@mriekki/project-forge 4.3.0 → 4.4.1

package/assets/generated/deployment/src/project_forge_deployment/environment_probe.py

@@ -12,6 +12,7 @@ from typing import Any
 from .app_runtime import normalize_app_spec, plan_app_deploy
 from .app_runtime_workstation import apply_app_deploy_with_preloaded_image
 from .box_platform import platform_status
+from .environment_isolation import environment_isolation_preflight
 from .errors import DeploymentKitError
 from .image_transfer import remote_image_present, transfer_image, verify_local_image
 from .proof_receipt import write_environment_proof_receipt
@@ -92,6 +93,27 @@ def _resolve_probe_image(image_tag: str) -> str:
     raise DeploymentKitError("Environment proof image has no usable immutable sha256 RepoDigest.")
 
 
+def _proof_isolation_preflight(
+    target_name: str,
+    *,
+    owner_repo: str,
+    environment: str,
+    production: bool,
+    probe_app_slug: str,
+) -> dict[str, Any]:
+    return environment_isolation_preflight(
+        target_name,
+        owner_repo=owner_repo,
+        environment=environment,
+        production=production,
+        app_slug=probe_app_slug,
+        container_name=f"{probe_app_slug}--{environment}",
+        runtime_port=80,
+        persistence_mode="none",
+        require_vacant_app_identity=True,
+    )
+
+
 def plan_environment_proof(
     target_name: str,
     *,
@@ -111,17 +133,27 @@ def plan_environment_proof(
         raise DeploymentKitError(
             f"Environment proof requires a ready shared platform; target '{target_name}' is '{platform.get('state', 'unknown')}'."
         )
+    probe_app_slug = _probe_slug(owner)
+    isolation = _proof_isolation_preflight(
+        target_name,
+        owner_repo=owner,
+        environment=env,
+        production=production,
+        probe_app_slug=probe_app_slug,
+    )
     return {
         "targetName": target_name,
         "ownerRepo": owner,
         "environment": env,
         "production": production,
-        "probeAppSlug": _probe_slug(owner),
+        "probeAppSlug": probe_app_slug,
         "probeImageTag": probe_image,
         "artifactDelivery": "workstation-transfer",
         "persistence": "none",
         "healthPath": "/",
         "cleanup": "automatic",
+        "isolationPreflight": isolation,
+        "runnable": isolation["state"] == "clear",
         "requiredAuthorization": (
             PRODUCTION_ENVIRONMENT_PROOF_WRITE_PHRASE if production else ENVIRONMENT_PROOF_WRITE_PHRASE
         ),
@@ -139,6 +171,8 @@ def _proof_result(plan: dict[str, Any]) -> dict[str, Any]:
         "preflight": {
             "targetAccess": "verified-by-platform-doctor",
             "hostPlatform": "ready",
+            "environmentIsolation": plan["isolationPreflight"]["state"],
+            "isolationEvidenceSha256": plan["isolationPreflight"]["evidenceSha256"],
         },
         "registryDigest": None,
         "localImageId": None,
@@ -199,10 +233,32 @@ def run_environment_proof(plan: dict[str, Any]) -> dict[str, Any]:
         "persistence",
         "healthPath",
         "cleanup",
+        "isolationPreflight",
+        "runnable",
         "requiredAuthorization",
     }
     if not isinstance(plan, dict) or set(plan) != required:
         raise DeploymentKitError("Malformed environment proof plan.")
+    if plan["isolationPreflight"].get("state") != "clear" or not plan["runnable"]:
+        raise DeploymentKitError(
+            "Environment proof is blocked by the reviewed isolation/collision preflight; resolve the reported conflicts and create a fresh plan."
+        )
+
+    current_isolation = _proof_isolation_preflight(
+        plan["targetName"],
+        owner_repo=plan["ownerRepo"],
+        environment=plan["environment"],
+        production=plan["production"],
+        probe_app_slug=plan["probeAppSlug"],
+    )
+    if current_isolation["state"] != "clear":
+        raise DeploymentKitError(
+            "Environment isolation became blocked after the proof plan was reviewed; no proof mutation was attempted."
+        )
+    if current_isolation["evidenceSha256"] != plan["isolationPreflight"].get("evidenceSha256"):
+        raise DeploymentKitError(
+            "Environment isolation evidence changed after the proof plan was reviewed; create and authorize a fresh plan."
+        )
 
     result = _proof_result(plan)
     deploy_plan: dict[str, Any] | None = None

package/assets/generated/deployment/src/project_forge_deployment/environment_setup.py

