fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/identity_profile.py

@@ -0,0 +1,227 @@
+"""Sanitized readiness contract for the standalone Entra identity operation."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from fdai_deployment_cli.contracts import canonical_digest
+
+
+@dataclass(frozen=True, slots=True)
+class IdentityProfileEvidence:
+    """Value-free readback facts; ``None`` means the provider read was unavailable."""
+
+    premium_license_eligible: bool | None
+    role_groups_present: bool | None
+    role_group_profile_match: bool | None
+    conditional_access_policy_present: bool | None
+    access_review_present: bool | None
+    authentication_method_policy_present: bool | None
+    phishing_resistant_method_enabled: bool | None
+    azure_policy_assignment_present: bool | None
+    human_identity_present: bool | None
+    human_approver_authorized: bool | None
+    executor_identity_present: bool | None
+    executor_is_managed_identity: bool | None
+    executor_profile_match: bool | None
+    human_executor_separated: bool | None
+
+    def __post_init__(self) -> None:
+        if any(
+            value is not None and type(value) is not bool
+            for value in (
+                self.premium_license_eligible,
+                self.role_groups_present,
+                self.role_group_profile_match,
+                self.conditional_access_policy_present,
+                self.access_review_present,
+                self.authentication_method_policy_present,
+                self.phishing_resistant_method_enabled,
+                self.azure_policy_assignment_present,
+                self.human_identity_present,
+                self.human_approver_authorized,
+                self.executor_identity_present,
+                self.executor_is_managed_identity,
+                self.executor_profile_match,
+                self.human_executor_separated,
+            )
+        ):
+            raise ValueError("identity profile evidence values MUST be booleans or unknown")
+
+
+@dataclass(frozen=True, slots=True)
+class IdentityProfileObservation:
+    """Sanitized read-only identity posture with stable fail-closed blockers."""
+
+    evidence: IdentityProfileEvidence
+    blockers: tuple[str, ...]
+
+    @classmethod
+    def from_evidence(cls, evidence: IdentityProfileEvidence) -> IdentityProfileObservation:
+        """Classify every required readback without exposing provider values."""
+
+        blockers: list[str] = []
+        _classify(
+            blockers,
+            evidence.premium_license_eligible,
+            unavailable="premium_license_readback_unavailable",
+            absent="premium_license_ineligible",
+        )
+        _classify(
+            blockers,
+            evidence.role_groups_present,
+            unavailable="role_group_readback_unavailable",
+            absent="role_group_missing",
+        )
+        if evidence.role_groups_present is True:
+            _classify(
+                blockers,
+                evidence.role_group_profile_match,
+                unavailable="role_group_readback_unavailable",
+                absent="role_group_profile_mismatch",
+            )
+        _classify(
+            blockers,
+            evidence.conditional_access_policy_present,
+            unavailable="conditional_access_readback_unavailable",
+            absent="conditional_access_policy_missing",
+        )
+        _classify(
+            blockers,
+            evidence.access_review_present,
+            unavailable="access_review_readback_unavailable",
+            absent="access_review_missing",
+        )
+        _classify(
+            blockers,
+            evidence.authentication_method_policy_present,
+            unavailable="authentication_method_policy_readback_unavailable",
+            absent="authentication_method_policy_missing",
+        )
+        if evidence.authentication_method_policy_present is True:
+            _classify(
+                blockers,
+                evidence.phishing_resistant_method_enabled,
+                unavailable="authentication_method_policy_readback_unavailable",
+                absent="phishing_resistant_method_missing",
+            )
+        _classify(
+            blockers,
+            evidence.azure_policy_assignment_present,
+            unavailable="azure_policy_assignment_readback_unavailable",
+            absent="azure_policy_assignment_missing",
+        )
+        _classify(
+            blockers,
+            evidence.human_identity_present,
+            unavailable="human_identity_readback_unavailable",
+            absent="human_identity_missing",
+        )
+        if evidence.human_identity_present is True:
+            _classify(
+                blockers,
+                evidence.human_approver_authorized,
+                unavailable="human_approver_membership_readback_unavailable",
+                absent="human_approver_membership_missing",
+            )
+        _classify(
+            blockers,
+            evidence.executor_identity_present,
+            unavailable="executor_identity_readback_unavailable",
+            absent="executor_identity_missing",
+        )
+        if evidence.executor_identity_present is True:
+            _classify(
+                blockers,
+                evidence.executor_is_managed_identity,
+                unavailable="executor_identity_readback_unavailable",
+                absent="executor_is_not_managed_identity",
+            )
+            if evidence.executor_is_managed_identity is True:
+                _classify(
+                    blockers,
+                    evidence.executor_profile_match,
+                    unavailable="executor_identity_readback_unavailable",
+                    absent="executor_profile_mismatch",
+                )
+        if evidence.human_identity_present is True and evidence.executor_identity_present is True:
+            _classify(
+                blockers,
+                evidence.human_executor_separated,
+                unavailable="human_executor_separation_unavailable",
+                absent="human_executor_not_separated",
+            )
+        return cls(evidence=evidence, blockers=tuple(blockers))
+
+    @property
+    def ready(self) -> bool:
+        """Return whether every required profile and identity readback passed."""
