atlas-iac/services/hermes/scripts/bootstrap_soteria_publication_retry.py

#!/usr/bin/env python3
"""One-time, fail-closed recovery of Soteria #3's retained publication evidence."""

from __future__ import annotations

import argparse
import hashlib
import json
import os
import sqlite3
import stat
from pathlib import Path
from typing import Any

import supervisor_state
from execution_pool_protocol import derive_ordinal_key, payload_digest, read_key, sign_envelope


BOARD = "soteria"
CHILD = "t_4095fe0d"
ROOT = "t_c7c42600"
RUN_ID = "8"
ORDINAL = 0
HEAD = "f21833e78768e7e4045a6304e311989196846ae4"
REQUIRED_RECEIPT = {
    "source", "baseline_sha", "head", "title", "body", "structured", "result_digest"
}


def _value(task: Any, name: str) -> Any:
    return task.get(name) if isinstance(task, dict) else getattr(task, name, None)


def _receipt(path: Path) -> dict[str, Any]:
    """Read the mediator-produced receipt without following an operator symlink."""
    descriptor = os.open(path, os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0))
    try:
        info = os.fstat(descriptor)
        if not stat.S_ISREG(info.st_mode) or info.st_size > 48 * 1024:
            raise ValueError("bootstrap receipt file is invalid")
        raw = os.read(descriptor, 48 * 1024 + 1)
    finally:
        os.close(descriptor)
    try:
        value = json.loads(raw)
    except (UnicodeDecodeError, json.JSONDecodeError) as error:
        raise ValueError("bootstrap receipt is malformed") from error
    if not isinstance(value, dict) or set(value) != REQUIRED_RECEIPT:
        raise ValueError("bootstrap receipt shape is invalid")
    return value


def _pool_record(database: Path) -> tuple[dict[str, Any], str, int]:
    """Read exactly run 8's finalized terminal evidence without writing pool state."""
    source = sqlite3.connect(f"file:{database}?mode=ro", uri=True)
    try:
        row = source.execute(
            "SELECT payload_json,result_json,result_digest,state,worker_ordinal,attempt FROM assignments "
            "WHERE board=? AND task_id=? AND run_id=?", (BOARD, CHILD, RUN_ID)
        ).fetchone()
    finally:
        source.close()
    if row is None or row[3] != "finalized" or row[4] != ORDINAL or not isinstance(row[5], int) or row[5] < 1:
        raise ValueError("bootstrap source assignment is not the retained terminal run")
    try:
        assignment, result = json.loads(row[0]), json.loads(row[1])
    except (TypeError, json.JSONDecodeError) as error:
        raise ValueError("bootstrap terminal evidence is malformed") from error
    structured = result.get("structured") if isinstance(result, dict) else None
    if (
        not isinstance(assignment, dict) or assignment.get("root_task_id") != ROOT
        or assignment.get("continuation_kind") != "repair"
        or not isinstance(structured, dict) or structured.get("status") != "blocked"
        or result.get("returncode") != 0 or not isinstance(result.get("capacity_failure"), bool)
        or result.get("scm_submission") is not None
        or payload_digest(result) != row[2]
    ):
        raise ValueError("bootstrap terminal evidence is not a clean publication refusal")
    with sqlite3.connect(f"file:{database}?mode=ro", uri=True) as source:
        later = source.execute(
            "SELECT 1 FROM assignments WHERE board=? AND task_id=? AND run_id<>? "
            "AND state IN ('assigned','running','result')", (BOARD, CHILD, RUN_ID)
        ).fetchone()
    if later is not None:
        raise ValueError("bootstrap has a newer live pool assignment")
    return assignment, hashlib.sha256(row[1].encode()).hexdigest(), row[5]


def _native_guard() -> supervisor_state.Lineage:
    """Require the still-blocked exact native run and the private root/child chain."""
    from hermes_cli import kanban_db

