xrefkit 0.7.6__tar.gz → 0.7.7__tar.gz

{xrefkit-0.7.6/xrefkit.egg-info → xrefkit-0.7.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: xrefkit
-Version: 0.7.6
+Version: 0.7.7
 Summary: Portable XID, Skill, Knowledge, workflow, and MCP runtime for XRefKit
 Author: synthaicode
 License: MIT License

{xrefkit-0.7.6 → xrefkit-0.7.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "xrefkit"
-version = "0.7.6"
+version = "0.7.7"
 description = "Portable XID, Skill, Knowledge, workflow, and MCP runtime for XRefKit"
 readme = "README.md"
 requires-python = ">=3.11"

xrefkit-0.7.7/tests/test_governance_host.py

@@ -0,0 +1,248 @@
+"""Local host integration checks use simulated subprocess/UI, never real approval."""
+import copy
+import json
+from pathlib import Path
+import subprocess
+from types import SimpleNamespace
+
+import pytest
+
+from test_governance_entry import case, host_receipt, HOST_KEY
+from test_subagent_startup import startup
+from xrefkit.governance_entry import digest, validate_result
+from xrefkit.mcp.contribution_adoption import HmacHumanApprovalVerifier
+from xrefkit import governance_host as host
+
+
+@pytest.fixture
+def local(case, monkeypatch):
+    root, packet, _ = case
+    packet_file = root / "work/packet.json"
+    packet_file.write_text(json.dumps(packet))
+    receipt = host_receipt(root, packet)
+    receipt_file = root / "work/receipt.json"
+    receipt_file.write_text(json.dumps(receipt))
+    state_file = root / "authority.dpapi"
+    state = {"schema": "xrefkit.local_host_authority/v1", "root": str(root),
+             "packet_hash": packet["packet_hash"], "receipt_hash": digest(receipt),
+             "host_secret": HOST_KEY, "applied": False}
+    monkeypatch.setattr(host, "_load_state", lambda path: copy.deepcopy(state))
+    monkeypatch.setattr(host, "_save_state", lambda path, value, **kwargs: state.update(value))
+    return root, packet, packet_file, receipt_file, state_file, state
+
+
+def test_native_decline_never_applies_or_issues_human_secret(local, monkeypatch):
+    root, _, packet, receipt, state_file, state = local
+    monkeypatch.setattr(host, "_review_dialog", lambda *args: False)
+    result = host.apply_local(root, packet, receipt, state_file, root / "work/reflection.json")
+    assert result["status"] == "human_declined_no_application"
+    assert not (root / "knowledge/item.md").exists()
+    assert "human_secret" not in state and not state["applied"]
+
+
+def test_native_action_applies_with_separate_keys_and_stale_replay_refuses(local, monkeypatch):
+    root, _, packet, receipt, state_file, state = local
+    observed = []
+    monkeypatch.setattr(host, "_review_dialog", lambda *args: observed.append(args) or True)
+    result = host.apply_local(root, packet, receipt, state_file, root / "work/reflection.json")
+    assert result["runtime_activation"] == "not_performed"
+    assert observed[0][0] == "knowledge/item.md" and "+# New" in observed[0][2]
+    assert state["human_secret"] != state["host_secret"]
+    assert (root / "knowledge/item.md").read_bytes() == (root / "work/candidate.md").read_bytes()
+    with pytest.raises(ValueError, match="unapplied dispatch"):
+        host.apply_local(root, packet, receipt, state_file, root / "work/replay.json")
+
+
+@pytest.mark.parametrize("mutation", ["candidate", "target"])
+def test_change_during_dialog_refuses_even_after_ui_accepts(local, monkeypatch, mutation):
+    root, _, packet, receipt, state_file, state = local
+    def change(*args):
+        path = root / ("work/candidate.md" if mutation == "candidate" else "knowledge/item.md")
+        path.parent.mkdir(exist_ok=True)
+        path.write_text("external change")
+        return True
+    monkeypatch.setattr(host, "_review_dialog", change)
+    with pytest.raises(ValueError, match="changed"):
+        host.apply_local(root, packet, receipt, state_file, root / "work/reflection.json")
+    assert not state["applied"]
+    if mutation == "target":
+        assert (root / "knowledge/item.md").read_text() == "external change"
+
+
+@pytest.mark.parametrize("field", ["packet_hash", "receipt_hash", "root"])
+def test_wrong_dispatch_state_rejected_before_dialog(local, monkeypatch, field):
+    root, _, packet, receipt, state_file, state = local
+    state[field] = "wrong"
+    monkeypatch.setattr(host, "_review_dialog", lambda *args: pytest.fail("UI must not open"))
+    with pytest.raises(ValueError, match="does not match"):
+        host.apply_local(root, packet, receipt, state_file, root / "work/reflection.json")
+
+
+def test_failed_gate_cannot_be_human_approved(local, monkeypatch):
+    root, packet, packet_file, receipt_file, state_file, state = local
+    receipt = host_receipt(root, packet, failed=True)
+    receipt_file.write_text(json.dumps(receipt))
+    state["receipt_hash"] = digest(receipt)
+    monkeypatch.setattr(host, "_review_dialog", lambda *args: pytest.fail("UI must not open"))
+    with pytest.raises(ValueError, match="failed or unknown"):
+        host.apply_local(root, packet_file, receipt_file, state_file, root / "work/reflection.json")
+
+
+def test_tampered_signature_refused_even_with_matching_receipt_digest(local, monkeypatch):
+    root, _, packet, receipt_file, state_file, state = local
+    receipt = json.loads(receipt_file.read_text())
+    receipt["signature"] = "wrong"
+    receipt_file.write_text(json.dumps(receipt))
+    state["receipt_hash"] = digest(receipt)
+    monkeypatch.setattr(host, "_review_dialog", lambda *args: pytest.fail("UI must not open"))
+    with pytest.raises(ValueError, match="signature"):
+        host.apply_local(root, packet, receipt_file, state_file, root / "work/reflection.json")
+
+
+def test_evidence_destination_cannot_overwrite_packet(local, monkeypatch):
+    root, _, packet, receipt, state_file, _ = local
+    monkeypatch.setattr(host, "_review_dialog", lambda *args: pytest.fail("UI must not open"))
+    with pytest.raises(ValueError, match="overwrite"):
+        host.apply_local(root, packet, receipt, state_file, packet)
+
+
+@pytest.mark.parametrize("events", [[], [{"type": "thread.started", "thread_id": "x"}],
+    [{"type": "thread.started", "thread_id": "x"}, {"type": "turn.failed"}],
+    [{"type": "thread.started", "thread_id": "x"}, {"type": "turn.completed"}, {"type": "turn.completed"}]])
+def test_missing_or_failed_terminal_events_are_not_execution(tmp_path, events):
+    path = tmp_path / "events.jsonl"
+    path.write_text("\n".join(json.dumps(event) for event in events))
+    with pytest.raises(ValueError):
+        host._completed_session(path)
+
+
+def test_valid_single_completion(tmp_path):
+    path = tmp_path / "events.jsonl"
+    path.write_text('{"type":"thread.started","thread_id":"actual-session"}\n{"type":"turn.completed"}\n')
+    assert host._completed_session(path) == "actual-session"
+
+
+def test_authority_never_inherited_by_child(monkeypatch):
+    monkeypatch.setenv("XREFKIT_GOVERNANCE_HOST_SECRET", "private")
+    monkeypatch.setenv("XREFKIT_GOVERNANCE_HUMAN_SECRET", "private")
+    monkeypatch.setenv("XREFKIT_CONTRIBUTION_APPROVAL_SECRET", "private")
+    env = host._child_environment()
+    assert not any(key.startswith("XREFKIT_GOVERNANCE_") for key in env)
+    assert "XREFKIT_CONTRIBUTION_APPROVAL_SECRET" not in env
+
+
+def test_child_open_refusal_never_dispatches(case, monkeypatch):
+    root, packet, _ = case
+    source = root / "work/packet.json"
+    source.write_text(json.dumps(packet))
+    binary = root / "codex.exe"
+    binary.write_bytes(b"test fixture, never executable")
+    monkeypatch.setattr(host.subprocess, "run", lambda *args, **kwargs:
+                        SimpleNamespace(returncode=2, stdout='{"ok":false}'))
+    monkeypatch.setattr(host.subprocess, "Popen", lambda *args, **kwargs: pytest.fail("must not dispatch"))
+    with pytest.raises(ValueError, match="Skill run refused"):
+        host.dispatch_local(root, source, binary, root / "work/dispatch")
+
+
+def test_process_failure_never_generates_host_authority(case, monkeypatch):
+    root, packet, _ = case
+    source = root / "work/packet.json"
+    source.write_text(json.dumps(packet))
+    binary = root / "codex.exe"
+    binary.write_bytes(b"test fixture, never executable")
+    monkeypatch.setattr(host.subprocess, "run", lambda *args, **kwargs:
+                        SimpleNamespace(returncode=0, stdout='{"ok":true,"run_id":"opened"}'))
+    process = SimpleNamespace(returncode=7, pid=123, communicate=lambda *args, **kwargs: None)
+    monkeypatch.setattr(host.subprocess, "Popen", lambda *args, **kwargs: process)
+    monkeypatch.setattr(host.secrets, "token_hex", lambda *args: pytest.fail("key must not be generated"))
+    with pytest.raises(ValueError, match="process failed"):
+        host.dispatch_local(root, source, binary, root / "work/dispatch")
+
+
+def test_no_cli_automatic_approval_option():
+    with pytest.raises(SystemExit) as exc:
+        host.main(["--root", ".", "apply", "--packet", "a", "--receipt", "b",
+                   "--authority-state", "c", "--out", "d", "--yes"])
+    assert exc.value.code == 2
+
+
+def test_applied_but_authority_save_failure_carries_reflection(local, monkeypatch):
+    root, _, packet, receipt, state_file, _ = local
+    monkeypatch.setattr(host, "_review_dialog", lambda *args: True)
+    def fail_save(*args, **kwargs):
+        raise OSError("simulated authority disk failure")
+    monkeypatch.setattr(host, "_save_state", fail_save)
+    with pytest.raises(host.AppliedEvidenceError) as exc:
+        host.apply_local(root, packet, receipt, state_file, root / "work/reflection.json")
+    assert (root / "knowledge/item.md").read_bytes() == (root / "work/candidate.md").read_bytes()
+    assert exc.value.reflection["target"]["path"] == "knowledge/item.md"
+
+
+def test_cli_distinguishes_applied_evidence_failure(monkeypatch, capsys):
+    reflection = {"target": {"path": "skills/example/SKILL.v1.md", "sha256": "observed-hash"}}
+    def failed(*args):
+        raise host.AppliedEvidenceError(reflection)
+    monkeypatch.setattr(host, "apply_local", failed)
+    code = host.main(["--root", ".", "apply", "--packet", "a", "--receipt", "b",
+                      "--authority-state", "c", "--out", "d"])
+    assert code == 3
+    assert "observed-hash" in capsys.readouterr().out
+
+
+@pytest.mark.parametrize("invalid_run", [None, "identity", "escalated"])
+def test_dispatch_attests_only_actual_opened_run_and_completed_output(case, monkeypatch, invalid_run):
+    root, packet, _ = case
+    source = root / "work/packet.json"
+    source.write_text(json.dumps(packet))
+    binary = root / "codex.exe"
+    binary.write_bytes(b"test fixture, never executable")
+    host_receipt(root, packet)  # Test-only prepared body/closed log.
+    out = root / "work/dispatch"
+    state = {}
+    child_path = None
+    def open_run(argv, **kwargs):
+        nonlocal child_path
+        child_path = Path(argv[argv.index("--out") + 1])
+        assert child_path.name.endswith("_skill_run_shared_asset_update_gate.md")
+        text = (root / "work/child.md").read_text().replace("work/analysis.md", "work/dispatch/analysis.json")
+        child_path.write_text(text)
+        return SimpleNamespace(returncode=0, stdout='{"ok":true,"run_id":"child-test-run"}')
+    def launch(argv, **kwargs):
+        def communicate(prompt, **options):
+            assert b"Do not open another run" in prompt
+            (out / "analysis.json").write_bytes((root / "work/analysis.md").read_bytes())
+            Path(argv[argv.index("--output-last-message") + 1]).write_text("Analysis complete")
+            kwargs["stdout"].write(b'{"type":"thread.started","thread_id":"simulated-session"}\n{"type":"turn.completed"}\n')
+            if invalid_run == "identity":
+                child_path.write_text(child_path.read_text().replace("child-test-run", "replaced-run"))
+            elif invalid_run == "escalated":
+                child_path.write_text(child_path.read_text().replace(
+                    "## Closure Gate\n- status: `done`", "## Closure Gate\n- status: `escalated`"))
+        return SimpleNamespace(returncode=0, pid=123, communicate=communicate)
+    monkeypatch.setattr(host.subprocess, "run", open_run)
+    monkeypatch.setattr(host.subprocess, "Popen", launch)
+    monkeypatch.setattr(host, "_state_path", lambda execution_id: root / "authority.dpapi")
+    monkeypatch.setattr(host, "_save_state", lambda path, value, **kwargs: state.update(value))
+    if invalid_run:
+        expected = "host-opened child identity" if invalid_run == "identity" else "completed child Skill run"
+        with pytest.raises(ValueError, match=expected):
+            host.dispatch_local(root, source, binary, out)
+        assert not state and not (out / "receipt.json").exists()
+    else:
+        result = host.dispatch_local(root, source, binary, out)
+        receipt = json.loads(Path(result["receipt"]).read_text())
+        verifier = HmacHumanApprovalVerifier(state["host_secret"])
+        assert validate_result(root, packet, receipt, verifier)["packet_hash"] == packet["packet_hash"]
+        provenance = json.loads((out / "dispatch.json").read_text())
+        verifier.verify_event(provenance["event"], provenance["signature"])
+        assert provenance["event"]["thread_id"] == "simulated-session"
+        assert state["host_secret"] not in (out / "receipt.json").read_text()
+        assert not (root / "knowledge/item.md").exists()
+
+
+@pytest.mark.skipif(host.os.name != "nt", reason="Windows operator adapter")
+def test_windows_dpapi_roundtrip():
+    disposable = b"non-secret disposable integration test"
+    ciphertext = host._protect(disposable)
+    assert ciphertext != disposable
+    assert host._protect(ciphertext, decrypt=True) == disposable

{xrefkit-0.7.6 → xrefkit-0.7.7}/xrefkit/__init__.py

@@ -2,4 +2,4 @@
 
 __all__ = ["__version__"]
 
-__version__ = "0.7.6"
+__version__ = "0.7.7"

xrefkit-0.7.7/xrefkit/governance_host.py

@@ -0,0 +1,378 @@
+"""Local Windows host bridge; analysis, host attestation and human action stay separate.
+
+This is an operator-controlled adapter, not protection against another process
+running as the same OS user. It never accepts an imported analyst receipt or an
+automatic human-approval flag. Existing governance validators own acceptance.
+"""
+from __future__ import annotations
+
+import argparse
+import ctypes
+import difflib
+from datetime import date
+import hashlib
+import json
+import os
+from pathlib import Path
+import secrets
+import subprocess
+import sys
+import tempfile
+import time
+import uuid
+
+from .governance_entry import apply_update, digest, revalidate, snapshot, validate_result
+from .governance_entry_cli import _read
+from .mcp.contribution_adoption import HmacHumanApprovalVerifier, issue_hmac_approval_assertion
+from .skillrun import _log_field
+
+
+class AppliedEvidenceError(RuntimeError):
+    """The target changed successfully; retry must inspect reflection first."""
+
+    def __init__(self, reflection: dict):
+        super().__init__("canonical application completed but reflection evidence save failed")
+        self.reflection = reflection
+
+
+def _write_new(path: Path, value: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with path.open("x", encoding="utf-8") as stream:
+        json.dump(value, stream, ensure_ascii=False, indent=2)
+        stream.write("\n")
+
+
+def _work_path(root: Path, path: Path) -> Path:
+    path = path.resolve()
+    if not path.is_relative_to((root / "work").resolve()):
+        raise ValueError("host evidence must remain under repository work/")
+    return path
+
+
+def _relative(root: Path, path: Path) -> str:
+    return path.resolve().relative_to(root.resolve()).as_posix()
+
+
+def _child_environment() -> dict[str, str]:
+    # Do not pass any existing operator authority to the analyst. New host keys
+    # are generated only AFTER the analyst exits, not inherited or put on disk.
+    return {key: value for key, value in os.environ.items()
+            if not key.upper().startswith("XREFKIT_GOVERNANCE_")
+            and key.upper() != "XREFKIT_CONTRIBUTION_APPROVAL_SECRET"}
+
+
+def _protect(raw: bytes, *, decrypt: bool = False) -> bytes:
+    if os.name != "nt":
+        raise RuntimeError("this operator adapter requires Windows DPAPI")
+
+    class Blob(ctypes.Structure):
+        _fields_ = [("size", ctypes.c_ulong), ("data", ctypes.POINTER(ctypes.c_ubyte))]
+
+    buffer = ctypes.create_string_buffer(raw)
+    source = Blob(len(raw), ctypes.cast(buffer, ctypes.POINTER(ctypes.c_ubyte)))
+    output = Blob()
+    crypt = ctypes.WinDLL("crypt32", use_last_error=True)
+    kernel = ctypes.WinDLL("kernel32", use_last_error=True)
+    kernel.LocalFree.argtypes = [ctypes.c_void_p]
+    kernel.LocalFree.restype = ctypes.c_void_p
+    if decrypt:
+        success = crypt.CryptUnprotectData(ctypes.byref(source), None, None, None, None,
+                                          1, ctypes.byref(output))
+    else:
+        success = crypt.CryptProtectData(ctypes.byref(source), "XRefKit governance host",
+                                        None, None, None, 1, ctypes.byref(output))
+    if not success:
+        raise OSError("Windows authority storage failed")
+    try:
+        return ctypes.string_at(output.data, output.size)
+    finally:
+        kernel.LocalFree(output.data)
+
+
+def _state_path(execution_id: str) -> Path:
+    location = os.environ.get("LOCALAPPDATA")
+    if not location:
+        raise RuntimeError("LOCALAPPDATA is required for operator authority storage")
+    return Path(location) / "XRefKit" / "governance-host" / (execution_id + ".dpapi")
+
+
+def _save_state(path: Path, state: dict, *, create: bool = True) -> None:
+    raw = _protect(json.dumps(state, sort_keys=True).encode("utf-8"))
+    path.parent.mkdir(parents=True, exist_ok=True)
+    if create:
+        with path.open("xb") as stream:
+            stream.write(raw)
+        return
+    descriptor, temporary = tempfile.mkstemp(prefix=".authority-", dir=path.parent)
+    try:
+        with os.fdopen(descriptor, "wb") as stream:
+            stream.write(raw)
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(temporary, path)
+    finally:
+        if os.path.exists(temporary):
+            os.unlink(temporary)
+
+
+def _load_state(path: Path) -> dict:
+    state = json.loads(_protect(path.read_bytes(), decrypt=True))
+    if not isinstance(state, dict) or state.get("schema") != "xrefkit.local_host_authority/v1":
+        raise ValueError("invalid local host authority")
+    return state
+
+
+def _completed_session(path: Path) -> str:
+    started = []
+    completed = 0
+    for line in path.read_text(encoding="utf-8").splitlines():
+        event = json.loads(line)
+        if event.get("type") in {"error", "turn.failed"}:
+            raise ValueError("analyst stream reported failure")
+        if event.get("type") == "thread.started":
+            started.append(event.get("thread_id"))
+        if event.get("type") == "turn.completed":
+            completed += 1
+    if len(started) != 1 or not isinstance(started[0], str) or not started[0] or completed != 1:
+        raise ValueError("one actual completed Codex thread is required")
+    return started[0]
+
+
+def _prompt(packet_path: Path, child_log: Path, result: Path) -> str:
+    return f"""Act only as the isolated shared_asset_update_gate analyst.
+The host has already opened your correlated Skill run. Do not open another run.
+Read the repository startup sources, then the selected method
+skills/os/shared_asset_update_gate/SKILL.v1.md and the immutable packet:
+{packet_path}
+Your opened run log: {child_log}
+Save the strict JSON result body (without output pointer) to: {result}
+Consume only packet materials and required startup/method contracts. Do not edit
+the packet, candidate, canonical target, specialist evidence, parent log or code.
+Use the existing skill workitem/artifact/concern/phase/verify/close commands to
+record and close your own run. Never advance check yourself; use deterministic
+verify. Never sign a receipt or approve/apply a target. Record the designated
+result as a done output artifact using its repository-relative path; record
+evidence, explicit handoff and all concerns. Report failed/unknown findings
+honestly. Successful process exit is not evidence that checks pass.
+The later host attestation, separate human action and canonical application are
+normal downstream responsibilities, outside your analysis scope. Record them
+as handoff steps; their being future steps alone is not an unresolved analysis
+risk. If you identify a concrete unresolved risk or uncertainty, retain it and
+its required disposition even when that prevents host attestation. The host
+requires actual Closure Gate done; it will not reinterpret escalated closure as
+success, and you must not resolve a genuine concern merely to obtain a receipt.
+Return only a short completion message after the output and run are saved.
+"""
+
+
+def dispatch_local(root: Path, packet_path: Path, codex: Path, out_dir: Path,
+                   *, timeout: int = 1800) -> dict:
+    """Run the actual CLI child, then attest its validated, closed result."""
+    root = root.resolve()
+    packet_path = packet_path.resolve()
+    packet = _read(str(packet_path))
+    revalidate(root, packet)
+    if packet["kind"] != "asset_update" or "endpoint" in packet["payload"]:
+        raise ValueError("local host requires a canonical single-target asset_update packet")
+    codex = codex.resolve(strict=True)
+    if not codex.is_file() or codex.suffix.lower() != ".exe":
+        raise ValueError("select the trusted native Codex executable, not a shell wrapper")
+    out_dir = _work_path(root, out_dir)
+    out_dir.mkdir(parents=True, exist_ok=False)
+    child = out_dir / f"{date.today().isoformat()}_skill_run_shared_asset_update_gate.md"
+    output = out_dir / "analysis.json"
+    final = out_dir / "last-message.txt"
+    events = out_dir / "events.jsonl"
+    stderr = out_dir / "stderr.log"
+    binding = packet["binding"]
+    command = [sys.executable, "-m", "xrefkit", "skill", "run", "--root", str(root),
+               "--definition", "skills/os/shared_asset_update_gate/SKILL.v1.md",
+               "--task", "Analyze frozen canonical governance packet " + packet["packet_hash"],
+               "--capability", "governance analysis", "--tuning", "shared asset management",
+               "--responsibility", "Analyze only the frozen common management checks without adoption",
+               "--execution-mode", "subagent_required", "--parent-run-id", binding["run_id"],
+               "--root-run-id", binding["run_snapshot"]["fields"]["root_run_id"],
+               "--work-item-id", binding["work_item_id"], "--out", str(child), "--json"]
+    opened = subprocess.run(command, cwd=root, env=_child_environment(), capture_output=True,
+                            text=True, encoding="utf-8", timeout=60, check=False)
+    (out_dir / "open-run.json").write_text(opened.stdout, encoding="utf-8")
+    opened_record = json.loads(opened.stdout)
+    if opened.returncode or not opened_record.get("ok") or not opened_record.get("run_id"):
+        raise ValueError("analyst Skill run refused; inspect open-run.json")
+    execution_id = str(uuid.uuid4())
+    argv = [str(codex), "exec", "--json", "--color", "never", "--sandbox", "workspace-write",
+            "--cd", str(root), "--output-last-message", str(final), "-"]
+    before = time.time()
+    with events.open("xb") as stdout, stderr.open("xb") as error:
+        process = subprocess.Popen(argv, cwd=root, env=_child_environment(), stdin=subprocess.PIPE,
+                                   stdout=stdout, stderr=error)
+        try:
+            process.communicate(_prompt(packet_path, child, output).encode("utf-8"), timeout=timeout)
+        except subprocess.TimeoutExpired:
+            if os.name == "nt":
+                subprocess.run(["taskkill.exe", "/PID", str(process.pid), "/T", "/F"],
+                               capture_output=True, timeout=30, check=False)
+            process.kill()
+            process.wait()
+            raise ValueError("analyst timed out; no attestation or approval created") from None
+    if process.returncode:
+        raise ValueError("analyst process failed; inspect stderr.log")
+    session = _completed_session(events)
+    if not final.is_file() or not final.read_text(encoding="utf-8").strip():
+        raise ValueError("analyst final message missing")
+    revalidate(root, packet)
+    if _log_field(child.read_text(encoding="utf-8"), "run_id") != opened_record["run_id"]:
+        raise ValueError("analyst replaced the host-opened child identity")
+    body = _read(str(output))
+    if "output" in body:
