OCI Policy Analysis Presentation

Desktop UI

The desktop reference lists the maintained tab and reusable table modules. UI callbacks and private widget helpers remain implementation details.

class oci_policy_analysis.presentation.tk.base_tab.BaseUITab(*args: Any, **kwargs: Any)

Bases: Frame

Provide shared help, documentation-link, and timing behavior for UI tabs.

DOCROOT = 'https://agregory999.github.io/oci-policy-analysis'

create_doc_link_label(parent, text: str, url: str, **grid_kwargs) → tkinter.ttk.Label

Create a styled label that opens a documentation URL when clicked.

open_link(url: str)

Open a link in the user’s web browser. If browser opening fails, display the URL in a messagebox.

apply_settings(context_help: bool, font_size: str)

Apply application settings for context help and font size.

Parameters:

• context_help (bool) – Whether to show context (page) help.

• font_size (str) – Font size as ‘Small’, ‘Medium’, etc.

set_page_help_text(text: str, temporary: bool = False)

Sets help label text, ensuring the area always shows (at least) 2 lines for layout stability.

add_context_help(widget, message: str, restore_message: str | None = None)

Adds hover-based context help to given widget. If restore_message is not given, restores self.default_help_text.

set_page_help_permalink(permalink)

Set or change the persistent permalink in the Page Help area (right 10%).

update_page_help_visibility()

Show/hide (and re-pin) the page help frame at the top of the tab. Always keeps help fixed before all other widgets—never at the bottom.

refresh_context_help()

Re-applies page help styles/colors after theme/font change or context visibility event.

timed_step(label, fn, *args, **kwargs)

Run a callable, log its elapsed time, and return its result.

class oci_policy_analysis.presentation.tk.settings_tab.SettingsTab(*args: Any, **kwargs: Any)

Bases: BaseUITab

Settings Tab for OCI Policy Analysis UI. Allows configuration of tenancy, profile, MCP server, and display settings. All tenancy data is loaded via this tab.

refresh_context_help()

Refresh style/visibility of Page Help label. (SettingsTab extension point)

refresh_cache_list()

Update the cache list OptionMenu in the Settings tab to reflect the current state, preserving selection.

class oci_policy_analysis.presentation.tk.policies_tab.PoliciesTab(*args: Any, **kwargs: Any)

Bases: BaseUITab

Tab for displaying and filtering OCI policies.

• Supports searching and filtering by multiple criteria (OR via | character in fields).

• Includes saved search/load, policy export, and summary displays.

• Context help is unified and appears at the top, per app setting.

• Provides right-click analysis and integration with other app tabs.

clear_policy_filters()

export_policy_to_csv()

populate_data(*args)

Populate the policy output using per-step timing ala BaseUITab.timed_step (sub-timings).

update_policy_output(*args, **kwargs)

[DEPRECATED] Use populate_data instead for sub-timing and improved logging.

enable_widgets_after_load()

Enable widgets after load.

class oci_policy_analysis.presentation.tk.policy_browser_tab.PolicyBrowserTab(*args: Any, **kwargs: Any)

Bases: BaseUITab

Tab for browsing all compartments, policies, and policy statements in a JSON-style tree. Hierarchy: compartments → policies → statements (with statement text). No filtering or distinction of policy type; all statements appear under their policy.

on_search()

Perform case-insensitive search with highlighting and rebuild tree.

manage_policy_limits()

Open snapshot-scoped entry or explain why live limits cannot be overridden.

on_clear_search()

Clear search box and show full unfiltered tree.

post_load_update_ui()

Populate Policy Browser data widgets after repository data has been loaded.

refresh_tree()

Refresh the compartment/policy/statement tree from latest repo data.

expand_collapse_all(expand: bool = True)

Expand or collapse all nodes in the tree.

expand_collapse_compartments(only=True, expand=True)

Expand/collapse all compartments, but collapse their Policies nodes and below.

class oci_policy_analysis.presentation.tk.policy_recommendations_tab.PolicyRecommendationsTab(*args: Any, **kwargs: Any)

Bases: BaseUITab

Unified UI tab for displaying Oracle Cloud Policy Recommendations and analytics.

populate_data()

Called after policy analysis/intelligence is refreshed. Reload all analytics/tables, using timing. Also launches OCI tenancy limits fetch for policy objects and hierarchy statements.

reset_for_data_load() → None

Clear tenancy-scoped recommendation state before any new dataset is loaded.

update_limits_tab_output()

fetch_tenancy_policy_statement_limits()

update_cross_tenancy_tab_output() → None

Refresh cross-tenancy findings from the intelligence overlay.

update_supersession_tab_output() → None

Refresh complete-supersession rows from policy-intelligence output.

reload_all_analytics()

on_enabled_cleanup_checks_changed()

Called when Settings > Recommendation/Consolidation cleanup check toggles change. Re-runs analytics with new checks.

update_policy_risk_tab_output()

Aggregates risk per policy (from statement risk) and updates the table. Adds globally normalized risk and supporting stats.

update_risk_tab_output()

Update statement risk table: only allow statements, columns: Policy Path, Effective Path, Score, Relative Risk, Risk Notes, Statement Text (truncated).

update_overlap_tab_output()

update_consolidation_tab_output()

Refresh the consolidation tab’s data after analytics reload.

update_consolidation_plan_availability()

Allow handoff whenever the consolidation workbench is available.

update_cleanup_tab_output()

Refresh the cleanup tab’s data after analytics reload.

apply_settings(context_help: bool, font_size: str)

Apply context help and font size settings for the recommendations tab.

class oci_policy_analysis.presentation.tk.workload_principals_tab.WorkloadPrincipalsTab(*args: Any, **kwargs: Any)

Bases: BaseUITab

Display workload principals and their associated policy statements.

update_principals_sheets(*args)

Update view: show or hide tables depending on dropdown, update data in both tables.

• In DG mode, show both tables; in other principal modes, show only matching policy table, hiding DG table.

• Refresh table data for all cases.

• Text filter field applies to Matching Rule (DG) or Policy Statement (any-user modes).

apply_settings(context_help: bool, font_size: str)

Update help area and style on global context help and font size change (from main.py).

class oci_policy_analysis.presentation.tk.dynamic_group_tab.DynamicGroupsTab(*args: Any, **kwargs: Any)

Bases: BaseUITab

Dynamic Groups Tab for OCI Policy Analysis UI.

Browse, filter, and analyze dynamic groups and related policies. Select dynamic groups to reveal matching policy statements below.

set_show_all_data(checked: bool | None = None) → None

Sync table display columns with the Show all Data checkbox.

If checked is provided, force the checkbox to that state. If checked is None, rely on the current BooleanVar value (used when invoked by the Checkbutton command, since Tkinter has already toggled it).

set_ocid_filter_and_search(ocids: list[str] | None) → None

Set the DG OCID filter from a list of OCIDs and refresh the table.

Intended for cross-tab integrations (e.g., Policies tab right-click actions) to programmatically focus on one or more dynamic groups by OCID. OCIDs are joined with | to leverage existing OR semantics.

populate_data() → None

Populate / refresh Dynamic Groups tab data after a load.

This is the single entry point used by the main application after repository data is (re)loaded. It enables filter controls and refreshes the dynamic groups table using the current filter state.

apply_settings(context_help: bool, font_size: str)

Update context help and font settings (called globally from main app).

enable_controls()

Called from main app when data is loaded to enable the controls

class oci_policy_analysis.presentation.tk.users_tab.UsersTab(*args: Any, **kwargs: Any)

Bases: BaseUITab

Users Tab for OCI Policy Analysis UI. Allows selection of Groups or Users, and displays associated policy statements. Supports filtering and detailed policy statement views.

populate_data()

Populate / refresh Users tab data after a tenancy or cache load.

This is the single entry point used by the main application after repository data is (re)loaded. It ensures that:

• The GROUPS/USERS dropdown reflects the current repository state (including load_all_users and whether users were actually loaded).

• The top tables (groups/users) and counts are refreshed using the current search text and selection.

Behavior-wise this is equivalent to the previous sequence of calls from main:

• update_user_analysis_output()

• update_users_dropdown_options()

set_show_all_data(checked=None)

Sync table display columns with the Show all Data checkbox.

If checked is provided, force the checkbox to that state. If checked is None, rely on the current BooleanVar value (used when invoked by the Checkbutton command, since Tkinter has already toggled it).

sync_load_all_users_checkbox()

Ensures the checkbox/UI for load_all_users matches the repository state. Should be called after loading data/cache if UI lags behind data model.

should_show_users_option()

Returns True if the USERS option should be available in the dropdown, i.e., only if load_all_users is True AND there are users loaded.

update_users_dropdown_options()

Refresh the GROUPS/USERS dropdown based on current repo state.

This should be called after any tenancy/repository load and is safe to invoke at other times. The method also forces a refresh of the table below by calling update_user_analysis_output() at the end so that the current selection (GROUPS vs USERS) and search term are immediately reflected in the UI.

update_user_analysis_output()

Update the top user/group listing and associated counters.

