igniter 0.5.1 → 0.5.2

data/packages/igniter-application/lib/igniter/application/application_host_activation_ledger_verification.rb

@@ -0,0 +1,301 @@
+# frozen_string_literal: true
+
+require "time"
+
+module Igniter
+  module Application
+    class ApplicationHostActivationLedgerVerification
+      attr_reader :packet, :commit_result, :adapter, :metadata
+
+      def self.verify(evidence_packet, commit_result:, adapter:, metadata: {})
+        new(
+          evidence_packet: evidence_packet,
+          commit_result: commit_result,
+          adapter: adapter,
+          metadata: metadata
+        )
+      end
+
+      def initialize(evidence_packet:, commit_result:, adapter:, metadata: {})
+        @packet = normalize_hash(evidence_packet).freeze
+        @commit_result = normalize_hash(commit_result.respond_to?(:to_h) ? commit_result.to_h : commit_result).freeze
+        @adapter = adapter
+        @metadata = metadata.dup.freeze
+        @readbacks = readback_records.freeze
+        @findings = build_findings.freeze
+        freeze
+      end
+
+      def valid?
+        findings.empty?
+      end
+
+      def complete?
+        valid? && committed? && verified_operations.length == expected_operations.length
+      end
+
+      def to_h
+        {
+          verification_id: verification_id,
+          packet_id: packet_id,
+          result_id: result_id,
+          operation_digest: operation_digest,
+          idempotency_key: idempotency_key,
+          valid: valid?,
+          complete: complete?,
+          committed: committed?,
+          findings: findings,
+          verified_operations: verified_operations,
+          unexpected_operations: unexpected_operations,
+          adapter_readbacks: readbacks,
+          counts: counts,
+          skipped_operations: skipped_operations,
+          verified_at: Time.now.utc.iso8601,
+          metadata: metadata.dup
+        }
+      end
+
+      private
+
+      attr_reader :readbacks, :findings
+
+      def verification_id
+        "activation-ledger-verification:#{packet_id}:#{operation_digest}"
+      end
+
+      def packet_id
+        value(packet, :packet_id)
+      end
+
+      def result_id
+        value(commit_result, :result_id)
+      end
+
+      def operation_digest
+        value(packet, :operation_digest)
+      end
+
+      def idempotency_key
+        value(packet, :idempotency_key)
+      end
+
+      def committed?
+        value(commit_result, :committed) == true
+      end
+
+      def build_findings
+        [].tap do |items|
+          items << finding(:commit_not_committed, "Activation commit result is not committed.", commit_result) unless
+            committed?
+          items.concat(result_identity_findings)
+          items.concat(applied_operation_findings)
+          items.concat(identity_findings)
+          items.concat(missing_findings)
+          items.concat(unexpected_findings)
+          items.concat(duplicate_findings)
+          items.concat(commit_receipt_findings)
+        end
+      end
+
+      def result_identity_findings
+        [
+          [:result_packet_id_mismatch, :packet_id, packet_id],
+          [:result_operation_digest_mismatch, :operation_digest, operation_digest]
+        ].filter_map do |code, field, expected|
+          actual = value(commit_result, field)
+          next if actual == expected
+
+          finding(code, "Activation commit result identity does not match evidence packet.", {
+                    field: field,
+                    expected: expected,
+                    actual: actual
+                  })
+        end
+      end
+
+      def applied_operation_findings
+        return [] if applied_operation_types.sort == expected_operation_types.sort
+
+        [
+          finding(:applied_operation_mismatch, "Activation commit result applied operations do not match packet.", {
+                    expected_types: expected_operation_types,
+                    actual_types: applied_operation_types
+                  })
+        ]
+      end
+
+      def identity_findings
+        [
+          [:packet_id_mismatch, :packet_id, packet_id],
+          [:operation_digest_mismatch, :operation_digest, operation_digest],
+          [:idempotency_key_mismatch, :idempotency_key, idempotency_key]
+        ].flat_map do |code, field, expected|
+          readbacks.filter_map do |record|
+            actual = value(record, field)
+            next if actual == expected
+
+            finding(code, "Activation ledger readback identity does not match evidence packet.", {
+                      field: field,
+                      expected: expected,
+                      actual: actual,
+                      receipt_id: value(record, :receipt_id)
+                    })
+          end
+        end
+      end
+
