fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/runtime_build.py

@@ -0,0 +1,386 @@
+"""Assemble a complete runtime release from prebuilt, locally verified artifacts."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import stat
+from pathlib import Path, PurePosixPath
+from tempfile import TemporaryDirectory
+from typing import cast
+
+from fdai_deployment_cli.contracts import canonical_bytes
+from fdai_deployment_cli.oci_archive import (
+    validate_dependency_oci_archive,
+    validate_oci_archive,
+)
+from fdai_deployment_cli.offline_kit import (
+    _MAX_FILE_BYTES,
+    _copy_verified_file,
+    _sha256_nofollow,
+)
+from fdai_deployment_cli.private_output import (
+    _open_private_parent,
+    read_private_bytes,
+    write_private_bytes,
+)
+from fdai_deployment_cli.runtime_release import (
+    RUNTIME_RELEASE_PATH,
+    RUNTIME_SERVICES,
+    RUNTIME_SIDECARS,
+    load_runtime_release,
+    validate_runtime_images,
+)
+
+_SCHEMA = "fdai.runtime-release-build.v1"
+_OUTPUT_SCHEMA = "fdai.runtime-release-build-result.v1"
+_MAX_DESCRIPTOR_BYTES = 1024 * 1024
+_COMMIT = re.compile(r"[0-9a-f]{40}")
+_DIGEST = re.compile(r"sha256:[0-9a-f]{64}")
+_SHA256 = re.compile(r"[0-9a-f]{64}")
+_PLATFORMS = frozenset({"linux-x86_64", "linux-aarch64"})
+_IMAGE_FIELDS = frozenset(
+    {
+        "archive",
+        "archive_sha256",
+        "sbom",
+        "sbom_sha256",
+        "provenance",
+        "provenance_sha256",
+        "image_digest",
+    }
+)
+_ARCHIVE_FIELDS = frozenset({"archive", "archive_sha256", "sbom", "sbom_sha256"})
+_ROOT_FIELDS = frozenset(
+    {
+        "schema_version",
+        "source_commit",
+        "platform_tag",
+        "services",
+        "sidecars",
+        "console",
+        "deployment_support",
+    }
+)
+_OUTPUT_NAMES = {
+    "archive": "image.oci.tar",
+    "sbom": "sbom.cdx.json",
+    "provenance": "provenance.jsonl",
+}
+
+
+def build_runtime_release(
+    source_root: Path,
+    descriptor_path: Path,
+    deployment_bundle: Path,
+    output_root: Path,
+) -> dict[str, object]:
+    """Build one exact runtime v2 tree without network access or artifact execution.
+
+    The private descriptor names only relative files below ``source_root``. Every
+    payload is copied through no-follow digest checks into a new private output.
+    Service OCI archives must carry the declared FDAI revision; the ClamAV archive
+    is revision-neutral. This function does not sign artifacts, attest provenance,
+    publish an image, or authorize deployment.
+    """
+
+    descriptor = _load_descriptor(
+        read_private_bytes(descriptor_path, max_bytes=_MAX_DESCRIPTOR_BYTES)
+    )
+    source_commit = _text(descriptor, "source_commit")
+    platform_tag = _text(descriptor, "platform_tag")
+    if _COMMIT.fullmatch(source_commit) is None:
+        raise ValueError("runtime build source_commit is invalid")
+    if platform_tag not in _PLATFORMS:
+        raise ValueError("runtime build platform_tag is unsupported")
+    _require_source_root(source_root)
+    if not output_root.is_absolute():
+        raise ValueError("runtime release output MUST be an absolute path")
+    parent = _open_private_parent(output_root)
+    os.close(parent)
+    if output_root.exists() or output_root.is_symlink():
+        raise ValueError("runtime release output already exists")
+    bundle_digest = _regular_digest(deployment_bundle, label="deployment bundle")
+
+    with TemporaryDirectory(prefix=".runtime-release-", dir=output_root.parent) as temporary:
+        temporary_root = Path(temporary)
+        temporary_root.chmod(0o700)
+        staging = temporary_root / "release"
+        staging.mkdir(mode=0o700)
+        services = _build_image_group(
+            source_root,
+            staging,
+            descriptor.get("services"),
+            section="services",
+            expected_names=RUNTIME_SERVICES,
+            source_commit=source_commit,
+            platform_tag=platform_tag,
+        )
+        sidecars = _build_image_group(
+            source_root,
+            staging,
+            descriptor.get("sidecars"),
+            section="sidecars",
+            expected_names=RUNTIME_SIDECARS,
+            source_commit=None,
+            platform_tag=platform_tag,
+        )
+        console = _build_archive_record(
+            source_root,
+            staging,
+            descriptor.get("console"),
+            section="console",
+            archive_name="console.tar.gz",
+        )
+        support = _build_archive_record(
+            source_root,
+            staging,
+            descriptor.get("deployment_support"),
