Repository navigation
refactor!: restore package layering in src - #2244
jackie-cqz wants to merge 11 commits into
Conversation
The Artifact Processing Supervisor replaced in-process APScheduler activation in oceanbase#1523, which also removed the only `start_scheduler` call. The scheduler module, `BuiltinRuntime.start_scheduler`, the scheduled Source and Experience processors, the access-scoped runners the Server factory built for them, and the Scope enumeration helpers that only fed them were left without production callers. Remove that path and its tests. APScheduler stays a dependency because cron bindings still parse expressions with `CronTrigger`. `scheduler_path` on `open_builtin_runtime` and `create_server_app` is now deprecated: it is ignored and emits a DeprecationWarning. The `default_scheduler_path` helper and the `ScheduledSourceProcessor` and `ScheduledExperienceProcessor` exports are removed. In-repository callers, examples, and docs no longer pass or describe the scheduler sidecar. The enforced-mode startup test now checks the background-principal guard through the supervisor's worker security, where it applies, and separately checks that a schedule without a runnable family is rejected at startup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The built-in runtime imported `powercontext.server.authz` in 23 places, and `server.processing_security` imported the runtime composition root while the runtime lazily imported it back. Access control depends only on Core and built-in persistence, so it belongs below the Server. - Move `powercontext.server.authz` to `powercontext.builtin.authz`. - Split processing security: the child-side `WorkerSecuritySpec`, `WorkerSecurity`, and `open_worker_security` move to `powercontext.builtin.authz.worker`; `build_worker_security`, which reads `ServerSettings`, stays in `powercontext.server.processing_security`. - Split Dream access: `DreamAuthorization` in `powercontext.builtin.authz.dream` checks recorded Dream principals for processing children; the Server's `DreamAccess` subclass adds the request-principal Review checks and request IDs. - `deployment_runner` takes the database configuration instead of `ServerSettings`. - Move the `powercontext code` command to `powercontext.cli.code`. The built-in package no longer imports `powercontext.server`. BREAKING CHANGE: import access-control types from `powercontext.builtin.authz` instead of `powercontext.server.authz`. No compatibility alias is provided, because aliasing the old package path would load its submodules twice and break `isinstance` checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Server and the personal service imported `powercontext.cli.env_file` and `powercontext.cli.inference_notice`, and the built-in runtime imported redaction helpers from `powercontext.client.capture`. - Move the standard-library environment-file loader to `powercontext.env_file`. - Move the inference capability notice to `powercontext.server.inference_notice`; the `cli` and `service` commands already depend on the Server package. - Move the credential redaction primitives to `powercontext.redaction`. `powercontext.client.capture` keeps capture-event rendering and uses them. Import `powercontext.env_file` instead of `powercontext.cli.env_file`, and `known_secret_values` and the sensitive-key constants from `powercontext.redaction`. `render_capture_event` is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
|
The only failing check is This looks like a flaky test rather than something this PR introduced:
Could a maintainer please re-run the failed job? I don't have permission to re-run it myself. |
Resolve conflicts with the reusable database upgrade framework (oceanbase#2168): - Keep upstream's `deployment_runner(settings, ...)` and `server/database_migration.py`. The framework needs the full Server settings, so the narrower signature introduced with the access-control move no longer applies. The only remaining `builtin` -> `server` import is annotation-only (`TYPE_CHECKING`). - Adopt upstream's reworked startup tests, and drop `scheduler_path` from them and from the tests the framework added. - Point the upgrade release gate's managed inputs and its tests at `src/powercontext/builtin/authz`, so access control stays under the persistence compatibility review instead of silently leaving it. - Update the persistence digest and append a rationale sentence. The generated table and index DDL for all 59 tables is identical to master on the SQLite and MySQL dialects. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
hireview001
left a comment
hireview001
left a comment
There was a problem hiding this comment.
- Resolve merge conflicts with the target branch.
