Skip to content

Commit 4fd0dcd

Browse files
mdhellermdheller
committed
merge: resolve conflicts keeping all content from both sides
2 parents c1852a2 + 26901aa commit 4fd0dcd

53 files changed

Lines changed: 4357 additions & 23 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/contract-schemas.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: contract-schemas
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
paths:
7+
- "contracts/**/*.schema.json"
8+
- "fixtures/**/*.json"
9+
- "tools/validate_contract_schemas.py"
10+
- ".github/workflows/contract-schemas.yml"
11+
push:
12+
branches: [main]
13+
paths:
14+
- "contracts/**/*.schema.json"
15+
- "fixtures/**/*.json"
16+
- "tools/validate_contract_schemas.py"
17+
- ".github/workflows/contract-schemas.yml"
18+
19+
jobs:
20+
validate:
21+
runs-on: ubuntu-latest
22+
steps:
23+
- uses: actions/checkout@v4
24+
- uses: actions/setup-python@v5
25+
with:
26+
python-version: "3.11"
27+
- name: Validate contract schemas
28+
run: python3 tools/validate_contract_schemas.py

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,6 @@
11
__pycache__/
22
*.py[cod]
3+
*.egg-info/
4+
dist/
5+
build/
6+
.eggs/

‎.sourceos/manifest.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"repo": "SourceOS-Linux/agent-machine",
3+
"domain": "agent",
4+
"specVersion": "0.1.0",
5+
"ownedSchemas": [
6+
"AgentRuntimeProfile",
7+
"AgentExecutionPlan",
8+
"AgentRuntimeEvidence"
9+
],
10+
"syncEngines": [],
11+
"sourceChannels": [
12+
"agent.execute.tool",
13+
"agent.access.memory",
14+
"agent.access.shell",
15+
"agent.model.route",
16+
"agent.mcp.invoke"
17+
],
18+
"policyClasses": [
19+
"critical"
20+
],
21+
"auditEvents": [
22+
"agent.execution.started",
23+
"agent.execution.denied",
24+
"agent.execution.completed",
25+
"agent.lease.expired",
26+
"agent.lease.revoked",
27+
"agent.policy.mismatch"
28+
],
29+
"dangerousSurfaces": [
30+
"agent.execute.tool",
31+
"agent.access.memory",
32+
"agent.access.shell",
33+
"agent.access.network",
34+
"agent.model.route",
35+
"agent.mcp.invoke",
36+
"agent.secret_ref.use"
37+
],
38+
"authorityRepos": [
39+
"SourceOS-Linux/sourceos-spec",
40+
"SocioProphet/agent-registry",
41+
"SocioProphet/policy-fabric",
42+
"SocioProphet/guardrail-fabric",
43+
"SocioProphet/memory-mesh"
44+
],
45+
"notes": "Local agent runtime. High-risk execution requires scoped capability leases and policy decisions before tool, memory, shell, network, MCP, model, or secret-reference access."
46+
}

‎Makefile‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
.PHONY: validate validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula doctor probe
1+
.PHONY: validate validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-agent-registry validate-superconscious-runtime-plan validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula validate-runtime-install-receipts doctor probe
22

33
PYTHON ?= python3
44
RUBY ?= ruby
@@ -16,12 +16,13 @@ FAIL_POLICY := examples/policy-admission.missing.json
1616
FAIL_GRANT := examples/agent-registry-grant.missing.json
1717
RECEIPT_DIR := examples
1818
POLICY_DIR := examples
19+
GRANT_DIR := examples
1920
DEPLOYMENT_RECEIPT_ID := urn:srcos:agent-machine:deployment-receipt:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
2021
DECIDED_AT := 2026-05-04T12:51:00Z
2122
PYCLI := PYTHONPATH=src $(PYTHON) -m agent_machine.cli
2223
PYMOD := PYTHONPATH=src $(PYTHON) -m
2324

24-
validate: validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula
25+
validate: validate-json validate-yaml validate-quadlet validate-render validate-evidence validate-governance validate-policy-fabric validate-agent-registry validate-superconscious-runtime-plan validate-activation validate-supply-chain validate-release-bundle validate-sourceos-projections validate-package validate-cli validate-formula validate-runtime-install-receipts
2526

2627
validate-json:
2728
$(PYTHON) scripts/validate-json.py
@@ -58,11 +59,23 @@ validate-policy-fabric:
5859
$(PYTHON) scripts/resolve-policy-admission.py $(LOCAL_AGENTPOD) --policy-dir $(POLICY_DIR) --expected-status allowed --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --provider-id urn:srcos:agent-machine:inference-provider:asahi-llama-cpp --pretty >/tmp/agent-machine-policy-resolve-allowed.json
5960
$(PYCLI) policy resolve $(LOCAL_AGENTPOD) --policy-dir $(POLICY_DIR) --expected-status denied --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --provider-id urn:srcos:agent-machine:inference-provider:asahi-llama-cpp --pretty >/tmp/agent-machine-pycli-policy-resolve-denied.json
6061