+      def missing_findings
+        expected_operation_keys.filter_map do |operation_key|
+          next if readback_by_operation.key?(operation_key)
+
+          finding(:missing_ledger_record, "Activation ledger readback is missing an expected operation.", {
+                    operation_key: operation_key
+                  })
+        end
+      end
+
+      def unexpected_findings
+        unexpected_operations.map do |record|
+          finding(:unexpected_ledger_record, "Activation ledger readback contains an unplanned operation.", record)
+        end
+      end
+
+      def duplicate_findings
+        readback_by_operation.filter_map do |operation_key, records|
+          next unless records.length > 1
+
+          finding(:duplicate_ledger_record, "Activation ledger readback contains duplicate operation records.", {
+                    operation_key: operation_key,
+                    receipt_ids: records.map { |record| value(record, :receipt_id) }
+                  })
+        end
+      end
+
+      def commit_receipt_findings
+        commit_receipts.filter_map do |record|
+          receipt_id = value(record, :receipt_id)
+          next if readbacks.any? { |readback| value(readback, :receipt_id) == receipt_id }
+
+          finding(:commit_receipt_missing_from_readback, "Commit receipt was not returned by adapter readback.", record)
+        end
+      end
+
+      def verified_operations
+        expected_operations.filter_map do |operation|
+          records = readback_by_operation.fetch(operation_key(operation), [])
+          next unless records.length == 1 && record_matches_expected?(records.first)
+
+          {
+            type: operation_type(operation),
+            operation_key: operation_key(operation),
+            receipt_id: value(records.first, :receipt_id),
+            status: :verified
+          }
+        end
+      end
+
+      def unexpected_operations
+        readbacks.reject { |record| expected_operation_keys.include?(record_operation_key(record)) }
+      end
+
+      def readback_by_operation
+        @readback_by_operation ||= readbacks.group_by { |record| record_operation_key(record) }
+      end
+
+      def readback_records
+        return [] unless adapter.respond_to?(:readback)
+
+        adapter.readback(idempotency_key: idempotency_key, operation_digest: operation_digest).map do |record|
+          normalize_hash(record)
+        end
+      end
+
+      def record_matches_expected?(record)
+        value(record, :packet_id) == packet_id &&
+          value(record, :operation_digest) == operation_digest &&
+          value(record, :idempotency_key) == idempotency_key
+      end
+
+      def expected_operations
+        Array(value(dry_run_payload, :would_apply)).map { |entry| normalize_hash(entry) }
+      end
+
+      def expected_operation_keys
+        @expected_operation_keys ||= expected_operations.map { |operation| operation_key(operation) }
+      end
+
+      def commit_receipts
+        Array(value(commit_result, :adapter_receipts)).map { |entry| normalize_hash(entry) }
+      end
+
+      def applied_operations
+        Array(value(commit_result, :applied_operations)).map { |entry| normalize_hash(entry) }
+      end
+
+      def applied_operation_types
+        applied_operations.map { |entry| operation_type(entry) }
+      end
+
+      def expected_operation_types
+        expected_operations.map { |entry| operation_type(entry) }
+      end
+
+      def skipped_operations
+        Array(value(commit_result, :skipped_operations)).map { |entry| normalize_hash(entry) }
+      end
+
+      def counts
+        {
+          expected: expected_operations.length,
+          readback: readbacks.length,
+          verified: verified_operations.length,
+          unexpected: unexpected_operations.length,
+          findings: findings.length,
+          skipped: skipped_operations.length
+        }
+      end
+
+      def dry_run_payload
+        normalize_hash(value(packet, :dry_run))
+      end
+
+      def record_operation_key(record)
+        operation = normalize_hash(value(record, :operation))
+        value(operation, :operation_key) || operation_key(operation)
+      end
+
+      def operation_key(operation)
+        [
+          value(operation, :type),
+          value(operation, :destination),
+          value(operation, :source)
+        ].join(":")
+      end
+
+      def operation_type(operation)
+        type = value(operation, :type)
+        type.respond_to?(:to_sym) ? type.to_sym : type
+      end
+
+      def normalize_hash(value)
+        source = value.respond_to?(:to_h) ? value.to_h : {}
+        source.transform_keys { |key| key.respond_to?(:to_sym) ? key.to_sym : key }
+      end
+
+      def value(hash, key)
+        return nil unless hash.respond_to?(:key?)
