owner
6ffd7fe19c
Apply the approved Implementation Baseline 1.1 architecture revisions onto the current mainline, verified faithful to the delivered change bundle: - Add aios_baseline: signed owner-delegation-grant.v1 / operational-epoch.v1 / task-principal.v1 auth chain, runtime contract + deployment-truth evaluator, declarative operation registry (effect-class + fail-closed dispatch), lineage ledger, release/recipe/saga ledger, bounded optimization controller, authenticated HTTP transport, resident worker loop and systemd host probe. - Extend existing Job authority (aios_gitops_job_controller/executor) with durable intent/receipt/reconcile and fail-closed admission; harden task_plane/store heartbeat CAS and terminal-state fencing; make reconciliation_controller fail-closed on incomplete/drift evidence. - Add isolated-validation profile templates (deploy/baseline-v1.1, systemd .example), source change/rollback tooling (tools/baseline_v1_1), the AT-01..AT-23 acceptance matrix, M0-M5 runbook, installation/rollback docs and the baseline_v1_1 test suite. - Keep legacy write authorities untouched; isolated-validation profile only. Staged blobs verified byte-identical to the delivered source-changes bundle. Cross-platform baseline tests pass; systemd/fcntl-dependent paths require the declared Linux x86_64 + CPython 3.12 + systemd runtime (site-bound).
40 lines
1.7 KiB
Python
40 lines
1.7 KiB
Python
"""Canonical, domain-separated machine receipts, distinct from Owner grants."""
|
|
import base64
|
|
import hashlib
|
|
import json
|
|
from cryptography.exceptions import InvalidSignature
|
|
|
|
|
|
def canonical(value):
|
|
return json.dumps(value,sort_keys=True,separators=(',',':'),ensure_ascii=False,allow_nan=False).encode()
|
|
|
|
|
|
def digest(value):
|
|
return hashlib.sha256(canonical(value)).hexdigest()
|
|
|
|
|
|
class ReceiptSigner:
|
|
def __init__(self, private_key, *, key_id='baseline-machine', trusted_public_keys=None):
|
|
self.private_key=private_key
|
|
self.public_key=private_key.public_key()
|
|
self.key_id=key_id
|
|
self.trusted_public_keys=dict(trusted_public_keys or {})
|
|
self.trusted_public_keys[key_id]=self.public_key
|
|
|
|
def sign(self,payload):
|
|
raw=canonical({'domain':'aios.operation-receipt.v1','key_id':self.key_id,'payload':payload})
|
|
return {'schema':'aios.operation-receipt.v1','key_id':self.key_id,'payload':payload,
|
|
'signature':base64.b64encode(self.private_key.sign(raw)).decode()}
|
|
|
|
def verify(self,envelope):
|
|
try:
|
|
if type(envelope) is not dict or set(envelope)!={'schema','key_id','payload','signature'} or envelope['schema']!='aios.operation-receipt.v1' or type(envelope['payload']) is not dict:
|
|
return False
|
|
public=self.trusted_public_keys.get(envelope['key_id'])
|
|
if public is None: return False
|
|
raw=canonical({'domain':envelope['schema'],'key_id':envelope['key_id'],'payload':envelope['payload']})
|
|
public.verify(base64.b64decode(envelope['signature'],validate=True),raw)
|
|
return True
|
|
except (ValueError,TypeError,InvalidSignature,KeyError):
|
|
return False
|