2d88c9765b
Some checks are pending
CI / lint-and-test (push) Waiting to run
* Harden leoclean no-send staging runtime * Isolate GCP leoclean runtime adapters * Verify current-main leoclean context contracts * Constrain no-send operational contracts
215 lines
8.7 KiB
Python
215 lines
8.7 KiB
Python
#!/usr/bin/env python3
|
|
"""GCP-staging entry point over the unchanged shared Cloud SQL bridge."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import importlib.util
|
|
import json
|
|
import stat
|
|
import sys
|
|
from pathlib import Path
|
|
from types import ModuleType
|
|
from typing import Any
|
|
|
|
RUNTIME_IDENTITY_SCHEMA = "livingip.leocleanGcpRuntimeIdentity.v1"
|
|
STAGING_SERVICE_ACCOUNT = "sa-teleo-staging-vm@teleo-501523.iam.gserviceaccount.com"
|
|
HERE = Path(__file__).resolve().parent
|
|
|
|
|
|
def _load_sibling(name: str, filename: str) -> ModuleType:
|
|
path = HERE / filename
|
|
if path.is_symlink() or not path.is_file():
|
|
raise SystemExit(f"Bound runtime module was unavailable: {filename}.")
|
|
spec = importlib.util.spec_from_file_location(name, path)
|
|
if spec is None or spec.loader is None:
|
|
raise SystemExit(f"Bound runtime module was unavailable: {filename}.")
|
|
module = importlib.util.module_from_spec(spec)
|
|
sys.modules[name] = module
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
cloudsql = _load_sibling("livingip_cloudsql_memory_base", "cloudsql_memory_base.py")
|
|
contracts = _load_sibling("livingip_operational_contracts", "operational_contracts.py")
|
|
_BASE_QUERY_ROWS = cloudsql.query_rows
|
|
_BASE_PARSE_ARGS = cloudsql.parse_args
|
|
|
|
|
|
def _parse_runtime_identity(body: bytes) -> str:
|
|
def reject_duplicates(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
|
|
value: dict[str, Any] = {}
|
|
for key, item in pairs:
|
|
if key in value:
|
|
raise ValueError("duplicate key")
|
|
value[key] = item
|
|
return value
|
|
|
|
try:
|
|
value = json.loads(body, object_pairs_hook=reject_duplicates)
|
|
except (UnicodeDecodeError, ValueError):
|
|
raise SystemExit("Runtime identity manifest was invalid.") from None
|
|
if value != {
|
|
"expected_service_account": STAGING_SERVICE_ACCOUNT,
|
|
"schema": RUNTIME_IDENTITY_SCHEMA,
|
|
}:
|
|
raise SystemExit("Runtime identity manifest was invalid.")
|
|
return STAGING_SERVICE_ACCOUNT
|
|
|
|
|
|
def expected_runtime_service_account(path: Path | None = None) -> str:
|
|
"""Read the exact root-controlled staging identity bound beside this tool."""
|
|
|
|
identity_path = path or (HERE / "gcp-runtime-identity.json")
|
|
try:
|
|
if identity_path.is_symlink():
|
|
raise OSError
|
|
resolved = identity_path.resolve(strict=True)
|
|
if resolved != identity_path or not resolved.is_file():
|
|
raise OSError
|
|
metadata = resolved.stat()
|
|
if metadata.st_uid != 0 or stat.S_IMODE(metadata.st_mode) != 0o644:
|
|
raise OSError
|
|
body = resolved.read_bytes()
|
|
except OSError:
|
|
raise SystemExit("Runtime identity manifest was invalid.") from None
|
|
if not body or len(body) > 1024:
|
|
raise SystemExit("Runtime identity manifest was invalid.")
|
|
return _parse_runtime_identity(body)
|
|
|
|
|
|
def _parse_args() -> Any:
|
|
"""Consume bounded contextual-retrieval flags before the shared parser."""
|
|
|
|
filtered = [sys.argv[0]]
|
|
retrieval_query: str | None = None
|
|
retrieval_anchors: list[str] = []
|
|
arguments = iter(sys.argv[1:])
|
|
for argument in arguments:
|
|
if argument == "--retrieval-query":
|
|
if retrieval_query is not None:
|
|
raise SystemExit("Only one retrieval query is allowed.")
|
|
retrieval_query = next(arguments, None)
|
|
if retrieval_query is None:
|
|
raise SystemExit("Retrieval query value is required.")
|
|
continue
|
|
if argument.startswith("--retrieval-query="):
|
|
if retrieval_query is not None:
|
|
raise SystemExit("Only one retrieval query is allowed.")
|
|
retrieval_query = argument.split("=", 1)[1]
|
|
continue
|
|
if argument == "--retrieval-anchor":
|
|
anchor = next(arguments, None)
|
|
if anchor is None:
|
|
raise SystemExit("Retrieval anchor value is required.")
|
|
retrieval_anchors.append(anchor)
|
|
continue
|
|
if argument.startswith("--retrieval-anchor="):
|
|
retrieval_anchors.append(argument.split("=", 1)[1])
|
|
continue
|
|
filtered.append(argument)
|
|
if retrieval_query is not None and (not retrieval_query.strip() or len(retrieval_query) > 16_000):
|
|
raise SystemExit("Retrieval query was invalid.")
