Skip to content

Commit 4cb0ec4

Browse files
mdhellermdheller
committed
merge: resolve conflicts keeping all content from both sides
2 parents 7d032f1 + 7bc1bb6 commit 4cb0ec4

13 files changed

Lines changed: 467 additions & 12 deletions

‎Makefile‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
.PHONY: validate validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-superconscious-runtime-plan validate-package validate-cli validate-formula doctor probe
2+
.PHONY: validate validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula doctor probe
3+
.PHONY: validate validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-activation validate-supply-chain validate-release-bundle validate-package validate-cli validate-formula doctor probe
4+
.PHONY: validate validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-agent-registry validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula doctor probe
5+
.PHONY: validate validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula doctor probe
26
.PHONY: validate validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-agent-registry validate-superconscious-runtime-plan validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula validate-runtime-install-receipts doctor probe
37

48
PYTHON ?= python3
@@ -24,6 +28,10 @@ PYCLI := PYTHONPATH=src $(PYTHON) -m agent_machine.cli
2428
PYMOD := PYTHONPATH=src $(PYTHON) -m
2529

2630
validate: validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-superconscious-runtime-plan validate-package validate-cli validate-formula
31+
validate: validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula
32+
validate: validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-activation validate-supply-chain validate-release-bundle validate-package validate-cli validate-formula
33+
validate: validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-agent-registry validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula
34+
validate: validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula
2735
validate: validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-agent-registry validate-superconscious-runtime-plan validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula validate-runtime-install-receipts
2836

2937
validate-json:
@@ -64,19 +72,21 @@ validate-policy-fabric:
6472
validate-agent-registry:
6573
$(PYTHON) scripts/validate-agent-registry.py
6674
$(PYTHON) scripts/resolve-agent-registry-grant.py $(LOCAL_AGENTPOD) --grant-dir $(GRANT_DIR) --grant-id urn:srcos:agent-machine:agent-registry-grant:active-loopback-activation --requested-agent-identity-ref urn:srcos:agent:local-inference-provider --session-ref urn:srcos:session:local-bootstrap --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --pretty >/tmp/agent-machine-registry-resolve-active.json
75+
$(PYCLI) registry resolve $(LOCAL_AGENTPOD) --grant-dir $(GRANT_DIR) --grant-id urn:srcos:agent-machine:agent-registry-grant:active-render-only --requested-agent-identity-ref urn:srcos:agent:local-inference-provider --session-ref urn:srcos:session:local-bootstrap --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --pretty >/tmp/agent-machine-pycli-registry-resolve-render-only.json
6776
$(PYCLI) registry resolve $(LOCAL_AGENTPOD) --grant-dir $(GRANT_DIR) --grant-id urn:srcos:agent-machine:agent-registry-grant:active-loopback-activation --session-ref urn:srcos:session:local-bootstrap --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --pretty >/tmp/agent-machine-pycli-registry-resolve-active.json
6877

6978
validate-superconscious-runtime-plan:
7079
$(PYTHON) scripts/validate-superconscious-runtime-plan.py
7180

7281
validate-superconscious-runtime-plan:
7382
$(PYTHON) scripts/validate-superconscious-runtime-plan.py
74-
7583
validate-activation:
7684
$(PYTHON) scripts/validate-activation.py
7785
$(PYTHON) scripts/evaluate-activation.py $(LOCAL_AGENTPOD) $(READY_POLICY) $(READY_GRANT) --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --storage-receipt-dir examples --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-evaluate-activation-allowed.json
7886
$(PYCLI) activate evaluate $(LOCAL_AGENTPOD) $(FAIL_POLICY) $(FAIL_GRANT) --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-fail-closed --pretty >/tmp/agent-machine-pycli-evaluate-activation-fail-closed.json
87+
$(BOOTSTRAP_CLI) activate evaluate $(LOCAL_AGENTPOD) $(READY_POLICY) $(READY_GRANT) --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-bootstrap-evaluate-activation-allowed.json
7988
$(PYCLI) activate evaluate $(LOCAL_AGENTPOD) $(READY_GRANT) --policy-dir $(POLICY_DIR) --expected-status allowed --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --provider-id urn:srcos:agent-machine:inference-provider:asahi-llama-cpp --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-pycli-resolved-policy-activation-allowed.json
89+
$(PYCLI) activate evaluate $(LOCAL_AGENTPOD) $(READY_POLICY) --grant-dir $(GRANT_DIR) --grant-id urn:srcos:agent-machine:agent-registry-grant:active-loopback-activation --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --requested-agent-identity-ref urn:srcos:agent:local-inference-provider --session-ref urn:srcos:session:local-bootstrap --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --provider-id urn:srcos:agent-machine:inference-provider:asahi-llama-cpp --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-pycli-resolved-grant-activation-allowed.json
8090
$(PYCLI) activate evaluate $(LOCAL_AGENTPOD) --policy-dir $(POLICY_DIR) --expected-status allowed --grant-dir $(GRANT_DIR) --grant-id urn:srcos:agent-machine:agent-registry-grant:active-loopback-activation --session-ref urn:srcos:session:local-bootstrap --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --provider-id urn:srcos:agent-machine:inference-provider:asahi-llama-cpp --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-pycli-resolved-policy-grant-activation-allowed.json
8191
$(BOOTSTRAP_CLI) activate evaluate $(LOCAL_AGENTPOD) $(READY_POLICY) $(READY_GRANT) --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-bootstrap-evaluate-activation-allowed.json
8292