+
+        return not self.blockers
+
+    @property
+    def digest(self) -> str:
+        """Bind the exact sanitized observation used by the mutation preflight."""
+
+        return canonical_digest(self._projection())
+
+    def to_mapping(self) -> dict[str, object]:
+        """Return only generic booleans, stable blockers, and an opaque digest."""
+
+        projection = self._projection()
+        projection["profile_digest"] = canonical_digest(projection)
+        return projection
+
+    def _projection(self) -> dict[str, object]:
+        evidence = self.evidence
+        return {
+            "schema_version": "fdai.identity-profile-observation.v1",
+            "premium_license": _fact(evidence.premium_license_eligible, "eligible"),
+            "role_groups": {
+                "readback_available": evidence.role_groups_present is not None,
+                "all_present": evidence.role_groups_present is True,
+                "profile_match": evidence.role_group_profile_match is True,
+            },
+            "conditional_access": _fact(
+                evidence.conditional_access_policy_present, "policy_present"
+            ),
+            "access_review": _fact(evidence.access_review_present, "definition_present"),
+            "authentication_method_policy": {
+                **_fact(evidence.authentication_method_policy_present, "policy_present"),
+                "phishing_resistant_method_enabled": bool(
+                    evidence.phishing_resistant_method_enabled
+                ),
+            },
+            "azure_policy": _fact(evidence.azure_policy_assignment_present, "assignment_present"),
+            "identity_separation": {
+                "human_readback_available": evidence.human_identity_present is not None,
+                "human_present": evidence.human_identity_present is True,
+                "human_approver_authorized": evidence.human_approver_authorized is True,
+                "executor_readback_available": evidence.executor_identity_present is not None,
+                "executor_present": evidence.executor_identity_present is True,
+                "executor_is_managed_identity": evidence.executor_is_managed_identity is True,
+                "executor_profile_match": evidence.executor_profile_match is True,
+                "human_executor_separated": evidence.human_executor_separated is True,
+            },
+            "blockers": list(self.blockers),
+            "ready": self.ready,
+            "mutation_performed": False,
+        }
+
+
+def _classify(
+    blockers: list[str],
+    value: bool | None,
+    *,
+    unavailable: str,
+    absent: str,
+) -> None:
+    if value is None:
+        if unavailable not in blockers:
+            blockers.append(unavailable)
+    elif not value:
+        blockers.append(absent)
+
+
+def _fact(value: bool | None, field: str) -> dict[str, bool]:
+    return {"readback_available": value is not None, field: value is True}

fdai_deployment_cli/image_targets.py

@@ -0,0 +1,197 @@
+"""Resolve changed repository paths to independently deployable service images."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Iterable
+from dataclasses import asdict, dataclass
+
+
+@dataclass(frozen=True)
+class ImageTarget:
+    target: str
+    service: str
+    dockerfile: str
+    image: str
+
+
+IMAGE_TARGETS = (
+    ImageTarget(
+        target="core-control-plane",
+        service="core-control-plane",
+        dockerfile="services/core-control-plane/docker/Dockerfile",
+        image="fdai-core-control-plane",
+    ),
+    ImageTarget(
+        target="cost-governance",
+        service="core-control-plane",
+        dockerfile="extensions/cost-governance/docker/Dockerfile",
+        image="fdai-cost-governance",
+    ),
+    ImageTarget(
+        target="operator-service",
+        service="operator-service",
+        dockerfile="services/operator-service/docker/Dockerfile",
+        image="fdai-operator-service",
+    ),
+    ImageTarget(
+        target="document-ingestion-api",
+        service="document-ingestion-api",
+        dockerfile="services/document-ingestion-api/docker/Dockerfile",
+        image="fdai-document-ingestion-api",
+    ),
+    ImageTarget(
+        target="document-processing-worker",
+        service="document-processing-worker",
+        dockerfile="services/document-processing-worker/docker/Dockerfile",
+        image="fdai-document-processing-worker",
+    ),
+    ImageTarget(
+        target="isolated-executor",
+        service="isolated-executor",
+        dockerfile="services/isolated-executor/docker/Dockerfile",
+        image="fdai-isolated-executor",
+    ),
+    ImageTarget(
+        target="system-knowledge-service",
+        service="system-knowledge-service",
+        dockerfile="services/system-knowledge-service/docker/Dockerfile",
+        image="fdai-system-knowledge-service",
+    ),
+)
+
+_ALL_TARGET_EXACT_PATHS = {
+    ".dockerignore",
+    ".github/workflows/container-supply-chain.yml",
+    ".trivyignore.yaml",
+    "config/service-image-build-override.json",
+    "LICENSE",
+    "README.md",
+    "pyproject.toml",
+    "scripts/deployment/service/apply_image_build_override.py",
+    "scripts/deployment/service/select_changed_images.py",
+    "uv.lock",
+}
+_ALL_TARGET_PREFIXES = (
+    "evaluation-sdk/",
+    "packages/service-contracts/",
+    "service-contracts/",
+    "src/",
+)
+_ALL_TARGET_METADATA_PATHS = {
+    "benchmarks/cybergym/pyproject.toml",
+    "benchmarks/sregym/pyproject.toml",
+    "extensions/code-assurance/pyproject.toml",
+    "extensions/cost-governance/pyproject.toml",
+    "packages/github-app-auth/pyproject.toml",
+    *(f"services/{target.service}/pyproject.toml" for target in IMAGE_TARGETS),
+}
+_CORE_EXACT_PATHS = {
+    "alembic.ini",
+    "docs/internals/sregym-absorption-ledger.json",
+    "scripts/deployment/local/materialize-authoritative-catalogs.py",
+}
+_CORE_PREFIXES = (
+    "alembic/",
+    "config/",
+    "policies/",
+    "provider-schema-catalog/",
+    "rule-catalog/",
+    "services/assets/",
+    "tests/scenarios/",
+)
+_COST_GOVERNANCE_PREFIX = "extensions/cost-governance/"
+_GITHUB_APP_AUTH_PREFIX = "packages/github-app-auth/"
+_RUNTIME_DIAGNOSTICS_PREFIX = "packages/runtime-diagnostics/"
+_SOURCE_PACKAGE_PREFIXES = (
+    *(f"services/{target.service}/" for target in IMAGE_TARGETS),
+    _COST_GOVERNANCE_PREFIX,
+    _GITHUB_APP_AUTH_PREFIX,
+    _RUNTIME_DIAGNOSTICS_PREFIX,
+    "packages/service-contracts/",
+    "evaluation-sdk/",
+)
+
+
+def select_requested_images(selection: str) -> tuple[ImageTarget, ...]:
+    """Resolve explicit target names without expanding optional image profiles."""
+    names = [name.strip() for name in selection.split(",")]
+    if names == ["all"]:
+        return IMAGE_TARGETS
+    by_name = {name: target for target in IMAGE_TARGETS for name in (target.target, target.image)}
+    selected: set[str] = set()
+    for name in names:
+        if name not in by_name:
+            raise ValueError("images must name known targets or image names, or only 'all'")
+        target = by_name[name]
+        if target.target in selected:
+            raise ValueError("images must not repeat a target or its image alias")
+        selected.add(target.target)
+    return tuple(target for target in IMAGE_TARGETS if target.target in selected)
+
+
+def _is_packaging_input(path: str) -> bool:
+    if path == "README.md":
+        return False
+    for prefix in _SOURCE_PACKAGE_PREFIXES:
+        if not path.startswith(prefix):
+            continue
+        relative = path.removeprefix(prefix)
+        if relative.startswith("tests/") and not (
+            prefix == "services/core-control-plane/" and relative.startswith("tests/scenarios/")
+        ):
+            return False
+        if relative.startswith("docs/"):
+            return False
+        return not (relative.startswith("src/") and relative.endswith((".py", ".pyi")))
+    return not (path.startswith("src/") and path.endswith((".py", ".pyi")))
+
+
+def select_image_targets(
+    changed_paths: Iterable[str], *, packaging_only: bool = False
+) -> tuple[ImageTarget, ...]:
+    """Select every image whose declared source or packaged asset changed."""
+    paths = {path.removeprefix("./") for path in changed_paths if path}
+    if packaging_only:
+        paths = {path for path in paths if _is_packaging_input(path)}
+    if any(
+        path in _ALL_TARGET_EXACT_PATHS
+        or path in _ALL_TARGET_METADATA_PATHS
+        or path.startswith(_ALL_TARGET_PREFIXES)
+        for path in paths
+    ):
+        return IMAGE_TARGETS
+
+    selected: set[str] = set()
+    for path in paths:
+        if path.startswith(_RUNTIME_DIAGNOSTICS_PREFIX):
+            selected.update({"core-control-plane", "cost-governance", "operator-service"})
+            continue
+        if path.startswith(_GITHUB_APP_AUTH_PREFIX):
+            selected.update({"core-control-plane", "cost-governance", "document-ingestion-api"})
+            continue
+        if path.startswith(_COST_GOVERNANCE_PREFIX):
+            selected.add("cost-governance")
+            continue
+        if path in _CORE_EXACT_PATHS or path.startswith(_CORE_PREFIXES):
+            selected.update({"core-control-plane", "cost-governance"})
+        if path == "config/agent-stewardship.yaml":
+            selected.add("document-ingestion-api")
+        if not path.startswith("services/") or path.startswith("services/assets/"):
+            continue
+        matching = {
+            target.target
+            for target in IMAGE_TARGETS
+            if path.startswith(f"services/{target.service}/")
+        }
+        if not matching:
+            return IMAGE_TARGETS
+        selected.update(matching)
+    return tuple(target for target in IMAGE_TARGETS if target.target in selected)
+
+
+def matrix_json(targets: Iterable[ImageTarget]) -> str:
+    return json.dumps(
+        {"include": [asdict(target) for target in targets]},
+        separators=(",", ":"),
+    )