Kevin Veen-BirkenbachandClaude Opus 5.5
d09ed61161
Operator tasks move from the Inbox into Tasks with the Waits on Operator filter. Review and commit asks carry the staged diff; a file whose old or new blob holds an armour line or a detection-pattern match, or every file when no pattern loads, ships only its path, status, mode and counts. The approval binds to the staged tree id from git write-tree, the encoded request body respects the hub limit, and the hub image ships every client module signed.py loads. Committed below the bar on the operator's word 2026-11-12 (no further per-bundle tests, one gate after the merge): the full hub suite and the W1 e2e never ran, two high MEDUSA rows (sandbox_paths.py FLOOR, permission_hook.py ask POST) wait for their acceptance. 🎯 Fix: 85 % 💥 Break: 12 % 💸 Cost: 30 % ⏱️ Time: 30 % 🛡️ Security: 50 % 🏆 Score: 100 🚦 Gate: ⛔ fix 85 % < 90, break 12 % > 5; security 50 % < 100: ask the operator before the commit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
58 lines
2.0 KiB
Python
58 lines
2.0 KiB
Python
from __future__ import annotations
|
|
|
|
import importlib.util
|
|
import sys
|
|
from pathlib import Path
|
|
from types import ModuleType
|
|
|
|
CLIENT = Path(__file__).resolve().parents[1] / "client"
|
|
|
|
|
|
def client_module(name: str, uses: dict[str, ModuleType]) -> ModuleType:
|
|
"""Args:
|
|
name: a module of orchestrator/client, loaded under its own
|
|
kvb_orchestrator_<name> name.
|
|
uses: the client modules it imports by their bare names; they are
|
|
visible under those names only while it loads.
|
|
"""
|
|
spec = importlib.util.spec_from_file_location(f"kvb_orchestrator_{name}", CLIENT / f"{name}.py")
|
|
module = importlib.util.module_from_spec(spec)
|
|
before = {key: sys.modules.get(key) for key in uses}
|
|
sys.modules.update(uses)
|
|
try:
|
|
spec.loader.exec_module(module)
|
|
finally:
|
|
for key, old in before.items():
|
|
if old is None:
|
|
sys.modules.pop(key, None)
|
|
else:
|
|
sys.modules[key] = old
|
|
return module
|
|
|
|
|
|
limits = client_module("hub_limits", {})
|
|
signing = client_module("signing", {})
|
|
passkey = client_module("passkey", {"signing": signing})
|
|
verifier = client_module("verifier", {"signing": signing, "passkey": passkey})
|
|
|
|
|
|
def ask_signed(ask: dict) -> dict:
|
|
return signing.ask_item(ask["id"], ask["tool"], ask["command"], ask["cwd"], ask["session"])
|
|
|
|
|
|
def review_signed(review: dict) -> dict:
|
|
return signing.review_item(review["id"], review.get("repo", ""), review["worktree"], review["branch"], review["tree"])
|
|
|
|
|
|
def operator_signed(row: dict) -> dict:
|
|
return signing.operator_item(row["task"], row["command"], row["directory"])
|
|
|
|
|
|
def request_signed(request: dict) -> dict:
|
|
return signing.rule_request_item(request["id"], request["kind"], request["tool"], request["pattern"], request["scope"], int(request["expires"]))
|
|
|
|
|
|
def message_signed(message: dict) -> dict:
|
|
upload = message["upload"]
|
|
return signing.message_item(message["to"], message["class"], message["text"], "" if upload is None else upload["id"], message["voice"] or "", message["voice_sha256"])
|