Upload folder using huggingface_hub

app/api/routes_admin.py

@@ -11,7 +11,8 @@ import secrets
 import uuid
 from sqlalchemy.orm import Session
 from app.api.deps import get_db
-from app.core.usage_tracker import tracker, Tier
+from app.core import usage_tracker
+from app.core.usage_tracker import Tier
 from app.database.models_intents import TenantDB
 
 router = APIRouter(prefix="/admin", tags=["admin"])
@@ -67,7 +68,7 @@ async def create_api_key(req: CreateKeyRequest, db: Session = Depends(get_db)):
         db.commit()
 
     new_key = f"sk_live_{uuid.uuid4().hex[:24]}"
-    tracker.get_or_create_api_key(new_key, tenant_id=tenant_id, tier=tier_enum)
+    usage_tracker.tracker.get_or_create_api_key(new_key, tenant_id=tenant_id, tier=tier_enum)
     return {"api_key": new_key, "tenant_id": tenant_id, "tier": req.tier}
 
 
@@ -82,8 +83,8 @@ async def list_api_keys(limit: int = 100, offset: int = 0):
     longer has -- query `/admin/keys/{api_key}/audit` with the real key for
     per-key usage/audit history instead.
     """
-    with tracker._get_pg_conn() as conn:
-        rows = tracker._pg_execute(
+    with usage_tracker.tracker._get_pg_conn() as conn:
+        rows = usage_tracker.tracker._pg_execute(
             conn,
             "SELECT lookup_hash, tier, created_at, last_used_at, is_active FROM api_keys "
             "ORDER BY created_at DESC LIMIT %s OFFSET %s",
@@ -111,13 +112,13 @@ async def update_key_tier(
     if req.tier not in [t.value for t in Tier]:
         raise HTTPException(
             status_code=400, detail=f"Invalid tier. Must be one of {[t.value for t in Tier]}")
-    with tracker._get_pg_conn() as conn:
-        row = tracker._pg_execute(
+    with usage_tracker.tracker._get_pg_conn() as conn:
+        row = usage_tracker.tracker._pg_execute(
             conn, "SELECT lookup_hash FROM api_keys WHERE lookup_hash = %s", (key_id,)).fetchone()
         if not row:
             conn.rollback()
             raise HTTPException(status_code=404, detail="API key not found")
-        tracker._pg_execute(
+        usage_tracker.tracker._pg_execute(
             conn, "UPDATE api_keys SET tier = %s WHERE lookup_hash = %s", (req.tier, key_id))
         conn.commit()
     return {"message": f"Tier updated to {req.tier}"}
@@ -133,8 +134,8 @@ async def rotate_api_key(
     before this endpoint existed) risks losing track of the tenant_id
     partway through, or leaving the old key active if a later step fails.
     The new plaintext key is returned exactly once, like create_api_key's."""
-    with tracker._get_pg_conn() as conn:
-        old_row = tracker._pg_execute(
+    with usage_tracker.tracker._get_pg_conn() as conn:
+        old_row = usage_tracker.tracker._pg_execute(
             conn, "SELECT tenant_id, tier FROM api_keys WHERE lookup_hash = %s", (key_id,)
         ).fetchone()
         if not old_row:
@@ -143,15 +144,15 @@ async def rotate_api_key(
 
         new_key = f"sk_live_{uuid.uuid4().hex[:24]}"
         salt = secrets.token_hex(16)
-        tracker._pg_execute(
+        usage_tracker.tracker._pg_execute(
             conn, "UPDATE api_keys SET is_active = false WHERE lookup_hash = %s", (key_id,))
-        tracker._pg_execute(
+        usage_tracker.tracker._pg_execute(
             conn,
             "INSERT INTO api_keys "
             "(tenant_id, tier, created_at, is_active, salt, key_hash, lookup_hash) "
             "VALUES (%s, %s, %s, %s, %s, %s, %s)",
             (old_row["tenant_id"], old_row["tier"], datetime.utcnow(), True,
-             salt, tracker._salted_hash(new_key, salt), tracker._lookup_hash(new_key)),
+             salt, usage_tracker.tracker._salted_hash(new_key, salt), usage_tracker.tracker._lookup_hash(new_key)),
         )
         conn.commit()
 
@@ -166,13 +167,13 @@ async def rotate_api_key(
 @router.delete("/keys/{key_id}", dependencies=[Depends(verify_admin)])
 async def deactivate_api_key(
         key_id: str = Path(..., description="The key_id from GET /admin/keys (not the raw API key)")):
-    with tracker._get_pg_conn() as conn:
-        row = tracker._pg_execute(
+    with usage_tracker.tracker._get_pg_conn() as conn:
+        row = usage_tracker.tracker._pg_execute(
             conn, "SELECT lookup_hash FROM api_keys WHERE lookup_hash = %s", (key_id,)).fetchone()
         if not row:
             conn.rollback()
             raise HTTPException(status_code=404, detail="API key not found")
-        tracker._pg_execute(
+        usage_tracker.tracker._pg_execute(
             conn, "UPDATE api_keys SET is_active = false WHERE lookup_hash = %s", (key_id,))
         conn.commit()
     return {"message": "API key deactivated"}
@@ -187,23 +188,23 @@ async def get_audit_logs(
 ):
     start = datetime.fromisoformat(start_date) if start_date else None
     end = datetime.fromisoformat(end_date) if end_date else None
-    logs = tracker.get_audit_logs(api_key, start, end, limit)
+    logs = usage_tracker.tracker.get_audit_logs(api_key, start, end, limit)
     return {"api_key": api_key, "logs": logs}
 
 
 @router.get("/stats", dependencies=[Depends(verify_admin)])
 async def get_global_stats():
-    with tracker._get_pg_conn() as pg_conn:
-        total_keys = tracker._pg_execute(
+    with usage_tracker.tracker._get_pg_conn() as pg_conn:
+        total_keys = usage_tracker.tracker._pg_execute(
             pg_conn, "SELECT COUNT(*) FROM api_keys WHERE is_active = true").fetchone()["count"]
         pg_conn.commit()
-    with tracker._get_conn() as conn:
+    with usage_tracker.tracker._get_conn() as conn:
         total_requests = conn.execute(
             "SELECT COUNT(*) FROM usage_log").fetchone()[0]
         by_tier = conn.execute(
             "SELECT tier, COUNT(*) as count FROM usage_log GROUP BY tier"
         ).fetchall()
-        month = tracker._get_month_key()
+        month = usage_tracker.tracker._get_month_key()
         current_month_requests = conn.execute(
             "SELECT SUM(count) FROM monthly_counts WHERE year_month = ?", (month,)
         ).fetchone()[0] or 0

app/api/routes_governance.py

@@ -81,6 +81,7 @@ except ImportError:
 try:
     from arf_enterprise.executor import EnterpriseExecutor
     from arf_enterprise.actuators.fake import FakeCloudActuator
+    from arf_enterprise.config import EnterpriseConfig
     from arf_enterprise.store import ApprovalStore, PostgresStore
     from arf_enterprise.exceptions import (
         ExecutionError as EnterpriseExecutionError,
@@ -92,12 +93,31 @@ except ImportError:
     ENTERPRISE_EXECUTOR_AVAILABLE = False
     EnterpriseExecutor = None
     FakeCloudActuator = None
+    EnterpriseConfig = None
     ApprovalStore = None
     PostgresStore = None
     EnterpriseExecutionError = None
     PendingApprovalError = None
     EnterpriseSafetyError = None
 
+
+def _trusted_signing_keys() -> List[str]:
+    """Parse ARF_TRUSTED_SIGNING_KEYS into a list of hex fingerprints.
+
+    Comma-separated, matching EnterpriseConfig.from_env's own parsing.
+    Splitting matters: the variable holds N fingerprints, and passing the
+    raw string as a single-element list would register the literal
+    "abc,def" as one key -- so neither real key would be trusted, and an
+    unset variable would register the empty string as trusted rather than
+    trusting nothing.
+
+    An empty result is the correct fail-closed state: the ladder then
+    rejects every signed intent, which is loud and safe.
+    """
+    raw = os.getenv("ARF_TRUSTED_SIGNING_KEYS", "")
+    return [k.strip() for k in raw.split(",") if k.strip()]
+
+
 ARF_ENABLE_EXECUTION = os.getenv("ARF_ENABLE_EXECUTION", "false").lower() == "true"
 
 # ===== OPEN TELEMETRY =====
@@ -501,7 +521,27 @@ async def execute_intent_endpoint(
     # mode is the documented fallback (see EnterpriseExecutor.execute).
     approval_store = getattr(request.app.state, "approval_store", None)
 
