r[idZddlmZddlZddlmcmZddl Z ddl Z ddl m Z m Z ddlmZmZmZddlmZmZddlmZddlmZmZmZdd lmZmZdd lmZm Z Gd d Z!d&d Z"d&dZ#e jHjd&dZ%e jHjd&dZ&e jHjd&dZ'e jHjd&dZ(e jHjd&dZ)e jHjd&dZ*e jHjd&dZ+e jHjd&dZ,e jHjd&dZ-e jHjd&dZ.e jHjd&dZ/e jHjd&dZ0GddZ1Gdde!Z2e jHjd&dZ3e jHjd&d Z4e jHjd&d!Z5Gd"d#Z6e7d$k(re jpe9d%gyy)'z*Contract tests for InMemoryTaskDispatcher.) annotationsN)AuthorizedExecutionServiceExecutionRefused)Agent AgentRegistryTaskDispatcher)InMemoryAgentRegistryInMemoryTaskDispatcher)ApprovalManager) AgentIdentityPermissionScope TrustLevel)PermissionGateway SecurityError) PolicyEngine PolicyModecheZdZdZ d d dZed dZed dZd dZd d dZ y) MockAgentz3Mock agent implementing Agent protocol for testing.NcX||_|xsd||_||_||_g|_y)Nzagent-)_role _agent_ididentitypermission_gatewayexecuted_payloads)selfroleagent_idrrs InMemoryTaskDispatcher must implement TaskDispatcher protocol.rDrEN)r rregister_agent) dispatcherrHs r(test_task_dispatcher_protocol_compliancerkCs$!7!9J g Ei/r cVKt}tddtj}t d|}|j d||j ddddid{}|d }d }||k(}|sltjd |fd ||ftj|tj|d z}dd|iz}ttj|dx}x}}|j}t|} d} | | k(} | s tjd | fd| | fdtjvstj trtjtnddtjvstj |rtj|ndtj|tj| tj| dz} dd| iz} ttj| dx}x} x} } |jdd}d}||k(}|sltjd |fd ||ftj|tj|d z}dd|iz}ttj|dx}x}}y7Fw)z'dispatch must accept and track task_id.rErD trust_levelrztask-123r1planNr'r&==z%(py1)s == %(py4)spy1rKassert %(py6)srLzW%(py5)s {%(py5)s = %(py0)s(%(py3)s {%(py3)s = %(py1)s.executed_payloads }) } == %(py8)slenrHrIrupy3py5rMrNrOr)r r rTRUSTEDrridispatchrTrUrYrZr[rryrVrWrX)rjrrHr3 @py_assert0r_ @py_assert2 @py_format5 @py_format7 @py_assert4ra @py_assert6rbrcs rtest_dispatch_uses_task_idrKs()JYZ=O=OPH g 1Ei/&&z9x>PQ QF ( #t# t #### t### ###t#######&&,3& ',1, '1 ,,,, '1,,,,,,3,,,3,,,,,,u,,,u,,,&,,, ',,,1,,,,,,,  " "1 %h /969 /6 9999 /6999 /99969999999RsAJ) J&!IJ)c ,Kt}tddtddtj}tddtddtj}|j d||j d||j ddddid {|j}t|}d }||k(}|s tjd |fd ||fd tjvstjtrtjtnd dtjvstj|rtj|ndtj|tj|tj|dz}dd|iz}ttj |d x}x}x}}|j}t|}d}||k(}|s tjd |fd ||fd tjvstjtrtjtnd dtjvstj|rtj|ndtj|tj|tj|dz}dd|iz}ttj |d x}x}x}}|j ddddid {|j}t|}d }||k(}|s tjd |fd ||fd tjvstjtrtjtnd dtjvstj|rtj|ndtj|tj|tj|dz}dd|iz}ttj |d x}x}x}}|j}t|}d }||k(}|s tjd |fd ||fd tjvstjtrtjtnd dtjvstj|rtj|ndtj|tj|tj|dz}dd|iz}ttj |d x}x}x}}|j ddddid {|j}t|}d}||k(}|s tjd |fd ||fd tjvstjtrtjtnd dtjvstj|rtj|ndtj|tj|tj|dz}dd|iz}ttj |d x}x}x}}|j}t|}d }||k(}|s tjd |fd ||fd tjvstjtrtjtnd dtjvstj|rtj|ndtj|tj|tj|dz}dd|iz}ttj |d x}x}x}}y 7r77rw)zDdispatch_to_role must select agents deterministically (round-robin).rDrErmrozagent-2task-1r1rpNrwrqrxryagent1rzrNrOragent2task-2ztask-3)r rr rr}ridispatch_to_rolerryrTrUrVrWrXrYrZr[) rjrrrrrarrbrcs r/test_dispatch_to_role_deterministic_round_robinrYs()J ]9gS]SeSe%fF]9gS]SeSe%fFi0i0  % %h(F9K LLL''-3' (-A- (A ---- (A------3---3------v---v---'--- (---A-------''-3' (-A- (A ---- (A------3---3------v---v---'--- (---A-------  % %h(F9K LLL''-3' (-A- (A ---- (A------3---3------v---v---'--- (---A-------''-3' (-A- (A ---- (A------3---3------v---v---'--- (---A-------  % %h(F9K LLL''-3' (-A- (A ---- (A------3---3------v---v---'--- (---A-------''-3' (-A- (A ---- (A------3---3------v---v---'--- (---A-------M M Ms9B`` J``J`` I,```cKttj}t|}t ddt j tjh}t|}tdd||}|jd||jdddd id {}|d }d }||k(}|sltjd |fd||ftj|tj|dz} dd| iz} t!tj"| d x}x}}t%j&t(5|jddddid {d d d y 77#1swYy xYww)uHdispatch must enforce Identity → Policy → Permission before execute.modez secure-agentrDrrrnscopes policy_enginerrrr1 read_fileNr'r&rqrsrtrvrLr write_file)rrSAFErr rr}r READ_FILEr rrir~rTrUrYrZr[pytestraisesr) rgatewayrrjrHr3rr_rrrs r:test_dispatch_security_boundary_identity_policy_permissionrvs9!joo6M .G &&))* H(mDJ g~U\ ]Ene4&&x(KAXY YF ( #t# t #### t### ###t####### } %V!!(NX|=)z0%(py3)s {%(py3)s = %(py0)s(%(py1)s) } >= %(py6)sry perm_events)rIrur{rLzassert %(py8)srMrq)z.%(py3)s {%(py3)s = %(py1)s.action } == %(py6)s)rur{rL)!cyberbrain26.security_plane.auditrrrrrrr r rr}r rrrir~queryPERMISSION_CHECKryrTrUrVrWrXrYrZr[r1)rrrauditrrjrrHrrr`rrrbrs r!test_dispatch_records_audit_eventrsWV JE joo6M'muUJ &&))* H g}x @EmU3   h +7N OOO++jN4S4STUK {  q q    q      3   3      {   {      q       q>/> /K/ K //// K///>/// ///K/////// PsBI<I9 GI<cKttj}t|}t ddt j tjh}t|}tdd||}|jd|tjt5|jdddd id {d d d y 7 #1swYy xYww) z0dispatch_to_role must enforce security boundary.rzsecure-agent-1rDrrrrr1 execute_shellN)rrrrr rr}r SHELLr rrirrrrrrrrjrHs r'test_dispatch_to_role_security_boundaryrs!joo6M .G! &&%%& H(mDJ g/(W^ _E.6 } %Z))(Gh=XYYYZZYZZs0BCC3C4C8 CCC CcKt}tjtd5|j ddddid{dddy7 #1swYyxYww)z4dispatch must raise KeyError for unregistered agent.zagent not foundmatchrunknownr1testN)r rrKeyErrorr~rjs r'test_dispatch_unregistered_agent_raisesrs^()J x'8 9K!!(I&7IJJJKKJKK.&AAAA AAAAcKt}tjtd5|j ddddid{dddy7 #1swYyxYww)z6dispatch_to_role must raise KeyError for unknown role.zno agent with rolerrz unknown-roler1rN)r rrrrrs r%test_dispatch_to_role_no_agent_raisesrs^()J x'; <X))(NXvDVWWWXXWXXrcKt}tddtj}t d|}|j d|t jtd5|jdddd id {d d d |j}g}||k(}|stjd |fd ||fd tjvstj|rtj |nd tj |tj |dz}dd|iz}t#tj$|d x}x}}y 7#1swYxYww)zAA payload with no declared action must be refused, not defaulted.rErDrmrono default action is inferredrrr(anythingNrqz9%(py2)s {%(py2)s = %(py0)s.executed_payloads } == %(py5)srHrIrJr|assert %(py7)spy7)r r rr}rrirrrr~rrTrUrVrWrXrYrZr[rjrrHr^rr_ @py_format6 @py_format8s r'test_dispatch_without_action_is_refusedrs()JYZ=O=OPH g 1Ei/ },K LP!!