This method is responsible for:

• Updating the Total Groups / Total Users labels from the underlying repository.

• Displaying either the groups table or the users table, depending on the current value of self.groups_option_var ('GROUPS' or 'USERS').

• Applying the search filter from self.user_group_search using GroupSearch / UserSearch.

It does not compute policy statements; those are handled by _update_user_analysis_policy_output() and update_user_policy_output().

update_user_policy_output()

Refresh the policy statements table and related labels.

This uses the pre-computed self.filtered_policies and self.selected_groups_for_table that are maintained by _update_user_analysis_policy_output() when the selection in the groups/users tables changes.

Responsibilities:

• Toggle between basic vs expanded policy columns based on the Parsed Output checkbox (self.chk_show_expanded).

• Optionally include “any-user” / “any-group” statements when the corresponding checkbox is enabled.

• Push the final policy list into self.users_policy_table and update the Selected Groups helper table and the Policy Statements (Filtered) count label.

on_load_all_users_setting_changed(enabled: bool)

Called if settings change for Load All Users to refresh user/group options and UI. Synchronizes between UI and model: both directions.

class oci_policy_analysis.presentation.tk.permissions_report_tab.PermissionsReportTab(*args: Any, **kwargs: Any)

Bases: BaseUITab

Tab for displaying permissions by effective compartment and subject in a treeview, with context help.

enable_widgets_after_load()

apply_settings(context_help: bool, font_size: str)

Apply main settings for context help and font size.

populate_tree()

on_tree_selection(event)

class oci_policy_analysis.presentation.tk.historical_tab.HistoricalTab(*args: Any, **kwargs: Any)

Bases: BaseUITab

Compare two cached tenancy states and display policy and identity changes.

populate_cache_dropdowns(tenancy_name=None)

class oci_policy_analysis.presentation.tk.simulation_tab.SimulationTab(*args: Any, **kwargs: Any)

Bases: BaseUITab

UI Tab for Policy Simulation:

• Section 1: Compartment and Principal chooser (dropdowns, load button)

• Section 2: Applies policy statement preview & where-fields preview

• Section 3: API Operation chooser, dynamic where inputs, simulate button

• Section 4: Results/tracing output

All major user actions log info/debug for workflow tracking.

populate_data()

Populate Simulation tab data once a tenancy is loaded.

This is invoked from App._post_load_update_ui, after policy_compartment_analysis has a concrete tenancy_ocid. At this point we can safely hydrate the simulation engine’s prospective (what-if) statements from settings for the active tenancy.

refresh_dropdowns()

Refreshes the dropdowns for compartment and principals.

• If users are not loaded, will hide/remove “user” as a principal type.

on_load_all_users_setting_changed(enabled: bool)

Called if settings change for Load All Users to refresh simulation principal types and UI.

apply_settings(context_help: bool, font_size: str)

Apply main settings for context help and font size.

load_statements()

Loads and displays policy statements for the currently selected compartment and principal.

Filters policy statements based on selection; populates the UI preview table and enables downstream simulation controls.

Returns:

None

add_prospective_statement_from_builder(statement_text: str, compartment_path: str | None = None, description: str | None = None) → None

Add a new prospective statement generated by the Tag-based builder.

This now delegates persistence to the tenancy-scoped ProspectiveStatementsService when available, or falls back to the simulation engine’s in-memory list. The Simulation tab itself remains read-only and simply refreshes its prospective preview.

open_prospective_editor(*_)

Open a simple CRUD dialog for managing prospective policy statements.

Users can add/edit/delete “what-if” statements that will be evaluated alongside real tenancy policies during simulation. Only statements applicable to the current compartment/principal will appear in the Applicable Policy Statements table, but this editor allows defining prospective statements anywhere in the tenancy.

load_where_fields(checked_rows=None)

Extracts and displays dynamic where clause input fields based on the selected statements.

Parses checked statements for required where-clause variables, then renders appropriate Tkinter fields for user input.

Returns:

None

on_trace_history_selected(event=None)

Displays simulation results for the selected simulation trace entry.

Parameters:

event (tk.Event, optional) – Optional Tkinter event object from dropdown selection.

Returns:

None

run_simulation()

Runs a policy simulation with the current selections (basic mode).

Triggers the simulation engine and displays allow/deny result and final permission set.

Returns:

None

class oci_policy_analysis.presentation.tk.condition_tester_tab.ConditionTesterTab(*args: Any, **kwargs: Any)

Bases: BaseUITab

UI Tab for interactively testing OCI Condition (Where) clauses using an AST simulation (ANTLR). Allows user to provide a where clause and simulated environment variables, and see evaluation/log details.

apply_settings(context_help: bool, font_size: str)

Apply main settings for context help and font size.

set_clause_text(text)

Programmatically set the contents of the where clause input.

class oci_policy_analysis.presentation.tk.data_table.DataTable(*args: Any, **kwargs: Any)

Bases: Frame

A Tkinter table widget with alternating row colors, sortable columns, resizable columns, show/hide columns, row selection with callback, full space utilization, cell copy functionality, and row context menu.

Note: for checklist-style tables with checkboxes and custom action button, see the more generic CheckboxTable class also defined below.

Note: ttk.Treeview does not natively support row-specific heights. This widget adjusts the whole table’s row height to fit the largest visible explicit newline count in the current row set, capped to keep tables usable. Text does not wrap automatically.

Variables:

• parent – The parent Tkinter widget.

• columns – List of all possible column names.

• display_columns – List of initially displayed column names.

• data – List of dictionaries containing row data.

• sortable – Enable/disable column sorting (default: True).

• row_colors – Tuple of colors for alternating rows (default: white, light gray).

• selection_callback – Optional function to call with selected rows (default: None). Can be omitted if no callback is needed.

• multi_select – Enable/disable multi-row selection (default: False).

• column_widths – Dictionary mapping column names to initial widths (default: None, uses 100 for all columns).

• row_context_menu_callback – Optional function to create a context menu for a row (default: None).

set_multi_select(multi_select: bool) → None

Set single or multi-select mode.

set_display_columns(display_columns: list[str]) → None

Set the displayed columns externally.

update_data(new_data: list[dict]) → None

Update table data and refresh display. Re-applies current sort if one was set.

apply_theme(theme: str) → None

Apply light or dark theme colors to the Treeview. :param theme: ‘light’ or ‘dark’

class oci_policy_analysis.presentation.tk.data_table.CheckboxTable(*args: Any, **kwargs: Any)

Bases: Frame

A DataTable-based Tkinter widget for a table with a first-column checkbox and resizable columns, alternating backgrounds, and an action button.

Optional display_columns restricts which columns are shown (subset of columns; the checkbox column is “☑”). Optional sortable enables column header sorting on the inner DataTable (default False).

get_checked_rows()

update_data(data)

Qt desktop prototype

Install the optional qt extra to run this source-level desktop exploration. See Embedding and Integrating OCI Policy Analysis for launch commands and lifecycle limitations.

Optional PySide6 workbench over the installed application services.

Importing this adapter does not import PySide6 or start an application. Use oci-policy-analysis-ui after installing the qt extra.

Qt workbench shell: page composition, navigation, and window lifetime.

class oci_policy_analysis.presentation.qt.main.WorkbenchWindow(*args: Any, **kwargs: Any)

Bases: QMainWindow

Compose independent pages around a controller-owned analysis snapshot.

Variables:

• controller – Owner of asynchronous loads and the latest successful context.

• settings_page – Combined overview, load settings, and hideable logging pane.

• browser_page – Original policy evidence and shared-core search controls.

• graph_page – Native Qt graph over direct corpus grants and excluded evidence.

• dynamic_groups_page – Known inventory and exact principal-focused evidence.

• users_groups_page – Known users, group memberships, and policy evidence.

• resource_principals_page – Resource, dynamic-group and OKE workload evidence.

• drawer – Shared animated record inspector across evidence pages.

• activity_page – Load stages and handled errors.

• mcp_page – Managed loopback MCP endpoint and optional Codex conversation.

Notes

No OCI connection occurs on construction. Logging settings affect the current process; explicit Apply actions save preferences. Close is blocked during loading and waits for MCP/Codex shutdown.

page_index(key: str) → int

Return the navigation index for a stable page key.

Parameters:

key – Page registry key, independent of visual navigation order.

Returns:

Position shared by navigation and the page stack.

Return type:

int

closeEvent(event: PySide6.QtGui.QCloseEvent) → None

Keep an active worker alive and detach the UI log handler on close.

oci_policy_analysis.presentation.qt.main.main(argv: list[str] | None = None) → int

Run the optional Qt workbench with independent pages over shared services.

Parameters:

argv – Application arguments; defaults to process arguments.

Returns:

Qt application exit code.

Return type:

int

Notes

Sample data is loaded from Overview & Settings after the window opens. OCI authentication occurs only after the user requests a live load.

Own the current context and publish successful asynchronous loads to pages.

class oci_policy_analysis.presentation.qt.controller.WorkbenchController(*args: Any, **kwargs: Any)

Bases: QObject

Coordinate load lifecycle independently of navigation and page widgets.