+        return hash[key] if hash.key?(key)
+
+        hash[key.to_s]
+      end
+
+      def finding(code, message, entry)
+        {
+          code: code,
+          message: message,
+          entry: entry
+        }
+      end
+    end
+  end
+end

data/packages/igniter-application/lib/igniter/application/application_host_activation_operation_digest.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "digest"
+require "json"
+
+module Igniter
+  module Application
+    class ApplicationHostActivationOperationDigest
+      def self.compute(dry_run_or_hash)
+        new(dry_run_or_hash).compute
+      end
+
+      def initialize(dry_run_or_hash)
+        @payload = normalize_hash(dry_run_or_hash.respond_to?(:to_h) ? dry_run_or_hash.to_h : dry_run_or_hash)
+      end
+
+      def compute
+        Digest::SHA256.hexdigest(JSON.generate(normalized_payload))
+      end
+
+      private
+
+      attr_reader :payload
+
+      def normalized_payload
+        {
+          would_apply: normalize_operations(value(payload, :would_apply)),
+          skipped: normalize_operations(value(payload, :skipped))
+        }
+      end
+
+      def normalize_operations(operations)
+        Array(operations).map { |entry| normalize_hash(entry) }
+                         .sort_by { |entry| [value(entry, :type).to_s, value(entry, :destination).to_s] }
+                         .map { |entry| normalize_value(entry) }
+      end
+
+      def normalize_value(item)
+        case item
+        when Hash
+          item.each_with_object({}) do |(key, value), result|
+            next if key.to_s.end_with?("_at")
+
+            result[key.to_s] = normalize_value(value)
+          end.sort.to_h
+        when Array
+          item.map { |entry| normalize_value(entry) }
+        when Symbol
+          item.to_s
+        else
+          item
+        end
+      end
+
+      def normalize_hash(value)
+        source = value.respond_to?(:to_h) ? value.to_h : {}
+        source.transform_keys { |key| key.respond_to?(:to_sym) ? key.to_sym : key }
+      end
+
+      def value(hash, key)
+        return nil unless hash.respond_to?(:key?)
+        return hash[key] if hash.key?(key)
+
+        hash[key.to_s]
+      end
+    end
+  end
+end

data/packages/igniter-application/lib/igniter/application/application_host_activation_plan.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+module Igniter
+  module Application
+    class ApplicationHostActivationPlan
+      attr_reader :readiness_payload, :metadata, :operations, :decisions
+
+      def self.build(readiness, metadata: {})
+        new(readiness: readiness, metadata: metadata)
+      end
+
+      def initialize(readiness:, metadata: {})
+        @readiness_payload = payload_from(readiness).freeze
+        @metadata = metadata.dup.freeze
+        @decisions = normalize_decisions(value(readiness_payload, :decisions)).freeze
+        @operations = build_operations.freeze
+        freeze
+      end
+
+      def executable?
+        value(readiness_payload, :ready) == true && blockers.empty?
+      end
+
+      def to_h
+        {
+          executable: executable?,
+          operations: operations,
+          blockers: blockers,
+          warnings: warnings,
+          surface_count: surface_count,
+          metadata: metadata.dup
+        }
+      end
+
+      private
+
+      def build_operations
+        return [] unless executable?
