JjmddlmZddlZddlZddlmZmZddlmZm Z ddl m Z m Z ddl mZddlmZmZddlmZmZdd lmZdd lmZmZej4eZd Zd Zd ZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,eGddZ-Gdde Z.Gdd e Z/Gd!d"Z0Gd#d$eZ1Gd%d&e1Z2Gd'd(e1Z3Gd)d*e1Z4Gd+d,e1Z5Gd-d.e1Z6Gd/d0e1Z7y)1) annotationsN)ABCabstractmethod) dataclassfield)AnyProtocol)uuid4) AsyncEventBusMemoryTaskQueue)AuthorizedExecutionServiceExecutionRefused) AgentIdentity)PermissionGateway SecurityErrorzplanner.task_requestzplanner.task_completedzcoder.task_requestzcoder.task_completedzevaluator.task_requestzevaluator.task_completedzsecurity.task_requestzsecurity.task_completedzresearch.task_requestzresearch.task_completedzbrowser.task_requestzbrowser.task_completedexecute2zmBrowserAgent has no browsing backend; the capability is not implemented and no page was fetched or inspected.cheZdZUdZded<ded<ded<eeZd ed <d Zded <d Z ded<y ) AgentResultaStructured outcome of one agent run. ``execution_attempted`` records whether the sandbox may already have run code for this result. It defaults to True on purpose: a consumer that cannot prove the code never started must assume side effects are possible and therefore must not re-run the step. Only an agent that structurally knows it was refused *before* the provider was invoked may set it to False, which is what makes a blocked step retryable. str agent_name str | Nonetask_idboolsuccess)default_factorydict[str, Any]dataNerrorTexecution_attempted) __name__ __module__ __qualname____doc____annotations__rdictrr r!F/home/oem/CyberBrain26-unified/src/cyberbrain26/agents/orchestrator.pyrr,s=O  M 6D.6E: $$r)rceZdZdZddZy)TaskAuthorizera&Authorization collaborator required before bus-driven agent work. Security rationale: the event bus is a shared, publicly reachable channel (``PtahBridge.bus`` is exposed to callers), so a published ``*_TASK_REQUEST`` is untrusted input. An agent therefore never calls ``execute`` for a bus task on its own: it first hands the payload to an injected authorizer that must run the canonical chain (identity -> scope -> policy -> approval -> audit). Contract for implementations: * return normally when the request may proceed; * raise (``SecurityError`` for a policy refusal, or any other exception when the decision could not be made) when it may not. Only "returned without raising" counts as authorization. A return value is deliberately not inspected, so an implementation cannot accidentally turn a falsy return into an approval. ``BaseAgent`` treats every raise as a refusal and treats a missing authorizer as a refusal too, which keeps the failure mode closed when wiring is incomplete. c KywNr(self task_datas r*__call__zTaskAuthorizer.__call__WsNr1rreturnNone)r"r#r$r%r2r(r)r*r,r,@s ,Er)r,c2eZdZdZ d ddZy)DispatcherAuthorizerPortaStructural view of ``InMemoryTaskDispatcher._authorize``. Declared structurally rather than imported so the agents module keeps no import-time dependency on the extension layer, and so the extension layer can rename its internals without a silent behaviour change here. c Kywr.r()r0rregistered_agent_idagentactionresources r* _authorizez#DispatcherAuthorizerPort._authorizebs r3N).) rrr:rr;rr<rr=rr5r6)r"r#r$r%r>r(r)r*r8r8ZsK # !      