Ticket graphs

Rewrite ONE unique forge module as entirely new, behavior-preserving, installable, control-config'd Python, per the FORGE-wide refactor standard #200 (#std). This ticket covers ONE module — the one identified below — and nothing else. It was filed against the module's DEDUPLICATED identity, so if that module was copy-pasted across the forge, every copy is covered by this single ticket. MODULE KEY : forge-rw:1e2c76b02cb58931 (the ticketer's idempotency marker — it lives in this ticket's TITLE. Do not edit the title, or the module will be re-filed as a duplicate.) IDENTITY : AST-NORMALIZED — codebean's `_ast_norm` (#183), i.e. ast.dump(ast.parse(ast.unparse(ast.parse(src)))). Copies of this module that differ only in comments, blank lines, quoting or spacing carry the SAME module-sha and are covered by THIS ticket. A differing docstring is real content, so a module whose docstring differs is a DIFFERENT module with its own ticket. SIZE : 4041 bytes EXTENSION : .py CANONICAL SOURCE (the location this ticket is named for): repo : agent_tools_suite path : ats_token.py ref : HEAD (HEAD) blob : ca9e85deca7c77089721636c0712ecac8115333b (git blob sha1) REFERENCE ONLY — you do NOT need this command. This module's bytes are embedded COMPLETE in THE ORIGINAL SOURCE block below, and that is what the rewrite is based on. For a reader who does have forge access: git --git-dir=/Users/stevenpeterson/code/installed/jazz-project/config/forge/remotes/agent_tools_suite.git cat-file blob ca9e85deca7c77089721636c0712ecac8115333b THE SAME MODULE ALSO LIVES AT THESE FORGE TIPS: none — this module is unique to agent_tools_suite among the repos scanned so far. HISTORICAL OCCURRENCES of this exact blob — every OTHER DISTINCT {repo, path} the omni-git index (`occ`, joined on the git blob sha1) records this byte-identical file at, with the index's own `ts` for the first row of each. Any place this run enumerated LIVE is listed under the forge tips above, not here. Context for the rewrite, not extra work: testmonkeyalpha-group/jazz-forge/agent_tools_suite:ats_token.py [occ.ts gitlab] THE ORIGINAL SOURCE, EMBEDDED — YOU NEED NO FORGE ACCESS TO DO THIS TICKET. The module's own bytes are reproduced below, inside this ticket. THEY are the authoritative copy and the behavior-preserving basis: rewrite from them. The `git --git-dir=... cat-file blob` command under CANONICAL SOURCE above is kept only as a REFERENCE for a reader who happens to have forge access — running it is NOT part of this ticket. (Why the bytes are here at all: the pair_loop worker that executes this ticket is sandboxed to the ticket's own congruency worktree and cannot read the forge's bare repos. Ticket #346 is the fix that put them on the ticket.) The block BEGINS at the line ===ORIGINAL SOURCE (verbatim, the behavior-preserving basis)=== and ENDS at the first line ===END SOURCE=== Everything strictly between those two lines is the module — 4041 byte(s), byte for byte, with no re-indentation, no re-wrapping and nothing elided. ===ORIGINAL SOURCE (verbatim, the behavior-preserving basis)=== #!/usr/bin/env python3 """ats_token — wallet-rooted bearer tokens for the ats gate, with scopes. A token is derived deterministically from the wallet seed (HMAC over the wallet's ed25519 private key for the name 'ats-gate'), so it is reproducible and rooted in the same Keychain seed as ssh/EVM/ledger — no fresh secret to manage. Tokens are provisioned once into ~/.secrets/ats.env (chmod 600, OUTSIDE any git); the server and clients read that file. Two scopes today: full ats:use ats:full — every tool (the operator / ~/code client) crankws ats:use ats:crankws — only the crankws_* verbs (the scoped crank agent) `ats:use` is the base scope the transport requires (any valid token has it → tokenless = 401); the per-tool split (full vs crankws) is enforced in the gate's call_tool/list_tools. """ import hashlib import hmac import os import subprocess import tempfile SECRETS = os.path.expanduser("~/.secrets") ENVFILE = os.path.join(SECRETS, "ats.env") WALLET = os.environ.get("WALLET_BIN") or os.path.expanduser("~/bin/wallet") WALLET_NAME = "ats-gate" # token-name -> the scopes it carries SCOPES = { "full": ["ats:use", "ats:full"], "crankws": ["ats:use", "ats:crankws"], "crankcong": ["ats:use", "ats:crankcong"], # only the crankcong_* verbs (the scoped congruency agent) } def _wallet_secret(): """The wallet-derived ed25519 raw seed (32 deterministic bytes) for WALLET_NAME — the root secret, never stored. Note: the OpenSSH private-key *file* randomizes its check-bytes/padding on every export, so we parse out the raw seed (which IS deterministic) rather than hashing the file bytes.""" from cryptography.hazmat.primitives.serialization import Encoding, NoEncryption, PrivateFormat, load_ssh_private_key with tempfile.TemporaryDirectory() as d: p = os.path.join(d, "k") subprocess.run([WALLET, "ssh", WALLET_NAME, "-w", p], check=True, capture_output=True) with open(p, "rb") as fh: key = load_ssh_private_key(fh.read(), password=None) return