Resolve conflicts with durable owner recovery (oceanbase#2187), which added `server/authz/owner_recovery.py` while this branch moved `server/authz` to `builtin/authz`. - Place `owner_recovery.py` under `builtin/authz` and point its imports, the Server's `app.py` and `factory.py`, and the new owner-recovery tests at the new package path. - Keep the scheduled-runner helpers deleted: the owner-recovery change only threaded its session through `_scheduled_access_runners`, which no longer has a caller. - Drop `scheduler_path` from the call sites upstream added, and update the new `ops` and release-upgrade fixtures for the moved `env_file` and `authz` modules. - Merge the upgrade-support rationale with upstream's owner-recovery text and update the persistence digest. The generated table and index DDL for all 63 tables, including `pc_access_owner_recovery`, is identical to master on the SQLite and MySQL dialects. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
hireview001
left a comment
hireview001
left a comment
There was a problem hiding this comment.
- CI failed: Upgrade release gate (failure).
- CI failed: upgrade-acceptance / Verify the selected upgrade matrix (failure).
- CI failed: upgrade-acceptance / Upgrade 1.3.0 / oceanbase / full-server-code (failure).
- CI failed: upgrade-acceptance / Upgrade 1.3.0 / sqlite / full-server-vector (failure).
- CI failed: upgrade-acceptance / Upgrade 1.3.0 / oceanbase / full-server-vector (failure).
- CI failed: upgrade-acceptance / Upgrade 1.3.0 / sqlite / full-server-code (failure).
- CI failed: upgrade-acceptance / Upgrade 1.3.0 / seekdb / full-server-vector (failure).
- CI failed: upgrade-acceptance / Upgrade 1.3.0 / oceanbase / full-server-vector-code (failure).
- CI failed: upgrade-acceptance / Upgrade 1.3.0 / oceanbase / full-server-no-vector (failure).
- CI failed: upgrade-acceptance / Upgrade 1.3.0 / sqlite / full-server-vector-code (failure).
- Additional CI issues: PR checks.
|
|
||
| import httpx | ||
|
|
||
| from powercontext.builtin.authz import PrincipalRef |
There was a problem hiding this comment.
[P2] Preserve historical-release imports in the upgrade fixture
historical() runs this fixture with the source release's isolated interpreter, but PowerContext 1.3.0 has no powercontext.builtin.authz, so the new import aborts upgrade acceptance before migration begins. Select the appropriate import for each installed release so both source and target authorization checks remain executable.
There was a problem hiding this comment.
Confirmed on 42f8bcc6. The uploaded SQLite upgrade evidence contains source-authorization.log with ModuleNotFoundError: No module named 'powercontext.builtin.authz' at this line (failing job). I also checked an actual installed PowerContext 1.3.0 interpreter: powercontext.server.authz.PrincipalRef imports successfully, while powercontext.builtin.authz does not.
This is a regression in the shared source/target acceptance fixture: historical() calls verify_authorization(case, "source", ...) before any migration. Please select the authorization import supported by the installed release, retain the target-side check, and rerun the required automatic upgrade matrix. The current gate failure cannot establish whether the migration itself works.
There was a problem hiding this comment.
@jackie-cqz This remains unresolved on the current head, 42f8bcc6; no fix commit has been pushed since the previous review. The 1.3.0 upgrade jobs and the upgrade release gate are still failing. Please make this shared fixture import the authorization types supported by each installed release, keep both source and target authorization checks, and rerun the required automatic upgrade matrix before merging.
There was a problem hiding this comment.
@jackie-cqz Following up on the unresolved P2: the head is still 42f8bcc6, and the required 1.3.0 upgrade acceptance and release gate remain failed. Please push the release-compatible import fix, preserve authorization verification for both source and target installations, and rerun the required upgrade matrix. Could you provide an update on the fix and its expected timing?
There was a problem hiding this comment.
Thanks, and sorry for the delay. The root cause is confirmed, and the fix is pushed in a60ef4f.
Cause. I rewrote this import with a repo-wide path replacement and did not account for the fact that this script runs under each installed release's own interpreter. All ten failing cases fail identically at source-authorization.log (No module named 'powercontext.builtin.authz'); I checked the uploaded evidence of each. The unit tests never execute this script, which is why it slipped through.
Fix. The fixture now picks the package with importlib.util.find_spec("powercontext.builtin.authz") and otherwise uses powercontext.server.authz. I used find_spec rather than a try/except so that a broken built-in package still fails loudly on the target side instead of silently falling back. Both the source and the target authorization checks are unchanged.