|
|
if len(retrieval_anchors) > 4 or any(not item.strip() or len(item) > 120 for item in retrieval_anchors):
|
|
raise SystemExit("Retrieval anchors were invalid.")
|
|
original = sys.argv
|
|
try:
|
|
sys.argv = filtered
|
|
parsed = _BASE_PARSE_ARGS()
|
|
finally:
|
|
sys.argv = original
|
|
parsed.retrieval_query = retrieval_query
|
|
parsed.retrieval_anchor = retrieval_anchors
|
|
return parsed
|
|
|
|
|
|
def _claim_mentions_anchor(claim: dict[str, Any], anchors: list[str]) -> bool:
|
|
haystack = " ".join([str(claim.get("text") or ""), *(str(item) for item in claim.get("tags") or [])]).casefold()
|
|
return any(anchor.casefold() in haystack for anchor in anchors)
|
|
|
|
|
|
def _merge_anchor_backfill(
|
|
primary: dict[str, Any],
|
|
anchor_result: dict[str, Any],
|
|
*,
|
|
anchors: list[str],
|
|
limit: int,
|
|
) -> dict[str, Any]:
|
|
primary_claims = list(primary.get("claims") or [])
|
|
if any(_claim_mentions_anchor(claim, anchors) for claim in primary_claims):
|
|
return primary
|
|
primary_ids = {str(claim.get("id") or "") for claim in primary_claims}
|
|
backfill = [
|
|
claim for claim in list(anchor_result.get("claims") or []) if str(claim.get("id") or "") not in primary_ids
|
|
][: max(1, min(2, limit))]
|
|
if not backfill:
|
|
return primary
|
|
claims = (backfill + primary_claims)[:limit]
|
|
context_rows = list(primary.get("context_rows") or [])
|
|
include_private = str(primary.get("privacy") or "").startswith("private agent context mode")
|
|
claim_hits = []
|
|
for claim in claims:
|
|
hit = {
|
|
"source_table": "public.claims",
|
|
"row_id": claim.get("id"),
|
|
"score": claim.get("score"),
|
|
"claim_type": claim.get("type"),
|
|
"claim_status": claim.get("status"),
|
|
"confidence": claim.get("confidence"),
|
|
"tags": claim.get("tags") or [],
|
|
"evidence_count": claim.get("evidence_count"),
|
|
"edge_count": claim.get("edge_count"),
|
|
}
|
|
if include_private:
|
|
hit["excerpt"] = claim.get("text")
|
|
claim_hits.append(hit)
|
|
context_hits = [hit for hit in list(primary.get("hits") or []) if hit.get("source_table") != "public.claims"]
|
|
merged = dict(primary)
|
|
merged["claims"] = claims
|
|
merged["hits"] = claim_hits + context_hits
|
|
merged["hit_count_total"] = len(claims) + len(context_rows)
|
|
return merged
|
|
|
|
|
|
def _enrich_context(args: Any, query: str, result: dict[str, Any]) -> dict[str, Any]:
|
|
"""Attach current-main response contracts to the real Cloud SQL rows."""
|
|
|
|
operational_contracts = contracts.operational_contracts(query)
|
|
claims = result.get("claims")
|
|
if not isinstance(claims, list) or not all(isinstance(item, dict) for item in claims):
|
|
raise SystemExit("Cloud SQL context returned an invalid claims payload.")
|
|
evidence = {str(claim.get("id") or ""): list(claim.get("evidence") or []) for claim in claims if claim.get("id")}
|
|
contracts.bind_claim_evidence_challenge(operational_contracts, claims, evidence)
|
|
enriched = dict(result)
|
|
enriched["operational_contracts"] = operational_contracts
|
|
enriched["compiled_response"] = contracts.compile_operational_response(operational_contracts)
|
|
enriched["runtime_contract_mode"] = contracts.classify_contract_mode(query)
|
|
return enriched
|
|
|
|
|
|
def _query_rows(args: Any, query: str, limit: int) -> dict[str, Any]:
|
|
retrieval_query = str(getattr(args, "retrieval_query", None) or query)
|
|
retrieval_anchors = list(getattr(args, "retrieval_anchor", None) or [])
|
|
result = _BASE_QUERY_ROWS(args, retrieval_query, limit)
|
|
if getattr(args, "command", None) == "context" and retrieval_anchors:
|
|
anchor_result = _BASE_QUERY_ROWS(args, " ".join(retrieval_anchors), max(1, min(2, limit)))
|
|
result = _merge_anchor_backfill(result, anchor_result, anchors=retrieval_anchors, limit=limit)
|
|
result["query"] = query
|
|
result["retrieval_query_sha256"] = hashlib.sha256(retrieval_query.encode("utf-8")).hexdigest()
|
|
result["retrieval_anchors_sha256"] = hashlib.sha256(
|
|
json.dumps(retrieval_anchors, sort_keys=True, separators=(",", ":")).encode("utf-8")
|
|
).hexdigest()
|
|
if getattr(args, "command", None) != "context":
|
|
return result
|
|
return _enrich_context(args, query, result)
|
|
|
|
|
|
def main() -> None:
|
|
cloudsql.RUNTIME_SERVICE_ACCOUNT = expected_runtime_service_account()
|
|
cloudsql.parse_args = _parse_args
|
|
cloudsql.query_rows = _query_rows
|
|
cloudsql.main()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|