mosaicstack/stack
1
0
Fork 0
Code Issues 88 Pull Requests Actions Packages Projects Releases 15 Wiki Activity

feat(mosaic): add constrained context recovery command

Browse Source
This commit is contained in:
wjarvis mos-comms
2026-07-19 19:04:25 -05:00
parent 3b5513bd6e
commit 7729e6f2f7
10 changed files with 518 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
packages/mosaic/framework/tools/lease-broker/daemon.py
View File

@@ -400,7 +400,7 @@ class Broker:
response = self._handle(peer, request)
if self.store.value != previous:
self.store.commit()
if request.get("action") == "promote_lease":
if request.get("action") in {"promote_lease", "complete_recovery"}:
session_id = request.get("session_id")
if not isinstance(session_id, str):
raise BrokerFailure("INVALID_IDENTITY")
@@ -469,6 +469,71 @@ class Broker:
raise BrokerFailure("TOKEN_REPLAY")
del self.store.tokens()[token_value]
return {"ok": True}
if action == "begin_recovery":
# Recovery is the one ungated mutator, but it is not a second
# receipt protocol. It delegates to this exact normal-path
# transition, then marks its volatile pending cycle so completion
# can obtain the broker-minted challenge internally. Caller-supplied
# receipt text is never an input to recovery.
if any(field in request for field in ("receipt", "latest_assistant_message", "receipt_challenge")):
raise BrokerFailure("INVALID_RECOVERY_REQUEST")
normal_request = dict(request)
normal_request["action"] = "begin_verification"
response = self._handle(peer, normal_request)
session_id = response.get("session_id")
if not isinstance(session_id, str):
# begin_verification deliberately does not return identity;
# recover it only after its authenticated shared transition.
candidate = request.get("session_id")
if not isinstance(candidate, str):
raise BrokerFailure("INVALID_IDENTITY")
session_id = candidate
lease = self.leases.get(session_id)
if not isinstance(lease, dict) or lease.get("state") != LEASE_PENDING:
raise BrokerFailure("STATE_INTEGRITY")
lease["cycle_kind"] = "recovery"
response["state"] = "PENDING_DELIVERY"
return response
if action == "complete_recovery":
if any(field in request for field in ("receipt", "latest_assistant_message", "receipt_challenge")):
raise BrokerFailure("INVALID_RECOVERY_REQUEST")
session_id, _ = self.authenticate(peer_pid, request)
lease = self.leases.get(session_id)
challenge = lease.get("receipt_challenge") if isinstance(lease, dict) else None
if (
not isinstance(lease, dict)
or lease.get("cycle_kind") != "recovery"
or lease.get("state") != LEASE_PENDING
or not isinstance(challenge, str)
):
raise BrokerFailure("INVALID_LEASE_TRANSITION")
try:
# Reuse the shipped observe -> evidence commit -> consume ->
# promote transition. The recovery caller supplies neither a
# normal-path receipt nor a challenge; the trusted observer
# and current broker cycle remain the sole evidence authority.
observed_request = {
"action": "observe_receipt",
"session_id": session_id,
"runtime_generation": request["runtime_generation"],
"receipt_challenge": challenge,
}
self._handle(peer, observed_request)
return self._handle(peer, {
"action": "promote_lease",
"session_id": session_id,
"runtime_generation": request["runtime_generation"],
"receipt_challenge": challenge,
})
except Exception:
# A malformed, absent, or stale observed receipt must leave
# no pending recovery capability or live lease. A retry mints
# a new challenge through the shared begin transition.
self.revoke_session_authority(session_id)
self._rejected_cycle_fence = (
copy.deepcopy(self.store.value), copy.deepcopy(self.leases)
)
raise
if action == "begin_verification":
session_id, _ = self.authenticate(peer_pid, request)
runtime = request.get("runtime")