context_kwargs(),
+            callback_id="execution-attempt-attempt-1",
+            callback_nonce=CALLBACK_NONCE,
+            callback_nonce_commitment="0" * 64,
+        )
+
+
+def test_async_context_accepts_matching_pair_without_displaying_secret() -> None:
+    """A valid pair binds dispatch while keeping ordinary diagnostics redacted."""
+    context = ExecutionContext(
+        **_context_kwargs(),
+        callback_id="execution-attempt-attempt-1",
+        callback_nonce=CALLBACK_NONCE,
+        callback_nonce_commitment=CALLBACK_COMMITMENT,
+    )
+
+    assert context.callback_nonce_commitment == CALLBACK_COMMITMENT
+    assert CALLBACK_NONCE not in repr(context)
+
+
+def test_sync_context_does_not_require_an_unused_callback_secret() -> None:
+    """Local synchronous execution remains valid when callback delivery is skipped."""
+    context = ExecutionContext(
+        **_context_kwargs(),
+        callback_id="execution-attempt-attempt-1",
+        skip_callback=True,
+    )
+
+    assert context.callback_nonce is None
+    assert context.callback_nonce_commitment is None
+
+
+def test_attempt_v1_is_rejected_after_the_strict_contract_cutover() -> None:
+    """Mixed runtime versions must fail explicitly instead of losing nonce fields."""
+    with pytest.raises(ValidationError, match="validibot.attempt.v2"):
+        ExecutionContext(
+            **(
+                _context_kwargs() | {"attempt_contract_version": "validibot.attempt.v1"}
+            ),
+            callback_id="execution-attempt-attempt-1",
+            callback_nonce=CALLBACK_NONCE,
+            callback_nonce_commitment=CALLBACK_COMMITMENT,
+        )
+
+
+def test_callback_payload_transports_secret_without_displaying_it() -> None:
+    """The backend must send the nonce, while ordinary repr output stays redacted."""
+    callback = ValidationCallback(
+        run_id="run-1",
+        callback_id="execution-attempt-attempt-1",
+        callback_nonce=CALLBACK_NONCE,
+        status=ValidationStatus.SUCCESS,
+        result_uri="gs://bucket/attempt-1/output.json",
+    )
+
+    assert callback.model_dump()["callback_nonce"] == CALLBACK_NONCE
+    assert CALLBACK_NONCE not in repr(callback)
+
+
+def test_callback_payload_rejects_missing_or_short_nonce() -> None:
+    """A callback without a full-strength attempt secret is not authenticated."""
+    base = {
+        "run_id": "run-1",
+        "callback_id": "execution-attempt-attempt-1",
+        "status": ValidationStatus.SUCCESS,
+        "result_uri": "gs://bucket/attempt-1/output.json",
+    }
+
+    with pytest.raises(ValidationError, match="callback_nonce"):
+        ValidationCallback(**base)
+    with pytest.raises(ValidationError, match="at least 43 characters"):
+        ValidationCallback(**base, callback_nonce="too-short")
+
+
+def test_output_envelope_has_no_callback_secret_field() -> None:
+    """Public results must never expose the live secret used for callback auth."""
+    assert "callback_nonce" not in ValidationOutputEnvelope.model_fields

{validibot_shared-0.16.0 → validibot_shared-0.18.0}/tests/test_canonicalization.py

@@ -12,16 +12,22 @@ from __future__ import annotations
 import hashlib
 import json
 
+import pytest
 from pydantic import BaseModel, ConfigDict
 
 from validibot_shared.canonicalization import (
     canonicalize_dict,
     canonicalize_model,
+    compute_callback_nonce_commitment,
     sha256_hex_for_dict,
     sha256_hex_for_model,
 )
 
 UNSAFE_INTEGER = 9007199254740993
+FIXED_CALLBACK_NONCE = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"
+FIXED_CALLBACK_NONCE_COMMITMENT = (
+    "c3ce1f94c76a98b82472f8611c2a56ff24ce2dc318a09c6b4972286ca5fae512"
+)
 
