fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/source_change_parser.py

@@ -0,0 +1,75 @@
+"""Register changed-source CLI commands without growing the top-level parser."""
+
+from __future__ import annotations
+
+import argparse
+from collections.abc import Callable, Mapping
+from pathlib import Path
+
+
+def register(
+    provision_commands: argparse._SubParsersAction[argparse.ArgumentParser],
+    *,
+    command: Callable[..., argparse.ArgumentParser],
+    handlers: Mapping[str, Callable[[argparse.Namespace], int]],
+) -> None:
+    plan = command(
+        provision_commands,
+        "source-change-plan",
+        "Classify one exact Git diff into the narrowest safe deployment lane",
+    )
+    plan.add_argument("--source", type=Path, required=True, help="Clean Git checkout to inspect")
+    plan.add_argument("--base", required=True, help="Base Git revision for the exact diff")
+    plan.add_argument(
+        "--head",
+        default="HEAD",
+        help="Head Git revision for the exact diff (default: %(default)s)",
+    )
+    plan.add_argument(
+        "--output",
+        choices=("text", "json"),
+        default="text",
+        help="Output format (default: %(default)s)",
+    )
+    plan.set_defaults(handler=handlers["provision_source_change_plan"])
+
+    update = command(
+        provision_commands,
+        "source-changed-update",
+        "Deploy every affected baseline service from one exact Git diff",
+    )
+    update.add_argument(
+        "--source",
+        type=Path,
+        required=True,
+        help="Clean checkout whose HEAD supplies the update",
+    )
+    update.add_argument("--base", required=True, help="Base Git revision for affected services")
+    update.add_argument(
+        "--application-work-dir",
+        type=Path,
+        required=True,
+        help="Retained existing-development application work directory",
+    )
+    update.add_argument(
+        "--work-dir",
+        type=Path,
+        required=True,
+        help="Fresh or retained private changed-update work directory",
+    )
+    update.add_argument(
+        "--timeout-seconds",
+        type=int,
+        default=14400,
+        help="Total update deadline in seconds (default: %(default)s)",
+    )
+    update.add_argument(
+        "--output",
+        choices=("text", "json"),
+        default="text",
+        help="Output format (default: %(default)s)",
+    )
+    update.set_defaults(handler=handlers["provision_source_changed_update"])
+
+
+__all__ = ["register"]

fdai_deployment_cli/source_change_plan.py

@@ -0,0 +1,181 @@
+"""Classify a clean Git diff into the narrowest safe source deployment lane."""
+
+from __future__ import annotations
+
+import re
+import subprocess
+from collections.abc import Iterable
+from pathlib import Path
+
+from fdai_deployment_cli.contracts import canonical_digest
+from fdai_deployment_cli.image_targets import IMAGE_TARGETS, select_image_targets
+from fdai_deployment_cli.runtime_release import RUNTIME_SERVICES
+
+_COMMIT = re.compile(r"[0-9a-f]{40}")
+_MAX_CHANGED_PATHS = 20_000
+_HIGHER_LANE_PREFIXES = (
+    "alembic/",
+    "infra/",
+    "lifecycle/",
+    "packages/deployment-cli/",
+    "scripts/deployment/azure/",
+    "service-migrations/",
+)
+_HIGHER_LANE_EXACT = frozenset({"alembic.ini", "azure.yaml"})
+_NO_DEPLOY_PREFIXES = (
+    ".github/",
+    ".vscode/",
+    "docs/",
+    "examples/",
+    "mocks/",
+    "site/",
+    "tests/",
+    "tools/",
+)
+_RUNTIME_EXCEPTION_PATHS = frozenset({"docs/internals/sregym-absorption-ledger.json"})
+_RUNTIME_EXCEPTION_PREFIXES = ("services/core-control-plane/tests/scenarios/",)
+_SERVICE_BUILD_CONTRACTS = frozenset(
+    {
+        *(target.dockerfile for target in IMAGE_TARGETS),
+        *(f"services/{target.service}/pyproject.toml" for target in IMAGE_TARGETS),
+    }
+)
+
+
+def source_change_plan(
+    changed_paths: Iterable[str],
+    *,
+    base_commit: str,
+    head_commit: str,
+    deleted_paths: Iterable[str] = (),
+) -> dict[str, object]:
+    """Return a no-effect deployment route for one exact commit range."""