r)r8c>eZdZdZedd ddZddZy)DispatcherAuthorizera,Adapter binding a bus task to a dispatcher's authorization decision. ``InMemoryTaskDispatcher._authorize`` already implements the canonical chain (identity match -> policy -> approval -> audit) and already fails closed by raising ``SecurityError``. This adapter forwards to it so the bus path and the dispatcher path share one decision instead of duplicating - and eventually weakening - policy evaluation inside the agents. Construction order matters: the bridge must build the agents first and then assign the adapter, because the adapter needs both the agent and its identity:: agent = PlannerAgent(bridge.bus, bridge.queue, identity=..., permission_gateway=...) agent.authorizer = DispatcherAuthorizer(bridge.dispatcher, agent.identity.agent_id, agent) N)r<r=cJ||_||_||_||_||_yr.) _dispatcher _agent_id_agent_action _resource)r0 dispatcheragent_idr;r<r=s r*__init__zDispatcherAuthorizer.__init__}s(&!  !r)cK|jd}|r t|ndtj}|jj ||j |j|j|jd{y7w)Nrzbus-) getrr hexrBr>rCrDrErF)r0r1 raw_task_idrs r*r2zDispatcherAuthorizer.__call__slmmI. &1#k"egkk]7K))  NN KK LL NN    sBB BB ) rGr8rHrr;rr<rr=rr5r6r4)r"r#r$r%BUS_TASK_ACTIONrIr2r(r)r*r@r@lsS,&# ", " " "  " "  "  r)r@ceZdZ d ddZeeddZeeddZddZddZ eddZ ddZ dd Z dd Z dd d  dd ZdddZy) BaseAgentNct||_||_g|_d|_d|_||_||_||_y)aWire the agent onto the bus. ``authorizer`` gates every bus-delivered task request. It defaults to ``None``, which means "no authorization collaborator was injected" and therefore **deny**: the agent refuses bus-driven work instead of executing it. The default is deliberately fail-closed so that a construction site which has not been migrated to the new contract loses the unauthenticated entry point rather than keeping it. Callers that legitimately drive agents over the bus must inject a ``TaskAuthorizer`` (see ``DispatcherAuthorizer``), either in this constructor or by assigning ``agent.authorizer`` afterwards. N)busqueueresults_task_request_event_task_completed_eventidentitypermission_gateway authorizer)r0rRrSrWrXrYs r*rIzBaseAgent.__init__s?( *, /3 15"  "4$r)cyr.r(r0s r*namezBaseAgent.namer)cyr.r(r[s r*rolezBaseAgent.roler]r)c~|jr1|jj|j|jyyr.)rUrR subscribe_on_task_requestr[s r* _subscribezBaseAgent._subscribes0  # # HH  t779N9N O $r)cKt|dd}t|tr|ni}|j|d{}||n|j |d{}|t|j rh|j j|j |j|j|j|jd|jdd{|S77~7 w)aHandle a bus-delivered task request. Security rationale: this handler used to call ``execute`` directly, so anyone holding a reference to the event bus could run an agent body with an arbitrary payload and no identity, scope, policy or approval check at all - the bus was a full bypass of the authorization chain. Every bus task must now clear an injected ``TaskAuthorizer`` first; a missing or denying authorizer produces a recorded refusal instead of work. payloadN)rrr )r;resultr) getattr isinstancer'_authorize_task_requestrrVrRpublishr\rrr r)r0eventrer1refusalrfs r*rbzBaseAgent._on_task_requests%D1/9'4/HGb 44Y??#/4<< ;R5R  $"<"<((""4#=#=&,nnfkkTZT`T`a!