@namewta/speculo 1.0.6 → 1.0.8

package/template/workflows/ops/common/tools/opslib/execution.py

@@ -1,248 +0,0 @@
-"""Digest-bound approval, target receipts, fail-closed resume and dual documentation delivery."""
-from __future__ import annotations
-import base64, copy, datetime as dt, json, os
-from pathlib import Path
-from .core import *
-from .model import load, save, ledger_load, validate, validate_status
-from .planner import locate_plan, env_file
-from .transport import call, host_transport_digest
-from .docs import delivery_bundle
-
-
-def engine_digest() -> str:
-    base=Path(__file__).resolve().parents[2]
-    files=sorted(list((base/"tools/opslib").glob("*.py"))+list((base/"schemas").glob("*.json")))
-    return digest({str(p.relative_to(base)):digest(p.read_bytes()) for p in files})
-
-def approval(state: Path, run: str, expected: str, by: str, statement: str) -> dict:
-    path=locate_plan(state,run);plan=read_json(path);validate(plan,"plan")
-    if digest(plan)!=expected:raise OpsError("approval digest mismatch: reread the full plan report")
-    if not by.strip() or len(statement.strip())<8:raise OpsError("approval needs identified approver and a meaningful explicit confirmation statement")
-    if dt.datetime.now(dt.timezone.utc)>=dt.datetime.fromisoformat(plan["expires_at"].replace("Z","+00:00")):raise OpsError("plan expired; replan")
-    value={"schema_version":1,"artifact":"ops-plan-approval","run_id":plan["run_id"],"plan_digest":expected,
-           "approved_by":by,"approved_at":now(),"decision":"approved","statement":statement}
-    validate(value,"approval")
-    with lock(state/".locks/catalog",{"operation":"approve","run_id":plan["run_id"]}):
-        if digest(load(state))!=plan["registry_digest"]:raise OpsError("catalog drift since plan; replan before approval")
-        write_json(path.parent/"approval.json",value,exclusive=True)
-    return {"run_id":plan["run_id"],"status":"approved","plan_digest":expected}
-
-def journal(folder: Path, event: dict) -> None:
-    path=folder/"journal.jsonl";no_symlinks(path);private_dir(path.parent)
-    # Exclusive controller lock serializes append order; sequence hash makes truncation/tampering visible.
-    previous="0"*64;seq=1
-    if path.exists():
-        with path.open("rb") as f:
-            for line in f:
-                old=json.loads(line);seq=old["sequence"]+1;previous=old["event_digest"]
-    value={"sequence":seq,"at":now(),"previous_digest":previous,**event};value["event_digest"]=digest(value)
-    fd=os.open(path,os.O_WRONLY|os.O_APPEND|os.O_CREAT,0o600)
-    with os.fdopen(fd,"ab") as f:f.write(canonical(value)+b"\n");f.flush();os.fsync(f.fileno())
-    secure(path)
-
-def verify_journal(path: Path) -> dict:
-    previous="0"*64;expected=1
-    if not path.exists():return {"events":0}
-    for line in path.read_text(encoding="utf8").splitlines():
-        v=json.loads(line);claimed=v.pop("event_digest")
-        if v["sequence"]!=expected or v["previous_digest"]!=previous or digest(v)!=claimed:raise OpsError("journal integrity mismatch")
-        previous=claimed;expected+=1
-    return {"events":expected-1,"last_digest":previous}
-
-def request_base(plan,hid,ledger):
-    values=[]
-    for ref in plan["credential_versions"]:
-        cid,v=ref.split("@");values.extend(ledger["entries"][cid][v]["values"].values())
-    return {"host_id":hid,"root":plan["hosts"][hid]["root"],"controller_id":plan["controller_id"],"run_id":plan["run_id"],
-            "plan_digest":digest(plan),"adopt_root":hid in plan["allow_adopt_roots"],"external_files":plan["external_files"].get(hid,[]),
-            "strict_docker_root":plan["registry_after"]["policies"]["strict_docker_root"],"secrets":values}
-
-def resolved_op(operation,ledger):
-    op=resolve_secrets(copy.deepcopy(operation),ledger)
-    if op["kind"]=="write":
-        if "json_values" in operation:op["content"]=json.dumps(resolve_secrets(operation["json_values"],ledger),ensure_ascii=False,indent=2)+"\n"
-        op.pop("json_values",None)
-        if "env_values" in operation:
-            op["content"]=env_file(resolve_secrets(operation["env_values"],ledger),systemd=operation.get("env_format")=="systemd")
-        if "content" in op:op["content_b64"]=base64.b64encode(op.pop("content").encode()).decode()
-        op.pop("env_values",None);op.pop("env_format",None)
-    return op
-
-def commit_observations(state,current,plan,execution):
-    result=copy.deepcopy(current);desired=plan["registry_after"];records=execution["steps"]
-    # The desired registry is not treated as observed reality. Preserve the previous verified version on failure.
