@mriekki/project-forge 4.3.0 → 4.4.0

package/assets/generated/deployment/src/project_forge_deployment/environment_probe.py

@@ -12,6 +12,7 @@ from typing import Any
 from .app_runtime import normalize_app_spec, plan_app_deploy
 from .app_runtime_workstation import apply_app_deploy_with_preloaded_image
 from .box_platform import platform_status
+from .environment_isolation import environment_isolation_preflight
 from .errors import DeploymentKitError
 from .image_transfer import remote_image_present, transfer_image, verify_local_image
 from .proof_receipt import write_environment_proof_receipt
@@ -92,6 +93,27 @@ def _resolve_probe_image(image_tag: str) -> str:
     raise DeploymentKitError("Environment proof image has no usable immutable sha256 RepoDigest.")
 
 
+def _proof_isolation_preflight(
+    target_name: str,
+    *,
+    owner_repo: str,
+    environment: str,
+    production: bool,
+    probe_app_slug: str,
+) -> dict[str, Any]:
+    return environment_isolation_preflight(
+        target_name,
+        owner_repo=owner_repo,
+        environment=environment,
+        production=production,
+        app_slug=probe_app_slug,
+        container_name=f"{probe_app_slug}--{environment}",
+        runtime_port=80,
+        persistence_mode="none",
+        require_vacant_app_identity=True,
+    )
+
+
 def plan_environment_proof(
     target_name: str,
     *,
@@ -111,17 +133,27 @@ def plan_environment_proof(
         raise DeploymentKitError(
             f"Environment proof requires a ready shared platform; target '{target_name}' is '{platform.get('state', 'unknown')}'."
         )
+    probe_app_slug = _probe_slug(owner)
+    isolation = _proof_isolation_preflight(
+        target_name,
+        owner_repo=owner,
+        environment=env,
+        production=production,
+        probe_app_slug=probe_app_slug,
+    )
     return {
         "targetName": target_name,
         "ownerRepo": owner,
         "environment": env,
         "production": production,
-        "probeAppSlug": _probe_slug(owner),
+        "probeAppSlug": probe_app_slug,
         "probeImageTag": probe_image,
         "artifactDelivery": "workstation-transfer",
         "persistence": "none",
         "healthPath": "/",
         "cleanup": "automatic",
+        "isolationPreflight": isolation,
+        "runnable": isolation["state"] == "clear",
         "requiredAuthorization": (
             PRODUCTION_ENVIRONMENT_PROOF_WRITE_PHRASE if production else ENVIRONMENT_PROOF_WRITE_PHRASE
         ),
@@ -139,6 +171,8 @@ def _proof_result(plan: dict[str, Any]) -> dict[str, Any]:
         "preflight": {
             "targetAccess": "verified-by-platform-doctor",
             "hostPlatform": "ready",
+            "environmentIsolation": plan["isolationPreflight"]["state"],
+            "isolationEvidenceSha256": plan["isolationPreflight"]["evidenceSha256"],
         },
         "registryDigest": None,
         "localImageId": None,
@@ -199,10 +233,32 @@ def run_environment_proof(plan: dict[str, Any]) -> dict[str, Any]:
         "persistence",
         "healthPath",
         "cleanup",
+        "isolationPreflight",
+        "runnable",
         "requiredAuthorization",
     }
     if not isinstance(plan, dict) or set(plan) != required:
         raise DeploymentKitError("Malformed environment proof plan.")
+    if plan["isolationPreflight"].get("state") != "clear" or not plan["runnable"]:
+        raise DeploymentKitError(
+            "Environment proof is blocked by the reviewed isolation/collision preflight; resolve the reported conflicts and create a fresh plan."
+        )
+
+    current_isolation = _proof_isolation_preflight(
+        plan["targetName"],
+        owner_repo=plan["ownerRepo"],
+        environment=plan["environment"],
+        production=plan["production"],
+        probe_app_slug=plan["probeAppSlug"],
+    )
+    if current_isolation["state"] != "clear":
+        raise DeploymentKitError(
+            "Environment isolation became blocked after the proof plan was reviewed; no proof mutation was attempted."
+        )
+    if current_isolation["evidenceSha256"] != plan["isolationPreflight"].get("evidenceSha256"):
+        raise DeploymentKitError(
+            "Environment isolation evidence changed after the proof plan was reviewed; create and authorize a fresh plan."
+        )
 
     result = _proof_result(plan)
     deploy_plan: dict[str, Any] | None = None

package/assets/generated/deployment/src/project_forge_deployment/environment_setup.py

@@ -248,7 +248,7 @@ def _next_action(status: dict[str, Any]) -> dict[str, Any]:
         return {
             "kind": "complete",
             "action": "remote-environment-ready",
-            "reason": "Fresh workstation-local proof evidence matches this Project/environment/target context.",
+            "reason": "Fresh workstation-local proof evidence matches this Project/environment/target context and current isolation remains clear.",
             "proofReceipt": phases["deploymentPath"].get("detail"),
         }
 
@@ -259,6 +259,36 @@ def _next_action(status: dict[str, Any]) -> dict[str, Any]:
     }
 
 
+def _proof_command(name: str, proof: dict[str, Any], *, production: bool) -> str:
+    command = (
+        f"project-forge-deploy environment proof plan {name} "
+        f"--owner-repo {proof['ownerRepo']} --environment {proof['environment']}"
+    )
+    if production:
+        command += " --production"
+    return command
+
+
+def _blocked_isolation_action(
+    name: str,
+    proof: dict[str, Any],
+    *,
+    production: bool,
+) -> dict[str, Any]:
+    return {
+        "kind": "blocked",
+        "action": "resolve-environment-isolation-collision",
+        "command": _proof_command(name, proof, production=production),
+        "reason": (
+            "The read-only colocated-environment preflight found a managed ownership or footprint collision. "
+            "Do not redirect this environment to a sibling target identity or take over existing runtime, route, persistence, or lock state."
+        ),
+        "proofPlan": proof,
+        "isolationPreflight": proof.get("isolationPreflight"),
+        "safety": "Inspect the reported managed ownership records and resolve the collision explicitly before creating a fresh proof plan.",
+    }
+
+
 def remote_setup_plan(
     name: str,
     *,
@@ -272,48 +302,64 @@ def remote_setup_plan(
         raise DeploymentKitError("ownerRepo and environment must be supplied together for setup proof planning.")
 
     status = remote_setup_status(name)
-    if owner_repo is not None and environment is not None and status["phases"]["hostPlatform"]["state"] == "ready":
-        receipt = load_environment_proof_receipt(
+    proof: dict[str, Any] | None = None
+    receipt: dict[str, Any] | None = None
+    if (
+        owner_repo is not None
+        and environment is not None
+        and status["phases"]["hostPlatform"]["state"] == "ready"
+    ):
+        # Current machine isolation must be checked even when a prior proof receipt is
+        # otherwise reusable. A sibling environment can be added after the receipt was
+        # recorded without changing workstation/target identity or trust evidence.
+        proof = plan_environment_proof(
             name,
             owner_repo=owner_repo,
             environment=environment,
             production=production,
         )
-        status["phases"]["deploymentPath"] = _phase(
-            "DEPLOYMENT PATH PROVEN",
-            "proven" if receipt["state"] == "proven" else "not-proven",
-            detail=receipt,
+        receipt = load_environment_proof_receipt(
+            name,
+            owner_repo=owner_repo,
+            environment=environment,
+            production=production,
         )
+        isolation_clear = proof.get("runnable", True)
+        if isolation_clear:
+            status["phases"]["deploymentPath"] = _phase(
+                "DEPLOYMENT PATH PROVEN",
+                "proven" if receipt["state"] == "proven" else "not-proven",
+                detail=receipt,
+            )
+            if receipt["state"] == "proven":
+                status["state"] = "environment-ready"
+        else:
+            status["phases"]["deploymentPath"] = _phase(
+                "DEPLOYMENT PATH PROVEN",
+                "blocked",
+                detail={
+                    "proofReceipt": receipt,
+                    "isolationPreflight": proof.get("isolationPreflight"),
+                },
+            )
+            status["state"] = "needs-setup"
         status["currentPhase"] = _current_phase(status["phases"])
-        if receipt["state"] == "proven":
-            status["state"] = "environment-ready"
 
     next_action = _next_action(status)
 
-    if (
+    if proof is not None and not proof.get("runnable", True):
+        next_action = _blocked_isolation_action(name, proof, production=production)
+    elif (
         next_action["action"] == "plan-deployment-path-proof"
-        and owner_repo is not None
-        and environment is not None
+        and proof is not None
     ):
-        proof = plan_environment_proof(
-            name,
-            owner_repo=owner_repo,
-            environment=environment,
-            production=production,
-        )
-        command = (
-            f"project-forge-deploy environment proof plan {name} "
-            f"--owner-repo {proof['ownerRepo']} --environment {proof['environment']}"
-        )
-        if production:
-            command += " --production"
         next_action = {
             "kind": "read-only",
             "action": "review-deployment-path-proof",
-            "command": command,
+            "command": _proof_command(name, proof, production=production),
             "proofPlan": proof,
             "runAuthorization": proof["requiredAuthorization"],
-            "previousProof": status["phases"]["deploymentPath"].get("detail"),
+            "previousProof": receipt,
         }
 
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.3.0",
+  "version": "4.4.0",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {