#!/usr/bin/env python3 """GCP-staging entry point over the unchanged shared Cloud SQL bridge.""" from __future__ import annotations import hashlib import importlib.util import json import stat import sys from pathlib import Path from types import ModuleType from typing import Any RUNTIME_IDENTITY_SCHEMA = "livingip.leocleanGcpRuntimeIdentity.v1" STAGING_SERVICE_ACCOUNT = "sa-teleo-staging-vm@teleo-501523.iam.gserviceaccount.com" HERE = Path(__file__).resolve().parent def _load_sibling(name: str, filename: str) -> ModuleType: path = HERE / filename if path.is_symlink() or not path.is_file(): raise SystemExit(f"Bound runtime module was unavailable: {filename}.") spec = importlib.util.spec_from_file_location(name, path) if spec is None or spec.loader is None: raise SystemExit(f"Bound runtime module was unavailable: {filename}.") module = importlib.util.module_from_spec(spec) sys.modules[name] = module spec.loader.exec_module(module) return module cloudsql = _load_sibling("livingip_cloudsql_memory_base", "cloudsql_memory_base.py") contracts = _load_sibling("livingip_operational_contracts", "operational_contracts.py") _BASE_QUERY_ROWS = cloudsql.query_rows _BASE_PARSE_ARGS = cloudsql.parse_args def _parse_runtime_identity(body: bytes) -> str: def reject_duplicates(pairs: list[tuple[str, Any]]) -> dict[str, Any]: value: dict[str, Any] = {} for key, item in pairs: if key in value: raise ValueError("duplicate key") value[key] = item return value try: value = json.loads(body, object_pairs_hook=reject_duplicates) except (UnicodeDecodeError, ValueError): raise SystemExit("Runtime identity manifest was invalid.") from None if value != { "expected_service_account": STAGING_SERVICE_ACCOUNT, "schema": RUNTIME_IDENTITY_SCHEMA, }: raise SystemExit("Runtime identity manifest was invalid.") return STAGING_SERVICE_ACCOUNT def expected_runtime_service_account(path: Path | None = None) -> str: """Read the exact root-controlled staging identity bound beside this tool.""" identity_path = path or (HERE / "gcp-runtime-identity.json") try: if identity_path.is_symlink(): raise OSError resolved = identity_path.resolve(strict=True) if resolved != identity_path or not resolved.is_file(): raise OSError metadata = resolved.stat() if metadata.st_uid != 0 or stat.S_IMODE(metadata.st_mode) != 0o644: raise OSError body = resolved.read_bytes() except OSError: raise SystemExit("Runtime identity manifest was invalid.") from None if not body or len(body) > 1024: raise SystemExit("Runtime identity manifest was invalid.") return _parse_runtime_identity(body) def _parse_args() -> Any: """Consume bounded contextual-retrieval flags before the shared parser.""" filtered = [sys.argv[0]] retrieval_query: str | None = None retrieval_anchors: list[str] = [] arguments = iter(sys.argv[1:]) for argument in arguments: if argument == "--retrieval-query": if retrieval_query is not None: raise SystemExit("Only one retrieval query is allowed.") retrieval_query = next(arguments, None) if retrieval_query is None: raise SystemExit("Retrieval query value is required.") continue if argument.startswith("--retrieval-query="): if retrieval_query is not None: raise SystemExit("Only one retrieval query is allowed.") retrieval_query = argument.split("=", 1)[1] continue if argument == "--retrieval-anchor": anchor = next(arguments, None) if anchor is None: raise SystemExit("Retrieval anchor value is required.") retrieval_anchors.append(anchor) continue if argument.startswith("--retrieval-anchor="): retrieval_anchors.append(argument.split("=", 1)[1]) continue filtered.append(argument) if retrieval_query is not None and (not retrieval_query.strip() or len(retrieval_query) > 16_000): raise SystemExit("Retrieval query was invalid.") if len(retrieval_anchors) > 4 or any(not item.strip() or len(item) > 120 for item in retrieval_anchors): raise SystemExit("Retrieval anchors were invalid.") original = sys.argv try: sys.argv = filtered parsed = _BASE_PARSE_ARGS() finally: sys.argv = original parsed.retrieval_query = retrieval_query parsed.retrieval_anchor = retrieval_anchors return parsed def _claim_mentions_anchor(claim: dict[str, Any], anchors: list[str]) -> bool: haystack = " ".join([str(claim.get("text") or ""), *(str(item) for item in claim.get("tags") or [])]).casefold() return any(anchor.casefold() in haystack for anchor in anchors) def _merge_anchor_backfill( primary: dict[str, Any], anchor_result: dict[str, Any], *, anchors: list[str], limit: int, ) -> dict[str, Any]: primary_claims = list(primary.get("claims") or []) if any(_claim_mentions_anchor(claim, anchors) for claim in primary_claims): return primary primary_ids = {str(claim.get("id") or "") for claim in primary_claims} backfill = [ claim for claim in list(anchor_result.get("claims") or []) if str(claim.get("id") or "") not in primary_ids ][: max(1, min(2, limit))] if not backfill: return primary claims = (backfill + primary_claims)[:limit] context_rows = list(primary.get("context_rows") or []) include_private = str(primary.get("privacy") or "").startswith("private agent context mode") claim_hits = [] for claim in claims: hit = { "source_table": "public.claims", "row_id": claim.get("id"), "score": claim.get("score"), "claim_type": claim.get("type"), "claim_status": claim.get("status"), "confidence": claim.get("confidence"), "tags": claim.get("tags") or [], "evidence_count": claim.get("evidence_count"), "edge_count": claim.get("edge_count"), } if include_private: hit["excerpt"] = claim.get("text") claim_hits.append(hit) context_hits = [hit for hit in list(primary.get("hits") or []) if hit.get("source_table") != "public.claims"] merged = dict(primary) merged["claims"] = claims merged["hits"] = claim_hits + context_hits merged["hit_count_total"] = len(claims) + len(context_rows) return merged def _enrich_context(args: Any, query: str, result: dict[str, Any]) -> dict[str, Any]: """Attach current-main response contracts to the real Cloud SQL rows.""" operational_contracts = contracts.operational_contracts(query) claims = result.get("claims") if not isinstance(claims, list) or not all(isinstance(item, dict) for item in claims): raise SystemExit("Cloud SQL context returned an invalid claims payload.") evidence = {str(claim.get("id") or ""): list(claim.get("evidence") or []) for claim in claims if claim.get("id")} contracts.bind_claim_evidence_challenge(operational_contracts, claims, evidence) enriched = dict(result) enriched["operational_contracts"] = operational_contracts enriched["compiled_response"] = contracts.compile_operational_response(operational_contracts) enriched["runtime_contract_mode"] = contracts.classify_contract_mode(query) return enriched def _query_rows(args: Any, query: str, limit: int) -> dict[str, Any]: retrieval_query = str(getattr(args, "retrieval_query", None) or query) retrieval_anchors = list(getattr(args, "retrieval_anchor", None) or []) result = _BASE_QUERY_ROWS(args, retrieval_query, limit) if getattr(args, "command", None) == "context" and retrieval_anchors: anchor_result = _BASE_QUERY_ROWS(args, " ".join(retrieval_anchors), max(1, min(2, limit))) result = _merge_anchor_backfill(result, anchor_result, anchors=retrieval_anchors, limit=limit) result["query"] = query result["retrieval_query_sha256"] = hashlib.sha256(retrieval_query.encode("utf-8")).hexdigest() result["retrieval_anchors_sha256"] = hashlib.sha256( json.dumps(retrieval_anchors, sort_keys=True, separators=(",", ":")).encode("utf-8") ).hexdigest() if getattr(args, "command", None) != "context": return result return _enrich_context(args, query, result) def main() -> None: cloudsql.RUNTIME_SERVICE_ACCOUNT = expected_runtime_service_account() cloudsql.parse_args = _parse_args cloudsql.query_rows = _query_rows cloudsql.main() if __name__ == "__main__": main()