(I :7NOOOP  " "(b( "b (((( "b((((((5(((5((( "(((b((((((( PPPs1A!E #E<E=ECE EEE cKt}tddtj}t d|}|j d|t jtd5|jddid{ddd|j}g}||k(}|stjd |fd ||fd tjvstj|rtj |nd tj |tj |d z}d d|iz}t#tj$|dx}x}}y7#1swYxYww)z2dispatch_to_role must not invent an action either.rErDrmrorrrNrqrrHrrr)r r rr}rrirrrrrrTrUrVrWrXrYrZr[rs r/test_dispatch_to_role_without_action_is_refusedrs()JYZ=O=OPH g 1Ei/ },K LA))(GR@@@A  " "(b( "b (((( "b((((((5(((5((( "(((b((((((( AAAs1A!E#E:E;E?CEEEEcKt}tddtjtj tj tjh}td|}|jd|tjt5|jddddid{ddd|j}g}||k(}|stj d |fd ||fd t#j$vstj&|rtj(|nd tj(|tj(|d z}d d|iz}t+tj,|dx}x}}y7#1swYxYww)z:An action outside the canonical vocabulary must be denied.rErD)rnrrorr1r+NrqrrHrrr)r r rr}r rrPYTHONrrirrrr~rrTrUrVrWrXrYrZr[rs r(test_dispatch_unmapped_action_is_refusedrs()J&&))?+@+@/BXBXY H g 1Ei/ } %N!!(I)7LMMMN  " "(b( "b (((( "b((((((5(((5((( "(((b((((((( NNNs1B F F(E>)F-CF >FF F cKt}td}|jd|tjt d5|j ddddid{ddd|j}g}||k(}|stjd |fd ||fd tjvstj|rtj|nd tj|tj|d z}d d|iz}ttj|dx}x}}y7#1swYxYww)zr?r@ provider_namerr+rBr rrr!sFM2"r rc<eZdZdZ dfd ZddZxZS)_SwappingCoderaCoder whose body swaps the code after the dispatch approved the original. This models the one thing the single-approval flow must never tolerate: the payload that reached the operator is not the payload that reaches the sandbox. It is deliberately a *legitimate-looking* agent - it holds the right identity, the right scope and calls the real execution service. cLt|||j|||_y)Nrr)superrrservice)rrrr __class__s rrz_SwappingCoder.__init__7s& (9(9HM r c Kd|d<|jj|j|d|dt|j dd|j dd{dd iS7w) Nz5print('swapped after the operator approved the step')codelanguagetask_iddispatched-task workspace)rrr'r&)rr+rr5rSr*s rr+z_SwappingCoder.execute@sxQll"" MM FO J  I/@ABkk+. #   $ sA!A.#A,$ A.)rr5rr rrr7r8r:)r=r>r?r@rr+ __classcell__)rs@rrr.s8 ,     r rc Kttddtjtj h}t }t|ttd}t}td||}|jd|dfd }tj|}tj t"d 5|j%d dd d d dd{ddd|d{|j&}g}||k(} | st)j*d| fd||fdt-j.vst)j0|rt)j2|ndt)j2|t)j2|dz} t)j4ddzd| iz} t7t)j8| dx}x} }j:} | }t=|} d}| |k(}|s4t)j*d|fd| |fdt-j.vst)j0t<rt)j2t<nddt-j.vst)j0rt)j2ndt)j2| t)j2|t)j2| t)j2|dz}t)j4ddzd|iz}t7t)j8|dx} x}x} x}}y7\#1swY\xYw7Zw) aA granted approval must not travel from the approved code to other code. The dispatcher obtains one human approval for the step as declared, then hands control to the agent. If the agent changes the payload in between, the inner gateway has to notice: reusing the approval would run code nobody approved, and asking again would hide the swap. So the execution is refused, the provider is never reached, and the refusal is audited. coder-1rDr皙?approval_managerapproval_timeout_secondsrcKjs.tjdd{js.jjdjddy7DwNg{Gzt?rreviewerapproved list_pendingasynciosleepapprove request_id approvalssr approve_oncezatest_approval_for_the_original_payload_does_not_authorise_a_changed_payload..approve_onceh^((*--& & &((*)00215@@*jY ')A3A1A30A3zdoes not cover this executionrrexecute_pythonpythonz!print('approved by the reviewer')r1rrNrqz-%(py2)s {%(py2)s = %(py0)s.calls } == %(py5)sproviderrz4the sandbox must not be reached with unapproved codez >assert %(py7)srrwzj%(py7)s {%(py7)s = %(py0)s(%(py5)s {%(py5)s = %(py3)s {%(py3)s = %(py1)s.list_records }() }) } == %(py10)sryrrIrur{r|rrOz+exactly one approval, and it was not reusedz >assert %(py12)spy12r)r r rr}r rrrrrr rrir create_taskrrrr~rrTrUrVrWrXrY_format_assertmsgrZr[ list_recordsry)rrrrjrHrapproverr^rr_rrrr @py_assert9rdrc @py_format13rs @rKtest_approval_for_the_original_payload_does_not_authorise_a_changed_payloadrLsH !I &&&&' H "#H(,.)"!% G (CJ 7Hg 6Ei/Z ""<>2H '/N O  !!  *$;       NN >>WRW>R WWW>RWWWWWW8WWW8WWW>WWWRWWW!WWWWWWWW%%\%'\3' (\A\ (A -\\\ (A\\\\\\3\\\3\\\\\\y\\\y\\\%\\\'\\\ (\\\A\\\/\\\\\\\\    s=CM M%M&M* M7M8I MMM Mc 8KGfddt}ttddtjt j h}t}t|ttdt}|dd| }|jd|d%fd }tj|}|jd dd d ddd{}|d{ddi}||k(} | st!j"d| fd||fdt%j&vst!j(|rt!j*|ndt!j*|dz} dd| iz} t-t!j.| dx} }|j0}t3|} d} | | k(}|s t!j"d|fd| | fdt%j&vst!j(t2rt!j*t2nddt%j&vst!j(|rt!j*|ndt!j*|t!j*| t!j*| dz}dd|iz}t-t!j.|dx}x} x}} j4}|} t3| }d}||k(}|st!j"d|fd ||fdt%j&vst!j(t2rt!j*t2ndd!t%j&vst!j(rt!j*nd!t!j*|t!j*| t!j*|t!j*|d"z}d#d$|iz}t-t!j.|dx}x} x}x}}y7;74w)&zThe same dispatch with an untouched payload needs no second approval. The gateway still re-runs its own scope and policy check; what it does not do is raise a second request the operator would have to answer again. ceZdZdfd Zy)Stest_unchanged_payload_lets_the_second_gate_proceed_on_one_approval.._Coderc Kj|j|d|dt|jddd{ddiS7w)Nrrrr)rr'r&)r+rr5rS)rr(rs rr+z[test_unchanged_payload_lets_the_second_gate_proceed_on_one_approval.._Coder.executes^//  #GKK 3DEF "   d# #  sAAA ANr:)r=r>r?r+)rsr_Coderrs $r rrrDrrrrrcKjs.tjdd{js.jjdjddy7DwrrrsrrzYtest_unchanged_payload_lets_the_second_gate_proceed_on_one_approval..approve_oncerrrrrzprint('approved')rNr'r&rq)z%(py0)s == %(py3)sr3)rIr{zassert %(py5)sr|rw)zK%(py5)s {%(py5)s = %(py0)s(%(py3)s {%(py3)s = %(py1)s.calls }) } == %(py8)sryrrzrNrOrrrzassert %(py12)srr)rr r rr}r rrrrrr rirrr~rTrUrVrWrXrYrZr[rryr )rrrrjrHrr r3rr^ @py_format4rrrarrbrcr rdr rrs @@rCtest_unchanged_payload_lets_the_second_gate_proceed_on_one_approvalr~s$$ !I &&&&' H "#H(,.)"!% G (CJ 7Y BEi/Z ""<>2H&&#CVWF NN%%6% %%%%6%%%%%%%6%%%6%%%%%%%%%%%~~#3~ #!# ! #### !######3###3######x###x###~### ###!#######%%-%'-3' (-A- (A ---- (A------3---3------y---y---%---'--- (---A-------- s%CPP P#P$L1PPc "Kt}tddtjtj h}t }t|tt|d}t|}td||}|jd|tjtd5|j!d dd d d d d{ddd|j"}g}||k(}|st%j&d|fd||fdt)j*vst%j,|rt%j.|ndt%j.|t%j.|dz} dd| iz} t1t%j2| dx}x}}|j4}|}g} || k(} | st%j&d| fd|| fdt)j*vst%j,|rt%j.|ndt%j.|t%j.|t%j.| dz} dd| iz} t1t%j2| dx}x}x} } y7#1swYxYww)a'A policy "allow" must not be laundered into an approval. ``plan`` needs no human decision at the outer gate. If that allow were turned into a grant, an agent could spend it to skip the approval the real execution action requires - so no grant is minted and the inner gate asks. rrDrrrrrrrrshellzecho hirNrqrrrrr)zK%(py4)s {%(py4)s = %(py2)s {%(py2)s = %(py0)s.list_records }() } == %(py7)sr)rIrJrKrzassert %(py9)srP)r r rr}r rrrrrr rrirrrr~rrTrUrVrWrXrYrZr[r )rrrrrjrHr^rr_rrrr`res r2test_outer_allow_mints_no_grant_for_the_inner_gaters !I &&&&' H "#H(,.)"!% G (CJ 7Hg 6Ei/ ' ? !!  7I F     >>R>R >R88>R  ! !) ! #)r) #r )))) #r))))))9)))9))) !))) #)))r)))))))   s1B'J)JI?J F6J?JJ JceZdZdZddZy)TestAgentProtocolz+Verify BaseAgent implements Agent protocol.c ddlm}ddlm}m}Gdd|}|}|}|||}d}t ||} | sddt jvstjt rtjt ndd t jvstj|rtj|nd tj|tj| d z} ttj| dx}} d }t ||} | sddt jvstjt rtjt ndd t jvstj|rtj|nd tj|tj| d z} ttj| dx}} d }t ||} | sddt jvstjt rtjt ndd t jvstj|rtj|nd tj|tj| d z} ttj| dx}} d }t ||} | sddt jvstjt rtjt ndd t jvstj|rtj|nd tj|tj| d z} ttj| dx}} d}t ||} | sddt jvstjt rtjt ndd t jvstj|rtj|nd tj|tj| d z} ttj| dx}} t|t} | s ddt jvstjtrtjtndd t jvstj|rtj|nd dt jvstjtrtjtndtj| dz} ttj| d} y)Nr) BaseAgent) AsyncEventBusMemoryTaskQueuec8eZdZeddZeddZddZy)PTestAgentProtocol.test_base_agent_has_required_attributes..ConcreteAgentcy)NTestrBr#s rnamezUTestAgentProtocol.test_base_agent_has_required_attributes..ConcreteAgent.namer cy)NrrBr#s rrzUTestAgentProtocol.test_base_agent_has_required_attributes..ConcreteAgent.roler%r c Kywr"rB)r task_datas rr+zXTestAgentProtocol.test_base_agent_has_required_attributes..ConcreteAgent.executes sNr9)r(r;r7r8)r=r>r?rAr$rr+rBr r ConcreteAgentr!s-      r r)rz5assert %(py5)s {%(py5)s = %(py0)s(%(py1)s, %(py3)s) }hasattrrH)rIrur{r|rrr+r4z5assert %(py4)s {%(py4)s = %(py0)s(%(py1)s, %(py2)s) } isinstancer)rIrurJrK) cyberbrain26.agents.orchestratorrcyberbrain26.control_planerrr*rVrWrTrXrYrZr[r+r) rrrrr)busqueuerHrrrr_rs r'test_base_agent_has_required_attributesz9TestAgentProtocol.test_base_agent_has_required_attributess>M I o!c5)%%wuf%%%%%%%%w%%%w%%%%%%u%%%u%%%f%%%%%%%%%%()wuj))))))))w)))w))))))u)))u)))j))))))))))23wu233333333w333w333333u333u33323333333333'(wui((((((((w(((w((((((u(((u(((i((((((((((01wu011111111w111w111111u111u11101111111111%''''''''z'''z''''''%'''%'''''''''''''''''''r Nr)r=r>r?r@r0rBr rrrs 5(r r__main__z-vr):r@ __future__rbuiltinsrV_pytest.assertion.rewrite assertionrewriterTrr+cyberbrain26.execution_plane.secure_gatewayrr+cyberbrain26.extension_layer.agent_registryrrr*cyberbrain26.extension_layer.registry_implr r $cyberbrain26.security_plane.approvalr $cyberbrain26.security_plane.identityr r r&cyberbrain26.security_plane.permissionrr"cyberbrain26.security_plane.policyrrrrgrkmarkrrrrrrrrrrrrrrrrrrr=main__file__rBr rrAs^0" ]\d@[[SG 0 0F/0 : :..8VV2000ZZ*KKXX ) ) ) )))&))XX. " " Y <.].]b2.2.j$*$*N((@ zFKK4 !r