+ jHj45Rt^RIHt^RIHt^RIHt^RIHt^RI H t H t H t ^RI Ht!RR4t]!R R 7!R R 44tR RltRRltRtRtRtRRltRtRtRtRtRRltRR/RltR#) aOne SessionAuthority per reserved profile home; resolved by the active runtime scope. A multiplexing gateway owns every profile under ``profiles/`` plus the default home. Each home has its own ``state.db``, admission ledger, runtime epoch and control identity, so each gets its own authority. Every consumer already runs inside the routed profile's ``_profile_runtime_scope`` (that is what the multiplex fixes on main established), so the authority for "the profile this code is acting for" is the one keyed by the active home. A single-profile gateway is a map of one: the launch home's authority answers every lookup, scoped or not, exactly as before. ) annotations) dataclass)Path)Any)get_hermes_homeget_hermes_home_overridehermes_home_keyRuntimeStoreErrorc]tRt^tRtRR/RltRRRlltRR ltR tR t R R lt Rt RRlt ] R4tRtRtRtRRltRRltRRltRtR#)SessionAuthoritiesz;Registry of authorities keyed by ``hermes_home_key(home)``. multiplexedFc b\V4Vn/Vn/Vn\ V4VnR#N)r launch_key_by_key_namesboolr )self launch_homer s&&$@/home/ubuntu/.hermes/hermes-agent/gateway/session_authorities.py__init__SessionAuthorities.__init__s+)+6*, -/  ,NcV^8dQhRR/#returnNone)formats"r __annotate__SessionAuthorities.__annotate__!s$$$rc \V4pW@P9d\RV 24hW PV&W0PV&W@P8wd RVnR#R#)z duplicate session authority for TN)rr RuntimeErrorrrr )rhome authoritynamekeys&&&& raddSessionAuthorities.add!sXd# ,, !A$HI I% S C // !#D  "rcV^8dQhRR/#rr)r s"rr!r"*s&&$&rc \V4pW0P9gVPV,e\RV 24hW PV&R#)zRFill the slot reserved by ``add(home, None, name=...)`` once the authority exists.Nz'no reserved session authority slot for )rrr$)rr%r&r(s&&& rreplaceSessionAuthorities.replace*sCd# ll "dll3&7&C!HOP P% Src \V4pW P8Xd \R4hVPP VR4VP P VR4#)z|Drop *home*'s slot (a parked boot, a hot-unserved profile); returns the authority or None. The launch slot is never removed.z.the launch session authority cannot be removedN)rrr$rpopr)rr%r(s&& rremoveSessionAuthorities.remove1sMd# // !OP P T"||T**rc \VP4pW P8XdR#VPP V4#)zServed profile name for *authority*; None for the launch profile (its adapters are ``runner.adapters``, its session keys the historical ``agent:main`` namespace).N)r profile_idrrget)rr&r(s&& r profile_nameSessionAuthorities.profile_name:s5i223oo-tG4;;??33GGrcV^8dQhRR/#)rrintr)r s"rr!r"@s!!!rc ,\VP4#r)lenrrs&r__len__SessionAuthorities.__len__@s4<<  rc H\VPP44#r)iterrvaluesr<s&r__iter__SessionAuthorities.__iter__CsDLL'')**rcV^8dQhRR/#rrrr)r s"rr!r"Fs55D5rc 2\V4VP9#r)rrrr%s&&r __contains__SessionAuthorities.__contains__Fst$ 44rc <VPVP,#r)rrr<s&rlaunchSessionAuthorities.launchIs||DOO,,rc JVPP\V44#)zEAuthority owning *home*, or None when this process does not serve it.)rr5rrGs&&rfor_homeSessionAuthorities.for_homeMs|| 566rc FVPV4pVf \R4hV#)Nprofile_mismatch)rNr )rr%r&s&& rrequireSessionAuthorities.requireQs(MM$'  #$67 7rc VP'd \4fVPVP,#VPP \ \ 444#)uAuthority for the active runtime scope. Unscoped code (startup, shutdown, background watchers) belongs to the launch profile. Scoped code that names a home this process does not serve gets ``None``: a routed profile must never fall back to the launch profile's ledger — including once a removed secondary leaves only the launch slot (a late callback of that profile). Only a runtime that never multiplexed is a map of one that answers every scope with the launch authority. )r rrrr5rrr<s&ractiveSessionAuthorities.activeWsI#;#=#E<<0 0||0A BCCrcV^8dQhRR/#)rrlistr)r s"rr!r"dsooorc \VPP44Uu.uFqfK\VRR4'dKVNK! up#uupi)zAuthorities that accept work: not a reserved-but-unbuilt slot, not one retiring (a failed serve or an unserve whose turn outlived Stop keeps its slot but refuses admissions).retiringF)rXrrAgetattrras& rservingSessionAuthorities.servingdsC  3 3 56n6aPWXY[eglPm6nnnsAAAcV^8dQhRR/#)rrz list[dict]r)r s"rr!r"js\\\rc |VP4Uu.uFpRVPRVP/NK up#uupi)r4r%)r^r4r\s& rserved_profiles"SessionAuthorities.served_profilesjs1LPLLN[Nqq||VQ\\BN[[[s#9cV^8dQhRR/#)rrzfrozenset[str]r)r s"rr!r"ms??^?rc B\RVP444#)c38"TFqPxK R#5ir)r4).0r]s& r 1SessionAuthorities.profile_ids..ns>~!~s) frozensetr^r<s&r profile_idsSessionAuthorities.profile_idsms>t||~>>>r)rrrr r)__name__ __module__ __qualname____firstlineno____doc__rr)r-r1r6r=rBrHpropertyrKrNrRrUr^rbrk__static_attributes__rrrr r soE-5-$&+H !+5--7 Do \??rr T)frozencV]tRt^qt$RtR]R&R]R&R]R&RtR ]R &R tR ]R &RtR#)LocalBotaOne local bot this process serves: its profile ``name``, ``home`` and owning ``authority``. ``problem`` says why a client cannot address it by that name (None when it can); ``retiring`` marks one being unserved, which still owns its rooms but takes no new work.strr'rr%rr&Nz str | NoneproblemFrrZr) rmrnrorprq__annotations__rxrZrsrrrrvrvqs-S I JNGZHdrrvcV^8dQhRR/#)rrzlist[LocalBot]r)r s"rr!r!}s.rc|^RIHp\VRR4pVf-\VRR4pVe\VP4V3.M.pMe\ VP P44Uu.uF8qUfKVPV4;'g\VP4V3NK: ppV!RV44p.pVFwwrRp Wh,^8dRp MV\VP48wdRp VP\V\VP4W9\\VRR 4444Ky V#uupi) a!The local bots this gateway serves, one per built authority, by the name the registry reserved each under (the launch profile keeps ``served_profile_name``). The one answer to "which bots are local here" for both the Bots roster (``profiles.list``) and group seating (``session_hosted_members``). A name two homes answer to, or one that is not its home's own name (a linked ``profiles/`` resolves outside ``profiles/`` and reads as ``default``), is flagged rather than bound: a client routes, and the member transport names, a bot by name.)Countersession_authoritiesNsession_authorityc3*"TF wrVxK R#5irr)rgr'_s& rrhlocal_bots..s/gdTsz$two served homes answer to that namez*a linked profile home is not supported yetrZF) collectionsr|r[served_profile_namer4rXrrAr6appendrvrr) runnerr|registryr&pairsr]countsbotsr'rxs & r local_botsr}s<$v4d;HF$7> LULa%i&:&:;YGHgix//6689L9QT(''*OO.A!,,.OQRS9 L // /F D   >BG HT4 (<(<#=y!')Z"GHJ K ! KLs)D93D9 D9cV^8dQhRR/#)rrrwr)r s"rr!r!s444rc2^RIHpV!V4;'gR#)a`Canonical profile id of a served home: ``default`` for the root, the directory name for ``profiles/`` (via ``hermes_constants.profile_name_for_home``, the resolver main uses). Any other custom HERMES_HOME is the process's own single profile and keeps the ``default`` label the CLI reports for it (``hermes -p`` never targets such a home by name).)profile_name_for_homedefault)hermes_constantsr)r%rs& rrrs 7  & 3 3)3rc\VRR4pVfi\VRR4pVeV\VPP4P 4P \V4P 48XdV#R#VP V4#)zGExplicit per-home lookup for callers that already know the routed home.r}Nr~)r[rdbdb_pathresolveparentrN)rr%rr&s&& rauthority_for_homers{v4d;HF$7>  T),,*>*>%?%G%G%I%P%PTXY]T^TfTfTh%h    T ""rc,\V\V44#r)rr)rr4s&&rauthority_for_profile_idrs fd:&6 77rc^\VRR4pVf\VRR4#VP4#)zAuthority for the active runtime scope (see ``SessionAuthorities.active``); the single launch authority when the runner predates the registry (bare test runners).r}Nr~)r[rU)rrs& ractive_authorityrs6v4d;Hv2D99 ?? rNc\V4pVf^RIHpV!V4VeVe$V!4VPJd^RIHpV!R4hV#)aQThe active scope's authority, or a refusal: retryable (``runtime_draining``) while its profile is parked, else ``profile_mismatch``. With *store* (a callable returning the caller's SessionDB, called only once an authority exists), that store must be the authority's: an API adapter bound to another profile's SessionDB never admits here.)refuse_parked_scoper rQ)rgateway.run_runtimerrhermes_state_runtimer )rstorer&rr s&& rrequire_active_authorityrsL !