key.private_bytes(Encoding.Raw, PrivateFormat.Raw, NoEncryption()) def _derive(secret, name): return hmac.new(secret, ("ats-token:" + name).encode(), hashlib.sha256).hexdigest() def derive_all(): """Return {token-name: token} for every scope, from a single wallet export.""" secret = _wallet_secret() return {name: _derive(secret, name) for name in SCOPES} def provision(): """Write ~/.secrets/ats.env (chmod 600) with ATS_TOKEN_<NAME>=<token>. Idempotent. Returns tokens.""" os.makedirs(SECRETS, exist_ok=True) toks = derive_all() fd = os.open(ENVFILE, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600) with os.fdopen(fd, "w") as fh: for name, t in toks.items(): fh.write("ATS_TOKEN_%s=%s\n" % (name.upper(), t)) return toks def load_map(): """Return {token-string: scopes} for the verifier. Prefer ~/.secrets/ats.env; else derive live. Returns {} if neither the file nor the wallet is available (caller runs unauthenticated).""" out = {} if os.path.exists(ENVFILE): env = {} for line in open(ENVFILE): line = line.strip() if "=" in line and not line.startswith("#"): k, v = line.split("=", 1) env[k] = v for name, scopes in SCOPES.items(): t = env.get("ATS_TOKEN_%s" % name.upper()) if t: out[t] = scopes if not out: try: for name, t in derive_all().items(): out[t] = SCOPES[name] except Exception: # noqa: BLE001 — no wallet: caller decides (unauth fallback) return {} return out if __name__ == "__main__": import sys if len(sys.argv) > 1 and sys.argv[1] == "provision": for name, t in provision().items(): print("ATS_TOKEN_%s=%s" % (name.upper(), t)) else: for t, scopes in load_map().items(): print("%s %s" % (t, " ".join(scopes))) ===END SOURCE=== THE CALLABLE SURFACE — every callable in the original, lowered with codebean's `lower_node` (#183). The rewrite must present THIS surface (same names, same parameters, same defaults) so callers of the original keep working: _wallet_secret() _derive(secret, name) derive_all() provision() load_map() CAPTURED BEHAVIORAL EXEMPLARS: none. no function in this module is minable — criteria_miner mines only self-contained pure functions (it refuses anything that mentions a world-touching or non-deterministic name, plus methods and no-arg functions), and nothing here qualified This does NOT weaken the ticket's bar — it MOVES the work: you must write the equivalence exemplars by hand from the original's behavior before rewriting, and they are what settles this ticket. THE STANDARD — #200's four requirements, which this ticket exists to enforce. All four are the standard's own words; none is optional: 1. BEHAVIOR-PRESERVING, VERIFIED NOT ASSERTED — the deliverable is ENTIRELY NEW source code (rewritten, not copied). It must reproduce the ORIGINAL's behavior, and the proof is the exemplars above (captured via codebean lower_* #183 + criteria_miner IO-exemplars, exactly as #200 specifies). 2. A PYTHON MODULE — regardless of the source language. This module's source is `.py`; the rewrite is Python either way. 3. INSTALLABLE — a proper package: pyproject.toml, `pip install -e .` works, console entry points where applicable. WRITE ONLY YOUR OWN MODULE FILE at forge2/<repo>/<module>.py. Do NOT hand-author pyproject.toml or __init__.py: the harness DERIVES them ADDITIVELY from the modules present (congruency/tools/ forge_package.py, #410 — the analogue of the tag-registry fix #281), so your unit never conflicts with, or clobbers, a sibling module of the same forge2/<repo>/ package. A package-level pyproject includes every .py in the directory, so your module installs and imports as `<repo>.<module>` the moment it lands. 4. CONTROL-CONFIG'D — NO hardcoded paths or params. A JSON/registry config object drives it (the install.json / registry.json idiom of this repo), and per note-for-claude a tool that cannot see its config THROWS rather than guessing a default. Add ONLY your own `forge2.<repo>.<module>` section to the package's registry.json (create the file if it is absent); NEVER read, edit or drop a sibling module's section — the sections are disjoint keys and stay additive that way. ACCEPTANCE (#200's, per rewrite ticket) — this ticket settles when ALL of: a. the new source reproduces every captured exemplar above, plus the edge cases you add for what sampling cannot reach (paste the runs as evidence); b. it presents the callable surface above, so existing callers keep working; c. `pip install -e .` installs it clean from its own pyproject.toml; d. it runs off a config object with ZERO hardcoded settings, and throws without one. Kind is `build` (a pair: coder + adversarial tester). This ticket hangs off #200 by a `spawned` edge, so a stop ticket aimed at #200 brakes every rewrite in this programme. Filed mechanically by checkouts/current/congruency/tools/forge_refactor_ticketer.py under ticket #201, from the forge bare repos at /Users/stevenpeterson/code/installed/jazz-project/config/forge/remotes. Its original source is embedded above (#346), so this ticket is complete on its own.

— browse congruency source (forge-parked tree)