Files
nisse/nisse-dev/src/nisse_dev/canonical.py
T
dongarandClaude Opus 5.5 ea4376eaa1
CI / checks (push) Skipped
CI / checks (pull_request) Successful in 2m10s
CI / e2e (pull_request) Successful in 10m30s
M3.1: action classes and the fast path
Every execution tool call, the driver's and a helper's, gets a verdict
from code before it runs (P3, P4, D6).

- nisse_core.actions, nisse-core's first code: Action and Verdict, and
  reading shell commands statically, segment by segment (cd, wrappers,
  sh -c). What can't be read that way is unknown; a line is as bad as
  its worst command.
- nisse_dev.loop.actions, the rule table: reading, checks and tests are
  harmless; workspace edits, local git and installs on the build VM are
  contained; pushing, other hosts, uploads, publishing, the forge's own
  tools, deleting outside the workspace and wrecking the VM are
  dangerous; changing branches by hand is refused (the harness owns
  branches) with a pointer to the milestone tools.
- A dangerous call isn't run. The item waits on the operator with a
  question rendered from the action, and `allow` lets exactly that
  action run once. A helper can't ask, so it is refused and told to
  hand back. Unknown actions run, logged, until the classifier (M3.2).
- Every verdict is an action_verdict event, which no model sees, and an
  oplog line; `details` shows the counts and every action not simply
  run.
- The property walk gains dangerous_only_when_allowed (checked against
  a mutant that doesn't use the allow up); the slice e2e checks every
  call was judged and none needed an allow.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE
2026-10-08 04:32:13 +00:00

169 lines
4.1 KiB
Python

"""Canonical transcript schema (architecture L7).
The durable record is this event log, never a provider-shaped ``messages``
array; provider request bodies are rendered from it at call time. Canonical
tool-call IDs are minted locally — provider IDs are mapped at the boundary and
never used as a join key.
Transcript appends are the conversation record itself, not state-machine
mutations, so they are deliberately outside the L12 state-change taxonomy.
"""
import uuid
from dataclasses import asdict, dataclass, fields
from typing import Any
@dataclass(frozen=True)
class UserMessage:
text: str
source: str # e.g. a Matrix event ID
@dataclass(frozen=True)
class AssistantText:
text: str
model: str
@dataclass(frozen=True)
class ToolCall:
call_id: str # canonical, minted locally via mint_call_id()
tool: str
arguments: dict[str, Any]
@dataclass(frozen=True)
class ToolResult:
call_id: str
result: str
success: bool
@dataclass(frozen=True)
class PlanSubmitted:
plan: str
model: str
@dataclass(frozen=True)
class GateOpened:
gate: str
reason: str
@dataclass(frozen=True)
class DelegationStarted:
brief: str
role: str
model: str # the alias asked for, e.g. "remote-architecture"
caps: dict[str, Any] # turns / tokens / wall-clock limits
# What the alias resolved to at task start. An alias is free to change
# models between tasks, so eval history (L9) keyed on the alias alone
# would average results across whatever it happened to point at.
backing_model: str = ""
@dataclass(frozen=True)
class DelegationCompleted:
handback: str
artifacts: list[str]
tokens: int
duration_s: float
exit_status: str
@dataclass(frozen=True)
class Fact:
"""Something the orchestrator knows that the models must too (L6, L7):
a plan approved, a milestone finished, a PR opened. Written by the
orchestrator; every role sees it, as a statement rather than a turn."""
text: str
@dataclass(frozen=True)
class ActionVerdict:
"""What the fast path made of a tool call before it ran (P4, L4): a
record for the log, the operator and the classifier's evaluation set,
never shown to a model."""
call_id: str
tool: str
effect: str # harmless | contained | unknown | dangerous | refused
rule: str
reason: str
decision: str # ran | refused | asked | allowed
@dataclass(frozen=True)
class Compaction:
summary: str
model: str
replaces: list[int] # [first_id, last_id] inclusive range replaced
CanonicalEvent = (
UserMessage
| AssistantText
| ToolCall
| ToolResult
| PlanSubmitted
| GateOpened
| DelegationStarted
| DelegationCompleted
| Fact
| ActionVerdict
| Compaction
)
EVENT_TYPES: dict[str, type] = {
"user_message": UserMessage,
"assistant_text": AssistantText,
"tool_call": ToolCall,
"tool_result": ToolResult,
"plan_submitted": PlanSubmitted,
"gate_opened": GateOpened,
"delegation_started": DelegationStarted,
"delegation_completed": DelegationCompleted,
"fact": Fact,
"action_verdict": ActionVerdict,
"compaction": Compaction,
}
_TYPE_NAMES = {cls: name for name, cls in EVENT_TYPES.items()}
@dataclass(frozen=True)
class StoredEvent:
id: int
ts: str
event: CanonicalEvent
# The work item it belongs to (None: agent-level, L6) and the role that
# produced it (L7). Rendering uses both.
work_item: str | None = None
actor: str = ""
def mint_call_id() -> str:
return f"call-{uuid.uuid4().hex}"
def event_type(event: CanonicalEvent) -> str:
return _TYPE_NAMES[type(event)]
def to_payload(event: CanonicalEvent) -> dict[str, Any]:
return asdict(event)
def from_payload(type_name: str, payload: dict[str, Any]) -> CanonicalEvent:
cls = EVENT_TYPES.get(type_name)
if cls is None:
raise ValueError(f"unknown canonical event type: {type_name!r}")
known = {f.name for f in fields(cls)}
unknown = payload.keys() - known
if unknown:
raise ValueError(f"unknown fields for {type_name}: {sorted(unknown)}")
return cls(**payload)