Compare commits
21
Commits
@@ -13,7 +13,6 @@ from hashlib import sha256
|
||||
from pathlib import Path
|
||||
import json
|
||||
from typing import Any
|
||||
from message_handoff import stable_event_id
|
||||
|
||||
|
||||
def utc_now() -> str:
|
||||
@@ -56,18 +55,13 @@ class AgentEventBus:
|
||||
payload: dict[str, Any],
|
||||
correlation_id: str | None = None,
|
||||
) -> dict[str, Any]:
|
||||
event_id = stable_event_id(
|
||||
source=source, target=target, message_type=kind, payload=payload,
|
||||
tenant_id=(payload.get('tenant_id') if isinstance(payload, dict) else None),
|
||||
user_id=(payload.get('user_id') if isinstance(payload, dict) else None),
|
||||
project_id=(payload.get('project_id') if isinstance(payload, dict) else None),
|
||||
conversation_id=(payload.get('conversation_id') if isinstance(payload, dict) else None),
|
||||
task_id=(payload.get('task_id') if isinstance(payload, dict) else None),
|
||||
run_id=(payload.get('run_id') if isinstance(payload, dict) else None),
|
||||
causation_id=(payload.get('causation_id') if isinstance(payload, dict) else None),
|
||||
sequence=(payload.get('sequence') if isinstance(payload, dict) else None),
|
||||
idempotency_key=(payload.get('idempotency_key') if isinstance(payload, dict) else None),
|
||||
)
|
||||
event_id = "evt_" + sha256(
|
||||
json.dumps(
|
||||
{"kind": kind, "source": source, "summary": summary, "payload": payload},
|
||||
sort_keys=True,
|
||||
ensure_ascii=False,
|
||||
).encode("utf-8")
|
||||
).hexdigest()[:16]
|
||||
event = AgentEvent(event_id, kind, source, target, summary, payload, correlation_id=correlation_id)
|
||||
self._write("pending", event.to_dict())
|
||||
self._audit("created", event.to_dict())
|
||||
|
||||
@@ -94,91 +94,6 @@ class AuthorityGitExecutor:
|
||||
self._git(["worktree", "add", "--detach", str(path), base_oid])
|
||||
return path
|
||||
|
||||
def recover_failed_detached_worktree_exact(
|
||||
self,
|
||||
*,
|
||||
path: Path,
|
||||
expected_oid: str,
|
||||
stale_oid: str,
|
||||
target_ref: str,
|
||||
) -> str:
|
||||
"""Recreate one exact clean, detached, single-attempt worktree at its durable head."""
|
||||
_oid(expected_oid, "expected_oid")
|
||||
_oid(stale_oid, "stale_oid")
|
||||
if not TASK_BRANCH_RE.fullmatch(target_ref):
|
||||
raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
|
||||
if self.read_ref(target_ref) is not None:
|
||||
raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
|
||||
if (
|
||||
not path.is_absolute()
|
||||
or path.parent != self.worktree_root
|
||||
or path.name in {"", ".", ".."}
|
||||
or path.is_symlink()
|
||||
or not path.is_dir()
|
||||
):
|
||||
raise AuthorityGitError("WORKTREE_RECOVERY_PATH_INVALID")
|
||||
head = subprocess.run(
|
||||
["git", "-C", str(path), "rev-parse", "HEAD"],
|
||||
text=True, capture_output=True, check=False,
|
||||
)
|
||||
if head.returncode != 0 or head.stdout.strip() != stale_oid or stale_oid == expected_oid:
|
||||
raise AuthorityGitError("WORKTREE_RECOVERY_HEAD_INVALID")
|
||||
symbolic = subprocess.run(
|
||||
["git", "-C", str(path), "symbolic-ref", "-q", "HEAD"],
|
||||
text=True, capture_output=True, check=False,
|
||||
)
|
||||
if symbolic.returncode != 1:
|
||||
raise AuthorityGitError("WORKTREE_RECOVERY_NOT_DETACHED")
|
||||
status = subprocess.run(
|
||||
["git", "-C", str(path), "status", "--porcelain=v1", "--untracked-files=all"],
|
||||
text=True, capture_output=True, check=False,
|
||||
)
|
||||
if status.returncode != 0 or status.stdout:
|
||||
raise AuthorityGitError("WORKTREE_RECOVERY_NOT_CLEAN")
|
||||
parents = self._git(["rev-list", "--parents", "-n", "1", stale_oid]).split()
|
||||
if parents != [stale_oid, expected_oid]:
|
||||
raise AuthorityGitError("WORKTREE_RECOVERY_LINEAGE_INVALID")
|
||||
registered = [
|
||||
line.removeprefix("worktree ")
|
||||
for line in self._git(["worktree", "list", "--porcelain"]).splitlines()
|
||||
if line.startswith("worktree ")
|
||||
]
|
||||
if registered.count(str(path)) != 1:
|
||||
raise AuthorityGitError("WORKTREE_RECOVERY_REGISTRATION_INVALID")
|
||||
self._git(["worktree", "remove", "--force", str(path)])
|
||||
if path.exists() or path.is_symlink():
|
||||
raise AuthorityGitError("WORKTREE_RECOVERY_REMOVE_FAILED")
|
||||
recreated = self.create_detached_worktree(expected_oid, path.name, path.parent)
|
||||
readback = subprocess.run(
|
||||
["git", "-C", str(recreated), "rev-parse", "HEAD"],
|
||||
text=True, capture_output=True, check=False,
|
||||
)
|
||||
detached = subprocess.run(
|
||||
["git", "-C", str(recreated), "symbolic-ref", "-q", "HEAD"],
|
||||
text=True, capture_output=True, check=False,
|
||||
)
|
||||
if readback.returncode != 0 or readback.stdout.strip() != expected_oid or detached.returncode != 1:
|
||||
raise AuthorityGitError("WORKTREE_RECOVERY_READBACK_MISMATCH")
|
||||
return stale_oid
|
||||
|
||||
def create_task_branch_CAS(self, branch: str, expected_base_oid: str, new_oid: str) -> str:
|
||||
if not TASK_BRANCH_RE.fullmatch(branch):
|
||||
raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
|
||||
_oid(expected_base_oid, "expected_base_oid")
|
||||
_oid(new_oid, "new_oid")
|
||||
current = self.read_ref(branch)
|
||||
if current is not None:
|
||||
if current == new_oid:
|
||||
return new_oid
|
||||
raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
|
||||
if not self.ancestry_check(expected_base_oid, new_oid):
|
||||
raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
|
||||
self._git(["update-ref", branch, new_oid, "0" * 40])
|
||||
readback = self.read_ref(branch)
|
||||
if readback != new_oid:
|
||||
raise AuthorityGitError("AUTHORITY_CREATE_READBACK_MISMATCH")
|
||||
return readback
|
||||
|
||||
def advance_task_branch_CAS(self, branch: str, expected_oid: str, new_oid: str) -> str:
|
||||
if not TASK_BRANCH_RE.fullmatch(branch):
|
||||
raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
|
||||
|
||||
Regular → Executable
+1
-47
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env python3
|
||||
from __future__ import annotations
|
||||
import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, urllib.request, uuid
|
||||
import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, uuid
|
||||
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
@@ -404,51 +404,6 @@ class H(BaseHTTPRequestHandler):
|
||||
if not a['ok']: self.sendj({'error':'unauthorized','hint':'Bearer token required'},401); return None
|
||||
if '*' not in a['scopes'] and scope not in a['scopes']: self.sendj({'error':'forbidden','required_scope':scope,'account':a['account']},403); return None
|
||||
return a
|
||||
def bridge_release(self, path, data):
|
||||
route = {
|
||||
'/createTagApprovalRequest': '/v2/tag/approval-request',
|
||||
'/requestOrCreateTag': '/v2/tag/publish',
|
||||
'/getTagPublicationStatus': '/v2/tag/status',
|
||||
'/buildProductionArtifact': '/v2/release/artifact',
|
||||
'/executeApprovedProductionRelease': '/v2/release/execute',
|
||||
'/getReleaseConsistency': '/v2/release/consistency',
|
||||
'/runReleaseAcceptance': '/v2/release/acceptance',
|
||||
}.get(path)
|
||||
if route is None:
|
||||
raise ValueError('governed_release_route_invalid')
|
||||
base = os.getenv('AIOS_BRIDGE_V2_URL', 'http://127.0.0.1:18892').rstrip('/')
|
||||
request = urllib.request.Request(
|
||||
base + route,
|
||||
data=json.dumps(data, sort_keys=True, separators=(',', ':')).encode('utf-8'),
|
||||
headers={'Content-Type': 'application/json'},
|
||||
method='POST',
|
||||
)
|
||||
try:
|
||||
with urllib.request.urlopen(request, timeout=30) as response:
|
||||
result = json.loads(response.read().decode('utf-8'))
|
||||
return self.sendj(result, response.status)
|
||||
except urllib.error.HTTPError as exc:
|
||||
try:
|
||||
body = json.loads(exc.read().decode('utf-8'))
|
||||
except Exception:
|
||||
body = {'error': 'bridge_http_error'}
|
||||
return self.sendj(body, exc.code)
|
||||
except (urllib.error.URLError, TimeoutError) as exc:
|
||||
return self.sendj({'error': 'GOVERNED_BRIDGE_UNAVAILABLE', 'detail': type(exc).__name__}, 503)
|
||||
def do_POST(self):
|
||||
path = urllib.parse.urlparse(self.path).path
|
||||
if path in {
|
||||
'/createTagApprovalRequest', '/requestOrCreateTag', '/getTagPublicationStatus',
|
||||
'/buildProductionArtifact', '/executeApprovedProductionRelease',
|
||||
'/getReleaseConsistency', '/runReleaseAcceptance',
|
||||
}:
|
||||
actor = self.need('tag:create')
|
||||
if not actor:
|
||||
return
|
||||
return self.bridge_release(path, self.body())
|
||||
if reject_non_read_http(self, 'POST', path):
|
||||
return
|
||||
return self.sendj({'error': 'not_found', 'path': path}, 404)
|
||||
def do_GET(self):
|
||||
u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path
|
||||
if path not in READ_ONLY_GET_PATHS: return self.sendj({'error':'not_found','path':path},404)
|
||||
@@ -950,4 +905,3 @@ def main():
|
||||
print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
|
||||
ThreadingHTTPServer((HOST,PORT), H).serve_forever()
|
||||
if __name__ == '__main__': main()
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
"""ChatGPT GitOps Bridge v2 contract and governed release operations."""
|
||||
"""ChatGPT GitOps Bridge v2 contract and immutable runtime identity."""
|
||||
from __future__ import annotations
|
||||
|
||||
from dataclasses import dataclass
|
||||
@@ -6,93 +6,19 @@ import hashlib
|
||||
from pathlib import Path
|
||||
from typing import Any, Callable, Mapping
|
||||
|
||||
|
||||
BRIDGE_SCHEMA_VERSION = "aios.chatgpt-gitops-bridge.v2"
|
||||
BRIDGE_OPERATIONS = (
|
||||
"getRuntimeStatus",
|
||||
"getGovernedWriteCapabilities",
|
||||
"createGovernedTask",
|
||||
"acquireWriterLease",
|
||||
"bootstrapWriterLease",
|
||||
"renewWriterLease",
|
||||
"commitFileGoverned",
|
||||
"commitFilesGoverned",
|
||||
"getGitOpsJob",
|
||||
"resumeGitOpsJob",
|
||||
"reconcileGitOpsJob",
|
||||
"createTagApprovalRequest",
|
||||
"requestOrCreateTag",
|
||||
"getTagPublicationStatus",
|
||||
"buildProductionArtifact",
|
||||
"executeApprovedProductionRelease",
|
||||
"getReleaseConsistency",
|
||||
"runReleaseAcceptance",
|
||||
"getControlPlaneSnapshot",
|
||||
)
|
||||
|
||||
BRIDGE_OPERATIONS = ("getRuntimeStatus", "getGovernedWriteCapabilities", "createGovernedTask", "acquireWriterLease", "commitFileGoverned", "commitFilesGoverned", "getGitOpsJob", "resumeGitOpsJob", "reconcileGitOpsJob", "getControlPlaneSnapshot")
|
||||
OPERATION_REQUIRED_FIELDS = {
|
||||
"createGovernedTask": ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key"),
|
||||
"acquireWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
|
||||
"bootstrapWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
|
||||
"renewWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
|
||||
"commitFileGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "path", "content_base64", "message"),
|
||||
"commitFilesGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "files", "message"),
|
||||
"getGitOpsJob": ("job_id",),
|
||||
"resumeGitOpsJob": ("job_id", "expected_revision"),
|
||||
"reconcileGitOpsJob": ("job_id", "expected_revision"),
|
||||
"createTagApprovalRequest": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "owner_approval", "execute"),
|
||||
"requestOrCreateTag": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
|
||||
"getTagPublicationStatus": ("version",),
|
||||
"buildProductionArtifact": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
|
||||
"executeApprovedProductionRelease": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
|
||||
"getReleaseConsistency": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
|
||||
"runReleaseAcceptance": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
|
||||
"getControlPlaneSnapshot": (),
|
||||
}
|
||||
|
||||
BRIDGE_OPERATION_CONTRACTS = {
|
||||
"acquireWriterLease": {
|
||||
"method": "POST",
|
||||
"path": "/v2/writer-lease",
|
||||
"required_fields": OPERATION_REQUIRED_FIELDS["acquireWriterLease"],
|
||||
"response_fields": (
|
||||
"task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
|
||||
"create_target_branch", "worktree_mode", "cas_ref_update_required",
|
||||
),
|
||||
},
|
||||
"bootstrapWriterLease": {
|
||||
"method": "POST",
|
||||
"path": "/v2/writer-lease/bootstrap",
|
||||
"required_fields": OPERATION_REQUIRED_FIELDS["bootstrapWriterLease"],
|
||||
"response_fields": (
|
||||
"task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
|
||||
"create_target_branch", "worktree_mode", "cas_ref_update_required",
|
||||
"recovered", "bootstrapped", "runtime_rehydrated",
|
||||
"durable_branch_lease_present", "idempotent",
|
||||
),
|
||||
},
|
||||
"renewWriterLease": {
|
||||
"method": "POST",
|
||||
"path": "/v2/writer-lease/renew",
|
||||
"required_fields": OPERATION_REQUIRED_FIELDS["renewWriterLease"],
|
||||
"response_fields": (
|
||||
"task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
|
||||
"recovered", "bootstrapped", "runtime_rehydrated",
|
||||
"durable_branch_lease_present", "idempotent",
|
||||
),
|
||||
},
|
||||
"commitFileGoverned": {
|
||||
"method": "POST", "path": "/v2/commit-file",
|
||||
"required_fields": OPERATION_REQUIRED_FIELDS["commitFileGoverned"],
|
||||
"response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
|
||||
},
|
||||
"commitFilesGoverned": {
|
||||
"method": "POST", "path": "/v2/commit-files",
|
||||
"required_fields": OPERATION_REQUIRED_FIELDS["commitFilesGoverned"],
|
||||
"response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
class RuntimeDriftError(RuntimeError):
|
||||
pass
|
||||
@@ -114,90 +40,37 @@ class ControlPlaneReleaseManifest:
|
||||
deployment_state: str
|
||||
|
||||
def as_dict(self) -> dict[str, object]:
|
||||
return {
|
||||
"control_plane_release_version": self.control_plane_release_version,
|
||||
"control_plane_target_oid": self.control_plane_target_oid,
|
||||
"artifact_sha256": self.artifact_sha256,
|
||||
"runtime_path": str(self.runtime_path),
|
||||
"bridge_schema_version": self.bridge_schema_version,
|
||||
"repository_identity": self.repository_identity,
|
||||
"authoritative_git_dir": str(self.authoritative_git_dir),
|
||||
"deployment_state": self.deployment_state,
|
||||
}
|
||||
return {"control_plane_release_version": self.control_plane_release_version, "control_plane_target_oid": self.control_plane_target_oid, "artifact_sha256": self.artifact_sha256, "runtime_path": str(self.runtime_path), "bridge_schema_version": self.bridge_schema_version, "repository_identity": self.repository_identity, "authoritative_git_dir": str(self.authoritative_git_dir), "deployment_state": self.deployment_state}
|
||||
|
||||
def validate(self, artifact: Path, *, observed_oid: str, approved_root: Path = Path("/opt/aios/gitops-control-plane")) -> dict[str, object]:
|
||||
try:
|
||||
runtime = self.runtime_path.resolve(strict=True)
|
||||
root = approved_root.resolve(strict=True)
|
||||
artifact_path = artifact.resolve(strict=True)
|
||||
runtime.relative_to(root)
|
||||
artifact_path.relative_to(runtime)
|
||||
runtime = self.runtime_path.resolve(strict=True); root = approved_root.resolve(strict=True); artifact_path = artifact.resolve(strict=True); runtime.relative_to(root); artifact_path.relative_to(runtime)
|
||||
except (OSError, ValueError):
|
||||
raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT") from None
|
||||
mutable_markers = {"workspace", "workspaces", "worktree", "worktrees"}
|
||||
if mutable_markers.intersection(part.lower() for part in runtime.parts):
|
||||
if any(marker in {"workspace", "workspaces", "worktree", "worktrees"} for marker in (part.lower() for part in runtime.parts)):
|
||||
raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
|
||||
valid = (
|
||||
len(self.control_plane_target_oid) == 40
|
||||
and observed_oid == self.control_plane_target_oid
|
||||
and len(self.artifact_sha256) == 64
|
||||
and hashlib.sha256(artifact_path.read_bytes()).hexdigest() == self.artifact_sha256
|
||||
and self.bridge_schema_version == BRIDGE_SCHEMA_VERSION
|
||||
and self.repository_identity == "aios/aios"
|
||||
and self.authoritative_git_dir == Path("/data/aios-gitops/repo.git")
|
||||
and self.authoritative_git_dir.is_absolute()
|
||||
and self.deployment_state == "STAGING"
|
||||
)
|
||||
valid = len(self.control_plane_target_oid) == 40 and observed_oid == self.control_plane_target_oid and len(self.artifact_sha256) == 64 and hashlib.sha256(artifact_path.read_bytes()).hexdigest() == self.artifact_sha256 and self.bridge_schema_version == BRIDGE_SCHEMA_VERSION and self.repository_identity == "aios/aios" and self.authoritative_git_dir == Path("/data/aios-gitops/repo.git") and self.deployment_state == "STAGING"
|
||||
if not valid:
|
||||
raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
|
||||
return {**self.as_dict(), "drift_status": "PASS"}
|
||||
|
||||
|
||||
class BridgeV2Adapter:
|
||||
"""Thin operation adapter; all mutating handlers are injected seams."""
|
||||
|
||||
def __init__(self, *, runtime_status: Mapping[str, Any], handlers: Mapping[str, Callable[[Mapping[str, Any]], Any]] | None = None) -> None:
|
||||
self.runtime_status = dict(runtime_status)
|
||||
self.handlers = dict(handlers or {})
|
||||
self.runtime_status = dict(runtime_status); self.handlers = dict(handlers or {})
|
||||
|
||||
def getRuntimeStatus(self) -> dict[str, Any]:
|
||||
return {"bridge_schema_version": BRIDGE_SCHEMA_VERSION, **self.runtime_status}
|
||||
|
||||
def getGovernedWriteCapabilities(self) -> dict[str, Any]:
|
||||
return {
|
||||
"bridge_schema_version": BRIDGE_SCHEMA_VERSION,
|
||||
"legacy_writes_enabled": False,
|
||||
"governed_writes_enabled": True,
|
||||
"operations": list(BRIDGE_OPERATIONS),
|
||||
"operation_contracts": {
|
||||
operation: {
|
||||
**contract,
|
||||
"required_fields": list(contract["required_fields"]),
|
||||
"response_fields": list(contract["response_fields"]),
|
||||
}
|
||||
for operation, contract in BRIDGE_OPERATION_CONTRACTS.items()
|
||||
},
|
||||
"force_push": False,
|
||||
"main_write": False,
|
||||
"tag_write": False,
|
||||
"baseline_write": False,
|
||||
"production_write": False,
|
||||
"approved_release_operations": True,
|
||||
"approved_release_scope": {
|
||||
"version": "V2R2C1",
|
||||
"target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
|
||||
"evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
|
||||
"approval_plan_id": "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e",
|
||||
},
|
||||
}
|
||||
return {"bridge_schema_version": BRIDGE_SCHEMA_VERSION, "legacy_writes_enabled": False, "governed_writes_enabled": True, "operations": list(BRIDGE_OPERATIONS), "force_push": False, "main_write": False, "tag_write": False, "baseline_write": False, "production_write": False}
|
||||
|
||||
@staticmethod
|
||||
def legacy_write_disabled() -> dict[str, object]:
|
||||
return {"error": "LEGACY_WRITE_DISABLED", "replacement": "createGovernedTask", "governed_writes_available": True}
|
||||
|
||||
def _call(self, operation: str, request: Mapping[str, Any]) -> Any:
|
||||
required = OPERATION_REQUIRED_FIELDS[operation]
|
||||
if any(key not in request for key in required):
|
||||
if tuple(key for key in OPERATION_REQUIRED_FIELDS[operation] if key not in request):
|
||||
raise BridgeV2Error("BRIDGE_REQUEST_FIELDS_MISSING")
|
||||
handler = self.handlers.get(operation)
|
||||
if handler is None:
|
||||
@@ -206,19 +79,9 @@ class BridgeV2Adapter:
|
||||
|
||||
def createGovernedTask(self, request: Mapping[str, Any]) -> Any: return self._call("createGovernedTask", request)
|
||||
def acquireWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("acquireWriterLease", request)
|
||||
def bootstrapWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("bootstrapWriterLease", request)
|
||||
def renewWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("renewWriterLease", request)
|
||||
def commitFileGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFileGoverned", request)
|
||||
def commitFilesGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFilesGoverned", request)
|
||||
def getGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("getGitOpsJob", request)
|
||||
def resumeGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("resumeGitOpsJob", request)
|
||||
def reconcileGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("reconcileGitOpsJob", request)
|
||||
def createTagApprovalRequest(self, request: Mapping[str, Any]) -> Any: return self._call("createTagApprovalRequest", request)
|
||||
def requestOrCreateTag(self, request: Mapping[str, Any]) -> Any: return self._call("requestOrCreateTag", request)
|
||||
def getTagPublicationStatus(self, request: Mapping[str, Any]) -> Any: return self._call("getTagPublicationStatus", request)
|
||||
def buildProductionArtifact(self, request: Mapping[str, Any]) -> Any: return self._call("buildProductionArtifact", request)
|
||||
def executeApprovedProductionRelease(self, request: Mapping[str, Any]) -> Any: return self._call("executeApprovedProductionRelease", request)
|
||||
def getReleaseConsistency(self, request: Mapping[str, Any]) -> Any: return self._call("getReleaseConsistency", request)
|
||||
def runReleaseAcceptance(self, request: Mapping[str, Any]) -> Any: return self._call("runReleaseAcceptance", request)
|
||||
|
||||
def getControlPlaneSnapshot(self, request: Mapping[str, Any] | None = None) -> Any: return self._call("getControlPlaneSnapshot", request or {})
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -51,13 +51,11 @@ class AuthorityPort(Protocol):
|
||||
def branch_exists(self, branch: str) -> bool: ...
|
||||
def branch_head(self, branch: str) -> str: ...
|
||||
def is_ancestor(self, older: str, newer: str) -> bool: ...
|
||||
def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str: ...
|
||||
def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
|
||||
|
||||
|
||||
class RemotePort(Protocol):
|
||||
def repository_identity(self) -> str: ...
|
||||
def push_new_exact(self, branch: str, new: str) -> None: ...
|
||||
def push_exact(self, branch: str, expected: str, new: str) -> None: ...
|
||||
def read_git_ref(self, branch: str) -> str | None: ...
|
||||
def read_api_branch(self, branch: str) -> str | None: ...
|
||||
@@ -105,9 +103,6 @@ class AuthorityGitAdapter:
|
||||
def is_ancestor(self, older: str, newer: str) -> bool:
|
||||
return self.executor.ancestry_check(older, newer)
|
||||
|
||||
def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str:
|
||||
return self.executor.create_task_branch_CAS(self._ref(branch), expected_base, new)
|
||||
|
||||
def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str:
|
||||
return self.executor.advance_task_branch_CAS(self._ref(branch), expected, new)
|
||||
|
||||
@@ -263,15 +258,6 @@ class GiteaContinuationRemote:
|
||||
raise ContinuationExecutionError("GITEA_GIT_READBACK_INVALID")
|
||||
return oid
|
||||
|
||||
def push_new_exact(self, branch: str, new: str) -> None:
|
||||
self._require_projected()
|
||||
self.repository_identity()
|
||||
if self.read_git_ref(branch) is not None:
|
||||
raise ContinuationExecutionError("GITEA_TARGET_BRANCH_ALREADY_EXISTS")
|
||||
_run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
|
||||
if self.read_git_ref(branch) != new:
|
||||
raise ContinuationExecutionError("GITEA_CREATE_READBACK_MISMATCH")
|
||||
|
||||
def push_exact(self, branch: str, expected: str, new: str) -> None:
|
||||
self._require_projected()
|
||||
self.repository_identity()
|
||||
@@ -298,24 +284,13 @@ class GiteaContinuationRemote:
|
||||
|
||||
def read_api_branch(self, branch: str) -> str | None:
|
||||
owner, name = self.repository.split("/", 1)
|
||||
page = 1
|
||||
while page <= 100:
|
||||
value = self._api(f"/repos/{quote(owner)}/{quote(name)}/branches?page={page}&limit=50")
|
||||
if value is None:
|
||||
return None
|
||||
if not isinstance(value, list):
|
||||
raise ContinuationExecutionError("GITEA_API_BRANCH_COLLECTION_INVALID")
|
||||
for item in value:
|
||||
if not isinstance(item, dict) or item.get("name") != branch:
|
||||
continue
|
||||
oid = item.get("commit", {}).get("id")
|
||||
if not isinstance(oid, str) or not OID_RE.fullmatch(oid):
|
||||
raise ContinuationExecutionError("GITEA_API_BRANCH_INVALID")
|
||||
return oid
|
||||
if len(value) < 50:
|
||||
return None
|
||||
page += 1
|
||||
raise ContinuationExecutionError("GITEA_API_BRANCH_PAGINATION_LIMIT")
|
||||
value = self._api(f"/repos/{quote(owner)}/{quote(name)}/branches/{quote(branch, safe='/')}")
|
||||
if value is None:
|
||||
return None
|
||||
oid = value.get("commit", {}).get("id") if isinstance(value, dict) else None
|
||||
if not isinstance(oid, str) or not OID_RE.fullmatch(oid):
|
||||
raise ContinuationExecutionError("GITEA_API_BRANCH_INVALID")
|
||||
return oid
|
||||
|
||||
def commit_visible(self, oid: str) -> bool:
|
||||
owner, name = self.repository.split("/", 1)
|
||||
@@ -343,7 +318,6 @@ class ContinuationPermissions:
|
||||
@dataclass(frozen=True, slots=True)
|
||||
class ContinuationRuntimeBinding:
|
||||
request: WriterLeaseRequestV2
|
||||
job_id: str
|
||||
workspace_path: Path
|
||||
lease_not_before: datetime
|
||||
lease_expires_at: datetime
|
||||
@@ -404,20 +378,13 @@ class ContinuationExecutor:
|
||||
def observe_generation(self, branch: str, generation: int) -> None:
|
||||
self._observed_generations[branch] = max(generation, self._observed_generations.get(branch, 0))
|
||||
|
||||
def _max_generation(self, branch: str, *, exclude_job_id: str | None = None) -> int:
|
||||
def _max_generation(self, branch: str) -> int:
|
||||
observed = self._observed_generations.get(branch, 0)
|
||||
with self.controller.store._connect() as connection:
|
||||
if exclude_job_id is None:
|
||||
row = connection.execute(
|
||||
"SELECT MAX(generation) AS generation FROM branch_leases WHERE branch=?",
|
||||
(branch,),
|
||||
).fetchone()
|
||||
else:
|
||||
row = connection.execute(
|
||||
"SELECT MAX(generation) AS generation FROM branch_leases "
|
||||
"WHERE branch=? AND job_id!=?",
|
||||
(branch, exclude_job_id),
|
||||
).fetchone()
|
||||
row = connection.execute(
|
||||
"SELECT MAX(generation) AS generation FROM branch_leases WHERE branch=?",
|
||||
(branch,),
|
||||
).fetchone()
|
||||
durable = int(row["generation"] or 0)
|
||||
return max(observed, durable)
|
||||
|
||||
@@ -426,7 +393,6 @@ class ContinuationExecutor:
|
||||
return {
|
||||
"schema": WriterLeaseRequestV2.schema,
|
||||
"task_id": request.task_id,
|
||||
"job_id": request.job_id,
|
||||
"repository": request.repository,
|
||||
"branch_mode": request.branch_mode,
|
||||
"base_oid": request.base_oid,
|
||||
@@ -436,21 +402,10 @@ class ContinuationExecutor:
|
||||
"lease_seconds": request.lease_seconds,
|
||||
}
|
||||
|
||||
def _validate_preflight(self, binding: ContinuationRuntimeBinding, *, job_id: str | None = None) -> None:
|
||||
def _validate_preflight(self, binding: ContinuationRuntimeBinding) -> None:
|
||||
request = binding.request
|
||||
request_mapping = self._request_mapping(request)
|
||||
normalized = validate_writer_lease_request_v2(request_mapping, self.authority)
|
||||
expected_normalized = {
|
||||
**request_mapping,
|
||||
"create_target_branch": request.branch_mode == "CREATE_NEW",
|
||||
"worktree_mode": (
|
||||
"detached_at_base_oid"
|
||||
if request.branch_mode == "CREATE_NEW"
|
||||
else "detached_at_expected_head"
|
||||
),
|
||||
"cas_ref_update_required": True,
|
||||
}
|
||||
if normalized != expected_normalized:
|
||||
normalized = validate_writer_lease_request_v2(self._request_mapping(request), self.authority)
|
||||
if normalized != {**self._request_mapping(request), "create_target_branch": False, "worktree_mode": "detached_at_expected_head", "cas_ref_update_required": True}:
|
||||
raise ContinuationExecutionError("CONTINUATION_NORMALIZATION_INVALID")
|
||||
if not binding.original_receipt_valid or not binding.original_grant_consumed:
|
||||
raise ContinuationExecutionError("ORIGINAL_GRANT_LINEAGE_INVALID")
|
||||
@@ -460,7 +415,7 @@ class ContinuationExecutor:
|
||||
raise ContinuationExecutionError("LEASE_NOT_ACTIVE")
|
||||
if now >= binding.lease_expires_at:
|
||||
raise ContinuationExecutionError("LEASE_EXPIRED")
|
||||
if request.generation <= self._max_generation(request.target_branch, exclude_job_id=job_id):
|
||||
if request.generation <= self._max_generation(request.target_branch):
|
||||
raise ContinuationExecutionError("GENERATION_NOT_MONOTONIC")
|
||||
if not self.workspace.is_detached():
|
||||
raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
|
||||
@@ -486,102 +441,57 @@ class ContinuationExecutor:
|
||||
"generation": request.generation,
|
||||
}
|
||||
|
||||
def execute(
|
||||
self,
|
||||
binding: ContinuationRuntimeBinding,
|
||||
commit: ContinuationCommit,
|
||||
*,
|
||||
before_complete: Callable[[str], None] | None = None,
|
||||
) -> dict[str, object]:
|
||||
commit.payload()
|
||||
if not binding.job_id or binding.request.job_id != binding.job_id:
|
||||
raise ContinuationExecutionError("RUNTIME_LINEAGE_MISSING_JOB_ID")
|
||||
current = self.controller.store.read(binding.job_id)
|
||||
current_state = JobState(current["state"])
|
||||
if current_state == JobState.COMPLETED:
|
||||
def execute(self, binding: ContinuationRuntimeBinding, commit: ContinuationCommit) -> dict[str, object]:
|
||||
payload = commit.payload()
|
||||
submitted = self.controller.submit(self._job_request(binding, commit, payload), payload=payload)
|
||||
current = self.controller.store.read(submitted.job_id)
|
||||
if JobState(current["state"]) == JobState.COMPLETED:
|
||||
return self.controller.store._receipt(current, duplicate=True).as_dict()
|
||||
if current_state == JobState.REMOTE_VERIFIED:
|
||||
receipt = json.loads(str(current["receipt_json"] or "{}"))
|
||||
commit_oid = str(receipt.get("authority_oid") or "")
|
||||
if not OID_RE.fullmatch(commit_oid):
|
||||
raise ContinuationExecutionError("GOVERNED_COMMIT_OID_INVALID")
|
||||
if before_complete is not None:
|
||||
before_complete(commit_oid)
|
||||
return self.controller.advance(
|
||||
binding.job_id,
|
||||
JobState.COMPLETED,
|
||||
side_effect_state="REMOTE_VERIFIED",
|
||||
receipt=receipt,
|
||||
).as_dict()
|
||||
self._validate_preflight(binding, job_id=binding.job_id)
|
||||
self._validate_preflight(binding)
|
||||
request = binding.request
|
||||
projected = False
|
||||
try:
|
||||
self.credential.project()
|
||||
projected = True
|
||||
row = self.controller.store.read(binding.job_id)
|
||||
state = JobState(row["state"])
|
||||
if state == JobState.REQUESTED:
|
||||
row = self.controller.store.read(submitted.job_id)
|
||||
if JobState(row["state"]) == JobState.REQUESTED:
|
||||
self.controller.advance(
|
||||
binding.job_id,
|
||||
submitted.job_id,
|
||||
JobState.AUTHORIZED,
|
||||
side_effect_state="AUTHORIZED",
|
||||
receipt={"task_id": request.task_id, "original_grant_consumed": True},
|
||||
expected_revision=int(row["revision"]),
|
||||
)
|
||||
row = self.controller.store.read(binding.job_id)
|
||||
state = JobState(row["state"])
|
||||
if state == JobState.AUTHORIZED:
|
||||
row = self.controller.store.read(submitted.job_id)
|
||||
if JobState(row["state"]) == JobState.AUTHORIZED:
|
||||
self.controller.lease_job(
|
||||
binding.job_id,
|
||||
lease_id=f"lease-{binding.job_id}",
|
||||
submitted.job_id,
|
||||
lease_id=f"lease-{submitted.job_id}",
|
||||
lineage_anchor_oid=request.base_oid,
|
||||
current_head_oid=request.expected_branch_oid,
|
||||
generation=request.generation,
|
||||
lease_expires_at=binding.lease_expires_at.astimezone(timezone.utc).isoformat(),
|
||||
expected_revision=int(row["revision"]),
|
||||
)
|
||||
row = self.controller.store.read(binding.job_id)
|
||||
state = JobState(row["state"])
|
||||
if state == JobState.LEASED:
|
||||
self.controller.advance(binding.job_id, JobState.WORKTREE_READY,
|
||||
side_effect_state="WORKTREE_READY", expected_revision=int(row["revision"]))
|
||||
row = self.controller.store.read(binding.job_id)
|
||||
state = JobState(row["state"])
|
||||
if state == JobState.WORKTREE_READY:
|
||||
self.controller.advance(binding.job_id, JobState.EXECUTING,
|
||||
side_effect_state="IN_PROGRESS", expected_revision=int(row["revision"]))
|
||||
elif state != JobState.EXECUTING:
|
||||
raise ContinuationExecutionError("JOB_EXECUTION_STATE_INVALID")
|
||||
self.controller.advance(submitted.job_id, JobState.WORKTREE_READY, side_effect_state="WORKTREE_READY")
|
||||
self.controller.advance(submitted.job_id, JobState.EXECUTING, side_effect_state="IN_PROGRESS")
|
||||
new_oid = self.workspace.commit_files(commit.files, commit.message)
|
||||
if not OID_RE.fullmatch(new_oid) or not self.authority.is_ancestor(request.expected_branch_oid, new_oid):
|
||||
raise ContinuationExecutionError("NON_FAST_FORWARD_COMMIT")
|
||||
if request.branch_mode == "CREATE_NEW":
|
||||
authority_oid = self.authority.create_task_branch_cas(request.target_branch, request.base_oid, new_oid)
|
||||
else:
|
||||
authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
|
||||
authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
|
||||
if authority_oid != new_oid:
|
||||
raise ContinuationExecutionError("AUTHORITY_CAS_READBACK_MISMATCH")
|
||||
self.controller.advance(
|
||||
binding.job_id,
|
||||
submitted.job_id,
|
||||
JobState.LOCAL_VERIFIED,
|
||||
side_effect_state="LOCAL_VERIFIED",
|
||||
receipt={"authority_oid": authority_oid, "force_push": False},
|
||||
)
|
||||
try:
|
||||
self.controller.advance(binding.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
|
||||
if request.branch_mode == "CREATE_NEW":
|
||||
self.remote.push_new_exact(request.target_branch, new_oid)
|
||||
else:
|
||||
self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
|
||||
self.controller.advance(submitted.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
|
||||
self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
|
||||
except Exception:
|
||||
return self._remote_pending(binding.job_id, authority_oid, new_oid)
|
||||
return self._finish_remote_verification(
|
||||
binding.job_id,
|
||||
authority_oid,
|
||||
new_oid,
|
||||
before_complete=before_complete,
|
||||
)
|
||||
return self._remote_pending(submitted.job_id, authority_oid, new_oid)
|
||||
return self._finish_remote_verification(submitted.job_id, authority_oid, new_oid)
|
||||
finally:
|
||||
if projected:
|
||||
self.credential.revoke()
|
||||
@@ -604,14 +514,7 @@ class ContinuationExecutor:
|
||||
)
|
||||
return result.as_dict()
|
||||
|
||||
def _finish_remote_verification(
|
||||
self,
|
||||
job_id: str,
|
||||
authority_oid: str,
|
||||
new_oid: str,
|
||||
*,
|
||||
before_complete: Callable[[str], None] | None = None,
|
||||
) -> dict[str, object]:
|
||||
def _finish_remote_verification(self, job_id: str, authority_oid: str, new_oid: str) -> dict[str, object]:
|
||||
row = self.controller.store.read(job_id)
|
||||
branch = row["branch"]
|
||||
request = json.loads(row["request_json"])["binding"]
|
||||
@@ -628,20 +531,8 @@ class ContinuationExecutor:
|
||||
"reconciliation_decision": decision.action.value,
|
||||
"force_push": False,
|
||||
}
|
||||
self.controller.advance(
|
||||
job_id,
|
||||
JobState.REMOTE_VERIFIED,
|
||||
side_effect_state="REMOTE_VERIFIED",
|
||||
receipt=receipt,
|
||||
)
|
||||
if before_complete is not None:
|
||||
before_complete(new_oid)
|
||||
return self.controller.advance(
|
||||
job_id,
|
||||
JobState.COMPLETED,
|
||||
side_effect_state="REMOTE_VERIFIED",
|
||||
receipt=receipt,
|
||||
).as_dict()
|
||||
self.controller.advance(job_id, JobState.REMOTE_VERIFIED, side_effect_state="REMOTE_VERIFIED", receipt=receipt)
|
||||
return self.controller.advance(job_id, JobState.COMPLETED, side_effect_state="REMOTE_VERIFIED", receipt=receipt).as_dict()
|
||||
|
||||
def reconcile(self, job_id: str) -> dict[str, object]:
|
||||
row = self.controller.store.read(job_id)
|
||||
|
||||
@@ -49,7 +49,6 @@ class WriterLeaseRequestV2:
|
||||
target_branch: str
|
||||
generation: int
|
||||
lease_seconds: int = 900
|
||||
job_id: str = ""
|
||||
|
||||
schema = "aios.task-writer-lease.v2"
|
||||
accepted_schemas = frozenset({"aios.task-writer-lease.v2", "aios.task-writer-lease-request.v2"})
|
||||
@@ -57,8 +56,6 @@ class WriterLeaseRequestV2:
|
||||
def validate(self, probe: BranchProbe) -> None:
|
||||
if not self.task_id or self.repository != "aios/aios":
|
||||
raise ContinuationError("request_identity_invalid")
|
||||
if not self.job_id or not self.job_id.startswith("job-"):
|
||||
raise ContinuationError("job_id_invalid")
|
||||
if self.branch_mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
|
||||
raise ContinuationError("branch_mode_invalid")
|
||||
_oid(self.base_oid, "base_oid")
|
||||
@@ -77,12 +74,6 @@ class WriterLeaseRequestV2:
|
||||
raise ContinuationError("EXISTING_BRANCH_OID_CONFLICT")
|
||||
if not probe.is_ancestor(self.base_oid, actual):
|
||||
raise ContinuationError("BASE_NOT_ANCESTOR_OF_BRANCH")
|
||||
elif hasattr(probe, "commit_exists") and not probe.commit_exists(self.base_oid):
|
||||
raise ContinuationError("BASE_COMMIT_NOT_FOUND")
|
||||
elif self.branch_mode == "CREATE_NEW" and probe.branch_exists(self.target_branch):
|
||||
raise ContinuationError("TARGET_BRANCH_ALREADY_EXISTS")
|
||||
elif self.branch_mode == "CREATE_NEW" and self.base_oid != self.expected_branch_oid:
|
||||
raise ContinuationError("CREATE_NEW_BASE_EXPECTATION_MISMATCH")
|
||||
|
||||
|
||||
@dataclass(frozen=True, slots=True)
|
||||
|
||||
@@ -27,19 +27,6 @@ class ServiceUnavailable(JobError):
|
||||
pass
|
||||
|
||||
|
||||
@dataclass(frozen=True, slots=True)
|
||||
class LeaseRenewalResult:
|
||||
"""Durable outcome of one writer-lease recovery attempt."""