    child = supervisor_state.get_child(BOARD, CHILD)
    if child is None or child["root_task_id"] != ROOT or child["kind"] != "repair":
        raise ValueError("bootstrap continuation lineage is unavailable")
    with kanban_db.scoped_current_board(BOARD):
        connection = kanban_db.connect(board=BOARD)
        try:
            task = kanban_db.get_task(connection, CHILD)
            parents = kanban_db.parent_ids(connection, CHILD)
            latest = connection.execute(
                "SELECT id,status,outcome FROM task_runs WHERE task_id=? ORDER BY id DESC LIMIT 1", (CHILD,)
            ).fetchone()
        finally:
            connection.close()
    if (
        task is None or _value(task, "status") != "blocked"
        or _value(task, "current_run_id") is not None
        or latest is None or latest[0] != int(RUN_ID)
        # Run 8 predates the terminal-state classifier.  Its retained native
        # record is exactly blocked/blocked; accept only that historical
        # terminal form in addition to the current terminal spellings.
        or latest[1] not in {"blocked", "done", "failed"}
        or (latest[1] == "blocked" and latest[2] != "blocked")
        or not isinstance(parents, (list, tuple, set)) or ROOT not in {str(value) for value in parents}
    ):
        raise ValueError("bootstrap native task is no longer the exact blocked run")
    return child["lineage"]


def bootstrap(receipt_path: Path, pool_database: Path) -> str:
    """Persist one receipt only after the independent native and pool guards agree."""
    receipt = _receipt(receipt_path)
    assignment, raw_sha, attempt = _pool_record(pool_database)
    lineage = _native_guard()
    source = receipt["source"]
    if (
        receipt.get("head") != HEAD or not isinstance(source, dict)
        or source.get("attempt") != attempt
        or any(source.get(name) != value for name, value in {
            "board": BOARD, "task_id": CHILD, "run_id": RUN_ID, "worker_ordinal": ORDINAL,
            "root_task_id": ROOT, "repo_url": f"https://scm.bstein.dev/titan/{lineage.project}.git",
            "branch": lineage.branch, "base_branch": lineage.base_branch,
        }.items())
    ):
        raise ValueError("bootstrap mediator receipt does not match retained authority")
    binding = {name: source[name] for name in ("board", "task_id", "run_id", "worker_ordinal", "attempt")}
    supervisor_state.record_publication_retry(BOARD, CHILD, binding, receipt)
    supervisor_state.record_publication_retry_provenance(BOARD, CHILD, raw_sha)
    return raw_sha


def signed_assignment(pool_database: Path, key_file: Path) -> bytes:
    """Attest the verified retained assignment with the current coordinator key."""
    assignment, _raw_sha, attempt = _pool_record(pool_database)
    _native_guard()
    key = derive_ordinal_key(read_key(key_file), ORDINAL)
    return json.dumps(sign_envelope(key, "assignment", {
        "board": BOARD, "task_id": CHILD, "run_id": RUN_ID,
        "worker_ordinal": ORDINAL, "attempt": attempt,
    }, assignment), separators=(",", ":"), sort_keys=True).encode()


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--receipt-file", type=Path)
    parser.add_argument("--pool-db", type=Path, default=Path(os.environ.get("HERMES_HOME", "/opt/data")) / "execution-pool/assignments.db")
    parser.add_argument("--emit-assignment", action="store_true")
    parser.add_argument("--key-file", type=Path, default=Path(os.environ.get("HERMES_EXECUTION_POOL_KEY_FILE", "/runtime-access/execution-pool-key")))
    args = parser.parse_args()
    if args.emit_assignment == (args.receipt_file is not None):
        raise SystemExit("select exactly one bootstrap action")
    if args.emit_assignment:
        print(signed_assignment(args.pool_db, args.key_file).decode())
        return 0
    bootstrap(args.receipt_file, args.pool_db)
    print(f"bootstrapped {BOARD}/{CHILD} run={RUN_ID} head={HEAD[:12]}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())