(I;F#U.57),,3N: 233 rcf\VRR4pVe \V4#\VRR4pVeV.#.#)r}Nr~)r[rXrrr&s& rall_authoritiesrsBv4d;HH~ 3T:I#/I;7R7rc\VRR4pVeVP4#\VRR4pVe\VRR4'gV.#.#)aThe authorities that accept work (``SessionAuthorities.serving``: no reserved-but-unbuilt slot, none retiring): what startup recovery, service creation and cross-ledger reads cover. Shutdown keeps ``all_authorities``, so a retained authority's live writer is still settled.r}Nr~rZF)r[r^rs& rserving_authoritiesrsYv4d;H!! 3T:I#/ :W\8]8]I;eceercB\VRR4'd \R4hR#)zRefuse a verb reached through a stale connection to a retired authority: its ownership is released, and until a successor bumps the epoch its own epoch still passes the store fence.retiredFruntime_retiredN)r[r )r&s&rrequire_servingrs$y)U++ 122,rc^RIHpVPV4pV'gV#VPP 4;_uu_4pV!WC4uuRRR4# +'giR#;i)a The admission identity a physical store row answers to: its compression root, then the local creation id a canonical reset forks under (a reset child is not a compression child, so ``logical_owner`` alone stops at the child and misses the conversation's admissions).)local_lineage_ownerN)hermes_state_localr logical_ownerr _read_ctx)r& session_idrsidconns&& radmission_ownerrsK7  ! !* -C     ! !T"4- " ! ! !s A A( cV^8dQhRR/#rEr)r s"rr!r!sdrc "\VPPRV\W4344# \dRp\ TRR4'gh^RIpTPR4PRT\ TRR4T4Rp?R #Rp?ii;i) aWhether *authority*'s store holds a canonical admission for *session_id*. A parked profile's retained (retiring) store that cannot answer counts as holding one: startup auto-resume fails closed for that entry instead of stopping the boot or resuming a turn that FIFO may own.zISELECT 1 FROM session_admissions WHERE target_session_id IN (?,?) LIMIT 1rZFNz gateway.runz?Skipping auto-resume of %s: retained store %s cannot answer: %sr4?T) rr _read_oner Exceptionr[logging getLoggerwarning)r&rexcrs&& rholds_admissionrs ILL** W ? @BC C y*e44 -(001r1;WYP\^a=bdg i s/2 BAB  Bhydrate_secretsFc>^RIHp\VRR4p\\VRR4RR4'g^RIHpV!4#\ \ VP44pVP4'dVP4'gV!4#^RI H pV!WQR 7#) u9Runtime scope of the profile that owns *authority* — under multiplex only. Owner-side handlers (RPC dispatch, cron submit, admitted execution) must read config, jobs and policy for the OWNING profile, never the launch profile's ambient scope. A single-profile gateway keeps its ambient scope byte-for-byte: entering a scope there would read the profile's config/.env for every handler, including bypass (--safe-mode) launches that must never touch the profile YAML. Test peers with symbolic ids ('fixture') likewise keep the ambient scope. A standalone gateway that already hosts a second home (a profile created over the wire froze the launch env and made unscoped secret reads fail closed) binds the launch profile's own scope instead: unbound, every launch-profile session.create raised UnscopedSecretError (#141623). ) nullcontextrNconfigmultiplex_profilesF)#launch_profile_scope_if_multiplexed)_profile_runtime_scope)r) contextlibrr[!tui_gateway.launch_profile_policyrrrwr4 is_absoluteis_dir gateway.runr)r&rrrrr%rs&$ r owner_scopers~' Y$ /F 768T24H% P PY244 I(() *D     T[[]]}2 !$ HHrr)rq __future__r dataclassesrpathlibrtypingrrrrrrr r rvrrrrrrrrrrrrrrrrs #!WW2X?X?v $:4#8 8f3 ."IeIr