Native governed embedding

use meerkat_runtime::{MeerkatMachine, RuntimeDriverError};
use meerkat_runtime::meerkat_machine::NativeGrantWorkConfiguration;

fn install_governance(
    owners: NativeGrantWorkConfiguration,
) -> Result<MeerkatMachine, RuntimeDriverError> {
    MeerkatMachine::ephemeral().with_local_grant_authorization(owners)
}

use meerkat::{AgentFactory, Config, FactoryAgentBuilder};
use meerkat_core::confinement::{
    ConfinementSpec, ExecutionConfinement, FilesystemAccess, IpNetworkAccess,
    PathAccess, PlatformBaseline,
};
use meerkat_tools::builtin::shell::ShellConfinement;

let requirement: ExecutionConfinement = ConfinementSpec {
    baseline: PlatformBaseline::CommandRuntimeV1,
    read: FilesystemAccess::Paths(vec![PathAccess::Subtree(work_root.clone())]),
    write: FilesystemAccess::Paths(vec![PathAccess::Subtree(work_root.clone())]),
    deny_read: vec![],
    deny_write: vec![],
    network: IpNetworkAccess::Denied,
    unix_connect: vec![],
    require_descendant_termination: false,
}
.try_into()?;

let factory = AgentFactory::new(sessions_path)
    .project_root(&work_root)
    .builtins(false)
    .shell(true)
    .with_shell_confinement(ShellConfinement::Required { requirement });
let mut config = Config::default();
config.shell.program = "/bin/bash".into();
// This example grants local shell operations, not provider-hosted search.
config.provider_tools.anthropic.web_search = false;
let builder = FactoryAgentBuilder::new(factory, config);

use std::{sync::Arc, time::Duration};
use meerkat::FactoryAgentBuilder;
use meerkat::operation_reviewer::{
    ModelOperationReviewer, ModelReviewerConfig,
    NativeOperationReviewContextSource,
};
use meerkat_core::{Provider, SessionLlmIdentity};
use meerkat_core::approval::review::BoundOperationReview;

let reviewer_identity = SessionLlmIdentity {
    model: reviewer_model.to_owned(),
    provider: Provider::OpenAI,
    self_hosted_server_id: None,
    provider_params: None,
    auth_binding: Some(reviewer_auth_binding),
};
let reviewer = ModelOperationReviewer::build(
    &factory,
    &config,
    ModelReviewerConfig::new(reviewer_identity, 256)?,
    Arc::new(NativeOperationReviewContextSource),
).await?;
let factory = factory.with_operation_review(Arc::new(BoundOperationReview::new(
    Arc::new(reviewer),
    approvals,
    Duration::from_secs(8),
)));
let builder = FactoryAgentBuilder::new(factory, config);

use std::sync::Arc;
use meerkat::{MemoryBlobStore, MemoryStore, PersistenceBundle};
use meerkat_runtime::InMemoryRuntimeStore;

let bundle = PersistenceBundle::new_with_local_grant_authorization(
    Arc::new(MemoryStore::new()),
    Arc::new(InMemoryRuntimeStore::new()),
    Arc::new(MemoryBlobStore::new()),
    owners,
)?;

let (service, machine) =
    meerkat::surface::build_runtime_backed_service_with_default_reconfigure_host(
        builder, max_sessions, bundle, reconfigure_config_path,
    );

use std::sync::Arc;
use meerkat::{PersistenceBundle, SqliteSessionStore};
use meerkat_runtime::SqliteRuntimeStore;

let runtime_store = Arc::new(
    SqliteRuntimeStore::new_whole_blob(database_path.clone())?,
);
let bundle = PersistenceBundle::new_with_local_grant_authorization(
    Arc::new(SqliteSessionStore::open(database_path)?),
    runtime_store,
    blob_store,
    owners,
)?;

let (service, machine) =
    meerkat::surface::build_runtime_backed_service_with_default_reconfigure_host(
        builder, max_sessions, bundle, reconfigure_config_path,
    );

let mut custody = machine.try_controller_grant_mutation()?;
grants.revoke(&administrator, &grant_to_remove, &mut custody)?;

use meerkat_core::service::{SessionServiceControlExt, SystemContextControlRequest};

let control = SystemContextControlRequest::from_trusted_ingress(
    session_id, request, facts, producer_receipt,
)?;
let result = service.append_authenticated_system_context(control).await?;

use meerkat_runtime::input::{Input, PromptInput};
use meerkat_runtime::input_authority::NativeIngressContext;

let mut prompt = PromptInput::new("Read the permitted record", None);
prompt.header.authority_association = Some(association);
let input = Input::Prompt(prompt);
let ingress = NativeIngressContext::from_trusted_ingress(
    &input, requester, ingress_actor, realm, authentication,
)?.with_controller_client(&input, pin)?;
let input = input.with_ingress_context(ingress)?;
let (accepted, completion) = machine
    .accept_input_with_completion(&session_id, input)
    .await?;

use meerkat_rpc::governed_jsonl::{
    GovernedConnection, GovernedJsonlSetup, serve_governed_jsonl,
};

let connection = GovernedConnection::new(
    requester, represented_subject, ingress_actor, realm,
    authentication_evidence, association_producer,
)?;
let setup = GovernedJsonlSetup {
    config,
    persistence: bundle,
    client: selected_client,
    connection,
    tools: catalog,
    mcp_attachment_identity_key_custody: None,
    session_binder: None,
    connector_authority: None,
};
serve_governed_jsonl(reader, writer, setup).await?;

./scripts/repo-cargo test --locked -p meerkat-rpc --lib \
  --no-default-features --features local-authorization \
  governed_jsonl::tests:: -- --test-threads=1