|
||||
|
||||
renewed: bool
|
||||
idempotent: bool
|
||||
durable: bool
|
||||
lease_expires_at: str | None
|
||||
|
||||
def __bool__(self) -> bool:
|
||||
return self.renewed or self.idempotent
|
||||
|
||||
|
||||
class BindingConflict(JobError):
|
||||
pass
|
||||
|
||||
@@ -79,14 +66,6 @@ def utc_now() -> str:
|
||||
return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
|
||||
|
||||
|
||||
def parse_utc(value: str) -> datetime:
|
||||
normalized = value[:-1] + "+00:00" if value.endswith("Z") else value
|
||||
parsed = datetime.fromisoformat(normalized)
|
||||
if parsed.tzinfo is None:
|
||||
raise ValueError("LEASE_EXPIRY_INVALID")
|
||||
return parsed.astimezone(timezone.utc)
|
||||
|
||||
|
||||
def canonical_json(value: Any) -> bytes:
|
||||
return (
|
||||
json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n"
|
||||
@@ -425,16 +404,13 @@ class GitOpsJobController:
|
||||
self.store._mirror(result)
|
||||
return self.store._receipt(result, duplicate=True)
|
||||
|
||||
def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE", lease_expires_at: str | None = None) -> None:
|
||||
def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE") -> None:
|
||||
if len(current_head_oid) != 40 or generation < 1:
|
||||
raise JobError("LEASE_BINDING_INVALID")
|
||||
try:
|
||||
with self.store._connect() as connection:
|
||||
connection.execute("BEGIN IMMEDIATE")
|
||||
if lease_expires_at is None:
|
||||
updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, state, lease_id, expected_revision))
|
||||
else:
|
||||
updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,lease_expires_at=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, lease_expires_at, state, lease_id, expected_revision))
|
||||
updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, state, lease_id, expected_revision))
|
||||
if updated.rowcount != 1:
|
||||
raise JobError("LEASE_REVISION_CAS_CONFLICT")
|
||||
connection.commit()
|
||||
@@ -443,94 +419,6 @@ class GitOpsJobController:
|
||||
except sqlite3.Error as exc:
|
||||
raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
|
||||
|
||||
def renew_lease(
|
||||
self,
|
||||
*,
|
||||
branch: str,
|
||||
lineage_anchor_oid: str,
|
||||
current_head_oid: str,
|
||||
generation: int,
|
||||
lease_expires_at: str,
|
||||
) -> LeaseRenewalResult:
|
||||
if (
|
||||
not branch
|
||||
or len(lineage_anchor_oid) != 40
|
||||
or len(current_head_oid) != 40
|
||||
or generation < 1
|
||||
or not lease_expires_at.strip()
|
||||
):
|
||||
raise JobError("LEASE_BINDING_INVALID")
|
||||
try:
|
||||
with self.store._connect() as connection:
|
||||
connection.execute("BEGIN IMMEDIATE")
|
||||
rows = connection.execute(
|
||||
"SELECT lease_id, revision, generation, state, lease_expires_at "
|
||||
"FROM branch_leases "
|
||||
"WHERE branch=? AND lineage_anchor_oid=? AND current_head_oid=? "
|
||||
"AND generation=? AND state='ACTIVE' ORDER BY revision DESC",
|
||||
(branch, lineage_anchor_oid, current_head_oid, generation),
|
||||
).fetchall()
|
||||
if not rows:
|
||||
connection.commit()
|
||||
return LeaseRenewalResult(False, False, False, None)
|
||||
if len(rows) != 1:
|
||||
raise JobError("LEASE_BINDING_CONFLICT")
|
||||
row = rows[0]
|
||||
try:
|
||||
current_expires_at = parse_utc(str(row["lease_expires_at"]))
|
||||
requested_expires_at = parse_utc(lease_expires_at)
|
||||
except (TypeError, ValueError) as exc:
|
||||
raise JobError("LEASE_EXPIRY_INVALID") from exc
|
||||
now = datetime.now(timezone.utc)
|
||||
if requested_expires_at <= now:
|
||||
raise JobError("LEASE_EXPIRY_INVALID")
|
||||
if current_expires_at > now:
|
||||
connection.commit()
|
||||
return LeaseRenewalResult(
|
||||
False,
|
||||
True,
|
||||
True,
|
||||
str(row["lease_expires_at"]),
|
||||
)
|
||||
updated = connection.execute(
|
||||
"UPDATE branch_leases SET lease_expires_at=?,revision=revision+1 "
|
||||
"WHERE lease_id=? AND revision=? AND generation=? "
|
||||
"AND state='ACTIVE' AND lease_expires_at=?",
|
||||
(
|
||||
lease_expires_at,
|
||||
row["lease_id"],
|
||||
int(row["revision"]),
|
||||
generation,
|
||||
row["lease_expires_at"],
|
||||
),
|
||||
)
|
||||
if updated.rowcount != 1:
|
||||
current = connection.execute(
|
||||
"SELECT lease_expires_at, generation, state FROM branch_leases "
|
||||
"WHERE lease_id=?",
|
||||
(row["lease_id"],),
|
||||
).fetchone()
|
||||
if (
|
||||
current is not None
|
||||
and int(current["generation"]) == generation
|
||||
and current["state"] == "ACTIVE"
|
||||
and parse_utc(str(current["lease_expires_at"])) > now
|
||||
):
|
||||
connection.commit()
|
||||
return LeaseRenewalResult(
|
||||
False,
|
||||
True,
|
||||
True,
|
||||
str(current["lease_expires_at"]),
|
||||
)
|
||||
raise JobError("LEASE_REVISION_CAS_CONFLICT")
|
||||
connection.commit()
|
||||
return LeaseRenewalResult(True, False, True, lease_expires_at)
|
||||
except JobError:
|
||||
raise
|
||||
except sqlite3.Error as exc:
|
||||
raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
|
||||
|
||||
def advance(self, job_id: str, state: JobState, *, side_effect_state: str, receipt: Mapping[str, Any] | None = None, expected_revision: int | None = None) -> JobReceipt:
|
||||
return self._advance(
|
||||
job_id,
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -964,7 +964,6 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
|
||||
required = {
|
||||
"schema",
|
||||
"task_id",
|
||||
"job_id",
|
||||
"repository",
|
||||
"branch_mode",
|
||||
"base_oid",
|
||||
@@ -977,7 +976,6 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
|
||||
raise ProvisioningError("LEASE_REQUEST_V2_FIELDS_REJECTED", 409)
|
||||
request = WriterLeaseRequestV2(
|
||||
task_id=str(raw["task_id"]),
|
||||
job_id=str(raw["job_id"]),
|
||||
repository=str(raw["repository"]),
|
||||
branch_mode=str(raw["branch_mode"]),
|
||||
base_oid=str(raw["base_oid"]),
|
||||
@@ -990,7 +988,6 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
|
||||
return {
|
||||
"schema": WriterLeaseRequestV2.schema,
|
||||
"task_id": request.task_id,
|
||||
"job_id": request.job_id,
|
||||
"repository": request.repository,
|
||||
"branch_mode": request.branch_mode,
|
||||
"base_oid": request.base_oid,
|
||||
@@ -998,7 +995,7 @@ def validate_writer_lease_request_v2(raw: Mapping[str, Any], probe: Any) -> dict
|
||||
"target_branch": request.target_branch,
|
||||
"generation": request.generation,
|
||||
"lease_seconds": request.lease_seconds,
|
||||
"create_target_branch": request.branch_mode == "CREATE_NEW",
|
||||
"worktree_mode": "detached_at_base_oid" if request.branch_mode == "CREATE_NEW" else "detached_at_expected_head",
|
||||
"create_target_branch": False,
|
||||
"worktree_mode": "detached_at_expected_head",
|
||||
"cas_ref_update_required": True,
|
||||
}
|
||||
|
||||
@@ -1,84 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Single canonical Production Baseline authority for the GitOps reader.
|
||||
|
||||
The API and the one-shot writer import this module. Workspace and release
|
||||
copies are projections only; they are never selected as a fallback source.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
|
||||
|
||||
AUTHORITY_PATH = Path(os.getenv(
|
||||
"AIOS_GITOPS_BASELINE_AUTHORITY",
|
||||
"/var/lib/aios-gitops-runtime-anchor/baseline/current.json",
|
||||
))
|
||||
AUTHORITY_SHA_PATH = AUTHORITY_PATH.with_suffix(".sha256")
|
||||
|
||||
|
||||
class BaselineAuthorityError(RuntimeError):
|
||||
"""Fail-closed error raised for an unavailable or inconsistent authority."""
|
||||
|
||||
|
||||
class BaselineAuthority:
|
||||
def __init__(self, path: Path | str = AUTHORITY_PATH):
|
||||
self.path = Path(path)
|
||||
self.sha_path = self.path.with_suffix(".sha256")
|
||||
|
||||
def _raw(self) -> bytes:
|
||||
try:
|
||||
raw = self.path.read_bytes()
|
||||
except OSError as exc:
|
||||
raise BaselineAuthorityError(f"authority_unavailable:{exc}") from exc
|
||||
if not raw:
|
||||
raise BaselineAuthorityError("authority_empty")
|
||||
return raw
|
||||
|
||||
def read(self) -> dict[str, Any]:
|
||||
raw = self._raw()
|
||||
digest = hashlib.sha256(raw).hexdigest()
|
||||
try:
|
||||
value = json.loads(raw.decode("utf-8"))
|
||||
except (UnicodeDecodeError, json.JSONDecodeError) as exc:
|
||||
raise BaselineAuthorityError("authority_invalid_json") from exc
|
||||
if not isinstance(value, dict):
|
||||
raise BaselineAuthorityError("authority_not_object")
|
||||
expected = str(value.get("authority_sha256", ""))
|
||||
if expected and expected != digest:
|
||||
raise BaselineAuthorityError("authority_embedded_digest_mismatch")
|
||||
if self.sha_path.exists():
|
||||
sidecar = self.sha_path.read_text(encoding="utf-8").strip().split()[0]
|
||||
if sidecar != digest:
|
||||
raise BaselineAuthorityError("authority_sidecar_digest_mismatch")
|
||||
required = {
|
||||
"current_baseline", "previous_baseline", "target_oid", "tag_oid",
|
||||
"evidence_closure_oid", "approval_plan_id", "status", "generation",
|
||||
"source_identity",
|
||||
}
|
||||
missing = sorted(required.difference(value))
|
||||
if missing:
|
||||
raise BaselineAuthorityError("authority_missing:" + ",".join(missing))
|
||||
value = dict(value)
|
||||
value["authority_sha256"] = digest
|
||||
value["authority_path"] = str(self.path)
|
||||
return value
|
||||
|
||||
def read_consistent(self, policy: dict[str, Any] | None = None) -> dict[str, Any]:
|
||||
value = self.read()
|
||||
if policy:
|
||||
expected = policy.get("release_binding", policy)
|
||||
for key, field in (("version", "current_baseline"),
|
||||
("previous_version", "previous_baseline"),
|
||||
("target_oid", "target_oid"),
|
||||
("tag_oid", "tag_oid"),
|
||||
("evidence_closure_oid", "evidence_closure_oid"),
|
||||
("approval_plan_id", "approval_plan_id")):
|
||||
wanted = expected.get(key)
|
||||
if wanted is not None and value.get(field) != wanted:
|
||||
raise BaselineAuthorityError(f"authority_binding_mismatch:{field}")
|
||||
return value
|
||||
|
||||
@@ -1,568 +0,0 @@
|
||||
"""Governed V2R2C1 production release orchestration.
|
||||
|
||||
This module is deliberately scoped to the Owner-approved V2R2C1 binding. It
|
||||
uses the existing TagPublisher and metadata adapters; it does not introduce a
|
||||
second Git writer, a second durable job store, or an alternate baseline.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import fcntl
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
import subprocess
|
||||
import tarfile
|
||||
import tempfile
|
||||
import time
|
||||
from dataclasses import dataclass
|
||||
from pathlib import Path
|
||||
from typing import Any, Mapping
|
||||
|
||||
from gitea_tag_publication import (
|
||||
GiteaTagClient,
|
||||
GitTagBackend,
|
||||
PublicationManualOwnerReviewRequired,
|
||||
PublicationPending,
|
||||
PublicationReconciliationRequired,
|
||||
PublicationRequest,
|
||||
TagPublisher,
|
||||
)
|
||||
|
||||
|
||||
VERSION = "V2R2C1"
|
||||
TARGET_OID = "998d30304787e31e5ae607c0bd86b5edb2b0e5ad"
|
||||
EVIDENCE_CLOSURE_OID = "a8b906d1bc24088c19647e98de6a679268f6d0a2"
|
||||
APPROVAL_PLAN_ID = "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e"
|
||||
REPOSITORY = "aios/aios"
|
||||
SERVICE = "aios-v2r1c7-production.service"
|
||||
PORT = 18927
|
||||
OID_RE = re.compile(r"^[0-9a-f]{40}$")
|
||||
SHA_RE = re.compile(r"^[0-9a-f]{64}$")
|
||||
|
||||
|
||||
class ReleaseBlocked(RuntimeError):
|
||||
"""A release gate failed and no unsafe recovery is permitted."""
|
||||
|
||||
|
||||
class ManualOwnerReviewRequired(ReleaseBlocked):
|
||||
pass
|
||||
|
||||
|
||||
class ReconciliationRequired(ReleaseBlocked):
|
||||
pass
|
||||
|
||||
|
||||
def canonical(value: object) -> bytes:
|
||||
return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode()
|
||||
|
||||
|
||||
def sha256_file(path: Path) -> str:
|
||||
if path.is_symlink() or not path.is_file():
|
||||
raise ReleaseBlocked("artifact must be a regular file")
|
||||
digest = hashlib.sha256()
|
||||
with path.open("rb") as stream:
|
||||
for block in iter(lambda: stream.read(1024 * 1024), b""):
|
||||
digest.update(block)
|
||||
return digest.hexdigest()
|
||||
|
||||
|
||||
def atomic_json(path: Path, value: Mapping[str, Any], mode: int = 0o600) -> None:
|
||||
path.parent.mkdir(parents=True, exist_ok=True)
|
||||
temporary = path.with_name(path.name + ".tmp")
|
||||
temporary.write_bytes(canonical(dict(value)))
|
||||
os.chmod(temporary, mode)
|
||||
os.replace(temporary, path)
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class ReleaseBinding:
|
||||
version: str = VERSION
|
||||
target_oid: str = TARGET_OID
|
||||
evidence_closure_oid: str = EVIDENCE_CLOSURE_OID
|
||||
approval_plan_id: str = APPROVAL_PLAN_ID
|
||||
repository: str = REPOSITORY
|
||||
production_service: str = SERVICE
|
||||
production_port: int = PORT
|
||||
|
||||
def validate(self) -> None:
|
||||
if self.version != VERSION or self.repository != REPOSITORY:
|
||||
raise ManualOwnerReviewRequired("release binding is outside V2R2C1 scope")
|
||||
if not OID_RE.fullmatch(self.target_oid) or self.target_oid != TARGET_OID:
|
||||
raise ManualOwnerReviewRequired("V2R2C1 target_oid mismatch")
|
||||
if not OID_RE.fullmatch(self.evidence_closure_oid) or self.evidence_closure_oid != EVIDENCE_CLOSURE_OID:
|
||||
raise ManualOwnerReviewRequired("V2R2C1 evidence closure mismatch")
|
||||
if self.approval_plan_id != APPROVAL_PLAN_ID:
|
||||
raise ManualOwnerReviewRequired("V2R2C1 approval plan mismatch")
|
||||
if self.production_service != SERVICE or int(self.production_port) != PORT:
|
||||
raise ManualOwnerReviewRequired("production service binding mismatch")
|
||||
|
||||
def as_dict(self) -> dict[str, Any]:
|
||||
return {
|
||||
"version": self.version,
|
||||
"target_oid": self.target_oid,
|
||||
"evidence_closure_oid": self.evidence_closure_oid,
|
||||
"approval_plan_id": self.approval_plan_id,
|
||||
"repository": self.repository,
|
||||
"production_service": self.production_service,
|
||||
"production_port": self.production_port,
|
||||
}
|
||||
|
||||
|
||||
class StateLock:
|
||||
def __init__(self, path: Path):
|
||||
self.path = path
|
||||
self.handle = None
|
||||
|
||||
def __enter__(self) -> "StateLock":
|
||||
self.path.parent.mkdir(parents=True, exist_ok=True)
|
||||
self.handle = self.path.open("a+", encoding="utf-8")
|
||||
fcntl.flock(self.handle.fileno(), fcntl.LOCK_EX)
|
||||
return self
|
||||
|
||||
def __exit__(self, exc_type, exc, tb) -> None:
|
||||
if self.handle is not None:
|
||||
fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
|
||||
self.handle.close()
|
||||
|
||||
|
||||
class ReleaseState:
|
||||
def __init__(self, root: Path, binding: ReleaseBinding):
|
||||
self.root = root
|
||||
self.path = root / "release-state.json"
|
||||
self.binding = binding
|
||||
root.mkdir(parents=True, exist_ok=True)
|
||||
if self.path.exists():
|
||||
value = json.loads(self.path.read_text(encoding="utf-8"))
|
||||
if value.get("binding") != binding.as_dict():
|
||||
raise ManualOwnerReviewRequired("persisted release binding conflict")
|
||||
self.value = value
|
||||
else:
|
||||
self.value = {
|
||||
"schema": "aios.v2r2c1.governed-production-release-state.v1",
|
||||
"binding": binding.as_dict(),
|
||||
"state": "INITIAL",
|
||||
"completed": {},
|
||||
"history": [],
|
||||
}
|
||||
self.save()
|
||||
|
||||
def save(self) -> None:
|
||||
atomic_json(self.path, self.value)
|
||||
|
||||
def record(self, state: str, step: str, result: Mapping[str, Any]) -> None:
|
||||
safe = json.loads(json.dumps(dict(result)))
|
||||
self.value["state"] = state
|
||||
self.value.setdefault("completed", {})[step] = safe
|
||||
self.value.setdefault("history", []).append(
|
||||
{"at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "state": state, "step": step, "result": safe}
|
||||
)
|
||||
self.save()
|
||||
|
||||
def fail(self, state: str, reason: str) -> None:
|
||||
self.value["state"] = state
|
||||
self.value.setdefault("history", []).append(
|
||||
{"at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "state": state, "reason": str(reason)[:500]}
|
||||
)
|
||||
self.save()
|
||||
|
||||
|
||||
def _git(git_dir: Path, *args: str, check: bool = True) -> str:
|
||||
completed = subprocess.run(
|
||||
["git", f"--git-dir={git_dir}", *args],
|
||||
check=False,
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=45,
|
||||
env={"PATH": os.environ.get("PATH", "")},
|
||||
)
|
||||
if check and completed.returncode != 0:
|
||||
raise ReconciliationRequired(completed.stderr.strip() or "authoritative git query failed")
|
||||
return completed.stdout.strip()
|
||||
|
||||
|
||||
def _ancestor(git_dir: Path, ancestor: str, descendant: str) -> bool:
|
||||
return subprocess.run(
|
||||
["git", f"--git-dir={git_dir}", "merge-base", "--is-ancestor", ancestor, descendant],
|
||||
check=False,
|
||||
capture_output=True,
|
||||
timeout=45,
|
||||
env={"PATH": os.environ.get("PATH", "")},
|
||||
).returncode == 0
|
||||
|
||||
|
||||
def verify_lineage(git_dir: Path, binding: ReleaseBinding) -> dict[str, Any]:
|
||||
binding.validate()
|
||||
if _git(git_dir, "cat-file", "-t", binding.target_oid) != "commit":
|
||||
raise ReleaseBlocked("approved target_oid is not a commit")
|
||||
if _git(git_dir, "cat-file", "-t", binding.evidence_closure_oid) != "commit":
|
||||
raise ReleaseBlocked("evidence closure is not a commit")
|
||||
if not _ancestor(git_dir, binding.target_oid, binding.evidence_closure_oid):
|
||||
raise ManualOwnerReviewRequired("approved target is not an ancestor of evidence closure")
|
||||
return {
|
||||
"target_oid": binding.target_oid,
|
||||
"evidence_closure_oid": binding.evidence_closure_oid,
|
||||
"target_is_ancestor_of_evidence": True,
|
||||
"main_oid": _git(git_dir, "rev-parse", "refs/heads/main"),
|
||||
}
|
||||
|
||||
|
||||
def verify_owner_approval(value: Mapping[str, Any], binding: ReleaseBinding) -> dict[str, Any]:
|
||||
approval = value.get("owner_approval")
|
||||
if not isinstance(approval, Mapping):
|
||||
raise ReleaseBlocked("OWNER_APPROVAL_RECEIPT_REQUIRED")
|
||||
if approval.get("approved") is not True or approval.get("status") != "APPROVED":
|
||||
raise ReleaseBlocked("OWNER_APPROVAL_NOT_ACCEPTED")
|
||||
if approval.get("approved_by") != "aiman":
|
||||
raise ManualOwnerReviewRequired("OWNER_APPROVAL_ACTOR_MISMATCH")
|
||||
if approval.get("approval_source") != "explicit_owner_approval_in_chat":
|
||||
raise ManualOwnerReviewRequired("OWNER_APPROVAL_SOURCE_MISMATCH")
|
||||
for key, expected in binding.as_dict().items():
|
||||
if key in {"repository", "production_service", "production_port"}:
|
||||
continue
|
||||
if approval.get(key) != expected:
|
||||
raise ManualOwnerReviewRequired("OWNER_APPROVAL_BINDING_MISMATCH:" + key)
|
||||
return dict(approval)
|
||||
|
||||
|
||||
def _payload_file(git_dir: Path, oid: str, path: str) -> bytes:
|
||||
completed = subprocess.run(
|
||||
["git", f"--git-dir={git_dir}", "show", f"{oid}:{path}"],
|
||||
check=False,
|
||||
capture_output=True,
|
||||
timeout=45,
|
||||
env={"PATH": os.environ.get("PATH", "")},
|
||||
)
|
||||
if completed.returncode != 0:
|
||||
raise ReleaseBlocked("required release source missing:" + path)
|
||||
return completed.stdout
|
||||
|
||||
|
||||
def _commit_epoch(git_dir: Path, oid: str) -> int:
|
||||
return int(_git(git_dir, "show", "-s", "--format=%ct", oid))
|
||||
|
||||
|
||||
def build_production_artifact(
|
||||
git_dir: Path,
|
||||
binding: ReleaseBinding,
|
||||
output_root: Path,
|
||||
) -> dict[str, Any]:
|
||||
"""Build a deterministic executable V2R2C1 health artifact from target_oid."""
|
||||
binding.validate()
|
||||
verify_lineage(git_dir, binding)
|
||||
epoch = _commit_epoch(git_dir, binding.target_oid)
|
||||
output_root.mkdir(parents=True, exist_ok=True)
|
||||
stem = f"aios-{VERSION}-{binding.target_oid[:12]}"
|
||||
output = output_root / (stem + ".tar.zst")
|
||||
with tempfile.TemporaryDirectory(prefix="v2r2c1-artifact-") as temp:
|
||||
root = Path(temp) / "payload"
|
||||
root.mkdir(parents=True)
|
||||
source_paths = {
|
||||
"active-runtime/app/deployment_state.py": "active-runtime/app/deployment_state.py",
|
||||
"active-runtime/app/v2r1c6_privacy_tools.py": "active-runtime/app/v2r1c6_privacy_tools.py",
|
||||
}
|
||||
for destination, source in source_paths.items():
|
||||
target = root / destination
|
||||
target.parent.mkdir(parents=True, exist_ok=True)
|
||||
target.write_bytes(_payload_file(git_dir, binding.target_oid, source))
|
||||
generated: dict[str, str] = {
|
||||
"VERSION": VERSION + "\n",
|
||||
"active-runtime/app/v2r2c1_health_service.py": (
|
||||
"from v2r1c6_privacy_tools import main\n\n"
|
||||
"if __name__ == '__main__':\n raise SystemExit(main())\n"
|
||||
),
|
||||
"deploy/aios-v2/systemd/aios-v2r1c7-production.service": (
|
||||
"[Unit]\nDescription=AIOS V2R2C1 governed health contract service\n"
|
||||
"After=network.target\n\n[Service]\nType=simple\n"
|
||||
"User=aios-v2r1c7\nGroup=aios-v2r1c7\n"
|
||||
"WorkingDirectory=/opt/aios/v2r2c1\n"
|
||||
"EnvironmentFile=/etc/aios/aios-v2r2c1.env\n"
|
||||
"ExecStart=/usr/bin/python3 /opt/aios/v2r2c1/active-runtime/app/v2r2c1_health_service.py --serve --host 127.0.0.1 --port ${AIOS_V2R1C7_PORT}\n"
|
||||
"Restart=on-failure\nRestartSec=5\nNoNewPrivileges=true\nPrivateTmp=true\n"
|
||||
"ProtectHome=true\nProtectSystem=strict\nProtectKernelLogs=true\n"
|
||||
"ProtectKernelModules=true\nProtectKernelTunables=true\nProtectControlGroups=true\n"
|
||||
"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6\nIPAddressDeny=any\n"
|
||||
"IPAddressAllow=localhost\nUMask=0077\n\n[Install]\nWantedBy=multi-user.target\n"
|
||||
),
|
||||
"deploy/aios-v2/v2r2c1-runtime-config.json": json.dumps({
|
||||
"schema": "aios.v2r2c1.production-runtime.v1",
|
||||
"version": VERSION,
|
||||
"target_oid": binding.target_oid,
|
||||
"service": SERVICE,
|
||||
"port": PORT,
|
||||
"health_path": "/health",
|
||||
"deployment_state_source": "environment_and_state_file",
|
||||
}, sort_keys=True, separators=(",", ":")) + "\n",
|
||||
"deploy/aios-v2/v2r2c1-rollback.json": json.dumps({
|
||||
"schema": "aios.v2r2c1.rollback-metadata.v1",
|
||||
"rollback_version": "V2R1C7",
|
||||
"rollback_service": SERVICE,
|
||||
"rollback_target_is_previous_production": True,
|
||||
"automatic_rollback": False,
|
||||
}, sort_keys=True, separators=(",", ":")) + "\n",
|
||||
"scripts/probe_v2r2c1_health.py": (
|
||||
"import json,sys,urllib.request\n"
|
||||
"url=sys.argv[1] if len(sys.argv)>1 else 'http://127.0.0.1:18927/health'\n"
|
||||
"with urllib.request.urlopen(url, timeout=5) as r: print(json.dumps(json.load(r), sort_keys=True))\n"
|
||||
),
|
||||
"scripts/rollback_v2r2c1_release.sh": "#!/bin/sh\nset -eu\nprintf '%s\\n' 'rollback requires governed owner-approved executor'\nexit 2\n",
|
||||
"release-manifests/V2R2C1.json": json.dumps({
|
||||
"schema": "aios.release-source.v2",
|
||||
"version": VERSION,
|
||||
"repository": REPOSITORY,
|
||||
"target_oid": binding.target_oid,
|
||||
"evidence_closure_oid": binding.evidence_closure_oid,
|
||||
"production_deployed": False,
|
||||
"deployment_state": "STAGING",
|
||||
"artifact_kind": "executable-production-health",
|
||||
}, sort_keys=True, separators=(",", ":")) + "\n",
|
||||
}
|
||||
for rel, text in generated.items():
|
||||
target = root / rel
|
||||
target.parent.mkdir(parents=True, exist_ok=True)
|
||||
target.write_text(text, encoding="utf-8")
|
||||
if rel.startswith("scripts/"):
|
||||
target.chmod(0o755)
|
||||
metadata = {
|
||||
"schema": "aios.release-artifact-build.v3",
|
||||
"version": VERSION,
|
||||
"repository": REPOSITORY,
|
||||
"source_head_oid": binding.target_oid,
|
||||
"evidence_closure_oid": binding.evidence_closure_oid,
|
||||
"source_date_epoch": epoch,
|
||||
"clean_source": True,
|
||||
"executable_payload": True,
|
||||
"production_deployed": False,
|
||||
"tag_created": False,
|
||||
"baseline_changed": False,
|
||||
"secrets_included": False,
|
||||
}
|
||||
(root / "BUILD-METADATA.json").write_bytes(canonical(metadata))
|
||||
(root / "ROLLBACK-METADATA.json").write_bytes(canonical(json.loads((root / "deploy/aios-v2/v2r2c1-rollback.json").read_text(encoding="utf-8"))))
|
||||
names = sorted("payload/" + str(path.relative_to(root)).replace(os.sep, "/") for path in root.rglob("*") if path.is_file())
|
||||
(root / "ARTIFACT-MANIFEST.json").write_bytes(canonical({
|
||||
"schema": "aios.release-artifact-manifest.v3",
|
||||
"version": VERSION,
|
||||
"source_head_oid": binding.target_oid,
|
||||
"evidence_closure_oid": binding.evidence_closure_oid,
|
||||
"repository": REPOSITORY,
|
||||
"files": names + ["payload/ARTIFACT-MANIFEST.json"],
|
||||
"deployable": True,
|
||||
"executable_payload": True,
|
||||
"production_deployed": False,
|
||||
"tag_created": False,
|
||||
"baseline_changed": False,
|
||||
}))
|
||||
tar_path = Path(temp) / "release.tar"
|
||||
with tarfile.open(tar_path, "w") as archive:
|
||||
for path in sorted(root.rglob("*")):
|
||||
relative = str(path.relative_to(root)).replace(os.sep, "/")
|
||||
info = archive.gettarinfo(str(path), arcname="payload/" + relative)
|
||||
info.uid = info.gid = 0
|
||||
info.uname = "root"
|
||||
info.gname = "root"
|
||||
info.mtime = epoch
|
||||
info.mode = 0o755 if path.is_dir() or path.suffix == ".sh" else 0o644
|
||||
if path.is_file():
|
||||
with path.open("rb") as stream:
|
||||
archive.addfile(info, stream)
|
||||
else:
|
||||
archive.addfile(info)
|
||||
subprocess.run(["zstd", "-T1", "-19", "--no-progress", "-q", "-f", str(tar_path), "-o", str(output)], check=True, timeout=120)
|
||||
digest = sha256_file(output)
|
||||
receipt = {
|
||||
"schema": "aios.release-artifact-receipt.v3",
|
||||
"version": VERSION,
|
||||
"repository": REPOSITORY,
|
||||
"source_head_oid": binding.target_oid,
|
||||
"evidence_closure_oid": binding.evidence_closure_oid,
|
||||
"artifact": str(output),
|
||||
"artifact_sha256": digest,
|
||||
"artifact_size": output.stat().st_size,
|
||||
"deployable": True,
|
||||
"executable_payload": True,
|
||||
"production_deployed": False,
|
||||
"tag_created": False,
|
||||
"baseline_changed": False,
|
||||
}
|
||||
atomic_json(output.with_suffix(output.suffix + ".receipt.json"), receipt, mode=0o640)
|
||||
return receipt
|
||||
|
||||
|
||||
class GovernedProductionReleaseExecutor:
|
||||
def __init__(self, config: Any):
|
||||
self.config = config
|
||||
self.binding = ReleaseBinding()
|
||||
self.binding.validate()
|
||||
self.root = Path(config.state_root) / "v2r2c1-governed-production-release"
|
||||
self.state = ReleaseState(self.root, self.binding)
|
||||
workspace = self.root / "publication-workspace"
|
||||
workspace.mkdir(parents=True, exist_ok=True)
|
||||
self.publisher = TagPublisher(
|
||||
workspace,
|
||||
GitTagBackend(workspace, authoritative_repo=Path(config.authoritative_git_dir)),
|
||||
GiteaTagClient(config.api_base, REPOSITORY, Path(config.token_path)),
|
||||
config.remote_name,
|
||||
state_root=self.root / "tag-publication",
|
||||
)
|
||||
|
||||
def _request(self, request: Mapping[str, Any]) -> PublicationRequest:
|
||||
binding = self.binding
|
||||
for key, expected in binding.as_dict().items():
|
||||
if key in request and request[key] != expected:
|
||||
raise ManualOwnerReviewRequired("release request binding mismatch:" + key)
|
||||
return PublicationRequest(binding.version, binding.target_oid, binding.evidence_closure_oid, binding.approval_plan_id)
|
||||
|
||||
def approval_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
||||
if request.get("execute") is not False:
|
||||
raise ReleaseBlocked("TAG_APPROVAL_REQUEST_MUST_BE_DRY_RUN")
|
||||
owner = verify_owner_approval(request, self.binding)
|
||||
with StateLock(self.root / "release.lock"):
|
||||
current = self.state.value.get("approval")
|
||||
approval_digest = hashlib.sha256(canonical(owner)).hexdigest()
|
||||
record = {
|
||||
"schema": "aios.v2r2c1.tag-approval-request.v1",
|
||||
"binding": self.binding.as_dict(),
|
||||
"owner_approval": owner,
|
||||
"owner_approval_digest_sha256": approval_digest,
|
||||
"execute": False,
|
||||
"recorded_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
|
||||
}
|
||||
if current and current != record:
|
||||
raise ManualOwnerReviewRequired("persisted Owner approval differs")
|
||||
self.state.value["approval"] = record
|
||||
self.state.record("APPROVAL_REQUEST_RECORDED", "tag_approval_request", record)
|
||||
return {"status": "RECORDED", "execute": False, "binding": self.binding.as_dict(), "owner_approval_digest_sha256": approval_digest}
|
||||
|
||||
def _require_approval(self) -> None:
|
||||
approval = self.state.value.get("approval")
|
||||
if not isinstance(approval, Mapping) or approval.get("binding") != self.binding.as_dict():
|
||||
raise ReleaseBlocked("OWNER_APPROVAL_REQUEST_NOT_RECORDED")
|
||||
|
||||
def publish_tag(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
||||
if request.get("execute") is not True:
|
||||
raise ReleaseBlocked("TAG_PUBLICATION_REQUIRES_EXECUTE_TRUE")
|
||||
self._require_approval()
|
||||
publication = self._request(request)
|
||||
with StateLock(self.root / "release.lock"):
|
||||
try:
|
||||
verified = self.publisher._verify_publication(publication, allow_push=True, previously_deployed=False)
|
||||
except PublicationManualOwnerReviewRequired as exc:
|
||||
self.state.fail("MANUAL_OWNER_REVIEW_REQUIRED", str(exc))
|
||||
raise ManualOwnerReviewRequired(str(exc)) from exc
|
||||
except PublicationPending as exc:
|
||||
self.state.fail("REMOTE_PUSH_PENDING", str(exc))
|
||||
raise ReconciliationRequired(str(exc)) from exc
|
||||
except PublicationReconciliationRequired as exc:
|
||||
self.state.fail("RECONCILIATION_REQUIRED", str(exc))
|
||||
raise ReconciliationRequired(str(exc)) from exc
|
||||
result = dict(verified)
|
||||
self.state.record("TAG_VERIFIED", "tag", result)
|
||||
return {"status": "REMOTE_VERIFIED", **result}
|
||||
|
||||
def tag_status(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
||||
self._request(request)
|
||||
return self.publisher.get_tag_publication_status(VERSION)
|
||||
|
||||
def build_artifact(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
||||
self._require_approval()
|
||||
self._request(request)
|
||||
receipt = build_production_artifact(Path(self.config.authoritative_git_dir), self.binding, self.root / "artifacts")
|
||||
self.state.record("ARTIFACT_VERIFIED", "production_artifact", receipt)
|
||||
return {"status": "VERIFIED", **receipt}
|
||||
|
||||
def execute_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
||||
self._require_approval()
|
||||
publication = self._request(request)
|
||||
tag_state = self.state.value.get("completed", {}).get("tag")
|
||||
if not isinstance(tag_state, Mapping) or tag_state.get("state") not in {"GITEA_API_CONFIRMED", "REMOTE_VERIFIED"}:
|
||||
raise ReleaseBlocked("REMOTE_TAG_PROOF_REQUIRED")
|
||||
artifact = self.state.value.get("completed", {}).get("production_artifact")
|
||||
if not isinstance(artifact, Mapping):
|
||||
artifact = self.build_artifact(request)