 
 class SampleSchema(BaseModel):
@@ -98,3 +104,60 @@ def test_sha256_for_model_matches_manual_hash() -> None:
     schema = SampleSchema(alpha="test", beta=99, gamma="yes")
     expected = hashlib.sha256(canonicalize_model(schema)).hexdigest()
     assert sha256_hex_for_model(schema) == expected
+
+
+# ── Callback nonce commitments ──────────────────────────────────────────────
+# Input envelopes transport a live authentication secret, but evidence and
+# output identity must hash only its public domain-separated commitment.
+
+
+def test_callback_nonce_commitment_matches_fixed_cross_repo_vector() -> None:
+    """The domain separator and UTF-8 preimage must remain byte-for-byte stable."""
+    assert (
+        compute_callback_nonce_commitment(FIXED_CALLBACK_NONCE)
+        == FIXED_CALLBACK_NONCE_COMMITMENT
+    )
+
+
+def test_canonicalization_replaces_raw_nonce_with_commitment() -> None:
+    """Canonical bytes must bind the nonce without exposing its secret value."""
+    canonical = canonicalize_dict(
+        {
+            "context": {
+                "callback_nonce": FIXED_CALLBACK_NONCE,
+                "callback_nonce_commitment": FIXED_CALLBACK_NONCE_COMMITMENT,
+            },
+        },
+    )
+
+    assert FIXED_CALLBACK_NONCE.encode() not in canonical
+    assert FIXED_CALLBACK_NONCE_COMMITMENT.encode() in canonical
+    assert b'"callback_nonce"' not in canonical
+
+
+def test_secret_and_public_forms_have_the_same_canonical_identity() -> None:
+    """A verifier retaining only the commitment must reproduce the input digest."""
+    secret_form = {
+        "context": {
+            "callback_nonce": FIXED_CALLBACK_NONCE,
+            "callback_nonce_commitment": FIXED_CALLBACK_NONCE_COMMITMENT,
+        },
+    }
+    public_form = {
+        "context": {
+            "callback_nonce_commitment": FIXED_CALLBACK_NONCE_COMMITMENT,
+        },
+    }
+
+    assert canonicalize_dict(secret_form) == canonicalize_dict(public_form)
+
+
+def test_canonicalization_rejects_a_false_declared_commitment() -> None:
+    """A producer cannot bind the digest to a commitment unrelated to its nonce."""
+    with pytest.raises(ValueError, match="does not match"):
+        canonicalize_dict(
+            {
+                "callback_nonce": FIXED_CALLBACK_NONCE,
+                "callback_nonce_commitment": "0" * 64,
+            },
+        )

{validibot_shared-0.16.0 → validibot_shared-0.18.0}/tests/test_energyplus_envelopes.py

@@ -3,6 +3,7 @@ from pathlib import Path
 import pytest
 from pydantic import ValidationError
 
+from validibot_shared.canonicalization import compute_callback_nonce_commitment
 from validibot_shared.energyplus.envelopes import (
     EnergyPlusInputEnvelope,
     EnergyPlusInputs,
@@ -24,6 +25,10 @@ TEST_TIMESTEP_PER_HOUR = 6
 TEST_ELECTRICITY_KWH = 123.4
 TEST_EXECUTION_SECONDS = 12.5
 TEST_EUI_KWH_M2 = 10.5
+TEST_CALLBACK_NONCE = "A" * 43
+TEST_CALLBACK_NONCE_COMMITMENT = compute_callback_nonce_commitment(
+    TEST_CALLBACK_NONCE,
+)
 
 
 def _base_input_envelope_kwargs():
@@ -49,6 +54,9 @@ def _base_input_envelope_kwargs():
         ],
         "context": ExecutionContext(
             callback_url="https://example.com/callback",
+            callback_id="execution-attempt-attempt-1",
+            callback_nonce=TEST_CALLBACK_NONCE,
+            callback_nonce_commitment=TEST_CALLBACK_NONCE_COMMITMENT,
             execution_bundle_uri="gs://bucket/run-1/",
             execution_attempt_id="attempt-1",
             step_run_id="step-run-1",

{validibot_shared-0.16.0 → validibot_shared-0.18.0}/tests/test_evidence_manifest.py

@@ -19,6 +19,8 @@ What this file covers
 5. Artifact lineage fields are additive, evidence-safe projections:
    hashes and stable IDs are allowed; private storage URIs are not part
    of the public schema.
+6. Attempt-bound execution evidence records canonical envelopes, verified
+   input identities, and explicit preprocessing relationships without URIs.
 """
 
 from __future__ import annotations
@@ -33,6 +35,9 @@ from validibot_shared.evidence import (
     EvidenceManifest,
     ManifestArtifactInputBinding,
     ManifestArtifactLineageEdge,
+    ManifestExecutionAttempt,
+    ManifestExecutionInput,
+    ManifestInputRelationship,
     ManifestPayloadDigests,
     ManifestProducedArtifact,
     ManifestRetentionInfo,
@@ -207,6 +212,7 @@ class TestArtifactLineageFields:
             contract_key="generated_model",
             filename="model.epjson",
             sha256="a" * 64,
+            storage_version="42",
         )
         binding = ManifestArtifactInputBinding(
             target_step_id=20,
@@ -217,6 +223,7 @@ class TestArtifactLineageFields:
             source_artifact_id="artifact-1",
             source_filename="model.epjson",
             source_sha256="a" * 64,
+            source_storage_version="42",
             producer_step_key="build_model",
             producer_contract_key="generated_model",
             resolved=True,
@@ -245,6 +252,99 @@ class TestArtifactLineageFields:
         assert not hasattr(restored.artifact_input_bindings[0], "uri")
 
