fix(038): INV_3 region ID mismatch + ATTN_3 helper SEMANTICS grouping

- INV_3: capability_mapper.py — MapCaseImpl region closed with wrong ID
  (MapCase); duplicate MapCase endregion removed; all region pairs now
  match by EXACT ID (stack-verified)
- ATTN_3: tools_038 helpers (DualAuthHeaders/Post/GuardPermission) now
  carry 'scenario' primary keyword in [SEMANTICS] for DSA grouping
- Full invariant audit: INV_1-8 + ATTN_1-4 verified (module <400,
  CC<=10 via ruff C901=0, all non-root contracts <=150 lines)
- 108 tests green; index rebuilt
This commit is contained in:
2026-07-31 13:26:13 +03:00
parent a2c8041810
commit 610052464d
2 changed files with 4 additions and 4 deletions

View File

@@ -23,7 +23,7 @@ TOOL_RESPONSE_LIMIT = 12000
TOOL_TIMEOUT_SECONDS = 120
# #region AgentChat.ToolsScenarioGraph.DualAuthHeaders [C:1] [TYPE Function] [SEMANTICS helpers,auth,http]
# #region AgentChat.ToolsScenarioGraph.DualAuthHeaders [C:1] [TYPE Function] [SEMANTICS scenario,helpers,auth,http]
# @ingroup AgentChat
# @BRIEF Build dual-auth HTTP headers: service JWT + optional user JWT.
def _dual_auth_headers() -> dict[str, str]:
@@ -42,7 +42,7 @@ def _dual_auth_headers() -> dict[str, str]:
# #endregion AgentChat.ToolsScenarioGraph.DualAuthHeaders
# #region AgentChat.ToolsScenarioGraph.Post [C:2] [TYPE Function] [SEMANTICS helpers,http,post]
# #region AgentChat.ToolsScenarioGraph.Post [C:2] [TYPE Function] [SEMANTICS scenario,helpers,http,post]
# @ingroup AgentChat
# @BRIEF Async HTTP POST to the backend scenario API with dual-auth headers.
async def _post(path: str, payload: dict[str, Any] | None = None) -> Any:
@@ -58,7 +58,7 @@ async def _post(path: str, payload: dict[str, Any] | None = None) -> Any:
# #endregion AgentChat.ToolsScenarioGraph.Post
# #region AgentChat.ToolsScenarioGraph.GuardPermission [C:1] [TYPE Function] [SEMANTICS helpers,rbac,permission]
# #region AgentChat.ToolsScenarioGraph.GuardPermission [C:1] [TYPE Function] [SEMANTICS scenario,helpers,rbac,permission]
# @ingroup AgentChat
# @BRIEF Enforce invocation-time RBAC before tool side effects.
def _guard_tool_permission(tool_name: str) -> None: