jwu UdZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z m Z mZddlmZmZmZmZmZmZmZmZddlmZmZmZmZej:eZd Z d e!d <d Z"d e!d <ejFdZ$de!d<ejFdejFdejFdejFdejFdejFdejFdejFdejFdejFdf Z%de!d<dZ&de!d<ed !Gd"d#Z'Gd$d%e(Z)Gd&d'e(Z*Gd(d)e+Z,Gd*d+e(Z-d=d,Z.d>d-Z/d?d@d.Z0ejFd/Z1de!d0<d1Z2de!d2<d3Z3d e!d4<dd5dAd6Z4dBd7Z5Gd8d9Z6 dCd:Z7 dDd;Z8d@d<Z9y)Euanu_v2.owner_trigger_only — OWNER_TRIGGER_ONLY_CAPABILITY core module. 회장 §명시 14장 1:1 박제 (2026-05-11 KST, OWNER_TRIGGER_ONLY_CAPABILITY). task-2554+1 회장 §명시 (2026-05-12 KST) HIGH race condition fix 반영. task-2554+2 회장 §명시 (2026-05-12 KST) §1 1:1 완성: - ``RESULT_PENDING`` import + sentinel 활용. - ``http_post`` 호출 직전 ``txn.record(PENDING)`` 으로 영구 기록 — process crash 후 다음 runner 가 DEDUPED 판정 (crash-safety fail-closed). task-2563 회장 §명시 (2026-05-13 KST) FUC-3 hardening 반영: - ``logger.exception(...)`` 을 http_post 실패 경로 ``txn.record(FAILED)`` 호출 전에 추가. - secret masking 강제: token / Authorization / api_key 등은 ``_redact_diagnostics`` 로 redact. - audit fail-closed 속성 유지 (token_value_logged=False, token_hash_prefix 보존). 본 모듈 범위: - public action **1 종**: ``POST_GEMINI_REVIEW_TRIGGER_COMMENT`` - comment body 상수 (외부 입력 X): ``COMMENT_BODY = "/gemini review"`` - 단일 허용 endpoint: ``POST /repos/{owner}/{repo}/issues/{pr_number}/comments`` - 금지 11 endpoint hard-block (``PermissionError`` raise) - 전용 token 1 종: ``OWNER_GEMINI_TRIGGER_TOKEN`` (다른 token fallback 0) - merge path 와 완전 분리: ``BOT_GITHUB_TOKEN`` 본 모듈 어디서도 사용 0 - dedupe atomic (audit JSONL + fcntl flock + sidecar lock transaction) - token redaction guard (audit 에 raw value 미출력) - decision JSON v1 검증 fail-closed - result enum: POSTED / DEDUPED / FAILED / PENDING result 흐름 (task-2554+2 §1): 1. txn.check_dedupe (POSTED + PENDING) 2. (DEDUPED 인 경우 audit DEDUPED + return) 3. token presence + hash_prefix 계산 4. **txn.record(PENDING)** — http_post 직전 영구 기록 (crash-safety) 5. http_post 호출 6. 성공: txn.record(POSTED) / 실패: txn.record(FAILED) one-way isolation: anu_v2/ 외부 import 금지. ) annotationsN) dataclass)Path)AnyCallableFinal)AuditRedactionErrorDedupeViolationOwnerTriggerAuditRESULT_DEDUPED RESULT_FAILEDRESULT_PENDING RESULT_POSTEDtoken_hash_prefix)ALLOWED_ACTIONALLOWED_COMMENT_BODYDecisionInvalidErrorvalidate_decisionz/gemini reviewz Final[str] COMMENT_BODYOWNER_GEMINI_TRIGGER_TOKENTOKEN_ENV_NAMEz(^/repos/[^/]+/[^/]+/issues/\d+/comments$zFinal[re.Pattern[str]]_ALLOWED_PATH_REz/pulls/\d+/merge\bz/pulls/\d+/reviews\bz /git/refs\bz /contents\bz/issues/\d+(?:\?|$)z /labels\bz /branches\bz$/actions/(?:runs|workflows)/.*/rerunz3/check-runs/.*/rerequest|/check-suites/.*/rerequestz/pulls/\d+\?