Variables:

• context – Latest successful context; None until the first successful load.

• settings – Session settings copied into each candidate context.

• worker – Active load thread, or None. Never read its context while loading.

progress

alias of str

loaded

alias of object

failed

alias of str

busy_changed

alias of bool

activity

alias of str

start_load(source: str, options: dict, description: str) → None

Start one worker, preserving the published context until success.

Worker-owned contexts and asynchronous loading through the shared core.

class oci_policy_analysis.presentation.qt.loading.LoadWorker(*args: Any, **kwargs: Any)

Bases: QThread

Own a candidate context until loading and enrichment finish in a worker.

progress

alias of str

loaded

alias of object

failed

alias of str

run() → None

Load a fresh context and emit either a successful snapshot or an error.

Combined overview, load settings, and collapsible logging controls.

class oci_policy_analysis.presentation.qt.pages.overview.OverviewSettingsPage(*args: Any, **kwargs: Any)

Bases: QScrollArea

Own loading inputs and snapshot overview; emit requests to the controller.

load_requested

alias of str

usage_changed

alias of bool

refresh_caches() → None

List saved caches without loading or rewriting a snapshot.

reflow_rows() → None

Stack Overview control rows when text sizing exceeds the viewport width.

resizeEvent(event) → None

Reflow loading controls after the scroll viewport or font size changes.

save_load_preferences(*, force: bool = False) → None

Persist load source, authentication and scope, including edits before close.

Parameters:

force – Save an explicit load request even when controls are unchanged.

Notes

Uses existing Tk/web setting keys and merges only these preferences. Saving does not authenticate or collect tenancy data.

load_options() → dict

Return explicit authentication and scope inputs without connecting to OCI.

load_sample() → None

Load fictional data through LoadService without authenticating to OCI.

set_busy(busy: bool) → None

Disable load and logging inputs until the current worker finishes.

set_load_locked(locked: bool) → None

Lock load sources while MCP serves the current snapshot.

set_snapshot(context: AppContext, result: LoadResult, description: str) → None

Refresh counts and collection scope from the newly published context.

Policy source browser with shared-core filtering and an evidence inspector.

class oci_policy_analysis.presentation.qt.pages.browser.PolicyBrowserPage(*args: Any, **kwargs: Any)

Bases: QWidget

Own the policy evidence table and source inspector.

details_requested

alias of object

focus_dynamic_group

alias of dict

set_context(context) → None

Replace the source model after a successful load.

search_payload() → dict

Return field filters or a validated complete JSON override.

refresh_saved_searches()

Read searches saved by all interfaces without changing current filters.

restore_search()

Restore the shared filter payload, including fields without native controls.

save_named_search(name: str, *, overwrite=False) → bool

Persist a named shared search while preserving other interfaces’ metadata.

prompt_save_search()

Ask for a name and explicit replacement of an existing saved search.

apply_filters() → None

Search the current repository through AnalysisService, including invalid evidence.

reset_filters() → None

Clear filters once, cancelling any pending debounced search.

focus_policy(policy: dict) → None

Show source statements for one inventory policy and compartment.

Native Qt graph of shared-core source grants, with evidence and exclusions.

class oci_policy_analysis.presentation.qt.pages.graph.PolicyGraphPage(*args: Any, **kwargs: Any)

Bases: QWidget

Draw principal → source grant → path relationships using native Qt items.

Variables:

• statements – Related source records with complete selected permission facts.

• details_requested – Explicit statement inspection request for the shared drawer.

• focus_dynamic_group – Request to focus a selected statement’s dynamic group.

Notes

Uses PolicyGraphService over the current corpus with all matching grants in a scrollable canvas and table. Edges represent direct source contributions, not inheritance, evaluated conditions, or OCI decisions.

details_requested

alias of object

focus_dynamic_group

alias of dict

set_theme(theme: str, color_theme: str = 'Forest') → None

Recolor the canvas and graph nodes without querying or reloading data.

set_context(context) → None

Bind the current corpus, including retained excluded source evidence.

search() → None

Search all matches in the current snapshot after a short typing debounce.

reset_filters() → None

Clear graph search independently of policy-browser filters.

showEvent(event) → None

Size the canvas after its page receives a real viewport geometry.

fit_graph() → None

Fit all matching nodes while retaining native pan and zoom controls.

cancel_pending_selection() → None

Stop queued node work before the owning window is destroyed.

Load progress and retained errors, separate from the live component log.

class oci_policy_analysis.presentation.qt.pages.activity.LoadActivityPage(*args: Any, **kwargs: Any)

Bases: QPlainTextEdit

Display bounded stage history without coupling to a loading thread.

Logging controls and a bounded INFO+ UI sink, independent of shell verbosity.

class oci_policy_analysis.presentation.qt.logging_panel.LogBridge(*args: Any, **kwargs: Any)

Bases: QObject

Batch at most 100 INFO+ records per timer tick into the UI.

Variables:

• message – Batched formatted text delivered on the GUI thread.

• prefix – Visible namespace or tuple of namespaces; all components by default.

• handler – INFO+ sink with a bounded 5,000-record pending queue.

Notes

DEBUG continues to the existing shell and file handlers. The GUI timer polls every 200 ms; queue overflow is reported rather than blocking loads.

message

alias of str

flush() → None

Deliver a bounded batch of pending records without blocking the UI.

clear() → None

Discard queued UI copies without changing shell or file output.

close() → None

Stop polling and detach the sink before its widgets are destroyed.

class oci_policy_analysis.presentation.qt.logging_panel.LiveLogView(*args: Any, **kwargs: Any)

Bases: QFrame

Read-only, bounded INFO+ output for the shell’s hideable log dock.

class oci_policy_analysis.presentation.qt.logging_panel.LoggingPanel(*args: Any, **kwargs: Any)

Bases: QFrame

Compact saved component controls with global reset and an INFO+ UI sink.

Parameters:

• settings – Shared settings, including saved component overrides.

• verbose – Whether startup DEBUG is locked for this process.

refresh_components() → None

Add newly registered loggers and reflow two compact label/level columns.

apply_levels() → None

Apply levels and persist preferences without saving startup –verbose.

Focused Qt settings widgets using the desktop/web setting names.

class oci_policy_analysis.presentation.qt.settings_panels.IntelligencePanel(*args: Any, **kwargs: Any)

Bases: QWidget

Configure enrichment and registered strategy selection for the next load.

reflow_columns(available: int) → None

Use one strategy column when large text exceeds the available width.

Parameters:

available – Width of the containing Overview viewport in pixels.

apply_settings() → None

Store session settings without mutating the currently displayed context.

class oci_policy_analysis.presentation.qt.settings_panels.AppearancePanel(*args: Any, **kwargs: Any)

Bases: QWidget

Apply text sizing and table density without rebuilding or reloading data.

changed

alias of dict

apply_settings() → None

Publish session appearance values to the window shell.

Load the existing application icon from package resources.

oci_policy_analysis.presentation.qt.icons.application_icon() → PySide6.QtGui.QIcon

Return the packaged application PNG as a Qt window/application icon.

Returns:

Runtime icon; packaged executables also need their platform icon metadata.

Return type:

QIcon

Web UI

For the ASGI application and server launcher, see OCI Policy Analysis Entry Points.

Loaded identity inventory, membership evidence, and related source policies.

class oci_policy_analysis.presentation.qt.pages.users_groups.UsersGroupsPage(*args: Any, **kwargs: Any)

Bases: QWidget

Browse loaded users and groups with read-only membership and policy evidence.

Variables:

• tabs – Group-based and user-based inventory views.

• group_view – Group filters, selected members, and matching statements.

• user_view – User filters, per-user memberships, and matching statements.

• details_requested – Explicit request to inspect retained source evidence.

details_requested

alias of object

focus_dynamic_group

alias of dict

set_context(context) → None

Replace the current snapshot and discard selections from the previous load.

Parameters:

context – Successfully loaded application context; queries remain local.

Dynamic-group inventory and exact principal-focused policy evidence.

class oci_policy_analysis.presentation.qt.pages.dynamic_groups.DynamicGroupsPage(*args: Any, **kwargs: Any)

Bases: QWidget

Browse known dynamic groups and the union of their source statements.

Variables:

• group_table – Sortable inventory with Ctrl/Cmd and Shift multi-selection.

• statements – Shared statement table with details and cross-page actions.

• context – Current loaded snapshot; replaced on each successful load.

details_requested

alias of object

focus_dynamic_group

alias of dict

set_context(context) → None

Discard prior selections and bind inventory to the new loaded snapshot.

reset_filters() → None

Clear inventory filters and retain only explicitly visible selections.

apply_filters(*, preserve_selection: bool = True) → None

Apply repository inventory filters; hidden groups stop contributing evidence.

focus_statement(statement: dict) → bool

Clear filters and focus known groups using their domains and names.

Parameters:

statement – Retained source statement; names are matched with domain, and opaque IDs are compared without changing their values.

Returns:

Whether at least one referenced group exists in the inventory.