What I verified locally, using the published 1.3.0 wheel and a wheel built from 42f8bcc, each in its own venv, running the scripts with python -I:
| Script | 1.3.0 | target wheel |
|---|---|---|
previous authorization_fixture.py |
ModuleNotFoundError (reproduces the CI error) |
imports |
fixed authorization_fixture.py |
imports (server.authz) |
imports (builtin.authz) |
processing_fixture.py, upgrade_database_probe.py |
import | import |
What I could not verify. The acceptance harness requires Linux process ownership, so I could not run the full matrix on my machine. The migration and target-side phases have therefore not executed on this PR yet, and I am not claiming they pass.
Timing. The branch also needs a merge with master (it currently conflicts, so CI will not start on it). My connection to GitHub is too unreliable at the moment to fetch master. I will merge it and push as soon as the connection recovers, and then follow the required automatic upgrade matrix in CI.
There was a problem hiding this comment.
Update: the branch is merged with current master (241398a) and pushed, so the conflict is gone and GitHub reports the PR as mergeable again. CI has started on this head, which includes the required 1.3.0 upgrade matrix running against the fixed fixture (a60ef4f).
Those runs are the first time the migration and target-side phases execute on this PR, because the source-side failure used to stop every case before migration began. I could not run that matrix locally, so I do not know yet whether it passes; if it shows anything beyond the import problem, I will deal with it separately.
The merge also pulled in two new upstream files that used the old authz path (source_management/gateway.py and the agent-tool-recovery evaluation server) and a monkeypatch target for the code command; I updated those as well.
There was a problem hiding this comment.
修复已在 head 241398a9 闭合，复核证据：
-
a60ef4fc把PrincipalRef的导入改为按importlib.util.find_spec("powercontext.builtin.authz")选择包。核对 1.3.0 实际产物（powercontext-1.3.0-py3-none-any.whl）：其中只有powercontext/server/authz/*共 9 个文件，powercontext/builtin/authz不存在，且server/authz/__init__.py导出PrincipalRef⇒ 历史解释器下回落到server.authz；目标解释器下走builtin.authz。source 侧与 target 侧的授权检查都保留，用find_spec而不是try/except也让 builtin 包损坏时照样报错，不会静默回退。 -
本次新增的合并提交（head 已是
a60ef4fc+ master0c1dfc28的合并）重新核对过解析：git merge-tree --write-tree显示 3 个文件需要人工处理——release/upgrade-support.json、src/powercontext/server/cli.py、tests/test_atomic_memory_migration_cli.py。逐个对照两侧：master 的v1_4_1_005/v1_4_1_006rationale 段完整保留，PR 的builtin.authz/powercontext.env_file/server.inference_notice导入迁移生效，两边内容都是并集而不是某一侧被覆盖；release/upgrade-support.json的persistence_sha256按 209 个MANAGED_INPUTS文件复算为e096057b0f2d3ebcbdc3009948d34797179ae2cbda5320c41de3a3d3d3aa4fb8，与声明一致。全树powercontext.*导入 0 处不可解析，无冲突标记残留。
尚未覆盖：本 head 的 19 个 check 目前仍 pending（quality、tests (*)、Acceptance (oceanbase) 均未完成），所以「1.3.0 升级验收在 CI 上全绿」仍没有 CI 证据，上面第 1 点只是对修复逻辑与 1.3.0 产物布局的源码级核对。
…ships The upgrade acceptance runs `authorization_fixture.py` under each installed release's own interpreter, before and after migration. It imported `PrincipalRef` from `powercontext.builtin.authz`, which exists only in the target wheel. PowerContext 1.3.0 keeps access control in `powercontext.server.authz`, so the source-side check failed with `ModuleNotFoundError` before any migration ran, failing every 1.3.0 case. Select the package with `importlib.util.find_spec` instead of a try/except, so a broken built-in package still fails loudly on the target side instead of silently falling back to the old path. Both the source and the target authorization checks stay in place. Checked against the published 1.3.0 wheel and the freshly built target wheel under `python -I`: the previous fixture reproduces the CI error under 1.3.0, and this one imports under both. The other two scripts run under historical interpreters (`processing_fixture.py`, `upgrade_database_probe.py`) import under both as well. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
Resolve conflicts with the dedicated database provisioning work (oceanbase#2031) and the other 48 commits that landed since the previous merge. - `server/cli.py`: keep both import sets, the relocated `builtin.authz` imports and the new database bootstrap errors. - `tests/test_atomic_memory_migration_cli.py`: take the new test setup and import access control from `powercontext.builtin.authz`. - `release/upgrade-support.json`: keep the rationale added upstream, append the sentence about this branch's code-organization changes, and recompute the persistence digest. The generated table and index DDL for all 64 tables, including the new `pc_source_write_plugins`, is identical to master on the SQLite and MySQL dialects. Follow the moves into code that arrived with the merge: - The new `source_management` gateway and the agent-tool-recovery evaluation server import access control from `powercontext.builtin.authz`. - `tests/test_cli.py` imports and patches the code command at `powercontext.cli.code`. - Drop `scheduler_path` from the two call sites added upstream. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
hireview001
left a comment
hireview001
left a comment
There was a problem hiding this comment.
