chore: sync master after atomic memory merge

Author: frf12

src/powercontext/builtin/persistence/migrations/atomic_memory_references.py

@@ -352,13 +352,6 @@ def _collection_citation(value: Any) -> dict[str, Any] | None:
     return None
 
 
-def _holds_collection_citation(value: Any) -> bool:
-    if _collection_citation(value) is not None:
-        return True
-    items = value.values() if isinstance(value, dict) else value if isinstance(value, list) else ()
-    return any(_holds_collection_citation(item) for item in items)
-
-
 async def _convert_citations(
     context: _Context,
     connection: AsyncConnection,
@@ -1260,9 +1253,7 @@ async def count(sql: str) -> int:
     cited = "(memory_citations IS NOT NULL AND LENGTH(memory_citations) > 2) OR "
     checks = {
         "pc_artifacts": (
-            "SELECT COUNT(*) FROM pc_artifacts WHERE "  # noqa: S608
-            + (cited if "pc_artifacts" in citation_tables else "")
-            + "(family = 'handoff' AND CAST(content AS CHAR) LIKE '%memory_citation%')",
+            "SELECT COUNT(*) FROM pc_artifacts WHERE memory_citations IS NOT NULL AND LENGTH(memory_citations) > 2",
             "Artifacts still hold legacy Memory citations",
         ),
         "pc_artifact_candidate_versions": (
@@ -1283,17 +1274,19 @@ async def count(sql: str) -> int:
     ):
         issues.append("unfinished Dream runs still carry legacy entry citation fields")
     for table, (sql, message) in checks.items():
-        if table in tables and await count(sql):
+        if table in tables and (table != "pc_artifacts" or table in citation_tables) and await count(sql):
             issues.append(message)
     if "pc_artifacts" in tables:
+        # The text match only narrows the rows; free text may mention these names, so judge parsed fields.
         for row in await rows(
             connection,
             "pc_artifacts",
             ("content",),
-            "WHERE family = 'handoff' AND CAST(content AS CHAR) LIKE '%\"memory\"%'",
+            "WHERE family = 'handoff' AND (CAST(content AS CHAR) LIKE '%\"memory\"%' "
+            "OR CAST(content AS CHAR) LIKE '%memory_citation%')",
         ):
-            if _holds_collection_citation(json.loads(bytes(row["content"]))):
-                issues.append("Handoffs still cite whole legacy Memory collections")
+            if _holds_memory_reference(json.loads(bytes(row["content"]))):
+                issues.append("Handoffs still hold legacy Memory references")
                 break
     if "pc_sources" in tables:
         for row in await rows(
@@ -1313,7 +1306,7 @@ async def count(sql: str) -> int:
                 current["unavailable_evidence"] = [
                     item for item in current.get("unavailable_evidence", ()) if _collection_citation(item) is None
                 ]
-            if "memory_citation" in content or _holds_collection_citation(current):
+            if _holds_memory_reference(current):
                 issues.append("structured Work Sources still hold legacy Memory citations")
                 break
     return issues

src/powercontext/server/authz/service.py

@@ -609,7 +609,8 @@ def with_connection(self, connection):
             raise AccessUnavailableError("transactional_relationships_unavailable")
         repository = self.relationships.with_connection(connection)
         provider = self.provider
-        if isinstance(provider, BuiltinAuthorizationProvider):
+        # Binding a Provider or Repository subclass could discard its custom rules; keep it unchanged.
+        if type(provider) is BuiltinAuthorizationProvider and type(provider._repository) is RelationalAccessRepository:
             provider = provider.with_repository(repository)
         bound = AccessControlService(
             provider,

tests/e2e/test_access_control_regressions.py

@@ -28,7 +28,15 @@
 from powercontext.builtin.persistence.sqlite import SQLiteConfig
 from powercontext.builtin.runtime import InferenceConfig, RuntimeConfig
 from powercontext.server.authentication import AuthenticationResult, ProviderReadiness
-from powercontext.server.authz import AccessAuditContext, AccessUnavailableError, PrincipalRef, ResourceRef
+from powercontext.server.authz import (
+    AccessAction,
+    AccessAuditContext,
+    AccessDecision,
+    AccessUnavailableError,
+    BuiltinAuthorizationProvider,
+    PrincipalRef,
+    ResourceRef,
+)
 from powercontext.server.authz.composition import open_builtin_access_control, open_casbin_access_control
 from powercontext.server.factory import create_server_app
 from powercontext.server.settings import AccessControlConfig, McpConfig, MetricsConfig, ServerSettings
@@ -1261,6 +1269,54 @@ async def interleaved_latest(connection, scope_id, family, artifact_id, **kwargs
     asyncio.run(scenario())
 
 
+def test_atomic_lifecycle_respects_a_custom_builtin_provider_denial(tmp_path):
+    class DenyArtifactWrite(BuiltinAuthorizationProvider):
+        async def check_batch(self, requests, /):
+            decisions = await super().check_batch(requests)
+            return tuple(
+                AccessDecision(False, "custom-denial", decision.policy_revision)
+                if request.action is AccessAction.ARTIFACT_WRITE
+                else decision
+                for request, decision in zip(requests, decisions, strict=True)
+            )
+
+    async def scenario():
+        async with _server(tmp_path) as (_, client, access):
+            scope_id = await _scope(client)
+            remembered = await client.post(
+                "/v1/memory/remember", json={"scope_id": scope_id, "kind": "fact", "text": "Alpha scope fact."}
+            )
+            assert remembered.status_code == 200, remembered.text
+            identity = remembered.json()["records"][0]["artifact"]["artifact_id"]
+            path = f"/v1/scopes/{scope_id}/artifacts/atomic-memory/{identity}"
+            current = await client.get(path)
+            assert current.status_code == 200, current.text
+
+            access.provider = DenyArtifactWrite(access.provider._repository, deployment_id=access.deployment_id)
+            edited = await client.put(
+                path, headers={"If-Match": current.headers["ETag"]}, json={"content": {"kind": "fact", "text": "Beta."}}
+            )
+            assert edited.status_code == 403, edited.text
+            forgotten = await client.post(
+                "/v1/atomic-memory/lifecycle",
+                json={
+                    "scope_id": scope_id,
+                    "target": {
+                        "artifact": {"family": "atomic-memory", "artifact_id": identity, "revision": 1},
+                        "state_version": 0,
+                    },
+                    "state": "forgotten",
+                },
+            )
+            assert forgotten.status_code == 403, forgotten.text
+            state = await client.get(path + "/state")
+            assert state.status_code == 200, state.text
+            assert state.json()["state"] == "active"
+            assert state.json()["state_version"] == 0
+
+    asyncio.run(scenario())
+
+
 @pytest.mark.parametrize("provider", ["builtin", "casbin", "custom"])
 def test_atomic_scope_search_and_list_keep_exact_artifact_shares_separate(tmp_path, provider):
     class ConfiguredProvider:

tests/e2e/test_atomic_memory_migration_evidence.py

@@ -954,6 +954,49 @@ async def scenario() -> None:
     asyncio.run(scenario())
 
 
+def test_work_text_mentioning_legacy_field_names_migrates_unchanged(migration_backend: MigrationBackend) -> None:
+    config = migration_backend.config
+    mention = "Please verify the memory_citation parser before accepting this Handoff."
+    receipt_source = SourceRef(source_type="content", source_id="mention-receipt")
+    unavailable = {"kind": "artifact", "artifact_ref": EA.model_dump(mode="json")}
+
+    async def seeded(contexts, connection) -> None:
+        content = _handoff_content(HandoffSourceCitation(source_ref=A).model_dump())
+        content["state"][0]["text"] = mention
+        await _insert_handoff(connection, "mention-handoff", content)
+        await _scope_row(connection)
+        await _work_source(
+            contexts,
+            connection,
+            receipt_source,
+            "handoff-receipt",
+            "powercontext.handoff-receipt.v1",
+            {**_legacy_receipt(unavailable), "message": mention},
+        )
+
+    async def scenario() -> None:
+        await _seed_and_migrate(config, seeded)
+        async with (
+            open_builtin_contexts(BuiltinConfig(database=config)) as contexts,
+            contexts.database.transaction() as connection,
+        ):
+            handoff = await contexts.repositories.artifacts.get(
+                connection, SCOPE, ArtifactRef(family="handoff", artifact_id="mention-handoff", revision=1)
+            )
+            assert handoff.content.state[0].text == mention
+            payload = await connection.scalar(
+                select(SOURCES_TABLE.c.payload).where(
+                    SOURCES_TABLE.c.scope_id == SCOPE, SOURCES_TABLE.c.source_id == receipt_source.source_id
+                )
+            )
+            assert isinstance(payload, bytes | bytearray | memoryview)
+            assert json.loads(json.loads(bytes(payload))["value"]["content"])["message"] == mention
+            report = await verify_atomic_memory_migration(connection, index=contexts.atomic_memory.index)
+            assert report.ready, report.errors
+
+    asyncio.run(scenario())
+
+
 def test_collections_citing_each_other_are_removed_regardless_of_identifier_order(
     migration_backend: MigrationBackend,
 ) -> None:

