tegwick
c30806b968
Some checks failed
Governed runtime contract / contract (push) Failing after 31s
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
333 lines
11 KiB
Python
333 lines
11 KiB
Python
"""Runs inside a network namespace: deterministic HTTP responses, no inference."""
|
|
|
|
import http.server
|
|
import json
|
|
import os
|
|
import subprocess
|
|
import threading
|
|
from pathlib import Path
|
|
|
|
root = Path("/work")
|
|
settings = json.loads((root / "case.json").read_text())
|
|
seen = []
|
|
guard_attempts = []
|
|
|
|
|
|
class Handler(http.server.BaseHTTPRequestHandler):
|
|
def log_message(self, *args):
|
|
pass
|
|
|
|
def do_POST(self):
|
|
body = json.loads(self.rfile.read(int(self.headers.get("Content-Length", 0))))
|
|
results = []
|
|
for message in body.get("messages", []):
|
|
if isinstance(message.get("content"), list):
|
|
results.extend(
|
|
{
|
|
"id": block.get("tool_use_id"),
|
|
"is_error": block.get("is_error", False),
|
|
}
|
|
for block in message["content"]
|
|
if block.get("type") == "tool_result"
|
|
)
|
|
seen.append(
|
|
{
|
|
"path": self.path,
|
|
"model": body.get("model"),
|
|
"max_tokens": body.get("max_tokens"),
|
|
"tools": [tool.get("name") for tool in body.get("tools", [])],
|
|
"tool_results": results,
|
|
"ambient_context_loaded": "AMBIENT_CONTEXT_SENTINEL"
|
|
in json.dumps(body),
|
|
}
|
|
)
|
|
if "count_tokens" in self.path:
|
|
self.send_response(200)
|
|
self.send_header("Content-Type", "application/json")
|
|
self.end_headers()
|
|
self.wfile.write(b'{"input_tokens":100}')
|
|
return
|
|
message_number = sum("count_tokens" not in request["path"] for request in seen)
|
|
if settings["case"] in ("tools", "guarded-tools") and message_number == 1:
|
|
blocks = [
|
|
{
|
|
"type": "tool_use",
|
|
"id": "tool_allowed",
|
|
"name": "Bash",
|
|
"input": {
|
|
"command": "git status",
|
|
"description": "Read fixture status",
|
|
},
|
|
},
|
|
{
|
|
"type": "tool_use",
|
|
"id": "tool_create",
|
|
"name": "Edit",
|
|
"input": {
|
|
"file_path": "/work/target/result.txt",
|
|
"old_string": "",
|
|
"new_string": "fixture-created\n",
|
|
},
|
|
},
|
|
{
|
|
"type": "tool_use",
|
|
"id": "tool_denied",
|
|
"name": "Bash",
|
|
"input": {
|
|
"command": "printf bypass > /work/denied-ran",
|
|
"description": "Fixture forbidden operation",
|
|
},
|
|
},
|
|
]
|
|
stop = "tool_use"
|
|
else:
|
|
blocks = [{"type": "text", "text": "fixture complete"}]
|
|
stop = "end_turn"
|
|
usage = {
|
|
"input_tokens": 60000
|
|
if settings["case"] in ("overrun", "guarded-overrun")
|
|
else 100,
|
|
"output_tokens": 0,
|
|
"cache_creation_input_tokens": 0,
|
|
"cache_read_input_tokens": 0,
|
|
}
|
|
events = [
|
|
(
