fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/foundation_progress.py

@@ -0,0 +1,231 @@
+"""Adapt known Genesis presentation records without deriving execution authority."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Callable
+from dataclasses import dataclass
+
+CHECKPOINT_LABELS = (
+    "Toolchain prerequisites",
+    "Azure target verification",
+    "Source and required CI",
+    "Azure resource providers",
+    "Tenant policy route",
+    "Deployment route selection",
+    "Runner image exact plan",
+    "Runner image exact apply",
+    "Foundation exact plan",
+    "Foundation exact apply",
+    "Runner enrollment and attestation",
+    "Foundation private state handoff",
+    "Protected application exact plan",
+    "Protected application exact apply",
+    "Post-deployment verification",
+)
+_TOTAL = len(CHECKPOINT_LABELS)
+_MAX_LINE = 512
+_CHUNK_SIZE = 4096
+_LEGACY_RECORD = re.compile(
+    r"\[([#.]{24})\] +([0-9]{1,3})%  done ([0-9]{1,2})/15 \| "
+    r"stage ([0-9]{1,2})/15 ([^\r\n]{1,80}) - "
+    r"(RUNNING|WAITING|BLOCKED|FAILED|COMPLETE) \| "
+    r"skipped ([0-9]{1,2}) \| remaining ([0-9]{1,2})"
+)
+_INSTALLER_RECORD = re.compile(
+    r"(==>|WAIT| OK |HOLD|FAIL) \[([0-9]{2})/15\] ([^|\r\n]{1,80}) \| "
+    r"(RUNNING|WAITING|BLOCKED|FAILED|COMPLETE) \| "
+    r"([0-9]{1,2}) complete \| ([0-9]{1,2}) skipped \| ([0-9]{1,2}) remaining"
+)
+_STATE_PREFIXES = {
+    "RUNNING": "==>",
+    "WAITING": "WAIT",
+    "COMPLETE": " OK ",
+    "BLOCKED": "HOLD",
+    "FAILED": "FAIL",
+}
+_HEARTBEAT = re.compile(r" {4}\.\. still running \| elapsed (?:[0-9]{2}:){1,2}[0-9]{2}")
+
+
+@dataclass(frozen=True)
+class FoundationCheckpoint:
+    """A checked display record, never a status receipt or approval."""
+
+    number: int
+    label: str
+    state: str
+    completed: int
+    skipped: int
+    total: int = _TOTAL
+
+
+def _prefix(completed: int) -> str:
+    filled = 24 * completed // _TOTAL
+    return (
+        f"[{'#' * filled}{'.' * (24 - filled)}] {completed * 100 // _TOTAL:3d}%  "
+        f"done {completed}/{_TOTAL} | stage "
+    )
+
+
+_PREFIXES = (
+    *(_prefix(count) for count in range(_TOTAL + 1)),
+    "==> ",
+    "WAIT ",
+    " OK  ",
+    "HOLD ",
+    "FAIL ",
+    "    .. still running | elapsed ",
+)
+
+
+def parse_checkpoint(line: str) -> FoundationCheckpoint | None:
+    """Accept only current or legacy producer labels, arithmetic, and field layout."""