|/pulls/\d+$z"Final[tuple[re.Pattern[str], ...]]FORBIDDEN_ENDPOINT_PATTERNS)BOT_GITHUB_TOKENGH_TOKEN GITHUB_TOKEN OWNER_PAT PAT_TOKENzFinal[tuple[str, ...]]FORBIDDEN_TOKEN_ENV_NAMEST)frozencpeZdZUdZded<ded<ded<ded<ded<ded <d ed <ded <d Zded<y ) TriggerResultuP``trigger_gemini_review`` 결과 객체. token / authorization header 미포함.strstatusintprheadaction comment_bodyendpointbool token_presentrN str | None error_code)__name__ __module__ __qualname____doc____annotations__r.;/home/jay/workspace/scripts/../anu_v2/owner_trigger_only.pyr"r"js:Z K G I KM!J !r5r"ceZdZdZy)ForbiddenEndpointErroru9금지 11 endpoint 호출 시도 (회장 §7 hard-block).Nr/r0r1r2r4r5r6r8r8|sCr5r8ceZdZdZy)TokenBoundaryViolationu-다른 token 사용 시도 (회장 §6 fail).Nr9r4r5r6r;r;s7r5r;ceZdZdZy)CommentBodyViolationuKCOMMENT_BODY 외부 변조 / 외부 입력 사용 시도 (회장 §4 fail).Nr9r4r5r6r=r=sUr5r=ceZdZdZy)MergePathViolationuGmerge_queue_executor merge path 와의 분리 위반 (회장 §9 fail).Nr9r4r5r6r?r?sQr5r?ct|tr|rd|vr tdt|tr|rd|vr tdt|trt|ts|dkr tdd|d|d|dS) N/z,owner must be a non-empty string without '/'z+repo must be a non-empty string without '/'rz pr_number must be a positive intz/repos/z/issues/z /comments) isinstancer# ValueErrorr%r+)ownerrepo pr_numbers r6_build_post_comment_pathrGs eS !#,GHH dC t FGG i %It)D UV;<< UG1TF(9+Y ??r5c6t|tr|jdk7rtd|t|ts tdtD]!}|j |std|t j|std|y)z+static + dynamic endpoint hard-block guard.POSTzforbidden method: zpath must be stringzforbidden endpoint path: z8path not in allow-list (POST issues/{n}/comments only): N)rBr#upperr8rsearchrmatch)methodpathpats r6assert_endpoint_allowedrPs fc "flln&>$'9&%DEE dC $%:;;*O ::d (+DTH)MN NO  ! !$ '$H Q   (r5cT|ytD]}||vstd|dtdy)utoken 경계 검증 (회장 §6). 명시적으로 ``env`` dict 에 다른 token env 이름이 키로 전달되면 fail. Nzforbidden token env injected: u! — owner trigger path must use  only)rr;r)env forbiddens r6assert_token_boundaryrUsI  {.  (0 <*+52 r5z5(?i)(token|authorization|api[_-]?key|secret|password)_REDACT_KEY_RE)Bearer ghp_ github_pat_ghu_ghs_ghr__REDACT_VALUE_SENTINELSz _REDACTED_PLACEHOLDER_depthcdk\rtS|t|tttfr|St|t r7|j }tD]}|j |vstcS|St|trYi}|jD]B\}}t |}tj|r t||<0t|dz||<D|St|tr|Dcgc]}t|dzc}St|trtfd|DS t |} | j } tD]}|j | vstcS| Scc}w#t$rI t!|j"} n#t$rd} YnwxYwt$j'd| dtcYSwxYw) u}dict / list / tuple / str 입력에서 token/Authorization/api_key 등 secret 을 masking. 회장 §6 + task-2563 FUC-3 1:1: logger.exception 으로 diagnostic 박제 시 token 원문 / Authorization header / api_key 등이 로그에 누출되지 않도록 보수적 마스킹. 동작: - dict: 키가 ``_REDACT_KEY_RE`` 패턴과 매치되면 값을 ``""`` 로 교체. 그 외 키도 값 자체에 sentinel 포함 시 redact (defense in depth). - list / tuple: 원소를 재귀적으로 redact (튜플은 동일 타입 보존). - str: ``_REDACT_VALUE_SENTINELS`` 중 하나라도 포함되면 전체 redact. - int / bool / float / None: 그대로 반환. - 그 외: ``str(data)`` 로 변환한 뒤 위 규칙 적용 (방어적). 재귀 깊이 상한 (``_depth >= 8``) — 비정상 입력에 대한 stack overflow 방지. r_c3>K|]}t|dzyw)rcr_N)_redact_diagnostics).0vr`s r6 z&_redact_diagnostics..s M1(6A:>>MsunknownuHredaction str() conversion failed for type=%s — redacting fail-closed.T)exc_info)r^rBr+r%floatr#lowerr]dictitemsrVrKrelisttuple Exceptiontyper/loggerwarning) datar` data_lowersentinelresultkeyvaluekey_strrgtext type_name text_lowers ` r6reres {$$ |z$sE(:; $ZZ\ / -H~~:-,, - $**, PJC#hG$$W-"7w"5eFQJ"Ow  P  $CGHa#Afqj9HH$MMMM %4yJ+) >> z )( () K+I  % "T ++I "!I " V   %$ %s<0E1/ E66 GFG F$!G#F$$!GGcri}dD]&}t||d}t|ts!||d<nt|dd}t|trN|j Dcic]\}}t |j |!}}}dD]}||vs||||<t|dd} | r d|vr| |d<|Scc}}w)uGhttp_post 예외 객체에서 GitHub diagnostic 필드를 보수적으로 수집. 수집 대상 (모두 optional, 미존재 시 skip): - status (HTTP status code) — ``exc.status`` / ``exc.code`` - x-github-request-id — ``exc.response_headers["x-github-request-id"]`` - x-accepted-github-permissions - documentation_url — ``exc.response_headers["documentation_url"]`` or ``exc.documentation_url`` 반환된 dict 은 호출자가 반드시 ``_redact_diagnostics`` 로 마스킹한 뒤 logger 에 전달해야 한다. )r$ status_codecodeNr$response_headers)zx-github-request-idzx-accepted-github-permissionsdocumentation_urlr)getattrrBr%rmrnr#rl) excdiagattrrzheaderskrglowered header_keydoc_urls r6_collect_http_diagnosticsr sD1T4( eS !"DN   c-t4G'4 18AA3q6<<>1$AA  7J W$#*:#6Z  7c.5G&d2$+ ! KBs$B3czeZdZdZdd d dZd dZddd ddZdZd Zd Z d Z y)OwnerTriggerOnlyu3OWNER_TRIGGER_ONLY_CAPABILITY 단일 진입점. public action: ``trigger_gemini_review(decision_path, owner, repo, current_head_actual)``. side-effect 추상화 (test injection): - ``http_post``: ``Callable[[method:str, path:str, body:dict, headers:dict], dict]`` - ``token_provider``: ``Callable[[], str]`` — OWNER_GEMINI_TRIGGER_TOKEN value 반환. task-2554+2 §1 흐름: 1. token boundary 검증 2. decision JSON 검증 3. comment_body 검증 4. endpoint hard-block 5. ── ATOMIC TRANSACTION ──────────────────────────────── 5a. audit.transaction() 진입 (sidecar lock LOCK_EX) 5b. txn.check_dedupe (POSTED + PENDING) 5c. DEDUPED 시 audit record + return 5d. token presence + hash_prefix 계산 5e. **txn.record(PENDING)** — http_post 호출 직전 영구 기록 (crash-safety) 5f. http_post 호출 5g. 성공 시 audit POSTED / 실패 시 audit FAILED 6. lock 해제 N)auditc| td| tdt|j|_||_||_|||_yt |j|_y)Nz#http_post callable must be injectedz(token_provider callable must be injected)NotImplementedErrorrresolve_workspace_root _http_post_token_providerr _audit)selfworkspace_root http_posttoken_providerrs r6__init__zOwnerTriggerOnly.__init__Ksk  %&KL L  !%&PQ Q#N3;;=#-$0e 6GH\H\6] r5ct|}|js|j|z }|jst dd|t j |jd}|S)NE_FILE_MISSINGzdecision file not found: zutf-8)encoding)r is_absoluterexistsrjsonloads read_text)r decision_pathrNrus r6_read_decisionzOwnerTriggerOnly._read_decision^sgM"!''$.D{{}&'7;TUYTZ9[\ \zz$..'