JjAdZddlmZddlZddlZddlmZddlmZddl m Z m Z ddl m Z mZmZmZmZddlmZmZdd lmZmZdd lmZmZdd lmZej:eZGd d Z GddZ!d dgZ"y)aIn-memory AgentRegistry and TaskDispatcher implementations. These are the default concrete implementations for Phase 4 modular contracts. They are intentionally simple and testable; production deployments may substitute database-backed or distributed variants. ) annotationsN) defaultdict)Any)Agent AgentRegistry)!DEFAULT_EXECUTION_TIMEOUT_SECONDSExecutionAuthorizationbound_execution_authorizationexecution_payload_digestnormalize_action)ApprovalManagerApprovalStatus)AuditEventTypeAuditLog)PermissionGateway SecurityError) PolicyEnginecHeZdZdZd dZd dZd dZd dZddZddZ d dZ y )InMemoryAgentRegistryzDefault AgentRegistry backed by an in-memory dict. Supports register, unregister, lookup by ID, listing by role, and existence checks. Thread-safe via simple dict operations. c i|_i|_yN)_agents_rolesselfs P/home/oem/CyberBrain26-unified/src/cyberbrain26/extension_layer/registry_impl.py__init__zInMemoryAgentRegistry.__init__&s)+ ,. c$||jvrtjd|||j|<t|dd}|rN||jvrg|j|<||j|vr|j|j |yyy)NzeZdZdZ d ddZddZddZejd ddZ d ddZ d dd Z dd Z dd Z dd Z dd Z d ddZy)InMemoryTaskDispatcheruDefault TaskDispatcher backed by an AgentRegistry. Routes tasks to agents by ID or by role. Requires agents to be registered in the registry before dispatching. All dispatches pass through Identity → Policy → Permission → Audit before agent.execute() is called. This dispatcher owns the *outer* authorization gate, and an approval it obtains is the one human decision for the step. When the authorized action is one the agent will really perform, the decision is handed to the agent as an ``ExecutionAuthorization`` bound to that single call, so the inner gate (the execution gateway standing in front of the sandbox) re-verifies it instead of asking the same operator the same question again. The grant is minted only when a human actually decided, and it is bound to a digest of the execution payload, so a step whose payload changes afterwards is refused at the inner gate rather than executed under the earlier approval. Ncr|dkr td|dkr td|xs t|_|xs t|_||_|j |j_t|j|j |_||_ ||_ ||_ tt|_y)Nrz)approval_timeout_seconds must be positivez'approval_poll_interval must be positive) audit_log) ValueErrorr _registryr_policy_engine_audit_log_instancerFr_permission_gateway_approval_manager_approval_timeout_seconds_approval_poll_intervalrint _role_indices)rregistry policy_enginerFapproval_managerapproval_timeout_secondsapproval_poll_intervals rrzInMemoryTaskDispatcher.__init__bs $q (HI I !Q &FG G!<%:%<+=|~#, (,(@(@%#4   4+C+C$  "2)A&'=$-8-=rc<|jj||yr)rHr')rr%r&s rregister_agentz%InMemoryTaskDispatcher.register_agent{s %0rc|jj|}|std||j|}|dzt |z|j|<||S)z8Select an agent by role using deterministic round-robin.zno agent with role: )rHr2KeyErrorrPlen)rr agentsidxs r_select_agent_by_rolez,InMemoryTaskDispatcher._select_agent_by_role~sc,,T21$89 9  &$'!Gs6{#:4 c{r event_typec r|j+|jj||||||||dk7r|ndyy)z=Record a dispatch-level security event with task correlation.Nallow)actorr%task_idactionpolicy_decisionresulterror)rJrecord)rrer%rfdecisionreasonr`s r_record_audit_eventz*InMemoryTaskDispatcher._record_audit_eventsO  # # /  $ $ + +! ( (G 3f ,  0rcJK|j|||||d{y7w)aEnforce identity, canonical policy, permission, approval, and audit. Returns nothing on purpose: the structural port the agents module uses for bus-delivered work declares this signature, and a bus task that clears the chain is not followed by a dispatched step whose payload a grant could describe. Callers that do own a step use :meth:`_authorize_step`, which also reports the approval that was obtained. N)_authorize_step)rreregistered_agent_idr&rfresources r _authorizez!InMemoryTaskDispatcher._authorizes& ""7,?PXYYYs #!#c^Kt|dd}|"d}|j|||d|t||j|k7r2d|jd|}|j|||d|t||jj |||}|j||j||j j|j|j jdk(ry|j jd k7rtd |jd |d |j@d }|j||j|d|tjtd|d |jj|||d|i|j} |j||j|d| jtjt|j |jj"} t%j&j)| z} t%j&j)| kr|jj+| j} | n| j,t.j0k(rI|j||j|d| j2xsdtj4| jS| j,t.j6k7rnXt%j8t|j:| d{t%j&j)| kr|jj=|jj+| j} | B| j,t.j6k(r%|jj?