|
||||
value = {
|
||||
**self.binding.as_dict(),
|
||||
"tag_oid": tag_state.get("tag_oid") or tag_state.get("gitea_tag_oid"),
|
||||
"artifact_path": artifact["artifact"],
|
||||
"artifact_size": int(artifact["artifact_size"]),
|
||||
"artifact_sha256": artifact["artifact_sha256"],
|
||||
}
|
||||
# The production adapter is privileged and is run through the root
|
||||
# approved-release service boundary by the caller. This handler is
|
||||
# still useful for a root-owned staging invocation and remains
|
||||
# fail-closed when the adapter is not available.
|
||||
import v2r2c1_production_adapter
|
||||
runtime = v2r2c1_production_adapter.execute_request({"schema": "aios.production-executor-request.v1", "operation": "apply", **value})
|
||||
if runtime.get("status") != "ACTIVE_VERIFIED":
|
||||
self.state.fail("RECONCILIATION_REQUIRED", "production health did not verify")
|
||||
raise ReconciliationRequired("production health did not verify")
|
||||
self.state.record("PRODUCTION_VERIFIED", "production", runtime)
|
||||
return {"status": "PRODUCTION_VERIFIED", "runtime": runtime, "artifact": artifact, "tag_oid": value["tag_oid"]}
|
||||
|
||||
def consistency(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
||||
publication = self._request(request)
|
||||
result = self.publisher.get_release_consistency(publication)
|
||||
result["release_binding"] = self.binding.as_dict()
|
||||
result["production_health"] = _health(self.config.health_url, self.binding, self.state.value.get("completed", {}).get("production_artifact", {}))
|
||||
result["registry"] = _read_json(Path(self.config.registry_root) / f"{VERSION}.json")
|
||||
result["baseline"] = _read_json(Path(self.config.baseline_path))
|
||||
return result
|
||||
|
||||
def acceptance(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
||||
result = self.consistency(request)
|
||||
result["accepted"] = result.get("status") == "PASS" and result.get("production_health", {}).get("status") == "ACTIVE_VERIFIED"
|
||||
self.state.record("ACCEPTED" if result["accepted"] else "RECONCILIATION_REQUIRED", "acceptance", result)
|
||||
return result
|
||||
|
||||
|
||||
def _read_json(path: Path) -> dict[str, Any]:
|
||||
try:
|
||||
value = json.loads(path.read_text(encoding="utf-8"))
|
||||
except FileNotFoundError:
|
||||
return {"status": "MISSING", "path": str(path)}
|
||||
if not isinstance(value, dict):
|
||||
return {"status": "INVALID", "path": str(path)}
|
||||
return {"status": "PRESENT", "path": str(path), **value}
|
||||
|
||||
|
||||
def _health(url: str, binding: ReleaseBinding, artifact: Mapping[str, Any]) -> dict[str, Any]:
|
||||
import urllib.request
|
||||
try:
|
||||
with urllib.request.urlopen(url, timeout=5) as response:
|
||||
body = json.loads(response.read().decode("utf-8"))
|
||||
status = response.status
|
||||
except Exception as exc:
|
||||
return {"status": "UNAVAILABLE", "error": type(exc).__name__}
|
||||
expected_artifact = artifact.get("artifact_sha256")
|
||||
exact = (
|
||||
status == 200
|
||||
and body.get("version") == binding.version
|
||||
and body.get("commit_oid") == binding.target_oid
|
||||
and (not expected_artifact or body.get("artifact_sha256") == expected_artifact)
|
||||
and body.get("deployment_state") == "ACTIVE"
|
||||
and body.get("production_deployed") is True
|
||||
)
|
||||
return {"status": "ACTIVE_VERIFIED" if exact else "CONFLICT", "http_status": status, **body}
|
||||
|
||||
|
||||
def build_executor_config(config: Any) -> GovernedProductionReleaseExecutor:
|
||||
return GovernedProductionReleaseExecutor(config)
|
||||
|
||||
|
||||
def main() -> int:
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("operation", choices=("build-artifact", "status"))
|
||||
parser.add_argument("--git-dir", type=Path, default=Path("/data/aios-gitops/repo.git"))
|
||||
parser.add_argument("--output-root", type=Path, default=Path("/var/lib/aios-gitops/approved-artifacts/V2R2C1"))
|
||||
args = parser.parse_args()
|
||||
binding = ReleaseBinding()
|
||||
if args.operation == "build-artifact":
|
||||
print(json.dumps(build_production_artifact(args.git_dir, binding, args.output_root), sort_keys=True))
|
||||
else:
|
||||
print(json.dumps({"binding": binding.as_dict(), "status": "READY"}, sort_keys=True))
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
@@ -1,413 +0,0 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import dataclasses
|
||||
import datetime as dt
|
||||
import hashlib
|
||||
import json
|
||||
import sqlite3
|
||||
from pathlib import Path
|
||||
from typing import Any, Iterable, Mapping
|
||||
|
||||
UTC = dt.timezone.utc
|
||||
_ALLOWED_CONFIDENTIALITY = frozenset({"public", "tenant", "project", "private", "run"})
|
||||
_PRIVILEGED = frozenset({"*", "admin", "system.admin", "message.admin", "task.admin"})
|
||||
|
||||
|
||||
class HandoffError(RuntimeError):
|
||||
code = "HANDOFF_ERROR"
|
||||
|
||||
|
||||
class MessageScopeMismatch(HandoffError):
|
||||
code = "MESSAGE_SCOPE_MISMATCH_DENY"
|
||||
|
||||
|
||||
class ConfidentialityScopeDenied(HandoffError):
|
||||
code = "MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"
|
||||
|
||||
|
||||
class MessageExpired(HandoffError):
|
||||
code = "MESSAGE_EXPIRED"
|
||||
|
||||
|
||||
class SequenceGap(HandoffError):
|
||||
code = "MESSAGE_SEQUENCE_GAP_DETECT"
|
||||
|
||||
|
||||
class SequenceConflict(HandoffError):
|
||||
code = "MESSAGE_SEQUENCE_CONFLICT"
|
||||
|
||||
|
||||
class IdempotencyConflict(HandoffError):
|
||||
code = "MESSAGE_IDEMPOTENCY_CONFLICT"
|
||||
|
||||
|
||||
def _utcnow() -> dt.datetime:
|
||||
return dt.datetime.now(UTC)
|
||||
|
||||
|
||||
def _iso(value: dt.datetime | str | None) -> str | None:
|
||||
if value is None:
|
||||
return None
|
||||
parsed = dt.datetime.fromisoformat(value.replace("Z", "+00:00")) if isinstance(value, str) else value
|
||||
if parsed.tzinfo is None:
|
||||
parsed = parsed.replace(tzinfo=UTC)
|
||||
return parsed.astimezone(UTC).isoformat()
|
||||
|
||||
|
||||
def _canonical(value: Any) -> str:
|
||||
return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str)
|
||||
|
||||
|
||||
def _sha(value: Any) -> str:
|
||||
return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
|
||||
|
||||
|
||||
def _clean(value: Any) -> str | None:
|
||||
if value is None:
|
||||
return None
|
||||
text = str(value).strip()
|
||||
return text or None
|
||||
|
||||
|
||||
def _tuple_scope(value: Iterable[str] | str | None) -> tuple[str, ...]:
|
||||
if value is None:
|
||||
return ()
|
||||
if isinstance(value, str):
|
||||
value = value.split(",")
|
||||
return tuple(sorted({str(item).strip() for item in value if str(item).strip()}))
|
||||
|
||||
|
||||
@dataclasses.dataclass(frozen=True)
|
||||
class DeliveryContext:
|
||||
tenant_id: str | None = None
|
||||
user_id: str | None = None
|
||||
project_id: str | None = None
|
||||
conversation_id: str | None = None
|
||||
run_id: str | None = None
|
||||
capabilities: tuple[str, ...] = ()
|
||||
|
||||
@classmethod
|
||||
def from_actor(cls, actor: Any) -> "DeliveryContext":
|
||||
def get(name: str) -> Any:
|
||||
if isinstance(actor, Mapping):
|
||||
return actor.get(name)
|
||||
return getattr(actor, name, None)
|
||||
return cls(
|
||||
tenant_id=_clean(get("tenant_id")),
|
||||
user_id=_clean(get("user_id")),
|
||||
project_id=_clean(get("project_id")),
|
||||
conversation_id=_clean(get("conversation_id")),
|
||||
run_id=_clean(get("run_id")),
|
||||
capabilities=_tuple_scope(get("capabilities") or get("capability_scope")),
|
||||
)
|
||||
|
||||
@property
|
||||
def privileged(self) -> bool:
|
||||
return bool(set(self.capabilities) & _PRIVILEGED)
|
||||
|
||||
|
||||
@dataclasses.dataclass(frozen=True)
|
||||
class MessageEnvelope:
|
||||
source: str
|
||||
target: str
|
||||
message_type: str
|
||||
payload: Mapping[str, Any]
|
||||
sequence: int
|
||||
idempotency_key: str
|
||||
tenant_id: str | None = None
|
||||
user_id: str | None = None
|
||||
project_id: str | None = None
|
||||
conversation_id: str | None = None
|
||||
task_id: str | None = None
|
||||
run_id: str | None = None
|
||||
causation_id: str | None = None
|
||||
capability_scope: tuple[str, ...] = ()
|
||||
confidentiality_scope: str = "private"
|
||||
expires_at: str | None = None
|
||||
created_at: str = dataclasses.field(default_factory=lambda: _iso(_utcnow()) or "")
|
||||
envelope_id: str = ""
|
||||
|
||||
def __post_init__(self) -> None:
|
||||
for field in ("source", "target", "message_type", "idempotency_key", "tenant_id", "user_id",
|
||||
"project_id", "conversation_id", "task_id", "run_id", "causation_id"):
|
||||
object.__setattr__(self, field, _clean(getattr(self, field)) if field not in {
|
||||
"source", "target", "message_type", "idempotency_key"
|
||||
} else (_clean(getattr(self, field)) or ""))
|
||||
object.__setattr__(self, "capability_scope", _tuple_scope(self.capability_scope))
|
||||
object.__setattr__(self, "confidentiality_scope", (_clean(self.confidentiality_scope) or "private").lower())
|
||||
object.__setattr__(self, "expires_at", _iso(self.expires_at))
|
||||
object.__setattr__(self, "created_at", _iso(self.created_at) or "")
|
||||
if not self.source or not self.target or not self.message_type or not self.idempotency_key:
|
||||
raise ValueError("MESSAGE_ENVELOPE_IDENTITY_REQUIRED")
|
||||
if not isinstance(self.sequence, int) or self.sequence < 1:
|
||||
raise ValueError("MESSAGE_SEQUENCE_MUST_BE_POSITIVE")
|
||||
if self.confidentiality_scope not in _ALLOWED_CONFIDENTIALITY:
|
||||
raise ValueError("MESSAGE_CONFIDENTIALITY_SCOPE_INVALID")
|
||||
if self.confidentiality_scope != "public" and self.tenant_id is None:
|
||||
raise ValueError("MESSAGE_TENANT_REQUIRED")
|
||||
if self.confidentiality_scope in {"project", "private", "run"} and self.project_id is None:
|
||||
raise ValueError("MESSAGE_PROJECT_REQUIRED")
|
||||
if self.confidentiality_scope in {"private", "run"} and self.user_id is None:
|
||||
raise ValueError("MESSAGE_USER_REQUIRED")
|
||||
if self.confidentiality_scope == "run" and self.run_id is None:
|
||||
raise ValueError("MESSAGE_RUN_REQUIRED")
|
||||
expected = stable_event_id(
|
||||
source=self.source, target=self.target, message_type=self.message_type, payload=self.payload,
|
||||
tenant_id=self.tenant_id, user_id=self.user_id, project_id=self.project_id,
|
||||
conversation_id=self.conversation_id, task_id=self.task_id, run_id=self.run_id,
|
||||
causation_id=self.causation_id, sequence=self.sequence, idempotency_key=self.idempotency_key,
|
||||
)
|
||||
if self.envelope_id and self.envelope_id != expected:
|
||||
raise ValueError("MESSAGE_ENVELOPE_ID_MISMATCH")
|
||||
object.__setattr__(self, "envelope_id", expected)
|
||||
|
||||
@property
|
||||
def payload_sha256(self) -> str:
|
||||
return _sha(self.payload)
|
||||
|
||||
@property
|
||||
def stream_key(self) -> str:
|
||||
return _sha({
|
||||
"tenant_id": self.tenant_id, "source": self.source, "target": self.target,
|
||||
"conversation_id": self.conversation_id, "task_id": self.task_id, "run_id": self.run_id,
|
||||
})
|
||||
|
||||
def is_expired(self, *, now: dt.datetime | None = None) -> bool:
|
||||
if self.expires_at is None:
|
||||
return False
|
||||
return dt.datetime.fromisoformat(self.expires_at) <= (now or _utcnow()).astimezone(UTC)
|
||||
|
||||
def as_record(self) -> dict[str, Any]:
|
||||
return {
|
||||
"envelope_id": self.envelope_id, "stream_key": self.stream_key, "source": self.source,
|
||||
"target": self.target, "message_type": self.message_type, "payload_json": _canonical(self.payload),
|
||||
"payload_sha256": self.payload_sha256, "tenant_id": self.tenant_id, "user_id": self.user_id,
|
||||
"project_id": self.project_id, "conversation_id": self.conversation_id, "task_id": self.task_id,
|
||||
"run_id": self.run_id, "causation_id": self.causation_id, "sequence": self.sequence,
|
||||
"capability_scope_json": _canonical(self.capability_scope),
|
||||
"confidentiality_scope": self.confidentiality_scope, "idempotency_key": self.idempotency_key,
|
||||
"expires_at": self.expires_at, "created_at": self.created_at,
|
||||
}
|
||||
|
||||
|
||||
def stable_event_id(*, source: Any, target: Any, message_type: Any, payload: Any,
|
||||
tenant_id: Any = None, user_id: Any = None, project_id: Any = None,
|
||||
conversation_id: Any = None, task_id: Any = None, run_id: Any = None,
|
||||
causation_id: Any = None, sequence: Any = None, idempotency_key: Any = None) -> str:
|
||||
return _sha({
|
||||
"source": _clean(source), "target": _clean(target), "message_type": _clean(message_type),
|
||||
"payload_sha256": _sha(payload), "tenant_id": _clean(tenant_id), "user_id": _clean(user_id),
|
||||
"project_id": _clean(project_id), "conversation_id": _clean(conversation_id),
|
||||
"task_id": _clean(task_id), "run_id": _clean(run_id), "causation_id": _clean(causation_id),
|
||||
"sequence": sequence, "idempotency_key": _clean(idempotency_key),
|
||||
})
|
||||
|
||||
|
||||
def bind_envelope_scope(envelope: MessageEnvelope, actor: Any) -> MessageEnvelope:
|
||||
ctx = DeliveryContext.from_actor(actor)
|
||||
if ctx.privileged:
|
||||
return envelope
|
||||
if ctx.tenant_id is None:
|
||||
if envelope.tenant_id is not None:
|
||||
raise MessageScopeMismatch(MessageScopeMismatch.code)
|
||||
return envelope
|
||||
updates: dict[str, Any] = {}
|
||||
for field in ("tenant_id", "user_id", "project_id", "conversation_id", "run_id"):
|
||||
trusted = getattr(ctx, field)
|
||||
requested = getattr(envelope, field)
|
||||
if requested is not None and requested != trusted:
|
||||
raise MessageScopeMismatch(f"{MessageScopeMismatch.code}:{field}")
|
||||
if requested is None and trusted is not None:
|
||||
updates[field] = trusted
|
||||
if not updates:
|
||||
return envelope
|
||||
data = dataclasses.asdict(envelope)
|
||||
data.update(updates)
|
||||
data["envelope_id"] = ""
|
||||
return MessageEnvelope(**data)
|
||||
|
||||
|
||||
def authorize_delivery(actor: Any, envelope: MessageEnvelope) -> None:
|
||||
ctx = DeliveryContext.from_actor(actor)
|
||||
if ctx.privileged:
|
||||
return
|
||||
if not set(envelope.capability_scope).issubset(set(ctx.capabilities)):
|
||||
raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:capability")
|
||||
if envelope.confidentiality_scope == "public":
|
||||
return
|
||||
if ctx.tenant_id != envelope.tenant_id:
|
||||
raise MessageScopeMismatch(f"{MessageScopeMismatch.code}:tenant_id")
|
||||
if envelope.confidentiality_scope in {"project", "private", "run"} and ctx.project_id != envelope.project_id:
|
||||
raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:project_id")
|
||||
if envelope.confidentiality_scope in {"private", "run"} and ctx.user_id != envelope.user_id:
|
||||
raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:user_id")
|
||||
if envelope.confidentiality_scope == "run" and ctx.run_id != envelope.run_id:
|
||||
raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:run_id")
|
||||
|
||||
|
||||
_SCHEMA = """
|
||||
CREATE TABLE IF NOT EXISTS message_handoff (
|
||||
envelope_id TEXT PRIMARY KEY,
|
||||
stream_key TEXT NOT NULL,
|
||||
source TEXT NOT NULL,
|
||||
target TEXT NOT NULL,
|
||||
message_type TEXT NOT NULL,
|
||||
payload_json TEXT NOT NULL,
|
||||
payload_sha256 TEXT NOT NULL,
|
||||
tenant_id TEXT,
|
||||
user_id TEXT,
|
||||
project_id TEXT,
|
||||
conversation_id TEXT,
|
||||
task_id TEXT,
|
||||
run_id TEXT,
|
||||
causation_id TEXT,
|
||||
sequence INTEGER NOT NULL CHECK(sequence >= 1),
|
||||
capability_scope_json TEXT NOT NULL,
|
||||
confidentiality_scope TEXT NOT NULL,
|
||||
idempotency_key TEXT NOT NULL,
|
||||
expires_at TEXT,
|
||||
created_at TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'PENDING',
|
||||
delivered_at TEXT,
|
||||
acked_at TEXT,
|
||||
UNIQUE(stream_key, idempotency_key),
|
||||
UNIQUE(stream_key, sequence)
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS idx_message_handoff_target_status
|
||||
ON message_handoff(target, status, created_at);
|
||||
CREATE INDEX IF NOT EXISTS idx_message_handoff_scope
|
||||
ON message_handoff(tenant_id, project_id, user_id, conversation_id, run_id);
|
||||
"""
|
||||
|
||||
|
||||
class DurableHandoffStore:
|
||||
def __init__(self, path: str | Path) -> None:
|
||||
self.path = Path(path)
|
||||
self.path.parent.mkdir(parents=True, exist_ok=True)
|
||||
with self._connect() as conn:
|
||||
conn.executescript(_SCHEMA)
|
||||
|
||||
def _connect(self) -> sqlite3.Connection:
|
||||
conn = sqlite3.connect(self.path, timeout=30.0)
|
||||
conn.row_factory = sqlite3.Row
|
||||
conn.execute("PRAGMA foreign_keys=ON")
|
||||
conn.execute("PRAGMA busy_timeout=30000")
|
||||
return conn
|
||||
|
||||
@staticmethod
|
||||
def _from_row(row: sqlite3.Row) -> MessageEnvelope:
|
||||
return MessageEnvelope(
|
||||
source=row["source"], target=row["target"], message_type=row["message_type"],
|
||||
payload=json.loads(row["payload_json"]), tenant_id=row["tenant_id"], user_id=row["user_id"],
|
||||
project_id=row["project_id"], conversation_id=row["conversation_id"], task_id=row["task_id"],
|
||||
run_id=row["run_id"], causation_id=row["causation_id"], sequence=int(row["sequence"]),
|
||||
capability_scope=tuple(json.loads(row["capability_scope_json"])),
|
||||
confidentiality_scope=row["confidentiality_scope"], idempotency_key=row["idempotency_key"],
|
||||
expires_at=row["expires_at"], created_at=row["created_at"], envelope_id=row["envelope_id"],
|
||||
)
|
||||
|
||||
def put(self, envelope: MessageEnvelope) -> tuple[str, MessageEnvelope]:
|
||||
if envelope.is_expired():
|
||||
raise MessageExpired(MessageExpired.code)
|
||||
record = envelope.as_record()
|
||||
with self._connect() as conn:
|
||||
conn.execute("BEGIN IMMEDIATE")
|
||||
replay = conn.execute(
|
||||
"SELECT * FROM message_handoff WHERE stream_key=? AND idempotency_key=?",
|
||||
(envelope.stream_key, envelope.idempotency_key),
|
||||
).fetchone()
|
||||
if replay is not None:
|
||||
existing = self._from_row(replay)
|
||||
if existing.envelope_id != envelope.envelope_id or existing.payload_sha256 != envelope.payload_sha256:
|
||||
raise IdempotencyConflict(IdempotencyConflict.code)
|
||||
conn.commit()
|
||||
return "REPLAY", existing
|
||||
seq = conn.execute(
|
||||
"SELECT * FROM message_handoff WHERE stream_key=? AND sequence=?",
|
||||
(envelope.stream_key, envelope.sequence),
|
||||
).fetchone()
|
||||
if seq is not None:
|
||||
existing = self._from_row(seq)
|
||||
if existing.envelope_id == envelope.envelope_id:
|
||||
conn.commit()
|
||||
return "REPLAY", existing
|
||||
raise SequenceConflict(SequenceConflict.code)
|
||||
maximum = int(conn.execute(
|
||||
"SELECT COALESCE(MAX(sequence),0) FROM message_handoff WHERE stream_key=?",
|
||||
(envelope.stream_key,),
|
||||
).fetchone()[0])
|
||||
expected = maximum + 1
|
||||
if envelope.sequence != expected:
|
||||
raise SequenceGap(f"{SequenceGap.code}:expected={expected}:actual={envelope.sequence}")
|
||||
columns = tuple(record)
|
||||
placeholders = ",".join("?" for _ in columns)
|
||||
conn.execute(
|
||||
f"INSERT INTO message_handoff ({','.join(columns)}) VALUES ({placeholders})",
|
||||
tuple(record[column] for column in columns),
|
||||
)
|
||||
conn.commit()
|
||||
return "CREATED", envelope
|
||||
|
||||
def get(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
|
||||
with self._connect() as conn:
|
||||
row = conn.execute("SELECT * FROM message_handoff WHERE envelope_id=?", (envelope_id,)).fetchone()
|
||||
if row is None:
|
||||
raise KeyError(envelope_id)
|
||||
envelope = self._from_row(row)
|
||||
if envelope.is_expired():
|
||||
conn.execute("UPDATE message_handoff SET status='EXPIRED' WHERE envelope_id=?", (envelope_id,))
|
||||
conn.commit()
|
||||
raise MessageExpired(MessageExpired.code)
|
||||
authorize_delivery(actor, envelope)
|
||||
return envelope
|
||||
|
||||
def pending(self, *, target: str, actor: Any, limit: int = 100) -> list[MessageEnvelope]:
|
||||
if not 1 <= limit <= 1000:
|
||||
raise ValueError("MESSAGE_PENDING_LIMIT_INVALID")
|
||||
visible: list[MessageEnvelope] = []
|
||||
with self._connect() as conn:
|
||||
rows = conn.execute(
|
||||
"SELECT * FROM message_handoff WHERE target=? AND status='PENDING' ORDER BY created_at, sequence LIMIT ?",
|
||||
(target, limit),
|
||||
).fetchall()
|
||||
for row in rows:
|
||||
envelope = self._from_row(row)
|
||||
if envelope.is_expired():
|
||||
conn.execute("UPDATE message_handoff SET status='EXPIRED' WHERE envelope_id=?", (envelope.envelope_id,))
|
||||
continue
|
||||
try:
|
||||
authorize_delivery(actor, envelope)
|
||||
except HandoffError:
|
||||
continue
|
||||
visible.append(envelope)
|
||||
conn.commit()
|
||||
return visible
|
||||
|
||||
def mark_delivered(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
|
||||
envelope = self.get(envelope_id, actor=actor)
|
||||
with self._connect() as conn:
|
||||
conn.execute(
|
||||
"UPDATE message_handoff SET status='DELIVERED', delivered_at=? "
|
||||
"WHERE envelope_id=? AND status='PENDING'",
|
||||
(_iso(_utcnow()), envelope_id),
|
||||
)
|
||||
conn.commit()
|
||||
return envelope
|
||||
|
||||
def acknowledge(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
|
||||
envelope = self.get(envelope_id, actor=actor)
|
||||
with self._connect() as conn:
|
||||
conn.execute(
|
||||
"UPDATE message_handoff SET status='ACKED', acked_at=? WHERE envelope_id=?",
|
||||
(_iso(_utcnow()), envelope_id),
|
||||
)
|
||||
conn.commit()
|
||||
return envelope
|
||||
|
||||
|
||||
class HandoffFabric:
|
||||
def __init__(self, store: DurableHandoffStore) -> None:
|
||||
self.store = store
|
||||
|
||||
def publish(self, envelope: MessageEnvelope, *, actor: Any | None = None) -> tuple[str, MessageEnvelope]:
|
||||
return self.store.put(bind_envelope_scope(envelope, actor) if actor is not None else envelope)
|
||||
@@ -1,68 +0,0 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from typing import Any, Mapping
|
||||
|
||||
from message_handoff import MessageEnvelope
|
||||
|
||||
|
||||
def _get(value: Any, *names: str, default: Any = None) -> Any:
|
||||
for name in names:
|
||||
if isinstance(value, Mapping) and name in value:
|
||||
return value[name]
|
||||
if hasattr(value, name):
|
||||
return getattr(value, name)
|
||||
return default
|
||||
|
||||
|
||||
def agent_event_to_envelope(event: Any, *, target: str | None = None, sequence: int = 1,
|
||||
idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
|
||||
payload = _get(event, "payload", "data", default={}) or {}
|
||||
target = target or _get(event, "target", "recipient")
|
||||
if not target:
|
||||
raise ValueError("MESSAGE_TARGET_REQUIRED")
|
||||
return MessageEnvelope(
|
||||
source=str(_get(event, "source", "producer", "agent_id", default="agent-event")),
|
||||
target=str(target),
|
||||
message_type=str(_get(event, "event_type", "type", "message_type", default="agent.event")),
|
||||
payload=dict(payload),
|
||||
sequence=sequence,
|
||||
idempotency_key=idempotency_key or str(_get(event, "id", "event_id", default="")) or f"agent-event:{sequence}",
|
||||
causation_id=_get(event, "causation_id"),
|
||||
**scope,
|
||||
)
|
||||
|
||||
|
||||
def taskplane_event_to_envelope(event: Any, *, target: str, sequence: int = 1,
|
||||
idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
|
||||
data = _get(event, "data", "payload", default={}) or {}
|
||||
event_id = str(_get(event, "id", "event_id", default=""))
|
||||
return MessageEnvelope(
|
||||
source=str(_get(event, "source", default="task-plane")),
|
||||
target=target,
|
||||
message_type=str(_get(event, "type", "event_type", default="task.event")),
|
||||
payload=dict(data),
|
||||
sequence=sequence,
|
||||
idempotency_key=idempotency_key or event_id or f"task-event:{sequence}",
|
||||
causation_id=event_id or None,
|
||||
**scope,
|
||||
)
|
||||
|
||||
|
||||
def legacy_message_to_envelope(message: Any, *, target: str | None = None, sequence: int = 1,
|
||||
idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
|
||||
payload = _get(message, "payload", "data", "body", "content", default={})
|
||||
if not isinstance(payload, Mapping):
|
||||
payload = {"value": payload}
|
||||
target = target or _get(message, "target", "recipient", "receiver")
|
||||
if not target:
|
||||
raise ValueError("MESSAGE_TARGET_REQUIRED")
|
||||
source = _get(message, "source", "sender", "agent_id", default="legacy-message-bus")
|
||||
kind = _get(message, "message_type", "type", "kind", default="legacy.message")
|
||||
identifier = _get(message, "id", "message_id", "event_id")
|
||||
return MessageEnvelope(
|
||||
source=str(source), target=str(target), message_type=str(kind), payload=dict(payload),
|
||||
sequence=sequence,
|
||||
idempotency_key=idempotency_key or (str(identifier) if identifier else f"legacy:{sequence}"),
|
||||
causation_id=str(identifier) if identifier else None,
|
||||
**scope,
|
||||
)
|
||||
@@ -34,7 +34,6 @@ from .models import (
|
||||
)
|
||||
from .policy import PolicyEngine
|
||||
from .store import TaskPlaneStore
|
||||
from .scope import bind_task_scope
|
||||
from .worker_registry import WorkerRegistry
|
||||
|
||||
|
||||
@@ -69,54 +68,28 @@ class TaskPlaneService:
|
||||
self.delegation = DelegationEngine(store)
|
||||
self.store.probe_attestation_verifier = self.policy.probe_attestation_verifier
|
||||
|
||||
def _authorized_task(self, task_id: str, actor: str, action: str) -> TaskRecord:
|
||||
task = self.store.get_task(task_id, self.policy.actor_context(actor))
|
||||
self.policy.assert_allowed(action, actor, task=task)
|
||||
return task
|
||||
|
||||
def create_task(
|
||||
self,
|
||||
body: dict[str, Any],
|
||||
idempotency_key: str | None = None,
|
||||
*,
|
||||
actor_identity: str | None = None,
|
||||
) -> dict[str, Any]:
|
||||
def create_task(self, body: dict[str, Any], idempotency_key: str | None = None) -> dict[str, Any]:
|
||||
if body.get("parent_task_id"):
|
||||
raise ForbiddenError("child tasks must use the delegate endpoint")
|
||||
issuer = body.get("issuer", {})
|
||||
declared_actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
|
||||
actor = actor_identity or declared_actor
|
||||
actor = issuer.get("id", "anon") if isinstance(issuer, dict) else "anon"
|
||||
self.policy.assert_allowed("create", actor)
|
||||
try:
|
||||
plan = TaskPlan.from_dict(body)
|
||||
except (TypeError, ValueError) as exc:
|
||||
raise ValidationError("invalid task plan") from exc
|
||||
if actor_identity is not None:
|
||||
plan = bind_task_scope(
|
||||
plan, self.policy.actor_context(actor_identity), public_create=True
|
||||
)
|
||||
task = self.store.create_task_with_event(plan, idempotency_key=idempotency_key)
|
||||
return task.to_dict()
|
||||
|
||||
def list_tasks(self, actor: str | None = None) -> list[dict[str, Any]]:
|
||||
context = None
|
||||
if actor is not None:
|
||||
self.policy.assert_allowed("read", actor)
|
||||
context = self.policy.actor_context(actor)
|
||||
return [
|
||||
task.to_dict(include_task=False)
|
||||
for task in self.store.list_tasks(context)
|
||||
]
|
||||
return [task.to_dict(include_task=False) for task in self.store.list_tasks()]
|
||||
|
||||
def get_task(self, task_id: str, actor: str | None = None) -> dict[str, Any]:
|
||||
context = None
|
||||
if actor is not None:
|
||||
self.policy.assert_allowed("read", actor)
|
||||
context = self.policy.actor_context(actor)
|
||||
task = self.store.get_task(task_id, context)
|
||||
if actor is not None:
|
||||
self.policy.assert_allowed("read", actor, task=task)
|
||||
return task.to_dict()
|
||||
self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
|
||||
return self.store.get_task(task_id).to_dict()
|
||||
|
||||
def get_worker(self, worker_id: str, actor: str | None = None) -> dict[str, Any]:
|
||||
if actor is not None:
|
||||
@@ -190,8 +163,9 @@ class TaskPlaneService:
|
||||
if not worker_id:
|
||||
raise ValidationError("worker_id required")
|
||||
|
||||
task = self._authorized_task(task_id, actor, "claim")
|
||||
task = self.store.get_task(task_id)
|
||||
self.policy.assert_readonly_worker_binding(actor, str(worker_id))
|
||||
self.policy.assert_allowed("claim", actor, task=task)
|
||||
lease_seconds = _bounded_int(
|
||||
body.get("lease_seconds", 30), "lease_seconds", 1, 3600
|
||||
)
|
||||
@@ -210,9 +184,10 @@ class TaskPlaneService:
|
||||
if not claim_id:
|
||||
raise ValidationError("claim_id required")
|
||||
actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
|
||||
task = self._authorized_task(task_id, actor, "heartbeat")
|
||||
task = self.store.get_task(task_id)
|
||||
claim = self.store.get_claim(claim_id)
|
||||
self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
|
||||
self.policy.assert_allowed("heartbeat", actor, task=task)
|
||||
if claim.worker_identity != actor:
|
||||
raise ForbiddenError("claim identity mismatch")
|
||||
lease_seconds = _bounded_int(
|
||||
@@ -231,9 +206,10 @@ class TaskPlaneService:
|
||||
message = body.get("message")
|
||||
if progress is None:
|
||||
raise ValidationError("progress required")
|
||||
task = self._authorized_task(task_id, actor, "progress")
|
||||
task = self.store.get_task(task_id)
|
||||
claim = self.store.get_claim(claim_id)
|
||||
self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
|
||||
self.policy.assert_allowed("progress", actor, task=task)
|
||||
if task.task_plan.data_classification == "credential-secret":
|
||||
if message not in {None, ""} or contains_secret_text(stage):
|
||||
raise ValidationError(
|
||||
@@ -258,7 +234,7 @@ class TaskPlaneService:
|
||||
if not claim_id:
|
||||
raise ValidationError("claim_id required")
|
||||
actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
|
||||
task = self._authorized_task(task_id, actor, "result")
|
||||
task = self.store.get_task(task_id)
|
||||
|
||||
status = body.get("status", "COMPLETED")
|
||||
outputs = body.get("outputs", [])
|
||||
@@ -271,6 +247,7 @@ class TaskPlaneService:
|
||||
raise ValidationError("evidence items must be objects")
|
||||
claim = self.store.get_claim(claim_id)
|
||||
self.policy.assert_readonly_worker_binding(actor, claim.worker_id)
|
||||
self.policy.assert_allowed("result", actor, task=task)
|
||||
if claim.worker_identity != actor:
|
||||
raise ForbiddenError("claim identity mismatch")
|
||||
if task.task_plan.data_classification == "credential-secret":
|
||||
@@ -349,7 +326,8 @@ class TaskPlaneService:
|
||||
reason = body.get("reason", "failed")
|
||||
actor = body.get("actor_identity") or body.get("worker_identity") or "worker"
|
||||
self.policy.assert_allowed("fail", actor)
|
||||
task = self._authorized_task(task_id, actor, "fail")
|
||||
task = self.store.get_task(task_id)
|
||||
self.policy.assert_allowed("fail", actor, task=task)
|
||||
claim = self.store.get_claim(claim_id)
|
||||
if claim.worker_identity != actor:
|
||||
raise ForbiddenError("claim identity mismatch")
|
||||
@@ -361,7 +339,8 @@ class TaskPlaneService:
|
||||
actor = body.get("actor_identity") or body.get("worker_identity") or "owner"
|
||||
self.policy.assert_allowed("cancel", actor)
|
||||
reason = body.get("reason", "cancelled")
|
||||
task = self._authorized_task(task_id, actor, "cancel")
|
||||
task = self.store.get_task(task_id)
|
||||
self.policy.assert_allowed("cancel", actor, task=task)
|
||||
updated = self.store.cancel_task_with_event(
|
||||
task_id, task.revision, reason=reason
|
||||
)
|
||||
@@ -370,7 +349,8 @@ class TaskPlaneService:
|
||||
def delegate(self, task_id: str, body: dict[str, Any]) -> dict[str, Any]:
|
||||
actor = body.get("actor_identity") or "owner"
|
||||
self.policy.assert_allowed("delegate", actor)
|
||||
parent = self._authorized_task(task_id, actor, "delegate")
|
||||
parent = self.store.get_task(task_id)
|
||||
self.policy.assert_allowed("delegate", actor, task=parent)
|
||||
if "task" in body:
|
||||
try:
|
||||
child_plan = TaskPlan.from_dict(body["task"])
|
||||
@@ -384,31 +364,25 @@ class TaskPlaneService:
|
||||
except (TypeError, ValueError) as exc:
|
||||
raise ValidationError("invalid child task plan") from exc
|
||||
child_plan.parent_task_id = task_id
|
||||
child_plan = bind_task_scope(
|
||||
child_plan, self.policy.actor_context(actor), public_create=False
|
||||
)
|
||||
child = self.delegation.delegate(task_id, child_plan, caller=actor)
|
||||
return child.to_dict()
|
||||
|
||||
def get_events(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
|
||||
if actor is not None:
|
||||
self._authorized_task(task_id, actor, "audit")
|
||||
else:
|
||||
self.store.get_task(task_id)
|
||||
self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
|
||||
self.store.get_task(task_id)
|
||||
return self.store.list_events(task_id)
|
||||
|
||||
def get_evidence(self, task_id: str, actor: str | None = None) -> list[dict[str, Any]]:
|
||||
if actor is not None:
|
||||
self._authorized_task(task_id, actor, "audit")
|
||||
else:
|
||||
self.store.get_task(task_id)
|
||||
self.policy.assert_allowed("audit", actor, task=self.store.get_task(task_id))
|
||||
self.store.get_task(task_id)
|
||||
return self.evidence.list(task_id)
|
||||
|
||||
def get_children(self, task_id: str, actor: str | None = None) -> list[str]:
|
||||
if actor is not None:
|
||||
self._authorized_task(task_id, actor, "read")
|
||||
else:
|
||||
self.store.get_task(task_id)
|
||||
self.policy.assert_allowed("read", actor, task=self.store.get_task(task_id))
|
||||
self.store.get_task(task_id)
|
||||
return self.store.list_children(task_id)
|
||||
|
||||
|
||||
@@ -532,11 +506,7 @@ class TaskPlaneRequestHandler(BaseHTTPRequestHandler):
|
||||
):
|
||||
raise ForbiddenError("issuer identity mismatch")
|
||||
body["issuer"] = {"type": "authenticated", "id": identity}
|
||||
return 201, self.service.create_task(
|
||||
body or {},
|
||||
headers.get("idempotency-key"),
|
||||
actor_identity=identity,
|
||||
)
|
||||
return 201, self.service.create_task(body or {}, headers.get("idempotency-key"))
|
||||
if body.get("actor_identity") not in {None, identity}:
|
||||
raise ForbiddenError("actor identity mismatch")
|
||||
body["actor_identity"] = identity
|
||||
|
||||
@@ -106,8 +106,3 @@ class DurableOutboxDispatcher:
|
||||
receipt=str(receipt) if receipt else None,
|
||||
error=None if receipt else f"{adapter.name} receipt unavailable",
|
||||
)
|
||||
|
||||
# R4.2 P0-B compatibility adapter.
|
||||
def to_handoff_envelope(event, *, target, sequence=1, idempotency_key=None, **scope):
|
||||
from message_handoff_adapters import taskplane_event_to_envelope
|
||||
return taskplane_event_to_envelope(event, target=target, sequence=sequence, idempotency_key=idempotency_key, **scope)
|
||||
|
||||
@@ -13,8 +13,6 @@ from dataclasses import dataclass, field
|
||||
from datetime import datetime, timezone
|
||||
from typing import Any
|
||||
|
||||
from .scope import normalize_task_scope
|
||||
|
||||
|
||||
SENSITIVE_KEYS = {
|
||||
"secret",
|
||||
@@ -68,12 +66,6 @@ TASK_PLAN_KEYS = {
|
||||
"allowed_input_paths",
|
||||
"allowed_output_paths",
|
||||
"output_policy",
|
||||
"scope_type",
|
||||
"tenant_id",
|
||||
"user_id",
|
||||
"project_id",
|
||||
"conversation_id",
|
||||
"run_id",
|
||||
}
|
||||
|
||||
|
||||
@@ -245,12 +237,6 @@ class TaskPlan:
|
||||
schema_version: int = 1
|
||||
task_id: str | None = None
|
||||
task_type: str = "code.change"
|
||||
scope_type: str = "legacy"
|
||||
tenant_id: str | None = None
|
||||
user_id: str | None = None
|
||||
project_id: str | None = None
|
||||
conversation_id: str | None = None
|
||||
run_id: str | None = None
|
||||
issuer: dict[str, Any] = field(default_factory=dict)
|
||||
intent: str | None = None
|
||||
required_capabilities: list[str] = field(default_factory=list)
|
||||
@@ -325,17 +311,10 @@ class TaskPlan:
|
||||
raise ValueError("credential-secret requires metadata-only logging")
|
||||
if output_policy != "hash-count-status-only":
|
||||
raise ValueError("credential-secret requires restricted output")
|
||||
scope = normalize_task_scope(data)
|
||||
return cls(
|
||||
schema_version=schema_version,
|
||||
task_id=validate_identifier(data["task_id"], "task_id"),
|
||||
task_type=validate_type(data.get("task_type", "code.change"), "task_type"),
|
||||
scope_type=scope.scope_type,
|
||||
tenant_id=scope.tenant_id,
|
||||
user_id=scope.user_id,
|
||||
project_id=scope.project_id,
|
||||
conversation_id=scope.conversation_id,
|
||||
run_id=scope.run_id,
|
||||
issuer=issuer,
|
||||
intent=data.get("intent"),
|
||||
required_capabilities=_normalize_list(data.get("required_capabilities", [])),
|
||||
@@ -369,12 +348,6 @@ class TaskPlan:
|
||||
"schema_version": self.schema_version,
|
||||
"task_id": self.task_id,
|
||||
"task_type": self.task_type,
|
||||
"scope_type": self.scope_type,
|
||||
"tenant_id": self.tenant_id,
|
||||
"user_id": self.user_id,
|
||||
"project_id": self.project_id,
|
||||
"conversation_id": self.conversation_id,
|
||||
"run_id": self.run_id,
|
||||
"issuer": self.issuer,
|
||||
"intent": self.intent,
|
||||
"required_capabilities": list(self.required_capabilities),
|
||||
|
||||
@@ -3,11 +3,10 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from dataclasses import dataclass
|
||||
from typing import Any, Callable, Mapping
|
||||
from typing import Callable
|
||||
|
||||
from .errors import ForbiddenError, LockedError
|
||||
from .models import ProbeEvidence, ResultEnvelope, TaskRecord
|
||||
from .scope import TaskActorContext, actor_context as build_actor_context
|
||||
|
||||
|
||||
RISK_RANK = {"low": 1, "medium": 2, "high": 3}
|
||||
@@ -94,10 +93,6 @@ class PolicyEngine:
|
||||
result_signature_verifier: Callable[[ResultEnvelope], bool] | None = None,
|
||||
probe_attestation_verifier: Callable[[ProbeEvidence], bool] | None = None,
|
||||
identity_capabilities: dict[str, set[str]] | None = None,
|
||||
identity_actor_contexts: Mapping[
|
||||
str, TaskActorContext | Mapping[str, Any]
|
||||
]
|
||||
| None = None,
|
||||
admin_identities: set[str] | None = None,
|
||||
readonly_worker_execution_enabled: bool = False,
|
||||
readonly_worker_profiles: list[ReadonlyWorkerProfile] | None = None,
|
||||
@@ -114,26 +109,12 @@ class PolicyEngine:
|
||||
identity: set(capabilities)
|
||||
for identity, capabilities in (identity_capabilities or {}).items()
|
||||
}
|
||||
self.identity_actor_contexts = dict(identity_actor_contexts or {})
|
||||
self.admin_identities = set(admin_identities or ())
|
||||
self.readonly_worker_execution_enabled = readonly_worker_execution_enabled
|
||||
self.readonly_worker_profiles = {
|
||||
profile.identity: profile for profile in (readonly_worker_profiles or [])
|
||||
}
|
||||
|
||||
def actor_context(self, identity: str) -> TaskActorContext:
|
||||
configured = self.identity_actor_contexts.get(
|
||||
identity, self.identity_actor_contexts.get("*")
|
||||
)
|
||||
capabilities = set(
|
||||
self.identity_capabilities.get(
|
||||
identity, self.identity_capabilities.get("*", set())
|
||||
)
|
||||
)
|
||||
if identity in self.admin_identities:
|
||||
capabilities.add("task.admin")
|
||||
return build_actor_context(identity, configured, capabilities)
|
||||
|
||||
def _readonly_worker_allows(
|
||||
self, action: str, actor: str, task: TaskRecord | None
|
||||
) -> bool:
|
||||
|
||||
@@ -1,181 +0,0 @@
|
||||
"""Trusted TaskPlane scope model and SQL authorization helpers."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from dataclasses import dataclass, replace
|
||||
from typing import Any, Mapping
|
||||
|
||||
from .errors import ForbiddenError, ValidationError
|
||||
|
||||
SCOPE_FIELDS = ("tenant_id", "user_id", "project_id", "conversation_id", "run_id")
|
||||
PRIVILEGED_CAPABILITIES = frozenset(
|
||||
{"*", "admin", "system.admin", "task.admin", "task.read.all"}
|
||||
)
|
||||
|
||||
|
||||
def _value(value: Any, field: str) -> Any:
|
||||
if hasattr(value, "task_plan"):
|
||||
value = value.task_plan
|
||||
if isinstance(value, Mapping):
|
||||
return value.get(field)
|
||||
return getattr(value, field, None)
|
||||
|
||||
|
||||
def _text(value: Any) -> str | None:
|
||||
if value is None:
|
||||
return None
|
||||
result = str(value).strip()
|
||||
return result or None
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class TaskScope:
|
||||
scope_type: str
|
||||
tenant_id: str | None = None
|
||||
user_id: str | None = None
|
||||
project_id: str | None = None
|
||||
conversation_id: str | None = None
|
||||
run_id: str | None = None
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class TaskActorContext:
|
||||
identity: str
|
||||
scope_type: str = "legacy"
|
||||
tenant_id: str | None = None
|
||||
user_id: str | None = None
|
||||
project_id: str | None = None
|
||||
conversation_id: str | None = None
|
||||
run_id: str | None = None
|
||||
capabilities: frozenset[str] = frozenset()
|
||||
|
||||
|
||||
def normalize_task_scope(value: Any) -> TaskScope:
|
||||
fields = {field: _text(_value(value, field)) for field in SCOPE_FIELDS}
|
||||
declared = _text(_value(value, "scope_type"))
|
||||
if declared is None:
|
||||
declared = "tenant" if fields["tenant_id"] else "legacy"
|
||||
if declared == "tenant":
|
||||
if fields["tenant_id"] is None:
|
||||
raise ValidationError(
|
||||
"tenant scope requires tenant_id", code="TASK_SCOPE_TENANT_ID_REQUIRED"
|
||||
)
|
||||
elif declared == "legacy":
|
||||
if any(fields.values()):
|
||||
raise ValidationError(
|
||||
"legacy scope cannot contain scoped ownership",
|
||||
code="TASK_SCOPE_LEGACY_WITH_SCOPED_FIELDS",
|
||||
)
|
||||
elif declared == "system":
|
||||
if any(fields[field] for field in ("tenant_id", "user_id", "project_id", "conversation_id")):
|
||||
raise ValidationError(
|
||||
"system scope cannot contain tenant ownership",
|
||||
code="TASK_SCOPE_SYSTEM_WITH_TENANT_FIELDS",
|
||||
)
|
||||
else:
|
||||
raise ValidationError("invalid task scope type", code="TASK_SCOPE_TYPE_INVALID")
|
||||
return TaskScope(declared, **fields)
|
||||
|
||||
|
||||
def actor_is_privileged(actor: TaskActorContext) -> bool:
|
||||
return bool(actor.capabilities & PRIVILEGED_CAPABILITIES)
|
||||
|
||||
|
||||
def actor_context(
|
||||
identity: str,
|
||||
configured: TaskActorContext | Mapping[str, Any] | None,
|
||||
capabilities: set[str] | frozenset[str],
|
||||
) -> TaskActorContext:
|
||||
if isinstance(configured, TaskActorContext):
|
||||
context = configured
|
||||
else:
|
||||
data = dict(configured or {})
|
||||
data.pop("identity", None)
|
||||
data.pop("capabilities", None)
|
||||
context = TaskActorContext(identity=str(identity), **data)
|
||||
scope = normalize_task_scope(context)
|
||||
return replace(
|
||||
context,
|
||||
identity=str(identity),
|
||||
scope_type=scope.scope_type,
|
||||
tenant_id=scope.tenant_id,
|
||||
user_id=scope.user_id,
|
||||
project_id=scope.project_id,
|
||||
conversation_id=scope.conversation_id,
|
||||
run_id=scope.run_id,
|
||||
capabilities=frozenset(str(item) for item in capabilities),
|
||||
)
|
||||
|
||||
|
||||
def bind_task_scope(plan: Any, actor: TaskActorContext, *, public_create: bool) -> Any:
|
||||
requested = normalize_task_scope(plan)
|
||||
if actor_is_privileged(actor):
|
||||
trusted = normalize_task_scope(actor)
|
||||
if requested.scope_type == "legacy" and trusted.scope_type != "legacy":
|
||||
plan.scope_type = trusted.scope_type
|
||||
for field in SCOPE_FIELDS:
|
||||
setattr(plan, field, getattr(actor, field))
|
||||
return plan
|
||||
trusted = normalize_task_scope(actor)
|
||||
if public_create and trusted.scope_type == "legacy":
|
||||
raise ForbiddenError(
|
||||
"authenticated identity has no tenant scope",
|
||||
code="TASK_ACTOR_SCOPE_UNAVAILABLE",
|
||||
)
|
||||
if trusted.scope_type != "tenant":
|
||||
if requested.scope_type == "legacy":
|
||||
plan.scope_type = trusted.scope_type
|
||||
for field in SCOPE_FIELDS:
|
||||
setattr(plan, field, getattr(actor, field))
|
||||
return plan
|
||||
if requested.scope_type != trusted.scope_type:
|
||||
raise ForbiddenError("task scope mismatch", code="TASK_SCOPE_MISMATCH_DENY")
|
||||
return plan
|
||||
if requested.scope_type not in {"legacy", "tenant"}:
|
||||
raise ForbiddenError("task scope mismatch", code="TASK_SCOPE_MISMATCH_DENY")
|
||||
updates: dict[str, Any] = {"scope_type": "tenant"}
|
||||
for field in SCOPE_FIELDS:
|
||||
declared = getattr(requested, field)
|
||||
authoritative = getattr(actor, field)
|
||||
if declared is not None and declared != authoritative:
|
||||
raise ForbiddenError(
|
||||
"task scope mismatch",
|
||||
code="TASK_SCOPE_MISMATCH_DENY",
|
||||
details={"field": field},
|
||||
)
|
||||
updates[field] = authoritative
|
||||
for field, item in updates.items():
|
||||
setattr(plan, field, item)
|
||||
return plan
|
||||
|
||||
|
||||
def actor_scope_sql(actor: TaskActorContext | None) -> tuple[str, tuple[Any, ...]]:
|
||||
if actor is None or actor_is_privileged(actor):
|
||||
return "", ()
|
||||
scope = normalize_task_scope(actor)
|
||||
if scope.scope_type == "legacy":
|
||||
return "scope_type = 'legacy'", ()
|
||||
if scope.scope_type == "system":
|
||||
return "scope_type = 'system'", ()
|
||||
clauses = ["scope_type = 'tenant'", "tenant_id = ?"]
|
||||
params: list[Any] = [scope.tenant_id]
|
||||
for field in ("user_id", "project_id", "conversation_id", "run_id"):
|
||||
value = getattr(scope, field)
|
||||
if value is None:
|
||||
clauses.append(f"{field} IS NULL")
|
||||
else:
|
||||
clauses.append(f"({field} IS NULL OR {field} = ?)")
|
||||
params.append(value)
|
||||
return " AND ".join(clauses), tuple(params)
|
||||
|
||||
|
||||
def task_scope_values(value: Any) -> tuple[str | None, ...]:
|
||||
scope = normalize_task_scope(value)
|
||||
return (
|
||||
scope.scope_type,
|
||||
scope.tenant_id,
|
||||
scope.user_id,
|
||||
scope.project_id,
|
||||
scope.conversation_id,
|
||||
scope.run_id,
|
||||
)
|
||||
@@ -32,7 +32,6 @@ from .models import (
|
||||
redact_value,
|
||||
validate_identifier,
|
||||
)
|
||||
from .scope import TaskActorContext, actor_scope_sql, task_scope_values
|
||||
|
||||
|
||||
EventEnvelope = tuple[str, str, str, str, str, float]
|
||||
@@ -135,12 +134,6 @@ class TaskPlaneStore:
|
||||
status TEXT NOT NULL,
|
||||
task_json TEXT NOT NULL,
|
||||
task_type TEXT NOT NULL,
|
||||
scope_type TEXT NOT NULL DEFAULT 'legacy',
|
||||
tenant_id TEXT,
|
||||
user_id TEXT,
|
||||
project_id TEXT,
|
||||
conversation_id TEXT,
|
||||
run_id TEXT,
|
||||
root_task_id TEXT NOT NULL,
|
||||
parent_task_id TEXT,
|
||||
correlation_id TEXT,
|
||||
@@ -279,21 +272,6 @@ class TaskPlaneStore:
|
||||
)
|
||||
"""
|
||||
)
|
||||
self._ensure_columns(
|
||||
"tasks",
|
||||
{
|
||||
"scope_type": "TEXT NOT NULL DEFAULT 'legacy'",
|
||||
"tenant_id": "TEXT",
|
||||
"user_id": "TEXT",
|
||||
"project_id": "TEXT",
|
||||
"conversation_id": "TEXT",
|
||||
"run_id": "TEXT",
|
||||
},
|
||||
)
|
||||
self.conn.execute(
|
||||
"UPDATE tasks SET scope_type='legacy' "
|
||||
"WHERE scope_type IS NULL OR TRIM(scope_type)=''"
|
||||
)
|
||||
self._ensure_columns(
|
||||
"workers",
|
||||
{
|
||||
@@ -321,14 +299,6 @@ class TaskPlaneStore:
|
||||
)
|
||||
self.conn.execute("CREATE INDEX IF NOT EXISTS ix_tasks_status ON tasks(status)")
|
||||
self.conn.execute("CREATE INDEX IF NOT EXISTS ix_tasks_parent ON tasks(parent_task_id)")
|
||||
self.conn.execute(
|
||||
"CREATE INDEX IF NOT EXISTS ix_tasks_scope_tenant_project "
|
||||
"ON tasks(scope_type, tenant_id, project_id)"
|
||||
)
|
||||
self.conn.execute(
|
||||
"CREATE INDEX IF NOT EXISTS ix_tasks_scope_owner "
|
||||
"ON tasks(scope_type, tenant_id, user_id, conversation_id, run_id)"
|
||||
)
|
||||
self.conn.execute("CREATE INDEX IF NOT EXISTS ix_workers_status ON workers(status)")
|
||||
self.conn.execute("CREATE INDEX IF NOT EXISTS ix_claims_task ON claims(task_id)")
|
||||
self.conn.execute(
|
||||
@@ -377,42 +347,6 @@ class TaskPlaneStore:
|
||||
raise NotFoundError("task")
|
||||
task_json = json.loads(row["task_json"])
|
||||
task_plan = TaskPlan.from_dict(task_json)
|
||||
stored_scope = tuple(
|
||||
row[field]
|
||||
for field in (
|
||||
"scope_type",
|
||||
"tenant_id",
|
||||
"user_id",
|
||||
"project_id",
|
||||
"conversation_id",
|
||||
"run_id",
|
||||
)
|
||||
)
|
||||
json_has_scope = any(
|
||||
field in task_json
|
||||
for field in (
|
||||
"scope_type",
|
||||
"tenant_id",
|
||||
"user_id",
|
||||
"project_id",
|
||||
"conversation_id",
|
||||
"run_id",
|
||||
)
|
||||
)
|
||||
if json_has_scope and stored_scope != task_scope_values(task_plan):
|
||||
raise ConflictError(
|
||||
"task scope persistence mismatch",
|
||||
code="TASK_SCOPE_PERSISTENCE_MISMATCH",
|
||||
)
|
||||
if not json_has_scope:
|
||||
(
|
||||
task_plan.scope_type,
|
||||
task_plan.tenant_id,
|
||||
task_plan.user_id,
|
||||
task_plan.project_id,
|
||||
task_plan.conversation_id,
|
||||
task_plan.run_id,
|
||||
) = stored_scope
|
||||
task_plan.parent_task_id = row["parent_task_id"]
|
||||
task_plan.correlation_id = row["correlation_id"]
|
||||
return TaskRecord(
|
||||
@@ -455,7 +389,6 @@ class TaskPlaneStore:
|
||||
task_id = task_plan.task_id or f"task-{uuid.uuid4()}"
|
||||
task_plan.task_id = task_id
|
||||
task_json = redact_value(task_plan.to_dict(redact=False))
|
||||
scope_values = task_scope_values(task_plan)
|
||||
now = _now()
|
||||
with self._transaction():
|
||||
if idempotency_key:
|
||||
@@ -464,11 +397,7 @@ class TaskPlaneStore:
|
||||
(idempotency_key,),
|
||||
).fetchone()
|
||||
if existing:
|
||||
existing_plan = TaskPlan.from_dict(
|
||||
json.loads(existing["task_json"])
|
||||
)
|
||||
existing_json = redact_value(existing_plan.to_dict(redact=False))
|
||||
if _canonical(existing_json) != _canonical(task_json):
|
||||
if _canonical(json.loads(existing["task_json"])) != _canonical(task_json):
|
||||
raise ConflictError("idempotency key payload mismatch")
|
||||
return self.get_task(existing["task_id"])
|
||||
root_task_id = task_id
|
||||
@@ -483,18 +412,14 @@ class TaskPlaneStore:
|
||||
self.conn.execute(
|
||||
"""
|
||||
INSERT INTO tasks
|
||||
(task_id, revision, status, task_json, task_type,
|
||||
scope_type, tenant_id, user_id, project_id, conversation_id, run_id,
|
||||
root_task_id, parent_task_id, correlation_id, idempotency_key,
|
||||
created_at, updated_at, failure_reason)
|
||||
VALUES (?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
|
||||
(task_id, revision, status, task_json, task_type, root_task_id, parent_task_id, correlation_id, idempotency_key, created_at, updated_at, failure_reason)
|
||||
VALUES (?, 1, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
|
||||
""",
|
||||
(
|
||||
task_id,
|
||||
"CREATED",
|
||||
json.dumps(task_json, ensure_ascii=False),
|
||||
task_plan.task_type,
|
||||
*scope_values,
|
||||
root_task_id,
|
||||
task_plan.parent_task_id,
|
||||
task_plan.correlation_id,
|
||||
@@ -526,30 +451,21 @@ class TaskPlaneStore:
|
||||
)
|
||||
return self.get_task(task.task_id)
|
||||
|
||||
def get_task(
|
||||
self, task_id: str, actor_context: TaskActorContext | None = None
|
||||
) -> TaskRecord:
|
||||
def get_task(self, task_id: str) -> TaskRecord:
|
||||
task_id = _validated_id(task_id, "task_id")
|
||||
predicate, scope_params = actor_scope_sql(actor_context)
|
||||
sql = "SELECT * FROM tasks WHERE task_id=?"
|
||||
if predicate:
|
||||
sql += f" AND ({predicate})"
|
||||
with self._lock:
|
||||
row = self.conn.execute(sql, (task_id, *scope_params)).fetchone()
|
||||
row = self.conn.execute(
|
||||
"SELECT * FROM tasks WHERE task_id=?", (task_id,)
|
||||
).fetchone()
|
||||
if row is None:
|
||||
raise NotFoundError(f"task {task_id} not found")
|
||||
return self._row_to_task(row)
|
||||
|
||||
def list_tasks(
|
||||
self, actor_context: TaskActorContext | None = None
|
||||
) -> list[TaskRecord]:
|
||||
predicate, scope_params = actor_scope_sql(actor_context)
|
||||
sql = "SELECT * FROM tasks"
|
||||
if predicate:
|
||||
sql += f" WHERE ({predicate})"
|
||||
sql += " ORDER BY created_at DESC"
|
||||
def list_tasks(self) -> list[TaskRecord]:
|
||||
with self._lock:
|
||||
rows = self.conn.execute(sql, scope_params).fetchall()
|
||||
rows = self.conn.execute(
|
||||
"SELECT * FROM tasks ORDER BY created_at DESC"
|
||||
).fetchall()
|
||||
return [self._row_to_task(row) for row in rows]
|
||||
|
||||
def get_task_budget(self, task_id: str) -> Budget:
|
||||
|
||||
@@ -1,135 +0,0 @@
|
||||
"""V2R2C1 adapter using the existing V2R1C7 deployment primitives.
|
||||
|
||||
The service identity and loopback port remain stable for a safe cutover. The
|
||||
new release is installed under its own immutable directory and keeps the
|
||||
previous V2R1C7 release available for an explicit, owner-approved rollback.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import os
|
||||
import shutil
|
||||
import sys
|
||||
from argparse import Namespace
|
||||
from pathlib import Path
|
||||
from typing import Any, Mapping
|
||||
|
||||
import v2r1c7_production_adapter as base
|
||||
|
||||
|
||||
VERSION = "V2R2C1"
|
||||
SERVICE = "aios-v2r1c7-production.service"
|
||||
PORT = 18927
|
||||
RELEASE_ROOT = Path("/opt/aios/releases")
|
||||
CURRENT_LINK = Path("/opt/aios/v2r2c1")
|
||||
ENV_FILE = Path("/etc/aios/aios-v2r2c1.env")
|
||||
STATE_FILE = Path("/var/lib/aios/v2r2c1/deployment-state.json")
|
||||
UNIT_FILE = Path("/etc/systemd/system/aios-v2r1c7-production.service")
|
||||
ROLLBACK_ROOT = Path("/var/lib/aios/v2r2c1/rollback")
|
||||
|
||||
REQUIRED_MEMBERS = {
|
||||
"payload/VERSION",
|
||||
"payload/active-runtime/app/deployment_state.py",
|
||||
"payload/active-runtime/app/v2r1c6_privacy_tools.py",
|
||||
"payload/active-runtime/app/v2r2c1_health_service.py",
|
||||
"payload/deploy/aios-v2/systemd/aios-v2r1c7-production.service",
|
||||
"payload/deploy/aios-v2/v2r2c1-runtime-config.json",
|
||||
"payload/deploy/aios-v2/v2r2c1-rollback.json",
|
||||
"payload/scripts/probe_v2r2c1_health.py",
|
||||
"payload/scripts/rollback_v2r2c1_release.sh",
|
||||
"payload/BUILD-METADATA.json",
|
||||
"payload/ARTIFACT-MANIFEST.json",
|
||||
"payload/ROLLBACK-METADATA.json",
|
||||
}
|
||||
|
||||
|
||||
def _configure_base() -> None:
|
||||
base.VERSION = VERSION
|
||||
base.SERVICE = SERVICE
|
||||
base.PORT = PORT
|
||||
base.REQUIRED_MEMBERS = REQUIRED_MEMBERS
|
||||
|
||||
|
||||
def _args() -> Namespace:
|
||||
return Namespace(
|
||||
release_root=RELEASE_ROOT,
|
||||
current_link=CURRENT_LINK,
|
||||
env_file=ENV_FILE,
|
||||
state_file=STATE_FILE,
|
||||
unit_file=UNIT_FILE,
|
||||
health_timeout=45,
|
||||
)
|
||||
|
||||
|
||||
def load_request() -> dict[str, Any]:
|
||||
_configure_base()
|
||||
value = base.load_request()
|
||||
if value.get("version") != VERSION or value.get("production_service") != SERVICE or int(value.get("production_port", -1)) != PORT:
|
||||
raise ValueError("V2R2C1 production binding mismatch")
|
||||
return value
|
||||
|
||||
|
||||
def _backup(path: Path, name: str) -> None:
|
||||
if path.is_file() and not path.is_symlink():
|
||||
ROLLBACK_ROOT.mkdir(parents=True, exist_ok=True)
|
||||
destination = ROLLBACK_ROOT / name
|
||||
if not destination.exists():
|
||||
shutil.copy2(path, destination)
|
||||
|
||||
|
||||
def execute_request(value: Mapping[str, Any]) -> dict[str, Any]:
|
||||
_configure_base()
|
||||
if value.get("schema") != "aios.production-executor-request.v1":
|
||||
raise ValueError("request_schema_invalid")
|
||||
if value.get("operation") == "apply":
|
||||
_backup(UNIT_FILE, "aios-v2r1c7-production.service.previous")
|
||||
_backup(Path("/etc/aios/aios-v2r1c7.env"), "aios-v2r1c7.env.previous")
|
||||
_backup(Path("/var/lib/aios/v2r1c7/deployment-state.json"), "v2r1c7-deployment-state.previous")
|
||||
return base.install_release(_args(), value)
|
||||
if value.get("operation") == "probe":
|
||||
return base.probe(_args(), value)
|
||||
if value.get("operation") == "rollback":
|
||||
return rollback(value)
|
||||
raise ValueError("unsupported_operation")
|
||||
|
||||
|
||||
def rollback(value: Mapping[str, Any]) -> dict[str, Any]:
|
||||
"""Explicit rollback only; this adapter never invokes it automatically."""
|
||||
import subprocess
|
||||
|
||||
subprocess.run(["systemctl", "stop", SERVICE], check=False, capture_output=True, text=True, timeout=45)
|
||||
previous_unit = ROLLBACK_ROOT / "aios-v2r1c7-production.service.previous"
|
||||
previous_env = ROLLBACK_ROOT / "aios-v2r1c7.env.previous"
|
||||
previous_state = ROLLBACK_ROOT / "v2r1c7-deployment-state.previous"
|
||||
if not previous_unit.is_file() or not previous_env.is_file():
|
||||
raise RuntimeError("ROLLBACK_RECEIPT_MISSING")
|
||||
UNIT_FILE.parent.mkdir(parents=True, exist_ok=True)
|
||||
ENV_FILE.parent.mkdir(parents=True, exist_ok=True)
|
||||
shutil.copy2(previous_unit, UNIT_FILE)
|
||||
shutil.copy2(previous_env, Path("/etc/aios/aios-v2r1c7.env"))
|
||||
if previous_state.is_file():
|
||||
Path("/var/lib/aios/v2r1c7").mkdir(parents=True, exist_ok=True)
|
||||
shutil.copy2(previous_state, Path("/var/lib/aios/v2r1c7/deployment-state.json"))
|
||||
subprocess.run(["systemctl", "daemon-reload"], check=True, capture_output=True, text=True, timeout=45)
|
||||
subprocess.run(["systemctl", "restart", SERVICE], check=True, capture_output=True, text=True, timeout=45)
|
||||
result = base.health("http://127.0.0.1:18927/health", {
|
||||
"version": "V2R1C7",
|
||||
"target_oid": str(json.loads(Path("/var/lib/aios/v2r1c7/deployment-state.json").read_text(encoding="utf-8")).get("commit_oid")),
|
||||
"artifact_sha256": str(json.loads(Path("/var/lib/aios/v2r1c7/deployment-state.json").read_text(encoding="utf-8")).get("artifact_sha256")),
|
||||
})
|
||||
return {"status": "ROLLED_BACK", "rollback_health": result, "automatic_rollback": False}
|
||||
|
||||
|
||||
def main() -> int:
|
||||
try:
|
||||
value = load_request()
|
||||
result = execute_request(value)
|
||||
print(json.dumps(result, sort_keys=True))
|
||||
return 0
|
||||
except Exception as exc:
|
||||
print(json.dumps({"status": "FAIL_CLOSED", "error": type(exc).__name__, "reason": str(exc)}, sort_keys=True))
|
||||
return 2
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
@@ -1,36 +0,0 @@
|
||||
-- R4.2 P0-B durable Message/Handoff Fabric.
|
||||
-- Forward-only. The existing 20260707 message_outbox remains a compatibility source.
|
||||
|
||||
CREATE TABLE IF NOT EXISTS message_handoff (
|
||||
envelope_id TEXT PRIMARY KEY,
|
||||
stream_key TEXT NOT NULL,
|
||||
source TEXT NOT NULL,
|
||||
target TEXT NOT NULL,
|
||||
message_type TEXT NOT NULL,
|
||||
payload_json TEXT NOT NULL,
|
||||
payload_sha256 TEXT NOT NULL,
|
||||
tenant_id TEXT,
|
||||
user_id TEXT,
|
||||
project_id TEXT,
|
||||
conversation_id TEXT,
|
||||
task_id TEXT,
|
||||
run_id TEXT,
|
||||
causation_id TEXT,
|
||||
sequence INTEGER NOT NULL CHECK(sequence >= 1),
|
||||
capability_scope_json TEXT NOT NULL,
|
||||
confidentiality_scope TEXT NOT NULL,
|
||||
idempotency_key TEXT NOT NULL,
|
||||
expires_at TEXT,
|
||||
created_at TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'PENDING',
|
||||
delivered_at TEXT,
|
||||
acked_at TEXT,
|
||||
UNIQUE(stream_key, idempotency_key),
|
||||
UNIQUE(stream_key, sequence)
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_message_handoff_target_status
|
||||
ON message_handoff(target, status, created_at);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_message_handoff_scope
|
||||
ON message_handoff(tenant_id, project_id, user_id, conversation_id, run_id);
|
||||
@@ -1,51 +0,0 @@
|
||||
[Unit]
|
||||
Description=AIOS GitOps Model API V2R2C1 immutable staging runtime
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=aiman
|
||||
Group=gitops
|
||||
WorkingDirectory=@RUNTIME_ROOT@
|
||||
Environment=PYTHONUNBUFFERED=1
|
||||
Environment=PYTHONDONTWRITEBYTECODE=1
|
||||
Environment=AIOS_GITOPS_ROOT=/var/lib/aios-gitops
|
||||
Environment=AIOS_GITOPS_WORKSPACE=@RUNTIME_ROOT@
|
||||
Environment=AIOS_GITOPS_REPO=/data/aios-gitops/repo.git
|
||||
Environment=AIOS_GITOPS_BARE_REPO=/data/aios-gitops/repo.git
|
||||
Environment=AIOS_GITOPS_AUTHORITATIVE_GIT_DIR=/data/aios-gitops/repo.git
|
||||
Environment=AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
|
||||
Environment=AIOS_GITOPS_BASELINE_AUTHORITY=/var/lib/aios-gitops-runtime-anchor/baseline/current.json
|
||||
Environment=AIOS_GITOPS_WRITES_ENABLED=false
|
||||
Environment=AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED=false
|
||||
Environment=AIOS_GITOPS_JOB_CONTROLLER_ENABLED=false
|
||||
Environment=AIOS_GITOPS_WORKSPACE_ROLE=runtime-anchor
|
||||
Environment=AIOS_GITOPS_RUNTIME_OID=@SOURCE_OID@
|
||||
Environment=AIOS_GITOPS_ARTIFACT_SHA256=@ARTIFACT_SHA256@
|
||||
Environment=AIOS_GITOPS_DEPLOYMENT_STATE=STAGING
|
||||
Environment=AIOS_GITOPS_MODEL_API_SERVICE=aios-gitops-model-api-v2r2c1-staging.service
|
||||
Environment=AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
|
||||
Environment=AIOS_SILENT_RELEASE_STATE_ROOT=/var/lib/aios-gitops/model-api-staging/silent-release
|
||||
Environment=AIOS_BRIDGE_V2_URL=http://127.0.0.1:18892
|
||||
Environment=AIOS_GITOPS_HOST=127.0.0.1
|
||||
Environment=AIOS_GITOPS_PORT=18893
|
||||
Environment=PYTHONPATH=@RUNTIME_ROOT@/app:@RUNTIME_ROOT@/runtime-agent-os
|
||||
ExecStart=/usr/bin/python3 @RUNTIME_ROOT@/app/aios_model_api_staging.py
|
||||
Restart=on-failure
|
||||
RestartSec=2
|
||||
NoNewPrivileges=true
|
||||
PrivateTmp=true
|
||||
ProtectHome=true
|
||||
ProtectSystem=strict
|
||||
ProtectKernelTunables=true
|
||||
ProtectKernelModules=true
|
||||
ProtectControlGroups=true
|
||||
LockPersonality=true
|
||||
RestrictSUIDSGID=true
|
||||
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
|
||||
ReadOnlyPaths=@RUNTIME_ROOT@ /data/aios-gitops/repo.git /var/lib/aios-gitops-runtime-anchor/baseline
|
||||
ReadWritePaths=/var/lib/aios-gitops/model-api-staging
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,6 +1,20 @@
|
||||
# Merge this fragment into docs/gitops/openapi-chatgpt-actions.yaml.
|
||||
components:
|
||||
schemas:
|
||||
WriterLeaseRequestV2:
|
||||
type: object
|
||||
additionalProperties: false
|
||||
required: [schema, task_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds]
|
||||
properties:
|
||||
schema: {type: string, const: aios.task-writer-lease.v2}
|
||||
task_id: {type: string}
|
||||
repository: {type: string, const: aios/aios}
|
||||
branch_mode: {type: string, const: CONTINUE_EXISTING}
|
||||
base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
|
||||
expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
|
||||
target_branch: {type: string, pattern: '^agent/'}
|
||||
generation: {type: integer, minimum: 1}
|
||||
lease_seconds: {type: integer, minimum: 1, maximum: 86400}
|
||||
AuthorizedTaskWriterProvisionRequest:
|
||||
type: object
|
||||
additionalProperties: false
|
||||
@@ -90,6 +104,20 @@ components:
|
||||
- production_marker_write
|
||||
- history_rewrite
|
||||
|
||||
ControlPlaneSnapshot:
|
||||
type: object
|
||||
additionalProperties: false
|
||||
required: [version, runtime, repository, production, task, capabilities, credential_broker, secret_material_exposed]
|
||||
properties:
|
||||
version: {type: object}
|
||||
runtime: {type: object}
|
||||
repository: {type: object}
|
||||
production: {type: object}
|
||||
task: {type: object}
|
||||
capabilities: {type: object}
|
||||
credential_broker: {type: object}
|
||||
secret_material_exposed: {type: boolean, const: false}
|
||||
|
||||
paths:
|
||||
/api/task-writer/provision-authorized:
|
||||
post:
|
||||
@@ -119,3 +147,10 @@ paths:
|
||||
description: Base drift, branch conflict, or idempotency scope conflict
|
||||
'503':
|
||||
description: Signer, validator, provisioner, or attestation unavailable
|
||||
|
||||
/v2/control-plane-snapshot:
|
||||
get:
|
||||
operationId: getControlPlaneSnapshot
|
||||
responses:
|
||||
'200':
|
||||
description: Non-sensitive control-plane snapshot
|
||||
|
||||
@@ -240,114 +240,6 @@ components:
|
||||
additionalProperties: false
|
||||
properties:
|
||||
candidate_id: {type: string}
|
||||
BridgeWriterLeaseRecoveryRequest:
|
||||
type: object
|
||||
additionalProperties: false
|
||||
required: [schema, task_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds]
|
||||
properties:
|
||||
schema:
|
||||
type: string
|
||||
enum: [aios.task-writer-lease.v2, aios.task-writer-lease-request.v2]
|
||||
task_id: {type: string, minLength: 1, maxLength: 256}
|
||||
job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
|
||||
repository: {type: string, const: aios/aios}
|
||||
branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
|
||||
base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
|
||||
expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
|
||||
target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
|
||||
generation: {type: integer, minimum: 1}
|
||||
lease_seconds: {type: integer, minimum: 1, maximum: 86400}
|
||||
BridgeWriterLeaseResponse:
|
||||
type: object
|
||||
additionalProperties: false
|
||||
required: [schema, task_id, job_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds, create_target_branch, worktree_mode, cas_ref_update_required]
|
||||
properties:
|
||||
schema: {type: string, enum: [aios.task-writer-lease.v2]}
|
||||
task_id: {type: string}
|
||||
job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
|
||||
repository: {type: string, const: aios/aios}
|
||||
branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
|
||||
base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
|
||||
expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
|
||||
target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
|
||||
generation: {type: integer, minimum: 1}
|
||||
lease_seconds: {type: integer, minimum: 1, maximum: 86400}
|
||||
create_target_branch: {type: boolean}
|
||||
worktree_mode: {type: string, enum: [detached_at_base_oid, detached_at_expected_head]}
|
||||
cas_ref_update_required: {type: boolean, const: true}
|
||||
lease_expires_at: {type: string, format: date-time}
|
||||
BridgeWriterLeaseRecoveryResponse:
|
||||
type: object
|
||||
additionalProperties: false
|
||||
required: [schema, task_id, job_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds, lease_expires_at, create_target_branch, worktree_mode, cas_ref_update_required, recovered, bootstrapped, idempotent, runtime_rehydrated, durable_branch_lease_present]
|
||||
properties:
|
||||
schema: {type: string, enum: [aios.task-writer-lease.v2]}
|
||||
task_id: {type: string}
|
||||
job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
|
||||
repository: {type: string, const: aios/aios}
|
||||
branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}
|
||||
base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
|
||||
expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
|
||||
target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
|
||||
generation: {type: integer, minimum: 1}
|
||||
lease_seconds: {type: integer, minimum: 1, maximum: 86400}
|
||||
lease_expires_at: {type: string, format: date-time}
|
||||
create_target_branch: {type: boolean, const: false}
|
||||
worktree_mode: {type: string, enum: [detached_at_base_oid, detached_at_expected_head]}
|
||||
cas_ref_update_required: {type: boolean, const: true}
|
||||
recovered: {type: boolean}
|
||||
bootstrapped: {type: boolean}
|
||||
idempotent: {type: boolean}
|
||||
runtime_rehydrated: {type: boolean}
|
||||
durable_branch_lease_present: {type: boolean}
|
||||
BridgeCommitFileRequest:
|
||||
type: object
|
||||
additionalProperties: false
|
||||
required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, path, content_base64, message]
|
||||
properties:
|
||||
task_id: {type: string, minLength: 1}
|
||||
job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
|
||||
repository: {type: string, const: aios/aios}
|
||||
expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
|
||||
target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
|
||||
generation: {type: integer, minimum: 1}
|
||||
idempotency_key: {type: string, minLength: 1, maxLength: 256}
|
||||
path: {type: string, minLength: 1, maxLength: 512}
|
||||
content_base64: {type: string, format: byte}
|
||||
message: {type: string, minLength: 1, maxLength: 200}
|
||||
BridgeCommitFilesRequest:
|
||||
type: object
|
||||
additionalProperties: false
|
||||
required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, files, message]
|
||||
properties:
|
||||
task_id: {type: string, minLength: 1}
|
||||
job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
|
||||
repository: {type: string, const: aios/aios}
|
||||
expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
|
||||
target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
|
||||
generation: {type: integer, minimum: 1}
|
||||
idempotency_key: {type: string, minLength: 1, maxLength: 256}
|
||||
files: {type: object, additionalProperties: {type: string, format: byte}, minProperties: 1}
|
||||
message: {type: string, minLength: 1, maxLength: 200}
|
||||
BridgeCommitResponse:
|
||||
type: object
|
||||
additionalProperties: true
|
||||
required: [job_id, commit_oid, commit_visible, branch_mode, target_branch, generation]
|
||||
properties:
|
||||
job_id: {type: string, pattern: '^job-[A-Za-z0-9][A-Za-z0-9._-]{7,255}$'}
|
||||
commit_oid: {type: string, pattern: '^[0-9a-f]{40}$'}
|
||||
commit_visible: {type: boolean}
|
||||
branch_mode: {type: string, enum: [CONTINUE_EXISTING]}
|
||||
target_branch: {type: string, pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'}
|
||||
generation: {type: integer, minimum: 1}
|
||||
BridgeGovernedCapabilities:
|
||||
type: object
|
||||
required: [bridge_schema_version, governed_writes_enabled, operations, operation_contracts]
|
||||
properties:
|
||||
bridge_schema_version: {type: string, const: aios.chatgpt-gitops-bridge.v2}
|
||||
governed_writes_enabled: {type: boolean, const: true}
|
||||
operations: {type: array, items: {type: string}}
|
||||
operation_contracts: {type: object, additionalProperties: true}
|
||||
paths:
|
||||
/createReleaseIntent:
|
||||
post:
|
||||
@@ -675,118 +567,53 @@ paths:
|
||||
'200': {description: Safe GitOps plan}
|
||||
'401': {description: Unauthorized}
|
||||
x-openai-isConsequential: true
|
||||
/v2/capabilities:
|
||||
/api/v2/governed-capabilities:
|
||||
get:
|
||||
operationId: getGovernedWriteCapabilities
|
||||
summary: Read the governed Bridge v2 capability contract
|
||||
responses:
|
||||
'200':
|
||||
description: Governed operations and their request/response contracts
|
||||
content:
|
||||
application/json:
|
||||
schema: {$ref: '#/components/schemas/BridgeGovernedCapabilities'}
|
||||
/v2/writer-lease:
|
||||
responses: {'200': {description: Governed write capabilities with legacy writes disabled}}
|
||||
/api/v2/governed-task:
|
||||
post:
|
||||
operationId: createGovernedTask
|
||||
requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [task_id, repository, base_oid, target_branch, risk, description, idempotency_key], properties: {task_id: {type: string}, repository: {type: string, const: aios/aios}, base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}, target_branch: {type: string, pattern: '^agent/'}, risk: {type: string}, description: {type: string}, idempotency_key: {type: string}}}}}}
|
||||
responses: {'200': {description: Exact governed task binding}}
|
||||
x-openai-isConsequential: true
|
||||
/api/v2/writer-lease:
|
||||
post:
|
||||
operationId: acquireWriterLease
|
||||
summary: Acquire the exact governed writer lease for a task generation
|
||||
security: [{bearerAuth: []}]
|
||||
requestBody:
|
||||
required: true
|
||||
content:
|
||||
application/json:
|
||||
schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
|
||||
responses:
|
||||
'200':
|
||||
description: Exact detached worktree lease binding
|
||||
content:
|
||||
application/json:
|
||||
schema: {$ref: '#/components/schemas/BridgeWriterLeaseResponse'}
|
||||
'400': {description: Invalid lease binding}
|
||||
'409': {description: Branch, base, or generation conflict}
|
||||
requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [schema, task_id, repository, branch_mode, base_oid, expected_branch_oid, target_branch, generation, lease_seconds], properties: {schema: {type: string}, task_id: {type: string}, repository: {type: string, const: aios/aios}, branch_mode: {type: string, enum: [CREATE_NEW, CONTINUE_EXISTING]}, base_oid: {type: string, pattern: '^[0-9a-f]{40}$'}, expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}, target_branch: {type: string, pattern: '^agent/'}, generation: {type: integer, minimum: 1}, lease_seconds: {type: integer, minimum: 1, maximum: 86400}}}}}}
|
||||
responses: {'200': {description: Detached CONTINUE_EXISTING lease}}
|
||||
x-openai-isConsequential: true
|
||||
/v2/writer-lease/bootstrap:
|
||||
post:
|
||||
operationId: bootstrapWriterLease
|
||||
summary: Bootstrap a governed writer runtime without creating a durable lease
|
||||
description: >
|
||||
Staging-only runtime recovery. It validates the exact task, repository,
|
||||
base OID, expected branch OID, target branch, and generation. It must
|
||||
not create a branch, insert a branch lease, or consume a generation.
|
||||
security: [{bearerAuth: []}]
|
||||
requestBody:
|
||||
required: true
|
||||
content:
|
||||
application/json:
|
||||
schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
|
||||
responses:
|
||||
'200':
|
||||
description: Runtime binding bootstrapped or returned idempotently
|
||||
content:
|
||||
application/json:
|
||||
schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryResponse'}
|
||||
'400': {description: Invalid lease binding}
|
||||
'409': {description: A matching durable lease already exists or binding conflicts}
|
||||
'503': {description: Runtime or durable state unavailable}
|
||||
x-openai-isConsequential: true
|
||||
/v2/writer-lease/renew:
|
||||
post:
|
||||
operationId: renewWriterLease
|
||||
summary: Recover an expired governed writer lease without changing its binding
|
||||
description: >
|
||||
Renews only the current task generation and exact repository, base OID,
|
||||
expected branch OID, and target branch. Durable renewal is revision-CAS
|
||||
protected; runtime rehydration is reported separately.
|
||||
security: [{bearerAuth: []}]
|
||||
requestBody:
|
||||
required: true
|
||||
content:
|
||||
application/json:
|
||||
schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryRequest'}
|
||||
responses:
|
||||
'200':
|
||||
description: Lease recovered or idempotently observed as already active
|
||||
content:
|
||||
application/json:
|
||||
schema: {$ref: '#/components/schemas/BridgeWriterLeaseRecoveryResponse'}
|
||||
'400': {description: Invalid schema, generation, or lease duration}
|
||||
'409': {description: Task, base, repository, branch, generation, or durable lease conflict}
|
||||
'503': {description: Durable job store or runtime unavailable}
|
||||
x-openai-isConsequential: true
|
||||
/v2/commit-file:
|
||||
/api/v2/commit-file:
|
||||
post:
|
||||
operationId: commitFileGoverned
|
||||
summary: Commit one file through the governed writer lease
|
||||
security: [{bearerAuth: []}]
|
||||
requestBody:
|
||||
required: true
|
||||
content:
|
||||
application/json:
|
||||
schema: {$ref: '#/components/schemas/BridgeCommitFileRequest'}
|
||||
responses:
|
||||
'200':
|
||||
description: Authority and remote visibility receipt
|
||||
content:
|
||||
application/json:
|
||||
schema: {$ref: '#/components/schemas/BridgeCommitResponse'}
|
||||
'409': {description: Lease, expected-head, idempotency, or repository conflict}
|
||||
'503': {description: Reconciliation required}
|
||||
requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, path, content_base64, message], properties: {task_id: {type: string}, repository: {type: string, const: aios/aios}, expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}, target_branch: {type: string, pattern: '^agent/'}, generation: {type: integer, minimum: 1}, idempotency_key: {type: string}, path: {type: string}, content_base64: {type: string}, message: {type: string}}}}}}
|
||||
responses: {'202': {description: Durable governed Job}}
|
||||
x-openai-isConsequential: true
|
||||
/v2/commit-files:
|
||||
/api/v2/commit-files:
|
||||
post:
|
||||
operationId: commitFilesGoverned
|
||||
summary: Atomically commit a bounded set of files through the governed writer lease
|
||||
security: [{bearerAuth: []}]
|
||||
requestBody:
|
||||
required: true
|
||||
content:
|
||||
application/json:
|
||||
schema: {$ref: '#/components/schemas/BridgeCommitFilesRequest'}
|
||||
responses:
|
||||
'200':
|
||||
description: Authority and remote visibility receipt
|
||||
content:
|
||||
application/json:
|
||||
schema: {$ref: '#/components/schemas/BridgeCommitResponse'}
|
||||
'409': {description: Lease, expected-head, idempotency, or repository conflict}
|
||||
'503': {description: Reconciliation required}
|
||||
requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [task_id, repository, expected_branch_oid, target_branch, generation, idempotency_key, files, message], properties: {task_id: {type: string}, repository: {type: string, const: aios/aios}, expected_branch_oid: {type: string, pattern: '^[0-9a-f]{40}$'}, target_branch: {type: string, pattern: '^agent/'}, generation: {type: integer, minimum: 1}, idempotency_key: {type: string}, files: {type: object, additionalProperties: {type: string}}, message: {type: string}}}}}}
|
||||
responses: {'202': {description: One atomic multi-file governed Job}}
|
||||
x-openai-isConsequential: true
|
||||
/api/v2/job:
|
||||
post:
|
||||
operationId: getGitOpsJob
|
||||
requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [job_id], properties: {job_id: {type: string}}}}}}
|
||||
responses: {'200': {description: Non-sensitive Job metadata}}
|
||||
/api/v2/job/resume:
|
||||
post:
|
||||
operationId: resumeGitOpsJob
|
||||
requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [job_id, expected_revision], properties: {job_id: {type: string}, expected_revision: {type: integer, minimum: 0}}}}}}
|
||||
responses: {'202': {description: Revision-CAS resume}}
|
||||
x-openai-isConsequential: true
|
||||
/api/v2/job/reconcile:
|
||||
post:
|
||||
operationId: reconcileGitOpsJob
|
||||
requestBody: {required: true, content: {application/json: {schema: {type: object, additionalProperties: false, required: [job_id, expected_revision], properties: {job_id: {type: string}, expected_revision: {type: integer, minimum: 0}}}}}}
|
||||
responses: {'202': {description: Observation-first reconciliation}}
|
||||
x-openai-isConsequential: true
|
||||
|
||||
/v2/control-plane-snapshot:
|
||||
get:
|
||||
operationId: getControlPlaneSnapshot
|
||||
responses: {'200': {description: Non-sensitive control-plane snapshot}}
|
||||
|
||||
@@ -1,54 +0,0 @@
|
||||
# R4.2 P0-A TaskPlane Scope Isolation Design
|
||||
|
||||
Status: approved candidate design. This document is not evidence of a protected-main merge or production deployment.
|
||||
|
||||
## Boundary
|
||||
|
||||
- Task: `r42-p0a-taskplane-scope-isolation-20260816`
|
||||
- Governed Job: `job-3fd743b51971c6007923699c1233f84c`
|
||||
- Repository: `aios/aios`
|
||||
- Base: `0eb6e1a864edfdaeef37b438991707a110e21558`
|
||||
- Target branch: `agent/r42-p0a-taskplane-scope-isolation-20260816`
|
||||
- Generation: `1`
|
||||
|
||||
The implementation reuses this exact boundary. It does not create a replacement Task, Job, branch, generation, or idempotency key.