+        raise ValueError("analyst must not supply a host output pointer")
+    result = {**body, "output": snapshot(root, _relative(root, output))}
+    event = {"schema": "xrefkit.governance_execution/v1", "packet_hash": packet["packet_hash"],
+             "execution_id": execution_id, "child_log": _relative(root, child),
+             "child_log_hash": snapshot(root, _relative(root, child))["sha256"],
+             "skill_id": "shared_asset_update_gate", "result": result, "result_hash": digest(result)}
+    host_secret = secrets.token_hex(32)
+    verifier = HmacHumanApprovalVerifier(host_secret)
+    receipt = {"event": event, "signature": verifier.seal_event(event)}
+    validate_result(root, packet, receipt, verifier)
+    state_path = _state_path(execution_id)
+    provenance = {"schema": "xrefkit.local_host_dispatch/v1", "execution_id": execution_id,
+                  "packet_hash": packet["packet_hash"], "thread_id": session, "pid": process.pid,
+                  "started_at": before, "completed_at": time.time(), "exit_code": process.returncode,
+                  "executable": str(codex), "executable_sha256": hashlib.sha256(codex.read_bytes()).hexdigest(),
+                  "events": snapshot(root, _relative(root, events)), "receipt_hash": digest(receipt)}
+    _save_state(state_path, {"schema": "xrefkit.local_host_authority/v1", "root": str(root),
+                            "packet_hash": packet["packet_hash"], "receipt_hash": digest(receipt),
+                            "host_secret": host_secret, "applied": False})
+    _write_new(out_dir / "receipt.json", receipt)
+    _write_new(out_dir / "dispatch.json", {"event": provenance, "signature": verifier.seal_event(provenance)})
+    handoff = {"receipt": str(out_dir / "receipt.json"), "authority_state": str(state_path),
+               "status": "dispatched_not_approved", "human_action": "run apply and review the native dialog"}
+    _write_new(out_dir / "handoff.json", handoff)
+    return handoff
+
+
+def _review_dialog(target: str, candidate_hash: str, difference: str) -> bool:
+    # No command-line/STDIN yes path. The operator must act in this native UI.
+    import tkinter as tk
+    from tkinter.scrolledtext import ScrolledText
+
+    window = tk.Tk()
+    window.title("XRefKit — 正式Skillソースへの反映")
+    window.geometry("1000x750")
+    accepted = False
+    tk.Label(window, text="次の差分を正式ソースへ反映します。成熟度・採用・配布版は変更しません。",
+             anchor="w").pack(fill="x", padx=12, pady=8)
+    tk.Label(window, text=f"対象: {target}\n候補 SHA-256: {candidate_hash}",
+             anchor="w", justify="left", wraplength=970).pack(fill="x", padx=12)
+    text = ScrolledText(window, wrap="none")
+    text.insert("1.0", difference)
+    text.configure(state="disabled")
+    text.pack(fill="both", expand=True, padx=12, pady=12)
+
+    def approve() -> None:
+        nonlocal accepted
+        accepted = True
+        window.destroy()
+
+    buttons = tk.Frame(window)
+    buttons.pack(fill="x", padx=12, pady=10)
+    tk.Button(buttons, text="反映せず終了", command=window.destroy).pack(side="right", padx=8)
+    tk.Button(buttons, text="この差分を正式ソースへ反映", command=approve).pack(side="right", padx=8)
+    window.mainloop()
+    return accepted
+
+
+def apply_local(root: Path, packet_path: Path, receipt_path: Path, state_path: Path,
+                output: Path) -> dict:
+    root = root.resolve()
+    packet = _read(str(packet_path))
+    receipt = _read(str(receipt_path))
+    state = _load_state(state_path)
+    if (state.get("root") != str(root) or state.get("packet_hash") != packet["packet_hash"]
+            or state.get("receipt_hash") != digest(receipt) or state.get("applied")):
+        raise ValueError("authority state does not match this unapplied dispatch")
+    verifier = HmacHumanApprovalVerifier(state["host_secret"])
+    result = validate_result(root, packet, receipt, verifier)
+    if result["unknowns"] or any(row["result"] not in {"pass", "not_applicable"} for row in result["findings"]):
+        raise ValueError("failed or unknown analysis cannot be approved")
+    output = _work_path(root, output)
+    protected = {packet_path.resolve(), receipt_path.resolve(), state_path.resolve(),
+                 (root / packet["log"]).resolve(), (root / packet["payload"]["target"]).resolve(),
+                 (root / receipt["event"]["child_log"]).resolve(),
+                 *((root / row["path"]).resolve() for row in packet["materials"]),
+                 (root / result["output"]["path"]).resolve()}