.:; r5) env_overrider)ct||j|}t|||tn|}|tk7rt dtd|t |d} |d} t||| } td| t|} |jdd } |jj5} |j| | |j'}t)|tr|st+t,dt/|}|j| | | t t0t| | d|d d d|ddd}dti} |j3d| || i}d } |j| | | t tFt| | d|d d t%tF| | t t| d|d cdddS#t$rV|j| | | t t"t| | d d d d d t%t"| | t t| d d d  cYcdddSwxYw#t4$r} t7|}t9|}t:j=d| | dddz| ||nN#t4$rB} t?d| d| ddd|t@jBn#t4$rYnwxYwYd}~nd}~wwxYw |j| | | t tDt| | d|d dd i}d }|#i}d }wxYwd}~wwxYw#i}d }wxYw#ttHf$rwxYw#1swYyxYw)u단일 public action. /gemini review 댓글 1회 작성. race condition: 동시 2 process 가 같은 (pr, head) 호출 시 lock 직렬화로 후속 process 의 check_dedupe 가 항상 DedupeViolation 차단. crash-safety (task-2554+2 §1): http_post 호출 직전 ``txn.record(PENDING)`` 으로 영구 기록. process crash 후 다음 runner 가 ``_has_active_trigger`` 에서 PENDING 발견 → DedupeViolation → DEDUPED 판정 (fail-closed). )current_head_actualNzcomment_body must be z, got r& current_headrItask_id)r&r'FDEDUPE) rr&r'r(rxr)r*rr,rtoken_value_loggedr.) r$r&r'r(r)r*r,rr.u+ not provided — owner trigger fail-closedT) rr&r'r(rxr)r*rr,rrrWzapplication/vnd.github+jsonz 2022-11-28) AuthorizationAcceptzX-GitHub-Api-Versionbodyz[owner_trigger http_post FAILED pr=%s head=%s endpoint=%s token_hash_prefix=%s diagnostic=%srbz...z)CRITICAL: owner_trigger logger failed pr=z head_prefix=z log_exc=)fileHTTP_POST_FAIL)%rUrrrrr=r%rGrPr#getr transaction check_deduper recordrr r"rrBr;rrrrrqrrers exceptionprintsysstderrr rr )rrrDrErrr)decisionrpr_numr'rNdecision_path_str task_id_valtxntoken hash_prefixr body_payloadr http_diag redacted_diaglog_excs r6trigger_gemini_reviewz&OwnerTriggerOnly.trigger_gemini_reviewis( l+&&}5(8KL ,3| ' '&'(<'?vdXN  Xd^$''tV<- .ll9b1 [[ $ $ &] #   F 6>((*EeS),%&&QR,E2K JJ*  ,,$0 $%6%))4*/  $$+5'!27(4G #L1L9 lGDn  #.$ $"0"/(4$():)--8.3 $!$%)""- g] ] #  #.$ $"0"0(4$():).-/.3&.  %))!-!"'&('  +] ]  D4   9# >I$7 $BM$$=Ra5(#%! GxP++/8*Ig[J!$ % JJ'2"($(&4&3,8(,->-11<27*: "!GE !GEg4 l&$%89  a] ] s5L7F0 A9LHL)K,L0AHLHL K 6IK J'JJ J JJ JKJK"*K KKKK  K##K))L,K==LL ctd)NzZowner_trigger_only must not perform merge. Use merge_queue_executor with BOT_GITHUB_TOKEN.)r?rargskwargss r6mergezOwnerTriggerOnly.merge5s  >  r5ctd)Nz)approve forbidden (review submit blocked)r8rs r6approvezOwnerTriggerOnly.approve;s$%PQQr5ctd)Nzclose forbiddenrrs r6closezOwnerTriggerOnly.close>s$%677r5ctd)Nzreopen forbiddenrrs r6reopenzOwnerTriggerOnly.reopenAs$%788r5) r str | Pathrz&Callable[[str, str, dict, dict], dict]rzCallable[[], str]rzOwnerTriggerAudit | NonereturnNone)rrrrm)rrrDr#rEr#rr#r dict | Noner)r-rr") r/r0r1r2rrrrrrrr4r5r6rr2s<+/ ^#^: ^ * ^ ( ^ ^&$%)#'H"H H  H ! H"H!H HX R89r5rcZddlm}ddlm}t |t s t d |j||||}|jt ttt"fvrtS|jS#tttt|f$r|$r tcYSt$r tcYSwxYw)uExecutorScheduler → OwnerTriggerOnly 호출 어댑터 (task-2556 §6). 회장 §6 명시 1:1: ``owner_trigger_only.trigger_gemini_review()`` 를 scheduler 가 자동 호출. 본 wrapper 는 runner 결과를 ``merge_queue_executor.orchestrate_owner_trigger_ for_stale_pr`` 가 기대하는 string 형식 ("POSTED" / "DEDUPED" / "FAILED") 으로 정규화. 