| j| | j,jnd} |j||j|dd| tjtd| d|d 7 w)aEnforce the authorization chain and report the approval behind it. Returns: The id of the approval request a human approved, or ``None`` when the chain allowed the action outright. ``None`` deliberately means "no human decision exists here", so a caller can never turn a policy "allow" into an approval that authorises executable content. identityNzagent identity is requireddenyzagent identity z does not match registered id )rer%rfrkrlrbrequire_approvalzAgent z denied for action ''z"approval manager is not configuredr_z!Approval unavailable for action 're)contextrlpendingapprovedzapproval grantedmissingz approval z Approval z for action ') r#rmrr%rKevaluaterkvaluerlrLrAPPROVAL_DENIEDcreate_request request_idAPPROVAL_REQUIREDminrMtimeout_secondsasyncioget_running_looptime get_requeststatusrAPPROVEDreviewerAPPROVAL_GRANTEDPENDINGsleeprN check_expiredcancel)rrerpr&rfrqrtrlrhrequest wait_secondsdeadlinecurrentrs rroz&InMemoryTaskDispatcher._authorize_steps 5*d3  1F  $ $W.A66SY Z' '    3 3!("3"3!67!!4 79   $ $W.A66SY Z' '))228VXN   &&__**== !  ?? G + ?? $6 6&):):(;;OPVxWX YZ Z  ! ! )9F  $ $!!)99 %  "CF81 MN N((77   (== 8            %77 !   * *  " " 2 2 ++-224|C&&(--/(:,,889K9KLG~~!8!88((%%$$:(:->> ))))~~!7!77--D$@$@, OP P P!&&(--/(:$ ,,.((44W5G5GH  7>>^5K5K#K  " " ) )'*<*< =)0)<%%)        x %55 ! ix}VHAFGG QsLP-P*)P- C"P-ct|jd}|s"d}|j||dd|t||S)uKReturn the canonical action declared by the payload. Security rationale: the dispatcher used to invent ``"execute"`` when the payload carried no action. That name is in neither the scope map nor the sensitive-action set, so the step skipped the scope gate and was allowed by SAFE mode's non-sensitive rule — an action nobody had ever authorized. No default is inferred here: a payload without an explicit action states nothing to authorize and is refused, exactly as the CLI already refuses an action-less roadmap step. rfzppayload declares no 'action', so there is nothing to authorize; it was refused and no default action is inferredrcru)r r.rmr)rrer%payloadrfrls r_require_declared_actionz/InMemoryTaskDispatcher._require_declared_action sM "'++h"78C   $ $WhFF K' ' rc&K|jj|}|td||j|||}|jd}|j |||||d{}|j ||||||d{S7"7w)Nzagent not found: rq)rHr.rZrro_execute_authorized)rrer%rr&rfrq approval_ids rdispatchzInMemoryTaskDispatcher.dispatch:s""8, =.xj9: :..w'J;;z* 00(E6S[\\ -- Xufg{   ] s$A(B*B +BB BBcNK|j|tfd|jjDd}|j |||}|j d}|j ||||d{}|j|||||d{S7"7w)Nc32K|]\}}|us |ywrrB).0r1ar&s r z:InMemoryTaskDispatcher.dispatch_to_role..Is GVS!AJS Gs unknownrq)r^nextrHr6rr.ror) rrer rr%rfrqrr&s @rdispatch_to_rolez'InMemoryTaskDispatcher.dispatch_to_roleFs**40 Gt~~668 G   ..w'J;;z* 00(E6S[\\ -- Xufg{   ] s$A;B%>B!?B%B#B%#B%c|yt||||jdt|jd|jd|jd|jdt|S) aReturn the grant to bind to this agent call, or ``None`` for none. The digest is taken over the payload exactly as the agent will read it: the same keys, and the same default timeout, that ``CoderAgent`` passes to the execution gateway. The two sides therefore agree on a well-behaved step and disagree on a tampered one, which is the property the inner gate relies on. Nrqcodelanguage workspacer)rrrr)r%rerfrqpayload_digestapproval_request_id)r r.r r)rrer%rfrrs r_execution_grantz'InMemoryTaskDispatcher._execution_grantTst  %[[,3[[( Z0!++k2 ' %'H! !,  rc K|j|||ddtj t|j |||||5|j |d{}dddttdd} |j|||| rdnd| rdnd tj|S7Q#1swYPxYw#t $r>}|j|||dt|jtjd}~wwxYww) Nstartedzagent execution startedr_failedsuccessT succeededzagent execution completedzagent returned failure) rmr AGENT_STARTEDr rexecute Exceptiontyper>AGENT_FINISHEDr=r#) rrer%r&rfrrrhexcrs rrz*InMemoryTaskDispatcher._execute_authorizedys!       %%33 !  /%%gx+V 6 %}}W55 6D9:      $K(+4 ':R%44 !  )6 6 6   $ $S "")88 %   sS&DB<B0B.B0!B<)AD.B00B95B<< D9C>>DD)NNNNg>@g?)rQzAgentRegistry | NonerRzPolicyEngine | NonerFzAuditLog | NonerSzApprovalManager | NonerTfloatrUrr9r:r;)r r<r9r)rer<r%r<rfr<rkr<rlr<r`rr9r:r) rer<rpr<r&rrfr<rq str | Noner9r:) rer<rpr<r&rrfr<rqrr9r)rer<r%r<rdict[str, Any]r9r<)rer<r%r<rrr9r)rer<r r<rrr9r) rer<r%r<rfr<rrrrr9zExecutionAuthorization | None)rer<r%r<r&rrfr<rrrrr9r)r>r?r@rArrWr^rPERMISSION_CHECKrmrrrorrrrrrBrrrDrDNs#**.-1%)37*.(,>&>+># > 1 > #( >!&> >21"&4%D%D     # : $ ZZ!Z Z  Z  Z Z0 $ nHnH!nH nH  nH  nH nH`  4    # # #  #  #  #  '# X#',,, ,  ,  , , ,rrD)#rA __future__rrlogging collectionsrtypingr+cyberbrain26.extension_layer.agent_registryrr#cyberbrain26.security_plane.actionsrr r r r $cyberbrain26.security_plane.approvalr r!cyberbrain26.security_plane.auditrr&cyberbrain26.security_plane.permissionrr"cyberbrain26.security_plane.policyr getLoggerr>r!rrD__all__rBrrrsn##LQFS;   8 $,(,(^WWt #$< =r