- CI failed: Recall effort (OceanBase) (failure).
- CI failed: tests (3.13, unit) (failure).
- CI failed: tests (3.11, unit) (failure).
- CI failed: tests (3.14, unit) (failure).
- CI failed: tests (3.12, unit) (failure).
- CI failed: quality (failure).
- CI failed: Main (failure). Failed steps: quality / Run checks; tests (3.12, unit) / Run unit tests; tests (3.14, unit) / Run unit tests.
- CI failed: E2E harness (failure). Failed steps: Recall effort (OceanBase) / Check code and types on Linux.
|
CI status on 241398a: the 1.3.0 upgrade matrix now passes in full (all 12 cases plus "Verify the selected upgrade matrix"), so the fixture fix in a60ef4f worked. The six checks still failing are not caused by this PR;
Both causes are semantic conflicts between merged PRs, not conflicts in this one:
I confirmed the unit failures by running the same five test files on an unmodified checkout of |
hireview001
left a comment
hireview001
left a comment
There was a problem hiding this comment.
- Resolve merge conflicts with the target branch.
- CI failed: Recall effort (OceanBase) (failure).
- CI failed: tests (3.13, unit) (failure).
- CI failed: tests (3.11, unit) (failure).
- CI failed: tests (3.14, unit) (failure).
- CI failed: tests (3.12, unit) (failure).
- CI failed: quality (failure).
- CI failed: Main (failure). Failed steps: quality / Run checks; tests (3.12, unit) / Run unit tests; tests (3.14, unit) / Run unit tests.
- CI failed: E2E harness (failure). Failed steps: Recall effort (OceanBase) / Check code and types on Linux.
Resolve conflicts with the managed plugin framework (oceanbase#2246) and the 36 other commits that landed since the previous merge, including PreparedContext receipts (oceanbase#2258) and the consolidated CI (oceanbase#2285). - `server/authz/profiles.py` and `service.py` were edited upstream (`register_custom_artifact_access_family`, `prepare_resource`) after this branch moved the package. The edits apply to `builtin/authz` unchanged apart from the docstring and import-order edits already made here. - `server/app.py`, `server/factory.py`: keep the relocated `builtin.authz` imports and add only the names the new upstream code references. - Restructured upstream tests (`harness.py`, `test_lexical_admission.py`, `test_local_dashboard_access.py`, `test_unified_lexical_search.py`): take the upstream version and drop `scheduler_path` again. - `release/upgrade-support.json`: keep the rationale added upstream, append the sentence about this branch's code-organization changes, and recompute the persistence digest. The generated table and index DDL for all 72 tables is identical to master on the SQLite and MySQL dialects. Follow the moves into code that arrived with the merge: - The plugin framework's `builtin/runtime` modules import access control from `powercontext.builtin.authz` and the worker-side security from `powercontext.builtin.authz.worker`, so no new `builtin` -> `server` import is introduced. - Restore the `perf_counter` import in `builtin/runtime/application.py`; the receipt code uses it. - Drop the extra `scheduler` argument from the two harness helpers' new callers (`test_native_code_fixture.py`, `test_real_experience_skill_baseline.py`). - Point the CI change-selection test at `builtin/authz/owner_recovery.py`, which classifies the same way as the previous path. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
Resolve the conflict with the v1.5.0 release preparation (oceanbase#2395) and the 27 other commits that landed since the previous merge, including the Rust PowerContext Gateway executor (oceanbase#2307) and historical Server upgrade paths (oceanbase#2394). - `release/upgrade-support.json`: keep the target version and the rationale added upstream, append the sentence about this branch's code-organization changes, and recompute the persistence digest. The generated table and index DDL for all 72 tables is identical to master on the SQLite and MySQL dialects. Follow the moves into code that arrived with the merge: - `evaluation/performance/input_encoding/runner.py`: `_open_runtime` no longer takes a `scheduler_path`, and its callers stop passing one. - Four new input-encoding and context-protection tests stop passing `scheduler_path` to `open_builtin_runtime` and `create_server_app`. - Three new tests import access control from `powercontext.builtin.authz`. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
hidb4ai
left a comment
hidb4ai
left a comment
There was a problem hiding this comment.
