+ jHjva0t$Rt^RIHt^RIt^RIHt^RIHt^RI H t H t ^RI H t HtHtHt]P"!]4tRtRR lt]!R R 7!R R 44tRRRllt]R]R] R/tR]R&RRltRRltRRltR#)aImage-managed install refusal contract. A refusal prints the real update command for the deployment kind, records a ``refused`` receipt (so fleet tooling sees "this install cannot self-update, use " instead of a silent non-update), and exits 2 on CLI surfaces. ) annotationsN) dataclass)Path)CallableOptional)STEWARD_APT_TERMUXSTEWARD_DESKTOPSTEWARD_DOCKER STEWARD_NIXzUThis build doesn't get updates. Ask the developer who gave it to you for a new build.c V^8dQhRRRR/#) project_rootrreturnbool)formats"?/home/ubuntu/.hermes/hermes-agent/hermes_cli/update_contract.py __annotate__rsLL$L4LcB^RIHpV!V4PR4R8H#))read_install_stampsource commit-build)hermes_cli.stewardrget)r rs& ris_commit_buildrs 5 l + / / 9^ KKrT)frozenc:]tRt^t$RtR]R&R]R&R]R&RtR#) UpdateRefusalz;Why an in-place update is refused, and what to run instead.strcodemessageupdate_commandrN)__name__ __module__ __qualname____firstlineno____doc____annotations____static_attributes__rrrrrsE I Lrrc(V^8dQhRRRRRRRR/#)r r!r methodr"zOptional[Callable[[str], str]]rrr)rs"rrr's0 J J3 J J.L JXe Jrcv^RIHpHpV!V4pVe V!V4pMVR8XdV!4MTp\WVR7#)zeRefusal for ``method``: ``message(command)`` if given, else docker's full message / the bare command.)format_docker_update_message%recommended_update_command_for_methoddockerr!r"r#)hermes_cli.configr.r/r)r!r,r"r.r/commandtexts&&& r_refusalr5's>e3F;Gw1781C+- d IIrr0nixaptzdict[str, str]_STEWARD_UPDATE_METHODSc V^8dQhRRRR/#)r stewardr rrr)rs"rrr=shhchmhrcaa^RIHo\PS4pVR8Xd \ SV4#Ve\ SVVV3Rl4#S\ 8XdRMRS 2p\ SS!S4VR7#)z)Refusal for a tree sealed by ``steward``.)steward_update_messager0c<S!S4#Nr)_commandr:r<s&r"_steward_refusal..Es :PQX:Yrz*Manage updates from within the desktop appz update via r1)rr<r8rr5rr)r:r,r3r<sf @r_steward_refusalrB=sw9 $ ( ( 1F (( )YZZ o % 57) $ g/Eg/N_f ggrc V^8dQhRRRR/#)r r rrzOptional[UpdateRefusal]r)rs"rrrRs@@D@5L@rcHa \V4'd\R\R4#^RIHpV!4o S e:S P 'g\ RRV 3Rl4#\ RS P4#^R I H pV!V4pVf/^R I HpV!4'd^R I HpHp\\"VVR 7#MVR8wd \%V4#^RIHpHp V!V4p V R8Xd \ RV 4#V !V 4'gV R8Xd\ V R8XdW4#RV 4#R# \d!p\PR T4Rp?LRp?ii;i \d!p\PRT4Rp?LRp?ii;i \d"p\PRT4Rp?R#Rp?ii;i)zReturn an :class:`UpdateRefusal` when in-place update must not run. ``None`` means the install is eligible for in-place update (git checkout or unknown-but- mutable). Never raises; on any internal error it falls back to the heuristic layer only. r)read_image_provenanceNzimage-marker-invalidr0c(<RSP RV 2#)uI✗ This install is image-managed, but its provenance marker is invalid (zE). In-place update is disabled. Update by pulling a new image: )error)r3 provenances&rr@+evaluate_update_admission..ds#**4*:*:);<''.i1rz image-markerz4Image provenance check failed (using heuristics): %s)sealed_steward) is_termux)SOURCE_ON_TERMUX_UPDATE_COMMANDSOURCE_ON_TERMUX_UPDATE_MESSAGEr1unknownz"Steward admission check failed: %s)detect_install_methodis_nix_install_methodr7r6z)Install-method admission check failed: %s)rrCOMMIT_BUILD_UPDATE_MESSAGEhermes_cli.image_provenancerFvalidr5manager ExceptionloggerdebugrrKhermes_constantsrLrMrNrrBr2rPrQ) r rFexcrKr:rLrMrNrPrQr,rIs & @revaluate_update_admissionr[Rs |$$^-H"MMRE*,  !### 6C NJ,>,>? ? "&@5 . ? 2{{o$+;#B !#G, ," GR&|4 X Hf- -  ( (FeOfoFI I5&I I-< O R KSQQR2 @ 93??@ G @#FF Gsq"DDD1$EE1E"E5( E56E5E5 E$D??E E2E--E25 F!FF!c V^8dQhRRRR/#)r refusalrrNoner)rs"rrrsBBMBdBrcP^RIHpHpHpV!4RVP R2pY@P 'dRVP 2MRVP 2, pV!RRV4V!RVPR 7R # \d"p\PR T4R p?R #R p?ii;i) zWrite a minimal ``refused`` receipt for a blocked update attempt. Gives fleet tooling a durable record that an update was ATTEMPTED and refused ("not updatable in place, use ") instead of a silent nothing. Best-effort; never raises. )begin_update_receiptfinalize_update_receipt record_stepznot updatable in place ()z; use: z; admissionFrefused) stop_reasonz$Could not record refusal receipt: %sN) hermes_cli.update_receiptr`rarbr!r#r"rVrWrX)r]r`rarbdetailrZs& rrecord_refusal_receiptris Bhh+GLL>;8N8N8NGG2234VXY`YhYhXiTjjK/ w||D B ;SAABsA5A99 B%B  B%r>)__conditional_annotations__r( __future__rlogging dataclassesrpathlibrtypingrrrrrr r getLoggerr$rWrRrrr5r8r)rBr[ri)rjs@rrqs#!%__   8 $\ L  $ J H+h*@FBr