-    result["policies"]=desired["policies"]
-    result["hosts"]=copy.deepcopy(desired["hosts"])
-    result["projects"]=copy.deepcopy(desired["projects"])
-    for did in plan["document_targets"]:
-        proposed=copy.deepcopy(desired["deployments"][did]);old=current["deployments"].get(did)
-        ops=[o for o in plan["operations"] if o.get("deployment_id")==did]
-        statuses=[records.get(o["step_id"],{}).get("status","not-started") for o in ops]
-        changing=bool(ops)
-        if changing and all(x=="succeeded" for x in statuses):
-            proposed["status"]="retired" if proposed["status"]=="retired" else "docs_pending"
-            proposed["observed_version"]=proposed["version"]
-            proposed["installed_at"]=proposed["installed_at"] or now();proposed["updated_at"]=now()
-        elif changing:
-            proposed["status"]="unknown" if "unknown" in statuses else ("failed" if "failed" in statuses else "planned")
-            proposed["observed_version"]=old.get("observed_version") if old else None
-            proposed["notes"].append("本次发布未完成；配置/数据可能部分变更。计划版本不是已验证运行版本。不得盲目重跑。")
-        elif old:proposed=copy.deepcopy(old)
-        else:proposed["status"]="planned";proposed["observed_version"]=None
-        result["deployments"][did]=proposed
-    for aid,a in desired["allocations"].items():
-        if aid in current["allocations"] and current["allocations"][aid]["status"]!="planned":result["allocations"][aid]=copy.deepcopy(current["allocations"][aid]);continue
-        item=copy.deepcopy(a)
-        provisioning=[o for o in plan["operations"] if o.get("allocation_id")==aid]
-        item["status"]="active" if provisioning and all(records.get(o["step_id"],{}).get("status")=="succeeded" for o in provisioning) else "planned"
-        result["allocations"][aid]=item
-    for bid,b in desired["bindings"].items():
-        item=copy.deepcopy(b);consumer=result["deployments"].get(b["consumer_deployment_id"])
-        if item["status"]=="active" and (not consumer or consumer["status"] in ("planned","failed","unknown")):
-            item["status"]="planned"
-        if item["mode"]=="shared" and result["allocations"][item["allocation_id"]]["status"]!="active" and item["status"]=="active":item["status"]="planned"
-        result["bindings"][bid]=item
-    result["releases"][plan["run_id"]]={"run_id":plan["run_id"],"worker":plan["worker"],"status":execution["status"],
-         "plan_path":str(Path(execution["plan_path"]).relative_to(state)),"host_ids":sorted(plan["hosts"]),"deployment_ids":plan["document_targets"],"updated_at":now(),
-         "results":{sid:{"status":v["status"],"at":v.get("at")} for sid,v in records.items()}}
-    save(state,result)
-    execution["committed_registry_digest"]=digest(result)
-    return result
-
-def mirror_configuration(state,plan,execution,ledger):
-    for original in plan["operations"]:
-        if original["kind"]!="write" or not original.get("deployment_id") or execution["steps"].get(original["step_id"],{}).get("status")!="succeeded":continue
-        dep=plan["registry_after"]["deployments"][original["deployment_id"]];h=plan["hosts"][dep["host_id"]]
-        cls=PureWindowsPath if h["platform"]=="windows" else PurePosixPath
-        try:rel=str(cls(original["path"]).relative_to(cls(dep["root"]))).replace("\\","/")
-        except ValueError:continue # Control file also has an in-project copy.
-        if rel.split("/")[0] not in {"env","compose","config","service","scripts"}:continue
-        op=resolved_op(original,ledger)
-        dest=state/"hosts"/dep["host_id"]/"deployments"/dep["deployment_id"]/"server-files"/relative(rel)
-        atomic_write(dest,base64.b64decode(op["content_b64"]))
-        if digest(dest.read_bytes())!=digest(base64.b64decode(op["content_b64"])):raise OpsError("local configuration mirror readback mismatch")
-
-def deliver(state,folder,plan,status,execution,ledger):
-    outbox=folder/"outbox.json"
-    eligible=[did for did in plan["document_targets"] if status["deployments"][did]["status"] not in ("planned","failed","unknown")]
-    if not outbox.exists():
-        document_status=copy.deepcopy(status)
-        for did in eligible:
-            if document_status["deployments"][did]["status"]=="docs_pending":document_status["deployments"][did]["status"]="completed"
-        write_json(outbox,delivery_bundle(state,plan,document_status,ledger,eligible),exclusive=True)
-    bundle=read_json(outbox)
-    if bundle["plan_digest"]!=digest(plan):raise OpsError("outbox does not belong to approved plan")
-    # Local files are durable first. A later remote failure cannot erase the controller's record.