+    # A narrow config carrying only the trust anchor. Deliberately NOT
+    # EnterpriseConfig.from_env(), which would also pick up ARF_CLOUD,
+    # ARF_MAX_BLAST_RADIUS, ARF_ENFORCE_BUSINESS_HOURS and the audit/safety
+    # toggles -- turning on guardrails and audit logging as a side effect of
+    # enabling signing is a behaviour change nobody asked for. Everything
+    # other than the trusted keys stays on today's defaults.
+    #
+    # Without this the executor got EnterpriseConfig() with an empty
+    # trusted_signing_keys, so the ladder trusted no keys and rejected every
+    # signed intent as "Untrusted signing key" -- the whole execute path was
+    # unreachable regardless of ARF_ENABLE_EXECUTION.
+    trusted_keys = _trusted_signing_keys()
+    if not trusted_keys:
+        logger.warning(
+            "ARF_TRUSTED_SIGNING_KEYS is unset or empty; the execution ladder "
+            "trusts no signing keys and will reject every signed intent. Set it "
+            "to the hex fingerprint(s) of the key(s) permitted to sign intents."
+        )
+
     executor = EnterpriseExecutor(
+        config=EnterpriseConfig(trusted_signing_keys=trusted_keys),
         actuator=FakeCloudActuator(),
         approval_store=approval_store,
         on_verified_outcome=_on_verified_outcome,

app/api/routes_incidents.py

@@ -33,7 +33,8 @@ from agentic_reliability_framework.core.models.event import (
 from app.api.deps import verify_internal_key
 from app.causal_explainer import CausalExplainer
 from app.core.storage import incident_history
-from app.core.usage_tracker import UsageRecord, enforce_quota, tracker
+from app.core import usage_tracker
+from app.core.usage_tracker import UsageRecord, enforce_quota
 
 logger = logging.getLogger(__name__)
 
@@ -227,7 +228,7 @@ async def evaluate_incident(
         # ------------------------------------------------------------------
         # Asynchronous usage logging
         # ------------------------------------------------------------------
-        if tracker:
+        if usage_tracker.tracker:
             record = UsageRecord(
                 api_key=api_key,
                 tier=tier,
@@ -237,7 +238,7 @@ async def evaluate_incident(
                 response=response_data,
                 processing_ms=(time.time() - start_time) * 1000,
             )
-            await tracker.increment_usage_async(record, background_tasks)
+            await usage_tracker.tracker.increment_usage_async(record, background_tasks)
 
         logger.warning(
             "Deprecated endpoint /v1/incidents/evaluate called by key %s",
@@ -250,7 +251,7 @@ async def evaluate_incident(
     except Exception as exc:
         error_msg = str(exc)
         logger.exception("Error in evaluate_incident (deprecated endpoint)")
-        if tracker:
+        if usage_tracker.tracker:
             record = UsageRecord(
                 api_key=api_key,
                 tier=tier,
@@ -260,5 +261,5 @@ async def evaluate_incident(
                 error=error_msg,
                 processing_ms=(time.time() - start_time) * 1000,
             )
-            await tracker.increment_usage_async(record, background_tasks)
+            await usage_tracker.tracker.increment_usage_async(record, background_tasks)
         raise HTTPException(status_code=500, detail="Internal server error")

app/api/routes_payments.py

@@ -8,7 +8,8 @@ import stripe
 from fastapi import APIRouter, HTTPException
 from pydantic import BaseModel
 
-from app.core.usage_tracker import tracker, Tier
+from app.core import usage_tracker
+from app.core.usage_tracker import Tier
 
 logger = logging.getLogger(__name__)
 
@@ -31,11 +32,11 @@ async def create_checkout_session(req: CheckoutRequest):
     """Create a Stripe Checkout session for the Pro tier."""
     if not stripe.api_key:
         raise HTTPException(status_code=500, detail="Stripe not configured")
-    if not tracker:
+    if not usage_tracker.tracker:
         raise HTTPException(status_code=503, detail="Usage tracking service not initialised")
 
     # Verify the API key exists and is free tier
-    tier = tracker.get_tier(req.api_key)
+    tier = usage_tracker.tracker.get_tier(req.api_key)
     if tier != Tier.FREE:
         raise HTTPException(status_code=400,
                             detail="Only free tier keys can be upgraded")
@@ -47,7 +48,7 @@ async def create_checkout_session(req: CheckoutRequest):
     # third party with no reason to ever see it. tenant_id is an opaque,
     # non-secret row identifier and is exactly what the webhook needs to
     # look up which tenant's keys to retier.
-    tenant_id = tracker.get_tenant_id(req.api_key)
+    tenant_id = usage_tracker.tracker.get_tenant_id(req.api_key)
 
     try:
         checkout_session = stripe.checkout.Session.create(

app/api/routes_users.py

@@ -9,7 +9,8 @@ from sqlalchemy.orm import Session
 from slowapi import Limiter
 from slowapi.util import get_remote_address
 
-from app.core.usage_tracker import tracker, enforce_quota, Tier
+from app.core import usage_tracker
+from app.core.usage_tracker import enforce_quota, Tier
 from app.api.deps import get_db
 from app.database.models_intents import TenantDB  # <-- NEW
 
@@ -30,7 +31,7 @@ async def register_user(
     Public endpoint to create a new free‑tier API key and a new tenant.
     Rate‑limited to 5 requests per hour per IP address.
     """
-    if tracker is None:
+    if usage_tracker.tracker is None:
         raise HTTPException(status_code=503, detail="Usage tracking service not initialised")
 
     # 1. Create a new tenant in the main database
@@ -48,7 +49,7 @@ async def register_user(
 
     # 2. Generate a new API key for this tenant
     new_key = f"sk_free_{uuid.uuid4().hex[:24]}"
-    success = tracker.get_or_create_api_key(api_key=new_key, tenant_id=tenant_id, tier=Tier.FREE)
+    success = usage_tracker.tracker.get_or_create_api_key(api_key=new_key, tenant_id=tenant_id, tier=Tier.FREE)
     if not success:
         # Rollback tenant creation if key creation fails
         db.delete(new_tenant)

app/core/usage_tracker.py

@@ -629,6 +629,17 @@ class UsageTracker:
 # --------------------------------------------------------------------------
 # Global instance and FastAPI dependency
 # --------------------------------------------------------------------------
+# Rebound by init_tracker() during the app lifespan, which means consumers
+# MUST reach it through the module -- `from app.core import usage_tracker`,
+# then `usage_tracker.tracker`. Never `from app.core.usage_tracker import
+# tracker`: that copies the *binding* (None) at import time, and init_tracker
+# rebinding this global does not update the importer's copy. Five modules
+# did exactly that (main, routes_admin, routes_incidents, routes_payments,
+# routes_users) and every one of them saw None forever -- silently skipping
+# metering and disabling signup/checkout, and crashing the Render deploy
+# outright once main.py called a method on it. Functions defined *in* this
+# module (enforce_quota, update_key_tier*) are safe to import by name: they
+# resolve `tracker` here, at call time.
 tracker: Optional[UsageTracker] = None
 
 

app/main.py

@@ -83,7 +83,8 @@ from agentic_reliability_framework.core.temporal_reliability import (
 )
 
 # ── Usage tracker ────────────────────────────────────────────
-from app.core.usage_tracker import init_tracker, tracker, Tier
+from app.core import usage_tracker
+from app.core.usage_tracker import init_tracker, Tier
 