>>@    @5R s46CCCCA5C C CCCc Kywr.r(r/s r*rzBaseAgent.executes  r3cpK|j|j|dS |j|d{y7#t$r%}|j|t|cYd}~Sd}~wt$r@}t j d|j||j|d|cYd}~Sd}~wwxYww)a7Authorize one bus task request before the agent body may run. Returns ``None`` when the request is authorized (the caller then runs ``execute``), or an ``AgentResult`` describing a refusal. Fail-closed: no authorizer, a raising authorizer, or any unexpected exception from the authorizer all mean "refuse". A refusal is recorded with ``execution_attempted=False`` because it is structurally known to have happened before the agent body started, which keeps the step retryable once the wiring is fixed. NzDbus task requests require an injected authorizer; none is configuredz>%s bus task authorization could not be completed, refusing: %szauthorization failed closed: )rY_refuse_task_requestrr Exceptionloggerwarningr\)r0r1excs r*riz!BaseAgent._authorize_task_requests ?? ",,V  //), , , - B,,YCA A  NNP   ,,:3%@  sUB6><>B6> B3A'!B3"B6' B335B.(B3)B6.B33B6ctjd|j||j|j |d|j dd|dS)zARecord and return a refusal for an unauthorized bus task request.z!%s refused a bus task request: %sF event_bus)r_sourcer!)rqrrr\publish_result _task_id_fromr_)r0r1reasons r*rozBaseAgent._refuse_task_requestsR:DIIvN""   y ) YY+ 6  % #  r)cB|jd}|dSt|S)zCBest-effort task id for a refusal or unavailable-capability result.rN)rKr)r0r1raws r*ryzBaseAgent._task_id_from s#mmI&{t0C0r)Trwczt|j|||xsi||}|jj||S)z;Record an outcome and mark whether execution was attempted.)rrrrr r!)rr\rTappend)r0rrrr r!rfs r*rxzBaseAgent.publish_resultsAyy 3   F# r)c|j |jy|jj|j||}|jjdk(S)zCheck whether this agent is permitted to perform an action. Returns True if allowed, False if denied or requires approval. Fallow)rWrXevaluatedecisionvalue)r0r<r=rfs r*check_permissionzBaseAgent.check_permission$sO == D$;$;$C((11$--R$$//r)NNN rRr rSr rWAgentIdentity | NonerXPermissionGateway | NonerYTaskAuthorizer | Noner5r6r5r)r5r6)rkrr5AgentResult | Noner1rr5r)r1rrzrr5r)r1rr5rNN) rrrrrzdict[str, Any] | Noner rr!rr5rr.)r<rr=rr5r)r"r#r$rIpropertyrr\r_rcrbrriroryrxrr(r)r*rPrPs *.7;,0 % %%' % 5 % * % %: P,  !'! !F  1'+ %)$   " *0r)rPceZdZ d dd d fdZed dZed dZd dZed dZ ddZ xZ S) PlannerAgentNrYct||||||t|_t|_g|_|jyr.)superrIPLANNER_TASK_REQUESTrUPLANNER_TASK_COMPLETEDrV_planrcr0rRrSrWrXrY __class__s r*rIzPlannerAgent.__init__0s< eX/A:N#7 %;"+-  r)cy)Nrr(r[s r*r\zPlannerAgent.name?r)cy)Nplannerr(r[s r*r_zPlannerAgent.roleCr)crK|jdd}|j|jd\}}||jddd|i|dStd|dzDcgc] }||d|d }}||_|j j d }|j|d |||d }|Scc}ww) a Build an in-memory plan, honouring ``max_steps`` from the payload. ``max_steps`` is what ``cyberbrain plan --steps/-n`` sends, and it used to be ignored: the plan was hard-coded to three steps, so the CLI flag silently had no effect. goalunknown max_stepsNFrwz - step )step descriptionc,tjdS)Nr)asynciosleepr(r)r*z&PlannerAgent.execute..^sW]]1-=r)T)rplanr)rK_resolve_step_countrxrangerrSenqueue) r0r1rstepsr i sub_tasksrrfs r*rzPlannerAgent.executeGs}}VY/// k0JK u  &&$) ' GLAuWXyFY ABQ$xs'; <   **$$%=>$$ TD)%P   sA!B7#B24AB7c|tdfSt|tst|ts td|fS|dkr td|fSt |t dfS)aValidate ``max_steps`` and return ``(steps, error)``. Rules, chosen because ``max_steps`` arrives over the event bus and is therefore untrusted input: * absent (``None``) -> ``DEFAULT_PLAN_STEPS`` (3); * ``bool`` or non-integer -> refused, never coerced, because ``True`` and ``"3"`` are ambiguous input, not a step count; * ``<= 0`` -> refused, because an empty plan