@@ -93,7 +103,6 @@ validate-sourceos-projections:
93103

94104
validate-superconscious-runtime-plan:
95105
$(PYTHON) scripts/validate-superconscious-runtime-plan.py
96-
97106
validate-package:
98107
$(PYTHON) scripts/validate-package.py
99108

@@ -109,6 +118,7 @@ validate-cli:
109118
$(PYCLI) steer preflight --sourceset gpt2-small.res-jb --pretty >/tmp/agent-machine-pycli-steer-preflight.json
110119
$(BOOTSTRAP_CLI) steer preflight --sourceset gpt2-small.res-jb --pretty >/tmp/agent-machine-bootstrap-steer-preflight.json
111120
$(PYCLI) steer resolve-artifacts --sourceset gpt2-small.res-jb --local-dir /tmp/agent-machine-steering-artifacts --receipt-out /tmp/agent-machine-steering-artifact-receipt.json --dry-run --pretty >/tmp/agent-machine-pycli-artifact-receipt.json
121+
$(PYTHON) scripts/verify-steering-receipt.py examples/steering-artifact-receipts/gpt2-small-res-jb.missing.steering-artifact-receipt.json --expect-status not_configured --pretty >/tmp/agent-machine-steering-load-preflight.json
112122
$(PYTHON) scripts/verify-steering-receipt.py examples/steering-artifact-receipts/gpt2-small-res-jb.missing.steering-artifact-receipt.json --expect-status not_configured --pretty >/tmp/agent-machine-steering-verify-preflight.json
113123
$(PYTHON) scripts/load-steering-receipt.py examples/steering-artifact-receipts/synthetic.available.steering-artifact-receipt.json --attempt-load --pretty >/tmp/agent-machine-steering-synthetic-load.json
114124
$(PYTHON) scripts/run-mock-steering.py /tmp/agent-machine-steer-request.json --pretty >/tmp/agent-machine-mock-steering.json
@@ -127,4 +137,5 @@ doctor:
127137
$(BOOTSTRAP_CLI) doctor --format json
128138

129139
probe:
130-
$(BOOTSTRAP_CLI) probe --format json
140+
$(BOOTSTRAP_CLI) probe --format json
141+
$(BOOTSTRAP_CLI) probe --format json

‎bin/agent-machine‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,9 @@ Usage:
6969
agent-machine render quadlet <agentpod.json> [--compare <file>]
7070
agent-machine render k8s <agentpod.json> [--compare <file>]
7171
agent-machine policy resolve <agentpod.json> --policy-dir <dir> --deployment-receipt-id <id> [--expected-status allowed]
72+
agent-machine activate evaluate <agentpod.json> [policy.json] <grant.json> --deployment-receipt-id <id> [--policy-dir <dir>] [--storage-receipt-dir <dir>] [--pretty]
7273
agent-machine registry resolve <agentpod.json> --grant-dir <dir> --requested-agent-identity-ref <ref> --session-ref <ref> [--expected-status active]
74+
agent-machine activate evaluate <agentpod.json> [policy.json] [grant.json] --deployment-receipt-id <id> [--policy-dir <dir>] [--grant-dir <dir>] [--storage-receipt-dir <dir>] [--pretty]
7375
agent-machine activate evaluate <agentpod.json> [policy.json] <grant.json> --deployment-receipt-id <id> [--policy-dir <dir>] [--storage-receipt-dir <dir>] [--pretty]
7476
agent-machine steer stub-response <request.json> [--status not_configured|noop] [--pretty]
7577
agent-machine steer serve-stub [--host 127.0.0.1] [--port 8080] [--status not_configured|noop]
@@ -295,6 +297,7 @@ case "$COMMAND" in
295297
;;
296298
registry)
297299
shift || true
300+
delegate_python_cli registry "$@"
298301
if [ "${1:-}" = "resolve" ]; then
299302
shift || true
300303
delegate_registry_resolver "$@"