|
||||
|
||||
## Model and invariants
|
||||
|
||||
`TaskPlan` gains first-class `scope_type`, `tenant_id`, `user_id`, `project_id`, `conversation_id`, and `run_id` fields. The fields participate in accepted-key validation, parsing, serialization, persistence, and authorization.
|
||||
|
||||
Historical rows without scope data normalize to `scope_type=legacy`; no tenant is inferred. Tenant-scoped tasks require a non-empty `tenant_id`. System/global resources use an explicit `scope_type=system` invariant and do not receive a fabricated tenant. A task may add user, project, conversation, and run ownership within its tenant.
|
||||
|
||||
## Trusted ActorContext
|
||||
|
||||
TaskPlane defines a small immutable `TaskActorContext` used only for authorization. The HTTP authenticator returns an identity. `PolicyEngine` resolves that identity through server-owned policy configuration into the effective context and capabilities. Request fields such as `tenant_id`, `user_id`, `group_id`, and `role` are declarations only and never expand authority.
|
||||
|
||||
Public create, list, and get paths always use the resolved context. Internal compatibility calls may omit a context and retain explicit legacy behavior, but the HTTP adapter never uses that path.
|
||||
|
||||
## Persistence
|
||||
|
||||
SQLite remains the current runtime. `_create_schema()` performs an idempotent forward migration that adds the six scope columns and indexes, then backfills only missing `scope_type` values to `legacy`.
|
||||
|
||||
New writes persist scope in both the canonical `task_json` representation and first-class columns. Reads accept historical JSON without scope, using legacy columns, but reject a new-row mismatch between JSON and columns. SQL list/get predicates are parameterized and applied before row hydration.
|
||||
|
||||
PostgreSQL remains a separate migration target and is not claimed by this change.
|
||||
|
||||
## Authorization flow
|
||||
|
||||
1. HTTP bearer authentication yields an identity.
|
||||
2. `PolicyEngine` verifies capability and resolves the identity to `TaskActorContext`.
|
||||
3. Create binds the requested scope to the trusted context and rejects mismatches.
|
||||
4. List/get pass the trusted context to `TaskPlaneStore`.
|
||||
5. Store applies tenant and ownership predicates in SQL; privileged capabilities may explicitly cross scope.
|
||||
|
||||
Tenant actors cannot read legacy tasks, another tenant, or mismatched owned resources. Legacy actors can only read legacy tasks. System actors require explicit privileged capability for cross-scope access.
|
||||
|
||||
## Failure behavior
|
||||
|
||||
Missing tenant scope, forged scope, unknown scope types, JSON/column divergence, and unauthorized list/get operations fail closed with canonical TaskPlane errors. Public get does not reveal whether an out-of-scope task exists.
|
||||
|
||||
## Verification
|
||||
|
||||
Tests exercise real model round trips, SQLite migration/restart, Service/Policy/Store wiring, tenant A versus tenant B list/get denial, ownership filtering, forged create payload rejection, legacy isolation, privileged access, and SQL parameterization. Existing TaskPlane API, RBAC, recovery/security, and security-contract suites remain mandatory.
|
||||
|
||||
The candidate is complete only after real `TASK_CLAIMED`, `TASK_HEARTBEAT`, exact WriterLease, governed commit, OID convergence, result submission, and `TASK_VERIFIED`. Protected main and production remain unchanged.
|
||||
@@ -1,9 +0,0 @@
|
||||
# R4.2 P0-A TaskPlane Scope Isolation
|
||||
|
||||
Status: candidate implementation. This is not proof of protected-main promotion or production deployment.
|
||||
|
||||
Task scope is now represented by `scope_type`, `tenant_id`, `user_id`, `project_id`, `conversation_id`, and `run_id` in the model and SQLite persistence. Historical rows become `legacy`; their tenant is never guessed. Tenant tasks require `tenant_id`. System resources use `scope_type=system` without a fabricated tenant.
|
||||
|
||||
The HTTP adapter uses the authenticated identity. `PolicyEngine` resolves that identity through server-owned `identity_actor_contexts`; request payload fields do not grant scope. Public create binds the trusted scope, and public list/get apply parameterized scope predicates in `TaskPlaneStore`.
|
||||
|
||||
SQLite is the current runtime database. PostgreSQL remains a separate migration and runtime-acceptance gate.
|
||||
@@ -1,38 +0,0 @@
|
||||
# R4.2 P0-B — Durable Message / Handoff Fabric
|
||||
|
||||
Status: candidate implementation; not evidence of protected-main merge or Production deployment.
|
||||
|
||||
`MessageEnvelope` is the single durable handoff identity and carries source/target/type, tenant/user/
|
||||
project/conversation/task/run scope, causation, sequence, capability scope, confidentiality scope,
|
||||
idempotency key, expiry and delivery state.
|
||||
|
||||
Identity includes **target + scope + sequence + idempotency key + payload hash**, fixing the existing
|
||||
AgentEventBus target collision. Server ActorContext is authoritative; caller scope may narrow but may
|
||||
not widen/forge trusted tenant/user/project/conversation/run fields.
|
||||
|
||||
`DurableHandoffStore` provides SQLite durability in the current runtime. Each logical stream has
|
||||
unique `(stream_key, idempotency_key)` and `(stream_key, sequence)`. Exact retry returns `REPLAY`;
|
||||
changed payload under the same key is rejected; sequence gaps are rejected; expired messages are not
|
||||
delivered.
|
||||
|
||||
Confidentiality scopes:
|
||||
|
||||
- public: no tenant requirement
|
||||
- tenant: same tenant
|
||||
- project: same tenant + project
|
||||
- private: same tenant + project + user
|
||||
- run: same tenant + project + user + run
|
||||
|
||||
Required `capability_scope` must be present on the authenticated delivery actor unless the actor is
|
||||
explicitly administrative.
|
||||
|
||||
Compatibility adapters convert AgentEventBus events, TaskPlane CloudEvents and legacy Agent OS
|
||||
MessageBus messages into the durable envelope. Existing message_outbox remains intact as a migration
|
||||
source; P0-B does not delete or silently rewrite it.
|
||||
|
||||
Required gates:
|
||||
`MESSAGE_SCOPE_MISMATCH_DENY`, `MESSAGE_TARGET_COLLISION_DENY`, `MESSAGE_IDEMPOTENCY_REPLAY`,
|
||||
`MESSAGE_SEQUENCE_GAP_DETECT`, `MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE`,
|
||||
`HANDOFF_CROSS_TENANT_DENY`, plus existing P0-A TaskPlane scope/security regressions.
|
||||
|
||||
SQLite remains current runtime persistence. PostgreSQL remains a separate migration gate.
|
||||
@@ -1,4 +0,0 @@
|
||||
[pytest]
|
||||
testpaths = tests
|
||||
python_files = test_*.py
|
||||
addopts = -ra --import-mode=importlib
|
||||
@@ -1,243 +0,0 @@
|
||||
{
|
||||
"authority_proof": {
|
||||
"branch_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"commit_visible": true,
|
||||
"main_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
|
||||
"v2r2c1_tag_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad"
|
||||
},
|
||||
"baseline_authority": {
|
||||
"artifact_sha256": "492338b895b152a55015fd92ea1d9dba2314894ab00c0ba219a78f3cef544b8a",
|
||||
"authority_sha256": "d8e23bad49bdb3e4192ba708c3dfe7fc5b7cdc6a513c2f87acd6412a51867231",
|
||||
"current_baseline": "V2R2C1",
|
||||
"raw_byte_sidecar_verification": "PASS",
|
||||
"target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad"
|
||||
},
|
||||
"control_plane_source_oid": "b781129bd5a8b53c05ab648361424d2800166ee4",
|
||||
"diff_stat": "active-runtime/app/aios_authority_git_executor.py | 24 +\n active-runtime/app/aios_chatgpt_actions_api.py | 48 +-\n active-runtime/app/aios_chatgpt_bridge_v2.py | 167 ++++\n .../app/aios_chatgpt_bridge_v2_server.py | 431 +++++++++\n active-runtime/app/aios_continuation_executor.py | 594 ++++++++++++\n active-runtime/app/aios_continuation_lease.py | 6 +\n active-runtime/app/aios_control_plane_snapshot.py | 26 +\n active-runtime/app/aios_credential_broker.py | 78 ++\n active-runtime/app/aios_gitea_publisher.py | 93 ++\n active-runtime/app/aios_gitops_job_controller.py | 16 +-\n .../app/aios_gitops_reconciliation_core.py | 80 ++\n active-runtime/app/aios_governed_policy.py | 59 ++\n active-runtime/app/aios_governed_task_bootstrap.py | 84 ++\n active-runtime/app/aios_model_api_staging.py | 1022 ++++++++++++++++++++\n .../app/authorized_task_writer_provisioning.py | 4 +-\n active-runtime/app/baseline_authority.py | 84 ++\n active-runtime/app/governed_production_release.py | 568 +++++++++++\n active-runtime/app/v2r2c1_production_adapter.py | 135 +++\n .../systemd/aios-chatgpt-bridge-v2-staging.service | 23 +\n .../aios-gitops-model-api-v2r2c1-staging.service | 51 +\n ...09-bridge-v2.1-durable-reconciliation-design.md | 15 +\n ...t-bridge-v2-control-plane-convergence-design.md | 150 +++\n pytest.ini | 4 +\n scripts/build_v2r2c1_model_api_staging.py | 145 +++\n .../aios_release_controller/manifest.py | 4 +-\n .../test_v2r1c6_release_consistency.py | 4 +-\n .../aios_v2_candidate/test_v2r1c6_release_ready.py | 16 +-\n tests/conftest.py | 65 ++\n tests/test_bridge_v2_governed_http_bootstrap.py | 90 ++\n tests/test_governed_local_writer.py | 6 +-\n tests/test_model_api_immutable_staging.py | 35 +\n 31 files changed, 4108 insertions(+), 19 deletions(-)",
|
||||
"evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
|
||||
"forbidden_operations": [
|
||||
"direct_main_push",
|
||||
"main_merge_without_owner_approval",
|
||||
"force_push",
|
||||
"tag_mutation",
|
||||
"baseline_mutation",
|
||||
"registry_mutation",
|
||||
"production_restart",
|
||||
"production_cutover",
|
||||
"live_model_api_cutover",
|
||||
"history_rewrite",
|
||||
"secret_commit"
|
||||
],
|
||||
"governance": {
|
||||
"baseline_modified": false,
|
||||
"direct_main_push": false,
|
||||
"force_push_used": false,
|
||||
"history_rewritten": false,
|
||||
"live_model_api_cutover": false,
|
||||
"main_merged": false,
|
||||
"owner_approval_respected": true,
|
||||
"production_changed": false,
|
||||
"production_restarted": false,
|
||||
"registry_modified": false,
|
||||
"secrets_committed": false,
|
||||
"tag_rewritten": false
|
||||
},
|
||||
"included_path_count": 31,
|
||||
"integration_branch": "agent/v2r2c1-post-release-mainline-convergence-20260809",
|
||||
"integration_head_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"logical_commits": [
|
||||
{
|
||||
"message": "feat(v2r2c1): converge durable control-plane core",
|
||||
"oid": "40b685d1c70c767c7a79a2b184348e58e3e319ae",
|
||||
"parent_oid": "2e8fa22989808a448065d1d76b5b18948774a637"
|
||||
},
|
||||
{
|
||||
"message": "docs(v2r2c1): converge durable runtime and design sources",
|
||||
"oid": "5f616311bab38b0dac296ed8b0e69660e031a20e",
|
||||
"parent_oid": "40b685d1c70c767c7a79a2b184348e58e3e319ae"
|
||||
},
|
||||
{
|
||||
"message": "feat(v2r2c1): integrate governed release overlay",
|
||||
"oid": "57780e316e320a5128cc2c9f12adbb19ae57aef5",
|
||||
"parent_oid": "5f616311bab38b0dac296ed8b0e69660e031a20e"
|
||||
},
|
||||
{
|
||||
"message": "feat(v2r2c1): wire governed release operations into durable bridge",
|
||||
"oid": "e41b8d323a3e7a40440f5d32221f524074bea5fe",
|
||||
"parent_oid": "57780e316e320a5128cc2c9f12adbb19ae57aef5"
|
||||
},
|
||||
{
|
||||
"message": "test: repair canonical pytest repository entrypoint",
|
||||
"oid": "b20cb8130e4c68267d5d85b02eed51cb8d4f41c0",
|
||||
"parent_oid": "e41b8d323a3e7a40440f5d32221f524074bea5fe"
|
||||
},
|
||||
{
|
||||
"message": "test: make whole-suite collection deterministic",
|
||||
"oid": "c6a1693efaede9dace9b929d884a09e162a02c89",
|
||||
"parent_oid": "b20cb8130e4c68267d5d85b02eed51cb8d4f41c0"
|
||||
},
|
||||
{
|
||||
"message": "test: preserve legacy suite imports under canonical collection",
|
||||
"oid": "91f2ea0591787d3dbf8c2e27ab0460629d86900e",
|
||||
"parent_oid": "c6a1693efaede9dace9b929d884a09e162a02c89"
|
||||
},
|
||||
{
|
||||
"message": "test: expose repository test helpers to canonical collection",
|
||||
"oid": "85897d3f6d708271dff16767265f9d14b2f29801",
|
||||
"parent_oid": "91f2ea0591787d3dbf8c2e27ab0460629d86900e"
|
||||
},
|
||||
{
|
||||
"message": "fix(v2r2c1): close slash-branch and suite contract regressions",
|
||||
"oid": "f1110d24f30d8441f2df04e0774ee230b95c2e02",
|
||||
"parent_oid": "85897d3f6d708271dff16767265f9d14b2f29801"
|
||||
},
|
||||
{
|
||||
"message": "test: align writer regression with durable idempotent replay",
|
||||
"oid": "c10d2a5dfcc394dde7a7022952d7b423725747a3",
|
||||
"parent_oid": "f1110d24f30d8441f2df04e0774ee230b95c2e02"
|
||||
},
|
||||
{
|
||||
"message": "feat(v2r2c1): source baseline authority for model-api staging",
|
||||
"oid": "f969aedaf61501a866435c712be01ff2cfe43fb1",
|
||||
"parent_oid": "c10d2a5dfcc394dde7a7022952d7b423725747a3"
|
||||
},
|
||||
{
|
||||
"message": "feat(v2r2c1): add immutable model api staging runtime",
|
||||
"oid": "4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b",
|
||||
"parent_oid": "f969aedaf61501a866435c712be01ff2cfe43fb1"
|
||||
},
|
||||
{
|
||||
"message": "fix(v2r2c1): avoid builder secret-scan false positives",
|
||||
"oid": "7c4e86bfc1f39e643e672968d1fdedbd72ace56d",
|
||||
"parent_oid": "4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b"
|
||||
},
|
||||
{
|
||||
"message": "fix(v2r2c1): isolate model api staging port",
|
||||
"oid": "7564363a30bfa7fa81ac5c7c545ec704984ec543",
|
||||
"parent_oid": "7c4e86bfc1f39e643e672968d1fdedbd72ace56d"
|
||||
},
|
||||
{
|
||||
"message": "fix(v2r2c1): bind baseline authority and openapi staging path",
|
||||
"oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"parent_oid": "7564363a30bfa7fa81ac5c7c545ec704984ec543"
|
||||
}
|
||||
],
|
||||
"main_base_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
|
||||
"mandatory_gates": {
|
||||
"baseline_registry_readback_staging_pass": true,
|
||||
"durable_source_path_manifest_complete": true,
|
||||
"existing_v2r2c1_suite_pass": true,
|
||||
"governed_release_suite_pass": true,
|
||||
"integration_authority_git_api_equal": true,
|
||||
"integration_branch_governed": true,
|
||||
"logical_slice_commits_remote_verified": true,
|
||||
"main_base_exact_before_branch_create": true,
|
||||
"model_api_immutable_runtime_staging_pass": true,
|
||||
"owner_merge_request_generated_execute_false": true,
|
||||
"production_unchanged": true,
|
||||
"pytest_collection_entrypoints_fixed": true,
|
||||
"pytest_tests_results_recorded": true
|
||||
},
|
||||
"model_api_staging": {
|
||||
"artifact_sha256": "492338b895b152a55015fd92ea1d9dba2314894ab00c0ba219a78f3cef544b8a",
|
||||
"baseline": {
|
||||
"authority_sha256": "d8e23bad49bdb3e4192ba708c3dfe7fc5b7cdc6a513c2f87acd6412a51867231",
|
||||
"current_baseline": "V2R2C1",
|
||||
"deployment_state": "ACTIVE",
|
||||
"evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
|
||||
"generation": 4,
|
||||
"previous_baseline": "V2R1C7",
|
||||
"production_deployed": true,
|
||||
"status": "PRODUCTION_DEPLOYED",
|
||||
"tag_oid": "07fc2746b688f5f243f29b39de39f32edc3dd9d2",
|
||||
"target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad"
|
||||
},
|
||||
"baseline_status": 200,
|
||||
"deployment_state": "STAGING",
|
||||
"health": {
|
||||
"artifact_sha256": "492338b895b152a55015fd92ea1d9dba2314894ab00c0ba219a78f3cef544b8a",
|
||||
"commit_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"deployment_state": "STAGING",
|
||||
"governed_release_routing": "bridge-v2",
|
||||
"legacy_global_writes_enabled": false,
|
||||
"production_deployed": false,
|
||||
"runtime_mode": "IMMUTABLE_STAGING",
|
||||
"status": "ok",
|
||||
"version": "V2R2C1"
|
||||
},
|
||||
"health_status": 200,
|
||||
"legacy_write_probe": "423_BLOCKED",
|
||||
"port": 18893,
|
||||
"restart_acceptance": "PASS",
|
||||
"runtime_root": "/opt/aios/gitops-model-api/2c6293160ed567a2098715edbb296741577c5bff/runtime",
|
||||
"source_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"systemd": "MainPID=788782\nExecStart={ path=/usr/bin/python3 ; argv[]=/usr/bin/python3 /opt/aios/gitops-model-api/2c6293160ed567a2098715edbb296741577c5bff/runtime/app/aios_model_api_staging.py ; ignore_errors=no ; start_time=[Sun 2026-08-09 19:11:19 CST] ; stop_time=[n/a] ; pid=788782 ; code=(null) ; status=0/0 }\nActiveState=active\nSubState=running",
|
||||
"unit": "aios-gitops-model-api-v2r2c1-staging.service",
|
||||
"versions": {
|
||||
"authoritative_head_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
|
||||
"baseline_generation": 4,
|
||||
"baseline_sha256": "d8e23bad49bdb3e4192ba708c3dfe7fc5b7cdc6a513c2f87acd6412a51867231",
|
||||
"baseline_version": "V2R2C1",
|
||||
"query_error": null
|
||||
},
|
||||
"versions_status": 200
|
||||
},
|
||||
"owner_merge_request": {
|
||||
"control_plane_source_oid": "b781129bd5a8b53c05ab648361424d2800166ee4",
|
||||
"execute": false,
|
||||
"integration_head_oid": "b2cf510e11b712bb99f20ded81459b6524257394",
|
||||
"main_expected_old_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
|
||||
"release_target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
|
||||
"report_commit_oid": "b2cf510e11b712bb99f20ded81459b6524257394",
|
||||
"status": "OWNER_APPROVAL_REQUIRED"
|
||||
},
|
||||
"placeholder_fields": [],
|
||||
"production": {
|
||||
"baseline_mutation": false,
|
||||
"health": {
|
||||
"artifact_sha256": "ab4ae257346c82863f05abf5e309381a1c86612957608c3a4f4ab5cc9233f052",
|
||||
"commit_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
|
||||
"deployment_state": "ACTIVE",
|
||||
"health_timestamp": "2026-08-09T11:21:16.872581+00:00",
|
||||
"production_deployed": true,
|
||||
"status": "ok",
|
||||
"version": "V2R2C1"
|
||||
},
|
||||
"health_status": 200,
|
||||
"live_model_api_show": "MainPID=2816107\nActiveState=active\nSubState=running",
|
||||
"live_model_api_unchanged": true,
|
||||
"production_cutover": false,
|
||||
"production_restart": false,
|
||||
"registry_mutation": false,
|
||||
"shadow_service_unchanged": true,
|
||||
"shadow_show": "MainPID=1505658\nActiveState=active\nSubState=running",
|
||||
"tag_mutation": false
|
||||
},
|
||||
"release_target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
|
||||
"remote_proof": {
|
||||
"api_branch_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"api_verification": "paginated_exact_name",
|
||||
"commit_visible": true,
|
||||
"git_remote_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"main_api_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
|
||||
"main_git_oid": "2e8fa22989808a448065d1d76b5b18948774a637"
|
||||
},
|
||||
"report_commit_parent_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"repository": "aios/aios",
|
||||
"schema": "aios.v2r2c1.post-release-mainline-convergence.acceptance.v1",
|
||||
"status": "V2R2C1_MAINLINE_CONVERGENCE_READY_FOR_OWNER_MERGE",
|
||||
"success_status": "V2R2C1_MAINLINE_CONVERGENCE_READY_FOR_OWNER_MERGE",
|
||||
"task_id": "TASK-P0-V2R2C1-POST-RELEASE-MAINLINE-CONVERGENCE-20260809",
|
||||
"tests": {
|
||||
"collection": "PASS",
|
||||
"command": "pytest tests",
|
||||
"failed": 0,
|
||||
"passed": 709,
|
||||
"skipped": 2,
|
||||
"skipped_tests": [
|
||||
"tests/test_gitea_tag_publication_live.py (live opt-in)",
|
||||
"tests/test_signer_contract_compatibility.py (live integration opt-in)"
|
||||
],
|
||||
"subtests": 154
|
||||
}
|
||||
}
|
||||
@@ -1,89 +0,0 @@
|
||||
# V2R2C1 post-release mainline convergence diff summary
|
||||
|
||||
- task: `TASK-P0-V2R2C1-POST-RELEASE-MAINLINE-CONVERGENCE-20260809`
|
||||
- repository: `aios/aios`
|
||||
- main base: `2e8fa22989808a448065d1d76b5b18948774a637`
|
||||
- release target: `998d30304787e31e5ae607c0bd86b5edb2b0e5ad`
|
||||
- control-plane source: `b781129bd5a8b53c05ab648361424d2800166ee4`
|
||||
- implementation integration head before this report commit: `2c6293160ed567a2098715edbb296741577c5bff`
|
||||
- branch: `agent/v2r2c1-post-release-mainline-convergence-20260809`
|
||||
|
||||
## Logical governed commits
|
||||
|
||||
| OID | Parent | Message |
|
||||
|---|---|---|
|
||||
| `40b685d1c70c767c7a79a2b184348e58e3e319ae` | `2e8fa22989808a448065d1d76b5b18948774a637` | feat(v2r2c1): converge durable control-plane core |
|
||||
| `5f616311bab38b0dac296ed8b0e69660e031a20e` | `40b685d1c70c767c7a79a2b184348e58e3e319ae` | docs(v2r2c1): converge durable runtime and design sources |
|
||||
| `57780e316e320a5128cc2c9f12adbb19ae57aef5` | `5f616311bab38b0dac296ed8b0e69660e031a20e` | feat(v2r2c1): integrate governed release overlay |
|
||||
| `e41b8d323a3e7a40440f5d32221f524074bea5fe` | `57780e316e320a5128cc2c9f12adbb19ae57aef5` | feat(v2r2c1): wire governed release operations into durable bridge |
|
||||
| `b20cb8130e4c68267d5d85b02eed51cb8d4f41c0` | `e41b8d323a3e7a40440f5d32221f524074bea5fe` | test: repair canonical pytest repository entrypoint |
|
||||
| `c6a1693efaede9dace9b929d884a09e162a02c89` | `b20cb8130e4c68267d5d85b02eed51cb8d4f41c0` | test: make whole-suite collection deterministic |
|
||||
| `91f2ea0591787d3dbf8c2e27ab0460629d86900e` | `c6a1693efaede9dace9b929d884a09e162a02c89` | test: preserve legacy suite imports under canonical collection |
|
||||
| `85897d3f6d708271dff16767265f9d14b2f29801` | `91f2ea0591787d3dbf8c2e27ab0460629d86900e` | test: expose repository test helpers to canonical collection |
|
||||
| `f1110d24f30d8441f2df04e0774ee230b95c2e02` | `85897d3f6d708271dff16767265f9d14b2f29801` | fix(v2r2c1): close slash-branch and suite contract regressions |
|
||||
| `c10d2a5dfcc394dde7a7022952d7b423725747a3` | `f1110d24f30d8441f2df04e0774ee230b95c2e02` | test: align writer regression with durable idempotent replay |
|
||||
| `f969aedaf61501a866435c712be01ff2cfe43fb1` | `c10d2a5dfcc394dde7a7022952d7b423725747a3` | feat(v2r2c1): source baseline authority for model-api staging |
|
||||
| `4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b` | `f969aedaf61501a866435c712be01ff2cfe43fb1` | feat(v2r2c1): add immutable model api staging runtime |
|
||||
| `7c4e86bfc1f39e643e672968d1fdedbd72ace56d` | `4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b` | fix(v2r2c1): avoid builder secret-scan false positives |
|
||||
| `7564363a30bfa7fa81ac5c7c545ec704984ec543` | `7c4e86bfc1f39e643e672968d1fdedbd72ace56d` | fix(v2r2c1): isolate model api staging port |
|
||||
| `2c6293160ed567a2098715edbb296741577c5bff` | `7564363a30bfa7fa81ac5c7c545ec704984ec543` | fix(v2r2c1): bind baseline authority and openapi staging path |
|
||||
|
||||
## Exact diff stat
|
||||
|
||||
```text
|
||||
active-runtime/app/aios_authority_git_executor.py | 24 +
|
||||
active-runtime/app/aios_chatgpt_actions_api.py | 48 +-
|
||||
active-runtime/app/aios_chatgpt_bridge_v2.py | 167 ++++
|
||||
.../app/aios_chatgpt_bridge_v2_server.py | 431 +++++++++
|
||||
active-runtime/app/aios_continuation_executor.py | 594 ++++++++++++
|
||||
active-runtime/app/aios_continuation_lease.py | 6 +
|
||||
active-runtime/app/aios_control_plane_snapshot.py | 26 +
|
||||
active-runtime/app/aios_credential_broker.py | 78 ++
|
||||
active-runtime/app/aios_gitea_publisher.py | 93 ++
|
||||
active-runtime/app/aios_gitops_job_controller.py | 16 +-
|
||||
.../app/aios_gitops_reconciliation_core.py | 80 ++
|
||||
active-runtime/app/aios_governed_policy.py | 59 ++
|
||||
active-runtime/app/aios_governed_task_bootstrap.py | 84 ++
|
||||
active-runtime/app/aios_model_api_staging.py | 1022 ++++++++++++++++++++
|
||||
.../app/authorized_task_writer_provisioning.py | 4 +-
|
||||
active-runtime/app/baseline_authority.py | 84 ++
|
||||
active-runtime/app/governed_production_release.py | 568 +++++++++++
|
||||
active-runtime/app/v2r2c1_production_adapter.py | 135 +++
|
||||
.../systemd/aios-chatgpt-bridge-v2-staging.service | 23 +
|
||||
.../aios-gitops-model-api-v2r2c1-staging.service | 51 +
|
||||
...09-bridge-v2.1-durable-reconciliation-design.md | 15 +
|
||||
...t-bridge-v2-control-plane-convergence-design.md | 150 +++
|
||||
pytest.ini | 4 +
|
||||
scripts/build_v2r2c1_model_api_staging.py | 145 +++
|
||||
.../aios_release_controller/manifest.py | 4 +-
|
||||
.../test_v2r1c6_release_consistency.py | 4 +-
|
||||
.../aios_v2_candidate/test_v2r1c6_release_ready.py | 16 +-
|
||||
tests/conftest.py | 65 ++
|
||||
tests/test_bridge_v2_governed_http_bootstrap.py | 90 ++
|
||||
tests/test_governed_local_writer.py | 6 +-
|
||||
tests/test_model_api_immutable_staging.py | 35 +
|
||||
31 files changed, 4108 insertions(+), 19 deletions(-)
|
||||
```
|
||||
|
||||
## Included durable source domains
|
||||
|
||||
- Bridge v2 adapter/server and governed HTTP contracts.
|
||||
- Durable reconciliation core, continuation executor/lease, Authority Git CAS adapter, job controller compatibility.
|
||||
- Gitea publisher/verifier, credential broker, governed policy, control-plane snapshot, release routing.
|
||||
- Canonical pytest entrypoint/conftest and regression coverage.
|
||||
- Source-controlled immutable model-api staging runtime, builder and systemd template.
|
||||
- Selected design specifications required for durable mainline context.
|
||||
|
||||
## Explicitly excluded
|
||||
|
||||
- `main` ref mutation or merge without Owner approval.
|
||||
- Production service, Registry, Baseline body/sidecar, production tags and mutable `/var/lib` state.
|
||||
- Installed `/opt` artifacts, temporary staging transition state and task-local receipts/credentials.
|
||||
- Production cutover/restart, force push, history rewrite and plaintext secrets.
|
||||
|
||||
## Verification
|
||||
|
||||
- `pytest tests`: **709 passed, 2 skipped, 154 subtests, 0 failed**.
|
||||
- Staging model-api: immutable OID/digest bound, port 18893, health/base/ver/OpenAPI readback PASS, restart recovery PASS.
|
||||
- Authority/Gitea Git/Gitea API commit equality and commit visibility PASS.
|
||||
- Production remains V2R2C1 and was not restarted or cut over.
|
||||
@@ -1,254 +0,0 @@
|
||||
{
|
||||
"control_plane_source_oid": "b781129bd5a8b53c05ab648361424d2800166ee4",
|
||||
"diff_stat": "active-runtime/app/aios_authority_git_executor.py | 24 +\n active-runtime/app/aios_chatgpt_actions_api.py | 48 +-\n active-runtime/app/aios_chatgpt_bridge_v2.py | 167 ++++\n .../app/aios_chatgpt_bridge_v2_server.py | 431 +++++++++\n active-runtime/app/aios_continuation_executor.py | 594 ++++++++++++\n active-runtime/app/aios_continuation_lease.py | 6 +\n active-runtime/app/aios_control_plane_snapshot.py | 26 +\n active-runtime/app/aios_credential_broker.py | 78 ++\n active-runtime/app/aios_gitea_publisher.py | 93 ++\n active-runtime/app/aios_gitops_job_controller.py | 16 +-\n .../app/aios_gitops_reconciliation_core.py | 80 ++\n active-runtime/app/aios_governed_policy.py | 59 ++\n active-runtime/app/aios_governed_task_bootstrap.py | 84 ++\n active-runtime/app/aios_model_api_staging.py | 1022 ++++++++++++++++++++\n .../app/authorized_task_writer_provisioning.py | 4 +-\n active-runtime/app/baseline_authority.py | 84 ++\n active-runtime/app/governed_production_release.py | 568 +++++++++++\n active-runtime/app/v2r2c1_production_adapter.py | 135 +++\n .../systemd/aios-chatgpt-bridge-v2-staging.service | 23 +\n .../aios-gitops-model-api-v2r2c1-staging.service | 51 +\n ...09-bridge-v2.1-durable-reconciliation-design.md | 15 +\n ...t-bridge-v2-control-plane-convergence-design.md | 150 +++\n pytest.ini | 4 +\n scripts/build_v2r2c1_model_api_staging.py | 145 +++\n .../aios_release_controller/manifest.py | 4 +-\n .../test_v2r1c6_release_consistency.py | 4 +-\n .../aios_v2_candidate/test_v2r1c6_release_ready.py | 16 +-\n tests/conftest.py | 65 ++\n tests/test_bridge_v2_governed_http_bootstrap.py | 90 ++\n tests/test_governed_local_writer.py | 6 +-\n tests/test_model_api_immutable_staging.py | 35 +\n 31 files changed, 4108 insertions(+), 19 deletions(-)",
|
||||
"evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
|
||||
"excluded_paths": [
|
||||
{
|
||||
"path": "refs/heads/main",
|
||||
"reason": "main merge requires separate Owner approval; unchanged"
|
||||
},
|
||||
{
|
||||
"path": "refs/tags/*",
|
||||
"reason": "formal tags are outside engineering convergence scope; unchanged"
|
||||
},
|
||||
{
|
||||
"path": "baseline/current.json and sidecar",
|
||||
"reason": "production mutable authority and sidecar; read-only verified"
|
||||
},
|
||||
{
|
||||
"path": "/var/lib/aios-gitops/**",
|
||||
"reason": "host runtime state and receipts excluded from repository source"
|
||||
},
|
||||
{
|
||||
"path": "/opt/aios/**",
|
||||
"reason": "installed immutable staging artifacts excluded; digest recorded in reports"
|
||||
},
|
||||
{
|
||||
"path": "credentials and secrets",
|
||||
"reason": "availability-only; no plaintext credential committed"
|
||||
},
|
||||
{
|
||||
"path": "production runtime and Registry",
|
||||
"reason": "production cutover/registry mutation forbidden"
|
||||
}
|
||||
],
|
||||
"included_paths": [
|
||||
{
|
||||
"path": "active-runtime/app/aios_authority_git_executor.py",
|
||||
"status": "M"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_chatgpt_actions_api.py",
|
||||
"status": "M"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_chatgpt_bridge_v2.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_chatgpt_bridge_v2_server.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_continuation_executor.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_continuation_lease.py",
|
||||
"status": "M"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_control_plane_snapshot.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_credential_broker.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_gitea_publisher.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_gitops_job_controller.py",
|
||||
"status": "M"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_gitops_reconciliation_core.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_governed_policy.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_governed_task_bootstrap.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/aios_model_api_staging.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/authorized_task_writer_provisioning.py",
|
||||
"status": "M"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/baseline_authority.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/governed_production_release.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "active-runtime/app/v2r2c1_production_adapter.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "deploy/systemd/aios-chatgpt-bridge-v2-staging.service",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "deploy/systemd/aios-gitops-model-api-v2r2c1-staging.service",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "docs/superpowers/specs/2026-08-09-bridge-v2.1-durable-reconciliation-design.md",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "docs/superpowers/specs/2026-08-09-chatgpt-bridge-v2-control-plane-convergence-design.md",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "pytest.ini",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "scripts/build_v2r2c1_model_api_staging.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "services/aios-release-controller/aios_release_controller/manifest.py",
|
||||
"status": "M"
|
||||
},
|
||||
{
|
||||
"path": "tests/aios_v2_candidate/test_v2r1c6_release_consistency.py",
|
||||
"status": "M"
|
||||
},
|
||||
{
|
||||
"path": "tests/aios_v2_candidate/test_v2r1c6_release_ready.py",
|
||||
"status": "M"
|
||||
},
|
||||
{
|
||||
"path": "tests/conftest.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "tests/test_bridge_v2_governed_http_bootstrap.py",
|
||||
"status": "A"
|
||||
},
|
||||
{
|
||||
"path": "tests/test_governed_local_writer.py",
|
||||
"status": "M"
|
||||
},
|
||||
{
|
||||
"path": "tests/test_model_api_immutable_staging.py",
|
||||
"status": "A"
|
||||
}
|
||||
],
|
||||
"integration_branch": "agent/v2r2c1-post-release-mainline-convergence-20260809",
|
||||
"integration_head_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"logical_commits": [
|
||||
{
|
||||
"message": "feat(v2r2c1): converge durable control-plane core",
|
||||
"oid": "40b685d1c70c767c7a79a2b184348e58e3e319ae",
|
||||
"parent_oid": "2e8fa22989808a448065d1d76b5b18948774a637"
|
||||
},
|
||||
{
|
||||
"message": "docs(v2r2c1): converge durable runtime and design sources",
|
||||
"oid": "5f616311bab38b0dac296ed8b0e69660e031a20e",
|
||||
"parent_oid": "40b685d1c70c767c7a79a2b184348e58e3e319ae"
|
||||
},
|
||||
{
|
||||
"message": "feat(v2r2c1): integrate governed release overlay",
|
||||
"oid": "57780e316e320a5128cc2c9f12adbb19ae57aef5",
|
||||
"parent_oid": "5f616311bab38b0dac296ed8b0e69660e031a20e"
|
||||
},
|
||||
{
|
||||
"message": "feat(v2r2c1): wire governed release operations into durable bridge",
|
||||
"oid": "e41b8d323a3e7a40440f5d32221f524074bea5fe",
|
||||
"parent_oid": "57780e316e320a5128cc2c9f12adbb19ae57aef5"
|
||||
},
|
||||
{
|
||||
"message": "test: repair canonical pytest repository entrypoint",
|
||||
"oid": "b20cb8130e4c68267d5d85b02eed51cb8d4f41c0",
|
||||
"parent_oid": "e41b8d323a3e7a40440f5d32221f524074bea5fe"
|
||||
},
|
||||
{
|
||||
"message": "test: make whole-suite collection deterministic",
|
||||
"oid": "c6a1693efaede9dace9b929d884a09e162a02c89",
|
||||
"parent_oid": "b20cb8130e4c68267d5d85b02eed51cb8d4f41c0"
|
||||
},
|
||||
{
|
||||
"message": "test: preserve legacy suite imports under canonical collection",
|
||||
"oid": "91f2ea0591787d3dbf8c2e27ab0460629d86900e",
|
||||
"parent_oid": "c6a1693efaede9dace9b929d884a09e162a02c89"
|
||||
},
|
||||
{
|
||||
"message": "test: expose repository test helpers to canonical collection",
|
||||
"oid": "85897d3f6d708271dff16767265f9d14b2f29801",
|
||||
"parent_oid": "91f2ea0591787d3dbf8c2e27ab0460629d86900e"
|
||||
},
|
||||
{
|
||||
"message": "fix(v2r2c1): close slash-branch and suite contract regressions",
|
||||
"oid": "f1110d24f30d8441f2df04e0774ee230b95c2e02",
|
||||
"parent_oid": "85897d3f6d708271dff16767265f9d14b2f29801"
|
||||
},
|
||||
{
|
||||
"message": "test: align writer regression with durable idempotent replay",
|
||||
"oid": "c10d2a5dfcc394dde7a7022952d7b423725747a3",
|
||||
"parent_oid": "f1110d24f30d8441f2df04e0774ee230b95c2e02"
|
||||
},
|
||||
{
|
||||
"message": "feat(v2r2c1): source baseline authority for model-api staging",
|
||||
"oid": "f969aedaf61501a866435c712be01ff2cfe43fb1",
|
||||
"parent_oid": "c10d2a5dfcc394dde7a7022952d7b423725747a3"
|
||||
},
|
||||
{
|
||||
"message": "feat(v2r2c1): add immutable model api staging runtime",
|
||||
"oid": "4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b",
|
||||
"parent_oid": "f969aedaf61501a866435c712be01ff2cfe43fb1"
|
||||
},
|
||||
{
|
||||
"message": "fix(v2r2c1): avoid builder secret-scan false positives",
|
||||
"oid": "7c4e86bfc1f39e643e672968d1fdedbd72ace56d",
|
||||
"parent_oid": "4ab70bfdb4d34aa9d1dabc4230a3367eaa93cc9b"
|
||||
},
|
||||
{
|
||||
"message": "fix(v2r2c1): isolate model api staging port",
|
||||
"oid": "7564363a30bfa7fa81ac5c7c545ec704984ec543",
|
||||
"parent_oid": "7c4e86bfc1f39e643e672968d1fdedbd72ace56d"
|
||||
},
|
||||
{
|
||||
"message": "fix(v2r2c1): bind baseline authority and openapi staging path",
|
||||
"oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"parent_oid": "7564363a30bfa7fa81ac5c7c545ec704984ec543"
|
||||
}
|
||||
],
|
||||
"main_base_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
|
||||
"release_target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
|
||||
"remote_proof": {
|
||||
"api_branch_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"api_verification": "paginated_exact_name",
|
||||
"commit_visible": true,
|
||||
"git_remote_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"main_api_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
|
||||
"main_git_oid": "2e8fa22989808a448065d1d76b5b18948774a637"
|
||||
},
|
||||
"report_commit_parent_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"repository": "aios/aios",
|
||||
"schema": "aios.v2r2c1.post-release-mainline-convergence.path-manifest.v1",
|
||||
"task_id": "TASK-P0-V2R2C1-POST-RELEASE-MAINLINE-CONVERGENCE-20260809"
|
||||
}
|
||||
@@ -1,37 +0,0 @@
|
||||
{
|
||||
"artifact_sha256": "492338b895b152a55015fd92ea1d9dba2314894ab00c0ba219a78f3cef544b8a",
|
||||
"baseline_authority_path": "/var/lib/aios-gitops-runtime-anchor/baseline/current.json",
|
||||
"checks": {
|
||||
"artifact_sha256": "PASS",
|
||||
"baseline_registry_readback": "PASS",
|
||||
"health_contract": "PASS",
|
||||
"legacy_write_rejection": "PASS",
|
||||
"live_service_unchanged": "PASS",
|
||||
"manifest_binding": "PASS",
|
||||
"openapi_readback": "PASS",
|
||||
"restart_recovery": "PASS"
|
||||
},
|
||||
"current_live_port": 18890,
|
||||
"current_live_service": "aios-gitops-model-api.service",
|
||||
"deployment_state": "STAGING",
|
||||
"execute": false,
|
||||
"governed_release_routing": "bridge-v2",
|
||||
"legacy_global_writes_enabled": false,
|
||||
"live_cutover": false,
|
||||
"owner_actions_required": [
|
||||
"review exact source OID and artifact SHA",
|
||||
"approve a separate future live model-api cutover",
|
||||
"approve any production service transition"
|
||||
],
|
||||
"production_restart": false,
|
||||
"repository_identity": "aios/aios",
|
||||
"runtime_mode": "IMMUTABLE_STAGING",
|
||||
"schema": "aios.v2r2c1.model-api-runtime-activation-plan.v1",
|
||||
"source_oid": "2c6293160ed567a2098715edbb296741577c5bff",
|
||||
"staging_port": 18893,
|
||||
"staging_runtime_root": "/opt/aios/gitops-model-api/2c6293160ed567a2098715edbb296741577c5bff/runtime",
|
||||
"staging_service": "aios-gitops-model-api-v2r2c1-staging.service",
|
||||
"status": "OWNER_APPROVAL_REQUIRED",
|
||||
"target_version": "V2R2C1",
|
||||
"task_id": "TASK-P0-V2R2C1-POST-RELEASE-MAINLINE-CONVERGENCE-20260809"
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
{
|
||||
"schema": "aios.bridge-v2-engineering-staging-acceptance.v1",
|
||||
"task_id": "TASK-P0-CHATGPT-BRIDGE-V2-CONTROL-PLANE-CONVERGENCE-20260809",
|
||||
"repository": "aios/aios",
|
||||
"branch": "agent/p0-chatgpt-bridge-v2-control-plane-convergence-20260809",
|
||||
"control_plane_release_version": "bridge-v2-aa0c37b8ab33",
|
||||
"control_plane_target_oid": "aa0c37b8ab333616e1bab9686cf6d10557f2ebda",
|
||||
"artifact_sha256": "08670c78cf760bfe693e3553e676eb751dadd7834116aa6d40e7c094f1357ae4",
|
||||
"runtime_path": "/opt/aios/gitops-control-plane/aa0c37b8ab333616e1bab9686cf6d10557f2ebda",
|
||||
"bridge_schema_version": "aios.chatgpt-gitops-bridge.v2",
|
||||
"deployment_state": "STAGING",
|
||||
"drift_status": "PASS",
|
||||
"restart_acceptance": {
|
||||
"pid_before": 3158850,
|
||||
"pid_after": 3159889,
|
||||
"runtime_response_equal": true
|
||||
},
|
||||
"governed_capabilities": {
|
||||
"legacy_writes_enabled": false,
|
||||
"governed_writes_enabled": true,
|
||||
"force_push": false,
|
||||
"main_write": false,
|
||||
"tag_write": false,
|
||||
"baseline_write": false,
|
||||
"production_write": false
|
||||
},
|
||||
"production_invariants": {
|
||||
"authority_main_oid": "2e8fa22989808a448065d1d76b5b18948774a637",
|
||||
"authority_tags_sha256": "bd2b6e30b76f28e7fcdcb447e7296690f0a65ad855209294c36b0f3f1d96098d",
|
||||
"baseline_current_sha256": "57651eb819584ab7c1d67f01b0ef66d6408cdc322ae5f6d4ff0aacd96f8327e1",
|
||||
"production_service_main_pid": 2816107,
|
||||
"production_service_nrestarts": 0,
|
||||
"production_service_active_enter_timestamp_monotonic": 2919386492273
|
||||
},
|
||||
"bridge_operation_sequence": {
|
||||
"createGovernedTask": "PASS",
|
||||
"acquireWriterLease": "PASS",
|
||||
"commitFilesGoverned": "REAL_GOVERNED_COMMIT",
|
||||
"getGitOpsJob": "PASS",
|
||||
"expected_branch_oid": "8fe3b85c1be592326473e81a502a23eeb9511d30",
|
||||
"generation": 7
|
||||
},
|
||||
"production_changed": false
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
{
|
||||
"schema": "aios.bridge-v2.1-durable-reconciliation.bootstrap-acceptance.v1",
|
||||
"task_id": "TASK-P0-BRIDGE-V21-DURABLE-RECONCILIATION-20260809",
|
||||
"repository": "aios/aios",
|
||||
"base_oid": "3f670c387692b8865a10d5b419468d8a0b64d7a4",
|
||||
"target_branch": "agent/p0-bridge-v21-durable-reconciliation-20260809",
|
||||
"branch_mode": "CREATE_NEW",
|
||||
"generation": 1,
|
||||
"implementation": "not_started",
|
||||
"production_changed": false,
|
||||
"required_proofs": [
|
||||
"absent_ref_cas",
|
||||
"observation_first_reconciliation",
|
||||
"authority_gitea_api_commit_equality",
|
||||
"commit_visible"
|
||||
]
|
||||
}
|
||||
@@ -48,8 +48,3 @@ class MessageBus:
|
||||
messages = list(self.queue)
|
||||
self.queue.clear()