-    for item in bundle["local"]:
-        path=state/relative(item["path"])
-        if item["path"]=="knowledge/INDEX.md" and path.exists():continue # Never overwrite user-owned permanent knowledge.
-        atomic_write(path,item["content"])
-        if digest(path.read_bytes())!=item["sha256"]:raise OpsError("local document readback mismatch")
-        bundle["acks"]["local:"+item["path"]]={"sha256":item["sha256"],"verified_at":now()}
-    write_json(outbox,bundle)
-    mirror_configuration(state,plan,execution,ledger)
-    for item in bundle["remote"]:
-        hid=item["host_id"];base=request_base(plan,hid,ledger)
-        step="docs-"+digest((hid+":"+item["path"]).encode())[:24]
-        op={"step_id":step,"kind":"write","path":item["path"],"content_b64":base64.b64encode(item["content"].encode()).decode(),"mode":0o600,"expected":item["expected"]}
-        result=call(plan["hosts"][hid],{**base,"action":"step","operation":op,"operation_digest":digest(op)})
-        if result["status"]!="succeeded":raise OpsError("target document write did not complete: "+item["path"]+" / "+result["status"])
-        observed=call(plan["hosts"][hid],{"action":"snapshot","paths":[item["path"]]})["paths"][item["path"]]
-        if observed.get("sha256")!=item["sha256"]:raise OpsError("target document readback mismatch: "+item["path"])
-        if plan["hosts"][hid]["platform"]!="windows" and observed["mode"]&0o077:raise OpsError("target plaintext documentation mode is too broad")
-        bundle["acks"]["remote:"+hid+":"+item["path"]]={"sha256":item["sha256"],"verified_at":now()}
-        write_json(outbox,bundle)
-    receipt={"schema_version":1,"run_id":plan["run_id"],"plan_digest":digest(plan),"completed_at":now(),"documents":bundle["acks"],"status":"both-sides-verified"}
-    write_json(folder/"docs-receipt.json",receipt)
-    for did in eligible:
-        dep=status["deployments"][did]
-        write_json(state/"hosts"/dep["host_id"]/"deployments"/did/"docs-receipt.json",receipt)
-    return receipt
-
-def apply(state: Path,run: str,*,resume=False,docs_only=False) -> dict:
-    path=locate_plan(state,run);folder=path.parent;plan=read_json(path);validate(plan,"plan")
-    approved=read_json(folder/"approval.json");validate(approved,"approval")
-    if approved["plan_digest"]!=digest(plan) or approved["run_id"]!=plan["run_id"]:raise OpsError("plan differs from approval")
-    if plan.get("engine_digest")!=engine_digest():raise OpsError("executor/schema code changed after planning; replan with this implementation")
-    exec_path=folder/"execution.json"
-    if exec_path.exists() and not (resume or docs_only):raise OpsError("run already started; use resume or docs-sync, never a blind second apply")
-    if not exec_path.exists() and dt.datetime.now(dt.timezone.utc)>=dt.datetime.fromisoformat(plan["expires_at"].replace("Z","+00:00")):raise OpsError("approved plan expired before first execution")
-    with lock(state/".locks/catalog",{"operation":"apply","run_id":plan["run_id"]}):
-        current=load(state);ledger=ledger_load(state)
-        execution=read_json(exec_path) if exec_path.exists() else {"schema_version":1,"run_id":plan["run_id"],"plan_path":str(path),"status":"executing","started_at":now(),"steps":{},"errors":[],"committed_registry_digest":None}
-        expected=execution["committed_registry_digest"] or plan["registry_digest"]
-        if digest(current)!=expected:raise OpsError("controller registry changed since this approved run; compile a new plan")
-        if execution["status"]=="completed":return {"run_id":plan["run_id"],"status":"completed","unchanged":True,"report":str(folder/"RESULT.md")}
-        verify_journal(folder/"journal.jsonl")
-        for hid,h in plan["hosts"].items():
-            if host_transport_digest(h)!=plan["transport_digests"][hid]:raise OpsError("SSH connection/known_hosts changed since approval")
-        for ref,wanted in plan["credential_versions"].items():
-            cid,v=ref.split("@")
-            if digest(ledger["entries"].get(cid,{}).get(v))!=wanted:raise OpsError("credential version changed/missing since approval: "+ref)
-        locked=[];unknown=False;operation_failed=False;doc_error=None
-        write_json(exec_path,execution)
-        journal(folder,{"kind":"attempt-start","run_id":plan["run_id"],"resume":resume,"docs_only":docs_only})
-        try:
-            for hid,h in plan["hosts"].items():
-                call(h,{**request_base(plan,hid,ledger),"action":"lock"});locked.append(hid)
-            if not docs_only:
-                for original in plan["operations"]:
-                    sid=original["step_id"]
-                    previous=execution["steps"].get(sid)
-                    if previous and previous["status"]=="succeeded":continue
-                    if previous and previous["status"]=="failed":raise OpsError("a terminal failed action needs a new recovery plan; failed actions are not replayed")
-                    hid=original["host_id"];op=resolved_op(original,ledger)
-                    journal(folder,{"kind":"step-dispatch","step_id":sid,"host_id":hid,"operation_digest":digest(original)})