Reviewed 1e487049 against 9c8f061c. The historical-release authorization import regression is fixed, and the required 1.3.0 upgrade matrix and Upgrade release gate pass. I found no remaining PR-introduced blocking defect; the database table/index definitions and HTTP/MCP operation contracts are unchanged.
The CI result is still red because the Python 3.11 and 3.14 code-seekdb shard-0 jobs exceeded their 30-minute job limit; the same shards also time out on master. @jackie-cqz Please obtain successful completion of these checks before merging. This approval does not certify those unfinished shards.
|
@jackie-cqz The head is still Please obtain successful completion of these shards and the aggregate CI gate before merging. The historical-release authorization import issue is fixed; this follow-up concerns the remaining CI completion requirement. |
Resolve conflicts with ownership migration when enabling enforcement (oceanbase#2304), Source evidence declarations (oceanbase#2004), and the 13 other commits that landed since the previous merge. - `server/authz/keys.py` is new upstream; it lands in `builtin/authz/keys.py` and `builtin/authz/__init__.py` exports `bounded_idempotency_key` and `IDEMPOTENCY_KEY_LIMIT` from there. - `server/processing_security.py` keeps only `build_worker_security`. The upstream change to `WorkerSecurity` (bounded idempotency keys) is applied to `builtin/authz/worker.py`, where this branch moved that class. - `server/app.py`, `server/factory.py`, `server/cli.py`: keep the relocated `builtin.authz` imports and add only the names the new upstream code uses (`bounded_idempotency_key`, `OwnerRecovery`). `_scheduled_access_runners` stays deleted; its only upstream change was the bounded key. - `release/upgrade-support.json`: keep the rationale added upstream for the v1_5_0_002 and v1_5_0_003 revisions, append the sentence about this branch's code-organization changes, and recompute the persistence digest. The generated table and index DDL for all 75 tables is identical to master on the SQLite and MySQL dialects. Follow the moves into code that arrived with the merge: - `server/ownership.py`, `builtin/authz/service.py` (new `static_scope_bootstrap_would_grant`), and the new ownership-migration, artifact-plugin, and access-control tests import access control from `powercontext.builtin.authz`. - The new ownership-migration, Atomic Memory evidence, and Source evidence tests stop passing the removed `scheduler_path` argument. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
|
@jackie-cqz I reviewed the new head I found no new demonstrated code defect in the refactor. Local replay hit startup/flush timing limits on both head and base, so it does not establish that this PR caused the CI timeout. Please obtain a successful E2E run and complete the selected automatic upgrade matrix for this head before merging. The passing upgrade evidence and my previous approval for |
Bring in the two commits that landed since the previous merge: the website SEO and Markdown export changes (oceanbase#2454) and the OpenCode setting that turns prompt-time recall off (oceanbase#2455). The merge is textually clean. Neither commit touches `src/`, so nothing needed to follow the access-control, scheduler, or helper moves. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
Which issue or RFC does this PR close?
No tracking issue. This follows up on the Artifact Processing Supervisor
(RFC 1515, #1523),
which replaced the APScheduler path removed here.