+            section="deployment-support",
+            archive_name="deployment-support.tar.gz",
+        )
+        catalog = {
+            "schema_version": "fdai.runtime-release.v2",
+            "source_commit": source_commit,
+            "platform_tag": platform_tag,
+            "deployment_bundle_sha256": bundle_digest,
+            "services": services,
+            "sidecars": sidecars,
+            "console": console,
+            "deployment_support": support,
+        }
+        write_private_bytes(staging / RUNTIME_RELEASE_PATH, canonical_bytes(catalog))
+        release = load_runtime_release(
+            staging,
+            expected_source_commit=source_commit,
+            expected_platform_tag=platform_tag,
+        )
+        image_digests = validate_runtime_images(staging, release)
+
+        marker = staging / "runtime/.fdai-incomplete"
+        write_private_bytes(marker, b"fdai-runtime-release-build-v1\n")
+        os.mkdir(output_root, 0o700)
+        try:
+            os.rename(staging / "runtime", output_root / "runtime")
+        except BaseException:
+            os.rmdir(output_root)
+            raise
+        marker = output_root / "runtime/.fdai-incomplete"
+        try:
+            marker.unlink()
+        except OSError as exc:
+            raise ValueError(
+                "runtime release publication is incomplete; remove the marked output after review"
+            ) from exc
+
+    return {
+        "schema_version": _OUTPUT_SCHEMA,
+        "runtime_release_digest": release.digest,
+        "deployment_bundle_sha256": bundle_digest,
+        "source_commit": source_commit,
+        "platform_tag": platform_tag,
+        "artifact_count": len(release.artifact_paths),
+        "image_content_digests": image_digests,
+        "azure_mutation_performed": False,
+        "production_release_eligibility": "unverified",
+    }
+
+
+def _load_descriptor(raw: bytes) -> dict[str, object]:
+    try:
+        value = json.loads(raw, object_pairs_hook=_unique_object)
+    except (UnicodeDecodeError, json.JSONDecodeError, RecursionError) as exc:
+        raise ValueError("runtime build descriptor is not valid JSON") from exc
+    if not isinstance(value, dict) or set(value) != _ROOT_FIELDS:
+        raise ValueError("runtime build descriptor fields do not match the schema")
+    result = cast(dict[str, object], value)
+    if result["schema_version"] != _SCHEMA:
+        raise ValueError("runtime build descriptor schema_version is unsupported")
+    return result
+
+
+def _unique_object(pairs: list[tuple[str, object]]) -> dict[str, object]:
+    result: dict[str, object] = {}
+    for key, value in pairs:
+        if key in result:
+            raise ValueError("runtime build descriptor contains duplicate JSON keys")
+        result[key] = value
+    return result
+
+
+def _build_image_group(
+    source_root: Path,
+    staging: Path,
+    value: object,
+    *,
+    section: str,
+    expected_names: frozenset[str],
+    source_commit: str | None,
+    platform_tag: str,
+) -> dict[str, object]:
+    records = _object(value, set(expected_names), label=section)
+    result: dict[str, object] = {}
+    for name in sorted(expected_names):
+        record = _string_record(records[name], _IMAGE_FIELDS, label=f"{section} record")
+        image_digest = record["image_digest"]
+        if _DIGEST.fullmatch(image_digest) is None:
+            raise ValueError("runtime build image digest is invalid")
+        output: dict[str, str] = {"image_digest": image_digest}
+        for field in ("archive", "sbom", "provenance"):
+            relative = f"runtime/{section}/{name}/{_OUTPUT_NAMES[field]}"
+            digest = _copy_source(
+                source_root,
+                record[field],
+                staging / relative,
+                output_root=staging,
+                expected_digest=record[f"{field}_sha256"],
+                label=f"{section} {field}",
+            )
+            output[field] = relative
+            output[f"{field}_sha256"] = digest
+        arguments = {
+            "expected_archive_sha256": output["archive_sha256"],
+            "expected_manifest_digest": image_digest,
+            "expected_platform_tag": platform_tag,
+        }
+        archive = staging / output["archive"]
+        if source_commit is None:
+            validate_dependency_oci_archive(archive, **arguments)
+        else:
+            validate_oci_archive(
+                archive,
+                expected_source_commit=source_commit,
+                **arguments,
+            )
+        result[name] = output
+    return result
+
+