Return type:

bool

Reusable source-record tables and statement context actions.

class oci_policy_analysis.presentation.qt.tables.RecordModel(*args: Any, **kwargs: Any)

Bases: QAbstractTableModel

Expose original statement evidence without creating one widget per cell.

headers = ()

rowCount(parent: PySide6.QtCore.QModelIndex = PySide6.QtCore.QModelIndex) → int

Return the number of source statements at the root.

columnCount(parent: PySide6.QtCore.QModelIndex = PySide6.QtCore.QModelIndex) → int

Return the fixed policy evidence column count.

data(index: PySide6.QtCore.QModelIndex, role: int = PySide6.QtCore.Qt.ItemDataRole.DisplayRole)

Return display/tooltip values without interpreting authorization.

headerData(section: int, orientation: PySide6.QtCore.Qt.Orientation, role: int = PySide6.QtCore.Qt.ItemDataRole.DisplayRole)

Return horizontal column labels.

replace(records: list[dict]) → None

Replace evidence after the owning context has finished loading.

class oci_policy_analysis.presentation.qt.tables.BrowserStatementModel(*args: Any, **kwargs: Any)

Bases: RecordModel

Format browser policy paths and mark explicitly invalid source evidence.

Parameters:

• columns – Display headings and source-field names.

• parent – Owning table, which supplies the current theme and font.

Notes

Formatting and styles never modify the original statement dictionary. Unknown validity retains normal styling. Red plus italics distinguishes invalid statements in both themes and without relying only on color.

data(index, role=PySide6.QtCore.Qt.ItemDataRole.DisplayRole)

Return combined policy labels or invalid-state roles for browser cells.

class oci_policy_analysis.presentation.qt.tables.RecordTable(*args: Any, **kwargs: Any)

Bases: QTableView

Sort source records without losing the identity behind a selected row.

Variables:

• details_requested – Explicit inspection request, or None when the source model resets.

• model – Source model, independent from table sort/filter order.

• proxy – Case-insensitive display filter over all columns.

details_requested

alias of object

test_condition_requested

alias of str

context_menu(record: dict) → PySide6.QtWidgets.QMenu

Offer explicit inspection without opening a drawer on ordinary selection.

record_at(index: PySide6.QtCore.QModelIndex) → dict | None

Return the source dictionary for an index in the displayed sort order.

selected_records() → list[dict]

Return only explicitly selected rows, preserving full source evidence.

class oci_policy_analysis.presentation.qt.tables.StatementTable(*args: Any, **kwargs: Any)

Bases: RecordTable

Shared statement table with details, copy, and dynamic-group focus actions.

focus_dynamic_group

alias of dict

context_menu(record: dict) → PySide6.QtWidgets.QMenu

Build actions for one source record; identity resolution belongs to its page.

Reusable animated, read-only source-record drawer for Qt pages.

class oci_policy_analysis.presentation.qt.details.DetailsDrawer(*args: Any, **kwargs: Any)

Bases: QFrame

Slide a source record in from the right, keeping every supplied field.

Variables:

• record – Currently inspected source dictionary, or None after clear/reload.

• raw – Read-only original record serialization, including all optional fields.

Notes

Never parses/reinterprets policy evidence or modifies the loaded snapshot. Nested values have their own scroll area; source values are plain text.

show_finding(record: dict | None) → None

Show all backing-service finding fields without collapsible sections.

Parameters:

record – Finding dictionary, or None to clear the drawer.

show_record(record: dict | None, title: str = 'Statement details', *, grouped: bool = True) → None

Render retained fields and animate the first opening of the drawer.

Parameters:

• record – Source or finding dictionary, or None to clear the drawer.

• title – Drawer heading.

• grouped – Group source evidence into sections. False shows every field, including empty values, in backing-service insertion order.

dismiss() → None

Slide out; keep the source selection available for reopening by click.

clear() → None

Immediately discard old snapshot evidence on reload, reset, or navigation.

eventFilter(watched, event) → bool

Anchor to the shell’s right edge after a resize, including dock changes.

Shared light/dark colors for Qt widgets, popups, and native graph items.

oci_policy_analysis.presentation.qt.themes.theme_color(color: str, theme: str, color_theme: str = 'Forest') → str

Resolve a semantic light color for the appearance and color palette.

Parameters:

• color – Original light-theme CSS color.

• theme – Light or Dark preference.

• color_theme – Named palette for the app surfaces and accent colors.

Returns:

Theme-aware CSS color, retaining unknown values.

Return type:

str

oci_policy_analysis.presentation.qt.themes.apply_theme(theme: str, size: int, color_theme: str = 'Forest') → str

Apply a Fusion palette and return the matching window stylesheet.

Parameters:

• theme – Light or Dark preference.

• size – Base font size in pixels.

• color_theme – Forest, Ocean, Plum, or Slate palette.

Returns:

Complete stylesheet covering widgets, menus, tabs and scroll areas.

Return type:

str

oci_policy_analysis.presentation.qt.themes.fixed_width_family() → str

Return an installed fixed-pitch font, including platform-specific fallbacks.

Returns:

Resolved system font family; generic aliases are replaced when Qt’s offscreen/native platform cannot resolve them to an actual fixed font.

Return type:

str

Qt preferences using the shared application settings file.

oci_policy_analysis.presentation.qt.preferences.load_preferences() → dict

Read existing settings and supply safe Qt defaults without loading OCI.

Returns:

Shared settings with Qt defaults; saved log levels apply unless –verbose overrides them.

Return type:

dict

oci_policy_analysis.presentation.qt.preferences.save_preferences(settings: dict, keys: tuple[str, ...]) → None

Merge only requested preferences, preserving other interfaces’ settings.

Parameters:

• settings – Current settings containing requested values.

• keys – Explicit settings to persist.

Raises:

OSError – Shared settings writer did not retain the requested values.

Discover application logger declarations without importing optional interfaces.

oci_policy_analysis.presentation.qt.logger_catalog.declared_components() → frozenset[str]

Find literal get_logger declarations in installed Python package sources.

Returns:

Application components, including unloaded Tk/web/MCP modules. Reading source avoids importing their optional dependencies.

Return type:

frozenset[str]

oci_policy_analysis.presentation.qt.logger_catalog.available_components(settings: dict) → list[str]

Merge declared, persisted, and currently registered component names.

Parameters:

settings – Effective logging configuration with canonical component keys.

Returns:

Sorted logger names; application names omit the common prefix.

Return type:

list[str]

Managed snapshot MCP, native Codex chat, and external desktop assistants.

class oci_policy_analysis.presentation.qt.pages.mcp.McpAssistantPage(*args: Any, **kwargs: Any)

Bases: QWidget

Operate a snapshot server with embedded CLI chat or external desktop apps.

Variables:

• host – Owned MCP worker, retained until its finished signal.

• client – Selected native CLI client; inactive until the user connects.

• locked – Whether loading is blocked to protect the served snapshot.

• idle – Emitted when server and child process have both exited.

locked

alias of bool

property active: bool

Whether a listener or child process still needs shutdown.

set_context(context) → None

Bind a newly published snapshot after all previous server activity stops.

set_loading(loading: bool) → None

Prevent server startup while the controller builds a replacement context.

start_server() → None

Pin the current snapshot and start an optional managed loopback listener.

stop_all() → None

Disconnect CLI clients and stop MCP, retaining ownership until workers exit.

send_question() → None

Submit one explicit question and stream its answer into the native viewer.

Optional managed loopback MCP host; no FastMCP dependency until start.

class oci_policy_analysis.presentation.qt.mcp_host.SnapshotMcpHost(*args: Any, **kwargs: Any)

Bases: QThread

Own an HTTP listener and pin one loaded context until shutdown.

Variables:

• ready – URL and verified tool metadata, emitted only after a real handshake.

• failed – Startup/runtime failure message; finished still signals thread exit.

• activity – Server-observed MCP operations from every connected client, with correlation, outcome and duration, excluding arguments/results.

• context – Snapshot served for the entire listener lifetime.

ready

alias of str

failed

alias of str

activity

alias of str

stop() → None

Request graceful shutdown from the GUI thread without blocking it.

run() → None

Run the server’s owned event loop and report handled startup failures.

Locate assistant CLIs and build their child environments on macOS and Windows.

Desktop apps launched from Finder, the Start menu or a shortcut do not inherit the interactive shell’s PATH, so Homebrew, npm and ~/.local installs can be invisible. This module adds the usual install directories and, on Windows, maps an npm .cmd shim to the native binary it wraps. Shims run through cmd.exe, which cannot pass the JSON-heavy arguments these adapters use.

oci_policy_analysis.presentation.qt.assistant_cli.search_directories(platform: str = 'linux', home: Path | None = None) → list[str]

Return existing install directories to append after the inherited PATH.

Parameters:

• platform – sys.platform value; selects macOS, Windows or other POSIX paths.

• home – Home directory override for tests; defaults to the operator’s home.

Returns:

Existing directories, in preference order, without duplicates.

