Ticket graphs

Rewrite ONE unique forge module as entirely new, behavior-preserving, installable, control-config'd Python, per the FORGE-wide refactor standard #200 (#std). This ticket covers ONE module — the one identified below — and nothing else. It was filed against the module's DEDUPLICATED identity, so if that module was copy-pasted across the forge, every copy is covered by this single ticket. MODULE KEY : forge-rw:832d4b672a698a00 (the ticketer's idempotency marker — it lives in this ticket's TITLE. Do not edit the title, or the module will be re-filed as a duplicate.) IDENTITY : AST-NORMALIZED — codebean's `_ast_norm` (#183), i.e. ast.dump(ast.parse(ast.unparse(ast.parse(src)))). Copies of this module that differ only in comments, blank lines, quoting or spacing carry the SAME module-sha and are covered by THIS ticket. A differing docstring is real content, so a module whose docstring differs is a DIFFERENT module with its own ticket. SIZE : 2512 bytes EXTENSION : .py CANONICAL SOURCE (the location this ticket is named for): repo : agent_tools_suite path : test_crankd.py ref : HEAD (HEAD) blob : 49d8272ac5e0c9507bd62a0d9f0de83a66322d66 (git blob sha1) REFERENCE ONLY — you do NOT need this command. This module's bytes are embedded COMPLETE in THE ORIGINAL SOURCE block below, and that is what the rewrite is based on. For a reader who does have forge access: git --git-dir=/Users/stevenpeterson/code/installed/jazz-project/config/forge/remotes/agent_tools_suite.git cat-file blob 49d8272ac5e0c9507bd62a0d9f0de83a66322d66 THE SAME MODULE ALSO LIVES AT THESE FORGE TIPS: none — this module is unique to agent_tools_suite among the repos scanned so far. HISTORICAL OCCURRENCES of this exact blob — every OTHER DISTINCT {repo, path} the omni-git index (`occ`, joined on the git blob sha1) records this byte-identical file at, with the index's own `ts` for the first row of each. Any place this run enumerated LIVE is listed under the forge tips above, not here. Context for the rewrite, not extra work: testmonkeyalpha-group/jazz-forge/agent_tools_suite:test_crankd.py [occ.ts gitlab] THE ORIGINAL SOURCE, EMBEDDED — YOU NEED NO FORGE ACCESS TO DO THIS TICKET. The module's own bytes are reproduced below, inside this ticket. THEY are the authoritative copy and the behavior-preserving basis: rewrite from them. The `git --git-dir=... cat-file blob` command under CANONICAL SOURCE above is kept only as a REFERENCE for a reader who happens to have forge access — running it is NOT part of this ticket. (Why the bytes are here at all: the pair_loop worker that executes this ticket is sandboxed to the ticket's own congruency worktree and cannot read the forge's bare repos. Ticket #346 is the fix that put them on the ticket.) The block BEGINS at the line ===ORIGINAL SOURCE (verbatim, the behavior-preserving basis)=== and ENDS at the first line ===END SOURCE=== Everything strictly between those two lines is the module — 2512 byte(s), byte for byte, with no re-indentation, no re-wrapping and nothing elided. ===ORIGINAL SOURCE (verbatim, the behavior-preserving basis)=== #!/usr/bin/env python3 """Prove crankd's wallet-approval gate: a valid signature over the ticket digest passes; a forged sig, a post-approval edit, and a missing sig all fail. Hermetic — generates its own ed25519 approver key. ~/jail/.venv/bin/python test_crankd.py """ import os import sys from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat # point crankd at a throwaway approver key BEFORE importing it _priv = Ed25519PrivateKey.generate() os.environ["CRANK_APPROVER_PUBKEY"] = _priv.public_key().public_bytes( Encoding.OpenSSH, PublicFormat.OpenSSH).decode() HERE = os.path.dirname(os.path.abspath(__file__)) sys.path.insert(0, HERE) import crankd as C # noqa: E402 C.APPROVER_PUBKEY = os.environ["CRANK_APPROVER_PUBKEY"] # in case the module cached None at import passed = failed = 0 def check(name, ok): global passed, failed passed, failed = passed + bool(ok), failed + (not ok) print(f" {'✓' if ok else '✗ FAIL'} {name}") def sign(ticket): return _priv.sign(C.digest(ticket).encode()).hex() print("\ncrankd — wallet-approval gate") ticket = {"id": 7, "component": "workstation", "title": "crank domain.py", "body": "add libvirt domain"} check("digest is deterministic", C.digest(ticket) == C.digest(dict(ticket))) check("digest changes when body is edited", C.digest(ticket) != C.digest({**ticket, "body": "evil"})) approved = {**ticket, "approval_sig": sign(ticket)} check("valid wallet signature -> approved", C.verify_approval(approved)) check("post-approval edit -> rejected (bait-and-switch defeated)", not C.verify_approval({**approved, "body": "rm -rf ~"})) check("forged signature -> rejected", not C.verify_approval({**ticket, "approval_sig": "00" * 64})) check("no signature -> rejected", not C.verify_approval(ticket)) # the flow refuses an unknown component before ever touching congruency try: C.crank("not-a-component", "x") check("unknown component refused", False) except C.CrankError as e: check("unknown component -> 404, no congruency call", e.status == 404) # and refuses when no approver key is configured (fail-closed) saved, C.APPROVER_PUBKEY = C.APPROVER_PUBKEY, None check("no approver key -> nothing is approved (fail-closed)", not C.verify_approval(approved)) C.APPROVER_PUBKEY = saved print(f"\n{'PASS' if not failed else 'FAIL'} — {passed} passed, {failed} failed") sys.exit(1 if failed else 0) ===END SOURCE=== THE CALLABLE SURFACE — every callable in the original, lowered with codebean's `lower_node` (#183). The rewrite must present THIS surface (same names, same parameters, same defaults) so callers of the original keep working: check(name, ok) sign(ticket) CAPTURED BEHAVIORAL EXEMPLARS: none. no function in this module is minable — criteria_miner mines only self-contained pure functions (it refuses anything that mentions a world-touching or non-deterministic name, plus methods and no-arg functions), and nothing here qualified This does NOT weaken the ticket's bar — it MOVES the work: you must write the equivalence exemplars by hand from the original's behavior before rewriting, and they are what settles this ticket. THE STANDARD — #200's four requirements, which this ticket exists to enforce. All four are the standard's own words; none is optional: 1. BEHAVIOR-PRESERVING, VERIFIED NOT ASSERTED — the deliverable is ENTIRELY NEW source code (rewritten, not copied). It must reproduce the ORIGINAL's behavior, and the proof is the exemplars above (captured via codebean lower_* #183 + criteria_miner IO-exemplars, exactly as #200 specifies). 2. A PYTHON MODULE — regardless of the source language. This module's source is `.py`; the rewrite is Python either way. 3. INSTALLABLE — a proper package: pyproject.toml, `pip install -e .` works, console entry points where applicable. WRITE ONLY YOUR OWN MODULE FILE at forge2/<repo>/<module>.py. Do NOT hand-author pyproject.toml or __init__.py: the harness DERIVES them ADDITIVELY from the modules present (congruency/tools/ forge_package.py, #410 — the analogue of the tag-registry fix #281), so your unit never conflicts with, or clobbers, a sibling module of the same forge2/<repo>/ package. A package-level pyproject includes every .py in the directory, so your module installs and imports as `<repo>.<module>` the moment it lands. 4. CONTROL-CONFIG'D — NO hardcoded paths or params. A JSON/registry config object drives it (the install.json / registry.json idiom of this repo), and per note-for-claude a tool that cannot see its config THROWS rather than guessing a default. Add ONLY your own `forge2.<repo>.<module>` section to the package's registry.json (create the file if it is absent); NEVER read, edit or drop a sibling module's section — the sections are disjoint keys and stay additive that way. ACCEPTANCE (#200's, per rewrite ticket) — this ticket settles when ALL of: a. the new source reproduces every captured exemplar above, plus the edge cases you add for what sampling cannot reach (paste the runs as evidence); b. it presents the callable surface above, so existing callers keep working; c. `pip install -e .` installs it clean from its own pyproject.toml; d. it runs off a config object with ZERO hardcoded settings, and throws without one. Kind is `build` (a pair: coder + adversarial tester). This ticket hangs off #200 by a `spawned` edge, so a stop ticket aimed at #200 brakes every rewrite in this programme. Filed mechanically by checkouts/current/congruency/tools/forge_refactor_ticketer.py under ticket #201, from the forge bare repos at /Users/stevenpeterson/code/installed/jazz-project/config/forge/remotes. Its original source is embedded above (#346), so this ticket is complete on its own.

— browse congruency source (forge-parked tree)