-                    result=call(plan["hosts"][hid],{**request_base(plan,hid,ledger),"action":"step","operation":op,"operation_digest":digest(original)},timeout=max(1800,op.get("timeout",300)+120))
-                    execution["steps"][sid]=result;write_json(exec_path,execution)
-                    journal(folder,{"kind":"step-result","step_id":sid,"status":result["status"],"receipt_digest":digest(result)})
-                    if result["status"]!="succeeded":
-                        unknown=result["status"]=="unknown";operation_failed=True;break
-            elif any(execution["steps"].get(o["step_id"],{}).get("status")!="succeeded" for o in plan["operations"]):
-                raise OpsError("docs-sync only retries documentation after all operation receipts succeeded")
-            complete_ops=all(execution["steps"].get(o["step_id"],{}).get("status")=="succeeded" for o in plan["operations"])
-            execution["status"]="unknown" if unknown else ("docs_pending" if complete_ops else "partial")
-            if not docs_only or not execution["committed_registry_digest"]:
-                current=commit_observations(state,current,plan,execution);write_json(exec_path,execution)
-            if complete_ops:
-                try:
-                    deliver(state,folder,plan,current,execution,ledger)
-                    for did in plan["document_targets"]:
-                        if current["deployments"][did]["status"]=="docs_pending":current["deployments"][did]["status"]="completed"
-                    execution["status"]="completed"
-                    current["releases"][plan["run_id"]]["status"]="completed";current["releases"][plan["run_id"]]["updated_at"]=now()
-                    save(state,current);execution["committed_registry_digest"]=digest(current)
-                except (OpsError,OSError,ValueError) as e:
-                    execution["status"]="docs_pending";doc_error=str(e)
-                    execution["errors"].append({"phase":"documentation","at":now(),"error":str(e)})
-            else:
-                # A durable controller record survives partial remote deployment even when server docs cannot be published.
-                for did in plan["document_targets"]:
-                    dep=current["deployments"][did]
-                    write_json(state/"hosts"/dep["host_id"]/"deployments"/did/"deployment.json",dep)
-        except UnknownResult as e:
-            unknown=True;execution["status"]="unknown";execution["errors"].append({"phase":"transport","error":str(e),"at":now()})
-            if not execution["committed_registry_digest"]:
-                # Record a dispatched step as unknown, not not-started.
-                if 'original' in locals() and original["step_id"] not in execution["steps"]:
-                    execution["steps"][original["step_id"]]={"status":"unknown","at":now(),"reason":"transport interrupted"}
-                current=commit_observations(state,current,plan,execution)
-        except (OpsError,OSError,ValueError) as e:
-            execution["status"]="failed";execution["errors"].append({"phase":"execution","error":str(e),"at":now()})
-            if not execution["committed_registry_digest"]:current=commit_observations(state,current,plan,execution)
-        finally:
-            # Unknown results keep target reservations, preventing another controller from racing recovery.
-            if not unknown:
-                for hid in reversed(locked):
-                    try:call(plan["hosts"][hid],{**request_base(plan,hid,ledger),"action":"unlock"})
-                    except (OpsError,UnknownResult) as e:
-                        execution["errors"].append({"phase":"unlock","host_id":hid,"error":str(e),"at":now()})
-                        if execution["status"]=="completed":execution["status"]="unknown"
-            execution["updated_at"]=now()
-            if plan["run_id"] in current["releases"] and current["releases"][plan["run_id"]]["status"]!=execution["status"]:
-                current["releases"][plan["run_id"]]["status"]=execution["status"];save(state,current);execution["committed_registry_digest"]=digest(current)
-            write_json(exec_path,execution)
-            journal(folder,{"kind":"attempt-end","status":execution["status"],"errors":len(execution["errors"])})
-            result_md="# 执行结果 "+plan["run_id"]+"\n\n状态："+execution["status"]+"\n\n"+"\n".join(f"- {sid}: {v['status']}" for sid,v in execution["steps"].items())+"\n\n错误/未完成项：\n"+json.dumps(execution["errors"],ensure_ascii=False,indent=2)+"\n\n双边文档验证仅在 docs-receipt.json 存在且内容为 both-sides-verified 时完成。业务数据不自动镜像到部署机。\n"
-            atomic_write(folder/"RESULT.md",result_md)
-        return {"run_id":plan["run_id"],"status":execution["status"],"report":str(folder/"RESULT.md"),"documentation_error":doc_error,"errors":execution["errors"]}

package/template/workflows/ops/common/tools/opslib/host_recipes.py

@@ -1,67 +0,0 @@
-"""Pinned environment-management recipes. No latest-version guessing or implicit profile edits."""