+def _build_archive_record(
+    source_root: Path,
+    staging: Path,
+    value: object,
+    *,
+    section: str,
+    archive_name: str,
+) -> dict[str, str]:
+    record = _string_record(value, _ARCHIVE_FIELDS, label=f"{section} record")
+    output: dict[str, str] = {}
+    names = {"archive": archive_name, "sbom": "sbom.cdx.json"}
+    for field in ("archive", "sbom"):
+        relative = f"runtime/{section}/{names[field]}"
+        digest = _copy_source(
+            source_root,
+            record[field],
+            staging / relative,
+            output_root=staging,
+            expected_digest=record[f"{field}_sha256"],
+            label=f"{section} {field}",
+        )
+        output[field] = relative
+        output[f"{field}_sha256"] = digest
+    return output
+
+
+def _copy_source(
+    source_root: Path,
+    relative: str,
+    target: Path,
+    *,
+    output_root: Path,
+    expected_digest: str,
+    label: str,
+) -> str:
+    if _SHA256.fullmatch(expected_digest) is None:
+        raise ValueError(f"runtime build {label} digest is invalid")
+    try:
+        source = _source_path(source_root, relative)
+        details = source.lstat()
+    except OSError as exc:
+        raise ValueError(f"runtime build {label} is unavailable") from exc
+    if not stat.S_ISREG(details.st_mode) or not 0 < details.st_size <= _MAX_FILE_BYTES:
+        raise ValueError(f"runtime build {label} MUST be a non-empty bounded regular file")
+    digest = _sha256_nofollow(source, expected=details)
+    if digest != expected_digest:
+        raise ValueError(f"runtime build {label} digest does not match")
+    _ensure_private_parent(target, root=output_root)
+    _copy_verified_file(
+        source,
+        target,
+        expected_digest=digest,
+        expected_size=details.st_size,
+    )
+    return digest
+
+
+def _ensure_private_parent(path: Path, *, root: Path) -> None:
+    current = root
+    for part in path.parent.relative_to(root).parts:
+        current /= part
+        try:
+            os.mkdir(current, 0o700)
+        except FileExistsError:
+            details = current.lstat()
+            if not stat.S_ISDIR(details.st_mode):
+                raise ValueError(
+                    "runtime release output directories MUST NOT be symlinks"
+                ) from None
+        current.chmod(0o700)
+
+
+def _source_path(root: Path, value: str) -> Path:
+    path = PurePosixPath(value)
+    if (
+        not value
+        or value.startswith("/")
+        or "\\" in value
+        or any(part in {"", ".", ".."} for part in path.parts)
+    ):
+        raise ValueError("runtime build source path is invalid")
+    current = root
+    for part in path.parts[:-1]:
+        current /= part
+        if not stat.S_ISDIR(current.lstat().st_mode):
+            raise ValueError("runtime build source directories MUST NOT be symlinks")
+    return root / path.as_posix()
+
+
+def _require_source_root(path: Path) -> None:
+    if not path.is_absolute() or not stat.S_ISDIR(path.lstat().st_mode):
+        raise ValueError("runtime build source root MUST be an absolute real directory")
+
+
+def _regular_digest(path: Path, *, label: str) -> str:
+    if not path.is_absolute():
+        raise ValueError(f"{label} path MUST be absolute")
+    try:
+        details = path.lstat()
+    except OSError as exc:
+        raise ValueError(f"{label} is unavailable") from exc
+    if not stat.S_ISREG(details.st_mode) or not 0 < details.st_size <= _MAX_FILE_BYTES:
+        raise ValueError(f"{label} MUST be a non-empty bounded regular file")
+    return _sha256_nofollow(path, expected=details)
+
+
+def _object(value: object, fields: set[str], *, label: str) -> dict[str, object]:
+    if not isinstance(value, dict) or set(value) != fields:
+        raise ValueError(f"runtime build {label} fields do not match the schema")
+    return cast(dict[str, object], value)
+
+
+def _string_record(value: object, fields: frozenset[str], *, label: str) -> dict[str, str]:
+    record = _object(value, set(fields), label=label)
+    if not all(isinstance(item, str) for item in record.values()):
+        raise ValueError(f"runtime build {label} values MUST be strings")
+    return cast(dict[str, str], record)
+
+
+def _text(value: dict[str, object], field: str) -> str:
+    item = value[field]
+    if not isinstance(item, str):
+        raise TypeError(f"runtime build {field} MUST be a string")
+    return item
+
+
+__all__ = ["build_runtime_release"]

fdai_deployment_cli/runtime_profile.py

@@ -0,0 +1,287 @@
+"""Validate and seal the runtime substrate selected for a new deployment."""
+
+from __future__ import annotations
+
+import argparse
+from dataclasses import dataclass, field
+from enum import StrEnum
+
+from fdai_service_contracts.product_profile import (
+    ObservationDataSource,
+    ObservationReadPermissions,
+    ProductAddOn,
+    ProductProfile,
+)
+
+from fdai_deployment_cli.contracts import canonical_digest
+
+
+class RuntimePlatform(StrEnum):
+    """Supported Azure runtime substrates for a new FDAI installation."""
+
+    CONTAINER_APPS = "container-apps"
+    AKS = "aks"
+
+
+class DatabasePlacement(StrEnum):
+    """Supported PostgreSQL placement choices for a new installation."""
+
+    POSTGRES_FLEX = "postgres-flex"
+    POSTGRES_AKS = "postgres-aks"
+
+
+# Explicit PostgreSQL Flexible Server sizes. Unset keeps the infrastructure default,
+# GP_Standard_D4ads_v5, and leaves the profile mapping and digest unchanged.
+DATABASE_SKUS = (
+    "B_Standard_B1ms",
+    "B_Standard_B2s",
+    "B_Standard_B2ms",
+    "GP_Standard_D2ds_v5",
+    "GP_Standard_D4ds_v5",
+    "GP_Standard_D4ads_v5",
+)
+
+LEGACY_FULL_PRODUCT_ADD_ONS = (
+    ProductAddOn.ENTERPRISE_IDENTITY_GOVERNANCE,
+    ProductAddOn.GOVERNED_EXECUTION,
+    ProductAddOn.NOTIFICATIONS,
+    ProductAddOn.READ_ONLY_CONSOLE,
+)
+
+
+@dataclass(frozen=True, slots=True)
+class RuntimeDeploymentProfile:
+    """Secret-free runtime and node-pool intent bound to exact deployment plans."""
+
+    runtime_platform: RuntimePlatform
+    database_placement: DatabasePlacement
+    system_node_count: int = 3
+    system_node_sku: str = "Standard_D4ds_v4"
+    user_node_min_count: int = 3
+    user_node_max_count: int = 5
+    user_node_sku: str = "Standard_D4ds_v4"
+    product_profile: ProductProfile = field(default_factory=ProductProfile)
+    database_sku: str | None = None
+
+    @property
+    def console_selected(self) -> bool:
+        """Report the explicitly selected read-only Console surface."""
+
+        return self.product_profile.selects(ProductAddOn.READ_ONLY_CONSOLE)
+
+    def __post_init__(self) -> None:
+        if self.database_sku is not None:
+            if self.database_sku not in DATABASE_SKUS:
+                raise ValueError("database SKU is unsupported")
+            if self.database_placement is not DatabasePlacement.POSTGRES_FLEX:
+                raise ValueError("database SKU requires postgres-flex placement")
+        if self.runtime_platform is RuntimePlatform.CONTAINER_APPS:
+            if self.database_placement is not DatabasePlacement.POSTGRES_FLEX:
+                raise ValueError("Container Apps requires postgres-flex")
+            return
+        if not 2 <= self.system_node_count <= 100:
+            raise ValueError("AKS system node count MUST be in [2, 100]")
+        minimum_user_nodes = 4 if self.database_placement is DatabasePlacement.POSTGRES_AKS else 3
+        if not minimum_user_nodes <= self.user_node_min_count <= 100:
+            raise ValueError(f"AKS user node minimum MUST be in [{minimum_user_nodes}, 100]")
+        if not self.user_node_min_count <= self.user_node_max_count <= 100:
+            raise ValueError("AKS user node maximum MUST cover the minimum and be at most 100")
+        for label, value in (
+            ("system node SKU", self.system_node_sku),
+            ("user node SKU", self.user_node_sku),
+        ):
+            if not value.startswith("Standard_") or any(character.isspace() for character in value):
+                raise ValueError(f"AKS {label} is invalid")
+
+    @property
+    def digest(self) -> str:
+        """Return a replay-stable digest over the complete runtime choice."""