 
+# ──────────────────────────────────────────────────────────────────────
+# Attempt-bound execution evidence — immutable files and transformations
+# ──────────────────────────────────────────────────────────────────────
+
+
+class TestExecutionAttemptEvidence:
+    """Pin the additive strict-execution evidence contract for verifiers."""
+
+    def test_execution_attempts_default_to_empty(self):
+        """Inline validators and older producers remain valid without attempts."""
+        manifest = EvidenceManifest(**_minimal_manifest_kwargs())
+
+        assert manifest.execution_attempts == []
+        assert manifest.schema_version == "validibot.evidence.v1"
+
+    def test_attempt_records_round_trip_without_storage_uris(self):
+        """Portable evidence keeps immutable identities but exposes no file URI."""
+        execution_input = ManifestExecutionInput(
+            channel="input_files",
+            name="generated.epjson",
+            role="primary-model",
+            port_key="primary_model",
+            media_type="application/json",
+            size_bytes=123,
+            sha256="b" * 64,
+            storage_version="sha256:" + "b" * 64,
+        )
+        relationship = ManifestInputRelationship(
+            source_kind="submission",
+            source_id="submission-1",
+            source_name="template.epjson",
+            source_size_bytes=100,
+            source_sha256="a" * 64,
+            target_channel="input_files",
+            target_name="generated.epjson",
+            target_port_key="primary_model",
+            target_sha256="b" * 64,
+            relationship="transformed",
+            transformation="energyplus-template-substitution.v1",
+        )
+        attempt = ManifestExecutionAttempt(
+            execution_attempt_id="attempt-1",
+            step_run_id="step-run-1",
+            attempt_number=1,
+            state="COMPLETED",
+            runner_type="cloud_run_job",
+            provider_execution_id="execution-1",
+            attempt_contract_version="validibot.attempt.v2",
+            input_envelope_sha256="c" * 64,
+            output_envelope_sha256="d" * 64,
+            backend_image_digest="registry/energyplus@sha256:" + "e" * 64,
+            inputs_verified=True,
+            input_files=[execution_input],
+            input_relationships=[relationship],
+        )
+
+        manifest = EvidenceManifest(
+            **_minimal_manifest_kwargs(),
+            execution_attempts=[attempt],
+        )
+        restored = EvidenceManifest.model_validate(manifest.model_dump(mode="json"))
+
+        assert restored == manifest
+        assert restored.execution_attempts[0].inputs_verified is True
+        assert not hasattr(restored.execution_attempts[0].input_files[0], "uri")
+
+    def test_relationship_keeps_original_and_executed_digests_distinct(self):
+        """Preprocessing evidence cannot imply original bytes were executed."""
+        relationship = ManifestInputRelationship(
+            source_kind="submission",
+            source_sha256="a" * 64,
+            target_channel="input_files",
+            target_name="generated.idf",
+            target_sha256="b" * 64,
+            relationship="transformed",
+            transformation="energyplus-template-substitution.v1",
+        )
+
+        assert relationship.source_sha256 != relationship.target_sha256
+        assert relationship.relationship == "transformed"
+
+    def test_execution_input_rejects_invalid_integrity_identity(self):
+        """Evidence cannot accept an invalid digest or negative byte length."""
+        with pytest.raises(ValidationError):
+            ManifestExecutionInput(
+                channel="input_files",
+                name="model.idf",
+                size_bytes=-1,
+                sha256="not-a-sha256",
+                storage_version="generation-1",
+            )
+
+
 # ──────────────────────────────────────────────────────────────────────
 # WorkflowContractSnapshot — constants, signal-mapping defs, definition hash
 # ──────────────────────────────────────────────────────────────────────