|
||||
return messages
|
||||
|
||||
# R4.2 P0-B compatibility adapter.
|
||||
def to_handoff_envelope(message, *, target=None, sequence=1, idempotency_key=None, **scope):
|
||||
from message_handoff_adapters import legacy_message_to_envelope
|
||||
return legacy_message_to_envelope(message, target=target, sequence=sequence, idempotency_key=idempotency_key, **scope)
|
||||
|
||||
@@ -1,145 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
from __future__ import annotations
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import tarfile
|
||||
import tempfile
|
||||
|
||||
SCHEMA = 'aios.v2r2c1.model-api-staging-manifest.v1'
|
||||
REQUIRED_APP = (
|
||||
'aios_model_api_staging.py',
|
||||
'aios_gitops_write_guard.py',
|
||||
'authoritative_git.py',
|
||||
'baseline_authority.py',
|
||||
'gitea_tag_publication.py',
|
||||
'silent_release_controller.py',
|
||||
'silent_release_hardening.py',
|
||||
'aios_gitops_job_controller.py',
|
||||
)
|
||||
OPTIONAL_APP = (
|
||||
'aios_chatgpt_actions_api.py',
|
||||
'aios_continuation_executor.py',
|
||||
'aios_continuation_lease.py',
|
||||
'aios_control_plane_snapshot.py',
|
||||
)
|
||||
|
||||
def sha256(path: Path) -> str:
|
||||
h = hashlib.sha256()
|
||||
with path.open('rb') as fh:
|
||||
for chunk in iter(lambda: fh.read(1024 * 1024), b''):
|
||||
h.update(chunk)
|
||||
return h.hexdigest()
|
||||
|
||||
def private_marker(path: Path) -> bool:
|
||||
import re
|
||||
text = path.read_text(encoding='utf-8', errors='ignore')
|
||||
patterns = (
|
||||
r'-----BEGIN [A-Z ]*PRIVATE KEY-----',
|
||||
r'(?<![A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])',
|
||||
r'(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{20,}(?![A-Za-z0-9])',
|
||||
r'(?i)aws_secret_access_key\s*[:=]\s*[A-Za-z0-9/+=]{16,}',
|
||||
)
|
||||
return any(re.search(pattern, text) for pattern in patterns)
|
||||
|
||||
def main() -> int:
|
||||
ap = argparse.ArgumentParser()
|
||||
ap.add_argument('--source-root', required=True, type=Path)
|
||||
ap.add_argument('--output-root', required=True, type=Path)
|
||||
ap.add_argument('--source-oid', required=True)
|
||||
args = ap.parse_args()
|
||||
oid = args.source_oid.lower()
|
||||
if len(oid) != 40 or any(c not in '0123456789abcdef' for c in oid):
|
||||
raise SystemExit('source oid must be exact 40 hex')
|
||||
source = args.source_root.resolve(strict=True)
|
||||
output = args.output_root.resolve()
|
||||
app = source / 'active-runtime' / 'app'
|
||||
runtime = source / 'runtime' / 'agent-os'
|
||||
docs = source / 'docs' / 'gitops'
|
||||
if not app.is_dir():
|
||||
raise SystemExit('active-runtime/app missing')
|
||||
paths = []
|
||||
for name in REQUIRED_APP:
|
||||
path = app / name
|
||||
if not path.is_file():
|
||||
raise SystemExit(f'required app dependency missing: {name}')
|
||||
paths.append((Path('app') / name, path))
|
||||
for name in OPTIONAL_APP:
|
||||
path = app / name
|
||||
if path.is_file():
|
||||
paths.append((Path('app') / name, path))
|
||||
for rel in ('orchestrator/__init__.py', 'orchestrator/action_monitor.py'):
|
||||
path = runtime / rel
|
||||
if not path.is_file():
|
||||
raise SystemExit(f'required runtime dependency missing: {rel}')
|
||||
paths.append((Path('runtime-agent-os') / rel, path))
|
||||
openapi = docs / 'openapi-chatgpt-actions.yaml'
|
||||
if openapi.is_file():
|
||||
paths.append((Path('docs') / 'gitops' / 'openapi-chatgpt-actions.yaml', openapi))
|
||||
for folder in ('config/model_registry', 'config/model_priority', 'patches', 'versions'):
|
||||
root = source / folder
|
||||
if root.is_dir():
|
||||
for path in sorted(root.rglob('*')):
|
||||
if path.is_file() and path.suffix.lower() in {'.json', '.yaml', '.yml', '.md'}:
|
||||
paths.append((Path(folder) / path.relative_to(root), path))
|
||||
for rel, path in paths:
|
||||
if private_marker(path):
|
||||
raise SystemExit(f'private marker rejected: {rel}')
|
||||
included = [str(rel).replace('\\', '/') for rel, _ in paths]
|
||||
manifest = {
|
||||
'schema': SCHEMA,
|
||||
'target_version': 'V2R2C1',
|
||||
'source_oid': oid,
|
||||
'repository_identity': 'aios/aios',
|
||||
'deployment_state': 'STAGING',
|
||||
'runtime_mode': 'IMMUTABLE_STAGING',
|
||||
'runtime_entrypoint': 'app/aios_model_api_staging.py',
|
||||
'legacy_global_writes_enabled': False,
|
||||
'governed_release_routing': 'bridge-v2',
|
||||
'artifact_sha256': 'provided-by-build-receipt-and-install-manifest',
|
||||
'included_paths': included,
|
||||
}
|
||||
output.mkdir(parents=True, exist_ok=True)
|
||||
archive = output / f'aios-v2r2c1-model-api-{oid}.tar.gz'
|
||||
with tempfile.TemporaryDirectory(prefix='v2r2c1-model-api-', dir=str(output)) as tmp:
|
||||
root = Path(tmp) / 'runtime'
|
||||
for rel, path in paths:
|
||||
target = root / rel
|
||||
target.parent.mkdir(parents=True, exist_ok=True)
|
||||
target.write_bytes(path.read_bytes())
|
||||
(root / 'manifest.json').write_text(json.dumps(manifest, ensure_ascii=False, indent=2, sort_keys=True) + '\n', encoding='utf-8')
|
||||
with tarfile.open(archive, 'w:gz', format=tarfile.PAX_FORMAT) as tf:
|
||||
for path in sorted(root.rglob('*')):
|
||||
rel = path.relative_to(root.parent)
|
||||
info = tf.gettarinfo(str(path), arcname=str(rel).replace('\\', '/'))
|
||||
info.mtime = 0
|
||||
info.uid = 0
|
||||
info.gid = 0
|
||||
info.uname = 'root'
|
||||
info.gname = 'root'
|
||||
if path.is_file():
|
||||
with path.open('rb') as fh:
|
||||
tf.addfile(info, fh)
|
||||
else:
|
||||
tf.addfile(info)
|
||||
digest = sha256(archive)
|
||||
receipt = {
|
||||
'schema': 'aios.v2r2c1.model-api-staging-build-receipt.v1',
|
||||
'target_version': 'V2R2C1',
|
||||
'source_oid': oid,
|
||||
'repository_identity': 'aios/aios',
|
||||
'artifact_path': str(archive),
|
||||
'artifact_sha256': digest,
|
||||
'deployment_state': 'STAGING',
|
||||
'manifest_schema': SCHEMA,
|
||||
'included_paths': included,
|
||||
}
|
||||
receipt_path = output / f'aios-v2r2c1-model-api-{oid}.receipt.json'
|
||||
receipt_path.write_text(json.dumps(receipt, ensure_ascii=False, indent=2, sort_keys=True) + '\n', encoding='utf-8')
|
||||
print(json.dumps(receipt, ensure_ascii=False, indent=2, sort_keys=True))
|
||||
return 0
|
||||
|
||||
if __name__ == '__main__':
|
||||
raise SystemExit(main())
|
||||
@@ -2,7 +2,7 @@ from __future__ import annotations
|
||||
import hashlib,json,re,tarfile
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
OID_RE=re.compile(r"^[0-9a-f]{40}$"); SHA_RE=re.compile(r"^[0-9a-f]{64}$"); VERSION_RE=re.compile(r"^V[0-9]+R[0-9]+C[0-9]+(?:-[A-Za-z0-9_.-]+)?$")
|
||||
OID_RE=re.compile(r"^[0-9a-f]{40}$"); SHA_RE=re.compile(r"^[0-9a-f]{64}$"); VERSION_RE=re.compile(r"^V2R1C[0-9]+$")
|
||||
REQUIRED_SOURCE={"schema","version","repository","base_ref","base_oid","binding_mode","release_readiness","production_deployed","tag_created","baseline_changed","production_service","production_port","rollback_metadata","controller_schema","required_checks"}
|
||||
REQUEST_KEYS={"schema","version","repository","base_oid","target_oid","artifact_uri","artifact_sha256","artifact_size","evidence_closure_oid","approval_plan_id","execute","production_deployed","production_service","production_port","rollback_metadata","current_tag_oid","source_manifest_sha256"}
|
||||
class ManifestValidationError(ValueError):
|
||||
@@ -62,7 +62,7 @@ def validate_release_request(source_manifest:dict[str,Any],request_path:Path,exp
|
||||
if not isinstance(request["approval_plan_id"],str) or not request["approval_plan_id"].startswith("sha256:"): raise ManifestValidationError("APPROVAL_PLAN","invalid approval plan")
|
||||
if request["execute"] is not False or request["production_deployed"] is not False: raise ManifestValidationError("EXECUTION_NOT_ALLOWED","must be non-executing")
|
||||
if request["production_service"]!=source_manifest["production_service"] or request["production_port"]!=source_manifest["production_port"]: raise ManifestValidationError("SERVICE_IDENTITY","request service mismatch")
|
||||
if not isinstance(request["current_tag_oid"],str) or request["current_tag_oid"] not in {"V2R1C7","82792347937c0df59a8e02d6162775252bcad2e2"}: raise ManifestValidationError("PROTECTED_TAG","previous production tag binding changed")
|
||||
if not isinstance(request["current_tag_oid"],str) or request["current_tag_oid"] not in {"V2R1C6","9e65bd59baea392294c0f253046d3ab116f63145"}: raise ManifestValidationError("PROTECTED_TAG","previous tag binding changed")
|
||||
_sha(request["source_manifest_sha256"],"source_manifest_sha256"); return request
|
||||
def build_approval_request(*,source_manifest_path:Path,target_oid:str,artifact_uri:str,artifact_sha256:str,artifact_size:int,evidence_closure_oid:str,rollback_metadata:str,current_tag_oid:str)->dict[str,Any]:
|
||||
source=_json_object(source_manifest_path); _oid(target_oid,"target_oid"); _sha(artifact_sha256,"artifact_sha256"); _oid(evidence_closure_oid,"evidence_closure_oid"); request={"schema":"aios.release-request.v2","version":source["version"],"repository":source["repository"],"base_oid":source["base_oid"],"target_oid":target_oid,"artifact_uri":artifact_uri,"artifact_sha256":artifact_sha256,"artifact_size":artifact_size,"evidence_closure_oid":evidence_closure_oid,"execute":False,"production_deployed":False,"production_service":source["production_service"],"production_port":source["production_port"],"rollback_metadata":rollback_metadata,"current_tag_oid":current_tag_oid,"source_manifest_sha256":sha256_file(source_manifest_path)}; request["approval_plan_id"]="sha256:"+sha256_bytes(_canonical(request)); return request
|
||||
|
||||
@@ -3,13 +3,13 @@ from __future__ import annotations
|
||||
import json
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
ROOT = Path(__file__).parents[2]
|
||||
|
||||
|
||||
def test_version_and_candidate_binding():
|
||||
assert (ROOT / "VERSION").read_text(encoding="utf-8").strip() == "V2R1C7"
|
||||
assert (ROOT / "VERSION").read_text(encoding="utf-8").strip() == "V2R1C6"
|
||||
metadata = json.loads((ROOT / "versions/V2R1C6.json").read_text(encoding="utf-8"))
|
||||
assert metadata["version"] == "V2R1C6"
|
||||
assert metadata["base_oid"] == "a33e2593967a180c89d44454350ccaeaf3f79b25"
|
||||
assert metadata["candidate_branch"] == "agent/v2r1c6-mainline-reconciliation-20260806"
|
||||
assert metadata["production_deployed"] is False
|
||||
|
||||
@@ -7,19 +7,17 @@ import pytest
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[2]
|
||||
sys.path.insert(0, str(ROOT / "active-runtime" / "app"))
|
||||
from deployment_state import RuntimeDeploymentState
|
||||
from v2r1c6_privacy_tools import health_payload, serve # noqa: E402
|
||||
|
||||
|
||||
def test_health_is_engineering_only() -> None:
|
||||
result = health_payload(RuntimeDeploymentState("V2R1C7", "a" * 40, "b" * 64, "STAGED"))
|
||||
assert result["status"] == "ok"
|
||||
assert result["version"] == "V2R1C7"
|
||||
assert result["commit_oid"] == "a" * 40
|
||||
assert result["artifact_sha256"] == "b" * 64
|
||||
assert result["deployment_state"] == "STAGED"
|
||||
assert result["production_deployed"] is False
|
||||
assert result["health_timestamp"]
|
||||
result = health_payload()
|
||||
assert result == {
|
||||
"status": "ok",
|
||||
"version": "V2R1C6",
|
||||
"production_deployed": False,
|
||||
"gitops_writes_enabled": False,
|
||||
}
|
||||
|
||||
|
||||
def test_listener_rejects_non_loopback() -> None:
|
||||
|
||||
@@ -1,65 +0,0 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import importlib.util
|
||||
import sys
|
||||
import types
|
||||
from pathlib import Path
|
||||
|
||||
REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
|
||||
TEST_ROOT = REPOSITORY_ROOT / "tests"
|
||||
SERVICE_PACKAGE_ROOT = REPOSITORY_ROOT / "services" / "aios-autonomous-release-candidate"
|
||||
ACTIVE_RUNTIME_ROOT = REPOSITORY_ROOT / "active-runtime"
|
||||
ACTIVE_RUNTIME_APP = ACTIVE_RUNTIME_ROOT / "app"
|
||||
|
||||
for path in (TEST_ROOT, SERVICE_PACKAGE_ROOT, ACTIVE_RUNTIME_APP):
|
||||
value = str(path)
|
||||
if value not in sys.path:
|
||||
sys.path.insert(0, value)
|
||||
|
||||
|
||||
def load_module(relative: str):
|
||||
path = REPOSITORY_ROOT / relative
|
||||
spec = importlib.util.spec_from_file_location("v2r1c6_privacy_tools", path)
|
||||
if spec is None or spec.loader is None:
|
||||
raise RuntimeError("module_load_failed")
|
||||
module = importlib.util.module_from_spec(spec)
|
||||
sys.modules[spec.name] = module
|
||||
spec.loader.exec_module(module)
|
||||
return module
|
||||
|
||||
|
||||
def _install_active_runtime_namespace() -> None:
|
||||
package = sys.modules.get("active_runtime")
|
||||
if package is None:
|
||||
package = types.ModuleType("active_runtime")
|
||||
package.__path__ = [str(ACTIVE_RUNTIME_ROOT)]
|
||||
package.__package__ = "active_runtime"
|
||||
sys.modules["active_runtime"] = package
|
||||
|
||||
app = sys.modules.get("active_runtime.app")
|
||||
if app is None:
|
||||
app = types.ModuleType("active_runtime.app")
|
||||
app.__path__ = [str(ACTIVE_RUNTIME_APP)]
|
||||
app.__package__ = "active_runtime"
|
||||
sys.modules["active_runtime.app"] = app
|
||||
package.app = app
|
||||
|
||||
|
||||
def _install_legacy_test_module(name: str, relative: str) -> None:
|
||||
if name in sys.modules:
|
||||
return
|
||||
path = REPOSITORY_ROOT / relative
|
||||
spec = importlib.util.spec_from_file_location(name, path)
|
||||
if spec is None or spec.loader is None:
|
||||
raise RuntimeError("legacy_test_module_load_failed:" + name)
|
||||
module = importlib.util.module_from_spec(spec)
|
||||
sys.modules[name] = module
|
||||
spec.loader.exec_module(module)
|
||||
|
||||
|
||||
_install_active_runtime_namespace()
|
||||
sys.modules.setdefault("conftest", sys.modules[__name__])
|
||||
_install_legacy_test_module(
|
||||
"test_native_adapter_contracts",
|
||||
"tests/autonomous_release/test_native_adapter_contracts.py",
|
||||
)
|
||||
@@ -45,9 +45,6 @@ class ShadowClientRBACPublicInterfaceTests(unittest.TestCase):
|
||||
identity_verifier=self.IdentityVerifier({"shadow-client"}),
|
||||
execution_enabled=False,
|
||||
identity_capabilities={"shadow-client": set(capabilities)},
|
||||
identity_actor_contexts={
|
||||
"shadow-client": {"scope_type": "system"}
|
||||
},
|
||||
)
|
||||
service = self.TaskPlaneService(store, policy=policy)
|
||||
|
||||
|
||||
@@ -1,298 +0,0 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import os
|
||||
import sqlite3
|
||||
import sys
|
||||
import threading
|
||||
import urllib.error
|
||||
import urllib.request
|
||||
from http.server import ThreadingHTTPServer
|
||||
|
||||
import pytest
|
||||
|
||||
ROOT = os.getcwd()
|
||||
if os.path.join(ROOT, "active-runtime") not in sys.path:
|
||||
sys.path.append(os.path.join(ROOT, "active-runtime"))
|
||||
|
||||
from app.task_plane.api import TaskPlaneRequestHandler, TaskPlaneService
|
||||
from app.task_plane.errors import ForbiddenError, NotFoundError, ValidationError
|
||||
from app.task_plane.models import TaskPlan
|
||||
from app.task_plane.policy import PolicyEngine
|
||||
from app.task_plane.store import TaskPlaneStore
|
||||
|
||||
|
||||
def _policy() -> PolicyEngine:
|
||||
return PolicyEngine(
|
||||
identity_capabilities={
|
||||
"actor-a": {"task.creator", "task.read"},
|
||||
"actor-b": {"task.creator", "task.read"},
|
||||
"reader-a": {"task.read"},
|
||||
"reader-b": {"task.read"},
|
||||
"owner": {"task.creator", "task.read", "task.read.all"},
|
||||
"unbound": {"task.creator", "task.read"},
|
||||
},
|
||||
identity_actor_contexts={
|
||||
"actor-a": {
|
||||
"scope_type": "tenant",
|
||||
"tenant_id": "tenant-a",
|
||||
"user_id": "user-a",
|
||||
"project_id": "project-a",
|
||||
"conversation_id": "conversation-a",
|
||||
"run_id": "run-a",
|
||||
},
|
||||
"reader-a": {
|
||||
"scope_type": "tenant",
|
||||
"tenant_id": "tenant-a",
|
||||
"user_id": "user-a",
|
||||
"project_id": "project-a",
|
||||
"conversation_id": "conversation-a",
|
||||
"run_id": "run-a",
|
||||
},
|
||||
"actor-b": {
|
||||
"scope_type": "tenant",
|
||||
"tenant_id": "tenant-b",
|
||||
"user_id": "user-b",
|
||||
"project_id": "project-b",
|
||||
},
|
||||
"reader-b": {
|
||||
"scope_type": "tenant",
|
||||
"tenant_id": "tenant-b",
|
||||
"user_id": "user-b",
|
||||
"project_id": "project-b",
|
||||
},
|
||||
"owner": {"scope_type": "system"},
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
def _service() -> TaskPlaneService:
|
||||
return TaskPlaneService(TaskPlaneStore(":memory:"), policy=_policy())
|
||||
|
||||
|
||||
def test_taskplan_scope_fields_round_trip_as_first_class_values() -> None:
|
||||
plan = TaskPlan.from_dict(
|
||||
{
|
||||
"task_id": "task-scope-roundtrip",
|
||||
"scope_type": "tenant",
|
||||
"tenant_id": "tenant-a",
|
||||
"user_id": "user-a",
|
||||
"project_id": "project-a",
|
||||
"conversation_id": "conversation-a",
|
||||
"run_id": "run-a",
|
||||
}
|
||||
)
|
||||
payload = plan.to_dict()
|
||||
assert TaskPlan.from_dict(payload).to_dict() == payload
|
||||
|
||||
|
||||
def test_tenant_scope_requires_tenant_id_and_system_scope_does_not() -> None:
|
||||
with pytest.raises(ValidationError) as exc:
|
||||
TaskPlan.from_dict({"task_id": "task-missing-tenant", "scope_type": "tenant"})
|
||||
assert exc.value.error_code == "TASK_SCOPE_TENANT_ID_REQUIRED"
|
||||
system = TaskPlan.from_dict(
|
||||
{"task_id": "task-system", "scope_type": "system", "run_id": "system-run"}
|
||||
)
|
||||
assert system.tenant_id is None
|
||||
|
||||
|
||||
def test_ACTOR_BINDING_AUTHZ_MERGE_uses_server_scope() -> None:
|
||||
service = _service()
|
||||
created = service.create_task(
|
||||
{"task_id": "task-a", "task_type": "code.change"},
|
||||
actor_identity="actor-a",
|
||||
)
|
||||
assert created["plan"]["tenant_id"] == "tenant-a"
|
||||
assert created["plan"]["user_id"] == "user-a"
|
||||
assert created["plan"]["project_id"] == "project-a"
|
||||
declared = service.create_task(
|
||||
{
|
||||
"task_id": "task-a-declared",
|
||||
"tenant_id": "tenant-a",
|
||||
"user_id": "user-a",
|
||||
"project_id": "project-a",
|
||||
"conversation_id": "conversation-a",
|
||||
"run_id": "run-a",
|
||||
},
|
||||
actor_identity="actor-a",
|
||||
)
|
||||
assert declared["plan"]["scope_type"] == "tenant"
|
||||
|
||||
|
||||
def test_TASK_SCOPE_MISMATCH_DENY_rejects_forged_client_scope() -> None:
|
||||
service = _service()
|
||||
with pytest.raises(ForbiddenError) as exc:
|
||||
service.create_task(
|
||||
{
|
||||
"task_id": "task-forged",
|
||||
"scope_type": "tenant",
|
||||
"tenant_id": "tenant-b",
|
||||
"user_id": "user-b",
|
||||
"project_id": "project-b",
|
||||
},
|
||||
actor_identity="actor-a",
|
||||
)
|
||||
assert exc.value.error_code == "TASK_SCOPE_MISMATCH_DENY"
|
||||
|
||||
|
||||
def test_public_create_fails_closed_without_server_actor_scope() -> None:
|
||||
service = _service()
|
||||
with pytest.raises(ForbiddenError) as exc:
|
||||
service.create_task(
|
||||
{"task_id": "task-unbound"}, actor_identity="unbound"
|
||||
)
|
||||
assert exc.value.error_code == "TASK_ACTOR_SCOPE_UNAVAILABLE"
|
||||
|
||||
|
||||
def test_TASKPLANE_LIST_AUTHZ_DENY_and_TASK_OWNERSHIP_FILTER() -> None:
|
||||
service = _service()
|
||||
service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
|
||||
service.create_task({"task_id": "task-b"}, actor_identity="actor-b")
|
||||
assert [item["task_id"] for item in service.list_tasks("reader-a")] == ["task-a"]
|
||||
assert [item["task_id"] for item in service.list_tasks("reader-b")] == ["task-b"]
|
||||
|
||||
|
||||
def test_TASKPLANE_GET_AUTHZ_DENY_does_not_disclose_cross_tenant_task() -> None:
|
||||
service = _service()
|
||||
service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
|
||||
with pytest.raises(NotFoundError):
|
||||
service.get_task("task-a", "reader-b")
|
||||
|
||||
|
||||
def test_http_authentication_drives_server_scope_and_cross_tenant_404() -> None:
|
||||
service = _service()
|
||||
|
||||
class Handler(TaskPlaneRequestHandler):
|
||||
pass
|
||||
|
||||
Handler.service = service
|
||||
Handler.authenticator = lambda token: {
|
||||
"token-a": "actor-a",
|
||||
"token-b": "reader-b",
|
||||
}.get(token)
|
||||
server = ThreadingHTTPServer(("127.0.0.1", 0), Handler)
|
||||
thread = threading.Thread(target=server.serve_forever, daemon=True)
|
||||
thread.start()
|
||||
base = f"http://127.0.0.1:{server.server_port}"
|
||||
try:
|
||||
request = urllib.request.Request(
|
||||
base + "/tasks",
|
||||
data=json.dumps({"task_id": "task-http-a"}).encode(),
|
||||
headers={
|
||||
"Authorization": "Bearer token-a",
|
||||
"Content-Type": "application/json",
|
||||
},
|
||||
method="POST",
|
||||
)
|
||||
with urllib.request.urlopen(request, timeout=3) as response:
|
||||
created = json.loads(response.read())
|
||||
assert created["plan"]["tenant_id"] == "tenant-a"
|
||||
|
||||
denied = urllib.request.Request(
|
||||
base + "/tasks/task-http-a",
|
||||
headers={"Authorization": "Bearer token-b"},
|
||||
)
|
||||
with pytest.raises(urllib.error.HTTPError) as exc:
|
||||
urllib.request.urlopen(denied, timeout=3)
|
||||
assert exc.value.code == 404
|
||||
finally:
|
||||
server.shutdown()
|
||||
server.server_close()
|
||||
thread.join(timeout=3)
|
||||
|
||||
|
||||
def test_mutating_endpoint_is_scoped_before_cancel() -> None:
|
||||
policy = PolicyEngine(
|
||||
execution_enabled=True,
|
||||
identity_capabilities={
|
||||
"actor-a": {"task.creator", "task.read"},
|
||||
"actor-b": {"task.cancel"},
|
||||
},
|
||||
identity_actor_contexts={
|
||||
"actor-a": {"scope_type": "tenant", "tenant_id": "tenant-a"},
|
||||
"actor-b": {"scope_type": "tenant", "tenant_id": "tenant-b"},
|
||||
},
|
||||
)
|
||||
service = TaskPlaneService(TaskPlaneStore(":memory:"), policy=policy)
|
||||
service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
|
||||
with pytest.raises(NotFoundError):
|
||||
service.cancel("task-a", {"actor_identity": "actor-b"})
|
||||
|
||||
|
||||
def test_privileged_server_actor_can_cross_scope() -> None:
|
||||
service = _service()
|
||||
service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
|
||||
service.create_task({"task_id": "task-b"}, actor_identity="actor-b")
|
||||
assert {item["task_id"] for item in service.list_tasks("owner")} == {
|
||||
"task-a",
|
||||
"task-b",
|
||||
}
|
||||
|
||||
|
||||
def test_scope_sql_parameters_do_not_interpolate_tenant_values() -> None:
|
||||
service = _service()
|
||||
service.create_task({"task_id": "task-a"}, actor_identity="actor-a")
|
||||
policy = PolicyEngine(
|
||||
identity_capabilities={"attacker": {"task.read"}},
|
||||
identity_actor_contexts={
|
||||
"attacker": {
|
||||
"scope_type": "tenant",
|
||||
"tenant_id": "tenant-a' OR 1=1 --",
|
||||
}
|
||||
},
|
||||
)
|
||||
attacker_service = TaskPlaneService(service.store, policy=policy)
|
||||
assert attacker_service.list_tasks("attacker") == []
|
||||
|
||||
|
||||
def test_existing_sqlite_rows_migrate_to_legacy_without_tenant_guess(tmp_path) -> None:
|
||||
path = tmp_path / "legacy.sqlite3"
|
||||
connection = sqlite3.connect(path)
|
||||
connection.execute(
|
||||
"""
|
||||
CREATE TABLE tasks (
|
||||
task_id TEXT PRIMARY KEY, revision INTEGER NOT NULL, status TEXT NOT NULL,
|
||||
task_json TEXT NOT NULL, task_type TEXT NOT NULL, root_task_id TEXT NOT NULL,
|
||||
parent_task_id TEXT, correlation_id TEXT, idempotency_key TEXT UNIQUE,
|
||||
created_at REAL NOT NULL, updated_at REAL NOT NULL, failure_reason TEXT
|
||||
)
|
||||
"""
|
||||
)
|
||||
connection.execute(
|
||||
"INSERT INTO tasks VALUES (?,?,?,?,?,?,?,?,?,?,?,?)",
|
||||
(
|
||||
"task-legacy",
|
||||
1,
|
||||
"CREATED",
|
||||
json.dumps({"task_id": "task-legacy"}),
|
||||
"code.change",
|
||||
"task-legacy",
|
||||
None,
|
||||
None,
|
||||
"legacy-key",
|
||||
1.0,
|
||||
1.0,
|
||||
None,
|
||||
),
|
||||
)
|
||||
connection.commit()
|
||||
connection.close()
|
||||
|
||||
store = TaskPlaneStore(str(path))
|
||||
task = store.get_task("task-legacy")
|
||||
assert task.task_plan.scope_type == "legacy"
|
||||
assert task.task_plan.tenant_id is None
|
||||
replay = store.create_task(
|
||||
TaskPlan.from_dict({"task_id": "task-legacy"}),
|
||||
idempotency_key="legacy-key",
|
||||
)
|
||||
assert replay.task_id == "task-legacy"
|
||||
assert tuple(
|
||||
store.conn.execute(
|
||||
"SELECT scope_type,tenant_id FROM tasks WHERE task_id='task-legacy'"
|
||||
).fetchone()
|
||||
) == ("legacy", None)
|
||||
tenant_context = _policy().actor_context("reader-a")
|
||||
with pytest.raises(NotFoundError):
|
||||
store.get_task("task-legacy", tenant_context)
|
||||
store.close()
|
||||
@@ -20,12 +20,3 @@ def test_unified_event_flow():
|
||||
|
||||
dashboard = AgentEventDashboard(bus).overview()
|
||||
assert dashboard["audit"]["enabled"] is True
|
||||
|
||||
|
||||
def test_target_changes_event_identity(tmp_path):
|
||||
bus = AgentEventBus(tmp_path)
|
||||
first = bus.publish('test', 'same', 'user-a', 'same summary', {'value': 1})
|
||||
second = bus.publish('test', 'same', 'user-b', 'same summary', {'value': 1})
|
||||
first_id = first.get('id') if isinstance(first, dict) else getattr(first, 'id', first)
|
||||
second_id = second.get('id') if isinstance(second, dict) else getattr(second, 'id', second)
|
||||
assert first_id != second_id
|
||||
|
||||
@@ -1,211 +0,0 @@
|
||||
import base64
|
||||
from pathlib import Path
|
||||
|
||||
from aios_authority_git_executor import AuthorityGitExecutor
|
||||
from aios_chatgpt_bridge_v2 import BridgeV2Adapter, OPERATION_REQUIRED_FIELDS
|
||||
from aios_chatgpt_bridge_v2_server import BridgeHandler, RuntimeConfig
|
||||
from aios_continuation_executor import GiteaContinuationRemote, ServerSideCredentialProjection
|
||||
from aios_continuation_lease import WriterLeaseRequestV2
|
||||
|
||||
|
||||
class Probe:
|
||||
def __init__(self, present=False):
|
||||
self.present = present
|
||||
|
||||
def branch_exists(self, _branch):
|
||||
return self.present
|
||||
|
||||
def branch_head(self, _branch):
|
||||
return "a" * 40
|
||||
|
||||
def is_ancestor(self, _older, _newer):
|
||||
return True
|
||||
|
||||
def commit_exists(self, _oid):
|
||||
return True
|
||||
|
||||
|
||||
def test_create_new_lease_is_exact_base_and_absent():
|
||||
request = WriterLeaseRequestV2(
|
||||
job_id="job-bridge-runtime-lineage-test",
|
||||
task_id="TASK-P0-BRIDGE-V21-DURABLE-RECONCILIATION-20260809",
|
||||
repository="aios/aios",
|
||||
branch_mode="CREATE_NEW",
|
||||
base_oid="a" * 40,
|
||||
expected_branch_oid="a" * 40,
|
||||
target_branch="agent/p0-bridge-v21-durable-reconciliation-20260809",
|
||||
generation=1,
|
||||
)
|
||||
request.validate(Probe())
|
||||
|
||||
|
||||
def test_create_new_lease_rejects_existing_target():
|
||||
request = WriterLeaseRequestV2(
|
||||
job_id="job-bridge-runtime-lineage-test",
|
||||
task_id="task",
|
||||
repository="aios/aios",
|
||||
branch_mode="CREATE_NEW",
|
||||
base_oid="a" * 40,
|
||||
expected_branch_oid="a" * 40,
|
||||
target_branch="agent/existing-target",
|
||||
generation=1,
|
||||
)
|
||||
try:
|
||||
request.validate(Probe(True))
|
||||
except Exception as exc:
|
||||
assert str(exc) == "TARGET_BRANCH_ALREADY_EXISTS"
|
||||
else:
|
||||
raise AssertionError("existing CREATE_NEW target must fail")
|
||||
|
||||
|
||||
def test_slash_branch_uses_paginated_collection():
|
||||
credential = ServerSideCredentialProjection(Path("/tmp/key"), Path("/tmp/token"), active=True)
|
||||
calls = []
|
||||
|
||||
class FakeRemote(GiteaContinuationRemote):
|
||||
def _api(self, path):
|
||||
calls.append(path)
|
||||
if "page=1" in path:
|
||||
return [{"name": f"agent/other-{i}", "commit": {"id": "b" * 40}} for i in range(50)]
|
||||
return [{"name": "agent/slash/branch", "commit": {"id": "c" * 40}}]
|
||||
|
||||
remote = FakeRemote(Path("/tmp"), credential)
|
||||
assert remote.read_api_branch("agent/slash/branch") == "c" * 40
|
||||
assert calls[0].endswith("branches?page=1&limit=50")
|
||||
assert calls[1].endswith("branches?page=2&limit=50")
|
||||
|
||||
|
||||
def test_http_route_contract_is_complete():
|
||||
expected = {
|
||||
"/v2/runtime", "/v2/capabilities", "/v2/governed-task",
|
||||
"/v2/writer-lease", "/v2/writer-lease/bootstrap", "/v2/writer-lease/renew", "/v2/commit-file", "/v2/commit-files",
|
||||
"/v2/job", "/v2/job/resume", "/v2/job/reconcile",
|
||||
"/v2/tag/approval-request",
|
||||
"/v2/tag/publish",
|
||||
"/v2/tag/status",
|
||||
"/v2/release/artifact",
|
||||
"/v2/release/execute",
|
||||
"/v2/release/consistency",
|
||||
"/v2/release/acceptance",
|
||||
}
|
||||
from aios_chatgpt_bridge_v2_server import ROUTES
|
||||
|
||||
assert set(ROUTES) == expected
|
||||
|
||||
|
||||
def test_renew_writer_lease_is_exposed_in_action_and_capability_contracts():
|
||||
adapter = BridgeV2Adapter(runtime_status={})
|
||||
capabilities = adapter.getGovernedWriteCapabilities()
|
||||
contract = capabilities["operation_contracts"]["renewWriterLease"]
|
||||
|
||||
assert contract["method"] == "POST"
|
||||
assert contract["path"] == "/v2/writer-lease/renew"
|
||||
assert tuple(contract["required_fields"]) == OPERATION_REQUIRED_FIELDS["renewWriterLease"]
|
||||
assert "runtime_rehydrated" in contract["response_fields"]
|
||||
|
||||
action_schema = Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
|
||||
assert "/v2/writer-lease/renew:" in action_schema
|
||||
assert "operationId: renewWriterLease" in action_schema
|
||||
assert "BridgeWriterLeaseRecoveryRequest" in action_schema
|
||||
assert "BridgeWriterLeaseRecoveryResponse" in action_schema
|
||||
assert {
|
||||
capabilities["operation_contracts"][operation]["path"]
|
||||
for operation in (
|
||||
"acquireWriterLease",
|
||||
"renewWriterLease",
|
||||
"commitFileGoverned",
|
||||
"commitFilesGoverned",
|
||||
)
|
||||
} == {
|
||||
"/v2/writer-lease",
|
||||
"/v2/writer-lease/renew",
|
||||
"/v2/commit-file",
|
||||
"/v2/commit-files",
|
||||
}
|
||||
|
||||
|
||||
def test_bootstrap_writer_lease_is_exposed_in_action_and_capability_contracts():
|
||||
adapter = BridgeV2Adapter(runtime_status={})
|
||||
capabilities = adapter.getGovernedWriteCapabilities()
|
||||
contract = capabilities["operation_contracts"]["bootstrapWriterLease"]
|
||||
|
||||
assert contract["method"] == "POST"
|
||||
assert contract["path"] == "/v2/writer-lease/bootstrap"
|
||||
assert tuple(contract["required_fields"]) == OPERATION_REQUIRED_FIELDS["bootstrapWriterLease"]
|
||||
assert "bootstrapped" in contract["response_fields"]
|
||||
assert "durable_branch_lease_present" in contract["response_fields"]
|
||||
|
||||
action_schema = Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
|
||||
assert "/v2/writer-lease/bootstrap:" in action_schema
|
||||
assert "operationId: bootstrapWriterLease" in action_schema
|
||||
assert "bootstrapped: {type: boolean}" in action_schema
|
||||
assert "durable_branch_lease_present: {type: boolean}" in action_schema
|
||||
|
||||
|
||||
|
||||
def test_http_allows_explicit_job_id_on_lease_and_commit_requests():
|
||||
handler = BridgeHandler.__new__(BridgeHandler)
|
||||
lease_body = {
|
||||
"schema": WriterLeaseRequestV2.schema,
|
||||
"task_id": "task",
|
||||
"job_id": "job-explicit-runtime-lineage",
|
||||
"repository": "aios/aios",
|
||||
"branch_mode": "CONTINUE_EXISTING",
|
||||
"base_oid": "a" * 40,
|
||||
"expected_branch_oid": "a" * 40,
|
||||
"target_branch": "agent/explicit-runtime-lineage",
|
||||
"generation": 2,
|
||||
"lease_seconds": 120,
|
||||
}
|
||||
handler._allowed("acquireWriterLease", lease_body)
|
||||
handler._allowed(
|
||||
"commitFilesGoverned",
|
||||
{
|
||||
"task_id": "task",
|
||||
"job_id": "job-explicit-runtime-lineage",
|
||||
"repository": "aios/aios",
|
||||
"expected_branch_oid": "a" * 40,
|
||||
"target_branch": "agent/explicit-runtime-lineage",
|
||||
"generation": 2,
|
||||
"idempotency_key": "commit-explicit-runtime-lineage",
|
||||
"files": {"docs/x.txt": "eA=="},
|
||||
"message": "test",
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
def test_http_allows_omitted_job_id_for_durable_server_resolution():
|
||||
handler = BridgeHandler.__new__(BridgeHandler)
|
||||
lease_body = {
|
||||
"schema": WriterLeaseRequestV2.schema,
|
||||
"task_id": "task",
|
||||
"repository": "aios/aios",
|
||||
"branch_mode": "CONTINUE_EXISTING",
|
||||
"base_oid": "a" * 40,
|
||||
"expected_branch_oid": "a" * 40,
|
||||
"target_branch": "agent/implicit-runtime-lineage",
|
||||
"generation": 2,
|
||||
"lease_seconds": 120,
|
||||
}
|
||||
handler._allowed("acquireWriterLease", lease_body)
|
||||
handler._allowed(
|
||||
"commitFilesGoverned",
|
||||
{
|
||||
"task_id": "task",
|
||||
"repository": "aios/aios",
|
||||
"expected_branch_oid": "a" * 40,
|
||||
"target_branch": "agent/implicit-runtime-lineage",
|
||||
"generation": 2,
|
||||
"idempotency_key": "commit-implicit-runtime-lineage",
|
||||
"files": {"docs/x.txt": "eA=="},
|
||||
"message": "test",
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
def test_capability_contracts_return_exact_job_id_lineage():
|
||||
contracts = BridgeV2Adapter(runtime_status={}).getGovernedWriteCapabilities()["operation_contracts"]
|
||||
for operation in ("acquireWriterLease", "bootstrapWriterLease", "renewWriterLease"):
|
||||
assert "job_id" in contracts[operation]["response_fields"]
|
||||
for operation in ("commitFileGoverned", "commitFilesGoverned"):
|
||||
assert "job_id" in contracts[operation]["response_fields"]
|
||||
@@ -0,0 +1,90 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import hashlib
|
||||
import json
|
||||
from pathlib import Path
|
||||
import tempfile
|
||||
|
||||
import pytest
|
||||
import yaml
|
||||
|
||||
from aios_chatgpt_bridge_v2 import (
|
||||
BRIDGE_OPERATIONS,
|
||||
BRIDGE_SCHEMA_VERSION,
|
||||
OPERATION_REQUIRED_FIELDS,
|
||||
BridgeV2Adapter,
|
||||
ControlPlaneReleaseManifest,
|
||||
RuntimeDriftError,
|
||||
)
|
||||
|
||||
|
||||
ROOT = Path(__file__).parents[1]
|
||||
|
||||
|
||||
def test_immutable_release_identity_accepts_exact_artifact_and_rejects_workspace_drift():
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
approved = Path(directory) / "releases"
|
||||
runtime = approved / "release-1"
|
||||
runtime.mkdir(parents=True)
|
||||
artifact = runtime / "bridge.pyz"
|
||||
artifact.write_bytes(b"bridge-v2")
|
||||
