#!/usr/bin/env python3 """Validate the Steev-named personal-agent profile distribution.""" from __future__ import annotations import json from pathlib import Path import yaml ROOT = Path(__file__).resolve().parents[1] REQUIRED = [ "AGENTS.md", "README.md", "WORKBOARD.yaml", "manifest.yaml", "AGENT.md", "CONTRACT.md", "DISCLOSURE.md", "docs/STEEV-MASTER.md", "docs/contracts/personal-agent-profile-surface-contract.json", "docs/contracts/personal-agent-bluebubbles-binding.json", "docs/prd/2026-06-14-personal-agent-context-runtime-prd.md", "docs/issues/2026-06-14-personal-agent-context-runtime-work-orders.md", "docs/supersession/2026-06-14-personal-agent-context-runtime-supersession-register.md", ] REQUIRED_SURFACES = { "imessage.read", "mail.read", "mail.draft", "mail.send_with_confirmation", "calendar.read", "calendar.propose_event", "calendar.write_with_confirmation", "contacts.read", "contacts.write_with_confirmation", "drive.read", "drive.write_with_confirmation", "browser.host_runtime.full_control", } REQUIRED_REDACTION_TERMS = { "raw_messages", "mail_bodies", "contact_details", "calendar_event_details", "drive_file_names", "endpoint_payloads", "credentials", "cookies", "keychain_values", "password_manager_values", "secret_values", } def read_text(rel: str) -> str: return (ROOT / rel).read_text(encoding="utf-8") def load_contract(errors: list[str]) -> dict: return load_json("docs/contracts/personal-agent-profile-surface-contract.json", errors) def load_json(rel: str, errors: list[str]) -> dict: path = ROOT / rel if not path.exists(): return {} try: return json.loads(path.read_text(encoding="utf-8")) except json.JSONDecodeError as exc: errors.append(f"json_invalid:{rel}:{exc.lineno}:{exc.colno}") return {} def main() -> int: errors: list[str] = [] for rel in REQUIRED: if not (ROOT / rel).exists(): errors.append(f"missing:{rel}") board = ROOT / "WORKBOARD.yaml" if board.exists(): text = board.read_text(encoding="utf-8") for snippet in ["STEEV-WORK-001", "PACR-001", "PACR-002", "PACR-003", "status: candidate", "owner: jp"]: if snippet not in text: errors.append(f"workboard_missing:{snippet}") agents = ROOT / "AGENTS.md" if agents.exists(): text = agents.read_text(encoding="utf-8") for snippet in ["child-local", "not Cortex OS Core authority", "python3 tools/validate_steev_child.py"]: if snippet not in text: errors.append(f"agents_missing:{snippet}") manifest = ROOT / "manifest.yaml" if manifest.exists(): data = yaml.safe_load(manifest.read_text(encoding="utf-8")) or {} if data.get("profile_identity") != "personal-agent": errors.append("manifest_profile_identity_not_personal_agent") if data.get("display_name") != "Steev": errors.append("manifest_display_name_not_steev") if data.get("profile") != "steev": errors.append("manifest_distribution_alias_not_steev") contract = load_contract(errors) if contract: if contract.get("profile_identity") != "personal-agent": errors.append("contract_profile_identity_not_personal_agent") if contract.get("display_name") != "Steev": errors.append("contract_display_name_not_steev") if contract.get("distribution_alias") != "steev": errors.append("contract_distribution_alias_not_steev") memory = contract.get("memory_policy", {}) if memory.get("allowed_target") != "secondbrain-personal": errors.append("contract_memory_allowed_target_not_secondbrain_personal") if "orgbrain" not in memory.get("forbidden_targets", []): errors.append("contract_memory_orgbrain_not_forbidden") if "proposal-only" not in memory.get("durable_write_policy", ""): errors.append("contract_memory_not_proposal_only") credential = contract.get("credential_policy", {}) if credential.get("mode") != "keyvault-reference-names-only": errors.append("contract_credential_policy_not_keyvault_refs_only") redaction = set(contract.get("proof_redaction_policy", {}).get("forbidden_in_core_or_proof", [])) missing_redaction = sorted(REQUIRED_REDACTION_TERMS - redaction) if missing_redaction: errors.append(f"contract_redaction_missing:{','.join(missing_redaction)}") states = set(contract.get("readiness_states", [])) for state in ["ready", "degraded", "pending", "blocked", "disabled"]: if state not in states: errors.append(f"contract_readiness_state_missing:{state}") surfaces = contract.get("surfaces", []) surface_names = {surface.get("name") for surface in surfaces} missing_surfaces = sorted(REQUIRED_SURFACES - surface_names) if missing_surfaces: errors.append(f"contract_surfaces_missing:{','.join(missing_surfaces)}") for surface in surfaces: name = surface.get("name", "") if not surface.get("capability_package"): errors.append(f"surface_missing_capability_package:{name}") if not isinstance(surface.get("allowed_effects"), list): errors.append(f"surface_allowed_effects_not_list:{name}") denied = surface.get("denied_effects") if not isinstance(denied, list): errors.append(f"surface_denied_effects_not_list:{name}") elif "orgbrain_write" not in denied: errors.append(f"surface_orgbrain_write_not_denied:{name}") if not surface.get("confirmation"): errors.append(f"surface_missing_confirmation_policy:{name}") binding = load_json("docs/contracts/personal-agent-bluebubbles-binding.json", errors) if binding: if binding.get("profile_identity") != "personal-agent": errors.append("bluebubbles_binding_profile_identity_not_personal_agent") if binding.get("surface") != "imessage.read": errors.append("bluebubbles_binding_surface_not_imessage_read") package = binding.get("capability_package", {}) if package.get("id") != "bluebubbles": errors.append("bluebubbles_binding_package_not_bluebubbles") if package.get("package_surface") != "bluebubbles.imessage.readonly": errors.append("bluebubbles_binding_package_surface_not_readonly") if package.get("live_connector") != "hermes-agent": errors.append("bluebubbles_binding_live_connector_not_hermes") if package.get("profile_local_connector_allowed") is not False: errors.append("bluebubbles_binding_profile_local_connector_not_denied") if package.get("duplicate_connector_allowed") is not False: errors.append("bluebubbles_binding_duplicate_connector_not_denied") policy = binding.get("binding_policy", {}) for key in [ "profile_consumes_package", "package_owns_runtime_wrapper", "package_owns_readonly_adapter", "package_owns_redacted_health", "package_owns_seed_candidate", "profile_owns_surface_exposure", ]: if policy.get(key) is not True: errors.append(f"bluebubbles_binding_policy_not_true:{key}") if policy.get("profile_runtime_readiness_claimed") is not False: errors.append("bluebubbles_binding_profile_runtime_readiness_claimed") memory = binding.get("memory_policy", {}) if memory.get("target") != "secondbrain-personal": errors.append("bluebubbles_binding_memory_target_not_secondbrain_personal") if "orgbrain" not in memory.get("forbidden", []): errors.append("bluebubbles_binding_orgbrain_not_forbidden") if "proposal-only" not in memory.get("durable_write_policy", ""): errors.append("bluebubbles_binding_memory_not_proposal_only") denied = set(binding.get("denied_effects", [])) for effect in [ "send_message", "read_receipt", "mark_read", "attachment_content_download", "secondbrain_durable_write", "orgbrain_write", "browser_full_control", ]: if effect not in denied: errors.append(f"bluebubbles_binding_denied_effect_missing:{effect}") forbidden_fields = set(binding.get("proof_policy", {}).get("forbidden_fields", [])) for field in ["raw_messages", "message_text", "endpoint_payloads", "credentials", "secret_values"]: if field not in forbidden_fields: errors.append(f"bluebubbles_binding_forbidden_field_missing:{field}") evidence = binding.get("bluebubbles_package_evidence", {}) if evidence.get("validator_command") != "python3 tools/validate_bluebubbles_child.py": errors.append("bluebubbles_binding_validator_command_missing") if evidence.get("validator_result_observed") != "ok": errors.append("bluebubbles_binding_validator_result_not_ok") if evidence.get("runtime_claims_from_validator") is not False: errors.append("bluebubbles_binding_runtime_claims_not_false") refs = set(evidence.get("referenced_artifacts", [])) for ref in [ "contracts/personal-agent-imessage-readonly-contract.json", "contracts/runtime-compliance-boundary.json", "contracts/secondbrain-proposal-envelope-contract.json", ]: if ref not in refs: errors.append(f"bluebubbles_binding_reference_missing:{ref}") for rel in ["AGENT.md", "CONTRACT.md", "DISCLOSURE.md", "README.md", "docs/STEEV-MASTER.md"]: path = ROOT / rel if not path.exists(): continue text = path.read_text(encoding="utf-8") if "personal-agent" not in text: errors.append(f"visible_personal_agent_note_missing:{rel}") if "display name" not in text and "display/distribution alias" not in text: errors.append(f"visible_display_alias_note_missing:{rel}") supersession = ROOT / "docs/supersession/2026-06-14-personal-agent-context-runtime-supersession-register.md" if supersession.exists(): text = supersession.read_text(encoding="utf-8") for snippet in [ "active-authority", "active-alias", "active-capability-package", "Personal-agent BlueBubbles binding", "superseded", "legacy-reference", "blocked-follow-up", "secondbrain-personal", "`orgbrain` as denied", "PACR-010", ]: if snippet not in text: errors.append(f"supersession_missing:{snippet}") for stale in ["SPCR-", "steev-personal-context-runtime"]: if stale in text: errors.append(f"supersession_stale_reference:{stale}") result = { "ok": not errors, "validator": "personal-agent-profile-distribution-v2", "checked": REQUIRED, "errors": errors, "warnings": [], } print(json.dumps(result, indent=2, sort_keys=True)) return 0 if result["ok"] else 1 if __name__ == "__main__": raise SystemExit(main())