tests/test_access_adapters.py

@@ -31,6 +31,7 @@
     AccessBinding,
     AccessBindingState,
     AccessControlService,
+    AccessDecision,
     AccessDeniedError,
     AccessProviderCapabilities,
     AccessRequest,
@@ -119,7 +120,8 @@ async def scenario() -> None:
     asyncio.run(scenario())
 
 
-def test_casbin_transaction_binding_preserves_custom_repository_policy() -> None:
+@pytest.mark.parametrize("provider_class", [BuiltinAuthorizationProvider, CasbinAuthorizationProvider])
+def test_transaction_binding_preserves_custom_repository_policy(provider_class) -> None:
     class ReadOnlyScopeRepository(RelationalAccessRepository):
         async def decision_snapshot(
             self,
@@ -158,7 +160,7 @@ async def scenario() -> None:
                 )
 
             service = AccessControlService(
-                CasbinAuthorizationProvider(ReadOnlyScopeRepository(profile.database)),
+                provider_class(ReadOnlyScopeRepository(profile.database)),
                 relationships=repository,
                 audit=repository,
             )
@@ -179,6 +181,37 @@ async def scenario() -> None:
     asyncio.run(scenario())
 
 
+def test_transaction_binding_preserves_builtin_subclass_denials() -> None:
+    class DenyArtifactWrite(BuiltinAuthorizationProvider):
+        async def check_batch(self, requests, /):
+            decisions = await super().check_batch(requests)
+            return tuple(
+                AccessDecision(False, "custom-denial", decision.policy_revision)
+                if request.action is AccessAction.ARTIFACT_WRITE
+                else decision
+                for request, decision in zip(requests, decisions, strict=True)
+            )
+
+    async def scenario() -> None:
+        async with SQLiteProfile.open(SQLiteConfig(), tables=ACCESS_TABLES) as profile:
+            repository = RelationalAccessRepository(profile.database)
+            await _seed_admin(repository)
+            memory = ResourceRef.artifact("scope-a", family="atomic-memory", artifact_id="memory-a")
+            service = AccessControlService(DenyArtifactWrite(repository), relationships=repository, audit=repository)
+            await service.establish_artifact_owner(memory, ALICE, idempotency_key="owner-memory", context=AUDIT)
+            assert (await service.require(ALICE, AccessAction.ARTIFACT_READ, memory, context=AUDIT)).allowed
+            assert not (await service.check(ALICE, AccessAction.ARTIFACT_WRITE, memory, context=AUDIT)).allowed
+
+            async with profile.database.transaction() as connection:
+                bound = service.with_connection(connection)
+                assert bound.provider is service.provider
+                assert (await bound.require(ALICE, AccessAction.ARTIFACT_READ, memory, context=AUDIT)).allowed
+                with pytest.raises(AccessDeniedError):
+                    await bound.require(ALICE, AccessAction.ARTIFACT_WRITE, memory, context=AUDIT)
+
+    asyncio.run(scenario())
+
+
 def test_authzen_uses_logical_identity_and_trusted_powercontext_context() -> None:
     seen: list[dict[str, object]] = []
     subject = PrincipalRef(type="user", id="workforce:alice", description="Alice")