+
+    if (match := _INSTALLER_RECORD.fullmatch(line)) is not None:
+        marker, number, label, state, count, skipped, remaining = match.groups()
+        completed, index, omitted = int(count), int(number), int(skipped)
+        if (
+            _STATE_PREFIXES[state] != marker
+            or not 0 <= omitted <= completed <= _TOTAL
+            or not 1 <= index <= _TOTAL
+            or label != CHECKPOINT_LABELS[index - 1]
+            or int(remaining) != _TOTAL - completed
+        ):
+            return None
+        expected = (
+            f"{marker} [{index:02d}/{_TOTAL}] {label} | {state} | "
+            f"{completed} complete | {omitted} skipped | {_TOTAL - completed} remaining"
+        )
+        if line != expected:
+            return None
+        return FoundationCheckpoint(index, label, state, completed, omitted)
+    match = _LEGACY_RECORD.fullmatch(line)
+    if match is None:
+        return None
+    _bar, _percent, count, number, label, state, skipped, remaining = match.groups()
+    completed, index, omitted = int(count), int(number), int(skipped)
+    if (
+        not 0 <= omitted <= completed <= _TOTAL
+        or not 1 <= index <= _TOTAL
+        or label != CHECKPOINT_LABELS[index - 1]
+        or int(remaining) != _TOTAL - completed
+    ):
+        return None
+    expected = (
+        f"{_prefix(completed)}{index}/{_TOTAL} {label} - {state} | "
+        f"skipped {omitted} | remaining {_TOTAL - completed}"
+    )
+    if line != expected:
+        return None
+    return FoundationCheckpoint(index, label, state, completed, omitted)
+
+
+def _intro(mode: str) -> str:
+    return (
+        f"FDAI Azure Genesis\nMode: {mode}; prompts: none\nProcedure:\n"
+        + "".join(f"  {index}. {label}\n" for index, label in enumerate(CHECKPOINT_LABELS, 1))
+        + "Routes: public-dev -> preview and exact-plan wait; "
+        "private-runner -> image, Foundation, enrollment, and state checkpoints\n"
+        "Safety: no route fallback, unsealed apply, or readiness claim\n"
+    )
+
+
+_INTROS = tuple(
+    (mode, _intro(mode)) for mode in ("mutation-enabled preflight", "read-only inspection")
+)
+
+
+class FoundationProgressStream:
+    """Compact known renderer output; pass all other text through without waiting for EOF.
+
+    The compatibility adapter activates only after the complete fixed Genesis introduction.
+    Unknown versions and malformed records remain native diagnostics. No record advances the
+    coordinator state machine, writes status, or grants approval.
+    """
+
+    def __init__(
+        self,
+        *,
+        output: Callable[[str], None],
+        checkpoint: Callable[[FoundationCheckpoint], None],
+        heartbeat: Callable[[], None],
+        mode: Callable[[str], None],
+    ) -> None:
+        self._output = output
+        self._checkpoint = checkpoint
+        self._heartbeat = heartbeat
+        self._mode = mode
+        self._intro_buffer = ""
+        self._pending = ""
+        self._started = False
+        self._native_only = False
+        self._native_line = False
+
+    def feed(self, text: str) -> None:
+        """Consume bounded pieces, promptly forwarding an unknown unterminated diagnostic."""
+        for offset in range(0, len(text), _CHUNK_SIZE):
+            self._feed(text[offset : offset + _CHUNK_SIZE])
+
+    def _feed(self, text: str) -> None:
+        if self._native_only:
+            self._output(text)
+            return
+        if not self._started:
+            self._intro_buffer += text
+            for mode, introduction in _INTROS:
+                if self._intro_buffer.startswith(introduction):
+                    text = self._intro_buffer[len(introduction) :]
+                    self._intro_buffer = ""
+                    self._started = True
+                    self._mode(mode)
+                    break
+            else:
+                if any(introduction.startswith(self._intro_buffer) for _, introduction in _INTROS):
+                    return
+                self._native_only = True
+                self._output(self._intro_buffer)
+                self._intro_buffer = ""
+                return
+        self._body(text)
+
+    def _body(self, text: str) -> None:
+        while text:
+            part, newline, text = text.partition("\n")
+            if self._native_line:
+                self._output(part + newline)
+                self._native_line = not bool(newline)
+                continue
+            self._pending += part
+            if newline:
+                line, self._pending = self._pending, ""
+                candidate = line.lstrip(".")
+                if (not candidate and line) or _HEARTBEAT.fullmatch(line):
+                    self._heartbeat()
+                elif (record := parse_checkpoint(candidate)) is not None:
+                    self._checkpoint(record)
+                else:
+                    self._output(line + newline)
+                continue
+            candidate = self._pending.lstrip(".")
+            possible = not candidate or any(
+                prefix.startswith(candidate) or candidate.startswith(prefix) for prefix in _PREFIXES
+            )
+            if possible and len(self._pending) <= _MAX_LINE:
+                if not candidate and self._pending:
+                    self._heartbeat()
+                return
+            self._output(self._pending)
+            self._pending = ""
+            self._native_line = True
+
+    def finish(self) -> None:
+        """Preserve incomplete records; heartbeat dots alone never imply completion."""