+    if _COMMIT.fullmatch(base_commit) is None or _COMMIT.fullmatch(head_commit) is None:
+        raise ValueError("source change plan requires exact commit ids")
+    paths = tuple(sorted({path.removeprefix("./") for path in changed_paths if path}))
+    if len(paths) > _MAX_CHANGED_PATHS or any(
+        path.startswith("/") or ".." in Path(path).parts or "\x00" in path for path in paths
+    ):
+        raise ValueError("source change plan paths are invalid or exceed their bound")
+    deleted = tuple(sorted({path.removeprefix("./") for path in deleted_paths if path}))
+    if any(path not in paths for path in deleted):
+        raise ValueError("source change plan deletions must belong to the exact diff")
+    runtime_paths = tuple(path for path in paths if not _is_no_deploy_path(path))
+
+    higher_lane = tuple(
+        path
+        for path in runtime_paths
+        if path in _HIGHER_LANE_EXACT or path.startswith(_HIGHER_LANE_PREFIXES)
+    )
+    removed_contracts = tuple(path for path in deleted if path in _SERVICE_BUILD_CONTRACTS)
+    console_paths = tuple(path for path in runtime_paths if path.startswith("console/"))
+    image_targets = select_image_targets(runtime_paths)
+    unsupported = tuple(
+        target.target
+        for target in image_targets
+        if target.service not in RUNTIME_SERVICES or target.target != target.service
+    )
+    services = tuple(
+        target.service
+        for target in image_targets
+        if target.service in RUNTIME_SERVICES and target.target == target.service
+    )
+    services = tuple(dict.fromkeys(services))
+
+    if removed_contracts:
+        lane, reason = "higher-lane-required", "service_build_contract_removed"
+        higher_lane = tuple(sorted({*higher_lane, *removed_contracts}))
+    elif higher_lane:
+        lane, reason = "higher-lane-required", "deployment_contract_changed"
+    elif unsupported:
+        lane, reason = "full-release-required", "unsupported_hot_path_target"
+    elif console_paths and services:
+        lane, reason = "split-update-required", "console_and_service_changed"
+    elif console_paths:
+        lane, reason = "console-update", "console_changed"
+    elif len(services) == 1:
+        lane, reason = "single-service-update", "one_service_changed"
+    elif len(services) > 1:
+        lane, reason = "multi-service-update", "multiple_services_changed"
+    elif paths and not runtime_paths:
+        lane, reason = "no-deploy", "non_runtime_files_changed"
+    elif paths:
+        lane, reason = "higher-lane-required", "unclassified_runtime_impact"
+    else:
+        lane, reason = "no-deploy", "no_files_changed"
+
+    result: dict[str, object] = {
+        "schema_version": "fdai.source-change-plan.v1",
+        "base_commit": base_commit,
+        "head_commit": head_commit,
+        "lane": lane,
+        "reason_code": reason,
+        "changed_path_count": len(paths),
+        "changed_paths_digest": canonical_digest({"paths": list(paths)}),
+        "services": list(services),
+        "image_targets": [target.target for target in image_targets],
+        "unsupported_hot_path_targets": list(unsupported),
+        "console_changed": bool(console_paths),
+        "higher_lane_paths": list(higher_lane),
+        "mutation_performed": False,
+        "deployment_ready": False,
+    }
+    result["plan_digest"] = canonical_digest(result)
+    return result
+
+
+def plan_git_changes(source_root: Path, base: str, head: str = "HEAD") -> dict[str, object]:
+    """Resolve an exact local diff and classify it without contacting Azure."""
+    root = source_root.resolve(strict=True)
+    if root.is_symlink():
+        raise ValueError("source change plan requires a non-symlink checkout")
+    base_commit = _git(root, "rev-parse", "--verify", f"{base}^{{commit}}").strip()
+    head_commit = _git(root, "rev-parse", "--verify", f"{head}^{{commit}}").strip()
+    if _COMMIT.fullmatch(base_commit) is None or _COMMIT.fullmatch(head_commit) is None:
+        raise ValueError("source change plan could not resolve exact commits")
+    output = subprocess.run(
+        [
+            "git",
+            "-C",
+            str(root),
+            "diff",
+            "--no-renames",
+            "--name-status",
+            "-z",
+            "--diff-filter=ACMRD",
+            base_commit,
+            head_commit,
+        ],
+        check=True,
+        capture_output=True,
+        timeout=30,
+    ).stdout
+    fields = [value for value in output.split(b"\0") if value]
+    if len(fields) % 2:
+        raise ValueError("source change plan received invalid Git diff status output")
+    changes = [
+        (fields[index].decode("ascii"), fields[index + 1].decode("utf-8"))
+        for index in range(0, len(fields), 2)
+    ]
+    return source_change_plan(
+        (path for _status, path in changes),
+        base_commit=base_commit,
+        head_commit=head_commit,
+        deleted_paths=(path for status, path in changes if status == "D"),
+    )
+
+
+def _git(root: Path, *arguments: str) -> str:
+    return subprocess.run(
+        ["git", "-C", str(root), *arguments],
+        check=True,
+        capture_output=True,
+        text=True,
+        timeout=30,
+    ).stdout
+
+
+def _is_no_deploy_path(path: str) -> bool:
+    if path in _RUNTIME_EXCEPTION_PATHS or path.startswith(_RUNTIME_EXCEPTION_PREFIXES):
+        return False
+    return path.startswith(_NO_DEPLOY_PREFIXES) or "/tests/" in path or "/docs/" in path

fdai_deployment_cli/source_changed_update.py

@@ -0,0 +1,196 @@
+"""Apply the service-only portion of one exact changed-source plan."""
