@topy-ai/maggie 0.7.48 → 0.7.49

package/bundled-tools/clis/maggie_deployment_collect.py

@@ -0,0 +1,225 @@
+#!/usr/bin/env python3
+"""Collect standard host release evidence and emit one reproducible readiness report.
+
+`maggie deployment readiness` validates evidence files but does not produce
+them, so each host used to hand-roll browser, SSH, systemd, and retention
+scripts. This collector runs the standard adapters declared in one reviewed
+config (edge/rendered canary, host health, rollback consistency, remote
+release identity, optional authenticated API canary), writes each adapter's
+evidence, and summarizes everything with the existing
+`maggie-deployment-readiness.v1` report. It never deploys, never uses a
+shell, and never records credentials or response bodies.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import importlib.util
+import json
+import re
+import subprocess
+import sys
+import urllib.error
+import urllib.request
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+from urllib.parse import urlparse
+
+CONFIG_SCHEMA = "maggie-evidence-collector.v1"
+HERE = Path(__file__).resolve().parent
+STANDARD_EVIDENCE = {
+    "unitRegression": ".maggie/verification/unit-regression.json",
+    "packageSmoke": ".maggie/verification/package-smoke.json",
+    "browserEvidence": ".maggie/verification/browser-evidence.json",
+    "deploymentPreflight": ".maggie/release-preflight.json",
+}
+SECRET_ARG = re.compile(r"(?:password|passwd|token|secret|apikey|api_key)=|Bearer\s|sk[-_](?:live|test)[-_]|eyJ[A-Za-z0-9_-]{10,}\.", re.IGNORECASE)
+RELEASE_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
+
+
+def load_module(name: str):
+    spec = importlib.util.spec_from_file_location(name, HERE / f"{name}.py")
+    assert spec and spec.loader
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def resolve(project: Path, value: str | Path) -> Path:
+    path = Path(value).expanduser()
+    return path if path.is_absolute() else project / path
+
+
+def write(path: Path, payload: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(payload, indent=2, ensure_ascii=False) + "\n", encoding="utf-8")
+
+
+def check_argv(argv: object, label: str) -> list[str]:
+    if not isinstance(argv, list) or not argv or not all(isinstance(item, str) and item for item in argv):
+        raise ValueError(f"{label} command must be a non-empty argv list (no shell string)")
+    if any(SECRET_ARG.search(item) for item in argv):
+        raise ValueError(f"{label} command contains a literal credential; use host configuration or SSH keys")
+    return argv
+
+
+def http_status(url: str, timeout: float) -> int | None:
+    request = urllib.request.Request(url, headers={"User-Agent": "maggie-deployment-collect/1.0"}, method="GET")
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            return response.status
+    except urllib.error.HTTPError as error:
+        return error.code
+    except (urllib.error.URLError, OSError):
+        return None
+
+
+def collect_health(config: dict, timeout: float) -> dict:
+    urls = config.get("urls")
+    if not isinstance(urls, list) or not urls:
+        raise ValueError("health adapter needs a non-empty urls list")
+    expect = config.get("expectStatus", [200])
+    checks = []
+    for url in urls:
+        parsed = urlparse(str(url))
+        if parsed.scheme not in {"http", "https"} or parsed.query:
+            raise ValueError("health URLs must be http(s) without query strings")
+        status = http_status(str(url), timeout)
+        checks.append({"url": f"{parsed.scheme}://{parsed.netloc}{parsed.path or '/'}", "status": status, "passed": status in expect})
+    return {"schemaVersion": "maggie-deployment-health.v1", "generatedAt": now(), "checks": checks, "passed": all(item["passed"] for item in checks)}
+
+
+def collect_release_identity(config: dict, release: str, timeout: float) -> tuple[dict, dict]:
+    run: dict[str, Any] = {}
+    observed = ""
+    if config.get("command"):
+        argv = check_argv(config["command"], "releaseIdentity")
+        completed = subprocess.run(argv, capture_output=True, text=True, timeout=timeout, check=False)
+        run = {"argv": argv, "exitCode": completed.returncode}
+        raw = completed.stdout.strip().splitlines()[-1].strip() if completed.returncode == 0 and completed.stdout.strip() else ""
+        # A `readlink -f <current>` path resolves to .../releases/<release-id>.
+        observed = raw.rstrip("/").rsplit("/", 1)[-1] if raw else ""
+    elif config.get("url"):
+        url = str(config["url"])
+        field = str(config.get("field") or "release")
+        request = urllib.request.Request(url, headers={"User-Agent": "maggie-deployment-collect/1.0", "Accept": "application/json"})
+        try:
+            with urllib.request.urlopen(request, timeout=timeout) as response:
+                payload = json.loads(response.read(200_000).decode("utf-8"))
+            observed = str(payload.get(field, "")) if isinstance(payload, dict) else ""
+            run = {"url": url, "field": field}
+        except (urllib.error.URLError, OSError, ValueError) as error:
+            run = {"url": url, "field": field, "error": type(error).__name__}
+    else:
+        raise ValueError("releaseIdentity adapter needs command (argv) or url")
+    if observed and not RELEASE_ID.fullmatch(observed):
+        observed = "<unrecognized>"
+    evidence = {"schemaVersion": "maggie-release-identity.v1", "generatedAt": now(), "expected": release, "observed": observed, "passed": bool(observed) and observed == release}
+    return evidence, run
+
+
+def collect_rollback(project: Path, config: dict) -> dict:
+    deployment = load_module("maggie_deployment")
+    evidence_path = resolve(project, config.get("evidence", "docs/deployment-rollback-smoke.json"))
+    keep = None
+    if config.get("plan"):
+        plan = json.loads(resolve(project, config["plan"]).read_text(encoding="utf-8"))
+        keep = (plan.get("retention") or {}).get("keep")
+    try:
+        result = deployment.validate_rollback_evidence(json.loads(evidence_path.read_text(encoding="utf-8")), keep)
+    except (OSError, json.JSONDecodeError) as error:
+        result = {"passed": False, "errors": [f"rollback evidence unavailable: {type(error).__name__}"]}
+    return {"schemaVersion": "maggie-deployment-rollback-check.v1", "generatedAt": now(), "retentionKeep": keep, "rollbackAvailable": None if keep is None else keep >= 2, "passed": result["passed"], "errors": result["errors"]}
+
+
+def collect_canary(project: Path, config: dict, destination: Path, timeout: float) -> dict:
+    argv = [sys.executable, str(HERE / "maggie_deployment_canary.py"), "--project", str(project), "--output", str(destination)]
+    for asset in config.get("assets", []):
+        argv += ["--asset", str(asset)]
+    if config.get("renderReport"):
+        argv += ["--render-report", str(resolve(project, config["renderReport"]))]
+    completed = subprocess.run(argv, capture_output=True, text=True, timeout=timeout, check=False)
+    return {"adapter": "maggie_deployment_canary.py", "exitCode": completed.returncode}
+
+
+def collect(project: Path, config: dict, evidence_dir: Path, timeout: float = 60.0) -> dict:
+    if config.get("schemaVersion") != CONFIG_SCHEMA:
+        raise ValueError(f"collector config schemaVersion must be {CONFIG_SCHEMA}")
+    release = str(config.get("release") or "")
+    if not RELEASE_ID.fullmatch(release):
+        raise ValueError("collector config needs the expected release id")
+    adapters = config.get("adapters") or {}
+    unknown = set(adapters) - {"canary", "health", "rollback", "releaseIdentity", "authCanary"}
+    if unknown:
+        raise ValueError("unsupported adapters: " + ", ".join(sorted(unknown)))
+    readiness = load_module("maggie_deployment_readiness")
+    paths = {name: resolve(project, (config.get("evidence") or {}).get(name, default)) for name, default in STANDARD_EVIDENCE.items()}
+    runs: dict[str, Any] = {}
+    canary_path = evidence_dir / "rendered-canary.json"
+    if "canary" in adapters:
+        runs["canary"] = collect_canary(project, adapters["canary"], canary_path, timeout)
+        paths["renderedCanary"] = canary_path
+    else:
+        paths["renderedCanary"] = resolve(project, (config.get("evidence") or {}).get("renderedCanary", ".maggie/deployment-canary.json"))
+    if "health" in adapters:
+        write(evidence_dir / "host-health.json", collect_health(adapters["health"], timeout))
+        paths["hostHealth"] = evidence_dir / "host-health.json"
+        runs["health"] = {"urls": len(adapters["health"].get("urls", []))}
+    if "rollback" in adapters:
+        write(evidence_dir / "rollback-check.json", collect_rollback(project, adapters["rollback"]))
+        paths["rollbackEvidence"] = evidence_dir / "rollback-check.json"
+        runs["rollback"] = {"validator": "validate_rollback_evidence"}
+    if "releaseIdentity" in adapters:
+        evidence, run = collect_release_identity(adapters["releaseIdentity"], release, timeout)
+        write(evidence_dir / "release-identity.json", evidence)
+        paths["releaseIdentity"] = evidence_dir / "release-identity.json"
+        runs["releaseIdentity"] = run
+    if "authCanary" in adapters:
+        auth = load_module("maggie_deployment_auth_canary")
+        spec = adapters["authCanary"]
+        plan = json.loads(resolve(project, spec["plan"]).read_text(encoding="utf-8"))
+        write(evidence_dir / "auth-canary.json", auth.auth_canary(plan, bool(spec.get("allowMutations")), timeout))
+        paths["authenticatedCanary"] = evidence_dir / "auth-canary.json"
+        runs["authCanary"] = {"plan": str(spec["plan"]), "allowMutations": bool(spec.get("allowMutations"))}
+    report = readiness.readiness_report(project, paths)
+    canonical = json.dumps(config, sort_keys=True, ensure_ascii=False).encode("utf-8")
+    report["collector"] = {
+        "schemaVersion": CONFIG_SCHEMA,
+        "configSha256": hashlib.sha256(canonical).hexdigest(),
+        "release": release,
+        "evidenceDir": readiness.display_path(evidence_dir, project),
+        "adapters": runs,
+        "mutation": "not executed",
+    }
+    return report
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--project", type=Path, default=Path.cwd())
+    parser.add_argument("--config", type=Path, default=Path(".maggie/deployment/collector.json"), help=f"{CONFIG_SCHEMA} config")
+    parser.add_argument("--evidence-dir", type=Path, default=Path(".maggie/deployment/collected"))
+    parser.add_argument("--timeout", type=float, default=60.0)
+    parser.add_argument("--output", type=Path, help="readiness report path (default: <evidence-dir>/readiness.json)")
+    args = parser.parse_args()
+    project = args.project.resolve()
+    evidence_dir = resolve(project, args.evidence_dir)
+    try:
+        config = json.loads(resolve(project, args.config).read_text(encoding="utf-8"))
+        report = collect(project, config, evidence_dir, args.timeout)
+    except (OSError, ValueError, KeyError, subprocess.SubprocessError) as error:
+        print(f"BLOCKED: maggie deployment collect: {error}", file=sys.stderr)
+        return 2
+    write(resolve(project, args.output) if args.output else evidence_dir / "readiness.json", report)
+    print(json.dumps(report, indent=2, ensure_ascii=False))
+    return 0 if report["status"] == "passed" else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/bundled-tools/clis/maggie_deployment_readiness.py

@@ -92,6 +92,39 @@ def validate_runtime_parity(payload: dict[str, Any]) -> tuple[bool, str]:
     return True, "worker/browser runtime parity passed"
 
 
+def validate_host_health(payload: dict[str, Any]) -> tuple[bool, str]:
+    if payload.get("schemaVersion") != "maggie-deployment-health.v1":
+        return False, "host health evidence schemaVersion is unsupported"
+    checks = payload.get("checks")
+    if payload.get("passed") is not True or not isinstance(checks, list) or not checks:
+        return False, "host health evidence must contain passing checks"
+    return True, "host health checks passed"
+
+
+def validate_release_identity(payload: dict[str, Any]) -> tuple[bool, str]:
+    if payload.get("schemaVersion") != "maggie-release-identity.v1":
+        return False, "release identity evidence schemaVersion is unsupported"
+    if payload.get("passed") is not True or not payload.get("expected") or payload.get("observed") != payload.get("expected"):
+        return False, "remote release identity does not match the expected release"
+    return True, "remote release identity matches"
+
+
+def validate_rollback_check(payload: dict[str, Any]) -> tuple[bool, str]:
+    if payload.get("schemaVersion") != "maggie-deployment-rollback-check.v1":
+        return False, "rollback check schemaVersion is unsupported"
+    if payload.get("passed") is not True:
+        return False, "rollback evidence is inconsistent with the retention policy or not passed"
+    return True, "rollback evidence is consistent with the retention policy"
+
+
+def validate_auth_canary(payload: dict[str, Any]) -> tuple[bool, str]:
+    if payload.get("schemaVersion") != "maggie-deployment-auth-canary.v1":
+        return False, "authenticated canary schemaVersion is unsupported"
+    if payload.get("status") != "passed" or payload.get("passed") is not True:
+        return False, "authenticated API canary did not pass"
+    return True, "authenticated API canary passed"
+
+
 VALIDATORS: dict[str, Callable[[dict[str, Any]], tuple[bool, str]]] = {
     "unitRegression": validate_unit,
     "packageSmoke": validate_package,
@@ -99,7 +132,12 @@ VALIDATORS: dict[str, Callable[[dict[str, Any]], tuple[bool, str]]] = {
     "renderedCanary": validate_canary,
     "deploymentPreflight": validate_preflight,
     "runtimeParity": validate_runtime_parity,
+    "hostHealth": validate_host_health,
+    "releaseIdentity": validate_release_identity,
+    "rollbackEvidence": validate_rollback_check,
+    "authenticatedCanary": validate_auth_canary,
 }
+OPTIONAL_CHECKS = ("runtimeParity", "hostHealth", "releaseIdentity", "rollbackEvidence", "authenticatedCanary")
 
 
 def inspect_check(name: str, path: Path, project: Path) -> dict[str, Any]:
@@ -120,7 +158,7 @@ def inspect_check(name: str, path: Path, project: Path) -> dict[str, Any]:
     return result
 