설계 원칙: - 본 함수는 token 을 직접 만지지 않는다. ``runner`` 에 이미 ``token_provider`` 가 주입되어 있어야 한다 (token boundary §11). - http_post 예외는 본 함수에서 catch — TokenBoundaryViolation / ForbiddenEndpointError / CommentBodyViolation 는 그대로 raise (fail-closed). - 일반 RuntimeError 는 "FAILED" 로 정규화 (transient 가능성, FAILED marker 가 caller 에서 생성됨). Args: runner: OwnerTriggerOnly 인스턴스 (token_provider/http_post 이미 주입). decision_path: owner_trigger_decision.json 경로 (Path 또는 str). owner: GitHub owner. repo: GitHub repo. current_head_actual: 실측 PR head SHA (40-char hex). Returns: "POSTED" | "DEDUPED" | "FAILED" | "PENDING" — orchestrate_owner_trigger_for_stale_pr 가 사용하는 enum. Raises: TokenBoundaryViolation: token 부재. ForbiddenEndpointError: 금지 endpoint 호출 시도. CommentBodyViolation: comment body 변조. MergePathViolation: merge path 침범. DecisionInvalidError: decision schema 위반. r)r)r (runner must be OwnerTriggerOnly instancerrDrEr)anu_v2.owner_trigger_decisionranu_v2.owner_trigger_auditr rBr TypeErrorrr;r8r=r?r rqr r$rr)runnerrrDrEr_DecisionInvalidError_DedupeViolationrxs r6invoke_from_schedulerrHsP\N f. /BCC--' 3 . "}}]NM>ZZ == #$: "46K M   sA22%B*B*)B*cbt|ts td|j||||S)usecond-review 자동 호출 진입점 (task-2565 §3.5 capability 재사용). 내부적으로 기존 trigger_gemini_review를 호출. dedupe key는 pr_number+head_sha. Args: runner: OwnerTriggerOnly 인스턴스 (token_provider/http_post 이미 주입). pr_number: PR 번호. head_sha: 현재 head SHA. owner: GitHub owner. repo: GitHub repo. decision_path: owner_trigger_decision.json 경로. Returns: TriggerResult (status: POSTED|DEDUPED|FAILED|PENDING). rr)rBrrr)rrFhead_sharDrErs r6trigger_for_second_reviewrs?0 f. /BCC  ' '# $ ( r5c| tdtD]}||vstd|dtdt|vrtdtd|jt}t |t r|sttdy) uFscheduler 진입 시 token boundary 검증 (task-2556 §11). scheduler 가 BOT_GITHUB_TOKEN / GH_TOKEN / OWNER_PAT 등을 들고 owner_trigger 경로로 진입하려는 시도를 hard-block. 회장 §11 / §16 1:1. 또한 ``OWNER_GEMINI_TRIGGER_TOKEN`` 이 env 에 명시되어 있지 않으면 fail-closed. Nz>scheduler env must be provided for token boundary verificationz,scheduler env contains forbidden token name u! — owner_trigger path must use rRzscheduler env missing u — owner_trigger fail-closedu- present but empty/non-string — fail-closed)r;rrrrBr#)rSrT token_values r6assert_scheduler_token_boundaryrs {$ L  /  (>ymL//=.>eE  S $$^$44R S  ''.)K k3 '{$K L  0;r5)rDr#rEr#rFr%rr#)rMr#rNr#rr)N)rSrrr)rurr`r%rr)r BaseExceptionrrm) r'OwnerTriggerOnly'rrrDr#rEr#rr#rr#)rrrFr%rr#rDr#rEr#rz 'str | Path'rr"):r2 __future__rrloggingrer dataclassesrpathlibrtypingrrrrr r r r r rrrrrrrr getLoggerr/rsrr3rcompilerrrr"PermissionErrorr8r;rCr=r?rGrPrUrVr]r^rerrrrrr4r5r6rs"H#  !''      8 $ , j+9 9+52::/,( BJJ$%BJJ&'BJJ~BJJ~BJJ%&BJJ|BJJ~BJJ67BJJEFBJJ*+ C? 51 $ " " ""D_D8_8V:VRR@   &*4<*& 3/%1z0569x#RP9P9lC CC  C  C  C CR       D r5