refactor: unify impl operation gates and correction verification

2026-10-13 16:35:52 +00:00
parent 4e9c46bba2
commit bd73c97a97
24 changed files with 1992 additions and 682 deletions
@@ -127,3 +127,100 @@ def reconcile_implementation(adapter: Any, *, head: str, number: int,
    if verified is not True:
        _reject("reconciliation intent or protected state mismatch")
    return {"remote_head": remote_head, "pr": bounded_pr}
+
+
+def deliver_approved_implementation(adapter: Any, *, head: str, declaration: Any,
+                                    push_intent: Any, push_approval: Any,
+                                    pr_intent: Any, pr_approval: Any,
+                                    coordinator: Any, on_attempt: Any) -> dict[str, Any]:
+    """Compose two approved operations; callbacks own scope/lease/provider proof.
+
+    Legacy helpers remain stage-only. This path is not a transport sandbox or a
+    durable transaction. on_attempt must archive provenance before external write.
+    """
+    import sys
+    root = str(Path(__file__).resolve().parents[6])
+    if root not in sys.path:
+        sys.path.insert(0, root)
+    from harness.lib.impl_operation import Adapter, Coordinator, validate
+    _validate_head(head)
+    for name in ("read_remote_head", "read_pr"):
+        if not callable(getattr(adapter, name, None)):
+            _reject("trusted operation readback adapter required")
+    if not isinstance(coordinator, Coordinator) or not callable(on_attempt):
+        _reject("caller-owned coordinator and attempt recorder required")
+    for name in ("preflight_operation", "verify_operation", "find_intended_pr", "push_operation", "create_or_reuse_pr_operation"):
+        if not callable(getattr(adapter, name, None)):
+            _reject("trusted operation adapter required")
+    try:
+        validate(push_intent, push_approval)
+        validate(pr_intent, pr_approval)
+    except (ValueError, TypeError):
+        _reject("invalid approved operation")
+    target = (push_intent.target, push_intent.target_id, push_intent.source_sha)
+    if push_intent.operation != "push" or pr_intent.operation != "pr.create":
+        _reject("only push and pr.create intents are supported")
+    if push_intent.source_sha != head or (pr_intent.target, pr_intent.target_id, pr_intent.source_sha) != target:
+        _reject("operation target/source mismatch")
+    if type(push_intent.payload) is not dict or type(pr_intent.payload) is not dict:
+        _reject("explicit operation payloads required")
+    if push_intent.payload.get("head") != head or pr_intent.payload.get("head") != head:
+        _reject("payload head differs from approved source")
+    if type(pr_intent.payload.get("body")) is not str or not pr_intent.payload["body"]:
+        _reject("explicit intended PR body required")
+
+    def stage(intent, approval, mutation, readback, expected):
+        entered = False
+        def preflight(item):
+            _delivery_adoption.require_adoption(declaration,
+                expected_source={"kind": "git_tree", "revision": head},
+                expected_stage="implementation-delivery")
+            return adapter.preflight_operation(item)
+        def mutate(item):
+            nonlocal entered
+            _delivery_adoption.require_adoption(declaration,
+                expected_source={"kind": "git_tree", "revision": head},
+                expected_stage="implementation-delivery")
+            entered = True
+            return mutation(item)
+        def verify(item, before, observed):
+            # A failed local approval gate is not an uncertain remote mutation.
+            return entered and expected(observed) and adapter.verify_operation(item, before, observed) is True
+        return coordinator.execute(intent, approval,
+            Adapter(preflight, True, mutate, readback, verify), on_attempt)
+
+    push = stage(push_intent, push_approval, lambda item: adapter.push_operation(item),
+                 lambda item: adapter.read_remote_head(),
+                 lambda value: type(value) is str and value == head)
+    if push.status != "verified":
+        return {"status": "partial", "push": push, "pr": None, "artifact": None}
+
+    intended_number = None
+    observed_pr = None
+    def create_pr(item):
+        nonlocal intended_number
+        intended_number = _validate_pr_number(adapter.create_or_reuse_pr_operation(item))
+        return {"number": intended_number}
+    def pr_readback(item):
+        nonlocal intended_number, observed_pr
+        if intended_number is None:
+            # The callback must return exactly one intended PR, or reject. GET only.
+            found = adapter.find_intended_pr(item)
+            if type(found) is not dict:
+                _reject("unique intended PR unavailable")
+            intended_number = _validate_pr_number(found.get("number"))
+        observed_pr = adapter.read_pr(intended_number)
+        return observed_pr
+    def pr_ok(value):
+        try:
+            _validate_readback(value, _validate_pr_number(intended_number), head)
+        except AdoptionError:
+            return False
+        return True
+    pr = stage(pr_intent, pr_approval, create_pr, pr_readback, pr_ok)
+    if pr.status != "verified":
+        return {"status": "partial", "push": push, "pr": pr, "artifact": None}
+    # Use the validated readback, not private adapter state or an unverified read.
+    return {"status": "verified", "push": push, "pr": pr,
+            "artifact": {"remote_head": head,
+                         "pr": _validate_readback(observed_pr, _validate_pr_number(intended_number), head)}}