+    if output in protected:
+        raise ValueError("reflection output would overwrite governance input")
+    _write_new(output, {"status": "awaiting_native_human_action"})
+    target = packet["payload"]["target"]
+    old_bytes = (root / target).read_bytes() if (root / target).exists() else None
+    candidate = packet["payload"]["candidate"]
+    new_bytes = (root / candidate).read_bytes()
+    candidate_hash = next(row["sha256"] for row in packet["materials"] if row["path"] == candidate)
+    if (hashlib.sha256(new_bytes).hexdigest() != candidate_hash
+            or (hashlib.sha256(old_bytes).hexdigest() if old_bytes is not None else None)
+            != packet["payload"]["expected_target_hash"]):
+        raise ValueError("review display differs from frozen candidate or target")
+    revalidate(root, packet)
+    old = old_bytes.decode("utf-8") if old_bytes is not None else ""
+    new = new_bytes.decode("utf-8")
+    difference = "".join(difflib.unified_diff(old.splitlines(True), new.splitlines(True),
+                                            fromfile=target, tofile=candidate))
+    if not _review_dialog(target, candidate_hash, difference):
+        output.write_text('{"status":"human_declined_no_application"}\n', encoding="utf-8")
+        return {"status": "human_declined_no_application"}
+    # Authority is issued only after the native action, in the operator process.
+    # Revalidation inside apply_update rejects changes made while the UI was open.
+    human_secret = secrets.token_hex(32)
+    assertion = issue_hmac_approval_assertion(human_secret, {
+        "action": "apply_governed_asset", "packet_hash": packet["packet_hash"],
+        "target": target, "result_hash": digest(result)})
+    reflected = apply_update(root, packet, receipt, host_verifier=verifier,
+                             approval_verifier=HmacHumanApprovalVerifier(human_secret),
+                             approval_assertion=assertion)
+    state.update({"human_secret": human_secret, "approval_assertion": assertion, "applied": True,
+                  "approved_at": time.time(), "reflected_target": reflected["target"]})
+    try:
+        _save_state(state_path, state, create=False)
+        output.write_text(json.dumps(reflected, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+    except (OSError, RuntimeError) as exc:
+        raise AppliedEvidenceError(reflected) from exc
+    return reflected
+
+
+def main(argv=None) -> int:
+    parser = argparse.ArgumentParser(prog="python -m xrefkit.governance_host")
+    parser.add_argument("--root", required=True, type=Path)
+    commands = parser.add_subparsers(dest="command", required=True)
+    start = commands.add_parser("dispatch")
+    start.add_argument("--packet", required=True, type=Path)
+    start.add_argument("--codex", type=Path, default=os.environ.get("CODEX_APP_RUNTIME_CLI_PATH"))
+    start.add_argument("--out-dir", required=True, type=Path)
+    start.add_argument("--timeout", type=int, default=1800)
+    apply = commands.add_parser("apply")
+    apply.add_argument("--packet", required=True, type=Path)
+    apply.add_argument("--receipt", required=True, type=Path)
+    apply.add_argument("--authority-state", required=True, type=Path)
+    apply.add_argument("--out", required=True, type=Path)
+    args = parser.parse_args(argv)
+    try:
+        if args.command == "dispatch":
+            if args.codex is None or args.timeout <= 0:
+                raise ValueError("native Codex executable and positive timeout required")
+            result = dispatch_local(args.root, args.packet, args.codex, args.out_dir, timeout=args.timeout)
+        else:
+            result = apply_local(args.root, args.packet, args.receipt, args.authority_state, args.out)
+        print(json.dumps(result, ensure_ascii=False))
+        return 0
+    except AppliedEvidenceError as exc:
+        print(str(exc))
+        print(json.dumps(exc.reflection, ensure_ascii=False))
+        return 3
+    except (ValueError, OSError, RuntimeError, KeyError, TypeError, subprocess.SubprocessError) as exc:
+        print(f"local governance host refused: {exc}")
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{xrefkit-0.7.6 → xrefkit-0.7.7/xrefkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: xrefkit
-Version: 0.7.6
+Version: 0.7.7
 Summary: Portable XID, Skill, Knowledge, workflow, and MCP runtime for XRefKit
 Author: synthaicode
 License: MIT License