cbc9ad73f7
Reference implementation of GCAP-SPEC-SHELLBOUND-BROKER-0001
in FastAPI. Designed for ISVs and enterprises implementing
the governed shell authorization protocol.
Architecture:
FastAPI + SQLModel + Pydantic + async SQLite
Single container deployment: Dockerfile included
OpenAPI schema at /docs is the machine-readable GSAP contract
Broker Interface (§5):
POST /governance/authorize/ — Issue AC
GET /governance/authorize/{p}/ — Poll elevation
POST /governance/complete/ — Receive CR
GET /governance/session/{id}/ — View chain of custody
POST /governance/elevate/ — JIT elevation
GET /governance/drivers/ — List drivers
Identity Driver Interface (§2.2):
IdentityDriver — abstract base (ISV extension point)
KeycloakDriver — Keycloak implementation
DriverRegistry — driver lookup and registration
Chronicle integration (§1.4):
Optional CloudEvents emission via CHRONICLE_WEBHOOK_URL
Forgejo push event format for receiver compatibility
Models:
Pydantic schemas for AC, CR, Principal, Accord, Operation
SQLModel DB models for persistence
Tests: 6 async tests including full AC→CR cycle
695 lines across 27 files.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
26 lines
1.1 KiB
Python
26 lines
1.1 KiB
Python
"""Chronicle CloudEvents client. Optional per GSAP §1.4."""
|
|
import hashlib, json, logging
|
|
from datetime import datetime, UTC
|
|
import httpx
|
|
from gsap_broker.settings import settings
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
async def emit(kind: str, payload: dict) -> str:
|
|
url = settings.chronicle_webhook_url
|
|
if not url:
|
|
return ""
|
|
try:
|
|
event_json = json.dumps({"kind": kind, **payload}, sort_keys=True, default=str)
|
|
cid = "sha256:" + hashlib.sha256(event_json.encode()).hexdigest()
|
|
async with httpx.AsyncClient(timeout=5.0) as client:
|
|
await client.post(url, json={
|
|
"pusher": {"login": payload.get("principal_did", settings.broker_did)},
|
|
"ref": f"refs/gsap/{kind}",
|
|
"repository": {"full_name": "gsap-broker/governance"},
|
|
"commits": [{"message": f"{kind}: {json.dumps(payload, default=str)}"}],
|
|
}, headers={"X-Forgejo-Event": "push"})
|
|
return cid
|
|
except Exception as e:
|
|
logger.warning(f"Chronicle emit failed: {kind}: {e}")
|
|
return ""
|