+
+from __future__ import annotations
+
+import re
+import time
+from pathlib import Path
+from typing import Any
+
+from fdai_deployment_cli.contracts import canonical_bytes, canonical_digest, load_json_object
+from fdai_deployment_cli.deployment_deadline import DeploymentDeadline
+from fdai_deployment_cli.private_output import read_private_bytes, write_private_bytes
+from fdai_deployment_cli.source_change_plan import plan_git_changes
+from fdai_deployment_cli.source_service_update import (
+    _require_private_directory,
+    deploy_source_service_update,
+)
+
+_SUPPORTED_LANES = frozenset({"single-service-update", "multi-service-update"})
+_DIGEST = re.compile(r"[0-9a-f]{64}")
+_IMAGE_DIGEST = re.compile(r"sha256:[0-9a-f]{64}")
+
+
+def deploy_changed_source(
+    *,
+    source_root: Path,
+    base: str,
+    application_work_dir: Path,
+    work_dir: Path,
+    timeout_seconds: int,
+) -> dict[str, object]:
+    """Deploy affected baseline services serially under their existing exact approvals."""
+
+    started = time.monotonic()
+    plan = plan_git_changes(source_root, base)
+    lane = str(plan["lane"])
+    services = plan.get("services")
+    if not isinstance(services, list) or any(not isinstance(item, str) for item in services):
+        raise TypeError("source change plan contains an invalid service list")
+    if lane == "no-deploy":
+        result: dict[str, object] = {
+            "schema_version": "fdai.source-changed-update.v1",
+            "state": "no-deploy",
+            "change_plan_digest": plan["plan_digest"],
+            "services": [],
+            "service_receipts": [],
+            "elapsed_ms": round((time.monotonic() - started) * 1000),
+            "mutation_performed": False,
+            "deployment_ready": False,
+        }
+        result["receipt_digest"] = canonical_digest(result)
+        return result
+    if lane not in _SUPPORTED_LANES:
+        result = {
+            "schema_version": "fdai.source-changed-update.v1",
+            "state": "review",
+            "lane": lane,
+            "reason_code": plan["reason_code"],
+            "change_plan_digest": plan["plan_digest"],
+            "services": services,
+            "next_action": "use_the_reported_deployment_lane",
+            "mutation_performed": False,
+            "deployment_ready": False,
+        }
+        result["receipt_digest"] = canonical_digest(result)
+        return result
+
+    deadline = DeploymentDeadline(timeout_seconds)
+    source = source_root.resolve(strict=True)
+    application = application_work_dir.absolute()
+    root = work_dir.absolute()
+    _require_private_directory(root, create=True)
+    intent: dict[str, object] = {
+        "schema_version": "fdai.source-changed-update-intent.v1",
+        "change_plan_digest": plan["plan_digest"],
+        "base_commit": plan["base_commit"],
+        "head_commit": plan["head_commit"],
+        "services": services,
+        "source_binding": canonical_digest({"path": str(source)}),
+        "application_work_binding": canonical_digest({"path": str(application)}),
+    }
+    intent["intent_digest"] = canonical_digest(intent)
+    _persist_exact(
+        root / "source-changed-update-intent.json",
+        intent,
+        label="source changed update intent",
+    )
+    receipts: list[dict[str, Any]] = []
+    for index, service in enumerate(services, start=1):
+        assert isinstance(service, str)
+        receipt = deploy_source_service_update(
+            source_root=source,
+            application_work_dir=application,
+            work_dir=root / service,
+            service=service,
+            timeout_seconds=deadline.remaining(),
+            expected_source_commit=str(plan["head_commit"]),
+            expected_current_source_commit=str(plan["base_commit"]),
+        )
+        summary = _service_receipt_summary(
+            receipt,
+            expected_service=service,
+            expected_source_commit=str(plan["head_commit"]),
+        )
+        receipts.append(summary)
+        progress: dict[str, object] = {
+            "schema_version": "fdai.source-changed-update-progress.v1",
+            "intent_digest": intent["intent_digest"],
+            "completed_service_count": index,
