Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

services/runtime/synthetic_monitor.py

@@ -0,0 +1,88 @@
+"""Permanent, secret-free synthetic monitoring for the governed Gitea surface."""
+
+from __future__ import annotations
+
+import json
+import re
+import urllib.error
+import urllib.request
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import yaml  # type: ignore[import-untyped]
+
+_GITEA_READY_URL = "http://connector-gitea:8080/health/ready"
+_FINGERPRINT = re.compile(r"^[0-9a-f]{64}$")
+_MAX_RESPONSE_BYTES = 32 * 1024
+
+
+@dataclass(frozen=True)
+class SyntheticSnapshot:
+    tool_count: int
+    capability_fingerprint: str
+    upstream: str
+
+
+def expected_gitea_wire_tools(catalog_root: Path) -> frozenset[str]:
+    names: set[str] = set()
+    for path in sorted((catalog_root / "tools").glob("*.yaml")):
+        value = yaml.safe_load(path.read_text(encoding="utf-8"))
+        spec = value.get("spec", {}) if isinstance(value, dict) else {}
+        if spec.get("connectorType") != "gitea":
+            continue
+        name = spec.get("connectorToolName", spec.get("canonicalName"))
+        if not isinstance(name, str) or not name:
+            raise ValueError("Gitea catalog carries an invalid connector tool name")
+        names.add(name)
+    if not names:
+        raise ValueError("Gitea synthetic monitor has no expected tools")
+    return frozenset(names)
+
+
+class GiteaSyntheticMonitor:
+    """Probe upstream reachability and detect capability drift every worker cycle."""
+
+    def __init__(self, catalog_root: Path) -> None:
+        self.expected_tools = expected_gitea_wire_tools(catalog_root)
+        self._baseline_fingerprint: str | None = None
+
+    def probe(self) -> SyntheticSnapshot:
+        request = urllib.request.Request(  # noqa: S310 - fixed internal allowlisted endpoint
+            _GITEA_READY_URL,
+            headers={"Accept": "application/json"},
+            method="GET",
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=5) as response:  # noqa: S310
+                raw = response.read(_MAX_RESPONSE_BYTES + 1)
+                status = int(response.status)
+        except (OSError, urllib.error.URLError) as exc:
+            raise RuntimeError("Gitea synthetic readiness probe failed") from exc
+        if status != 200 or len(raw) > _MAX_RESPONSE_BYTES:
+            raise RuntimeError("Gitea synthetic readiness response is invalid")
+        try:
+            payload: Any = json.loads(raw)
+        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+            raise RuntimeError("Gitea synthetic readiness response is invalid") from exc
+        if not isinstance(payload, dict):
+            raise RuntimeError("Gitea synthetic readiness response is invalid")
+        fingerprint = payload.get("capabilityFingerprint")
+        tool_count = payload.get("toolCount")
+        if (
+            payload.get("status") != "ready"
+            or payload.get("upstream") != "reachable"
+            or not isinstance(tool_count, int)
+            or tool_count != len(self.expected_tools)
+            or not isinstance(fingerprint, str)
+            or not _FINGERPRINT.fullmatch(fingerprint)
+        ):
+            raise RuntimeError("Gitea synthetic capability contract drifted")
+        if self._baseline_fingerprint is not None and fingerprint != self._baseline_fingerprint:
+            raise RuntimeError("Gitea synthetic capability fingerprint changed unexpectedly")
+        self._baseline_fingerprint = fingerprint
+        return SyntheticSnapshot(
+            tool_count=tool_count,
+            capability_fingerprint=fingerprint,
+            upstream="reachable",
+        )