morphogenesis_observer_acl

Canonical Redis ACL contract for the isolated morphogenesis observer.

This module is deliberately standard-library-only. The Stage 6A acceptance gate imports it in --plan-only mode, where importing Redis, Stargazer runtime services, or the morphogenesis package would widen the inspection surface.

class morphogenesis_observer_acl.AclDryRunProbe(label, command)

Bases: object

One side-effect-free ACL DRYRUN authority assertion.

Parameters:

label (str)
command (tuple[str, ...])

label: str

command: tuple[str, ...]

morphogenesis_observer_acl.observer_acl_contract_digest()

Bind reports and tests to the exact secret-free ACL contract.

Return type:: str

morphogenesis_observer_acl.observer_acl_contract_document()

Return the secret-free, state-independent production ACL contract.

Return type:: dict[str, object]

morphogenesis_observer_acl.observer_acl_rules(password, *, enabled)

Return a reset-from-scratch ACL rule vector with one password.

Redis accepts a SHA-256 password modifier, so the cleartext credential does not need to cross the administrative connection or appear in Redis command diagnostics.

Return type:

tuple[str, ...]

Parameters:

password (str)
enabled (bool)

morphogenesis_observer_acl.observer_password_sha256(password)

Return the password hash format exposed by ACL GETUSER.

Return type:: str
Parameters:: password (str)

morphogenesis_observer_acl.validate_deployable_observer_password(password)

Return a password that every supported observer transport can consume.

The direct URL and Sentinel environment loaders both reject surrounding whitespace, control characters, and overlong UTF-8 credentials. Keeping that contract here prevents provisioning an ACL identity that the isolated runtime can never authenticate as.

Return type:: str
Parameters:: password (str)