Return type:

list[str]

oci_policy_analysis.presentation.qt.assistant_cli.search_path(platform: str = 'linux', home: Path | None = None) → str

Return the inherited PATH followed by existing install directories.

oci_policy_analysis.presentation.qt.assistant_cli.resolve_executable(executable: str, *, platform: str = 'linux', home: Path | None = None) → tuple[Path | None, str]

Resolve a CLI name or path to a program that QProcess can start directly.

Parameters:

• executable – Name on PATH or an absolute path, without arguments.

• platform – sys.platform value; tests pass win32 to exercise shim mapping.

• home – Home directory override for tests.

Returns:

Program path, or None with a user-facing reason.

Return type:

tuple[Path | None, str]

oci_policy_analysis.presentation.qt.assistant_cli.child_environment(program: Path, *, platform: str = 'linux', home: Path | None = None) → PySide6.QtCore.QProcessEnvironment

Build the inherited environment with install directories and bundled helpers on PATH.

Parameters:

• program – Resolved executable; its bundled codex-path helpers are added when present.

• platform – sys.platform value.

• home – Home directory override for tests.

Returns:

Environment for the child process.

Return type:

QProcessEnvironment

oci_policy_analysis.presentation.qt.assistant_cli.redact_secrets(text: str) → str

Remove API key values and key-shaped tokens from text that may be logged or shown.

Parameters:

text – Diagnostic text from a child process or protocol error.

Returns:

Text with known secret values and sk- tokens replaced, truncated to 500 characters.

Return type:

str

oci_policy_analysis.presentation.qt.assistant_cli.billing_variables(environment: PySide6.QtCore.QProcessEnvironment, names: tuple[str, ...]) → str

Name the API-key variables present in a child environment, or the CLI login if none are set.

Native Qt client for Codex app-server’s newline-delimited RPC transport.

oci_policy_analysis.presentation.qt.codex_client.child_arguments(url: str, name: str) → list[str]

Build child-only configuration, disabling unrelated configured MCP servers.

Parameters:

• url – Verified loopback snapshot endpoint.

• name – Unique MCP server name for this child.

Returns:

Argument vector, never a shell command or global config write.

Return type:

list[str]

Raises:

• ValueError – Endpoint or existing TOML configuration is invalid.

• OSError – Codex configuration could not be read.

class oci_policy_analysis.presentation.qt.codex_client.CodexClient(*args: Any, **kwargs: Any)

Bases: QObject

Own one explicit Codex session; no process or inference on construction.

Variables:

• status – Human-readable connection and turn lifecycle messages.

• delta – Plain assistant text, incrementally delivered on the GUI thread.

• activity – Bounded tool/lifecycle descriptions without tool arguments.

• models – Model catalog for the page’s selector.

• ready – Whether authentication/configuration permit submitting a question.

• active – Whether a process still needs shutdown.

status

alias of str

delta

alias of str

activity

alias of str

models

alias of object

ready_changed

alias of bool

turn_finished

alias of str

property active: bool

Whether the child is starting or running.

start(url: str, executable: str = 'codex') → None

Start an explicit local session using the operator’s Codex login.

Parameters:

• url – Verified MCP URL from the managed host.

• executable – Codex executable name or absolute path, without arguments.

request(method: str, params: dict, callback, *, timeout: int = 30) → int

Send a correlated RPC request with a finite response deadline.

Parameters:

• method – Protocol method.

• params – Parameters; never logged wholesale.

• callback – Function accepting the successful result dictionary.

• timeout – Seconds before the session reports an unresponsive request.

Returns:

Monotonic request identifier.

Return type:

int

send(question: str, model: str) → None

Start a question only after explicit UI submission and connection checks.

interrupt() → None

Cancel the active turn, or disconnect if startup is still pending.

stop() → None

Request child shutdown, killing it after a bounded grace period.

receive(chunk: bytes) → None

Decode bounded JSONL input, including split UTF-8 and interleaved events.

Parameters:

chunk – Newly read stdout bytes from the child process.

Isolated Claude Code print-mode transport for the Qt snapshot assistant.

class oci_policy_analysis.presentation.qt.claude_client.ClaudeClient(*args: Any, **kwargs: Any)

Bases: QObject

Run explicit Claude Code turns using the operator’s CLI authentication.

Construction performs no I/O. Connecting probes the executable without inference; Send launches one isolated print-mode process. Successful question and answer pairs are supplied as bounded context on subsequent turns, without saving or resuming Claude sessions. Disconnect clears conversation history.

Variables:

• status – Human-readable configuration and turn state.

• delta – Streamed assistant text on the GUI thread.

• activity – Tool and lifecycle descriptions without arguments or results.

• models – CLI model aliases, rather than an authenticated model catalog.

• ready_changed – Emitted when question submission availability changes.

• turn_finished – Completed, failed or interrupted outcome after process exit.

• stopped – Emitted after disconnect and child cleanup.

• ready – Whether configured and idle; API access is checked only on Send.

• busy – Whether a question is running.

• active – Whether configuration or a child still needs shutdown.

status

alias of str

delta

alias of str

activity

alias of str

models

alias of object

ready_changed

alias of bool

turn_finished

alias of str

property active: bool

Whether a configured session or running child needs disconnect.

start(url: str, executable: str = 'claude') → None

Probe a CLI without inference or changing login and billing configuration.

Parameters:

• url – Verified managed snapshot endpoint.

• executable – Claude Code executable name or path, without arguments.

send(question: str, model: str) → None

Send one explicit question with bounded previous successful exchanges.

Parameters:

• question – User question, passed over stdin rather than command arguments.

• model – CLI alias or full model ID; default leaves selection to the CLI.

interrupt() → None

Terminate the current turn, retaining configuration for another question.

stop() → None

Disconnect, terminate the child, and clear session state after child exit.

Resource and workload principal evidence over the shared analysis service.

class oci_policy_analysis.presentation.qt.pages.resource_principals.ResourcePrincipalsPage(*args: Any, **kwargs: Any)

Bases: QWidget

Inspect broad subjects, exact dynamic groups, and OKE workload evidence.

Variables:

• context – Current snapshot; replaced after each successful load.

• statements – Source statements with confidence and explicit detail actions.

• groups – Multi-select inventory used only in Dynamic Group mode.

• details_requested – Request for the shell’s shared detail drawer.

• focus_dynamic_group – Request to focus a source statement on the DG page.

Notes

Matching is evidence from the loaded snapshot, not an OCI authorization decision or an inventory of distinct resource principals.

details_requested

alias of object

focus_dynamic_group

alias of dict

set_context(context) → None

Replace all inventory and discovered selectors from the active context.

apply_filters(*_args) → None

Query shared principal matching; retain original fields and confidence.

reset_filters() → None

Clear selectors and return to combined any-user / any-group evidence.

Optional PySide6 workbench over the installed application services.

Importing this adapter does not import PySide6 or construct an application. The console and module launchers share the same dependency check.

oci_policy_analysis.presentation.qt.launcher.main(argv: list[str] | None = None) → int

Launch the Qt workbench, explaining how to install its optional dependency.

Parameters:

argv – Command-line arguments; None uses the process arguments.

Returns:

Application exit status, or 2 when the qt extra is missing.

Return type:

int

Notes

Imports the UI only when called. Launching opens a local window; OCI collection and model requests require explicit actions in the UI.

One shared presentation-mode switch for navigation and individual widgets.

class oci_policy_analysis.presentation.qt.experience.ExperienceMode(*args: Any, **kwargs: Any)

Bases: QObject

Publish and persist the Qt experience without changing analysis behavior.

Parameters:

• settings – Shared session preferences; only qt_advanced_mode is persisted.

• parent – Owner of this window’s mode state.

Variables:

• advanced – Whether advanced workflows and controls are visible.

• changed – Emitted once when the effective mode changes.

• status – Persistence feedback for the settings panel.

Notes

This is a presentation preference, not an authorization boundary. It never loads data, starts a workflow, or discards hidden widget state.

changed

alias of bool

status

alias of str

set_advanced(advanced: bool) → None

Update every subscribed control and save the preference if possible.

bind_advanced(widget) → None

Show a window-owned widget only in advanced mode, now and on changes.

bind_advanced_tab(tabs, index: int) → None

Apply the same advanced-mode policy to a native QTabWidget tab.

Native checked-row inclusion shared by downstream analysis workflows.

class oci_policy_analysis.presentation.qt.selection_table.CheckableRecordModel(*args: Any, **kwargs: Any)

Bases: RecordModel

Keep process inclusion separate from row highlighting and source records.

Parameters:

• columns – Display labels and dictionary field names; Include is prepended.

• key – Adapter-supplied stable, unique ID, e.g. internal_id or plan-step ID.

• eligible – Adapter-supplied checkability rule; no domain rule is inferred.

Variables:

checked_changed – Complete checked-ID list, emitted after each change.

Notes

Source records are never modified. Missing IDs are uncheckable; duplicate IDs reject replacement before changing the model. Replacement clears inclusion unless preserve_checks is explicitly requested for the same snapshot/workflow. Proxy filtering does not replace the source model.

checked_changed

alias of object

replace(records: list[dict], *, preserve_checks: bool = False) → None

Publish new records atomically; preserve checks only on explicit request.

flags(index: PySide6.QtCore.QModelIndex)

Expose Qt’s native checkbox interaction only for eligible source rows.

data(index: PySide6.QtCore.QModelIndex, role: int = PySide6.QtCore.Qt.ItemDataRole.DisplayRole)

Provide standard check-state roles, leaving display evidence unchanged.

setData(index: PySide6.QtCore.QModelIndex, value, role: int = PySide6.QtCore.Qt.ItemDataRole.EditRole) → bool

Toggle one native checkbox without resetting the table or its sorting.

checked_ids() → list[str]

Return included IDs in source order, including filtered-out rows.

checked_records() → list[dict]

Return included source records without adding presentation state.

set_checked_ids(ids) → None

Apply explicit inclusion, ignoring unknown and ineligible IDs.

class oci_policy_analysis.presentation.qt.selection_table.CheckedRecordTable(*args: Any, **kwargs: Any)

Bases: QWidget

Compose a native record table with explicitly scoped inclusion actions.

Parameters:

• columns – Display labels and source dictionary field names.

• key – Stable ID extractor for the downstream service’s row type.

• eligible – Eligibility predicate; defaults to the row’s checkable field.

Variables:

• table – Shared sortable/filterable RecordTable with explicit detail menu.

• model – Inclusion model; emits complete checked IDs independent of filters.

• checked_changed – Complete checked-ID list, suitable for workflow state.

• details_requested – Original source row for the shared detail drawer.

checked_changed

alias of object

details_requested

alias of object

add_checked_action(title: str, callback: Callable[[list[str]], None]) → PySide6.QtWidgets.QPushButton

Add an explicit operation receiving the current IDs only when clicked.

Clearly labeled destinations for workflows awaiting their own Qt pages.

class oci_policy_analysis.presentation.qt.pages.workflows.PlannedWorkflowPage(*args: Any, **kwargs: Any)

Bases: QWidget

Explain a planned workflow without presenting inactive controls as usable.

Parameters:

• title – Workflow title.

• description – Purpose and planned interaction.

class oci_policy_analysis.presentation.qt.pages.workflows.ToolsPage(*args: Any, **kwargs: Any)

Bases: QTabWidget

Group utility destinations in native tabs; reuse existing logging controls.

Parameters:

• experience – Shared mode policy controlling advanced-only Maintenance.

• cache – Shared cache manager used for saved snapshot maintenance.

Variables:

• show_logs – Request the shell’s existing log dock.

• show_logging_settings – Request the existing Overview logging settings.

Guided native consolidation planning over shared protection and run history.

class oci_policy_analysis.presentation.qt.pages.consolidation.ConsolidationSelectionModel(*args: Any, **kwargs: Any)

Bases: CheckableRecordModel, BrowserStatementModel

Combine shared checkbox identity with shared statement formatting.

Variables:

• checked – Snapshot of selected source statement IDs.

• changed – Emitted after checkbox state or source inventory changes.

Notes

CheckableRecordModel owns ID validation and filtering-independent selection. Its superclass display calls use BrowserStatementModel’s policy labels and invalid-statement styles through the method resolution order.

property checked

Return selected IDs, including records currently hidden by filtering.

set_checked(ids)

Replace checkbox selection using the shared stable-ID eligibility checks.

Parameters:

ids – Statement IDs to include; unknown IDs are ignored.

class oci_policy_analysis.presentation.qt.pages.consolidation.ConsolidationWorker(*args: Any, **kwargs: Any)

Bases: QThread

Run plan generation or live progress checks while the shell owns the snapshot.

Parameters:

• service – Service bound to the active context and shared local cache.

• operation – proposal or progress.

• arguments – Positional service arguments captured before starting.

• parent – Page retaining the worker until its thread finishes.

Variables:

• result – Detached service result, available after thread completion.

• error – Failure message, empty on success.

• refreshed – Whether a live policy refresh may have replaced repository data.

run() → None

Plan locally or check OCI progress, rebuilding derived state after a live reload.

class oci_policy_analysis.presentation.qt.pages.consolidation.ConsolidationPage(*args: Any, **kwargs: Any)

Bases: QWidget

Guide protection, candidate selection, plan review, and persisted history.

Variables:

• busy_changed – Shell gate for snapshot loads and competing workers.

• snapshot_changed – Rebind other pages after a live progress refresh.

• details_requested – Explicit statement inspection for the shared drawer.

• worker – Retained background task, or None while idle.

• service – Current context-bound consolidation facade, recreated after reload.

Notes

Generates instructions only. OCI Console or CLI changes are performed by the operator outside the application; progress checking only reads OCI.

busy_changed

alias of bool

snapshot_changed

alias of object

details_requested

alias of object

show_stage(index)

Navigate without discarding selections or generating a new plan.

set_context(context)

Rebind to the active snapshot; clear transient plans and restore saved protection.

Parameters:

context – Loaded AppContext, or None to clear the page. The shell must not replace it while this page owns an active worker.

set_block_reason(reason)

Gate persistence, planning, and checks while another task owns the snapshot.

save_protection()

Save the full checkbox set, including checked statements hidden by a filter.

select_opportunity(opportunity: dict) → bool

Preselect eligible recommendation sources for explicit strategy review.

Parameters:

opportunity – Shared recommendation containing stable source IDs and an optional recommended strategy. No plan is saved here.

Returns:

Whether the idle, snapshot-bound page accepted the handoff.

Return type:

bool

generate_proposal()

Persist a plan using the selected IDs and shared strategy, off the GUI thread.

refresh_history()

Read the current tenancy’s shared history without checking OCI.

save_notes()

Persist decision notes in the selected shared history record.

copy_output()

Copy the selected execution/rollback view without executing it.

export_output()

Save the currently displayed instructions to an operator-selected file.

check_progress()

Refresh live policies and persist observed progress for the selected plan.

delete_history()

Delete one local history record after explicit confirmation; OCI is unchanged.

Tenancy-aware prospective CRUD and guided/ad-hoc modal statement editing.

class oci_policy_analysis.presentation.qt.pages.prospective.ProspectiveEditorDialog(*args: Any, **kwargs: Any)

Bases: QDialog

Edit one local draft using shared metadata, preview and validation services.

Parameters:

• context – Loaded runtime supplying tenancy inventory and validation.

• record – Optional saved record to edit; left untouched until acceptance.

• parent – Owning workspace.

Variables:

• fields – Guided builder inputs keyed by the shared preview API.

• statement – Editable ad-hoc text passed verbatim to validation.

Notes

Validation has no persistence side effects. Save returns draft fields to the workspace, which owns persistence and cross-page refresh.

class oci_policy_analysis.presentation.qt.pages.prospective.ProspectiveStatementsPage(*args: Any, **kwargs: Any)

Bases: QWidget

Manage saved prospective evidence for the active tenancy.

Variables:

• changed – Emitted after a successful persisted change for evidence refresh.

• table – Read-only saved records with validation and effective-path columns.

Notes

Add/Edit uses a modal local draft. Invalid statements can be saved and inspected, while corpus admission and simulation eligibility stay in core.

set_context(context)

Load the current tenancy’s persisted records and reset selected evidence.

Parameters:

context – Newly loaded AppContext; no prior service is retained.

review_draft(draft: dict) → bool

Review a generated draft in the existing editor and explicitly save it.

Parameters:

draft – Statement text, policy compartment and optional description.

Returns:

Whether the user accepted and local persistence succeeded.

Cancel leaves prospective state unchanged.

Return type:

bool

Interactive condition parsing and testing using the shared evaluator.

class oci_policy_analysis.presentation.qt.pages.condition_tester.ConditionTesterPage(*args: Any, **kwargs: Any)

Bases: QWidget

Parse a clause, collect simulated values and inspect individual comparisons.

Variables:

• clause – Editable condition or full-policy input.

• input_widgets – Variable-name mapping to text inputs and null toggles.

• structure – Read-only JSON representation of parsed logic and atoms.

• comparisons – Evaluation log table; original logs remain in raw_result.

Notes

Uses ConditionTesterService exclusively for parsing and evaluation. Runs without tenancy data and does not save test cases to settings or caches. Edits invalidate results until the current clause is parsed again.

set_clause_text(text: str) → None

Load a handoff into the tester and parse without evaluating it.

Parameters:

text – Condition or complete statement selected in another view.

Notes

Clears prior simulated inputs to prevent values leaking between cases.

parse_clause() → None

Parse the current text, expose diagnostics and generate both operand fields.

evaluate() → None

Evaluate only the current parsed expression and show full comparison evidence.

Guided simulation environment setup and statement inclusion.

class oci_policy_analysis.presentation.qt.pages.simulation.SimulationPage(*args: Any, **kwargs: Any)

Bases: QTabWidget

Select a snapshot-bound environment without running a simulation.

Variables:

• context – Current snapshot, replaced after each successful load.

• scenario – Current principal/key/path inputs, or None until complete.

• manage_prospective – Request navigation to the existing what-if editor.