-from __future__ import annotations
-import re,shlex
-from pathlib import Path
-from .core import *
-from .model import load
-from .transport import call
-
-def environment_spec(state: Path,hid: str,request: dict) -> dict:
-    exact(request,{"account","python_versions","uv_path","node_version","npm_version","volta_path","java_version","original_java_candidate","sdkman_init"},{"account"},"environment request")
-    identifier(request["account"],"toolchain account")
-    status=load(state);host=status["hosts"][hid]
-    inventory=call(host,{"action":"probe","disk_roots":[host["root"]]},timeout=180)
-    base=target_join(host,"_host/toolchains/"+request["account"])
-    defaults={k:v for k,v in inventory["tools"].items() if k in ("java","python","python3","node","npm") and v["status"]=="observed"}
-    actions=[]
-    def mkdir(rel):actions.append({"host_id":hid,"kind":"mkdir","reason":"统一工具链与缓存根","path":rel})
-    def command(argv,env,writes,verify,reason):
-        actions.append({"host_id":hid,"kind":"install-toolchain","reason":reason,"argv":argv,"cwd":host["root"],"env":env,"writes":writes,
-                        "timeout":3600,"expected_defaults":defaults,"verification":[{**verify,"env":env}]})
-    def pinned(value,label):
-        if not isinstance(value,str) or not re.fullmatch(r"[0-9][A-Za-z0-9.+_-]*",value):raise OpsError(label+" must be a concrete version/candidate, not latest or a range")
-        return value
-    if request.get("python_versions"):
-        uv=request.get("uv_path") or inventory["tools"]["uv"].get("path")
-        if not uv:raise OpsError("uv is missing: first stage a checksum-verified installer in a separate host/bootstrap plan")
-        install=base+("\\uv-python" if host["platform"]=="windows" else "/uv-python")
-        cache=target_join(host,"_host/cache/"+request["account"]+"/uv")
-        mkdir("_host/toolchains/"+request["account"]+"/uv-python");mkdir("_host/cache/"+request["account"]+"/uv")
-        for version in request["python_versions"]:
-            pinned(version,"Python")
-            command([uv,"python","install",version],{"UV_PYTHON_INSTALL_DIR":install,"UV_CACHE_DIR":cache},[install,cache],
-                    {"type":"command","argv":[uv,"python","find",version],"stdout_pattern":re.escape(install)},"Install explicitly pinned Python; never replace OS Python or change the old PATH/default.")
-    if request.get("node_version"):
-        v=pinned(request["node_version"],"Node");volta=request.get("volta_path") or inventory["tools"]["volta"].get("path")
-        if not volta:raise OpsError("Volta missing: install a reviewed pinned release before the managed environment recipe")
-        home=base+("\\volta" if host["platform"]=="windows" else "/volta")
-        mkdir("_host/toolchains/"+request["account"]+"/volta")
-        old=inventory["tools"]["node"].get("version","").strip().removeprefix("v")
-        if old and not re.fullmatch(r"\d+\.\d+\.\d+",old):raise OpsError("cannot confidently identify original Node default")
-        # Fetch installs additional versions without changing Volta's default.
-        command([volta,"fetch","node@"+v],{"VOLTA_HOME":home},[home],{"type":"command","argv":[volta,"list","all"]},"Populate the managed Volta store without changing the user's default Node.")
-        if old:
-            command([volta,"install","node@"+old],{"VOLTA_HOME":home},[home],{"type":"command","argv":[volta,"list","all"]},"Set the managed Volta default back to the exact observed Node version; no shell profile modification.")
-        if request.get("npm_version"):
-            npm=pinned(request["npm_version"],"npm")
-            command([volta,"fetch","npm@"+npm],{"VOLTA_HOME":home},[home],{"type":"command","argv":[volta,"list","all"]},"Fetch explicit npm version without changing user default.")
-            oldnpm=inventory["tools"]["npm"].get("version","").strip()
-            if re.fullmatch(r"\d+\.\d+\.\d+",oldnpm):
-                command([volta,"install","npm@"+oldnpm],{"VOLTA_HOME":home},[home],{"type":"command","argv":[volta,"list","all"]},"Restore the observed npm default inside the managed Volta home.")