is not a plan; * ``> MAX_PLAN_STEPS`` (50) -> capped, so one request cannot inflate the plan and the resulting roadmap without bound. The cap is reported back as the effective ``max_steps`` so the caller sees what was used. Nz*max_steps must be a positive integer, got rz)max_steps must be greater than zero, got )DEFAULT_PLAN_STEPSrhrintminMAX_PLAN_STEPS) requesteds r*rz PlannerAgent._resolve_step_countdsk  %t+ + i &jC.H%)ST]S`'aa a >%)RS\R]'^^ ^9n-t33r)c,t|jSr.)listrr[s r*get_planzPlannerAgent.get_plan{sDJJr)rrrr)rrr5ztuple[int, str | None]r5zlist[dict[str, Any]]) r"r#r$rIrr\r_r staticmethodrr __classcell__rs@r*rr/s *.7; -1    '  5 *   :44, r)rceZdZ d dd d fdZed dZed dZd dZd dZd dZ xZ S) CoderAgentNrct||||||||_t|_t |_g|_|jyr.) rrIexecution_serviceCODER_TASK_REQUESTrUCODER_TASK_COMPLETEDrV _implementedrc)r0rRrSrWrXrrYrs r*rIzCoderAgent.__init__sE eX/A:N!2#5 %9"') r)cy)Nrr(r[s r*r\zCoderAgent.namesr)cy)Ncoderr(r[s r*r_zCoderAgent.rolesr)c Kd|vr|jdd}|jd}|jd}t|jdxsdtj}t |trt |ts|j |dd|idd S|j |j|j |dd|id d S |j j|j||||jd d |jd d{}|jddk(xr|jdd }|r$|jjt|d} |s;|jdxs(|jddrdnd|jd} |j ||||d| S|jj!|j"} |jj|} | J|jj%| d{|jdd}|jj||j |d|dd} | S7W#t$r+}|j |dd|it|d cYd}~Sd}~wtttf$r)}|j |dd|it|cYd}~Sd}~wwxYw7#t&tt(j*f$r }t,j/d|Yd}~d}~wt$rt,j/dt0$rt,j3dwxYww)Ncoderzcode executionlanguagerzcoder-Fz!code and language must be stringsrwz .,(>(>? H NNA3 G G  NNJ K     P Q  sCM0A I?%I<&I?*C M05=K32K13K37AM0<I?? K. J.(K.)M0.K.K)#K.$M0)K..M01K33M-L,'M0,AM--M0c Kyw)N code_completer(r[s r*rzCoderAgent._do_codes r3c,t|jSr.)rrr[s r*get_implementedzCoderAgent.get_implementedD%%&&r)r)rRr rSr rWrrXrrz!AuthorizedExecutionService | NonerYrr5r6rr)r5z list[str]) r"r#r$rIrr\r_rrrrrs@r*rrs *.7;?C -1 '  5  = * "Zx'r)rc~eZdZ d dd d fdZed dZed dZd dZd dZddZ xZ S)EvaluatorAgentNrct||||||t|_t|_g|_|jyr.)rrIEVALUATOR_TASK_REQUESTrUEVALUATOR_TASK_COMPLETEDrV _assessmentsrcrs r*rIzEvaluatorAgent.__init__s= eX/A:N#9 %="24 r)cy)Nrr(r[s r*r\zEvaluatorAgent.name sr)cy)N evaluatorr(r[s r*r_zEvaluatorAgent.rolesr)cpK|jj|j} |jj|}|J|jj |d{|jdd}|dk\}||d}|jj||j!|||}|S7P#t t tjf$r }tjd|Yd}~d}~wt$rtjdt$rtjdwxYww)Nz(EvaluatorAgent queue dispatch failed: %sz1EvaluatorAgent permission denied during executionz5EvaluatorAgent unexpected error during queue dispatchscoregg?)passedr)rSr _do_evaluaterKrrrrrrqrrrrprrr~rx) r0r1rrrsrr assessmentrfs r*rzEvaluatorAgent.executes**$$T%6%67 ZZ^^G,F% %%**%%f- - - gs+# &7    ,$$WfjA  .,(>(>? L NNEs K K  NNN O     T U  B&D6=B9&B7'B9+A D67B99D3C2-D62AD33D6cKddiSw)Nr evaluatedr(r[s r*rzEvaluatorAgent._do_evaluate)s+&&c,t|jSr.)rrr[s r*get_assessmentszEvaluatorAgent.get_assessments,rr)rrrrr5rr) r"r#r$rIrr\r_rrrrrs@r*rrs *.7; -1    '  5 *     *''r)rc~eZdZ d dd d fdZed dZed dZd dZd dZddZ xZ S) SecurityAgentNrct||||||t|_t|_g|_|jyr.)rrISECURITY_TASK_REQUESTrUSECURITY_TASK_COMPLETEDrV _findingsrcrs r*rIzSecurityAgent.__init__1< eX/A:N#8 %<"/1 r)cy)Nrr(r[s r*r\zSecurityAgent.name@r)cy)Nsecurityr(r[s r*r_zSecurityAgent.roleDr)cpK|jj|j} |jj|}|J|jj |d{|jdd}||rdndd}|jj||j!