@@ -248,7 +248,7 @@ def _next_action(status: dict[str, Any]) -> dict[str, Any]:
         return {
             "kind": "complete",
             "action": "remote-environment-ready",
-            "reason": "Fresh workstation-local proof evidence matches this Project/environment/target context.",
+            "reason": "Fresh workstation-local proof evidence matches this Project/environment/target context and current isolation remains clear.",
             "proofReceipt": phases["deploymentPath"].get("detail"),
         }
 
@@ -259,6 +259,36 @@ def _next_action(status: dict[str, Any]) -> dict[str, Any]:
     }
 
 
+def _proof_command(name: str, proof: dict[str, Any], *, production: bool) -> str:
+    command = (
+        f"project-forge-deploy environment proof plan {name} "
+        f"--owner-repo {proof['ownerRepo']} --environment {proof['environment']}"
+    )
+    if production:
+        command += " --production"
+    return command
+
+
+def _blocked_isolation_action(
+    name: str,
+    proof: dict[str, Any],
+    *,
+    production: bool,
+) -> dict[str, Any]:
+    return {
+        "kind": "blocked",
+        "action": "resolve-environment-isolation-collision",
+        "command": _proof_command(name, proof, production=production),
+        "reason": (
+            "The read-only colocated-environment preflight found a managed ownership or footprint collision. "
+            "Do not redirect this environment to a sibling target identity or take over existing runtime, route, persistence, or lock state."
+        ),
+        "proofPlan": proof,
+        "isolationPreflight": proof.get("isolationPreflight"),
+        "safety": "Inspect the reported managed ownership records and resolve the collision explicitly before creating a fresh proof plan.",
+    }
+
+
 def remote_setup_plan(
     name: str,
     *,
@@ -272,48 +302,64 @@ def remote_setup_plan(
         raise DeploymentKitError("ownerRepo and environment must be supplied together for setup proof planning.")
 
     status = remote_setup_status(name)
-    if owner_repo is not None and environment is not None and status["phases"]["hostPlatform"]["state"] == "ready":
-        receipt = load_environment_proof_receipt(
+    proof: dict[str, Any] | None = None
+    receipt: dict[str, Any] | None = None
+    if (
+        owner_repo is not None
+        and environment is not None
+        and status["phases"]["hostPlatform"]["state"] == "ready"
+    ):
+        # Current machine isolation must be checked even when a prior proof receipt is
+        # otherwise reusable. A sibling environment can be added after the receipt was
+        # recorded without changing workstation/target identity or trust evidence.
+        proof = plan_environment_proof(
             name,
             owner_repo=owner_repo,
             environment=environment,
             production=production,
         )
-        status["phases"]["deploymentPath"] = _phase(
-            "DEPLOYMENT PATH PROVEN",
-            "proven" if receipt["state"] == "proven" else "not-proven",
-            detail=receipt,
+        receipt = load_environment_proof_receipt(
+            name,
+            owner_repo=owner_repo,
+            environment=environment,
+            production=production,
         )
+        isolation_clear = proof.get("runnable", True)
+        if isolation_clear:
+            status["phases"]["deploymentPath"] = _phase(
+                "DEPLOYMENT PATH PROVEN",
+                "proven" if receipt["state"] == "proven" else "not-proven",
+                detail=receipt,
+            )
+            if receipt["state"] == "proven":
+                status["state"] = "environment-ready"
+        else:
+            status["phases"]["deploymentPath"] = _phase(
+                "DEPLOYMENT PATH PROVEN",
+                "blocked",
+                detail={
+                    "proofReceipt": receipt,
+                    "isolationPreflight": proof.get("isolationPreflight"),
+                },
+            )
+            status["state"] = "needs-setup"
         status["currentPhase"] = _current_phase(status["phases"])
-        if receipt["state"] == "proven":
-            status["state"] = "environment-ready"
 
     next_action = _next_action(status)
 