‎contracts/external-trust-signal-provider.schema.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,14 @@
55
"description": "Secret-free adapter request/response contract for optional non-authoritative external identity, reputation, certificate-tier, counterparty, and registry lookup signals used as Agent Registry verifier inputs.",
66
"type": "object",
77
"additionalProperties": false,
8+
"required": ["specVersion", "id", "kind", "request", "response", "receiptSafety", "observedAt"],
9+
"$defs": {
10+
"signalType": {
11+
"type": "string",
12+
"enum": ["agent-identity", "cert-tier", "reputation-score", "counterparty-check", "registry-lookup", "other"]
13+
},
14+
"sha256Digest": {
15+
"type": ["string", "null"],
816
"required": [
917
"specVersion",
1018
"id",
@@ -36,6 +44,11 @@
3644
"freshness": {
3745
"type": "object",
3846
"additionalProperties": false,
47+
"required": ["maxAgeSeconds", "observedAgeSeconds", "fresh"],
48+
"properties": {
49+
"maxAgeSeconds": { "type": "integer", "minimum": 0 },
50+
"observedAgeSeconds": { "type": "integer", "minimum": 0 },
51+
"fresh": { "type": "boolean" }
3952
"required": [
4053
"maxAgeSeconds",
4154
"observedAgeSeconds",
@@ -58,6 +71,12 @@
5871
"signature": {
5972
"type": "object",
6073
"additionalProperties": false,
74+
"required": ["required", "observed", "signatureRef", "signerRef"],
75+
"properties": {
76+
"required": { "type": "boolean" },
77+
"observed": { "type": "boolean" },
78+
"signatureRef": { "type": ["string", "null"] },
79+
"signerRef": { "type": ["string", "null"] }
6180
"required": [
6281
"required",
6382
"observed",
@@ -88,6 +107,18 @@
88107
"externalTrustSignal": {
89108
"type": "object",
90109
"additionalProperties": false,
110+
"required": ["providerRef", "signalType", "signalRef", "signalDigest", "verifiedAt", "freshness", "signature", "authority", "failureReason"],
111+
"properties": {
112+
"providerRef": { "type": "string" },
113+
"signalType": { "$ref": "#/$defs/signalType" },
114+
"signalRef": { "type": "string" },
115+
"signalDigest": { "$ref": "#/$defs/sha256Digest" },
116+
"verifiedAt": { "type": "string" },
117+
"freshness": { "$ref": "#/$defs/freshness" },
118+
"signature": { "$ref": "#/$defs/signature" },
119+
"authority": { "type": "string", "const": "non-authoritative-verifier-input" },
120+
"failureReason": { "type": ["string", "null"] },
121+
"notes": { "type": "array", "items": { "type": "string" } }
91122
"required": [
92123
"providerRef",
93124
"signalType",
@@ -141,6 +172,7 @@
141172
}
142173
},
143174
"properties": {
175+
"specVersion": { "type": "string", "const": "0.1.0" },
144176
"specVersion": {
145177
"type": "string",
146178
"const": "0.1.0"
@@ -149,6 +181,14 @@
149181
"type": "string",
150182
"pattern": "^urn:srcos:agent-machine:external-trust-signal-provider:[a-z0-9][a-z0-9-]*$"
151183
},
184+
"kind": { "type": "string", "const": "ExternalTrustSignalProvider" },
185+
"request": {
186+
"type": "object",
187+
"additionalProperties": false,
188+
"required": ["requestId", "providerRef", "agentPodId", "requestedAgentIdentityRef", "sessionRef", "workroomRef", "topicRef", "requestedSignalTypes", "verificationFreshnessSeconds", "requestedExpiresAt", "signatureRequired"],
189+
"properties": {
190+
"requestId": { "type": "string" },
191+
"providerRef": { "type": "string" },
152192
"kind": {
153193
"type": "string",
154194
"const": "ExternalTrustSignalProvider"
@@ -180,6 +220,19 @@
180220
"type": "string",
181221
"pattern": "^urn:srcos:agent-machine:agent-pod:[a-z0-9][a-z0-9-]*$"
182222
},
223+
"requestedAgentIdentityRef": { "type": "string" },
224+
"sessionRef": { "type": "string" },
225+
"workroomRef": { "type": ["string", "null"] },
226+
"topicRef": { "type": ["string", "null"] },
227+
"requestedSignalTypes": {
228+
"type": "array",
229+
"items": { "$ref": "#/$defs/signalType" },
230+
"minItems": 1,
231+
"uniqueItems": true
232+
},
233+
"verificationFreshnessSeconds": { "type": "integer", "minimum": 0 },
234+
"requestedExpiresAt": { "type": ["string", "null"] },
235+
"signatureRequired": { "type": "boolean" }
183236
"requestedAgentIdentityRef": {
184237
"type": "string"
185238
},
@@ -224,6 +277,22 @@
224277
"response": {
225278
"type": "object",
226279
"additionalProperties": false,
280+
"required": ["status", "usableForGrantResolution", "providerRef", "authority", "verifiedAt", "freshness", "signals", "failureReason"],
281+
"properties": {
282+
"status": {
283+
"type": "string",
284+
"enum": ["available", "unavailable", "stale", "malformed", "unsigned", "denied", "error"]
285+
},
286+
"usableForGrantResolution": { "type": "boolean" },
287+
"providerRef": { "type": "string" },
288+
"authority": { "type": "string", "const": "non-authoritative-verifier-input" },
289+
"verifiedAt": { "type": ["string", "null"] },
290+
"freshness": { "$ref": "#/$defs/freshness" },
291+
"signals": {
292+
"type": "array",
293+
"items": { "$ref": "#/$defs/externalTrustSignal" }
294+
},
295+
"failureReason": { "type": ["string", "null"] }
227296
"required": [
228297
"status",
229298
"usableForGrantResolution",
@@ -283,6 +352,21 @@
283352
"receiptSafety": {
284353
"type": "object",
285354
"additionalProperties": false,
355+
"required": ["includeRawContent", "rawPromptContentIncluded", "rawKvCacheContentIncluded", "secretValuesIncluded", "privateMemoryIncluded", "apiKeysIncluded", "walletPrivateKeysIncluded", "rawCredentialsIncluded", "rawUserDataIncluded"],
356+
"properties": {
357+
"includeRawContent": { "type": "boolean", "const": false },
358+
"rawPromptContentIncluded": { "type": "boolean", "const": false },
359+
"rawKvCacheContentIncluded": { "type": "boolean", "const": false },
360+
"secretValuesIncluded": { "type": "boolean", "const": false },
361+
"privateMemoryIncluded": { "type": "boolean", "const": false },
362+
"apiKeysIncluded": { "type": "boolean", "const": false },
363+
"walletPrivateKeysIncluded": { "type": "boolean", "const": false },
364+
"rawCredentialsIncluded": { "type": "boolean", "const": false },
365+
"rawUserDataIncluded": { "type": "boolean", "const": false }
366+
}
367+
},
368+
"observedAt": { "type": "string" },
369+
"labels": { "type": "object", "additionalProperties": { "type": "string" } }
286370
"required": [
287371
"includeRawContent",
288372
"rawPromptContentIncluded",