digest = hashlib.sha256(artifact.read_bytes()).hexdigest()
|
||||
manifest = ControlPlaneReleaseManifest(
|
||||
"bridge-v2-test", "a" * 40, digest, runtime, BRIDGE_SCHEMA_VERSION,
|
||||
"aios/aios", Path("/data/aios-gitops/repo.git"), "STAGING",
|
||||
)
|
||||
assert manifest.validate(artifact, observed_oid="a" * 40, approved_root=approved)["drift_status"] == "PASS"
|
||||
with pytest.raises(RuntimeDriftError, match="CONTROL_PLANE_RUNTIME_DRIFT"):
|
||||
manifest.validate(artifact, observed_oid="b" * 40, approved_root=approved)
|
||||
mutable = ControlPlaneReleaseManifest(
|
||||
"bad", "a" * 40, digest, Path("/var/lib/worktrees/dev"), BRIDGE_SCHEMA_VERSION,
|
||||
"aios/aios", Path("/data/aios-gitops/repo.git"), "STAGING",
|
||||
)
|
||||
with pytest.raises(RuntimeDriftError, match="CONTROL_PLANE_RUNTIME_DRIFT"):
|
||||
mutable.validate(artifact, observed_oid="a" * 40, approved_root=approved)
|
||||
|
||||
|
||||
def test_bridge_capabilities_keep_legacy_closed_and_expose_exact_operations():
|
||||
adapter = BridgeV2Adapter(runtime_status={"drift_status": "PASS"})
|
||||
assert adapter.getRuntimeStatus()["bridge_schema_version"] == BRIDGE_SCHEMA_VERSION
|
||||
capabilities = adapter.getGovernedWriteCapabilities()
|
||||
assert capabilities["legacy_writes_enabled"] is False
|
||||
assert capabilities["governed_writes_enabled"] is True
|
||||
assert tuple(capabilities["operations"]) == BRIDGE_OPERATIONS
|
||||
assert adapter.legacy_write_disabled() == {
|
||||
"error": "LEGACY_WRITE_DISABLED",
|
||||
"replacement": "createGovernedTask",
|
||||
"governed_writes_available": True,
|
||||
}
|
||||
|
||||
|
||||
def test_openapi_runtime_and_fragment_required_fields_are_exactly_converged():
|
||||
canonical = yaml.safe_load((ROOT / "docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8"))
|
||||
fragment = yaml.safe_load((ROOT / "docs/gitops/openapi-authorized-task-writer-fragment.yaml").read_text(encoding="utf-8"))
|
||||
operations = {}
|
||||
for path, methods in canonical["paths"].items():
|
||||
for method, value in methods.items():
|
||||
if isinstance(value, dict) and value.get("operationId") in BRIDGE_OPERATIONS:
|
||||
operations[value["operationId"]] = value
|
||||
assert set(operations) == set(BRIDGE_OPERATIONS)
|
||||
for operation, required in OPERATION_REQUIRED_FIELDS.items():
|
||||
if "requestBody" not in operations[operation]:
|
||||
assert required == ()
|
||||
continue
|
||||
schema = operations[operation]["requestBody"]["content"]["application/json"]["schema"]
|
||||
assert tuple(schema["required"]) == required
|
||||
fragment_required = tuple(fragment["components"]["schemas"]["WriterLeaseRequestV2"]["required"])
|
||||
assert fragment_required == OPERATION_REQUIRED_FIELDS["acquireWriterLease"]
|
||||
|
||||
|
||||
def test_release_manifest_round_trip_contains_only_declared_identity_fields():
|
||||
manifest = ControlPlaneReleaseManifest(
|
||||
"v", "a" * 40, "b" * 64, Path("/opt/aios/gitops-control-plane/v"), BRIDGE_SCHEMA_VERSION,
|
||||
"aios/aios", Path("/data/aios-gitops/repo.git"), "STAGING",
|
||||
)
|
||||
value = manifest.as_dict()
|
||||
assert tuple(value) == (
|
||||
"control_plane_release_version", "control_plane_target_oid", "artifact_sha256", "runtime_path",
|
||||
"bridge_schema_version", "repository_identity", "authoritative_git_dir", "deployment_state",
|
||||
)
|
||||
assert "credential" not in json.dumps(value).lower()
|
||||
@@ -1,304 +0,0 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from pathlib import Path
|
||||
import re
|
||||
import json
|
||||
from types import SimpleNamespace
|
||||
|
||||
import pytest
|
||||
import yaml
|
||||
|
||||
from aios_chatgpt_bridge_v2_server import GovernedRuntime
|
||||
from aios_continuation_executor import ContinuationExecutor
|
||||
from aios_continuation_lease import WriterLeaseRequestV2
|
||||
from aios_gitops_job_controller import JobState
|
||||
|
||||
|
||||
TASK = "continuation-normalization-test"
|
||||
JOB = "job-continuation-normalization-test"
|
||||
REPO = "aios/aios"
|
||||
BASE = "a" * 40
|
||||
BRANCH = "agent/continuation-normalization-test"
|
||||
|
||||
|
||||
class Authority:
|
||||
def __init__(self, head: str | None) -> None:
|
||||
self.head = head
|
||||
|
||||
def read_ref(self, ref: str) -> str | None:
|
||||
assert ref == "refs/heads/" + BRANCH
|
||||
return self.head
|
||||
|
||||
def commit_exists(self, oid: str) -> bool:
|
||||
return oid == BASE
|
||||
|
||||
def branch_exists(self, branch: str) -> bool:
|
||||
assert branch == BRANCH
|
||||
return self.head is not None
|
||||
|
||||
def branch_head(self, branch: str) -> str:
|
||||
assert branch == BRANCH and self.head is not None
|
||||
return self.head
|
||||
|
||||
def is_ancestor(self, older: str, newer: str) -> bool:
|
||||
return older == BASE and newer == BASE
|
||||
|
||||
|
||||
def lease(**overrides: object) -> WriterLeaseRequestV2:
|
||||
values = {
|
||||
"task_id": TASK,
|
||||
"job_id": JOB,
|
||||
"repository": REPO,
|
||||
"branch_mode": "CREATE_NEW",
|
||||
"base_oid": BASE,
|
||||
"expected_branch_oid": BASE,
|
||||
"target_branch": BRANCH,
|
||||
"generation": 1,
|
||||
"lease_seconds": 120,
|
||||
}
|
||||
values.update(overrides)
|
||||
return WriterLeaseRequestV2(**values)
|
||||
|
||||
|
||||
def runtime(*, head: str | None = BASE, **binding_overrides: object) -> GovernedRuntime:
|
||||
value = GovernedRuntime.__new__(GovernedRuntime)
|
||||
value.authority = Authority(head)
|
||||
binding = {
|
||||
"task_id": TASK,
|
||||
"job_id": JOB,
|
||||
"repository": REPO,
|
||||
"base_oid": BASE,
|
||||
"expected_branch_oid": BASE,
|
||||
"target_branch": BRANCH,
|
||||
"generation": 1,
|
||||
"branch_mode": "CREATE_NEW",
|
||||
}
|
||||
binding.update(binding_overrides)
|
||||
value.bindings = {TASK: binding}
|
||||
return value
|
||||
|
||||
|
||||
def test_same_lineage_create_new_normalizes_to_continue_existing() -> None:
|
||||
normalized = runtime()._normalize_runtime_lease(lease())
|
||||
assert normalized.branch_mode == "CONTINUE_EXISTING"
|
||||
assert normalized.task_id == TASK
|
||||
assert normalized.job_id == JOB
|
||||
assert normalized.repository == REPO
|
||||
assert normalized.target_branch == BRANCH
|
||||
assert normalized.expected_branch_oid == BASE
|
||||
assert normalized.generation == 1
|
||||
|
||||
|
||||
def test_unprovisioned_create_new_stays_create_new() -> None:
|
||||
assert runtime(head=None)._normalize_runtime_lease(lease()).branch_mode == "CREATE_NEW"
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
("field", "value"),
|
||||
(
|
||||
("repository", "other/repo"),
|
||||
("base_oid", "b" * 40),
|
||||
("expected_branch_oid", "b" * 40),
|
||||
("target_branch", "agent/foreign"),
|
||||
("generation", 2),
|
||||
),
|
||||
)
|
||||
def test_binding_mismatch_fails_closed(field: str, value: object) -> None:
|
||||
with pytest.raises(RuntimeError, match="LEASE_BINDING_CONFLICT"):
|
||||
runtime(**{field: value})._normalize_runtime_lease(lease())
|
||||
|
||||
|
||||
def test_drifted_existing_head_fails_closed() -> None:
|
||||
with pytest.raises(RuntimeError, match="EXPECTED_BRANCH_OID_CONFLICT"):
|
||||
runtime(head="b" * 40)._normalize_runtime_lease(lease())
|
||||
|
||||
|
||||
def test_openapi_contract_parses_and_requires_exact_commit_lineage() -> None:
|
||||
document = yaml.safe_load(
|
||||
Path("docs/gitops/openapi-chatgpt-actions.yaml").read_text(encoding="utf-8")
|
||||
)
|
||||
schema = document["components"]["schemas"]["BridgeCommitResponse"]
|
||||
assert {
|
||||
"job_id",
|
||||
"commit_oid",
|
||||
"commit_visible",
|
||||
"branch_mode",
|
||||
"target_branch",
|
||||
"generation",
|
||||
} <= set(schema["required"])
|
||||
|
||||
|
||||
def test_changed_production_files_pass_secret_scan() -> None:
|
||||
paths = [
|
||||
Path("active-runtime/app/aios_authority_git_executor.py"),
|
||||
Path("active-runtime/app/aios_chatgpt_bridge_v2_server.py"),
|
||||
Path("active-runtime/app/aios_continuation_executor.py"),
|
||||
Path("active-runtime/app/aios_continuation_lease.py"),
|
||||
Path("active-runtime/app/authorized_task_writer_provisioning.py"),
|
||||
Path("active-runtime/app/aios_chatgpt_bridge_v2.py"),
|
||||
Path("docs/gitops/openapi-chatgpt-actions.yaml"),
|
||||
]
|
||||
expression = re.compile(
|
||||
r"(?i)(BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|"
|
||||
r"authorization:\\s*bearer\\s+[A-Za-z0-9._-]{12,}|"
|
||||
r"api[_-]?key\\s*[:=]\\s*['\\\"][^'\\\"]{12,})"
|
||||
)
|
||||
hits = []
|
||||
for path in paths:
|
||||
for number, line in enumerate(
|
||||
path.read_text(encoding="utf-8", errors="replace").splitlines(), 1
|
||||
):
|
||||
if expression.search(line):
|
||||
hits.append(f"{path}:{number}")
|
||||
assert hits == []
|
||||
|
||||
|
||||
def test_remote_verified_job_is_not_completed_when_head_cas_callback_fails() -> None:
|
||||
class Store:
|
||||
def read(self, _job_id):
|
||||
return {
|
||||
"branch": BRANCH,
|
||||
"request_json": json.dumps(
|
||||
{"binding": {"expected_branch_oid": BASE}}
|
||||
),
|
||||
}
|
||||
|
||||
class Controller:
|
||||
def __init__(self):
|
||||
self.store = Store()
|
||||
self.states = []
|
||||
|
||||
def advance(self, _job_id, state, **_kwargs):
|
||||
self.states.append(state)
|
||||
return SimpleNamespace(as_dict=lambda: {"state": state.value})
|
||||
|
||||
executor = ContinuationExecutor.__new__(ContinuationExecutor)
|
||||
executor.controller = Controller()
|
||||
executor._observe_remote = lambda _branch, oid: (oid, oid, True)
|
||||
|
||||
def fail_cas(_oid):
|
||||
raise RuntimeError("LEASE_CAS_CONFLICT")
|
||||
|
||||
with pytest.raises(RuntimeError, match="LEASE_CAS_CONFLICT"):
|
||||
executor._finish_remote_verification(
|
||||
JOB,
|
||||
"b" * 40,
|
||||
"b" * 40,
|
||||
before_complete=fail_cas,
|
||||
)
|
||||
|
||||
assert executor.controller.states == [JobState.REMOTE_VERIFIED]
|
||||
|
||||
|
||||
@pytest.mark.parametrize("branch_mode", ("CREATE_NEW", "CONTINUE_EXISTING"))
|
||||
def test_executor_preflight_accepts_the_exact_mode_dependent_normalized_shape(
|
||||
branch_mode: str,
|
||||
) -> None:
|
||||
from datetime import datetime, timedelta, timezone
|
||||
from aios_continuation_executor import (
|
||||
ContinuationPermissions,
|
||||
ContinuationRuntimeBinding,
|
||||
)
|
||||
|
||||
request = lease(branch_mode=branch_mode)
|
||||
now = datetime.now(timezone.utc)
|
||||
executor = ContinuationExecutor.__new__(ContinuationExecutor)
|
||||
executor.authority = Authority(None if branch_mode == "CREATE_NEW" else BASE)
|
||||
executor.now = lambda: now
|
||||
executor._max_generation = lambda _branch, *, exclude_job_id=None: 0
|
||||
executor.workspace = SimpleNamespace(
|
||||
is_detached=lambda: True,
|
||||
head_oid=lambda: BASE,
|
||||
)
|
||||
executor.remote = SimpleNamespace(repository_identity=lambda: REPO)
|
||||
binding = ContinuationRuntimeBinding(
|
||||
request=request,
|
||||
job_id=JOB,
|
||||
workspace_path=Path("/tmp/continuation-normalization-test"),
|
||||
lease_not_before=now - timedelta(seconds=1),
|
||||
lease_expires_at=now + timedelta(seconds=60),
|
||||
original_receipt_valid=True,
|
||||
original_grant_consumed=True,
|
||||
permissions=ContinuationPermissions(),
|
||||
)
|
||||
|
||||
executor._validate_preflight(binding, job_id=JOB)
|
||||
|
||||
|
||||
def test_create_new_executor_resumes_executing_and_uses_absence_bound_writers() -> None:
|
||||
from datetime import datetime, timedelta, timezone
|
||||
from aios_continuation_executor import (
|
||||
ContinuationCommit,
|
||||
ContinuationPermissions,
|
||||
ContinuationRuntimeBinding,
|
||||
)
|
||||
|
||||
new_oid = "b" * 40
|
||||
|
||||
class Store:
|
||||
def read(self, _job_id: str) -> dict[str, object]:
|
||||
return {"state": "EXECUTING", "revision": 4}
|
||||
|
||||
class Controller:
|
||||
def __init__(self) -> None:
|
||||
self.store = Store()
|
||||
self.advanced: list[str] = []
|
||||
|
||||
def advance(self, _job_id: str, state: JobState, **_kwargs: object) -> object:
|
||||
self.advanced.append(state.value)
|
||||
return SimpleNamespace(as_dict=lambda: {"state": state.value})
|
||||
|
||||
class Workspace:
|
||||
def commit_files(self, _files: object, _message: str) -> str:
|
||||
return new_oid
|
||||
|
||||
class CreateAuthority:
|
||||
def __init__(self) -> None:
|
||||
self.created: list[tuple[str, str, str]] = []
|
||||
|
||||
def is_ancestor(self, older: str, newer: str) -> bool:
|
||||
return older == BASE and newer == new_oid
|
||||
|
||||
def create_task_branch_cas(self, branch: str, base: str, new: str) -> str:
|
||||
self.created.append((branch, base, new))
|
||||
return new
|
||||
|
||||
def compare_and_swap_branch(self, *_args: object) -> str:
|
||||
raise AssertionError("existing-branch CAS must not serve CREATE_NEW")
|
||||
|
||||
class CreateRemote:
|
||||
def __init__(self) -> None:
|
||||
self.created: list[tuple[str, str]] = []
|
||||
|
||||
def push_new_exact(self, branch: str, new: str) -> None:
|
||||
self.created.append((branch, new))
|
||||
|
||||
def push_exact(self, *_args: object) -> None:
|
||||
raise AssertionError("existing-branch push must not serve CREATE_NEW")
|
||||
|
||||
class Credential:
|
||||
def project(self) -> None: pass
|
||||
def revoke(self) -> None: pass
|
||||
|
||||
controller=Controller(); authority=CreateAuthority(); remote=CreateRemote()
|
||||
executor=ContinuationExecutor(controller,authority,Workspace(),remote,Credential())
|
||||
executor._validate_preflight=lambda *_args,**_kwargs: None
|
||||
executor._finish_remote_verification=lambda *_args,**_kwargs: {
|
||||
"job_id":JOB,"state":"COMPLETED","receipt":{"authority_oid":new_oid,"commit_visible":True}
|
||||
}
|
||||
now=datetime.now(timezone.utc)
|
||||
binding=ContinuationRuntimeBinding(
|
||||
request=lease(branch_mode="CREATE_NEW"),job_id=JOB,
|
||||
workspace_path=Path("/tmp/create-new-executor-resume"),
|
||||
lease_not_before=now-timedelta(seconds=1),lease_expires_at=now+timedelta(seconds=60),
|
||||
original_receipt_valid=True,original_grant_consumed=True,
|
||||
permissions=ContinuationPermissions(),
|
||||
)
|
||||
result=executor.execute(
|
||||
binding,ContinuationCommit("create-new-test",{"docs/test.txt":b"ok"},"test")
|
||||
)
|
||||
|
||||
assert result["state"]=="COMPLETED"
|
||||
assert authority.created==[(BRANCH,BASE,new_oid)]
|
||||
assert remote.created==[(BRANCH,new_oid)]
|
||||
assert controller.advanced==["LOCAL_VERIFIED","REMOTE_SYNCING"]
|
||||
@@ -0,0 +1,283 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from datetime import datetime, timedelta, timezone
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import tempfile
|
||||
|
||||
import pytest
|
||||
|
||||
from aios_continuation_executor import (
|
||||
ContinuationCommit,
|
||||
ContinuationExecutionError,
|
||||
ContinuationExecutor,
|
||||
ContinuationPermissions,
|
||||
ContinuationRuntimeBinding,
|
||||
DetachedGitWorkspace,
|
||||
GiteaContinuationRemote,
|
||||
)
|
||||
from aios_continuation_lease import WriterLeaseRequestV2
|
||||
from aios_gitops_job_controller import BindingConflict, GitOpsJobController, JobState, JobStore
|
||||
|
||||
|
||||
TASK = "TASK-P0-CHATGPT-BRIDGE-V2-CONTROL-PLANE-CONVERGENCE-20260809"
|
||||
REPOSITORY = "aios/aios"
|
||||
BRANCH = "agent/p0-chatgpt-bridge-v2-control-plane-convergence-20260809"
|
||||
BASE = "2" * 40
|
||||
HEAD = "8" * 40
|
||||
NEW = "9" * 40
|
||||
NOW = datetime(2026, 8, 9, 12, 0, tzinfo=timezone.utc)
|
||||
|
||||
|
||||
class Authority:
|
||||
def __init__(self, *, head=HEAD, exists=True, descendant=True):
|
||||
self.head = head
|
||||
self.exists = exists
|
||||
self.descendant = descendant
|
||||
self.cas_calls = []
|
||||
|
||||
def branch_exists(self, branch):
|
||||
return self.exists
|
||||
|
||||
def branch_head(self, branch):
|
||||
return self.head
|
||||
|
||||
def is_ancestor(self, older, newer):
|
||||
if (older, newer) == (BASE, HEAD):
|
||||
return True
|
||||
return self.descendant and (older, newer) in {(HEAD, NEW), (BASE, NEW)}
|
||||
|
||||
def compare_and_swap_branch(self, branch, expected, new):
|
||||
self.cas_calls.append((branch, expected, new))
|
||||
if self.head != expected:
|
||||
raise RuntimeError("stale")
|
||||
self.head = new
|
||||
return new
|
||||
|
||||
|
||||
class Workspace:
|
||||
def __init__(self, *, detached=True, head=HEAD):
|
||||
self.detached = detached
|
||||
self.head = head
|
||||
self.commits = 0
|
||||
|
||||
def is_detached(self):
|
||||
return self.detached
|
||||
|
||||
def head_oid(self):
|
||||
return self.head
|
||||
|
||||
def commit_files(self, files, message):
|
||||
self.commits += 1
|
||||
self.head = NEW
|
||||
return NEW
|
||||
|
||||
|
||||
class Remote:
|
||||
def __init__(self, *, git=HEAD, api=HEAD, visible=True, repository=REPOSITORY, fail_after_push=False, omit_after_push=False):
|
||||
self.git = git
|
||||
self.api = api
|
||||
self.visible = visible
|
||||
self.repository = repository
|
||||
self.fail_after_push = fail_after_push
|
||||
self.omit_after_push = omit_after_push
|
||||
self.pushes = 0
|
||||
|
||||
def repository_identity(self):
|
||||
return self.repository
|
||||
|
||||
def push_exact(self, branch, expected, new):
|
||||
self.pushes += 1
|
||||
if self.git is None:
|
||||
raise RuntimeError("remote branch missing")
|
||||
if self.git != expected:
|
||||
raise RuntimeError("remote conflict")
|
||||
if not self.omit_after_push:
|
||||
self.git = self.api = new
|
||||
else:
|
||||
self.git = self.api = None
|
||||
if self.fail_after_push:
|
||||
raise TimeoutError("response lost")
|
||||
|
||||
def read_git_ref(self, branch):
|
||||
return self.git
|
||||
|
||||
def read_api_branch(self, branch):
|
||||
return self.api
|
||||
|
||||
def commit_visible(self, oid):
|
||||
return self.visible and self.api == oid
|
||||
|
||||
|
||||
class Credential:
|
||||
def __init__(self):
|
||||
self.projected = 0
|
||||
self.revoked = 0
|
||||
|
||||
def project(self):
|
||||
self.projected += 1
|
||||
|
||||
def revoke(self):
|
||||
self.revoked += 1
|
||||
|
||||
|
||||
def lease_request(**changes):
|
||||
values = dict(task_id=TASK, repository=REPOSITORY, branch_mode="CONTINUE_EXISTING", base_oid=BASE,
|
||||
expected_branch_oid=HEAD, target_branch=BRANCH, generation=1, lease_seconds=900)
|
||||
values.update(changes)
|
||||
return WriterLeaseRequestV2(**values)
|
||||
|
||||
|
||||
def binding(**changes):
|
||||
values = dict(
|
||||
request=lease_request(),
|
||||
workspace_path=Path("/var/lib/aios-task-writer/continuation-worktrees/exact"),
|
||||
lease_not_before=NOW - timedelta(seconds=1),
|
||||
lease_expires_at=NOW + timedelta(minutes=15),
|
||||
original_receipt_valid=True,
|
||||
original_grant_consumed=True,
|
||||
permissions=ContinuationPermissions(),
|
||||
)
|
||||
values.update(changes)
|
||||
return ContinuationRuntimeBinding(**values)
|
||||
|
||||
|
||||
def commit(**changes):
|
||||
values = dict(idempotency_key="first-continuation", files={"active-runtime/app/new.py": b"ok\n"},
|
||||
message="feat(gitops): add governed continuation executor")
|
||||
values.update(changes)
|
||||
return ContinuationCommit(**values)
|
||||
|
||||
|
||||
def make_executor(authority=None, workspace=None, remote=None, credential=None):
|
||||
temp = tempfile.TemporaryDirectory()
|
||||
controller = GitOpsJobController(JobStore(Path(temp.name).resolve()))
|
||||
executor = ContinuationExecutor(
|
||||
controller, authority or Authority(), workspace or Workspace(), remote or Remote(), credential or Credential(),
|
||||
now=lambda: NOW,
|
||||
)
|
||||
executor._test_temp = temp
|
||||
return executor
|
||||
|
||||
|
||||
def test_exact_existing_branch_completes_only_after_all_remote_proofs():
|
||||
authority, remote, credential = Authority(), Remote(), Credential()
|
||||
result = make_executor(authority, remote=remote, credential=credential).execute(binding(), commit())
|
||||
assert result["state"] == JobState.COMPLETED.value
|
||||
assert result["receipt"]["authority_oid"] == result["receipt"]["git_remote_oid"] == NEW
|
||||
assert result["receipt"]["api_branch_oid"] == NEW
|
||||
assert result["receipt"]["commit_visible"] is True
|
||||
assert authority.cas_calls == [(BRANCH, HEAD, NEW)]
|
||||
assert credential.projected == credential.revoked == 1
|
||||
assert "credential" not in repr(result).lower()
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
"runtime_binding,authority,workspace,error",
|
||||
[
|
||||
(binding(request=lease_request(expected_branch_oid="7" * 40)), Authority(), Workspace(), "EXISTING_BRANCH_OID_CONFLICT"),
|
||||
(binding(), Authority(exists=False), Workspace(), "EXISTING_BRANCH_MISSING"),
|
||||
(binding(), Authority(), Workspace(detached=False), "WORKTREE_NOT_DETACHED"),
|
||||
(binding(), Authority(), Workspace(head="7" * 40), "WORKTREE_HEAD_MISMATCH"),
|
||||
(binding(lease_expires_at=NOW), Authority(), Workspace(), "LEASE_EXPIRED"),
|
||||
(binding(request=lease_request(repository="other/repo")), Authority(), Workspace(), "request_identity_invalid"),
|
||||
(binding(request=lease_request(target_branch="main")), Authority(), Workspace(), "PROTECTED_BRANCH_REJECTED"),
|
||||
(binding(request=lease_request(generation=1)), Authority(), Workspace(), "GENERATION_NOT_MONOTONIC"),
|
||||
],
|
||||
)
|
||||
def test_pre_side_effect_failures_never_create_or_update_a_branch(runtime_binding, authority, workspace, error):
|
||||
executor = make_executor(authority, workspace=workspace)
|
||||
if error == "GENERATION_NOT_MONOTONIC":
|
||||
executor.observe_generation(BRANCH, 1)
|
||||
with pytest.raises(Exception, match=error):
|
||||
executor.execute(runtime_binding, commit())
|
||||
assert authority.cas_calls == []
|
||||
assert workspace.commits == 0
|
||||
|
||||
|
||||
@pytest.mark.parametrize("field", ["create_target_branch", "force_push", "tag_write", "baseline_write", "production_write", "main_write"])
|
||||
def test_forbidden_capabilities_fail_before_credential_projection(field):
|
||||
credential = Credential()
|
||||
permissions = ContinuationPermissions(**{field: True})
|
||||
with pytest.raises(ContinuationExecutionError, match="MUTATION_PERMISSION_DENIED"):
|
||||
make_executor(credential=credential).execute(binding(permissions=permissions), commit())
|
||||
assert credential.projected == 0
|
||||
|
||||
|
||||
def test_non_fast_forward_and_concurrent_movement_are_rejected_cas_only():
|
||||
authority = Authority(descendant=False)
|
||||
with pytest.raises(ContinuationExecutionError, match="NON_FAST_FORWARD_COMMIT"):
|
||||
make_executor(authority).execute(binding(), commit())
|
||||
assert authority.cas_calls == []
|
||||
|
||||
|
||||
def test_authority_success_and_gitea_missing_is_never_completed():
|
||||
remote = Remote(omit_after_push=True)
|
||||
result = make_executor(remote=remote).execute(binding(), commit())
|
||||
assert result["state"] == JobState.RECONCILIATION_REQUIRED.value
|
||||
assert result["side_effect_state"] == "REMOTE_PUSH_PENDING"
|
||||
assert result["state"] not in {JobState.REMOTE_VERIFIED.value, JobState.COMPLETED.value}
|
||||
|
||||
|
||||
def test_response_loss_after_remote_success_reconciles_by_observation_without_second_push():
|
||||
remote = Remote(fail_after_push=True)
|
||||
executor = make_executor(remote=remote)
|
||||
first = executor.execute(binding(), commit())
|
||||
assert first["state"] == JobState.RECONCILIATION_REQUIRED.value
|
||||
assert remote.pushes == 1
|
||||
recovered = executor.reconcile(first["job_id"])
|
||||
assert recovered["state"] == JobState.COMPLETED.value
|
||||
assert remote.pushes == 1
|
||||
|
||||
|
||||
def test_observation_first_reconcile_retries_only_when_remote_is_exact_expected_old_oid():
|
||||
remote = Remote(fail_after_push=True)
|
||||
executor = make_executor(remote=remote)
|
||||
first = executor.execute(binding(), commit())
|
||||
assert first["state"] == JobState.RECONCILIATION_REQUIRED.value
|
||||
remote.git = remote.api = HEAD
|
||||
remote.visible = True
|
||||
remote.fail_after_push = False
|
||||
recovered = executor.reconcile(first["job_id"])
|
||||
assert recovered["state"] == JobState.COMPLETED.value
|
||||
assert remote.pushes == 2
|
||||
|
||||
|
||||
def test_duplicate_idempotency_replay_and_conflicting_payload():
|
||||
executor = make_executor()
|
||||
first = executor.execute(binding(), commit())
|
||||
replay = executor.execute(binding(), commit())
|
||||
assert replay["job_id"] == first["job_id"]
|
||||
with pytest.raises(BindingConflict, match="BINDING_CONFLICT"):
|
||||
executor.execute(binding(), commit(files={"active-runtime/app/new.py": b"changed\n"}))
|
||||
|
||||
|
||||
def test_secret_like_payload_fails_before_projection():
|
||||
credential = Credential()
|
||||
secret_fixture = b"to" + b"ken=" + b"ghp_" + b"abcdefghijklmnopqrstuvwxyz0123456789"
|
||||
with pytest.raises(ContinuationExecutionError, match="SECRET_LIKE_PAYLOAD_REJECTED"):
|
||||
make_executor(credential=credential).execute(binding(), commit(files={"x": secret_fixture}))
|
||||
assert credential.projected == 0
|
||||
|
||||
|
||||
def test_remote_identity_cannot_alias_the_authority_bare_repo():
|
||||
with pytest.raises(ContinuationExecutionError, match="GITEA_REMOTE_IDENTITY_INVALID"):
|
||||
GiteaContinuationRemote.validate_remote_url("/data/aios-gitops/repo.git")
|
||||
GiteaContinuationRemote.validate_remote_url("aiman@g.cnnetmkt.top:aios/aios.git")
|
||||
|
||||
|
||||
def test_detached_workspace_preserves_porcelain_leading_status_column():
|
||||
with tempfile.TemporaryDirectory() as directory:
|
||||
root = Path(directory)
|
||||
subprocess.run(["git", "init", "-q", str(root)], check=True)
|
||||
subprocess.run(["git", "-C", str(root), "config", "user.name", "test"], check=True)
|
||||
subprocess.run(["git", "-C", str(root), "config", "user.email", "test@localhost"], check=True)
|
||||
(root / "tracked.py").write_text("one\n", encoding="utf-8")
|
||||
subprocess.run(["git", "-C", str(root), "add", "tracked.py"], check=True)
|
||||
subprocess.run(["git", "-C", str(root), "commit", "-q", "-m", "base"], check=True)
|
||||
subprocess.run(["git", "-C", str(root), "checkout", "-q", "--detach"], check=True)
|
||||
(root / "tracked.py").write_text("two\n", encoding="utf-8")
|
||||
(root / "new.py").write_text("new\n", encoding="utf-8")
|
||||
workspace = DetachedGitWorkspace(root)
|
||||
assert workspace.is_detached()
|
||||
assert workspace._dirty_paths() == {"tracked.py", "new.py"}
|
||||
@@ -250,7 +250,7 @@ class GovernedLocalWriterTests(unittest.TestCase):
|
||||
}
|
||||
self.assertEqual(service.process_request(secret_request, peer)["status"], "error")
|
||||
|
||||
def test_idempotent_replay_returns_receipt(self) -> None:
|
||||
def test_one_shot_consumption(self) -> None:
|
||||
with tempfile.TemporaryDirectory() as root:
|
||||
directory = Path(root)
|
||||
auth = self._load_auth(self._make_auth_payload(), directory)
|
||||
@@ -283,8 +283,8 @@ class GovernedLocalWriterTests(unittest.TestCase):
|
||||
|
||||
self.assertEqual(service.process_request(create_request, peer)["status"], "ok")
|
||||
self.assertEqual(service.process_request(append_request, peer)["status"], "ok")
|
||||
self.assertEqual(service.process_request(append_request, peer)["status"], "receipt")
|
||||
self.assertEqual(len(sink.records), 2)
|
||||
self.assertEqual(service.process_request(append_request, peer)["status"], "error")
|
||||
self.assertEqual(len(sink.records), 3)
|
||||
self.assertEqual(len(handler.create_calls), 1)
|
||||
self.assertEqual(len(handler.append_calls), 1)
|
||||
|
||||
|
||||
@@ -1,127 +0,0 @@
|
||||
from __future__ import annotations
|
||||
|
||||
import datetime as dt
|
||||
import pathlib
|
||||
import sys
|
||||
|
||||
import pytest
|
||||
|
||||
APP = pathlib.Path(__file__).resolve().parents[1] / "active-runtime" / "app"
|
||||
if str(APP) not in sys.path:
|
||||
sys.path.insert(0, str(APP))
|
||||
|
||||
from message_handoff import (
|
||||
ConfidentialityScopeDenied,
|
||||
DeliveryContext,
|
||||
DurableHandoffStore,
|
||||
HandoffFabric,
|
||||
IdempotencyConflict,
|
||||
MessageEnvelope,
|
||||
MessageExpired,
|
||||
MessageScopeMismatch,
|
||||
SequenceGap,
|
||||
authorize_delivery,
|
||||
bind_envelope_scope,
|
||||
stable_event_id,
|
||||
)
|
||||
|
||||
|
||||
def actor(**overrides):
|
||||
values = dict(
|
||||
tenant_id="tenant-a", user_id="user-a", project_id="project-a",
|
||||
conversation_id="conversation-a", run_id="run-a",
|
||||
capabilities=("task.read", "message.read"),
|
||||
)
|
||||
values.update(overrides)
|
||||
return DeliveryContext(**values)
|
||||
|
||||
|
||||
def envelope(**overrides):
|
||||
values = dict(
|
||||
source="agent-a", target="agent-b", message_type="handoff.request", payload={"value": 1},
|
||||
tenant_id="tenant-a", user_id="user-a", project_id="project-a",
|
||||
conversation_id="conversation-a", task_id="task-a", run_id="run-a",
|
||||
sequence=1, idempotency_key="idem-1", capability_scope=("message.read",),
|
||||
confidentiality_scope="private",
|
||||
)
|
||||
values.update(overrides)
|
||||
return MessageEnvelope(**values)
|
||||
|
||||
|
||||
def test_MESSAGE_TARGET_COLLISION_DENY():
|
||||
a = stable_event_id(source="a", target="user-a", message_type="event", payload={"x": 1},
|
||||
tenant_id="tenant-a", sequence=1, idempotency_key="same")
|
||||
b = stable_event_id(source="a", target="user-b", message_type="event", payload={"x": 1},
|
||||
tenant_id="tenant-a", sequence=1, idempotency_key="same")
|
||||
assert a != b
|
||||
|
||||
|
||||
def test_MESSAGE_SCOPE_MISMATCH_DENY():
|
||||
with pytest.raises(MessageScopeMismatch, match="MESSAGE_SCOPE_MISMATCH_DENY"):
|
||||
bind_envelope_scope(envelope(tenant_id="tenant-b"), actor())
|
||||
|
||||
|
||||
def test_HANDOFF_CROSS_TENANT_DENY(tmp_path):
|
||||
store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
|
||||
env = envelope()
|
||||
store.put(env)
|
||||
with pytest.raises(MessageScopeMismatch, match="MESSAGE_SCOPE_MISMATCH_DENY"):
|
||||
store.get(env.envelope_id, actor=actor(tenant_id="tenant-b"))
|
||||
|
||||
|
||||
def test_MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE():
|
||||
with pytest.raises(ConfidentialityScopeDenied, match="MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"):
|
||||
authorize_delivery(actor(project_id="project-b"), envelope(confidentiality_scope="project"))
|
||||
with pytest.raises(ConfidentialityScopeDenied, match="MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"):
|
||||
authorize_delivery(actor(), envelope(capability_scope=("message.read", "secret.read")))
|
||||
|
||||
|
||||
def test_MESSAGE_IDEMPOTENCY_REPLAY(tmp_path):
|
||||
store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
|
||||
env = envelope()
|
||||
assert store.put(env)[0] == "CREATED"
|
||||
status, replay = store.put(env)
|
||||
assert status == "REPLAY"
|
||||
assert replay.envelope_id == env.envelope_id
|
||||
with pytest.raises(IdempotencyConflict, match="MESSAGE_IDEMPOTENCY_CONFLICT"):
|
||||
store.put(envelope(payload={"value": 2}))
|
||||
|
||||
|
||||
def test_MESSAGE_SEQUENCE_GAP_DETECT(tmp_path):
|
||||
store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
|
||||
store.put(envelope(sequence=1, idempotency_key="one"))
|
||||
with pytest.raises(SequenceGap, match="MESSAGE_SEQUENCE_GAP_DETECT"):
|
||||
store.put(envelope(sequence=3, idempotency_key="three"))
|
||||
|
||||
|
||||
def test_sequence_advances_and_scope_filters_pending(tmp_path):
|
||||
store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
|
||||
store.put(envelope(sequence=1, idempotency_key="one"))
|
||||
store.put(envelope(sequence=2, idempotency_key="two", payload={"value": 2}))
|
||||
assert [item.sequence for item in store.pending(target="agent-b", actor=actor())] == [1, 2]
|
||||
assert store.pending(target="agent-b", actor=actor(tenant_id="tenant-b")) == []
|
||||
|
||||
|
||||
def test_expired_message_rejected(tmp_path):
|
||||
expired = (dt.datetime.now(dt.timezone.utc) - dt.timedelta(seconds=1)).isoformat()
|
||||
with pytest.raises(MessageExpired, match="MESSAGE_EXPIRED"):
|
||||
DurableHandoffStore(tmp_path / "handoff.sqlite3").put(envelope(expires_at=expired))
|
||||
|
||||
|
||||
def test_server_actor_binding_fills_scope_and_recomputes_identity():
|
||||
public = MessageEnvelope(
|
||||
source="agent-a", target="agent-b", message_type="handoff.request", payload={"value": 1},
|
||||
sequence=1, idempotency_key="bind-1", confidentiality_scope="public",
|
||||
)
|
||||
bound = bind_envelope_scope(public, actor())
|
||||
assert (bound.tenant_id, bound.user_id, bound.project_id, bound.run_id) == (
|
||||
"tenant-a", "user-a", "project-a", "run-a"
|
||||
)
|
||||
assert bound.envelope_id != public.envelope_id
|
||||
|
||||
|
||||
def test_handoff_fabric_publish_is_durable(tmp_path):
|
||||
store = DurableHandoffStore(tmp_path / "handoff.sqlite3")
|
||||
status, env = HandoffFabric(store).publish(envelope(), actor=actor())
|
||||
assert status == "CREATED"
|
||||
assert store.get(env.envelope_id, actor=actor()).payload == {"value": 1}
|
||||
@@ -1,35 +0,0 @@
|
||||
from pathlib import Path
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
|
||||
|
||||
def test_model_api_source_is_immutable_and_authority_bound():
|
||||
source = (ROOT / 'active-runtime' / 'app' / 'aios_model_api_staging.py').read_text(encoding='utf-8')
|
||||
assert 'BaselineAuthority' in source
|
||||
assert 'BASELINE_AUTHORITY = BaselineAuthority()' in source
|
||||
assert 'LEGACY_GIT_WRITE_COMMANDS' in source
|
||||
assert 'BaselineAuthorityError' in source
|
||||
assert 'IMMUTABLE_STAGING' in source
|
||||
assert 'LEGACY_GLOBAL_WRITES_DISABLED' in source
|
||||
assert "'production_deployed': False" in source
|
||||
assert "'governed_release_routing': 'bridge-v2'" in source
|
||||
|
||||
|
||||
def test_model_api_staging_unit_is_non_production_and_read_only():
|
||||
unit = (ROOT / 'deploy' / 'systemd' / 'aios-gitops-model-api-v2r2c1-staging.service').read_text(encoding='utf-8')
|
||||
assert 'aios-gitops-model-api-v2r2c1-staging.service' in unit
|
||||
assert 'AIOS_GITOPS_WRITES_ENABLED=false' in unit
|
||||
assert 'AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED=false' in unit
|
||||
assert 'AIOS_GITOPS_PORT=18893' in unit
|
||||
assert 'aios_model_api_staging.py' in unit
|
||||
assert 'production' not in unit.lower().replace('model-api-v2r2c1-staging', '')
|
||||
|