+        if self._intro_buffer:
+            self._output(self._intro_buffer)
+            self._intro_buffer = ""
+        if self._pending:
+            if self._pending.strip("."):
+                self._output(self._pending)
+            else:
+                self._heartbeat()
+            self._pending = ""

fdai_deployment_cli/github_actions.py

@@ -0,0 +1,171 @@
+"""Bounded GitHub Actions transport for protected FDAI deployment workflows."""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime
+
+from fdai_deployment_cli.github_transport import _artifact_runner, run_github_cli
+from fdai_deployment_cli.github_workflow_values import (
+    _COMMIT,
+    _DIGEST,
+    _REQUEST_ID,
+    CommandResult,
+    CommandRunner,
+    DeploymentSelection,
+    WorkflowDispatch,
+    _request_binding_from_id,
+    _validate_repository,
+    deployment_context_digest,
+    enforce_plan_not_expired,
+    parse_plan_expiry,
+    request_binding_prefix,
+    request_id,
+)
+from fdai_deployment_cli.github_dispatch import dispatch_apply, dispatch_plan
+from fdai_deployment_cli.github_plan_artifact import _download_plan_metadata
+from fdai_deployment_cli.github_apply_artifact import _download_apply_receipt
+from fdai_deployment_cli.github_artifact_io import (
+    _json_array,
+)
+
+
+# Artifact downloads are larger than metadata queries; use a longer timeout.
+
+
+def workflow_status(
+    *,
+    repository: str,
+    request_id_value: str,
+    expected_commit: str,
+    expected_context_digest: str,
+    target_binding: str,
+    expected_region: str,
+    resume_verification: bool = False,
+    expected_plan_id: str | None = None,
+    expected_plan_digest: str | None = None,
+    run: CommandRunner | None = None,
+) -> dict[str, object]:
+    """Read one uniquely matched workflow run without polling."""
+
+    _validate_repository(repository)
+    if _REQUEST_ID.fullmatch(request_id_value) is None:
+        raise ValueError("request_id is invalid")
+    if _COMMIT.fullmatch(expected_commit) is None:
+        raise ValueError("expected_commit MUST be a lowercase git SHA")
+    if _DIGEST.fullmatch(expected_context_digest) is None:
+        raise ValueError("expected_context_digest MUST be a lowercase SHA-256")
+    request_mode = (
+        "plan"
+        if request_id_value.startswith("plan-")
+        else ("resume" if resume_verification else "apply")
+    )
+    expected_binding = request_binding_prefix(
+        target_binding=target_binding,
+        context_digest=expected_context_digest,
+        mode=request_mode,
+        region=expected_region,
+    )
+    if _request_binding_from_id(request_id_value) != expected_binding:
+        raise ValueError("request_id does not match the approved deployment context")
+    runner = run or run_github_cli
+    result = runner(
+        (
+            "run",
+            "list",
+            "--repo",
+            repository,
+            "--workflow",
+            "deploy-dev.yml",
+            "--event",
+            "workflow_dispatch",
+            "--limit",
+            "50",
+            "--json",
+            "databaseId,displayTitle,status,conclusion,url,headSha",
+        )
+    )
+    if result.returncode != 0:
+        raise ValueError("github_workflow_status_unavailable")
+    payload = _json_array(result.stdout, "workflow runs")
+    expected_title = f"deploy-{request_id_value}"
+    matches = [item for item in payload if item.get("displayTitle") == expected_title]
+    if not matches:
+        raise ValueError("github_workflow_run_not_found")
+    if len(matches) != 1:
+        raise ValueError("github_workflow_run_ambiguous")
+    selected = matches[0]
+    database_id = selected.get("databaseId")
+    status = selected.get("status")
+    conclusion = selected.get("conclusion")
+    head_sha = selected.get("headSha")
+    if (
+        not isinstance(database_id, int)
+        or not isinstance(status, str)
+        or (conclusion is not None and not isinstance(conclusion, str))
+        or not isinstance(head_sha, str)
+        or _COMMIT.fullmatch(head_sha) is None
+    ):
+        raise ValueError("github_workflow_run_invalid")
+    projected: dict[str, object] = {
+        "schema_version": "fdai.workflow-status.v1",
+        "request_id": request_id_value,
+        "workflow_run_id": database_id,
+        "status": status,
+        "conclusion": conclusion,
+        "dispatch_ref_sha": head_sha,
+        "requested_commit": expected_commit,
+        "url": selected.get("url") if isinstance(selected.get("url"), str) else None,
+        "mutation_performed": False,
+    }
+    if request_id_value.startswith("plan-") and status == "completed" and conclusion == "success":
+        plan_meta = _download_plan_metadata(
+            repository=repository,
+            workflow_run_id=database_id,
+            request_id_value=request_id_value,
+            expected_commit=expected_commit,
+            expected_context_digest=expected_context_digest,
+            run=_artifact_runner(runner),
+        )
+        # Expose expired as read-only status without blocking the status query.
+        expires_at = plan_meta.get("expires_at")
+        if isinstance(expires_at, str):
+            try:
+                deadline = parse_plan_expiry(expires_at)
+                plan_meta["expired"] = datetime.now(UTC) >= deadline
+            except ValueError:
+                plan_meta["expired"] = True  # Fail-closed on unparseable expiry.
+        projected["plan"] = plan_meta
+    elif (
+        status == "completed"
+        and conclusion == "success"
+        and (expected_plan_id is not None or expected_plan_digest is not None)
+    ):
+        if expected_plan_id is None or expected_plan_digest is None:
+            raise ValueError("apply status requires plan id and digest together")
+        projected["apply_receipt"] = _download_apply_receipt(
+            repository=repository,
+            workflow_run_id=database_id,
+            request_id_value=request_id_value,
+            expected_commit=expected_commit,
+            expected_context_digest=expected_context_digest,
+            expected_plan_id=expected_plan_id,
+            expected_plan_digest=expected_plan_digest,
+            run=_artifact_runner(runner),
+        )
+    return projected
+
+
+__all__ = [
+    "CommandResult",
+    "DeploymentSelection",
+    "WorkflowDispatch",
+    "deployment_context_digest",
+    "dispatch_apply",
+    "dispatch_plan",
+    "enforce_plan_not_expired",
+    "parse_plan_expiry",
+    "request_binding_prefix",
+    "request_id",
+    "run_github_cli",
+    "workflow_status",
+]

fdai_deployment_cli/github_apply_artifact.py

@@ -0,0 +1,259 @@
+"""Protected apply receipt download and observation validation."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import tempfile
+from collections.abc import Mapping
+from pathlib import Path
+
+from fdai_deployment_cli.contracts import canonical_digest
+from fdai_deployment_cli.github_artifact_io import (
+    _json_object,
+    _private_artifact_bytes,
+    _private_artifact_json,
+)
+from fdai_deployment_cli.github_provider_artifact import (
+    _validate_provider_schema_core_baseline,
+    _validate_provider_schema_evidence,
+)
+from fdai_deployment_cli.github_workflow_values import (
+    _COMMIT,
+    _DIGEST,
+    _OCI_DIGEST,
+    _PLAN_ID,
+    CommandRunner,
+)
+
+
+def _download_apply_receipt(
+    *,
+    repository: str,
+    workflow_run_id: int,
+    request_id_value: str,
+    expected_commit: str,
+    expected_context_digest: str,
+    expected_plan_id: str,
+    expected_plan_digest: str,
+    run: CommandRunner,
+) -> dict[str, object]:
+    """Download and validate one application receipt and its profile observation."""
+
+    if (
+        _PLAN_ID.fullmatch(expected_plan_id) is None
+        or _DIGEST.fullmatch(expected_plan_digest) is None
+    ):
+        raise ValueError("expected apply plan identity is invalid")
+    with tempfile.TemporaryDirectory(prefix="fdai-apply-status-") as raw_directory:
+        directory = Path(raw_directory)
+        result = run(
+            (
+                "run",
+                "download",
+                str(workflow_run_id),
+                "--repo",
+                repository,
+                "--name",
+                f"deployment-apply-receipt-{expected_plan_id}",
+                "--dir",
+                str(directory),
+            )
+        )
+        if result.returncode != 0:
+            raise ValueError("github_apply_receipt_unavailable")
+        receipt = _private_artifact_json(directory / "apply-receipt.json", "apply receipt")
+        provider_schema = request_id_value.startswith("apply-provider-")
+        cost_governance = request_id_value.startswith("apply-cost-")
+        if provider_schema:
+            provider_evidence_bytes = _private_artifact_bytes(
+                directory / "provider-schema-deployment-evidence.json",
+                "provider-schema deployment evidence",
+            )
+            provider_evidence = dict(
+                _json_object(
+                    provider_evidence_bytes.decode("utf-8"),
+                    "provider-schema deployment evidence",
+                )
+            )
+            provider_baseline_bytes = _private_artifact_bytes(
+                directory / "provider-schema-core-baseline.json",
+                "provider-schema Core baseline",
+            )
+            provider_baseline = dict(
+                _json_object(
+                    provider_baseline_bytes.decode("utf-8"),
+                    "provider-schema Core baseline",
+                )
+            )
+            observation_bytes = b""
+            observation: dict[str, object] = {}
+        else:
+            observation_path = directory / (
+                "cost-governance-job-image-readback.json"
+                if cost_governance
+                else "initial-inventory-receipt.json"
+            )
+            observation_label = (
+                "Cost Governance Job image readback"
+                if cost_governance
+                else "initial inventory execution receipt"
+            )
+            observation_bytes = _private_artifact_bytes(observation_path, observation_label)
+            observation = dict(_json_object(observation_bytes.decode("utf-8"), observation_label))
+    expected = {
+        "schema_version": "fdai.deployment-apply-receipt.v1",
+        "plan_id": expected_plan_id,
+        "plan_digest": expected_plan_digest,
+        "request_id": request_id_value,
+        "context_digest": expected_context_digest,
+        "source_commit": expected_commit,
+        "status": "applied",
+        "terraform_zero_change_verified": True,
+        "subscription_ready": False,
+    }
+    if provider_schema:
+        expected.update(
+            {
+                "terraform_zero_change_verified": True,
+                "provider_schema_runtime_image_profile": (
+                    "cost-governance"
+                    if request_id_value.startswith("apply-provider-cost-")
+                    else "core-control-plane"
+                ),
+            }
+        )
+    elif cost_governance:
+        expected["cost_governance_job_images_verified"] = True
+    else:
+        expected.update(
+            {
+                "migration_stage_verified": True,
+                "runtime_health_verified": True,
+                "canary_verified": True,
+            }
+        )
+    receipt_digest = receipt.get("receipt_digest")
+    receipt_body = {key: item for key, item in receipt.items() if key != "receipt_digest"}
+    if any(receipt.get(key) != item for key, item in expected.items()):
+        raise ValueError("github_apply_receipt_context_mismatch")
+    if (
+        not isinstance(receipt_digest, str)
+        or _DIGEST.fullmatch(receipt_digest) is None
+        or canonical_digest(receipt_body) != receipt_digest
+    ):
+        raise ValueError("github_apply_receipt_digest_invalid")
+    if provider_schema:
+        runtime_revision = receipt.get("provider_schema_runtime_image_revision")
+        runtime_digest = receipt.get("provider_schema_runtime_image_digest")
+        if (
+            not isinstance(runtime_revision, str)
+            or _COMMIT.fullmatch(runtime_revision) is None
+            or not isinstance(runtime_digest, str)
+            or _OCI_DIGEST.fullmatch(runtime_digest) is None
+            or receipt.get("provider_schema_core_baseline_digest")
+            != hashlib.sha256(provider_baseline_bytes).hexdigest()
+            or receipt.get("provider_schema_deployment_evidence_digest")
+            != hashlib.sha256(provider_evidence_bytes).hexdigest()
+        ):
+            raise ValueError("github_provider_schema_receipt_invalid")
+        _validate_provider_schema_core_baseline(
+            provider_baseline,
+            expected_source_revision=runtime_revision,
+            expected_image_digest=runtime_digest,
+        )
+        provider_summary = _validate_provider_schema_evidence(
+            provider_evidence,
+            expected_application_source=expected_commit,
+            expected_runtime_revision=runtime_revision,
+            expected_plan_id=expected_plan_id,
+        )
+        return {
+            **expected,
+            "provider_schema_runtime_image_revision": runtime_revision,
+            "provider_schema_runtime_image_digest": runtime_digest,
+            "provider_schema_core_baseline_digest": hashlib.sha256(
+                provider_baseline_bytes
+            ).hexdigest(),
+            "provider_schema_deployment_evidence_digest": hashlib.sha256(
+                provider_evidence_bytes
+            ).hexdigest(),
+            "provider_schema": provider_summary,
+        }
+    observation_digest = hashlib.sha256(observation_bytes).hexdigest()
+    if cost_governance:
+        image_digest = receipt.get("cost_governance_image_digest")
+        if (
+            receipt.get("cost_governance_job_image_readback_digest") != observation_digest
+            or not isinstance(image_digest, str)
+            or _OCI_DIGEST.fullmatch(image_digest) is None
+        ):
+            raise ValueError("github_cost_governance_readback_invalid")
+        _validate_cost_governance_readback(observation, expected_digest=image_digest)
+        return {
+            **expected,
+            "cost_governance_image_digest": image_digest,
+            "cost_governance_job_image_readback_digest": observation_digest,
+        }
+    inventory_receipt_digest = observation.get("receipt_digest")
+    inventory_body = {key: item for key, item in observation.items() if key != "receipt_digest"}
+    if (
+        receipt.get("initial_inventory_execution_receipt_digest") != observation_digest
+        or observation.get("schema_version")
+        != "fdai.genesis-initial-inventory-execution-receipt.v1"
+        or observation.get("source_commit") != expected_commit
+        or observation.get("status") != "succeeded"
+        or observation.get("active_generation_verified") is not False
+        or observation.get("subscription_ready") is not False
+        or not isinstance(inventory_receipt_digest, str)
+        or _DIGEST.fullmatch(inventory_receipt_digest) is None
+        or hashlib.sha256(
+            json.dumps(inventory_body, sort_keys=True, separators=(",", ":")).encode()
+        ).hexdigest()
+        != inventory_receipt_digest
+    ):
+        raise ValueError("github_initial_inventory_receipt_invalid")
+    return {
+        "plan_id": expected_plan_id,
+        "plan_digest": expected_plan_digest,
+        "request_id": request_id_value,
+        "context_digest": expected_context_digest,
+        "source_commit": expected_commit,
+        "status": "applied",
+        "terraform_zero_change_verified": True,
+        "migration_stage_verified": True,
+        "runtime_health_verified": True,
+        "canary_verified": True,
+        "initial_inventory_execution_receipt_digest": observation_digest,
+        "subscription_ready": False,
+    }
+
+
+def _validate_cost_governance_readback(
+    value: Mapping[str, object],
+    *,
+    expected_digest: str,
+) -> None:
+    """Reject incomplete or mismatched Cost Governance Job observations."""
+    if (
+        set(value) != {"schema_version", "image_digest", "jobs"}
+        or value.get("schema_version") != "fdai.cost-governance-job-image-readback.v1"
+        or value.get("image_digest") != expected_digest
+    ):
+        raise ValueError("github_cost_governance_readback_invalid")
+    jobs = value.get("jobs")
+    expected_containers = {
+        "analyzer": "cost-governance-analyzer",
+        "collector": "cost-governance-collector",
+    }
+    if not isinstance(jobs, dict) or set(jobs) != set(expected_containers):
+        raise ValueError("github_cost_governance_readback_invalid")
+    for role, container in expected_containers.items():
+        job = jobs[role]
+        if (
+            not isinstance(job, dict)
+            or set(job) != {"container", "image_digest"}
+            or job.get("container") != container
+            or job.get("image_digest") != expected_digest
+        ):
+            raise ValueError("github_cost_governance_readback_invalid")