+            "service_receipts": list(receipts),
+        }
+        progress["progress_digest"] = canonical_digest(progress)
+        _persist_exact(
+            root / f"source-changed-update-progress-{index:02d}.json",
+            progress,
+            label="source changed update progress",
+        )
+    effect: dict[str, object] = {
+        "schema_version": "fdai.source-changed-update-effect.v1",
+        "state": "applied",
+        "intent_digest": intent["intent_digest"],
+        "change_plan_digest": plan["plan_digest"],
+        "head_commit": plan["head_commit"],
+        "services": services,
+        "service_receipts": receipts,
+        "effect_verified": True,
+        "mutation_performed": True,
+        "deployment_ready": False,
+    }
+    effect["receipt_digest"] = canonical_digest(effect)
+    _persist_exact(
+        root / "source-changed-update-effect.json",
+        effect,
+        label="source changed update effect",
+    )
+    result = {
+        "schema_version": "fdai.source-changed-update.v1",
+        "state": "applied",
+        "change_plan_digest": plan["plan_digest"],
+        "services": services,
+        "service_receipts": receipts,
+        "elapsed_ms": round((time.monotonic() - started) * 1000),
+        "effect_verified": True,
+        "effect_receipt_digest": effect["receipt_digest"],
+        "mutation_performed": True,
+        "deployment_ready": False,
+    }
+    result["receipt_digest"] = canonical_digest(result)
+    return result
+
+
+def _service_receipt_summary(
+    receipt: dict[str, object],
+    *,
+    expected_service: str,
+    expected_source_commit: str,
+) -> dict[str, object]:
+    receipt_digest = receipt.get("receipt_digest")
+    image_digest = receipt.get("image_digest")
+    if (
+        receipt.get("schema_version") != "fdai.source-service-update.v1"
+        or receipt.get("state") != "applied"
+        or receipt.get("service") != expected_service
+        or receipt.get("source_commit") != expected_source_commit
+        or not isinstance(receipt_digest, str)
+        or _DIGEST.fullmatch(receipt_digest) is None
+        or not isinstance(image_digest, str)
+        or _IMAGE_DIGEST.fullmatch(image_digest) is None
+        or any(
+            receipt.get(key) is not True
+            for key in (
+                "effect_verified",
+                "peer_state_unchanged_verified",
+                "terraform_zero_change_verified",
+            )
+        )
+    ):
+        raise ValueError("source changed update received incomplete service effect evidence")
+    return {
+        "service": expected_service,
+        "source_commit": expected_source_commit,
+        "receipt_digest": receipt_digest,
+        "image_digest": image_digest,
+    }
+
+
+def _persist_exact(path: Path, value: dict[str, object], *, label: str) -> None:
+    if path.exists() or path.is_symlink():
+        retained = load_json_object(
+            read_private_bytes(path, max_bytes=1024 * 1024),
+            label=label,
+        )
+        if retained != value:
+            raise ValueError(f"retained {label} differs")
+        return
+    write_private_bytes(path, canonical_bytes(value))

fdai_deployment_cli/source_deploy.py

@@ -0,0 +1,170 @@
+"""Prepare connected source deployments without constructing or trusting a release kit."""
+
+from __future__ import annotations
+
+import fcntl
+import os
+import re
+import stat
+from pathlib import Path
+
+from fdai_deployment_cli.contracts import canonical_bytes, canonical_digest, load_json_object
+from fdai_deployment_cli.private_output import read_private_bytes, write_private_bytes
+from fdai_deployment_cli.runtime_profile import RuntimeDeploymentProfile
+from fdai_deployment_cli.source_input import inspect_source
+from fdai_deployment_cli.source_snapshot import materialize_source, verify_source_snapshot
+
+
+def prepare_source_deployment(
+    *,
+    source_root: Path,
+    work_dir: Path,
+    runtime_profile: RuntimeDeploymentProfile,
+    region: str,
+    monthly_cost_ceiling: int,
+    hub_selection_digest: str | None = None,
+) -> dict[str, object]:
+    """Seal and reverify one connected dev source run without cloud access or execution.
