docs: enforce personal-agent profile contract
This commit is contained in:
Svrnty
@@ -1,12 +1,72 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Validate Steev Profile child workspace shell."""
|
||||
"""Validate the Steev-named personal-agent profile distribution."""
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
from pathlib import Path
|
||||
|
||||
import yaml
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
REQUIRED = ["AGENTS.md", "README.md", "WORKBOARD.yaml"]
|
||||
REQUIRED = [
|
||||
"AGENTS.md",
|
||||
"README.md",
|
||||
"WORKBOARD.yaml",
|
||||
"manifest.yaml",
|
||||
"AGENT.md",
|
||||
"CONTRACT.md",
|
||||
"DISCLOSURE.md",
|
||||
"docs/STEEV-MASTER.md",
|
||||
"docs/contracts/personal-agent-profile-surface-contract.json",
|
||||
"docs/prd/2026-06-14-personal-agent-context-runtime-prd.md",
|
||||
"docs/issues/2026-06-14-personal-agent-context-runtime-work-orders.md",
|
||||
"docs/supersession/2026-06-14-personal-agent-context-runtime-supersession-register.md",
|
||||
]
|
||||
|
||||
REQUIRED_SURFACES = {
|
||||
"imessage.read",
|
||||
"mail.read",
|
||||
"mail.draft",
|
||||
"mail.send_with_confirmation",
|
||||
"calendar.read",
|
||||
"calendar.propose_event",
|
||||
"calendar.write_with_confirmation",
|
||||
"contacts.read",
|
||||
"contacts.write_with_confirmation",
|
||||
"drive.read",
|
||||
"drive.write_with_confirmation",
|
||||
"browser.host_runtime.full_control",
|
||||
}
|
||||
|
||||
REQUIRED_REDACTION_TERMS = {
|
||||
"raw_messages",
|
||||
"mail_bodies",
|
||||
"contact_details",
|
||||
"calendar_event_details",
|
||||
"drive_file_names",
|
||||
"endpoint_payloads",
|
||||
"credentials",
|
||||
"cookies",
|
||||
"keychain_values",
|
||||
"password_manager_values",
|
||||
"secret_values",
|
||||
}
|
||||
|
||||
|
||||
def read_text(rel: str) -> str:
|
||||
return (ROOT / rel).read_text(encoding="utf-8")
|
||||
|
||||
|
||||
def load_contract(errors: list[str]) -> dict:
|
||||
rel = "docs/contracts/personal-agent-profile-surface-contract.json"
|
||||
path = ROOT / rel
|
||||
if not path.exists():
|
||||
return {}
|
||||
try:
|
||||
return json.loads(path.read_text(encoding="utf-8"))
|
||||
except json.JSONDecodeError as exc:
|
||||
errors.append(f"contract_json_invalid:{rel}:{exc.lineno}:{exc.colno}")
|
||||
return {}
|
||||
|
||||
|
||||
def main() -> int:
|
||||
@@ -17,7 +77,7 @@ def main() -> int:
|
||||
board = ROOT / "WORKBOARD.yaml"
|
||||
if board.exists():
|
||||
text = board.read_text(encoding="utf-8")
|
||||
for snippet in ["STEEV-WORK-001", "status: candidate", "owner: jp"]:
|
||||
for snippet in ["STEEV-WORK-001", "PACR-001", "PACR-002", "status: candidate", "owner: jp"]:
|
||||
if snippet not in text:
|
||||
errors.append(f"workboard_missing:{snippet}")
|
||||
agents = ROOT / "AGENTS.md"
|
||||
@@ -26,7 +86,99 @@ def main() -> int:
|
||||
for snippet in ["child-local", "not Cortex OS Core authority", "python3 tools/validate_steev_child.py"]:
|
||||
if snippet not in text:
|
||||
errors.append(f"agents_missing:{snippet}")
|
||||
result = {"ok": not errors, "validator": "steev-child-v1", "checked": REQUIRED, "errors": errors, "warnings": []}
|
||||
|
||||
manifest = ROOT / "manifest.yaml"
|
||||
if manifest.exists():
|
||||
data = yaml.safe_load(manifest.read_text(encoding="utf-8")) or {}
|
||||
if data.get("profile_identity") != "personal-agent":
|
||||
errors.append("manifest_profile_identity_not_personal_agent")
|
||||
if data.get("display_name") != "Steev":
|
||||
errors.append("manifest_display_name_not_steev")
|
||||
if data.get("profile") != "steev":
|
||||
errors.append("manifest_distribution_alias_not_steev")
|
||||
|
||||
contract = load_contract(errors)
|
||||
if contract:
|
||||
if contract.get("profile_identity") != "personal-agent":
|
||||
errors.append("contract_profile_identity_not_personal_agent")
|
||||
if contract.get("display_name") != "Steev":
|
||||
errors.append("contract_display_name_not_steev")
|
||||
if contract.get("distribution_alias") != "steev":
|
||||
errors.append("contract_distribution_alias_not_steev")
|
||||
memory = contract.get("memory_policy", {})
|
||||
if memory.get("allowed_target") != "secondbrain-personal":
|
||||
errors.append("contract_memory_allowed_target_not_secondbrain_personal")
|
||||
if "orgbrain" not in memory.get("forbidden_targets", []):
|
||||
errors.append("contract_memory_orgbrain_not_forbidden")
|
||||
if "proposal-only" not in memory.get("durable_write_policy", ""):
|
||||
errors.append("contract_memory_not_proposal_only")
|
||||
credential = contract.get("credential_policy", {})
|
||||
if credential.get("mode") != "keyvault-reference-names-only":
|
||||
errors.append("contract_credential_policy_not_keyvault_refs_only")
|
||||
redaction = set(contract.get("proof_redaction_policy", {}).get("forbidden_in_core_or_proof", []))
|
||||
missing_redaction = sorted(REQUIRED_REDACTION_TERMS - redaction)
|
||||
if missing_redaction:
|
||||
errors.append(f"contract_redaction_missing:{','.join(missing_redaction)}")
|
||||
states = set(contract.get("readiness_states", []))
|
||||
for state in ["ready", "degraded", "pending", "blocked", "disabled"]:
|
||||
if state not in states:
|
||||
errors.append(f"contract_readiness_state_missing:{state}")
|
||||
surfaces = contract.get("surfaces", [])
|
||||
surface_names = {surface.get("name") for surface in surfaces}
|
||||
missing_surfaces = sorted(REQUIRED_SURFACES - surface_names)
|
||||
if missing_surfaces:
|
||||
errors.append(f"contract_surfaces_missing:{','.join(missing_surfaces)}")
|
||||
for surface in surfaces:
|
||||
name = surface.get("name", "<unknown>")
|
||||
if not surface.get("capability_package"):
|
||||
errors.append(f"surface_missing_capability_package:{name}")
|
||||
if not isinstance(surface.get("allowed_effects"), list):
|
||||
errors.append(f"surface_allowed_effects_not_list:{name}")
|
||||
denied = surface.get("denied_effects")
|
||||
if not isinstance(denied, list):
|
||||
errors.append(f"surface_denied_effects_not_list:{name}")
|
||||
elif "orgbrain_write" not in denied:
|
||||
errors.append(f"surface_orgbrain_write_not_denied:{name}")
|
||||
if not surface.get("confirmation"):
|
||||
errors.append(f"surface_missing_confirmation_policy:{name}")
|
||||
|
||||
for rel in ["AGENT.md", "CONTRACT.md", "DISCLOSURE.md", "README.md", "docs/STEEV-MASTER.md"]:
|
||||
path = ROOT / rel
|
||||
if not path.exists():
|
||||
continue
|
||||
text = path.read_text(encoding="utf-8")
|
||||
if "personal-agent" not in text:
|
||||
errors.append(f"visible_personal_agent_note_missing:{rel}")
|
||||
if "display name" not in text and "display/distribution alias" not in text:
|
||||
errors.append(f"visible_display_alias_note_missing:{rel}")
|
||||
|
||||
supersession = ROOT / "docs/supersession/2026-06-14-personal-agent-context-runtime-supersession-register.md"
|
||||
if supersession.exists():
|
||||
text = supersession.read_text(encoding="utf-8")
|
||||
for snippet in [
|
||||
"active-authority",
|
||||
"active-alias",
|
||||
"active-capability-package",
|
||||
"superseded",
|
||||
"legacy-reference",
|
||||
"blocked-follow-up",
|
||||
"secondbrain-personal",
|
||||
"`orgbrain` as denied",
|
||||
"PACR-010",
|
||||
]:
|
||||
if snippet not in text:
|
||||
errors.append(f"supersession_missing:{snippet}")
|
||||
for stale in ["SPCR-", "steev-personal-context-runtime"]:
|
||||
if stale in text:
|
||||
errors.append(f"supersession_stale_reference:{stale}")
|
||||
|
||||
result = {
|
||||
"ok": not errors,
|
||||
"validator": "personal-agent-profile-distribution-v2",
|
||||
"checked": REQUIRED,
|
||||
"errors": errors,
|
||||
"warnings": [],
|
||||
}
|
||||
print(json.dumps(result, indent=2, sort_keys=True))
|
||||
return 0 if result["ok"] else 1
|
||||
|
||||
|
||||
Reference in New Issue
Block a user