Notes

Preparation does not evaluate requests or record history. Explicit Run actions evaluate the model in an owned worker and retain original inputs.

details_requested

alias of object

prospective_requested

alias of object

set_context(context)

Replace the snapshot and discard all previous environment selections.

Parameters:

context – Newly published AppContext. No source files are written.

refresh_prospective()

Refresh saved what-if evidence without changing the selected environment.

prepare_followup(request, before_prospective_ids=None)

Stage a related request or reviewed what-if rerun without executing it.

Parameters:

• request – Original environment and request values; None checked IDs explicitly request fresh default inclusion at a new related scope.

• before_prospective_ids – Existing prospect IDs before reviewed additions, used to include new prospects while retaining intentional exclusions.

Guided checked-statement selection using shared source evidence tables.

class oci_policy_analysis.presentation.qt.pages.simulation_statements.SimulationStatementsPage(*args: Any, **kwargs: Any)

Bases: QWidget

Review candidate provenance and choose explicit statement inclusion.

Variables:

• selection – Native checked table; highlighting only inspects a record.

• back_requested – Navigate back without discarding current checks.

• next_requested – Continue with the complete explicit checked-ID list.

Own asynchronous statement preparation and snapshot-bound inclusion state.

class oci_policy_analysis.presentation.qt.simulation_controller.SimulationTaskWorker(*args: Any, **kwargs: Any)

Bases: QThread

Own one serialized execution or suggestion request until completion.

Parameters:

• context – Current snapshot held alive by this worker.

• action – execute or suggestions.

• payload – Detached request or candidate-generation arguments.

• revision – Snapshot/environment generation for rejecting obsolete results.

• parent – Owning workflow controller.

completed

alias of int

failed

alias of int

run()

Execute against the active snapshot and report failures at INFO.

class oci_policy_analysis.presentation.qt.simulation_controller.StatementPreparationWorker(*args: Any, **kwargs: Any)

Bases: QThread

Prepare candidates off the UI thread while the shell locks mutation.

Parameters:

• context – Current context held alive for the duration of preparation.

• scenario – Copy of principal and compartment inputs.

• revision – Generation used to reject obsolete results.

• parent – Controller owning this thread until completion.

prepared

alias of int

failed

alias of int

run()

Discover candidates without evaluating a request or recording history.

class oci_policy_analysis.presentation.qt.simulation_controller.SimulationController(*args: Any, **kwargs: Any)

Bases: QObject

Invalidate prepared evidence on upstream changes and reject late workers.

Variables:

• worker – Owned preparation thread or None; shutdown must await completion.

• checked_ids – Explicit inclusion list, including an intentional empty list.

• ready – Whether candidates belong to the current environment and snapshot.

• busy_changed – Shell lock for load, prospective editing and embedded MCP.

busy_changed

alias of bool

prepared

alias of object

failed

alias of str

executed

alias of object

suggestions_ready

alias of object

set_context(context)

Replace the snapshot and invalidate all prepared inclusion state.

Parameters:

context – Newly published AppContext; old workers cannot publish into it.

set_environment(scenario, *, force=False)

Clear downstream state when principal, compartment or prospects change.

Parameters:

• scenario – Principal/type/path inputs, or None for an incomplete setup.

• force – Invalidate even with identical inputs after prospective changes.

prepare()

Start one worker after prerequisites and the shell lock are checked.

request_payload() → dict

Return the current explicit request inputs without running a simulation.

Returns:

Environment, checked IDs, canonical operation and supplied values.

Blank/null values are omitted. request.operation is derived from reference metadata, matching the engine’s execution behavior.

Return type:

dict

execute()

Run the explicit current request; never substitute all statements for [].

suggest(report, options)

Generate reviewable candidates from one original result and user choices.

Configure an API request and condition inputs without evaluating access.

class oci_policy_analysis.presentation.qt.pages.simulation_request.SimulationRequestPage(*args: Any, **kwargs: Any)

Bases: QWidget

Select a catalog operation and supply values for checked condition fields.

Parameters:

controller – Owner of the current snapshot, inclusion and request state.

Variables:

• input_widgets – Condition variable mapping to value and null controls.

• back_requested – Navigate to Statements without discarding request inputs.

Notes

Metadata comes from ReferenceDataService; condition schemas are prepared by SimulationService in the owned worker. No policy is evaluated here.

set_context(context)

Replace the reference catalog and discard inputs from the prior snapshot.

Parameters:

context – Newly published AppContext, read only for reference lookups.

clear_request()

Clear operation, values and evidence after upstream invalidation.

refresh_selection()

Project prepared schemas onto checked IDs, keeping surviving input values.

Native result evidence, related requests and reviewed what-if grant candidates.

class oci_policy_analysis.presentation.qt.pages.simulation_results.SimulationResultsPage(*args: Any, **kwargs: Any)

Bases: QWidget

Present original run evidence and explicit follow-up actions.

Parameters:

controller – Snapshot-bound simulation lifecycle and history owner.

Variables:

• report – Original displayed run, kept separate from edited request inputs.

• related_requested – A reviewed operation/path request requiring new preparation.

• prospective_requested – Draft candidates requiring review before persistence.

• details_requested – Native evidence-row inspection for the shared drawer.

Notes

No action applies OCI changes. History JSON export uses an explicit file picker; generated candidates require a separate review/save action.

related_requested

alias of dict

prospective_requested

alias of object

details_requested

alias of object

set_context(context)

Replace the snapshot, clear displayed results and bind known choice lists.

show_history(history)

List every run by timestamp, operation and target path without re-executing.

refresh_history()

Read current engine history, including runs from other active consumers.

show_report(report)

Render an original report with expandable native statement evidence.

mark_stale()

Keep saved evidence visible but distinguish it from edited request inputs.

show_candidates(result)

Display validated draft alternatives and their additional permissions.

Offline startup verification used by local Qt executable builds.

oci_policy_analysis.presentation.qt.frozen_smoke.main() → int

Check packaged Qt, resources, snapshot loading, and MCP typed metadata.

Returns:

Zero after successful offline checks. Failures raise an exception.

Return type:

int

Notes

Uses temporary settings/cache storage and never connects to OCI or starts an MCP listener. The external Codex executable is not part of the bundle.

On-demand native report previews and exports over the current snapshot.

class oci_policy_analysis.presentation.qt.pages.reports.ReportWorker(*args: Any, **kwargs: Any)

Bases: QThread

Retain a snapshot and generate a detached report off the GUI thread.

Parameters:

• context – Snapshot exclusively held by the shell’s task gate.

• report_id – Shared report catalog identifier.

• parent – Owning Reports page, which retains the thread until finished.

completed

alias of object

failed

alias of object

run() → None

Generate only on explicit request; emit detached export strings.

class oci_policy_analysis.presentation.qt.pages.reports.ReportPreview(*args: Any, **kwargs: Any)

Bases: QTextBrowser

Render report HTML without fetching images, local files or linked pages.

loadResource(resource_type, url)

Block linked resource loading from source-controlled report text.

Parameters:

• resource_type – QTextDocument resource kind requested by Qt.

• url – Resource reference; no scheme is fetched.

Returns:

Empty resource data.

Return type:

QByteArray

class oci_policy_analysis.presentation.qt.pages.reports.ReportsPage(*args: Any, **kwargs: Any)

Bases: QWidget

Generate and export snapshot reports with serialized background work.

Variables:

• busy_changed – Shell gate for loads, simulation, prospective edits and MCP.

• worker – Retained active report thread; close must wait for completion.

• report – Detached report or None, cleared on snapshot replacement.

busy_changed

alias of bool

set_context(context) → None

Bind a newly published snapshot and clear older report evidence.

Parameters:

context – Current loaded AppContext, or None before loading.

set_block_reason(reason: str) → None

Gate generation while another workflow holds the active snapshot.

Parameters:

reason – User-facing reason, or empty when generation is permitted.

run_report() → None

Start the selected shared report only when the shell permits it.

export_report() → None

Export the current immutable preview after an explicit file choice.

Native recommendations dashboard over shared snapshot intelligence.

class oci_policy_analysis.presentation.qt.pages.recommendations.FindingModel(*args: Any, **kwargs: Any)

Bases: RecordModel

Sort numeric risk/count fields numerically and priorities by urgency.

data(index, role=PySide6.QtCore.Qt.ItemDataRole.DisplayRole)

Return typed sort values while preserving original display evidence.

class oci_policy_analysis.presentation.qt.pages.recommendations.ConsolidationOpportunityTable(*args: Any, **kwargs: Any)

Bases: RecordTable

Offer a reviewed handoff for supported consolidation recommendations.

consolidation_requested

alias of dict

context_menu(record)

Add planning only when shared evidence identifies supported source IDs.

class oci_policy_analysis.presentation.qt.pages.recommendations.RecommendationWorker(*args: Any, **kwargs: Any)

Bases: QThread

Own the serialized snapshot while rebuilding full derived analysis.

Parameters:

• context – Active loaded snapshot; retained until thread completion.

• settings – Detached strategy and risk preferences for the explicit run.