Rationale for this change
A static import scan of
src/powercontext(module-level, deferred, andTYPE_CHECKINGimports) found lower layersimporting upper ones:
builtin→serverTYPE_CHECKING)builtin→clientserver→cliservice→cliThe deferred imports hid a cross-layer cycle:
server/processing_security.pyimported the runtime composition root atmodule level while the runtime imported it back inside functions. Separately, the in-process APScheduler activation
path stayed in the runtime after #1523 removed its only caller.
What changes are included in this PR?
Three commits that can be reviewed one at a time:
refactor(runtime): remove the legacy APScheduler scheduling pathbuiltin/runtime/scheduler.py,BuiltinRuntime.start_scheduler,ScheduledSourceProcessor,ScheduledExperienceProcessor, the access-scoped scheduled runners inserver/factory.py, and the Scopeenumeration helpers that only fed them, together with their tests.
scheduler_pathonopen_builtin_runtimeandcreate_server_appis deprecated: it is ignored and emits aDeprecationWarning.powercontext.paths.default_scheduler_pathis removed.CronTrigger.describe the scheduler sidecar.
refactor(authz)!: move access control into the built-in runtimepowercontext.server.authz→powercontext.builtin.authz. It already depended only on Core and built-inpersistence.
WorkerSecuritySpec,WorkerSecurity,open_worker_security) moves tobuiltin/authz/worker.py.build_worker_securitystays inserver/processing_security.pybecause it readsServerSettings.DreamAuthorization(builtin/authz/dream.py) holds the recorded-principal checks processing children need. TheServer's
DreamAccesssubclass adds the request-principal Review checks and request IDs.powercontext codecommand moves topowercontext.cli.code; the entry point is updated and the command isunchanged.
refactor: move shared helpers out of thecliandclientpackagespowercontext.cli.env_file→powercontext.env_file(standard library only).powercontext.cli.inference_notice→powercontext.server.inference_notice.powercontext.redaction;powercontext.client.capturekeeps capture-eventrendering and uses them.
Merge branch 'master'(seven merges): resolves conflicts with the reusable database upgrade framework(feat(migrations): complete the reusable database upgrade framework #2168), durable owner recovery (feat(authz): recover external owner writes from durable intents #2187), dedicated database provisioning (feat(storage): provision dedicated seekdb and oceanbase databases #2031), and the managed plugin
framework (feat(artifact): add managed plugin framework and some example #2246), plus the v1.5.0 release preparation (chore(release): prepare v1.5.0 and refresh product screenshots #2395) and ownership migration when enabling
enforcement (fix(access): support ownership migration when enabling enforcement #2304)
deployment_runner(settings, ...)andserver/database_migration.py. The framework needs thefull Server settings, so the access-control move no longer narrows that signature. This leaves one
annotation-only (
TYPE_CHECKING)builtin→serverimport, inbuiltin/persistence/migrations/deployment.py.MANAGED_INPUTSand its tests atsrc/powercontext/builtin/authz.managed_digestskips a missing directory silently, so without this the gate would have stopped coveringaccess control.
owner_recovery.pyunderbuiltin/authzand rewrites its imports,server/app.py,server/factory.py, and the new owner-recovery tests for the new package path. The only code from that PR inthe scheduled-runner helpers this PR deletes was the owner-recovery session threaded through them; with no
caller left, the helpers stay deleted.
server/cli.py, takes the new test setup intests/test_atomic_memory_migration_cli.py, and follows the moves into code that arrived with the merge: thenew
source_managementgateway and the agent-tool-recovery evaluation server import access control frombuiltin.authz,tests/test_cli.pyimports and patches the code command atpowercontext.cli.code, andthe two
scheduler_patharguments added upstream are dropped.release/upgrade-support.json: the persistence digest, plus one rationale sentence in the existingstyle, kept alongside the rationale upstream added. The generated table and index DDL for all 75 persistence
and access tables, including
pc_access_owner_recovery,pc_source_write_plugins, and the plugin framework'stables, is identical to
masteron the SQLite and MySQL dialects, so no table layout or migration encodingchanges. This is a maintainer-owned declaration; please confirm the wording.