 from app.api import (
     routes_governance,
@@ -285,8 +286,8 @@ async def lifespan(app: FastAPI):
             # the health endpoint answers, the deploy succeeds, and API
             # requests get a clean 503 from enforce_quota until the database
             # is reachable -- at which point they recover with no redeploy.
-            postgres_ready = tracker.warm_up() if tracker else False
-            if tracker and not postgres_ready:
+            postgres_ready = usage_tracker.tracker.warm_up()
+            if not postgres_ready:
                 logger.error(
                     "Usage tracker started WITHOUT a Postgres connection: api_keys "
                     "is unreachable, so API-key validation and quota enforcement "
@@ -302,7 +303,7 @@ async def lifespan(app: FastAPI):
             # kills the process -- reintroducing the crash loop the warm-up
             # above exists to prevent.
             api_keys_json = os.getenv("ARF_API_KEYS", "{}")
-            if tracker and not postgres_ready and api_keys_json not in ("", "{}"):
+            if not postgres_ready and api_keys_json not in ("", "{}"):
                 logger.warning(
                     "Skipping ARF_API_KEYS seeding: Postgres is unreachable. "
                     "Seeded keys will not exist until the database recovers "
@@ -311,41 +312,38 @@ async def lifespan(app: FastAPI):
                 api_keys_json = "{}"
             try:
                 api_keys = json.loads(api_keys_json)
-                if tracker:
-                    for key, tier_str in api_keys.items():
-                        try:
-                            tier = Tier(tier_str.lower())
-                            # Previously called get_or_create_api_key(key, tier)
-                            # -- tier was silently accepted as tenant_id, so
-                            # every seeded key of the same tier collided onto
-                            # one bogus tenant_id. These are demo/env-seeded
-                            # keys with no real TenantDB row, but each still
-                            # needs its own tenant_id to avoid cross-key
-                            # contamination in tenant-scoped state elsewhere
-                            # (BetaStateDB, IntentDB, decision audit log). A
-                            # fixed-length key prefix isn't safe here: keys
-                            # generated elsewhere in this codebase share an
-                            # 8-char prefix ("sk_live_"/"sk_free_"), so a
-                            # prefix-based id would collide the same way the
-                            # original bug did. Hash the whole key instead.
-                            tenant_id = "env-seed-" + hashlib.sha256(key.encode()).hexdigest()[:16]
-                            tracker.get_or_create_api_key(key, tenant_id=tenant_id, tier=tier)
-                            logger.info(f"Seeded API key for tier {tier.value}")
-                        except ValueError:
-                            logger.warning(
-                                f"Invalid tier '{tier_str}' for key {key}, skipping"
-                            )
+                for key, tier_str in api_keys.items():
+                    try:
+                        tier = Tier(tier_str.lower())
+                        # Previously called get_or_create_api_key(key, tier)
+                        # -- tier was silently accepted as tenant_id, so
+                        # every seeded key of the same tier collided onto
+                        # one bogus tenant_id. These are demo/env-seeded
+                        # keys with no real TenantDB row, but each still
+                        # needs its own tenant_id to avoid cross-key
+                        # contamination in tenant-scoped state elsewhere
+                        # (BetaStateDB, IntentDB, decision audit log). A
+                        # fixed-length key prefix isn't safe here: keys
+                        # generated elsewhere in this codebase share an
+                        # 8-char prefix ("sk_live_"/"sk_free_"), so a
+                        # prefix-based id would collide the same way the
+                        # original bug did. Hash the whole key instead.
+                        tenant_id = "env-seed-" + hashlib.sha256(key.encode()).hexdigest()[:16]
+                        usage_tracker.tracker.get_or_create_api_key(key, tenant_id=tenant_id, tier=tier)
+                        logger.info(f"Seeded API key for tier {tier.value}")
+                    except ValueError:
+                        logger.warning(
+                            f"Invalid tier '{tier_str}' for key {key}, skipping"
+                        )
             except json.JSONDecodeError:
                 logger.warning(
                     "ARF_API_KEYS environment variable is not valid JSON; skipping seeding."
                 )
-            app.state.usage_tracker = tracker
-            if tracker and postgres_ready:
+            app.state.usage_tracker = usage_tracker.tracker
+            if postgres_ready:
                 logger.info("✅ Usage tracker ready.")
-            elif tracker:
-                logger.warning("⚠️  Usage tracker started in degraded mode (no Postgres).")
             else:
-                logger.error("❌ Usage tracker is None; API-key validation and quota enforcement will not work.")
+                logger.warning("⚠️  Usage tracker started in degraded mode (no Postgres).")
         except Exception as e:
             # Still fail closed on genuine configuration errors -- a missing
             # or too-short ARF_KEY_PEPPER, an unset DATABASE_URL. Those never

tests/test_tracker_binding.py

@@ -0,0 +1,52 @@
+"""Guard against re-introducing the stale `tracker` from-import.
+
+`app.core.usage_tracker.tracker` starts as None and is rebound by
+`init_tracker()` during the lifespan. `from app.core.usage_tracker import
+tracker` copies the *binding* -- None -- at import time, and the later
+rebinding never reaches the importer. Five modules did this: main.py
+crashed the Render deploy with "'NoneType' object has no attribute
+'warm_up'", routes_admin's 20 unguarded uses would have 500'd, and
+routes_incidents/payments/users each had a `if tracker` guard that could
+only ever take the None branch -- so usage went unmetered and signup and
+checkout were permanently disabled, silently.
+
+This is a source-level check on purpose. Reproducing the bug at runtime
+needs a real UsageTracker (Postgres, pepper) and would only cover the
+modules the test happened to import; parsing every module catches the
+next one too, and costs nothing.
+"""
+
+import ast
+import pathlib
+
+import pytest
+
+APP = pathlib.Path(__file__).resolve().parent.parent / "app"
+
+# Names safe to import directly: functions defined in usage_tracker.py
+# resolve the module global at call time, so they always see the live
+# instance. Only the mutable module-level object itself is unsafe.
+UNSAFE_NAMES = {"tracker"}
+
+
+def _source_files():
+    return sorted(p for p in APP.rglob("*.py"))
+
+
+@pytest.mark.parametrize("path", _source_files(), ids=lambda p: p.name)
+def test_tracker_is_never_imported_by_name(path):
+    tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.ImportFrom):
+            continue
+        if node.module != "app.core.usage_tracker":
+            continue
+        offenders = sorted(
+            {a.name for a in node.names} & UNSAFE_NAMES
+        )
+        assert not offenders, (
+            f"{path.name}:{node.lineno} imports {offenders} by name from "
+            "app.core.usage_tracker. That binding is None at import time and "
+            "init_tracker() will not update it. Use `from app.core import "
+            "usage_tracker` and reference `usage_tracker.tracker` instead."
+        )