|
|
"message_start",
|
|
{
|
|
"type": "message_start",
|
|
"message": {
|
|
"id": "msg_fixture_" + str(message_number),
|
|
"type": "message",
|
|
"role": "assistant",
|
|
"model": "claude-sonnet-4-6",
|
|
"content": [],
|
|
"stop_reason": None,
|
|
"stop_sequence": None,
|
|
"usage": usage,
|
|
},
|
|
},
|
|
)
|
|
]
|
|
for index, block in enumerate(blocks):
|
|
if block["type"] == "text":
|
|
start = {"type": "text", "text": ""}
|
|
delta = {"type": "text_delta", "text": block["text"]}
|
|
else:
|
|
start = {**block, "input": {}}
|
|
delta = {
|
|
"type": "input_json_delta",
|
|
"partial_json": json.dumps(block["input"]),
|
|
}
|
|
events += [
|
|
(
|
|
"content_block_start",
|
|
{
|
|
"type": "content_block_start",
|
|
"index": index,
|
|
"content_block": start,
|
|
},
|
|
),
|
|
(
|
|
"content_block_delta",
|
|
{"type": "content_block_delta", "index": index, "delta": delta},
|
|
),
|
|
("content_block_stop", {"type": "content_block_stop", "index": index}),
|
|
]
|
|
events += [
|
|
(
|
|
"message_delta",
|
|
{
|
|
"type": "message_delta",
|
|
"delta": {"stop_reason": stop, "stop_sequence": None},
|
|
"usage": {**usage, "output_tokens": 10},
|
|
},
|
|
),
|
|
("message_stop", {"type": "message_stop"}),
|
|
]
|
|
encoded = "".join(
|
|
"event: " + name + "\ndata: " + json.dumps(value) + "\n\n"
|
|
for name, value in events
|
|
).encode()
|
|
self.send_response(200)
|
|
self.send_header("Content-Type", "text/event-stream")
|
|
self.send_header("Content-Length", str(len(encoded)))
|
|
self.end_headers()
|
|
self.wfile.write(encoded)
|
|
|
|
|
|
server = http.server.ThreadingHTTPServer(("127.0.0.1", 0), Handler)
|
|
threading.Thread(target=server.serve_forever, daemon=True).start()
|
|
gate = meter = None
|
|
route_token = "fixture-no-provider-secret"
|
|
base_url = "http://127.0.0.1:" + str(server.server_port)
|
|
if settings["case"].startswith("guarded-"):
|
|
from datetime import UTC, datetime, timedelta
|
|
from types import SimpleNamespace
|
|
|
|
from llm_connect.messages_gate import MessagesPolicy, MessagesServer, RequestRefused
|
|
from rein_aharness.request_admission import RequestLedger
|
|
from rein_aharness.spend_admission import SpendLedger, SpendPolicy
|
|
|
|
class ObservedPolicy(MessagesPolicy):
|
|
def validate(self, data, betas):
|
|
row = {
|
|
"fields": sorted(data),
|
|
"betas": betas,
|
|
"context_management": data.get("context_management"),
|
|
"thinking": data.get("thinking"),
|
|
"output_config": data.get("output_config"),
|
|
}
|
|
guard_attempts.append(row)
|
|
try:
|
|
value = super().validate(data, betas)
|
|
row["liability_microusd"] = value
|
|
return value
|
|
except RequestRefused as exc:
|
|
row["refusal"] = str(exc)
|
|
raise
|
|
|
|
# Synthetic accepted bounds ONLY, never a live price/FX/authority packet.
|
|
policy = ObservedPolicy(
|
|
"fixture:no-live-tariff",
|
|
"claude-sonnet-4-6",
|
|
200000,
|
|
32000,
|
|
3,
|
|
15,
|
|
allowed_betas=(
|
|
"claude-code-20250219",
|
|
"interleaved-thinking-2025-05-14",
|
|
"thinking-token-count-2026-05-13",
|
|
"context-management-2025-06-27",
|
|
"prompt-caching-scope-2026-01-05",
|
|
"effort-2025-11-24",
|
|
),
|
|
)
|
|
cap = "0.01" if settings["case"] == "guarded-overrun" else "5"
|
|
private = root / "private"
|
|
private.mkdir(mode=0o700)
|
|
now = datetime.now(UTC)
|
|
expiry = (now + timedelta(minutes=5)).isoformat()
|
|
parent_policy = SpendPolicy(
|
|
"1",
|
|
"fixture",
|
|
"fixture:no-live-authority",
|
|
(now - timedelta(minutes=1)).isoformat(),
|
|
expiry,
|
|
"UTC",
|
|
"fixture-worker",
|
|
"fixture-definition",
|
|
"/work/target",
|
|
"fixture",
|
|
"harness.fixture@1.0.0",
|
|
"a" * 64,
|
|
"b" * 64,
|
|
"fixture-grant",
|
|
cap,
|
|
cap,
|
|
4,
|
|
"1",
|
|
cap,
|
|
cap,
|
|
cap,
|
|
)
|
|
parent = SpendLedger(private / "spend.sqlite3", parent_policy)
|
|
parent.initialize()
|
|
meter = RequestLedger(parent)
|
|
meter.initialize()
|
|
parent.reserve(
|
|
SimpleNamespace(
|
|
id="fixture-run",
|
|
activity_definition_id="fixture-definition",
|
|
idempotency_key="fixture",
|
|
attempt=1,
|
|
)
|
|
)
|
|
route_token = meter.bind_route(
|
|
"fixture-run", policy.sha256, lease_id="fixture-lease", expires_at=expiry
|
|
)
|
|
gate = MessagesServer(
|
|
policy,
|
|
meter,
|
|
provider_key="fixture-owner-only-key",
|
|
upstream_url=base_url,
|
|
allow_test_http=True,
|
|
)
|
|
gate.start()
|
|
base_url = "http://127.0.0.1:" + str(gate.port)
|
|
(root / "target" / ".claude").mkdir(parents=True)
|
|
(root / "target" / ".claude" / "settings.json").write_text(
|
|
json.dumps(
|
|
{
|
|
"permissions": {"allow": ["Bash"]},
|
|
"hooks": {
|
|
"SessionStart": [
|
|
{"hooks": [{"type": "command", "command": "touch /work/hook-ran"}]}
|
|
]
|
|
},
|
|
}
|
|
)
|
|
)
|
|
(root / "target" / ".mcp.json").write_text(
|
|
json.dumps(
|
|
{
|
|
"mcpServers": {
|
|
"fixture": {"command": "/bin/sh", "args": ["-c", "touch /work/mcp-ran"]}
|
|
}
|
|
}
|
|
)
|
|
)
|
|
(root / "target" / "CLAUDE.md").write_text("AMBIENT_CONTEXT_SENTINEL\n")
|
|
subprocess.run(["git", "init", "-q", str(root / "target")], check=True)
|
|
env = dict(
|
|
os.environ,
|
|
ANTHROPIC_BASE_URL=base_url,
|
|
ANTHROPIC_API_KEY=route_token,
|
|
CLAUDE_CONFIG_DIR="/work/config",
|
|
CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1",
|
|
DISABLE_AUTOUPDATER="1",
|
|
)
|
|
try:
|
|
proc = subprocess.run(
|
|
settings["argv"],
|
|
input="Run the deterministic fixture.",
|
|
text=True,
|
|
capture_output=True,
|
|
check=False,
|
|
env=env,
|
|
cwd="/work/target",
|
|
timeout=45,
|
|
)
|
|
terminal = json.loads(proc.stdout)
|
|
output = {
|
|
"returncode": proc.returncode,
|
|
"terminal": {
|
|
key: terminal.get(key)
|
|
for key in (
|
|
"type",
|
|
"subtype",
|
|
"is_error",
|
|
"total_cost_usd",
|
|
"num_turns",
|
|
"usage",
|
|
"permission_denials",
|
|
)
|
|
},
|
|
"requests": seen,
|
|
"markers": {
|
|
name: (root / name).exists()
|
|
for name in ("hook-ran", "mcp-ran", "denied-ran")
|
|
},
|
|
"created_file": (root / "target" / "result.txt").read_text()
|
|
if (root / "target" / "result.txt").exists()
|
|
else None,
|
|
"network_namespace": os.readlink("/proc/self/ns/net"),
|
|
"guard_attempts": guard_attempts,
|
|
"request_reservations": meter.status() if meter else [],
|
|
}
|
|
print(json.dumps(output))
|
|
finally:
|
|
if gate:
|
|
gate.stop()
|
|
server.shutdown()
|