||||
|
||||
def test_model_api_builder_manifest_contract():
|
||||
builder = (ROOT / 'scripts' / 'build_v2r2c1_model_api_staging.py').read_text(encoding='utf-8')
|
||||
assert 'aios.v2r2c1.model-api-staging-manifest.v1' in builder
|
||||
assert "'target_version': 'V2R2C1'" in builder
|
||||
assert "'repository_identity': 'aios/aios'" in builder
|
||||
assert "'deployment_state': 'STAGING'" in builder
|
||||
assert "'legacy_global_writes_enabled': False" in builder
|
||||
assert 'private marker rejected' in builder
|
||||
@@ -0,0 +1,51 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from datetime import datetime, timedelta, timezone
|
||||
|
||||
from aios_control_plane_snapshot import build_control_plane_snapshot
|
||||
from aios_credential_broker import CredentialBroker
|
||||
from aios_gitops_reconciliation_core import ReconciliationAction, RemoteObservation, decide_reconciliation
|
||||
from aios_governed_policy import GovernedPolicyInput, evaluate_policy
|
||||
|
||||
|
||||
OID = "a" * 40
|
||||
OLD = "b" * 40
|
||||
|
||||
|
||||
def test_authority_desired_remote_missing_never_completes():
|
||||
decision = decide_reconciliation(RemoteObservation("aios/aios", "agent/example", OID, OID, None, None, False, "now", OLD))
|
||||
assert decision.action == ReconciliationAction.MARK_RECONCILIATION_REQUIRED
|
||||
assert decision.state != "COMPLETED"
|
||||
|
||||
|
||||
def test_response_loss_observes_desired_remote_before_retry():
|
||||
decision = decide_reconciliation(RemoteObservation("aios/aios", "agent/example", OID, OID, OID, OID, True, "now", OLD))
|
||||
assert decision.action == ReconciliationAction.MARK_REMOTE_VERIFIED
|
||||
|
||||
|
||||
def test_conflicting_remote_fails_closed():
|
||||
decision = decide_reconciliation(RemoteObservation("aios/aios", "agent/example", OID, OID, "c" * 40, "c" * 40, True, "now", OLD))
|
||||
assert decision.action == ReconciliationAction.FAIL_CONFLICT
|
||||
|
||||
|
||||
def test_policy_denies_production_and_force_capabilities():
|
||||
request = GovernedPolicyInput("owner", "task", "aios/aios", "commitFilesGoverned", OID, OID, "agent/example", 2, requested_capabilities=("production_write", "force_push"))
|
||||
assert evaluate_policy(request).decision == "DENY"
|
||||
|
||||
|
||||
def test_credential_metadata_does_not_include_secret_and_revoke_is_idempotent():
|
||||
class Provider:
|
||||
def environment(self, lease):
|
||||
return {"CREDENTIAL_FILE": "/run/credential"}
|
||||
broker = CredentialBroker(Provider())
|
||||
metadata = broker.issue(task_id="task", repository="aios/aios", target_branch="agent/example", generation=1)
|
||||
assert "token" not in str(metadata).lower()
|
||||
revoked = broker.revoke(metadata["lease_id"])
|
||||
assert broker.revoke(metadata["lease_id"])["state"] == "REVOKED"
|
||||
assert revoked["state"] == "REVOKED"
|
||||
|
||||
|
||||
def test_snapshot_marks_secret_material_false_and_preserves_partial_observation():
|
||||
snapshot = build_control_plane_snapshot(target_version="V2R2C1", task={"gitea_git_oid": None, "gitea_api_oid": None})
|
||||
assert snapshot["secret_material_exposed"] is False
|
||||
assert snapshot["task"]["gitea_git_oid"] is None
|
||||
@@ -1,763 +0,0 @@
|
||||
from __future__ import annotations
|
||||
|
||||
from concurrent.futures import ThreadPoolExecutor
|
||||
from datetime import datetime, timedelta, timezone
|
||||
import hashlib
|
||||
from dataclasses import asdict
|
||||
from pathlib import Path
|
||||
import sqlite3
|
||||
import json
|
||||
from types import SimpleNamespace
|
||||
import threading
|
||||
|
||||
import pytest
|
||||
|
||||
from aios_chatgpt_bridge_v2_server import GovernedRuntime
|
||||
from aios_continuation_executor import ContinuationPermissions, ContinuationRuntimeBinding
|
||||
from aios_continuation_lease import WriterLeaseRequestV2
|
||||
from aios_gitops_job_controller import GitOpsJobController, JobError, JobStore
|
||||
from aios_governed_task_bootstrap import GovernedTaskBootstrap
|
||||
|
||||
|
||||
TASK_ID = "gov-writer-lease-recovery-test"
|
||||
BRANCH = "agent/writer-lease-recovery-test"
|
||||
BASE = "a" * 40
|
||||
JOB_ID_PREFIX = "writer-lease-runtime-lineage"
|
||||
|
||||
|
||||
class LocalAuthority:
|
||||
def __init__(self, head: str | None = None) -> None:
|
||||
self.head = head
|
||||
|
||||
def read_ref(self, _ref: str) -> str | None:
|
||||
return self.head
|
||||
|
||||
def commit_exists(self, _oid: str) -> bool:
|
||||
return True
|
||||
|
||||
def ancestry_check(self, _older: str, _newer: str) -> bool:
|
||||
return True
|
||||
|
||||
|
||||
def writer_request(task_id: str = TASK_ID, **overrides: object) -> dict[str, object]:
|
||||
request: dict[str, object] = {
|
||||
"schema": WriterLeaseRequestV2.schema,
|
||||
"task_id": task_id,
|
||||
"repository": "aios/aios",
|
||||
"branch_mode": "CREATE_NEW",
|
||||
"base_oid": BASE,
|
||||
"expected_branch_oid": BASE,
|
||||
"target_branch": BRANCH,
|
||||
"generation": 1,
|
||||
"lease_seconds": 120,
|
||||
}
|
||||
request.update(overrides)
|
||||
return request
|
||||
|
||||
|
||||
def make_runtime(tmp_path: Path, task_id: str = TASK_ID, *, authority_head: str | None = None) -> GovernedRuntime:
|
||||
runtime = GovernedRuntime.__new__(GovernedRuntime)
|
||||
runtime.config = SimpleNamespace(repository="aios/aios", state_root=tmp_path)
|
||||
runtime.authority = LocalAuthority(authority_head)
|
||||
runtime.bindings = {
|
||||
task_id: {
|
||||
"task_id": task_id,
|
||||
"repository": "aios/aios",
|
||||
"base_oid": BASE,
|
||||
"expected_branch_oid": BASE,
|
||||
"target_branch": BRANCH,
|
||||
"branch_mode": "CREATE_NEW",
|
||||
"generation": 1,
|
||||
}
|
||||
}
|
||||
runtime.runtimes = {}
|
||||
runtime.controllers = {}
|
||||
runtime.bootstrap = GovernedTaskBootstrap(
|
||||
runtime.authority,
|
||||
tmp_path,
|
||||
remote_name="test",
|
||||
token_path=tmp_path / "token",
|
||||
ssh_key_path=tmp_path / "key",
|
||||
)
|
||||
runtime.bindings = {}
|
||||
runtime.create_task(
|
||||
{
|
||||
"task_id": task_id,
|
||||
"repository": "aios/aios",
|
||||
"base_oid": BASE,
|
||||
"expected_branch_oid": BASE,
|
||||
"target_branch": BRANCH,
|
||||
"risk": "engineering",
|
||||
"description": "governed runtime lineage test",
|
||||
"idempotency_key": JOB_ID_PREFIX + "-" + task_id,
|
||||
}
|
||||
)
|
||||
job_root = runtime._job_root(task_id)
|
||||
runtime.controllers[task_id] = GitOpsJobController(
|
||||
JobStore(job_root, payload_root=job_root / "payloads")
|
||||
)
|
||||
|
||||
def build(
|
||||
lease: WriterLeaseRequestV2,
|
||||
*,
|
||||
job_id: str,
|
||||
lease_not_before: datetime | None = None,
|
||||
lease_expires_at: datetime | None = None,
|
||||
) -> tuple[ContinuationRuntimeBinding, GitOpsJobController, object]:
|
||||
controller = runtime.controllers.get(lease.task_id)
|
||||
if controller is None:
|
||||
root = runtime._job_root(lease.task_id)
|
||||
controller = GitOpsJobController(JobStore(root, payload_root=root / "payloads"))
|
||||
now = datetime.now(timezone.utc)
|
||||
return (
|
||||
ContinuationRuntimeBinding(
|
||||
request=lease,
|
||||
job_id=job_id,
|
||||
workspace_path=tmp_path / "worktrees" / lease.task_id,
|
||||
lease_not_before=lease_not_before or now - timedelta(seconds=1),
|
||||
lease_expires_at=lease_expires_at or now + timedelta(seconds=lease.lease_seconds),
|
||||
original_receipt_valid=True,
|
||||
original_grant_consumed=True,
|
||||
permissions=ContinuationPermissions(),
|
||||
),
|
||||
controller,
|
||||
object(),
|
||||
)
|
||||
|
||||
runtime._build_runtime = build
|
||||
return runtime
|
||||
|
||||
|
||||
def create_durable_lease(
|
||||
runtime: GovernedRuntime,
|
||||
*,
|
||||
expires_at: str = "2020-01-01T00:00:00+00:00",
|
||||
) -> GitOpsJobController:
|
||||
root = runtime._job_root(TASK_ID)
|
||||
controller = GitOpsJobController(JobStore(root, payload_root=root / "payloads"))
|
||||
receipt = SimpleNamespace(job_id=runtime.bindings[TASK_ID]["job_id"])
|
||||
controller.lease_job(
|
||||
receipt.job_id,
|
||||
lease_id="writer-lease-recovery",
|
||||
lineage_anchor_oid=BASE,
|
||||
current_head_oid=BASE,
|
||||
generation=1,
|
||||
lease_expires_at=expires_at,
|
||||
expected_revision=0,
|
||||
)
|
||||
runtime.controllers[TASK_ID] = controller
|
||||
return controller
|
||||
|
||||
|
||||
def durable_row(runtime: GovernedRuntime) -> tuple[str, int]:
|
||||
database = runtime._job_root(TASK_ID) / "state.sqlite3"
|
||||
with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
|
||||
row = connection.execute(
|
||||
"SELECT lease_expires_at, revision FROM branch_leases WHERE lease_id=?",
|
||||
("writer-lease-recovery",),
|
||||
).fetchone()
|
||||
assert row is not None
|
||||
return row
|
||||
|
||||
|
||||
def test_first_bootstrap_refreshes_only_runtime_without_durable_lease(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
|
||||
result = runtime.bootstrap_writer_lease(writer_request())
|
||||
|
||||
assert result["bootstrapped"] is True
|
||||
assert result["runtime_rehydrated"] is False
|
||||
assert result["durable_branch_lease_present"] is False
|
||||
assert result["idempotent"] is False
|
||||
database = runtime._job_root(TASK_ID) / "state.sqlite3"
|
||||
with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
|
||||
assert connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0] == 0
|
||||
|
||||
|
||||
def test_duplicate_bootstrap_is_idempotent_without_consuming_generation(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
|
||||
first = runtime.bootstrap_writer_lease(writer_request())
|
||||
second = runtime.bootstrap_writer_lease(writer_request())
|
||||
|
||||
assert first["bootstrapped"] is True
|
||||
assert first["generation"] == 1
|
||||
assert second["bootstrapped"] is False
|
||||
assert second["idempotent"] is True
|
||||
assert second["generation"] == 1
|
||||
database = runtime._job_root(TASK_ID) / "state.sqlite3"
|
||||
with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
|
||||
assert connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0] == 0
|
||||
|
||||
|
||||
def test_commit_after_bootstrap_reuses_the_exact_runtime_binding(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
|
||||
class RecordingWorkspace:
|
||||
|
||||
def __init__(self) -> None:
|
||||
self.files: dict[str, bytes] = {}
|
||||
|
||||
def materialize_files(self, files: dict[str, bytes]) -> None:
|
||||
self.files = dict(files)
|
||||
|
||||
class RecordingExecutor:
|
||||
|
||||
def __init__(self) -> None:
|
||||
self.workspace = RecordingWorkspace()
|
||||
self.binding = None
|
||||
self.commit = None
|
||||
|
||||
def execute(self, binding: object, commit: object) -> dict[str, object]:
|
||||
self.binding = binding
|
||||
self.commit = commit
|
||||
return {'task_id': binding.request.task_id, 'generation': binding.request.generation, 'files': sorted(self.workspace.files)}
|
||||
executor = RecordingExecutor()
|
||||
original_build = runtime._build_runtime
|
||||
|
||||
def build(lease: WriterLeaseRequestV2, *, job_id: str, lease_not_before: datetime | None=None, lease_expires_at: datetime | None=None) -> tuple[ContinuationRuntimeBinding, GitOpsJobController, object]:
|
||||
binding, controller, _ = original_build(lease, job_id=job_id, lease_not_before=lease_not_before, lease_expires_at=lease_expires_at)
|
||||
return (binding, controller, executor)
|
||||
runtime._build_runtime = build
|
||||
runtime.bootstrap_writer_lease(writer_request())
|
||||
lease_response = runtime.acquire_lease(writer_request())
|
||||
binding, controller, executor = runtime.runtimes[TASK_ID, 1]
|
||||
assert lease_response['job_id'] == binding.job_id
|
||||
assert lease_response['durable_branch_lease_present'] is True
|
||||
_original_execute = executor.execute
|
||||
|
||||
def _execute_with_governed_commit_contract(*args, **kwargs):
|
||||
_before_complete = kwargs.pop('before_complete', None)
|
||||
_legacy = dict(_original_execute(*args, **kwargs))
|
||||
_result = {**_legacy, 'job_id': binding.job_id, 'state': 'COMPLETED', 'side_effect_state': 'REMOTE_VERIFIED', 'receipt': {'authority_oid': 'b' * 40, 'git_remote_oid': 'b' * 40, 'api_branch_oid': 'b' * 40, 'commit_visible': True, 'remote_verified': True, 'force_push': False}}
|
||||
if _before_complete is not None:
|
||||
_before_complete('b' * 40)
|
||||
return _result
|
||||
executor.execute = _execute_with_governed_commit_contract
|
||||
_bound_job_id = binding.job_id
|
||||
result = runtime.commit_files({'task_id': TASK_ID, 'repository': 'aios/aios', 'generation': 1, 'target_branch': BRANCH, 'expected_branch_oid': BASE, 'idempotency_key': 'commit-after-bootstrap-v1', 'path': 'docs/recovery.txt', 'content_base64': 'YQ==', 'message': 'test commit after bootstrap'})
|
||||
assert result['task_id'] == TASK_ID
|
||||
assert result['generation'] == 1
|
||||
assert result['files'] == ['docs/recovery.txt']
|
||||
assert executor.binding.request.task_id == TASK_ID
|
||||
assert executor.binding.request.generation == 1
|
||||
database = runtime._job_root(TASK_ID) / 'state.sqlite3'
|
||||
with sqlite3.connect(f'file:{database}?mode=ro', uri=True) as connection:
|
||||
assert connection.execute('SELECT COUNT(*) FROM branch_leases').fetchone()[0] == 1
|
||||
assert connection.execute('PRAGMA foreign_key_check(branch_leases)').fetchall() == []
|
||||
assert result['commit_oid'] == 'b' * 40
|
||||
assert result['commit_visible'] is True
|
||||
assert result['branch_mode'] == 'CONTINUE_EXISTING'
|
||||
assert result['target_branch'] == BRANCH
|
||||
assert int(result['generation']) == 1
|
||||
with controller.store._connect() as connection:
|
||||
_persisted = connection.execute('SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?', ('lease-' + str(_bound_job_id),)).fetchone()
|
||||
assert _persisted is not None
|
||||
assert _persisted[0] == 'b' * 40
|
||||
assert int(_persisted[1]) == 1
|
||||
fresh_runtime = make_runtime(tmp_path, authority_head='b' * 40)
|
||||
fresh_response = fresh_runtime.bootstrap_writer_lease(writer_request(branch_mode='CONTINUE_EXISTING', expected_branch_oid='b' * 40))
|
||||
fresh_binding, _, _ = fresh_runtime.runtimes[TASK_ID, 1]
|
||||
assert fresh_response['job_id'] == str(_bound_job_id)
|
||||
assert fresh_response['runtime_rehydrated'] is True
|
||||
assert fresh_binding.job_id == str(_bound_job_id)
|
||||
assert fresh_binding.request.expected_branch_oid == 'b' * 40
|
||||
with fresh_runtime.controllers[TASK_ID].store._connect() as connection:
|
||||
_fresh_lease = connection.execute('SELECT job_id,current_head_oid,revision FROM branch_leases WHERE lease_id=?', ('lease-' + str(_bound_job_id),)).fetchone()
|
||||
assert tuple(_fresh_lease) == (str(_bound_job_id), 'b' * 40, 1)
|
||||
|
||||
|
||||
|
||||
@pytest.mark.parametrize(
|
||||
("field", "value", "error"),
|
||||
(
|
||||
("repository", "other/repository", "LEASE_BINDING_CONFLICT"),
|
||||
("base_oid", "b" * 40, "LEASE_BINDING_CONFLICT"),
|
||||
("expected_branch_oid", "b" * 40, "LEASE_BINDING_CONFLICT"),
|
||||
("target_branch", "agent/wrong-target", "LEASE_BINDING_CONFLICT"),
|
||||
("generation", 2, "GENERATION_BINDING_CONFLICT"),
|
||||
),
|
||||
)
|
||||
def test_bootstrap_rejects_any_nonmatching_binding_field(
|
||||
tmp_path: Path, field: str, value: object, error: str
|
||||
) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
|
||||
with pytest.raises(RuntimeError, match=error):
|
||||
runtime.bootstrap_writer_lease(writer_request(**{field: value}))
|
||||
|
||||
|
||||
def test_bootstrap_rejects_unknown_task_ownership(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
|
||||
with pytest.raises(RuntimeError, match="TASK_OWNERSHIP_INVALID"):
|
||||
runtime.bootstrap_writer_lease(writer_request(task_id="unknown-task"))
|
||||
|
||||
|
||||
def test_renew_missing_durable_lease_is_not_bootstrap(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
|
||||
with pytest.raises(RuntimeError, match="LEASE_NOT_FOUND"):
|
||||
runtime.renew_writer_lease(writer_request())
|
||||
|
||||
|
||||
def test_renew_is_generation_scoped_before_durable_lookup(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
create_durable_lease(runtime)
|
||||
|
||||
with pytest.raises(RuntimeError, match="GENERATION_BINDING_CONFLICT"):
|
||||
runtime.renew_writer_lease(writer_request(generation=2))
|
||||
assert durable_row(runtime) == ("2020-01-01T00:00:00+00:00", 0)
|
||||
|
||||
|
||||
def test_restart_rehydrates_only_from_matching_durable_lease(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
create_durable_lease(runtime)
|
||||
runtime.runtimes.clear()
|
||||
|
||||
result = runtime.renew_writer_lease(writer_request())
|
||||
|
||||
expires_at, revision = durable_row(runtime)
|
||||
assert result["recovered"] is True
|
||||
assert result["runtime_rehydrated"] is True
|
||||
assert result["durable_branch_lease_present"] is True
|
||||
assert revision == 1
|
||||
assert datetime.fromisoformat(expires_at) > datetime.now(timezone.utc)
|
||||
|
||||
|
||||
def test_duplicate_renewal_is_idempotent_after_first_durable_recovery(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
create_durable_lease(runtime)
|
||||
|
||||
first = runtime.renew_writer_lease(writer_request())
|
||||
second = runtime.renew_writer_lease(writer_request())
|
||||
|
||||
assert first["recovered"] is True
|
||||
assert first["idempotent"] is False
|
||||
assert second["recovered"] is False
|
||||
assert second["idempotent"] is True
|
||||
assert durable_row(runtime)[1] == 1
|
||||
|
||||
|
||||
def test_update_lease_keeps_expiry_without_optional_argument_and_keeps_cas(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
controller = create_durable_lease(runtime)
|
||||
|
||||
controller.update_lease(
|
||||
"writer-lease-recovery",
|
||||
expected_revision=0,
|
||||
current_head_oid=BASE,
|
||||
generation=1,
|
||||
)
|
||||
assert durable_row(runtime) == ("2020-01-01T00:00:00+00:00", 1)
|
||||
with pytest.raises(JobError, match="LEASE_REVISION_CAS_CONFLICT"):
|
||||
controller.update_lease(
|
||||
"writer-lease-recovery",
|
||||
expected_revision=0,
|
||||
current_head_oid=BASE,
|
||||
generation=1,
|
||||
)
|
||||
|
||||
|
||||
def test_two_runtime_connections_resolve_renewal_cas_race_idempotently(tmp_path: Path) -> None:
|
||||
first = make_runtime(tmp_path)
|
||||
first_controller = create_durable_lease(first)
|
||||
second = make_runtime(tmp_path)
|
||||
second_controller = GitOpsJobController(
|
||||
JobStore(second._job_root(TASK_ID), payload_root=second._job_root(TASK_ID) / "payloads")
|
||||
)
|
||||
second.controllers[TASK_ID] = second_controller
|
||||
gate = threading.Barrier(2)
|
||||
|
||||
def gate_update(controller: GitOpsJobController) -> None:
|
||||
original = controller.update_lease
|
||||
|
||||
def update(*args: object, **kwargs: object) -> None:
|
||||
gate.wait(timeout=5)
|
||||
original(*args, **kwargs)
|
||||
|
||||
controller.update_lease = update
|
||||
|
||||
gate_update(first_controller)
|
||||
gate_update(second_controller)
|
||||
with ThreadPoolExecutor(max_workers=2) as pool:
|
||||
results = list(pool.map(lambda runtime: runtime.renew_writer_lease(writer_request()), (first, second)))
|
||||
|
||||
assert sorted((item["recovered"], item["idempotent"]) for item in results) == [
|
||||
(False, True),
|
||||
(True, False),
|
||||
]
|
||||
assert durable_row(first)[1] == 1
|
||||
|
||||
|
||||
def test_bootstrap_preserves_exact_governed_job_lineage(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
expected_job_id = runtime.bindings[TASK_ID]["job_id"]
|
||||
|
||||
response = runtime.bootstrap_writer_lease(writer_request())
|
||||
binding, _, _ = runtime.runtimes[(TASK_ID, 1)]
|
||||
|
||||
assert response["job_id"] == expected_job_id
|
||||
assert binding.job_id == expected_job_id
|
||||
assert binding.request.job_id == expected_job_id
|
||||
|
||||
|
||||
def test_restart_rehydrate_preserves_exact_governed_job_lineage(tmp_path: Path) -> None:
|
||||
first = make_runtime(tmp_path)
|
||||
expected_job_id = first.bindings[TASK_ID]["job_id"]
|
||||
first.acquire_lease(writer_request())
|
||||
|
||||
runtime = make_runtime(tmp_path)
|
||||
assert runtime is not first
|
||||
assert runtime.runtimes == {}
|
||||
response = runtime.bootstrap_writer_lease(writer_request())
|
||||
binding, _, _ = runtime.runtimes[(TASK_ID, 1)]
|
||||
|
||||
assert response["job_id"] == expected_job_id
|
||||
assert binding.job_id == expected_job_id
|
||||
assert binding.request.job_id == expected_job_id
|
||||
|
||||
|
||||
def test_wrong_governed_job_id_is_denied_before_runtime_or_lease_side_effect(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
|
||||
with pytest.raises(RuntimeError, match="LEASE_BINDING_CONFLICT"):
|
||||
runtime.bootstrap_writer_lease(writer_request(job_id="job-wrong-lineage"))
|
||||
|
||||
assert runtime.runtimes == {}
|
||||
database = runtime._job_root(TASK_ID) / "state.sqlite3"
|
||||
with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
|
||||
assert connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0] == 0
|
||||
assert connection.execute("PRAGMA foreign_key_check(branch_leases)").fetchall() == []
|
||||
|
||||
|
||||
def test_acquire_creates_exact_governed_writer_lease_with_fk_and_cas(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
expected_job_id = runtime.bindings[TASK_ID]["job_id"]
|
||||
|
||||
response = runtime.acquire_lease(writer_request())
|
||||
|
||||
assert response["job_id"] == expected_job_id
|
||||
assert response["durable_branch_lease_present"] is True
|
||||
assert response["idempotent"] is False
|
||||
database = runtime._job_root(TASK_ID) / "state.sqlite3"
|
||||
with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
|
||||
foreign_keys = connection.execute(
|
||||
"PRAGMA foreign_key_list(branch_leases)"
|
||||
).fetchall()
|
||||
row = connection.execute(
|
||||
"SELECT job_id,branch,lineage_anchor_oid,current_head_oid,generation,state,revision "
|
||||
"FROM branch_leases"
|
||||
).fetchone()
|
||||
job = connection.execute(
|
||||
"SELECT state,side_effect_state,revision FROM jobs WHERE job_id=?",
|
||||
(expected_job_id,),
|
||||
).fetchone()
|
||||
assert connection.execute("PRAGMA foreign_key_check(branch_leases)").fetchall() == []
|
||||
assert any(
|
||||
fk[2] == "jobs" and fk[3] == "job_id" and fk[4] == "job_id"
|
||||
for fk in foreign_keys
|
||||
)
|
||||
assert row == (expected_job_id, BRANCH, BASE, BASE, 1, "ACTIVE", 0)
|
||||
assert job == ("LEASED", "LEASED", 2)
|
||||
|
||||
|
||||
def test_duplicate_acquire_observes_same_durable_writer_lease(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
expected_job_id = runtime.bindings[TASK_ID]["job_id"]
|
||||
|
||||
first = runtime.acquire_lease(writer_request())
|
||||
second = runtime.acquire_lease(writer_request())
|
||||
|
||||
assert first["job_id"] == expected_job_id
|
||||
assert second["job_id"] == expected_job_id
|
||||
assert second["idempotent"] is True
|
||||
database = runtime._job_root(TASK_ID) / "state.sqlite3"
|
||||
with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
|
||||
leases = connection.execute(
|
||||
"SELECT lease_id,job_id,revision FROM branch_leases"
|
||||
).fetchall()
|
||||
job = connection.execute(
|
||||
"SELECT state,revision FROM jobs WHERE job_id=?",
|
||||
(expected_job_id,),
|
||||
).fetchone()
|
||||
assert leases == [("lease-" + expected_job_id, expected_job_id, 0)]
|
||||
assert job == ("LEASED", 2)
|
||||
|
||||
|
||||
def test_wrong_job_acquire_is_denied_before_authorize_or_lease(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
expected_job_id = runtime.bindings[TASK_ID]["job_id"]
|
||||
|
||||
with pytest.raises(RuntimeError, match="LEASE_BINDING_CONFLICT"):
|
||||
runtime.acquire_lease(writer_request(job_id="job-wrong-lineage"))
|
||||
|
||||
database = runtime._job_root(TASK_ID) / "state.sqlite3"
|
||||
with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as connection:
|
||||
job = connection.execute(
|
||||
"SELECT state,side_effect_state,revision FROM jobs WHERE job_id=?",
|
||||
(expected_job_id,),
|
||||
).fetchone()
|
||||
lease_count = connection.execute("SELECT COUNT(*) FROM branch_leases").fetchone()[0]
|
||||
assert job == ("REQUESTED", "NONE", 0)
|
||||
assert lease_count == 0
|
||||
|
||||
|
||||
def test_omitted_request_job_id_resolves_the_exact_durable_parent(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
expected_job_id = runtime.bindings[TASK_ID]["job_id"]
|
||||
raw = dict(writer_request())
|
||||
|
||||
response = runtime.acquire_lease(raw)
|
||||
binding, _, _ = runtime.runtimes[(TASK_ID, 1)]
|
||||
|
||||
assert response["job_id"] == expected_job_id
|
||||
assert binding.job_id == expected_job_id
|
||||
assert binding.request.job_id == expected_job_id
|
||||
|
||||
|
||||
def test_durable_job_expected_head_mismatch_is_denied(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
expected_job_id = runtime.bindings[TASK_ID]["job_id"]
|
||||
controller = runtime.controllers[TASK_ID]
|
||||
with controller.store._connect() as connection:
|
||||
row = connection.execute(
|
||||
"SELECT request_json FROM jobs WHERE job_id=?", (expected_job_id,)
|
||||
).fetchone()
|
||||
request = json.loads(row[0])
|
||||
request["expected_branch_oid"] = "c" * 40
|
||||
request["binding"]["expected_branch_oid"] = "c" * 40
|
||||
connection.execute(
|
||||
"UPDATE jobs SET request_json=? WHERE job_id=?",
|
||||
(json.dumps(request, sort_keys=True, separators=(",", ":")), expected_job_id),
|
||||
)
|
||||
connection.commit()
|
||||
|
||||
with pytest.raises(RuntimeError, match="RUNTIME_GOVERNED_JOB_UNRESOLVED"):
|
||||
runtime.bootstrap_writer_lease(writer_request())
|
||||
|
||||
assert runtime.runtimes == {}
|
||||
|
||||
|
||||
def _commit_ready_runtime(tmp_path: Path):
|
||||
runtime = make_runtime(tmp_path)
|
||||
runtime.bootstrap_writer_lease(writer_request())
|
||||
binding, controller, _ = runtime.runtimes[(TASK_ID, 1)]
|
||||
|
||||
class Workspace:
|
||||
def materialize_files(self, _files):
|
||||
return None
|
||||
|
||||
class Executor:
|
||||
def __init__(self):
|
||||
self.workspace = Workspace()
|
||||
self.calls = 0
|
||||
|
||||
def execute(self, _binding, _commit, *, before_complete=None):
|
||||
self.calls += 1
|
||||
result = {
|
||||
"job_id": binding.job_id,
|
||||
"state": "COMPLETED",
|
||||
"side_effect_state": "REMOTE_VERIFIED",
|
||||
"receipt": {
|
||||
"authority_oid": "b" * 40,
|
||||
"git_remote_oid": "b" * 40,
|
||||
"api_branch_oid": "b" * 40,
|
||||
"commit_visible": True,
|
||||
"remote_verified": True,
|
||||
"force_push": False,
|
||||
},
|
||||
}
|
||||
if before_complete is not None:
|
||||
before_complete("b" * 40)
|
||||
return result
|
||||
|
||||
executor = Executor()
|
||||
runtime.runtimes[(TASK_ID, 1)] = (binding, controller, executor)
|
||||
runtime.acquire_lease(writer_request())
|
||||
return runtime, binding, controller, executor
|
||||
|
||||
|
||||
def _commit_request():
|
||||
return {
|
||||
"task_id": TASK_ID,
|
||||
"repository": "aios/aios",
|
||||
"generation": 1,
|
||||
"target_branch": BRANCH,
|
||||
"expected_branch_oid": BASE,
|
||||
"idempotency_key": "commit-cas-test-v1",
|
||||
"path": "docs/cas.txt",
|
||||
"content_base64": "YQ==",
|
||||
"message": "test commit cas",
|
||||
}
|
||||
|
||||
|
||||
def test_commit_lease_revision_cas_conflict_is_preserved(tmp_path: Path) -> None:
|
||||
runtime, _binding, controller, _executor = _commit_ready_runtime(tmp_path)
|
||||
|
||||
def conflict(*_args, **_kwargs):
|
||||
raise JobError("LEASE_REVISION_CAS_CONFLICT")
|
||||
|
||||
controller.update_lease = conflict
|
||||
with pytest.raises(RuntimeError, match="LEASE_CAS_CONFLICT"):
|
||||
runtime.commit_files(_commit_request())
|
||||
|
||||
|
||||
def test_commit_divergent_durable_head_fails_before_executor(tmp_path: Path) -> None:
|
||||
runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
|
||||
controller.update_lease(
|
||||
"lease-" + binding.job_id,
|
||||
expected_revision=0,
|
||||
current_head_oid="c" * 40,
|
||||
generation=1,
|
||||
)
|
||||
|
||||
with pytest.raises(RuntimeError, match="LEASE_HEAD_RECONCILIATION_REQUIRED"):
|
||||
runtime.commit_files(_commit_request())
|
||||
assert executor.calls == 0
|
||||
|
||||
|
||||
def test_remote_pending_never_advances_durable_head(tmp_path: Path) -> None:
|
||||
runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
|
||||
|
||||
def pending(_binding, _commit, **_kwargs):
|
||||
executor.calls += 1
|
||||
return {
|
||||
"job_id": binding.job_id,
|
||||
"state": "RECONCILIATION_REQUIRED",
|
||||
"side_effect_state": "REMOTE_PUSH_PENDING",
|
||||
"receipt": {
|
||||
"authority_oid": "b" * 40,
|
||||
"desired_remote_oid": "b" * 40,
|
||||
"remote_verified": False,
|
||||
},
|
||||
}
|
||||
|
||||
executor.execute = pending
|
||||
with pytest.raises(RuntimeError, match="RECONCILIATION_REQUIRED"):
|
||||
runtime.commit_files(_commit_request())
|
||||
with controller.store._connect() as connection:
|
||||
row = connection.execute(
|
||||
"SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?",
|
||||
("lease-" + binding.job_id,),
|
||||
).fetchone()
|
||||
assert tuple(row) == (BASE, 0)
|
||||
|
||||
|
||||
def test_retry_accepts_exact_head_already_advanced_at_remote_verified_boundary(tmp_path: Path) -> None:
|
||||
runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
|
||||
commit_oid = "b" * 40
|
||||
controller.update_lease(
|
||||
"lease-" + binding.job_id,
|
||||
expected_revision=0,
|
||||
current_head_oid=commit_oid,
|
||||
generation=1,
|
||||
)
|
||||
receipt = {
|
||||
"authority_oid": commit_oid,
|
||||
"git_remote_oid": commit_oid,
|
||||
"api_branch_oid": commit_oid,
|
||||
"commit_visible": True,
|
||||
"remote_verified": True,
|
||||
"force_push": False,
|
||||
}
|
||||
with controller.store._connect() as connection:
|
||||
connection.execute(
|
||||
"UPDATE jobs SET state='REMOTE_VERIFIED',side_effect_state='REMOTE_VERIFIED',"
|
||||
"receipt_json=? WHERE job_id=?",
|
||||
(json.dumps(receipt, sort_keys=True, separators=(",", ":")), binding.job_id),
|
||||
)
|
||||
connection.commit()
|
||||
|
||||
result = runtime.commit_files(_commit_request())
|
||||
|
||||
assert result["commit_oid"] == commit_oid
|
||||
assert executor.calls == 1
|
||||
with controller.store._connect() as connection:
|
||||
row = connection.execute(
|
||||
"SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?",
|
||||
("lease-" + binding.job_id,),
|
||||
).fetchone()
|
||||
assert tuple(row) == (commit_oid, 1)
|
||||
|
||||
|
||||
def test_completed_response_with_invalid_oid_uses_canonical_oid_error(tmp_path: Path) -> None:
|
||||
runtime, binding, controller, executor = _commit_ready_runtime(tmp_path)
|
||||
|
||||
def invalid_oid(_binding, _commit, **_kwargs):
|
||||
executor.calls += 1
|
||||
return {
|
||||
"job_id": binding.job_id,
|
||||
"state": "COMPLETED",
|
||||
"side_effect_state": "REMOTE_VERIFIED",
|
||||
"receipt": {
|
||||
"authority_oid": "not-an-oid",
|
||||
"commit_visible": True,
|
||||
"remote_verified": True,
|
||||
},
|
||||
}
|
||||
|
||||
executor.execute = invalid_oid
|
||||
with pytest.raises(RuntimeError, match="GOVERNED_COMMIT_OID_INVALID"):
|
||||
runtime.commit_files(_commit_request())
|
||||
with controller.store._connect() as connection:
|
||||
row = connection.execute(
|
||||
"SELECT current_head_oid,revision FROM branch_leases WHERE lease_id=?",
|
||||
("lease-" + binding.job_id,),
|
||||
).fetchone()
|
||||
assert tuple(row) == (BASE, 0)
|
||||
|
||||
|
||||
def test_acquire_renews_an_expired_matching_durable_lease_with_revision_cas(tmp_path: Path) -> None:
|
||||
runtime = make_runtime(tmp_path)
|
||||
create_durable_lease(runtime)
|
||||
runtime.runtimes.clear()
|
||||
|
||||
result = runtime.acquire_lease(writer_request())
|
||||
|
||||
expires_at, revision = durable_row(runtime)
|
||||
assert result["recovered"] is True
|
||||
assert result["runtime_rehydrated"] is False
|
||||
assert result["durable_branch_lease_present"] is True
|
||||
assert revision == 1
|
||||
assert datetime.fromisoformat(expires_at) > datetime.now(timezone.utc)
|
||||
|
||||
|
||||
def test_authority_recovers_only_clean_detached_single_attempt_worktree(tmp_path: Path) -> None:
|
||||
import subprocess
|
||||
from aios_authority_git_executor import AuthorityGitExecutor
|
||||
|
||||
bare = tmp_path / "authority.git"
|
||||
seed = tmp_path / "seed"
|
||||
subprocess.run(["git", "init", "--bare", str(bare)], check=True, capture_output=True)
|
||||
subprocess.run(["git", "init", str(seed)], check=True, capture_output=True)
|
||||
(seed / "base.txt").write_text("base\n", encoding="utf-8")
|
||||
subprocess.run(["git", "-C", str(seed), "add", "base.txt"], check=True)
|
||||
subprocess.run(
|
||||
["git", "-C", str(seed), "-c", "user.name=test", "-c", "user.email=test@example.invalid",
|
||||
"commit", "-m", "base"], check=True, capture_output=True,
|
||||
)
|
||||
base = subprocess.check_output(["git", "-C", str(seed), "rev-parse", "HEAD"], text=True).strip()
|
||||
subprocess.run(["git", "-C", str(seed), "push", str(bare), "HEAD:refs/heads/main"], check=True, capture_output=True)
|
||||
root = tmp_path / "worktrees"
|
||||
authority = AuthorityGitExecutor(bare, root)
|
||||
worktree = authority.create_detached_worktree(base, "task")
|
||||
(worktree / "attempt.txt").write_text("attempt\n", encoding="utf-8")
|
||||
subprocess.run(["git", "-C", str(worktree), "add", "attempt.txt"], check=True)
|
||||
subprocess.run(
|
||||
["git", "-C", str(worktree), "-c", "user.name=test", "-c", "user.email=test@example.invalid",
|
||||
"commit", "-m", "failed attempt"], check=True, capture_output=True,
|
||||
)
|
||||
stale = subprocess.check_output(["git", "-C", str(worktree), "rev-parse", "HEAD"], text=True).strip()
|
||||
|
||||
recovered = authority.recover_failed_detached_worktree_exact(
|
||||
path=worktree,
|
||||
expected_oid=base,
|
||||
stale_oid=stale,
|
||||
target_ref="refs/heads/agent/recovery-test",
|
||||
)
|
||||
|
||||
assert recovered == stale
|
||||
assert subprocess.check_output(["git", "-C", str(worktree), "rev-parse", "HEAD"], text=True).strip() == base
|
||||
assert subprocess.run(["git", "-C", str(worktree), "symbolic-ref", "-q", "HEAD"]).returncode == 1
|
||||
assert subprocess.check_output(["git", "-C", str(worktree), "status", "--porcelain"], text=True) == ""
|
||||
Reference in New Issue
Block a user