{validibot_shared-0.16.0 → validibot_shared-0.18.0}/tests/test_fmu_envelopes.py

@@ -3,6 +3,7 @@
 import pytest
 from pydantic import ValidationError
 
+from validibot_shared.canonicalization import compute_callback_nonce_commitment
 from validibot_shared.fmu.envelopes import (
     FMUInputEnvelope,
     FMUOutputs,
@@ -18,6 +19,10 @@ from validibot_shared.validations.envelopes import (
 # Test constants
 TEST_EXECUTION_SECONDS = 2.5
 TEST_STOP_TIME = 10
+TEST_CALLBACK_NONCE = "A" * 43
+TEST_CALLBACK_NONCE_COMMITMENT = compute_callback_nonce_commitment(
+    TEST_CALLBACK_NONCE,
+)
 
 
 def _base_kwargs():
@@ -28,6 +33,9 @@ def _base_kwargs():
         "workflow": {"id": "wf-1", "step_id": "step-1", "step_name": "FMU"},
         "context": ExecutionContext(
             callback_url="https://example.com/cb",
+            callback_id="execution-attempt-attempt-123",
+            callback_nonce=TEST_CALLBACK_NONCE,
+            callback_nonce_commitment=TEST_CALLBACK_NONCE_COMMITMENT,
             execution_bundle_uri="gs://bucket/run-123/",
             execution_attempt_id="attempt-123",
             step_run_id="step-run-123",
@@ -103,6 +111,9 @@ def test_build_fmu_input_envelope_constructs_expected_payload():
         fmu_storage_version="1700000000000000",
         input_values={"u1": 1.0},
         callback_url="https://example.com/callback",
+        callback_id="execution-attempt-attempt-1",
+        callback_nonce=TEST_CALLBACK_NONCE,
+        callback_nonce_commitment=TEST_CALLBACK_NONCE_COMMITMENT,
         execution_bundle_uri="gs://bucket/run-1/",
         execution_attempt_id="attempt-1",
         step_run_id="step-run-1",

{validibot_shared-0.16.0 → validibot_shared-0.18.0}/tests/test_schematron_envelopes.py

@@ -12,6 +12,7 @@ against exactly this shape.
 import pytest
 from pydantic import ValidationError
 
+from validibot_shared.canonicalization import compute_callback_nonce_commitment
 from validibot_shared.schematron.envelopes import (
     ENGINE_ERROR_RULES_INVALID,
     ENGINE_STATUS_OK,
@@ -35,6 +36,10 @@ DEFAULT_MAX_FINDINGS = 500
 DEFAULT_XSLT_TIMEOUT = 60
 TEST_ERROR_COUNT = 3
 RULES_SHA = "b" * 64
+TEST_CALLBACK_NONCE = "A" * 43
+TEST_CALLBACK_NONCE_COMMITMENT = compute_callback_nonce_commitment(
+    TEST_CALLBACK_NONCE,
+)
 
 SCH_SOURCE = (
     '<schema xmlns="http://purl.oclc.org/dsdl/schematron">'
@@ -201,6 +206,9 @@ def test_build_schematron_input_envelope_assembles_the_xml_submission():
         submission_storage_version="1700000000000000",
         inputs=_inputs(),
         callback_url="https://example.com/callback",
+        callback_id="execution-attempt-attempt-1",
+        callback_nonce=TEST_CALLBACK_NONCE,
+        callback_nonce_commitment=TEST_CALLBACK_NONCE_COMMITMENT,
         execution_bundle_uri="gs://bucket/run-1/",
         execution_attempt_id="attempt-1",
         step_run_id="step-run-1",

{validibot_shared-0.16.0 → validibot_shared-0.18.0}/tests/test_shacl_envelopes.py

@@ -20,6 +20,7 @@ We therefore assert three things:
 import pytest
 from pydantic import ValidationError
 
+from validibot_shared.canonicalization import compute_callback_nonce_commitment
 from validibot_shared.shacl.envelopes import (
     SHACL_RESULT_REPORT_ONLY,
     SHACLInputEnvelope,
@@ -54,6 +55,10 @@ EXPECTED_SIGNAL_KEYS = {
     "shacl_info_count",
     "shacl_total_count",
 }
+TEST_CALLBACK_NONCE = "A" * 43
+TEST_CALLBACK_NONCE_COMMITMENT = compute_callback_nonce_commitment(
+    TEST_CALLBACK_NONCE,
+)
 
 
 def _base_kwargs():
@@ -65,6 +70,9 @@ def _base_kwargs():
         "workflow": {"id": "wf-1", "step_id": "step-1", "step_name": "SHACL"},
         "context": ExecutionContext(
             callback_url="https://example.com/cb",
+            callback_id="execution-attempt-attempt-123",
+            callback_nonce=TEST_CALLBACK_NONCE,
+            callback_nonce_commitment=TEST_CALLBACK_NONCE_COMMITMENT,
             execution_bundle_uri="gs://bucket/run-123/",
             execution_attempt_id="attempt-123",
             step_run_id="step-run-123",