server/authz/profiles.pyandservice.pyafter this branch had moved them, and git applied those edits tobuiltin/authz. The newplugin-framework modules under
builtin/runtimeand their tests import access control frombuiltin.authzand the worker-side security from
builtin.authz.worker, so the framework adds no newbuiltin→serverimport. Three follow-ups the merge needed: the
perf_counterimport that the first commit removed isrestored because PreparedContext receipts (feat(context): add bounded PreparedContext receipts #2258) use it, two new tests (fix(tests): initialize native Code Server storage before seeding #2348) stop passing the removed
schedulerargument to the harness helpers, and the CI change-selection test uses the new path ofowner_recovery.py, which classifies the same way.tyfound the two helper callers; a search for thescheduler_path=keyword could not, because they pass it positionally.9c8f061c, 28 commits: the v1.5.0 release preparation (chore(release): prepare v1.5.0 and refresh product screenshots #2395), the Rust PowerContextGateway executor (feat(gateway): add Rust PowerContext Gateway executor #2307) and its conversation-scoped injection (feat(gateway): inject prepared context into Responses requests #2400, fix(gateway): prepare once per user message within a conversation and replay it #2416, feat(gateway): inject by default in combined deployments for host conversations #2417), historical Server upgrade
paths (fix(migrations): support historical Server upgrade paths #2394), and the final request and response privacy checks with their input-encoding evaluation (feat(inference): enforce final request and response privacy checks #2311)):
the only textual conflict was
release/upgrade-support.json,where upstream raised the target to 1.5.0 and extended the rationale for the historical upgrade paths. This PR
keeps that text, re-appends its own sentence, and recomputes the digest; the gate passes. Six files added
upstream still used moved or removed names: the input-encoding evaluation runner
(
evaluation/performance/input_encoding/runner.py) and four new tests passedscheduler_path, and three newtests imported from
powercontext.server.authz. The runner's_open_runtimehelper drops itsscheduler_pathparameter and the tests import from
powercontext.builtin.authz; nothing else needed editing.1190dcbb, 75 commits: ownership migration when enabling enforcement (fix(access): support ownership migration when enabling enforcement #2304), Sourceevidence declarations (feat(memory): persist versioned Source evidence and neutral Atomic Memory projection #2004), and Desktop Linux diagnostics (feat(desktop):add Linux disgnostics integration #2343)): fix(access): support ownership migration when enabling enforcement #2304 added
server/authz/keys.py, which git placed atbuiltin/authz/keys.pyby rename detection, andserver/ownership.py, and it editedWorkerSecurityinserver/processing_security.py, which this branch hadsplit. The class lives in
builtin/authz/worker.py, so the three bounded idempotency keys are applied there andprocessing_security.pykeeps onlybuild_worker_security. Inserver/app.py,factory.py, andcli.pythebranch's
builtin.authzimports are kept, plusbounded_idempotency_keyandOwnerRecovery, which the new codeuses;
_scheduled_access_runnersstays deleted.release/upgrade-support.jsontakes upstream's text for the newv1_5_0_002andv1_5_0_003revisions, re-appends this PR's sentence, and recomputes the digest. A newstatic_scope_bootstrap_would_grantmethod and the new ownership tests importedserver.authz, and 18 calls intests/e2e/test_access_ownership_migration.pyplus two other tests passedscheduler_path; all are updated.code-seekdbjob timeout from 30 to 60 minutes in this range. The twocode-seekdb (…, 0)failures on the previous head were that job hitting the 30-minute limit in the unifiedmigrations step, and the same limit cancelled
code-seekdb (3.11, 0)onmaster.2853ed98, 2 commits: the website SEO and Markdown export changes (feat(website): improve SEO, Markdown exports, and community links #2454) and theOpenCode setting that turns prompt-time recall off (feat(opencode): add a setting that turns prompt-time recall off #2455)): textually clean. Neither commit touches
src/, sonothing needed to follow the moves.
test(release): import the access-control types the installed release shipstests/release_upgrades/authorization_fixture.pyunder each installed release'sown interpreter, before and after migration. The path rewrite in commit 2 made it import
powercontext.builtin.authz, which PowerContext 1.3.0 does not have, so every 1.3.0 case failed withModuleNotFoundErrorbefore migration started. The fixture now chooses the package withimportlib.util.find_spec, and both the source and target authorization checks are unchanged.Reverse edges that remain and are out of scope:
server→service(5 imports indatabase_migration.py, wheredb-migratestops the personal service before migrating, and in the newerdatabase_admission.py), and onecore→builtinimport inartifacts/indexes.pythat #2246 introduced and this PR does not touch.Are there any user-facing changes?
