aeat.application.user_profile._capabilities module

Profile-linked service-capability resolution.

A capability is the operator’s opt-in/opt-out of an external service, stored as a boolean fact under the profile schema capabilities section of the UserProfileRecord. This module resolves the effective posture by overlaying that profile fact onto the global Settings default and the global safety floor, returning a typed CapabilityDecision with the reason.

The load-bearing invariant (service-capabilities ADR): a capability may only NARROW the global safety floor, never widen it. For cloud_evidence_upload the gestor-mode bar is applied FIRST and absolutely — no profile opt-in can re-enable cloud upload for a gestor deployment. The resolver is the single place this is computed; every gate routes through it.

class CapabilitySource(*values)[source]

Bases: StrEnum

Why a capability resolved the way it did.

PROFILE
DEFAULT
GLOBAL_SETTING
SAFETY_FLOOR
class CapabilityDecision(**data)[source]

Bases: BaseModel

The resolved posture of one service capability for a profile.

Parameters:
capability: ServiceCapability
enabled: bool
source: CapabilitySource
reason: str
resolve_capability(capability, *, profile_record, settings)[source]

Resolve capability for a UserProfileRecord against the global posture.

Pure: no I/O. Reads the profile’s capability fact (when present), falls back to the global Settings flag (cloud upload) or the conservative capability default (vision / google), and applies the global safety floor on top. The safety floor can only DISABLE, never enable.

Return type:

CapabilityDecision

Returns:

The resolved CapabilityDecision carrying the posture and reason.

Parameters:
resolve_active_capability(capability, *, settings=None)[source]

Resolve capability for the active profile (or the global default when none).

Loads the active-profile record through a pure read of workflow state (no mutation, no bucket events), mirroring the output-language resolver. With no active profile, profile_record is None and the resolver falls back to the global default — so the posture is well-defined even before a profile is selected.

Return type:

CapabilityDecision

Returns:

The resolved CapabilityDecision for the active profile.

Parameters: