AIOS Governed Continuation
540e28a724
autonomy-smoke-tests Exact governed tree; evidence 7dbba7ff168e72af
autonomy-unit-tests Exact governed tree; evidence 7dbba7ff168e72af
campaign-approval-gate Exact governed tree; evidence 7dbba7ff168e72af
git-diff-check Exact governed tree; evidence 7dbba7ff168e72af
py-compile Exact governed tree; evidence 7dbba7ff168e72af
reconciliation-contract Exact governed tree; evidence 7dbba7ff168e72af
release-state-machine Exact governed tree; evidence 7dbba7ff168e72af
secret-scan Exact governed tree; evidence 7029b3eafb209066
signer-validator-contract Exact governed tree; evidence 7dbba7ff168e72af
75 lines
3.7 KiB
Python
75 lines
3.7 KiB
Python
"""Fixed registered composition of the existing shadow API and renewal store."""
|
|
import base64
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
import runpy
|
|
import sys
|
|
|
|
ORIGINAL_SHA = 'f6393fe614239036a1d8235c98c1f455dc32b700107d88f48190c4f61dae617e'
|
|
|
|
|
|
def service_type(types, renewal, public_key):
|
|
class RegisteredService(types.SilentReleaseActionService):
|
|
def __init__(self, root, **kwargs):
|
|
if 'completion_approvals' in kwargs:
|
|
raise renewal.RenewalRejected('FIXED_COMPLETION_DEPENDENCY_REQUIRED')
|
|
original = types.SignedApprovalStore(Path(root) / 'approvals')
|
|
completion = renewal.RegisteredCompletionApprovalStore(
|
|
original, public_key, types.SignedReleasePlanApproval,
|
|
)
|
|
super().__init__(root, completion_approvals=completion, **kwargs)
|
|
return RegisteredService
|
|
|
|
|
|
def main():
|
|
# Original Round3 startup and verifier remain loaded before the new root
|
|
# is added. The C5 types are a separate registered module as in R2.
|
|
import silent_release_hardening as original
|
|
import hashlib
|
|
if hashlib.sha256(Path(original.__file__).read_bytes()).hexdigest() != ORIGINAL_SHA:
|
|
raise RuntimeError('ROUND3_HARDENING_DRIFT')
|
|
if not getattr(original.BuilderAttestationVerifier.verify,
|
|
'__aios_round3_rollback_contract_patch__', False):
|
|
raise RuntimeError('ROUND3_VERIFIER_NOT_ACTIVE')
|
|
import c5_completion_renewal as renewal
|
|
renewal.configure_registered_bindings()
|
|
root = renewal.AUTHORITY_ROOT
|
|
sys.path.insert(0, str(root))
|
|
if Path(__file__) != root / 'c5_completion_api.py':
|
|
raise renewal.RenewalRejected('REGISTERED_API_WRAPPER_REQUIRED')
|
|
policy = renewal.RegisteredCompletionAuthority()()
|
|
parent = json.loads(renewal.secure_bytes(Path(policy['predecessor_snapshot'])))
|
|
keyring = json.loads(renewal.secure_bytes(root / 'approval-public-keyring.json'))
|
|
if keyring.get('algorithm') != 'Ed25519' or parent['key_id'] in keyring.get('revoked', []):
|
|
raise renewal.RenewalRejected('REGISTERED_APPROVAL_KEY_REQUIRED')
|
|
public_key = base64.b64decode(keyring['keys'][parent['key_id']], validate=True)
|
|
renewal.verify_signature(parent, public_key)
|
|
spec = importlib.util.spec_from_file_location('_registered_c5_completion_types',
|
|
root / 'silent_release_hardening.py')
|
|
types = importlib.util.module_from_spec(spec)
|
|
sys.modules[spec.name] = types
|
|
spec.loader.exec_module(types)
|
|
loaded = runpy.run_path(str(root / 'original_api.py'), run_name='_registered_original_api')
|
|
g = loaded['main'].__globals__
|
|
if g['SILENT_RELEASE_EXECUTION_ENABLED'] is not False or Path(g['SILENT_RELEASE_STATE_ROOT']) != renewal.STATE_ROOT:
|
|
raise renewal.RenewalRejected('EXISTING_SHADOW_PLANE_REQUIRED')
|
|
g['ReleasePlan'] = types.ReleasePlan
|
|
g['TrustedCandidateBundle'] = types.TrustedCandidateBundle
|
|
g['SilentReleaseActionService'] = service_type(types, renewal, public_key)
|
|
g['TRUSTED_RELEASE_POLICY'] = renewal.TRUSTED_RELEASE_POLICY_PATH
|
|
service = g['_build_silent_release_service']()
|
|
if service.execution_enabled or service.policy_sha256 != renewal.TRUSTED_RELEASE_POLICY_SHA256:
|
|
raise renewal.RenewalRejected('EXACT_API_POLICY_REQUIRED')
|
|
# Preserve the exact candidate boundary from the existing registered R2.
|
|
def reject_candidate_creation(payload):
|
|
raise original.CapabilityAuthorizationError('completion mode cannot create or replace candidates')
|
|
service.create_release_candidate = reject_candidate_creation
|
|
g['_SILENT_RELEASE_SERVICE'] = service
|
|
g['main']()
|
|
return 0
|
|
|
|
|
|
if __name__ == '__main__':
|
|
raise SystemExit(main())
|