For Python SDK and embedding users, yes. There are no HTTP, MCP, CLI, configuration, or persisted-format changes.
powercontext.builtin.authzinstead ofpowercontext.server.authz.No alias is provided, because aliasing the old package path would load its submodules a second time and break
isinstancechecks. Jupyter tutorial 13 is updated.powercontext.cli.env_fileis nowpowercontext.env_file.default_scheduler_pathand theScheduledSourceProcessor/ScheduledExperienceProcessorexports are removed.known_secret_valuesand thesensitive-key constants are imported from
powercontext.redaction;render_capture_eventis unchanged.scheduler_pathkeyword onopen_builtin_runtimeandcreate_server_app.are updated in both locales.
How was this change tested?
master(c9c9448b):uv run python -m pytest -n auto --doctest-modulesgives 9179passed, 934 skipped, 17 failed. Fourteen of the failures also occur on an unmodified checkout of
master(
1190dcbb) in my environment; I ran those three files there and the failure sets are identical. They are intests/test_source_management.py(9),tests/e2e/test_source_collect.py(3), andtests/e2e/test_source_deployment.py(2). I did not classify all 14 onmaster; the full run on this branch showsSource background processes currently require Linux(this machine is macOS) in 9 of them. The other three aretest_candidate_replay_sqlite[rename],test_chunked_http_error_body_respects_the_absolute_budget, andtest_large_changes_response_obeys_elapsed_and_byte_budgets. I ran the full suite while other checks shared themachine (it took 36 minutes where the previous run took 12), and two of the three are named for elapsed-time
budgets. All three pass when their files are run alone, both on this branch and on
master(92 passed, 6 skipped each).a3ee50dd) I did not rerun the full suite, because the two commits change no Python undersrc/. I ran the tests for the files they touch (integration manifest and guidance, blog site, OpenCode, CI scope,remote-access docs: 247 passed, 7 skipped) and
tests/e2e/test_zcode_service_chain.pythree times (2 passed each time).make checkpasses ona3ee50ddwhen run separately:version-check, pinned workflow actions,integration-manifest-check,integration-guidance-check,upgrade-policy-check,uv lock --locked, all 11prek hooks, and
ty checkfor the package (no diagnostics) and for the Pydantic AI integration. I ran them one byone because
make checkitself stopped on a network error while prek fetched its hook repositories on my machine.test_enforced_mode_cannot_silently_start_without_authentication_or_providerdepended on validation inside theremoved scheduled runners. It now checks the background-principal guard through
build_worker_securitywith arunnable family, and checks that a schedule with no runnable family is still rejected at startup.
byte-identical between
masterand this branch on the SQLite and MySQL dialects.scheduler_pathis ignored with aDeprecationWarningand creates no sidecar, for bothopen_builtin_runtimeandcreate_server_app.ty check, and focused tests (369, 419, and 590 passed). The second commit's batchalso reported
fixture 'migration_backend' not foundfor one e2e test; the same pytest arguments produce the sameerror on
master, and the test passes alone and in the full run.builtin/authz/dream.pykeepsannotation-only imports under
TYPE_CHECKINGso it does not trigger the existingbuiltin.dream.service↔builtin.runtimeimport cycle.its own venv and run with
python -I, the previousauthorization_fixture.pyreproduces the CI error under 1.3.0and the new one imports under both.
processing_fixture.pyandupgrade_database_probe.pyalso import underboth.
make notebooks-test, real-service e2e (--run-real-e2e),toxacross Python versions, and theinstalled-artifact upgrade acceptance matrix (
upgrade-release.yml). The harness requires Linux processownership and cannot run on macOS, so the migration and target-side phases are checked only by CI; only the
policy check was run locally.
AI usage statement
Built with Claude Code. Claude Opus 5.5 did the analysis, implementation, tests, and commit split. Claude Sonnet 5.5
performed the initial read-only repository exploration through subagents, resolved the merge conflicts, and updated
this description. Changes were validated with the commands listed above.
🤖 Generated with Claude Code