-    if (
+    if proof is not None and not proof.get("runnable", True):
+        next_action = _blocked_isolation_action(name, proof, production=production)
+    elif (
         next_action["action"] == "plan-deployment-path-proof"
-        and owner_repo is not None
-        and environment is not None
+        and proof is not None
     ):
-        proof = plan_environment_proof(
-            name,
-            owner_repo=owner_repo,
-            environment=environment,
-            production=production,
-        )
-        command = (
-            f"project-forge-deploy environment proof plan {name} "
-            f"--owner-repo {proof['ownerRepo']} --environment {proof['environment']}"
-        )
-        if production:
-            command += " --production"
         next_action = {
             "kind": "read-only",
             "action": "review-deployment-path-proof",
-            "command": command,
+            "command": _proof_command(name, proof, production=production),
             "proofPlan": proof,
             "runAuthorization": proof["requiredAuthorization"],
-            "previousProof": status["phases"]["deploymentPath"].get("detail"),
+            "previousProof": receipt,
         }
 
     return {

package/assets/generated/deployment/src/project_forge_deployment/sqlite_adapter.py

@@ -252,9 +252,18 @@ def _reservation_from_request(request: dict[str, Any]) -> dict[str, Any]:
     }
 
 
-def plan_sqlite_operation(name: str, action: str, request: dict[str, Any]) -> dict[str, Any]:
+def plan_sqlite_operation(
+    name: str,
+    action: str,
+    request: dict[str, Any],
+    *,
+    production: bool = False,
+) -> dict[str, Any]:
     if action not in {"import", "backup", "migrate", "rollback-check"}:
         raise DeploymentKitError("Unsupported SQLite plan action.")
+    if not isinstance(production, bool):
+        raise DeploymentKitError("SQLite Production classification must be a boolean.")
+    production_classified = production or request["environment"] == "production"
     _require_ready_platform(name)
     inventory = sqlite_inventory(name)
     existing = _find(inventory, request["appSlug"], request["environment"])
@@ -284,7 +293,8 @@ def plan_sqlite_operation(name: str, action: str, request: dict[str, Any]) -> di
             raise DeploymentKitError(f"SQLite {action} requires an existing database.")
     return {
         "targetName": name, "action": action, "ownerRepo": request["ownerRepo"],
-        "environment": request["environment"], "appSlug": request["appSlug"], "image": request["image"],
+        "environment": request["environment"], "productionClassified": production_classified,
+        "appSlug": request["appSlug"], "image": request["image"],
         "databaseFile": spec["databaseFile"], "runAs": spec["runAs"],
         "sourceDatabase": request["sourceDatabase"] if action == "import" else None,
         "firstInstall": bool(request["firstInstall"] if action == "migrate" else False),
@@ -295,7 +305,9 @@ def plan_sqlite_operation(name: str, action: str, request: dict[str, Any]) -> di
 
 
 def authorization_phrase(plan: dict[str, Any]) -> str:
-    production = plan["environment"] == "production"
+    production = plan.get("productionClassified")
+    if not isinstance(production, bool):
+        raise DeploymentKitError("Malformed SQLite operation plan Production classification.")
     mapping = {
         "import": (SQLITE_IMPORT_WRITE_PHRASE, PRODUCTION_SQLITE_IMPORT_WRITE_PHRASE),
         "backup": (SQLITE_BACKUP_WRITE_PHRASE, PRODUCTION_SQLITE_BACKUP_WRITE_PHRASE),
@@ -307,9 +319,11 @@ def authorization_phrase(plan: dict[str, Any]) -> str:
 