 
-def readiness(project: Path, paths: dict[str, Path], output: Path | None = None) -> int:
+def readiness_report(project: Path, paths: dict[str, Path]) -> dict[str, Any]:
     checks = {name: inspect_check(name, path, project) for name, path in paths.items()}
     states = {item["state"] for item in checks.values()}
     status = "failed" if "failed" in states else "inconclusive" if "inconclusive" in states else "passed"
@@ -132,6 +170,12 @@ def readiness(project: Path, paths: dict[str, Path], output: Path | None = None)
         "checks": checks,
         "nextAction": "resolve failed evidence before release" if status == "failed" else "collect the missing host adapter evidence" if status == "inconclusive" else "all declared readiness evidence passed",
     }
+    return report
+
+
+def readiness(project: Path, paths: dict[str, Path], output: Path | None = None) -> int:
+    report = readiness_report(project, paths)
+    status = report["status"]
     if output:
         destination = output if output.is_absolute() else project / output
         destination.parent.mkdir(parents=True, exist_ok=True)
@@ -150,6 +194,10 @@ def main() -> int:
     parser.add_argument("--rendered-canary", type=Path, default=Path(".maggie/deployment-canary.json"))
     parser.add_argument("--deployment-preflight", type=Path, default=Path(".maggie/release-preflight.json"))
     parser.add_argument("--runtime-parity", type=Path, help="validated worker/browser parity report from maggie deployment parity")
+    parser.add_argument("--host-health", type=Path, help="maggie-deployment-health.v1 evidence (e.g. from maggie deployment collect)")
+    parser.add_argument("--release-identity", type=Path, help="maggie-release-identity.v1 evidence")
+    parser.add_argument("--rollback-check", type=Path, help="maggie-deployment-rollback-check.v1 evidence")
+    parser.add_argument("--auth-canary", type=Path, help="maggie-deployment-auth-canary.v1 evidence")
     parser.add_argument("--output", type=Path)
     args = parser.parse_args()
     project = args.project.resolve()
@@ -159,8 +207,10 @@ def main() -> int:
         name: (getattr(args, option).resolve() if getattr(args, option).is_absolute() else project / getattr(args, option))
         for name, option in CHECKS
     }
-    if args.runtime_parity:
-        paths["runtimeParity"] = args.runtime_parity.resolve() if args.runtime_parity.is_absolute() else project / args.runtime_parity
+    for name, option in (("runtimeParity", "runtime_parity"), ("hostHealth", "host_health"), ("releaseIdentity", "release_identity"), ("rollbackEvidence", "rollback_check"), ("authenticatedCanary", "auth_canary")):
+        value = getattr(args, option)
+        if value:
+            paths[name] = value.resolve() if value.is_absolute() else project / value
     try:
         return readiness(project, paths, args.output)
     except (OSError, ValueError) as error:

package/bundled-tools/clis/maggie_design.py

@@ -857,12 +857,20 @@ commands:
   pressable-check flag pressables/buttons nested in another pressable (JSX/TSX)
   layer-check  flag unlayered CSS that overrides Tailwind v4 utilities
   palette      generate or validate a semantic palette role contract
+  verify       run automatable design-job steps and record evidence
+  icon-glyph-check render icons and prove font load and glyph paint
   reference-ui, init, validate-ui, app-init, app-validate, rebrand, review
 """)
         return 0
     if len(sys.argv) > 1 and sys.argv[1] in {"pressable-check", "layer-check"}:
         from maggie_design_lint import main as lint_main
         return lint_main(sys.argv[1:])
+    if len(sys.argv) > 1 and sys.argv[1] == "verify":
+        from maggie_design_verify import main as verify_main
+        return verify_main(sys.argv[2:])
+    if len(sys.argv) > 1 and sys.argv[1] == "icon-glyph-check":
+        from maggie_icon_glyph_check import main as glyph_main
+        return glyph_main(sys.argv[2:])
     if len(sys.argv) > 1 and sys.argv[1] == "palette":
         from maggie_palette import main as palette_main
         return palette_main(sys.argv[2:])