|
| 1 | +"""SkillGuard — quality gates for skill evolution. |
| 2 | +
|
| 3 | +Wraps ReviewGate + SkillStore into a single guarded API that ensures |
| 4 | +every skill mutation is reviewed BEFORE persistence. Unsafe skills are |
| 5 | +never written to the store. |
| 6 | +
|
| 7 | +Three guarded entry points: |
| 8 | + - guarded_evolve() — for FIXED/DERIVED evolutions (store.evolve_skill) |
| 9 | + - guarded_save() — for CAPTURED skills (store.save_record) |
| 10 | + - guarded_reactivate() — re-review before reactivating quarantined skills |
| 11 | +
|
| 12 | +Usage:: |
| 13 | +
|
| 14 | + guard = SkillGuard(store=store) |
| 15 | + result = await guard.guarded_evolve(new_record, parent_ids) |
| 16 | + if not result.passed: |
| 17 | + logger.error("Skill blocked: %s", result) |
| 18 | +""" |
| 19 | + |
| 20 | +from __future__ import annotations |
| 21 | + |
| 22 | +import logging |
| 23 | +from typing import List, Optional |
| 24 | + |
| 25 | +from openspace.skill_engine.review_gate import ReviewGate, ReviewResult, CheckResult |
| 26 | + |
| 27 | +logger = logging.getLogger(__name__) |
| 28 | + |
| 29 | + |
| 30 | +class SkillGuard: |
| 31 | + """Pre-persist quality gate for all skill mutations. |
| 32 | +
|
| 33 | + Every mutation path (evolve, save, reactivate) runs through |
| 34 | + ReviewGate BEFORE the store write. If review fails, the write |
| 35 | + never happens — the skill is never activated. |
| 36 | + """ |
| 37 | + |
| 38 | + def __init__(self, store, gate: Optional[ReviewGate] = None) -> None: |
| 39 | + self._store = store |
| 40 | + self._gate = gate or ReviewGate() |
| 41 | + |
| 42 | + async def guarded_evolve( |
| 43 | + self, |
| 44 | + new_record, |
| 45 | + parent_skill_ids: List[str], |
| 46 | + ) -> ReviewResult: |
| 47 | + """Review, then persist an evolved skill (FIXED or DERIVED). |
| 48 | +
|
| 49 | + Returns the ReviewResult. If passed, the skill is persisted and |
| 50 | + activated. If failed, the skill is NOT persisted at all. |
| 51 | + """ |
| 52 | + result = self._gate.review(new_record) |
| 53 | + |
| 54 | + if not result.passed: |
| 55 | + failed = [c for c in result.checks if c.verdict == "fail"] |
| 56 | + logger.warning( |
| 57 | + "SkillGuard BLOCKED evolve of %s — failed: %s", |
| 58 | + new_record.skill_id, |
| 59 | + ", ".join(c.name for c in failed), |
| 60 | + ) |
| 61 | + for c in failed: |
| 62 | + logger.warning(" [%s] %s", c.name, c.detail) |
| 63 | + return result |
| 64 | + |
| 65 | + await self._store.evolve_skill(new_record, parent_skill_ids) |
| 66 | + logger.info( |
| 67 | + "SkillGuard APPROVED evolve of %s (gen=%d)", |
| 68 | + new_record.skill_id, |
| 69 | + new_record.lineage.generation, |
| 70 | + ) |
| 71 | + return result |
| 72 | + |
| 73 | + async def guarded_save(self, record) -> ReviewResult: |
| 74 | + """Review, then save a new captured skill. |
| 75 | +
|
| 76 | + Returns the ReviewResult. If passed, the skill is saved. |
| 77 | + If failed, the skill is NOT saved. |
| 78 | + """ |
| 79 | + result = self._gate.review(record) |
| 80 | + |
| 81 | + if not result.passed: |
| 82 | + failed = [c for c in result.checks if c.verdict == "fail"] |
| 83 | + logger.warning( |
| 84 | + "SkillGuard BLOCKED save of %s — failed: %s", |
| 85 | + record.skill_id, |
| 86 | + ", ".join(c.name for c in failed), |
| 87 | + ) |
| 88 | + return result |
| 89 | + |
| 90 | + await self._store.save_record(record) |
| 91 | + logger.info("SkillGuard APPROVED save of %s", record.skill_id) |
| 92 | + return result |
| 93 | + |
| 94 | + async def guarded_reactivate(self, skill_id: str) -> ReviewResult: |
| 95 | + """Re-review a quarantined skill before reactivation. |
| 96 | +
|
| 97 | + Fetches the record, runs review, and only reactivates if it passes. |
| 98 | + """ |
| 99 | + record = await self._store.get_record(skill_id) |
| 100 | + if record is None: |
| 101 | + return ReviewResult.from_checks([ |
| 102 | + CheckResult( |
| 103 | + name="lookup", |
| 104 | + verdict="fail", |
| 105 | + detail=f"Skill {skill_id} not found in store", |
| 106 | + ), |
| 107 | + ]) |
| 108 | + |
| 109 | + result = self._gate.review(record) |
| 110 | + |
| 111 | + if not result.passed: |
| 112 | + logger.warning( |
| 113 | + "SkillGuard BLOCKED reactivation of %s — still fails review", |
| 114 | + skill_id, |
| 115 | + ) |
| 116 | + return result |
| 117 | + |
| 118 | + await self._store.reactivate_record(skill_id) |
| 119 | + logger.info("SkillGuard APPROVED reactivation of %s", skill_id) |
| 120 | + return result |
0 commit comments