{validibot_shared-0.16.0 → validibot_shared-0.18.0}/tests/test_validations_envelopes.py

@@ -5,7 +5,10 @@ from datetime import UTC, datetime
 import pytest
 from pydantic import ValidationError
 
-from validibot_shared.canonicalization import sha256_hex_for_model
+from validibot_shared.canonicalization import (
+    compute_callback_nonce_commitment,
+    sha256_hex_for_model,
+)
 from validibot_shared.validations.envelopes import (
     ATTEMPT_CONTRACT_VERSION,
     ExecutionContext,
@@ -23,6 +26,11 @@ from validibot_shared.validations.envelopes import (
     ValidatorType,
 )
 
+TEST_CALLBACK_NONCE = "A" * 43
+TEST_CALLBACK_NONCE_COMMITMENT = compute_callback_nonce_commitment(
+    TEST_CALLBACK_NONCE,
+)
+
 
 def _base_input_envelope_kwargs():
     return {
@@ -47,6 +55,9 @@ def _base_input_envelope_kwargs():
         ],
         "context": ExecutionContext(
             callback_url="https://example.com/callback",
+            callback_id="execution-attempt-attempt-42",
+            callback_nonce=TEST_CALLBACK_NONCE,
+            callback_nonce_commitment=TEST_CALLBACK_NONCE_COMMITMENT,
             execution_bundle_uri="gs://bucket/run-42/",
             execution_attempt_id="attempt-42",
             step_run_id="step-run-42",
@@ -111,12 +122,17 @@ def test_strict_attempt_fixture_has_the_cross_repo_canonical_digest():
             "attempt_contract_version": ATTEMPT_CONTRACT_VERSION,
             "expected_output_uri": "gs://fixture/runs/run-fixture/output.json",
             "execution_bundle_uri": "gs://fixture/runs/run-fixture/",
-            "skip_callback": True,
+            "callback_url": "https://example.com/callback",
+            "callback_id": "execution-attempt-attempt-fixture",
+            "callback_nonce": ("AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"),
+            "callback_nonce_commitment": compute_callback_nonce_commitment(
+                "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8",
+            ),
         },
     )
 
     assert sha256_hex_for_model(envelope) == (
-        "e17c5dae05c58f4d6034806e3f5e7a7602013d03f27ec811a97a9fc49f9d88d5"
+        "a212b9aaad3aca508a88608d70fd75b5642a8c0e20876308887789dc5bbfb64d"
     )
 
 
@@ -294,6 +310,8 @@ def test_validation_callback_serialization():
     """ValidationCallback should serialize correctly."""
     callback = ValidationCallback(
         run_id="run-101",
+        callback_id="execution-attempt-attempt-101",
+        callback_nonce=TEST_CALLBACK_NONCE,
         status=ValidationStatus.FAILED_RUNTIME,
         result_uri="gs://bucket/run-101/output.json",
     )

{validibot_shared-0.16.0 → validibot_shared-0.18.0}/validibot_shared/__init__.py

@@ -3,6 +3,7 @@
 from validibot_shared.canonicalization import (
     canonicalize_dict,
     canonicalize_model,
+    compute_callback_nonce_commitment,
     sha256_hex_for_dict,
     sha256_hex_for_model,
 )
@@ -18,6 +19,9 @@ from validibot_shared.evidence import (
     ContractConstant,
     ContractSignalMapping,
     EvidenceManifest,
+    ManifestExecutionAttempt,
+    ManifestExecutionInput,
+    ManifestInputRelationship,
     ManifestPayloadDigests,
     ManifestRetentionInfo,
     StepValidatorRecord,
@@ -38,6 +42,7 @@ __all__ = [
     "ContractSignalMapping",
     "canonicalize_dict",
     "canonicalize_model",
+    "compute_callback_nonce_commitment",
     "EnergyPlusSimulationLogs",
     "EnergyPlusSimulationMetrics",
     "EnergyPlusSimulationOutputs",
@@ -45,6 +50,9 @@ __all__ = [
     "FMUProbeResult",
     "FMUVariableMeta",
     "ManifestPayloadDigests",
+    "ManifestExecutionAttempt",
+    "ManifestExecutionInput",
+    "ManifestInputRelationship",
     "ManifestRetentionInfo",
     "SHACLInputEnvelope",
     "SHACLInputs",