62+
validate-agent-registry:
63+
$(PYTHON) scripts/validate-agent-registry.py
64+
$(PYTHON) scripts/resolve-agent-registry-grant.py $(LOCAL_AGENTPOD) --grant-dir $(GRANT_DIR) --grant-id urn:srcos:agent-machine:agent-registry-grant:active-loopback-activation --requested-agent-identity-ref urn:srcos:agent:local-inference-provider --session-ref urn:srcos:session:local-bootstrap --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --pretty >/tmp/agent-machine-registry-resolve-active.json
65+
$(PYCLI) registry resolve $(LOCAL_AGENTPOD) --grant-dir $(GRANT_DIR) --grant-id urn:srcos:agent-machine:agent-registry-grant:active-loopback-activation --session-ref urn:srcos:session:local-bootstrap --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --pretty >/tmp/agent-machine-pycli-registry-resolve-active.json
66+
67+
validate-superconscious-runtime-plan:
68+
$(PYTHON) scripts/validate-superconscious-runtime-plan.py
69+
70+
validate-superconscious-runtime-plan:
71+
$(PYTHON) scripts/validate-superconscious-runtime-plan.py
72+
6173
validate-activation:
6274
$(PYTHON) scripts/validate-activation.py
6375
$(PYTHON) scripts/evaluate-activation.py $(LOCAL_AGENTPOD) $(READY_POLICY) $(READY_GRANT) --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --storage-receipt-dir examples --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-evaluate-activation-allowed.json
6476
$(PYCLI) activate evaluate $(LOCAL_AGENTPOD) $(FAIL_POLICY) $(FAIL_GRANT) --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-fail-closed --pretty >/tmp/agent-machine-pycli-evaluate-activation-fail-closed.json
6577
$(PYCLI) activate evaluate $(LOCAL_AGENTPOD) $(READY_GRANT) --policy-dir $(POLICY_DIR) --expected-status allowed --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --provider-id urn:srcos:agent-machine:inference-provider:asahi-llama-cpp --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-pycli-resolved-policy-activation-allowed.json
78+
$(PYCLI) activate evaluate $(LOCAL_AGENTPOD) --policy-dir $(POLICY_DIR) --expected-status allowed --grant-dir $(GRANT_DIR) --grant-id urn:srcos:agent-machine:agent-registry-grant:active-loopback-activation --session-ref urn:srcos:session:local-bootstrap --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --agent-machine-id urn:srcos:agent-machine:m2-asahi-local --provider-id urn:srcos:agent-machine:inference-provider:asahi-llama-cpp --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-pycli-resolved-policy-grant-activation-allowed.json
6679
$(BOOTSTRAP_CLI) activate evaluate $(LOCAL_AGENTPOD) $(READY_POLICY) $(READY_GRANT) --deployment-receipt-id $(DEPLOYMENT_RECEIPT_ID) --storage-receipt-dir $(RECEIPT_DIR) --decided-at $(DECIDED_AT) --decision-id urn:srcos:agent-machine:activation-decision:local-llama-cpp-allowed --pretty >/tmp/agent-machine-bootstrap-evaluate-activation-allowed.json
6780

6881
validate-supply-chain:
@@ -102,8 +115,11 @@ validate-cli:
102115
validate-formula:
103116
$(RUBY) -c $(FORMULA)
104117

118+
validate-runtime-install-receipts:
119+
$(PYTHON) scripts/validate-runtime-install-receipts.py
120+
105121
doctor:
106122
$(BOOTSTRAP_CLI) doctor --format json
107123

108124
probe:
109-
$(BOOTSTRAP_CLI) probe --format json
125+
$(BOOTSTRAP_CLI) probe --format json

‎bin/agent-machine‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,16 @@ delegate_python_cli() {
4444
return 127
4545
}
4646