+
+        return canonical_digest(self.to_mapping())
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        runtime_platform: str,
+        database_placement: str,
+        system_node_count: int = 3,
+        system_node_sku: str | None = None,
+        user_node_min_count: int = 3,
+        user_node_max_count: int = 5,
+        user_node_sku: str = "Standard_D4ds_v4",
+        product_add_ons: tuple[str, ...] = (),
+        observation_data_sources: tuple[str, ...] = (),
+        database_sku: str | None = None,
+    ) -> RuntimeDeploymentProfile:
+        """Parse command values and reject unsupported runtime or database names."""
+
+        try:
+            runtime = RuntimePlatform(runtime_platform)
+        except ValueError as exc:
+            raise ValueError("runtime platform is unsupported") from exc
+        try:
+            database = DatabasePlacement(database_placement)
+        except ValueError as exc:
+            raise ValueError("database placement is unsupported") from exc
+        try:
+            add_ons = tuple(sorted({ProductAddOn(value) for value in product_add_ons}, key=str))
+        except ValueError as exc:
+            raise ValueError("product add-on is unsupported") from exc
+        if len(add_ons) != len(product_add_ons):
+            raise ValueError("product add-ons MUST NOT contain duplicates")
+        try:
+            data_sources = tuple(
+                sorted(
+                    {ObservationDataSource(value) for value in observation_data_sources},
+                    key=str,
+                )
+            )
+        except ValueError as exc:
+            raise ValueError("observation data source is unsupported") from exc
+        if len(data_sources) != len(observation_data_sources):
+            raise ValueError("observation data sources MUST NOT contain duplicates")
+        return cls(
+            runtime_platform=runtime,
+            database_placement=database,
+            system_node_count=system_node_count,
+            system_node_sku=system_node_sku
+            if system_node_sku is not None
+            else ("Standard_D4ds_v4" if runtime is RuntimePlatform.AKS else "Standard_D2as_v5"),
+            user_node_min_count=user_node_min_count,
+            user_node_max_count=user_node_max_count,
+            user_node_sku=user_node_sku,
+            product_profile=ProductProfile(
+                add_ons=add_ons,
+                observation_permissions=ObservationReadPermissions(
+                    selected_sources=data_sources,
+                ),
+            ),
+            database_sku=database_sku,
+        )
+
+    @classmethod
+    def from_prepare_arguments(cls, args: argparse.Namespace) -> RuntimeDeploymentProfile:
+        """Rebuild the profile from managed-host prepare arguments with the same checks."""
+
+        return cls.create(
+            runtime_platform=str(args.runtime_platform),
+            database_placement=str(args.database_placement),
+            system_node_count=int(args.system_node_count),
+            system_node_sku=args.system_node_sku,
+            user_node_min_count=int(args.user_node_min_count),
+            user_node_max_count=int(args.user_node_max_count),
+            user_node_sku=str(args.user_node_sku),
+            product_add_ons=tuple(args.product_add_on),
+            observation_data_sources=tuple(args.observation_source),
+            database_sku=args.database_sku,
+        )
+
+    @classmethod
+    def from_cli_arguments(cls, args: argparse.Namespace) -> RuntimeDeploymentProfile:
+        """Build the selected profile from the public Azure command arguments."""
+
+        return cls.create(
+            runtime_platform=args.runtime,
+            database_placement=args.database,
+            system_node_count=args.system_nodes,
+            system_node_sku=args.system_node_sku,
+            user_node_min_count=args.user_nodes,
+            user_node_max_count=args.max_user_nodes,
+            user_node_sku=args.user_node_sku,
+            product_add_ons=tuple(args.product_add_ons),
+            observation_data_sources=tuple(args.observation_data_sources),
+            database_sku=args.database_sku,
+        )
+
+    def to_mapping(self) -> dict[str, object]:
+        """Return the canonical machine representation stored with deployment evidence."""