‎docs/index.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ Agent Machine is a bootstrap runtime-control substrate for SourceOS agent worklo
3232
| [AgentRegistryGrant resolution](architecture/agent-registry-grant-resolution.md) | Local Agent Registry grant resolver and fail-closed missing-grant behavior. |
3333
| [Image digest pinning and provenance](architecture/image-digest-pinning-and-provenance.md) | Supply-chain strict-mode gate for digest-pinned release-candidate artifacts. |
3434
| [Release evidence bundle](architecture/release-evidence-bundle.md) | Deterministic validation/source/inventory/render/supply-chain/readiness bundle. |
35+
| [Signed release bundle envelope](architecture/signed-release-bundle-envelope.md) | Signing envelope contract for release evidence bundles. |
3536
| [Signed release bundle envelope](architecture/signed-release-bundle-envelope.md) | Signing/verification envelope around a release evidence bundle. |
3637
| [Runtime package layout](architecture/runtime-package-layout.md) | Migration from loose scripts to `src/agent_machine/` package modules. |
3738
| [Homebrew Python dependencies](architecture/homebrew-python-dependencies.md) | Current dependency strategy for render/evaluation commands. |
@@ -133,4 +134,6 @@ Current blockers:
133134
- TopoLVM runtime integration beyond skeleton manifests;
134135
- provider discovery and controlled provider activation implementation;
135136
- M2 Asahi host measurement/provider readiness data;
136-
- rollback, teardown, and wipe workflows.
137+
- signed release evidence bundle;
138+
- rollback, teardown, and wipe workflows.
139+
- rollback, teardown, and wipe workflows.

0 commit comments

Comments
 (0)