47+
delegate_registry_resolver() {
48+
ROOT="$(repo_root_guess || true)"
49+
if [ -n "${ROOT:-}" ] && [ -d "$ROOT/src/agent_machine" ]; then
50+
PYTHONPATH="$ROOT/src${PYTHONPATH:+:$PYTHONPATH}" python3 -m agent_machine.agent_registry "$@"
51+
return $?
52+
fi
53+
printf '%s\n' "agent-machine: Agent Registry resolver unavailable; repository package sources not found." >&2
54+
return 127
55+
}
56+
4757
print_help() {
4858
cat <<'EOF'
4959
agent-machine: SourceOS Agent Machine local node substrate CLI
@@ -59,6 +69,7 @@ Usage:
5969
agent-machine render quadlet <agentpod.json> [--compare <file>]
6070
agent-machine render k8s <agentpod.json> [--compare <file>]
6171
agent-machine policy resolve <agentpod.json> --policy-dir <dir> --deployment-receipt-id <id> [--expected-status allowed]
72+
agent-machine registry resolve <agentpod.json> --grant-dir <dir> --requested-agent-identity-ref <ref> --session-ref <ref> [--expected-status active]
6273
agent-machine activate evaluate <agentpod.json> [policy.json] <grant.json> --deployment-receipt-id <id> [--policy-dir <dir>] [--storage-receipt-dir <dir>] [--pretty]
6374
agent-machine steer stub-response <request.json> [--status not_configured|noop] [--pretty]
6475
agent-machine steer serve-stub [--host 127.0.0.1] [--port 8080] [--status not_configured|noop]
@@ -282,6 +293,16 @@ case "$COMMAND" in
282293
shift || true
283294
delegate_python_cli policy "$@"
284295
;;
296+
registry)
297+
shift || true
298+
if [ "${1:-}" = "resolve" ]; then
299+
shift || true
300+
delegate_registry_resolver "$@"
301+
else
302+
printf '%s\n' "agent-machine: unsupported registry subcommand: ${1:-<missing>}" >&2
303+
exit 2
304+
fi
305+
;;
285306
activate)
286307
shift || true
287308
delegate_python_cli activate "$@"

‎contracts/a2a-state-machine.schema.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "urn:srcos:agent-machine:schema:a2a-state-machine:v0.1.0",
4+
"title": "A2AStateMachine",
5+
"description": "Secret-free Agent-to-Agent control-plane lifecycle contract for attested capability negotiation, scoped MCP binding, execution, revocation, and settlement.",
6+
"type": "object",
7+
"additionalProperties": false,
8+
"required": ["specVersion", "id", "kind", "participants", "planes", "phases", "revocation", "receiptSafety", "issuedAt"],
9+
"properties": {
10+
"specVersion": {"type": "string", "const": "0.1.0"},
11+
"id": {"type": "string", "pattern": "^urn:srcos:agent-machine:a2a-state-machine:[a-z0-9][a-z0-9-]*$"},
12+
"kind": {"type": "string", "const": "A2AStateMachine"},
13+
"participants": {
14+
"type": "object",
15+
"additionalProperties": false,
16+
"required": ["initiatorAgentRef", "responderAgentRef", "hostRefs"],
17+
"properties": {
18+
"initiatorAgentRef": {"type": "string"},
19+
"responderAgentRef": {"type": "string"},
20+
"hostRefs": {"type": "array", "minItems": 1, "items": {"type": "string"}, "uniqueItems": true}
21+
}
22+
},
23+
"planes": {
24+
"type": "object",
25+
"additionalProperties": false,
26+
"required": ["controlPlane", "toolPlane", "controlToolSeparationRequired"],
27+
"properties": {
28+
"controlPlane": {"type": "string", "const": "a2a"},
29+
"toolPlane": {"type": "string", "const": "mcp"},
30+
"controlToolSeparationRequired": {"type": "boolean", "const": true}
31+
}
32+
},
33+
"phases": {
34+
"type": "array",
35+
"minItems": 9,
36+
"maxItems": 9,
37+
"prefixItems": [
38+
{"const": "HELLO"},
39+
{"const": "ATTEST"},
40+
{"const": "DISCOVER"},
41+
{"const": "NEGOTIATE"},
42+
{"const": "UX_CONTRACT"},
43+
{"const": "GRANT"},
44+
{"const": "BIND"},
45+
{"const": "EXECUTE"},
46+
{"const": "AUDIT_SETTLE"}
47+
],
48+
"items": false
49+
},
50+
"revocation": {
51+
"type": "object",
52+
"additionalProperties": false,
53+
"required": ["revocationRequired", "revocationBeatsKill", "propagationTargetSeconds", "revocationEventRef"],
54+
"properties": {
55+
"revocationRequired": {"type": "boolean", "const": true},
56+
"revocationBeatsKill": {"type": "boolean", "const": true},
57+
"propagationTargetSeconds": {"type": "integer", "minimum": 0},
58+
"revocationEventRef": {"type": ["string", "null"]}
59+
}
60+
},
61+
"receiptSafety": {"$ref": "#/$defs/receiptSafety"},
62+
"issuedAt": {"type": "string"},
63+
"labels": {"type": "object", "additionalProperties": {"type": "string"}}
64+
},
65+
"$defs": {
66+
"receiptSafety": {
67+
"type": "object",
68+
"additionalProperties": false,
69+
"required": ["includeRawContent", "secretValuesIncluded", "privateMemoryIncluded"],
70+
"properties": {
71+
"includeRawContent": {"type": "boolean", "const": false},
72+
"secretValuesIncluded": {"type": "boolean", "const": false},
73+
"privateMemoryIncluded": {"type": "boolean", "const": false}
74+
}
75+
}
76+
}
77+
}

‎contracts/artifact-boundary.schema.json‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "urn:srcos:agent-machine:schema:artifact-boundary:v0.1.0",
4+
"title": "ArtifactBoundary",
5+
"description": "Secret-free export boundary contract for default-deny artifact packaging, path bucket classification, symlink safety, manifesting, and audit ledger emission.",
6+
"type": "object",
7+
"additionalProperties": false,
8+
"required": ["specVersion", "id", "kind", "exportPolicy", "pathBuckets", "symlinkPolicy", "enumerationPolicy", "manifestPolicy", "auditLedger", "receiptSafety", "issuedAt"],
9+
"properties": {
10+
"specVersion": {"type": "string", "const": "0.1.0"},
11+
"id": {"type": "string", "pattern": "^urn:srcos:agent-machine:artifact-boundary:[a-z0-9][a-z0-9-]*$"},
12+
"kind": {"type": "string", "const": "ArtifactBoundary"},
13+
"exportPolicy": {
14+
"type": "object",
15+
"additionalProperties": false,
16+
"required": ["defaultDecision", "exceptionsRequireJustification", "copyToArtifactRequired"],
17+
"properties": {
18+
"defaultDecision": {"type": "string", "const": "deny"},
19+
"exceptionsRequireJustification": {"type": "boolean", "const": true},
20+
"copyToArtifactRequired": {"type": "boolean", "const": true}
21+
}
22+
},
23+
"pathBuckets": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/pathBucket"}},
24+
"symlinkPolicy": {
25+
"type": "object",
26+
"additionalProperties": false,
27+
"required": ["resolveRealPaths", "denyEscapes", "overrideAllowed"],
28+
"properties": {
29+
"resolveRealPaths": {"type": "boolean", "const": true},
30+
"denyEscapes": {"type": "boolean", "const": true},
31+
"overrideAllowed": {"type": "boolean"}
32+
}
33+
},
34+
"enumerationPolicy": {
35+
"type": "object",
36+
"additionalProperties": false,
37+
"required": ["depthCapRequired", "defaultMaxDepth", "recursiveExportDenied"],
38+
"properties": {
39+
"depthCapRequired": {"type": "boolean", "const": true},
40+
"defaultMaxDepth": {"type": "integer", "minimum": 0},
41+
"recursiveExportDenied": {"type": "boolean", "const": true}
42+
}
43+
},
44+
"manifestPolicy": {
45+
"type": "object",
46+
"additionalProperties": false,
47+
"required": ["manifestRequired", "includeAllowedPaths", "includeBlockedPaths", "includePolicyDigest"],
48+
"properties": {
49+
"manifestRequired": {"type": "boolean", "const": true},
50+
"includeAllowedPaths": {"type": "boolean", "const": true},
51+
"includeBlockedPaths": {"type": "boolean", "const": true},
52+
"includePolicyDigest": {"type": "boolean", "const": true}
53+
}
54+
},
55+
"auditLedger": {
56+
"type": "object",
57+
"additionalProperties": false,
58+
"required": ["ledgerRequired", "hashAlgorithm", "recordCommand"],
59+
"properties": {
60+
"ledgerRequired": {"type": "boolean", "const": true},
61+
"hashAlgorithm": {"type": "string", "const": "sha256"},
62+
"recordCommand": {"type": "boolean", "const": true}
63+
}
64+
},
65+
"receiptSafety": {"$ref": "#/$defs/receiptSafety"},
66+
"issuedAt": {"type": "string"},
67+
"labels": {"type": "object", "additionalProperties": {"type": "string"}}
68+
},
69+
"$defs": {
70+
"pathBucket": {
71+
"type": "object",
72+
"additionalProperties": false,
73+
"required": ["name", "defaultExportable", "pathPrefixes"],
74+
"properties": {
75+
"name": {"type": "string", "enum": ["artifact", "runtime-home", "platform-scaffolding", "kernel-pseudo-fs", "operator-allowlist"]},
76+
"defaultExportable": {"type": "boolean"},
77+
"pathPrefixes": {"type": "array", "items": {"type": "string"}, "uniqueItems": true}
78+
}
79+
},
80+
"receiptSafety": {
81+
"type": "object",
82+
"additionalProperties": false,
83+
"required": ["includeRawContent", "secretValuesIncluded", "privateMemoryIncluded"],
84+
"properties": {
85+
"includeRawContent": {"type": "boolean", "const": false},
86+
"secretValuesIncluded": {"type": "boolean", "const": false},
87+
"privateMemoryIncluded": {"type": "boolean", "const": false}
88+
}
89+
}
90+
}
91+
}

0 commit comments

Comments
 (0)