-    if request.get("java_version"):
-        if host["platform"]=="windows":raise OpsError("SDKMAN is not a native Windows adapter; register WSL as a distinct Linux execution host or retain native JDK")
-        version=pinned(request["java_version"],"JDK candidate");old=pinned(request.get("original_java_candidate"),"original SDKMAN JDK candidate")
-        init=request.get("sdkman_init");sdkroot=base+"/sdkman"
-        if not init or not within(init,sdkroot,host["platform"]):raise OpsError("SDKMAN initialization must be staged in the managed SDKMAN root; never silently migrate an existing ~/.sdkman")
-        q=shlex.quote
-        script="set -euo pipefail\nexport SDKMAN_DIR="+q(sdkroot)+"\nsource "+q(init)+"\nsdkman_auto_answer=true\nsdkman_selfupdate_enable=false\nsdk current java | grep -F -- "+q(old)+"\nsdk install java "+q(version)+"\nsdk default java "+q(old)+"\nsdk use java "+q(old)+"\njava -version\n"
-        rel="_host/scripts/"+new_id("sdkman")+".sh"
-        actions.append({"host_id":hid,"kind":"write-file","reason":"Version-pinned SDKMAN script with original-default restoration","path":rel,"content":script,"mode":0o700})
-        command(["bash",target_join(host,rel)],{},[sdkroot],{"type":"command","argv":["java","-version"]},"Install approved JDK, then restore and verify original candidate. Old JDK is never deleted.")
-    if not actions:raise OpsError("no explicit toolchain versions requested")
-    consumers={d["deployment_id"] for d in status["deployments"].values() if d["host_id"]==hid and d["status"]!="retired"}
-    for b in status["bindings"].values():
-        if b["provider_deployment_id"] in consumers and b["status"]=="active":consumers.add(b["consumer_deployment_id"])
-    return {"schema_version":1,"worker":"H","operation":"prepare","reason":"Managed toolchain preparation with observed-default preservation",
-            "hosts":[hid],"host_actions":actions,"acknowledged_consumers":sorted(consumers),
-            "rollback_note":"Do not remove old toolchains. A failed default check stops the run. The plan does not modify user shell profiles; adoption of the managed activation environment is a separate explicit change.","risk":"external-mutation"}

package/template/workflows/ops/common/tools/opslib/model.py

@@ -1,199 +0,0 @@
-"""Strict resource contracts and atomic controller-side catalog operations."""
-from __future__ import annotations
-import copy, json, os, re
-from pathlib import Path
-from typing import Any
-from .core import *
-
-SCHEMAS = Path(__file__).resolve().parents[2] / "schemas"
-
-def validate(value: Any, schema_name: str) -> None:
-    schema = json.loads((SCHEMAS / (schema_name + ".schema.json")).read_text(encoding="utf-8"))
-    def walk(v, s, label):
-        if "$ref" in s:
-            node = schema
-            for k in s["$ref"].removeprefix("#/").split("/"): node = node[k]
-            return walk(v, node, label)
-        if "oneOf" in s:
-            successes = 0
-            for branch in s["oneOf"]:
-                try: walk(v, branch, label); successes += 1
-                except OpsError: pass
-            if successes != 1: raise OpsError(f"{label}: oneOf contract not satisfied")
-        kinds = {"object": lambda x: isinstance(x, dict), "array": lambda x: isinstance(x, list),
-                 "string": lambda x: isinstance(x, str), "integer": lambda x: type(x) is int,
-                 "boolean": lambda x: type(x) is bool, "null": lambda x: x is None,
-                 "number": lambda x: isinstance(x, (int, float)) and not isinstance(x, bool)}
-        if "type" in s:
-            types = s["type"] if isinstance(s["type"], list) else [s["type"]]
-            if not any(kinds[t](v) for t in types): raise OpsError(f"{label}: wrong type")
-        if "const" in s and v != s["const"]: raise OpsError(f"{label}: wrong constant")
-        if "enum" in s and v not in s["enum"]: raise OpsError(f"{label}: invalid enum")
-        if isinstance(v, str):
-            if len(v) < s.get("minLength", 0) or len(v) > s.get("maxLength", 10000000): raise OpsError(f"{label}: string length")
-            if "pattern" in s and not re.search(s["pattern"], v): raise OpsError(f"{label}: invalid pattern")
-        if type(v) in (int, float):
-            if v < s.get("minimum", -float("inf")) or v > s.get("maximum", float("inf")): raise OpsError(f"{label}: number out of range")
-        if isinstance(v, dict):
-            if set(s.get("required", [])) - set(v): raise OpsError(f"{label}: missing {sorted(set(s['required'])-set(v))}")
-            props = s.get("properties", {})
-            for k, item in v.items():
-                if k in props: walk(item, props[k], label+"."+k)
-                elif s.get("additionalProperties") is False: raise OpsError(f"{label}: unknown field {k}")
-                elif isinstance(s.get("additionalProperties"), dict): walk(item, s["additionalProperties"], label+"."+k)
-            if "propertyNames" in s:
-                for k in v: walk(k, s["propertyNames"], label+".<key>")
-        if isinstance(v, list):
-            if len(v) < s.get("minItems", 0): raise OpsError(f"{label}: too few items")
-            if s.get("uniqueItems") and len({canonical(x) for x in v}) != len(v): raise OpsError(f"{label}: duplicate items")
-            for i, x in enumerate(v): walk(x, s.get("items", {}), f"{label}[{i}]")
-    walk(value, schema, schema_name)
-
-def deployment_root(host: dict, project_id: str, environment: str, instance: str, layout: str) -> str:
-    for x in (project_id, environment, instance): identifier(x)
-    if layout == "flat": return target_join(host, project_id)
-    if layout == "instances": return target_join(host, project_id, f"instances/{environment}/{instance}")
-    raise OpsError("unknown deployment layout")
-
-def validate_host(host: dict) -> None:
-    validate(host, "host")
-    identifier(host["host_id"])
-    if root_path(host["root"], host["platform"]) != host["root"]: raise OpsError("host root must be normalized")
-    if host["transport"] == "local" and host["connection"]:
-        raise OpsError("local host connection must be empty")
-    if host["transport"] == "ssh":
-        c = host["connection"]
-        for k in ("hostname", "username", "known_hosts", "python"):
-            if not c.get(k): raise OpsError("ssh connection missing " + k)
-        if not re.fullmatch(r"[A-Za-z0-9_.:-]+", c["hostname"]) or c["hostname"].startswith("-"):
-            raise OpsError("unsafe SSH hostname")
-        if not re.fullmatch(r"[A-Za-z0-9_.-]+", c["username"]) or c["username"].startswith("-"):
-            raise OpsError("unsafe SSH username")
-        python_pattern = r"[A-Za-z0-9_./:\\ +-]+" if host["platform"] == "windows" else r"[/A-Za-z0-9_.+-]+"
-        if not re.fullmatch(python_pattern, c["python"]) or c["python"].startswith("-"):
-            raise OpsError("SSH Python must be a safe executable path, not a command")
-        if c.get("shell", "posix") not in ("posix", "powershell"): raise OpsError("unsupported remote shell")
-    if not re.fullmatch(r"[a-f0-9]{64}", host["identity"]): raise OpsError("host identity must be a probed machine digest")
-
-def validate_status(s: dict) -> None:
-    if s.get("schema_version") != 3:
-        raise OpsError("ops-legacy-state: preserve the old state; run import-legacy into a new empty state root")
-    validate(s, "status")
-    roots = set()
-    physical_roots = []
-    for hid, h in s["hosts"].items():
-        validate_host(h)
-        if hid != h["host_id"]: raise OpsError("host index identity mismatch")
-        physical = (h["identity"], h["root"].casefold() if h["platform"] == "windows" else h["root"])
-        if physical in roots: raise OpsError("duplicate physical host/root registered under different IDs")
-        roots.add(physical)
-        for identity, other, platform in physical_roots:
-            if identity == h["identity"] and platform != h["platform"]: raise OpsError("same physical identity has inconsistent platform")
-            if identity == h["identity"] and (within(h["root"], other, platform) or within(other, h["root"], platform)):
-                raise OpsError("overlapping registered host roots")
-        physical_roots.append((h["identity"],h["root"],h["platform"]))
-    for pid, p in s["projects"].items():
-        validate(p, "project"); identifier(pid)
-        if pid != p["project_id"]: raise OpsError("project index identity mismatch")
-        if p["kind"] == "shared-service" and not p.get("service_type"): raise OpsError("shared provider requires service_type")
-    used = set()
-    occupied = []
-    for did, d in s["deployments"].items():
-        validate(d, "deployment")
-        if did != d["deployment_id"]: raise OpsError("deployment index mismatch")
-        if d["host_id"] not in s["hosts"] or d["project_id"] not in s["projects"]: raise OpsError("orphan deployment")
-        h = s["hosts"][d["host_id"]]
-        expected = deployment_root(h, d["project_id"], d["environment"], d["instance"], d["layout"])
-        if d["root"] != expected: raise OpsError("deployment root does not follow host/project policy")
-        slot = (h["identity"], expected.casefold() if h["platform"] == "windows" else expected)
-        if slot in used: raise OpsError("two deployments occupy the same directory; use explicit instances layout")
-        used.add(slot)
-        for identity, other, platform in occupied:
-            if identity == h["identity"] and platform != h["platform"]: raise OpsError("same physical identity has inconsistent platform")
-            if identity == h["identity"] and (within(expected, other, platform) or within(other, expected, platform)):
-                raise OpsError("overlapping flat/instances deployment roots require an explicit migration")
-        occupied.append((h["identity"], expected, h["platform"]))
-        for item in d["storage"]:
-            if not within(item["path"], d["root"], h["platform"]): raise OpsError("persistent path outside APP root")
-    for aid, a in s["allocations"].items():
-        validate(a, "allocation")
-        if aid != a["allocation_id"] or a["provider_deployment_id"] not in s["deployments"]: raise OpsError("orphan allocation")
-        pd = s["deployments"][a["provider_deployment_id"]]
-        if s["projects"][pd["project_id"]]["kind"] != "shared-service": raise OpsError("allocation provider must be shared-service")
-        if a["owner_project_id"] not in s["projects"]: raise OpsError("allocation owner missing")
-    resources = set()
-    for a in s["allocations"].values():
-        if a["status"] == "retired": continue
-        key = (a["provider_deployment_id"], a["resource_kind"], a["resource_name"])
-        if key in resources: raise OpsError("duplicate logical allocation: use one allocation for replicas")
-        resources.add(key)
-    edges = {}
-    for bid, b in s["bindings"].items():
-        validate(b, "binding")
-        if bid != b["binding_id"] or b["consumer_deployment_id"] not in s["deployments"]: raise OpsError("orphan binding")
-        consumer = s["deployments"][b["consumer_deployment_id"]]
-        if b["mode"] == "shared":
-            if b["allocation_id"] not in s["allocations"]: raise OpsError("binding allocation missing")
-            a = s["allocations"][b["allocation_id"]]
-            if a["provider_deployment_id"] != b["provider_deployment_id"]: raise OpsError("binding provider disagrees with allocation")
-            if a["owner_project_id"] != consumer["project_id"] or a["environment"] != consumer["environment"]:
-                if consumer["project_id"] not in a.get("shared_owners", []): raise OpsError("cross-app/environment sharing requires explicit shared owners")
-            if b["credential_ref"] != a["credential_ref"]: raise OpsError("binding must use allocation's application credential")
-            if a["status"] == "retired" and b["status"] == "active": raise OpsError("active consumer uses retired allocation")
-            edges.setdefault(b["consumer_deployment_id"], set()).add(b["provider_deployment_id"])
-        elif b["mode"] == "external":
-            if b["provider_deployment_id"] is not None or b["allocation_id"] is not None: raise OpsError("external binding cannot claim local provider data")
-        elif b["mode"] == "dedicated":
-            if b["allocation_id"] is not None or b["provider_deployment_id"] is not None: raise OpsError("dedicated component cannot reference shared provider/allocation")
-        if b["status"] == "active" and consumer["status"] == "retired": raise OpsError("retired deployment retains active binding")
-    def visit(node, trail, done):
-        if node in trail: raise OpsError("cyclic service dependencies")
-        if node in done: return
-        for nxt in edges.get(node, []): visit(nxt, trail | {node}, done)
-        done.add(node)
-    done = set()
-    for node in edges: visit(node, set(), done)
-
-def load(state: Path) -> dict:
-    s = read_json(state / "status.json"); validate_status(s); return s
-
-def save(state: Path, s: dict, *, bump: bool = True) -> None:
-    validate_status(s)
-    if bump: s["revision"] += 1
-    s["updated_at"] = now(); write_json(state / "status.json", s)
-
-def ledger_load(state: Path) -> dict:
-    p = state / "private/credentials.json"
-    if not p.exists(): return {"schema_version": 1, "entries": {}}
-    if os.name != "nt" and p.stat().st_mode & 0o077: raise OpsError("plaintext ledger permissions too broad; run chmod 600 explicitly")
-    return read_json(p)
-
-def put_credential(state: Path, value: dict) -> dict:
-    exact(value, {"credential_id", "version", "values", "purpose"}, {"credential_id", "version", "values", "purpose"}, "credential")
-    identifier(value["credential_id"])
-    if type(value["version"]) is not int or value["version"] < 1 or not value["values"]: raise OpsError("credential version/values invalid")
-    for k, v in value["values"].items():
-        if not re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", k) or not isinstance(v, str) or not v or "\x00" in v: raise OpsError("credential fields must be named nonempty strings")
-    with lock(state / ".locks/catalog", {"operation": "credential-import"}):
-        load(state)
-        ledger = ledger_load(state); entries = ledger["entries"].setdefault(value["credential_id"], {})
-        version = str(value["version"])
-        if version in entries:
-            if entries[version]["values"] != value["values"]: raise OpsError("immutable credential version: use a new explicit version")
-            return {"credential_ref": value["credential_id"]+"@"+version, "status": "unchanged"}
-        entries[version] = {"values": value["values"], "purpose": value["purpose"], "created_at": now()}
-        write_json(state / "private/credentials.json", ledger)
-    return {"credential_ref": value["credential_id"]+"@"+version, "status": "recorded-not-rotated-on-server"}
-
-def register(state: Path, request: dict) -> dict:
-    exact(request, {"hosts", "projects"}, set(), "registration")
-    with lock(state / ".locks/catalog", {"operation": "register"}):
-        s = load(state)
-        for group, idkey in (("hosts", "host_id"), ("projects", "project_id")):
-            for item in request.get(group, []):
-                key = item[idkey]
-                if key in s[group] and s[group][key] != item:
-                    raise OpsError(f"registered identity is immutable through register: {group}/{key}; use a reviewed migration")
-                s[group][key] = item
-        save(state, s)
-    return {"revision": s["revision"], "hosts": list(s["hosts"]), "projects": list(s["projects"])}