|| |}|S7P#t t tjf$r }tjd|Yd}~d}~wt$rtjdt$rtjdwxYww) Nz'SecurityAgent queue dispatch failed: %sz0SecurityAgent permission denied during executionz4SecurityAgent unexpected error during queue dispatchrequires_reviewFhighlow)rseverity)rSr_do_security_checkrKrrrrrrqrrrrprrr~rx)r0r1rrrsrfindingrfs r*rzSecurityAgent.executeHs**$$T%<%<= ZZ^^G,F% %%**%%f- - -$--(95A&5_6bgh g&$$W/.A7K  .,(>(>? K NNDc J J  NNM N     S T  rcKddiSw)Nrcheckedr(r[s r*rz SecurityAgent._do_security_check\s)$$rc,t|jSr.)rrr[s r* get_findingszSecurityAgent.get_findings_DNN##r)rrrrrr) r"r#r$rIrr\r_rrr rrs@r*rr0s *.7; -1    '  5 *   (%$r)rc~eZdZ d dd d fdZed dZed dZd dZd dZddZ xZ S) ResearchAgentNrct||||||t|_t|_g|_|jyr.)rrIRESEARCH_TASK_REQUESTrURESEARCH_TASK_COMPLETEDrV _researchrcrs r*rIzResearchAgent.__init__drr)cy)Nrr(r[s r*r\zResearchAgent.namesrr)cy)Nresearchr(r[s r*r_zResearchAgent.rolewrr)clK|jj|j} |jj|}|J|jj |d{|jdd}|jjd|i|j!|d|d|d}|S7N#t t tjf$r }tjd|Yd}~d}~wt$rtjdt$rtjdwxYww) Nz'ResearchAgent queue dispatch failed: %sz0ResearchAgent permission denied during executionz4ResearchAgent unexpected error during queue dispatchtopicrTz Research on )rsummary)rSr _do_researchrKrrrrrrqrrrrprrr~rx)r0r1rrrsrrfs r*rzResearchAgent.execute{s**$$T%6%67 ZZ^^G,F% %%**%%f- - - gy1 w./$$WdeR^_d^ePf4gh  .,(>(>? K NNDc J J  NNM N     S T  sB&D4=B7&B5'B7+A D45B77D1C0+D40AD11D4cKddiSw)Nr researchedr(r[s r*rzResearchAgent._do_researchs,''rc,t|jSr.)rrr[s r* get_researchzResearchAgent.get_researchr r)rrrrrr) r"r#r$rIrr\r_rrrrrs@r*rrcs *.7; -1    '  5 *   &($r)rcveZdZ ddd d fdZed dZed dZd dZd dZxZ S) BrowserAgentNrct||||||t|_t|_g|_|jyr.)rrIBROWSER_TASK_REQUESTrUBROWSER_TASK_COMPLETEDrV_browsedrcrs r*rIzBrowserAgent.__init__s< eX/A:N#7 %;".0  r)cy)Nrr(r[s r*r\zBrowserAgent.namerr)cy)Nbrowserr(r[s r*r_zBrowserAgent.rolerr)c K|j|j|d|jdddtdtdSw)aReport the browsing capability as unavailable. Security rationale: this agent has no browsing backend. It used to enqueue a no-op coroutine that returned ``{"status": "browsed"}``, then published ``success=True`` with a ``"Browsed "`` summary - a fake success report in a product whose whole point is trustworthy verdicts. A consumer had no way to tell "inspected the page" from "did nothing", and a negative finding that never happened looks exactly like a clean one. The agent now refuses every request with an explicit reason, records ``execution_attempted=False`` (nothing was attempted), and never appends to ``self._browsed``, so absence of evidence can no longer be read as evidence of absence. The role stays registered so the six-role Ptah topology is unchanged; it is a capability stub, not a working browser agent. Furlcapability_unavailablebrowsing)r(r capabilityrzrw)rxryrK%BROWSER_CAPABILITY_UNAVAILABLE_REASONr/s r*rzBrowserAgent.executesS"""   y )  }}U+2(?   2 %#  sAAc,t|jS)zPages actually fetched. Always empty: ``BrowserAgent`` has no backend, so nothing is ever recorded. Kept so existing callers keep working. )rr#r[s r* get_browsedzBrowserAgent.get_browseds DMM""r)rrrrr) r"r#r$rIrr\r_rr.rrs@r*rrs *.7; -1    '  5 *    <#r)r)8 __future__rrloggingabcrr dataclassesrrtypingrr uuidr cyberbrain26.control_planer r +cyberbrain26.execution_plane.secure_gatewayr r$cyberbrain26.security_plane.identityr&cyberbrain26.security_plane.permissionrr getLoggerr"rqrrrrrrrrrrr!r"rNrrr,rr,r8r@rPrrrrrrr(r)r*r:s<"#( E?S   8 $-1)-15/3/3-1,&  %% %&EXE4x$) ) XT0T0nM 9M `z'z'z1'Y1'h0$I0$f/$I/$d<#9<#r)