+
+        mapping: dict[str, object] = {
+            "schema_version": "fdai.runtime-deployment-profile.v2",
+            "runtime_platform": self.runtime_platform.value,
+            "database_placement": self.database_placement.value,
+            "system_node_count": self.system_node_count,
+            "system_node_sku": self.system_node_sku,
+            "user_node_min_count": self.user_node_min_count,
+            "user_node_max_count": self.user_node_max_count,
+            "user_node_sku": self.user_node_sku,
+            "product_profile": self.product_profile.model_dump(mode="json"),
+        }
+        if self.database_sku is not None:
+            mapping["database_sku"] = self.database_sku
+        return mapping
+
+    @classmethod
+    def from_mapping(cls, value: dict[str, object]) -> RuntimeDeploymentProfile:
+        """Read current profiles and preserve explicit legacy full-product behavior."""
+
+        schema_version = value.get("schema_version")
+        if schema_version not in {
+            "fdai.runtime-deployment-profile.v1",
+            "fdai.runtime-deployment-profile.v2",
+        }:
+            raise ValueError("runtime deployment profile schema is unsupported")
+        product = value.get("product_profile")
+        if schema_version == "fdai.runtime-deployment-profile.v1":
+            add_ons = tuple(item.value for item in LEGACY_FULL_PRODUCT_ADD_ONS)
+            data_sources = tuple(item.value for item in ObservationDataSource)
+        else:
+            if not isinstance(product, dict):
+                raise ValueError("runtime deployment product profile is missing")
+            parsed = ProductProfile.model_validate(product)
+            add_ons = tuple(item.value for item in parsed.add_ons)
+            data_sources = tuple(
+                item.value for item in parsed.observation_permissions.selected_sources
+            )
+        return cls.create(
+            runtime_platform=str(value.get("runtime_platform", "")),
+            database_placement=str(value.get("database_placement", "")),
+            system_node_count=value.get("system_node_count", 0),  # type: ignore[arg-type]
+            system_node_sku=(
+                str(value["system_node_sku"]) if value.get("system_node_sku") is not None else None
+            ),
+            user_node_min_count=value.get("user_node_min_count", 0),  # type: ignore[arg-type]
+            user_node_max_count=value.get("user_node_max_count", 0),  # type: ignore[arg-type]
+            user_node_sku=str(value.get("user_node_sku", "")),
+            product_add_ons=add_ons,
+            observation_data_sources=data_sources,
+            database_sku=(
+                str(value["database_sku"]) if value.get("database_sku") is not None else None
+            ),
+        )
+
+    def matches_mapping(self, value: dict[str, object]) -> bool:
+        """Compare current mappings exactly and legacy mappings without invented fields."""
+
+        if value.get("schema_version") == "fdai.runtime-deployment-profile.v1":
+            return legacy_runtime_profile_mapping(self) == value
+        return self.to_mapping() == value
+
+
+def legacy_runtime_profile_mapping(
+    profile: RuntimeDeploymentProfile,
+) -> dict[str, object]:
+    """Project the pre-product-axis mapping for immutable legacy evidence."""
+
+    current = profile.to_mapping()
+    current.pop("product_profile")
+    current["schema_version"] = "fdai.runtime-deployment-profile.v1"
+    return current
+
+
+def legacy_runtime_profile_digest(profile: RuntimeDeploymentProfile) -> str:
+    """Return the digest retained by a context created before profile v2."""
+
+    return canonical_digest(legacy_runtime_profile_mapping(profile))
+
+
+def legacy_full_product_matches(profile: RuntimeDeploymentProfile, retained_digest: str) -> bool:
+    """Match a pre-product-axis record only to the explicit legacy full-product selection."""
+
+    selected = profile.product_profile
+    return (
+        set(selected.add_ons) == set(LEGACY_FULL_PRODUCT_ADD_ONS)
+        and len(selected.observation_permissions.selected_sources) == len(ObservationDataSource)
+        and retained_digest == legacy_runtime_profile_digest(profile)
+    )