 
 def apply_sqlite_operation(plan: dict[str, Any]) -> dict[str, Any]:
-    required = {"targetName", "action", "ownerRepo", "environment", "appSlug", "image", "databaseFile", "runAs", "sourceDatabase", "firstInstall", "stopsManagedRuntime", "createsVerifiedBackup", "inventorySnapshot", "expectedReservationSha256", "spec"}
-    if not isinstance(plan, dict) or set(plan) != required:
+    required = {"targetName", "action", "ownerRepo", "environment", "productionClassified", "appSlug", "image", "databaseFile", "runAs", "sourceDatabase", "firstInstall", "stopsManagedRuntime", "createsVerifiedBackup", "inventorySnapshot", "expectedReservationSha256", "spec"}
+    if not isinstance(plan, dict) or set(plan) != required or not isinstance(plan["productionClassified"], bool):
         raise DeploymentKitError("Malformed SQLite operation plan.")
+    if plan["environment"] == "production" and not plan["productionClassified"]:
+        raise DeploymentKitError("Literal production environment must remain Production-classified.")
     _require_ready_platform(plan["targetName"])
     current = sqlite_inventory(plan["targetName"])
     if _snapshot(current) != plan["inventorySnapshot"]:
@@ -319,6 +333,7 @@ def apply_sqlite_operation(plan: dict[str, Any]) -> dict[str, Any]:
     result = sqlite_inventory(plan["targetName"])
     result["mutated"] = True
     result["operation"] = plan["action"]; result["operationOutput"] = output.strip()
+    result["productionClassified"] = plan["productionClassified"]
     return result
 
 
@@ -332,4 +347,4 @@ def assert_app_spec_matches_persistence(name: str, app_spec: dict[str, Any]) ->
     if existing["runAs"] != app_spec["runAs"]:
         raise DeploymentKitError("Application runAs does not match the prepared SQLite persistence reservation.")
     if app_spec.get("persistence", {}).get("mode") != "directory":
-        raise DeploymentKitError("Prepared SQLite persistence requires directory application persistence.")
+        raise DeploymentKitError("Prepared SQLite persistence requires directory application persistence.")

package/assets/generated/deployment/src/project_forge_deployment/sqlite_cli.py

@@ -38,6 +38,11 @@ def _common(parser: argparse.ArgumentParser) -> None:
     parser.add_argument('name')
     parser.add_argument('--owner-repo', required=True)
     parser.add_argument('--environment', required=True)
+    parser.add_argument(
+        '--production',
+        action='store_true',
+        help="Classify this named environment as Production even when its name is not literally 'production'",
+    )
     parser.add_argument('--app-slug', required=True)
     parser.add_argument('--image', required=True)
     parser.add_argument('--maintenance-env', action='append', default=[], help='Non-secret image maintenance environment value in NAME=value form; repeat as needed')
@@ -68,19 +73,20 @@ def main(argv: list[str]|None=None) -> int:
     args=build_parser().parse_args(argv)
     try:
         if args.command=='inventory': _print(sqlite_inventory(args.name),as_json=args.json); return 0
+        production_classified = args.production or args.environment == 'production'
         request=normalize_sqlite_request(owner_repo=args.owner_repo,environment=args.environment,app_slug=args.app_slug,image=args.image,
             maintenance_environment=_parse_env(args.maintenance_env),run_as=getattr(args,'run_as',None),database_file=getattr(args,'database_file',None),
             source_database=getattr(args,'source_database',None),first_install=getattr(args,'first_install',False))
         if args.command=='recover-import':
-            plan=plan_sqlite_import_recovery(args.name,request)
+            plan=plan_sqlite_import_recovery(args.name,request,production=production_classified)
             _print({k:v for k,v in plan.items() if k!='request'},as_json=False)
             phrase=recovery_authorization_phrase(plan)
             _confirm(args,phrase,f"recover SQLite import for {plan['appSlug']} ({plan['environment']}) on target {args.name}")
             _print(apply_sqlite_import_recovery(plan),as_json=args.json); return 0
-        plan=plan_sqlite_operation(args.name,args.command,request)
+        plan=plan_sqlite_operation(args.name,args.command,request,production=production_classified)
         _print({k:v for k,v in plan.items() if k!='spec'},as_json=False)
         phrase=authorization_phrase(plan)
         _confirm(args,phrase,f"run SQLite {args.command} for {plan['appSlug']} ({plan['environment']}) on target {args.name}")
         _print(apply_sqlite_operation(plan),as_json=args.json); return 0
     except DeploymentKitError as error:
-        print(f"ERROR: {error}",file=sys.stderr); return 2
+        print(f"ERROR: {error}",file=sys.stderr); return 2

package/assets/generated/deployment/src/project_forge_deployment/sqlite_import_recovery.py

@@ -356,13 +356,22 @@ def _snapshot(inspection: dict[str, Any]) -> str:
     return hashlib.sha256(json.dumps(value, sort_keys=True, separators=(",", ":")).encode("utf-8")).hexdigest()
 
 
-def plan_sqlite_import_recovery(name: str, request: dict[str, Any]) -> dict[str, Any]:
+def plan_sqlite_import_recovery(
+    name: str,
+    request: dict[str, Any],
+    *,
+    production: bool = False,
+) -> dict[str, Any]:
+    if not isinstance(production, bool):
+        raise DeploymentKitError("SQLite Production classification must be a boolean.")
+    production_classified = production or request["environment"] == "production"
     inspection = inspect_sqlite_import_recovery(name, request)
     return {
         "targetName": name,
         "action": "recover-import",
         "ownerRepo": request["ownerRepo"],
         "environment": request["environment"],
+        "productionClassified": production_classified,
         "appSlug": request["appSlug"],
         "image": request["image"],
         "runAs": request["runAs"],
@@ -381,22 +390,32 @@ def plan_sqlite_import_recovery(name: str, request: dict[str, Any]) -> dict[str,
 
 
 def authorization_phrase(plan: dict[str, Any]) -> str:
+    production = plan.get("productionClassified")
+    if not isinstance(production, bool):
+        raise DeploymentKitError("Malformed SQLite import recovery Production classification.")
     return (
         PRODUCTION_SQLITE_IMPORT_RECOVERY_WRITE_PHRASE
-        if plan["environment"] == "production"
+        if production
         else SQLITE_IMPORT_RECOVERY_WRITE_PHRASE
     )
 
 
 def apply_sqlite_import_recovery(plan: dict[str, Any]) -> dict[str, Any]:
     required = {
-        "targetName", "action", "ownerRepo", "environment", "appSlug", "image", "runAs",
+        "targetName", "action", "ownerRepo", "environment", "productionClassified", "appSlug", "image", "runAs",
         "databaseFile", "sourceDatabase", "databaseSha256", "sourceSha256", "databaseBytes",
         "stateSnapshot", "overwritesDatabase", "deletesPersistentData", "createsReservation",
         "reverifiesDatabase", "request",
     }
-    if not isinstance(plan, dict) or set(plan) != required or plan["action"] != "recover-import":
+    if (
+        not isinstance(plan, dict)
+        or set(plan) != required
+        or plan["action"] != "recover-import"
+        or not isinstance(plan["productionClassified"], bool)
+    ):
         raise DeploymentKitError("Malformed SQLite import recovery plan.")
+    if plan["environment"] == "production" and not plan["productionClassified"]:
+        raise DeploymentKitError("Literal production environment must remain Production-classified.")
     current = inspect_sqlite_import_recovery(plan["targetName"], plan["request"])
     if _snapshot(current) != plan["stateSnapshot"]:
         raise DeploymentKitError(
@@ -434,4 +453,5 @@ def apply_sqlite_import_recovery(plan: dict[str, Any]) -> dict[str, Any]:
     inventory["mutated"] = True
     inventory["operation"] = "recover-import"
     inventory["operationOutput"] = output.strip()
+    inventory["productionClassified"] = plan["productionClassified"]
     return inventory

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.3.0",
+  "version": "4.4.1",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {