[verified] Enforce delegation adoption at runtime consumers

2026-10-11 07:11:40 +00:00
parent 9367d5a3a1
commit 6cb2317667
19 changed files with 1112 additions and 47 deletions
@@ -0,0 +1,41 @@
+"""Canonical implementation delivery adoption boundary.
+
+The caller owns the authenticated transport and all push/readback invariants.
+This module only gates that transport on fresh delegation evidence.
+"""
+from __future__ import annotations
+
+import re
+
+_SHA40 = re.compile(r"^[0-9a-f]{40}$")
+
+
+class AdoptionError(ValueError):
+    pass
+
+
+def require_adoption(declaration, *, expected_source, expected_stage):
+    try:
+        import sys
+        from pathlib import Path
+        repo_root = Path(__file__).resolve().parents[6]
+        if str(repo_root) not in sys.path:
+            sys.path.insert(0, str(repo_root))
+        from harness.lib.delegation_adoption import require_adoption as checker
+    except Exception as exc:
+        raise AdoptionError("delegation adoption unavailable") from exc
+    try:
+        return checker(declaration, expected_source=expected_source, expected_stage=expected_stage)
+    except Exception as exc:
+        raise AdoptionError("delegation adoption rejected") from exc
+
+
+def deliver(adapter, *, head, declaration):
+    if not callable(adapter):
+        raise AdoptionError("trusted delivery adapter required")
+    if type(head) is not str or not _SHA40.fullmatch(head):
+        raise AdoptionError("invalid delivery head")
+    # Keep this immediately before the external-write callback: evidence must be fresh.
+    require_adoption(declaration, expected_source={"kind": "git_tree", "revision": head},
+                     expected_stage="implementation-delivery")
+    return adapter()
@@ -0,0 +1,90 @@
+"""Initial implementation delivery workflow with independent transport readbacks."""
+from __future__ import annotations
+
+import importlib.util
+import re
+from pathlib import Path
+from types import ModuleType
+from typing import Any
+
+
+_SHA40 = re.compile(r"^[0-9a-f]{40}$")
+_REQUIRED = ("push", "read_remote_head", "create_or_reuse_pr", "read_pr")
+
+
+def _load_delivery_adoption() -> ModuleType:
+    path = Path(__file__).resolve().parent / "delivery_adoption.py"
+    spec = importlib.util.spec_from_file_location("gitea_delivery_adoption", path)
+    if spec is None or spec.loader is None:
+        raise AdoptionError("delivery adoption unavailable")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+_delivery_adoption = _load_delivery_adoption()
+AdoptionError = _delivery_adoption.AdoptionError
+
+
+def _reject(message: str) -> None:
+    raise AdoptionError(message)
+
+
+def _validate_adapter(adapter: Any) -> None:
+    for name in _REQUIRED:
+        try:
+            value = getattr(adapter, name)
+        except Exception:
+            _reject("trusted delivery adapter required")
+        else:
+            if not callable(value):
+                _reject("trusted delivery adapter required")
+
+
+def _validate_head(head: Any) -> str:
+    if type(head) is not str or not _SHA40.fullmatch(head):
+        _reject("invalid delivery head")
+    return head
+
+
+def _validate_pr_number(value: Any) -> int:
+    if type(value) is not int or isinstance(value, bool) or value < 1:
+        _reject("invalid pull request number")
+    return value
+
+
+def _validate_readback(value: Any, number: int, head: str) -> dict[str, Any]:
+    if type(value) is not dict:
+        _reject("invalid pull request readback")
+    if value.get("number") != number or type(value.get("number")) is not int:
+        _reject("pull request number mismatch")
+    if value.get("head") != head or type(value.get("head")) is not str:
+        _reject("pull request head mismatch")
+    if value.get("state") != "open":
+        _reject("pull request state mismatch")
+    # Bound the returned artifact even when the trusted adapter exposes richer data.
+    return {"number": number, "head": head, "state": "open"}
+
+
+def deliver_implementation(adapter: Any, *, head: str, declaration: Any) -> dict[str, Any]:
+    """Push an implementation and create/reuse a PR only after fresh gates."""
+    _validate_head(head)
+    _validate_adapter(adapter)
+
+    # The canonical helper performs the explicit declaration/adoption check
+    # immediately before the first external write.
+    _delivery_adoption.deliver(lambda: adapter.push(head), head=head, declaration=declaration)
+
+    remote_head = adapter.read_remote_head()
+    if remote_head != head or type(remote_head) is not str or not _SHA40.fullmatch(remote_head):
+        _reject("remote head mismatch")
+
+    # Re-check fresh evidence immediately before the PR write.
+    pr_number = _delivery_adoption.deliver(
+        lambda: adapter.create_or_reuse_pr(head), head=head, declaration=declaration
+    )
+    pr_number = _validate_pr_number(pr_number)
+
+    readback = adapter.read_pr(pr_number)
+    bounded_pr = _validate_readback(readback, pr_number, head)
+    return {"remote_head": remote_head, "pr": bounded_pr}