+
+        host_export_operations +
+          host_capability_operations +
+          load_path_operations +
+          provider_operations +
+          contract_operations +
+          lifecycle_operations +
+          manual_action_operations +
+          mount_intent_operations
+      end
+
+      def host_export_operations
+        decisions.fetch(:host_exports, []).map do |entry|
+          operation(
+            type: :confirm_host_export,
+            source: :activation_readiness_host_export,
+            destination: value(entry, :name),
+            metadata: { entry: entry.dup }
+          )
+        end
+      end
+
+      def host_capability_operations
+        decisions.fetch(:host_capabilities, []).map do |capability|
+          operation(
+            type: :confirm_host_capability,
+            source: :activation_readiness_host_capability,
+            destination: capability,
+            metadata: { capability: capability }
+          )
+        end
+      end
+
+      def load_path_operations
+        decisions.fetch(:load_paths, []).map do |path|
+          operation(
+            type: :confirm_load_path,
+            source: :activation_readiness_load_path,
+            destination: path,
+            metadata: { path: path }
+          )
+        end
+      end
+
+      def provider_operations
+        decisions.fetch(:providers, []).map do |provider|
+          operation(
+            type: :confirm_provider,
+            source: :activation_readiness_provider,
+            destination: provider,
+            metadata: { provider: provider }
+          )
+        end
+      end
+
+      def contract_operations
+        decisions.fetch(:contracts, []).map do |contract|
+          operation(
+            type: :confirm_contract,
+            source: :activation_readiness_contract,
+            destination: contract,
+            metadata: { contract: contract }
+          )
+        end
+      end
+
+      def lifecycle_operations
+        decisions.fetch(:lifecycle, {}).keys.sort_by(&:to_s).map do |key|
+          operation(
+            type: :confirm_lifecycle,
+            source: :activation_readiness_lifecycle,
+            destination: key,
+            metadata: { key: key, value: decisions.fetch(:lifecycle).fetch(key) }
+          )
+        end
+      end
+
+      def manual_action_operations
+        return [] if manual_actions.empty?
+
+        [
+          operation(
+            type: :acknowledge_manual_actions,
+            source: :activation_readiness_manual_actions,
+            destination: :host,
+            metadata: { count: manual_actions.length, actions: manual_actions.map(&:dup) }
+          )
+        ]
+      end
+
+      def mount_intent_operations
+        mount_intents.map do |entry|
+          operation(
+            type: :review_mount_intent,
+            source: :activation_readiness_mount_intent,
+            destination: value(entry, :at),
+            metadata: { intent: entry.dup }
+          )
+        end
+      end
+
+      def operation(type:, source:, destination:, metadata:)
+        {
+          type: type,
+          status: :review_required,
+          source: source,
+          destination: destination,
+          metadata: metadata
+        }
+      end
+
+      def normalize_decisions(raw_decisions)
+        source = normalize_hash(raw_decisions)
+        source.merge(
+          host_exports: Array(value(source, :host_exports)).map { |entry| normalize_hash(entry) },
+          host_capabilities: Array(value(source, :host_capabilities)),
+          load_paths: Array(value(source, :load_paths)),
+          providers: Array(value(source, :providers)),
+          contracts: Array(value(source, :contracts)),
+          lifecycle: normalize_hash(value(source, :lifecycle))
+        )
+      end
+
+      def manual_actions
+        Array(value(readiness_payload, :manual_actions)).map { |entry| normalize_hash(entry) }
+      end
+
+      def mount_intents
+        Array(value(readiness_payload, :mount_intents)).map { |entry| normalize_hash(entry) }
+      end
+
+      def blockers
+        Array(value(readiness_payload, :blockers)).map { |entry| normalize_hash(entry) }
+      end
+
+      def warnings
+        Array(value(readiness_payload, :warnings)).map { |entry| normalize_hash(entry) }
+      end
+
+      def surface_count
+        value(readiness_payload, :surface_count) || 0
+      end
+
+      def payload_from(source)
+        payload = source.respond_to?(:to_h) ? source.to_h : source
+        normalize_hash(payload)
+      end
+
+      def normalize_hash(value)
+        source = value.respond_to?(:to_h) ? value.to_h : {}
+        source.transform_keys { |key| key.respond_to?(:to_sym) ? key.to_sym : key }
+      end
+
+      def value(hash, key)
+        return nil unless hash.respond_to?(:key?)