• parent – Owning page which keeps the worker alive.

completed

alias of object

failed

alias of object

stage

alias of str

run() → None

Run shared enrichment off the GUI thread and return detached evidence.

class oci_policy_analysis.presentation.qt.pages.recommendations.SupersessionDialog(*args: Any, **kwargs: Any)

Bases: QDialog

Present full candidate, evidence and qualified permission coverage.

Parameters:

• details – Detached shared-service supersession detail payload.

• parent – Owning Recommendations page.

showEvent(event) → None

Fit wrapped coverage rows after inherited font/theme styles are applied.

class oci_policy_analysis.presentation.qt.pages.recommendations.RecommendationsPage(*args: Any, **kwargs: Any)

Bases: QWidget

Browse shared findings and explicitly rebuild missing report material.

Variables:

• busy_changed – Shell serialization gate while analysis mutates derived state.

• analysis_finished – Context needing consumer rebinding after success/failure.

• details_requested – Read-only general finding inspection request.

• finding_details_requested – Policy/statement risk fields shown without sections.

• worker – Retained background worker or None while idle.

busy_changed

alias of bool

analysis_finished

alias of object

details_requested

alias of object

finding_details_requested

alias of object

consolidation_requested

alias of dict

set_context(context) → None

Replace snapshot findings without running analytics or fetching OCI data.

refresh_snapshot_data() → None

Refresh displayed snapshot reports after inventory limits change.

set_limits_feedback(message: str) → None

Display shared inventory fetch progress and completion messages.

set_block_reason(reason: str) → None

Prevent analysis while loading, simulation, reports or MCP own the data.

run_analysis() → None

Run configured checks and rebuild report prerequisites on explicit request.

Advanced, read-only historical comparison of saved tenancy JSON snapshots.

class oci_policy_analysis.presentation.qt.pages.historical.HistoricalWorker(*args: Any, **kwargs: Any)

Bases: QThread

Read selected snapshot sources and compare them without touching AppContext.

Parameters:

• cache – Existing cache manager, used only for named cache reads.

• sources – Detached baseline/target source descriptors.

• meaningful_only – Omit ephemeral internal IDs from changed-field analysis.

• generation – Owner’s selection generation for stale result rejection.

• parent – Owning page retaining this worker until finished.

• include_incomplete – Compare observed incomplete inventories with explicit warnings.

completed

alias of int

failed

alias of int

run() → None

Load each source once and run the shared section comparison off-thread.

class oci_policy_analysis.presentation.qt.pages.historical.HistoricalPage(*args: Any, **kwargs: Any)

Bases: QWidget

Compare saved caches/files with separate policy and IAM change queues.

Parameters:

cache – Existing cache manager used for listing and read-only snapshot access.

Variables:

• busy_changed – Shell gate for competing snapshot work and closing.

• worker – Retained comparison thread, or None while idle.

• result – Current comparison result, cleared whenever source/options change.

busy_changed

alias of bool

show_audit_commands()

Open a command-only helper scoped to the selected original change.

refresh_caches() → None

Refresh saved source choices, preserving selected cache and file inputs.

open_file(side: int) → None

Choose a JSON file without importing it into the active repository.

swap_sources() → None

Reverse baseline/target choices and invalidate direction-sensitive results.

set_block_reason(reason: str) → None

Gate comparison while another workflow owns snapshot operations.

compare() → None

Start one read-only comparison with retained source choices and options.

inspect(record) → None

Render selected field deltas and original JSON without reparsing policies.

show_details() → None

Open the resizable JSON inspector for the explicitly selected change.

copy_change() → None

Copy complete selected change JSON, including full before/after evidence.

export_comparison() → None

Export the completed comparison and metadata after an explicit file choice.

Read-only lazy JSON trees and structured field-change inspection.

oci_policy_analysis.presentation.qt.json_view.json_text(value, present=True) → str

Render JSON types literally, keeping absent values distinct from null.

Parameters:

• value – JSON-compatible scalar or container.

• present – False for a missing field rather than an explicit null value.

Returns:

Literal JSON or the explicit missing-value label.

Return type:

str

class oci_policy_analysis.presentation.qt.json_view.JsonModel(*args: Any, **kwargs: Any)

Bases: QAbstractItemModel

Expose original JSON lazily without one widget or item per source field.

Parameters:

• value – JSON-compatible source value retained read-only by the owner.

• parent – Owning tree view.

• present – Whether the root item exists; False produces an empty tree.

rowCount(parent=PySide6.QtCore.QModelIndex)

Return children for containers only; scalar leaves never expand.

columnCount(parent=PySide6.QtCore.QModelIndex)

Return JSON key, value and type columns.

index(row, column, parent=PySide6.QtCore.QModelIndex)

Materialize only the requested child of an expanded JSON container.

parent(index)

Return the owning container index independently of the selected column.

data(index, role=PySide6.QtCore.Qt.ItemDataRole.DisplayRole)

Provide literal JSON scalar values, container summaries and type names.

headerData(section, orientation, role=PySide6.QtCore.Qt.ItemDataRole.DisplayRole)

Label the three original-JSON columns.

class oci_policy_analysis.presentation.qt.json_view.JsonTree(*args: Any, **kwargs: Any)

Bases: QTreeView

Inspect original JSON with expansion and explicit copy actions.

set_json(value, *, present=True) → None

Replace source JSON and discard every prior node and selection.

Parameters:

• value – Original JSON retained read-only for the current selection.

• present – False when an entire baseline or target item is absent.

class oci_policy_analysis.presentation.qt.json_view.FieldChanges(*args: Any, **kwargs: Any)

Bases: QTreeView

Group changed fields into expandable paths with typed before/after values.

field_selected

alias of object

set_changes(changes) → None

Display service-generated field deltas; path tokens retain literal keys.

Explicit saved-cache maintenance using the shared cache service.

class oci_policy_analysis.presentation.qt.pages.maintenance.MaintenancePage(*args: Any, **kwargs: Any)

Bases: QWidget

Rename, lock and delete saved caches without changing loaded data.

Parameters:

cache – Shared cache manager for the operator’s selected cache directory.

Variables:

changed – Emitted after a successful mutation with action and cache names.

changed

alias of object

consolidation_reset

alias of str

refresh_caches() → None

Refresh index metadata without loading any snapshot into the application.

set_context(context) → None

Use the loaded tenancy’s name when listing saved consolidation state.

showEvent(event) → None

Refresh saved counts when returning from the consolidation workbench.

set_block_reason(reason: str) → None

Prevent mutations while a snapshot-dependent task is active.

Live, filterable OCI API metadata kept separately from component log text.

class oci_policy_analysis.presentation.qt.api_calls.ApiCallModel(*args: Any, **kwargs: Any)

Bases: RecordModel

Sort numeric timing/status values and chronological UTC start times.

data(index, role=PySide6.QtCore.Qt.ItemDataRole.DisplayRole)

Return scalar display data or typed sort values for completed calls.

class oci_policy_analysis.presentation.qt.api_calls.ApiCallsView(*args: Any, **kwargs: Any)

Bases: QWidget

Poll a bounded thread-safe journal independently of all logging levels.

Parameters:

journal – Optional isolated journal for embedded callers and tests.

Notes

Default history lasts for this application process, across successful or failed loads. Clear forgets only API metadata. No snapshot/file is written. SDK pagination and retry attempts appear as separate completed calls.

refresh()

Read completed calls on the GUI thread; retain selection while calls arrive.

clear_history()

Clear retained diagnostic metadata while leaving log output unchanged.

close()

Stop polling before the shell and its widgets are destroyed.

Manual policy-limit entry with tenancy-specific Console and CLI guidance.

class oci_policy_analysis.presentation.qt.policy_limits.PolicyLimitsDialog(*args: Any, **kwargs: Any)

Bases: QDialog

Collect verified limits for an offline snapshot without contacting OCI.

Parameters:

• context – Current snapshot; its named cache is updated on explicit Apply.

• parent – Owning Qt page. Cancel never changes limits or files.

Read-only tag-qualified grants and parsed predicates over the active snapshot.

class oci_policy_analysis.presentation.qt.pages.tag_based.TagConditionTable(*args: Any, **kwargs: Any)

Bases: StatementTable

Retain full-condition testing alongside explicit single-predicate testing.

context_menu(record)

Offer the selected atom without losing the full source qualification.

class oci_policy_analysis.presentation.qt.pages.tag_based.TagBasedPoliciesPage(*args: Any, **kwargs: Any)

Bases: QWidget

Inspect tag qualifiers without interpreting them as evaluated access.

Variables:

• context – Current snapshot, replaced on every load.

• details_requested – Requests original statement and predicate evidence.

• test_condition_requested – Opens the existing tester with selected text.

• focus_dynamic_group – Opens the referenced dynamic groups in their inventory.

details_requested

alias of object

test_condition_requested

alias of str

focus_dynamic_group

alias of dict

set_context(context) → None

Rebuild detached evidence without changing source data or cache files.

reset_filters() → None

Clear all display filters without loading or changing tenancy data.

apply_filters(*_args) → None

Filter predicates together, then retain their complete source statements.