fix(governance): route broker through deployed signer contract compatibility

active-runtime/app/authorized_task_writer_provisioning.py

@@ -23,6 +23,11 @@ from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any, Mapping
+from signer_contract_compatibility import (
+    deployed_signer_help,
+    run_compatible_signer,
+    run_compatible_validator,
+)
 
 
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
@@ -318,6 +323,14 @@ def _verify_tool_contract(
     if config.governed_use_sudo:
         _verify_executable(config.sudo_path, "SUDO")
     help_result = _run(_tool_argv(config, path, "--help"), timeout=15)
+    if name == "SIGNER":
+        sign_help = _run(
+            _tool_argv(config, path, "sign", "--help"),
+            timeout=15,
+        )
+        if deployed_signer_help(sign_help.stdout, sign_help.stderr):
+            _run(_tool_argv(config, path, "self-test"), timeout=30)
+            return
     for flag in ("--grant-dir", "--result-json"):
         if flag not in help_result.stdout and flag not in help_result.stderr:
             raise ProvisioningError(f"{name}_CONTRACT_UNSUPPORTED", 503)
@@ -705,34 +718,36 @@ class AuthorizedTaskWriterProvisioner:
             validator_result_path = temporary_root / "validator-result.json"
             provisioner_result_path = temporary_root / "provisioner-result.json"
 
-            _run(
-                _tool_argv(
-                    self.config,
-                    self.config.signer,
-                    "--grant-dir",
-                    str(grant_dir),
-                    "--result-json",
-                    str(signer_result_path),
-                ),
-                timeout=60,
-            )
+            try:
+                run_compatible_signer(
+                    _tool_argv(self.config, self.config.signer),
+                    grant_dir,
+                    signer_result_path,
+                )
+            except Exception as exc:
+                raise ProvisioningError(
+                    "SIGNER_COMPATIBILITY_FAILED",
+                    503,
+                    details={"error": type(exc).__name__},
+                ) from exc
             signer_result = _read_json(signer_result_path)
             signer = _verify_signer_result(
                 signer_result,
                 approval_plan_id=plan["approval_plan_id"],
             )
 
-            _run(
-                _tool_argv(
-                    self.config,
-                    self.config.validator,
-                    "--grant-dir",
-                    str(grant_dir),
-                    "--result-json",
-                    str(validator_result_path),
-                ),
-                timeout=60,
-            )
+            try:
+                validator_config_path = run_compatible_validator(
+                    _tool_argv(self.config, self.config.validator),
+                    grant_dir,
+                    validator_result_path,
+                )
+            except Exception as exc:
+                raise ProvisioningError(
+                    "VALIDATOR_COMPATIBILITY_FAILED",
+                    503,
+                    details={"error": type(exc).__name__},
+                ) from exc
             validator_result = _read_json(validator_result_path)
             _verify_validator_result(
                 validator_result,
@@ -740,6 +755,10 @@ class AuthorizedTaskWriterProvisioner:
                 grant_digest=signer["grant_digest_sha256"],
             )
 
+            provisioner_env = dict(os.environ)
+            provisioner_env["AIOS_GRANT_ROOT_CONFIG"] = str(
+                validator_config_path
+            )
             _run(
                 _tool_argv(
                     self.config,
@@ -749,6 +768,7 @@ class AuthorizedTaskWriterProvisioner:
                     "--result-json",
                     str(provisioner_result_path),
                 ),
+                env=provisioner_env,
                 timeout=180,
             )
             provisioner_result = _read_json(provisioner_result_path)