+        return hash[key] if hash.key?(key)
+
+        hash[key.to_s]
+      end
+    end
+  end
+end

data/packages/igniter-application/lib/igniter/application/application_host_activation_plan_verification.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+module Igniter
+  module Application
+    class ApplicationHostActivationPlanVerification
+      ALLOWED_OPERATION_TYPES = %i[
+        confirm_host_export
+        confirm_host_capability
+        confirm_load_path
+        confirm_provider
+        confirm_contract
+        confirm_lifecycle
+        acknowledge_manual_actions
+        review_mount_intent
+      ].freeze
+
+      REVIEW_STATUS = :review_required
+
+      attr_reader :plan_payload, :metadata
+
+      def self.verify(plan, metadata: {})
+        new(plan: plan, metadata: metadata)
+      end
+
+      def initialize(plan:, metadata: {})
+        @plan_payload = payload_from(plan).freeze
+        @metadata = metadata.dup.freeze
+        freeze
+      end
+
+      def valid?
+        findings.empty?
+      end
+
+      def to_h
+        {
+          valid: valid?,
+          executable: executable?,
+          verified: verified_operations,
+          findings: findings,
+          operation_count: operations.length,
+          surface_count: surface_count,
+          metadata: metadata.dup
+        }
+      end
+
+      private
+
+      def findings
+        [].tap do |items|
+          items << finding(:executable_plan_without_operations, "Executable activation plans should carry review operations.", plan_payload) if
+            executable? && operations.empty? && !allow_empty_operations?
+          items << finding(:non_executable_plan_without_blockers, "Non-executable activation plans should carry blockers.", plan_payload) if
+            !executable? && blockers.empty?
+          items << finding(:non_executable_plan_with_operations, "Non-executable activation plans must not carry operations.", operations) if
+            !executable? && !operations.empty?
+
+          operations.each do |operation|
+            items.concat(operation_findings(operation))
+          end
+        end
+      end
+
+      def operation_findings(operation)
+        [].tap do |items|
+          type = comparable(value(operation, :type)).to_sym
+          status = comparable(value(operation, :status)).to_sym
+
+          items << finding(:unknown_operation_type, "Activation plan operation type is not descriptive.", operation) unless
+            ALLOWED_OPERATION_TYPES.include?(type)
+          items << finding(:operation_not_review_required, "Activation plan operation must remain review-only.", operation) unless
+            status == REVIEW_STATUS
+          items << finding(:mount_intent_metadata_missing, "Mount review operation must carry supplied intent metadata only.", operation) if
+            type == :review_mount_intent && !value(metadata_for(operation), :intent).is_a?(Hash)
+        end
+      end
+
+      def verified_operations
+        return [] unless valid?
+
+        operations.map(&:dup)
+      end
+
+      def executable?
+        value(plan_payload, :executable) == true
+      end
+
+      def allow_empty_operations?
+        policy = normalize_hash(value(plan_payload, :policy))
+        plan_metadata = normalize_hash(value(plan_payload, :metadata))
+        value(policy, :allow_empty_operations) == true || value(plan_metadata, :allow_empty_operations) == true
+      end
+
+      def operations
+        Array(value(plan_payload, :operations)).map { |entry| normalize_hash(entry) }
+      end
+
+      def blockers
+        Array(value(plan_payload, :blockers)).map { |entry| normalize_hash(entry) }
+      end
+
+      def surface_count
+        value(plan_payload, :surface_count) || 0
+      end
+
+      def metadata_for(operation)
+        normalize_hash(value(operation, :metadata))
+      end
+
+      def finding(code, message, entry)
+        {
+          code: code,
+          message: message,
+          entry: entry
+        }
+      end
+
+      def payload_from(source)
+        payload = source.respond_to?(:to_h) ? source.to_h : source
+        normalize_hash(payload)
+      end
+
+      def normalize_hash(value)
+        source = value.respond_to?(:to_h) ? value.to_h : {}
+        source.transform_keys { |key| key.respond_to?(:to_sym) ? key.to_sym : key }
+      end
+
+      def comparable(value)
+        value.to_s
+      end
+
+      def value(hash, key)
+        return nil unless hash.respond_to?(:key?)
+        return hash[key] if hash.key?(key)
+
+        hash[key.to_s]
+      end
+    end
+  end
+end