+
+    A mode-specific work directory cannot adopt kit state, another source or runtime
+    profile. A partial snapshot is retained and blocked rather than silently replaced.
+    The receipt proves local preparation only and never grants apply or Trial authority.
+    """
+    if runtime_profile.runtime_platform.value != "aks" or (
+        runtime_profile.database_placement.value not in {"postgres-flex", "postgres-aks"}
+    ):
+        raise ValueError("source deployment currently requires AKS")
+    if re.fullmatch(r"[a-z][a-z0-9]+", region) is None:
+        raise ValueError("source deployment region is invalid")
+    if type(monthly_cost_ceiling) is not int or monthly_cost_ceiling <= 0:
+        raise ValueError("source deployment cost review ceiling must be positive")
+    source = inspect_source(source_root)
+    work_dir = work_dir.absolute()
+    if (work_dir / "hub-images").exists() and hub_selection_digest is None:
+        raise ValueError("source builds cannot reuse a Hub-image work directory")
+    if hub_selection_digest is not None:
+        from fdai_deployment_cli.hub_image_trust import load_selection
+
+        selection = load_selection(work_dir / "hub-images/selection.json", hub_selection_digest)
+        if selection.source_commit != source.commit:
+            raise ValueError("Hub images and source support revisions differ")
+    if work_dir.resolve().is_relative_to(source.root):
+        raise ValueError("source deployment work directory must be outside the selected checkout")
+    work_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
+    details = work_dir.lstat()
+    if (
+        not stat.S_ISDIR(details.st_mode)
+        or details.st_uid != os.geteuid()
+        or stat.S_IMODE(details.st_mode) != 0o700
+    ):
+        raise ValueError("source work directory must be a private owned directory")
+    from fdai_deployment_cli.private_output import _open_private_parent
+
+    parent = _open_private_parent(work_dir / "source.lock")
+    try:
+        lock = os.open(
+            "source.lock",
+            os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK,
+            0o600,
+            dir_fd=parent,
+        )
+    finally:
+        os.close(parent)
+    try:
+        lock_stat = os.fstat(lock)
+        if (
+            not stat.S_ISREG(lock_stat.st_mode)
+            or lock_stat.st_uid != os.geteuid()
+            or lock_stat.st_nlink != 1
+            or stat.S_IMODE(lock_stat.st_mode) != 0o600
+        ):
+            raise ValueError("source deployment lock identity is invalid")
+        try:
+            fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            raise ValueError("source deployment preparation is already active") from None
+        intent = {
+            "schema_version": "fdai.source-deployment-intent.v1",
+            "source": source.to_mapping(),
+            "source_input_digest": source.digest,
+            "runtime_profile": runtime_profile.to_mapping(),
+            "environment": "dev",
+            "region": region,
+            "monthly_cost_ceiling": monthly_cost_ceiling,
+        }
+        if hub_selection_digest is not None:
+            intent["hub_selection_digest"] = hub_selection_digest
+            intent["artifact_source"] = "hub-signed-images"
+        intent_path = work_dir / "source-intent.json"
+        if intent_path.exists():
+            prior = load_json_object(
+                read_private_bytes(intent_path, max_bytes=65_536), label="source intent"
+            )
+            if prior != intent:
+                changed = sorted(
+                    key for key in set(prior) | set(intent) if prior.get(key) != intent.get(key)
+                )
+                raise ValueError(
+                    "retained source deployment intent differs; preserve the existing run. "
+                    f"Repeat the original values for: {', '.join(changed)}"
+                )
+        else:
+            expected_entries = {"source.lock"}
+            if hub_selection_digest is not None:
+                expected_entries.add("hub-images")
+            if {path.name for path in work_dir.iterdir()} != expected_entries:
+                raise ValueError("source deployment cannot adopt existing or partial work state")
+            write_private_bytes(intent_path, canonical_bytes(intent))
+        receipt_path = work_dir / "source-preparation.json"
+        snapshot = work_dir / "source-snapshot"
+        if receipt_path.exists():
+            receipt = load_json_object(
+                read_private_bytes(receipt_path, max_bytes=65_536), label="source preparation"
+            )
+            digest = receipt.pop("receipt_digest", None)
+            if canonical_digest(receipt) != digest or receipt.get(
+                "intent_digest"
+            ) != canonical_digest(intent):
+                raise ValueError("source preparation receipt binding is invalid")
+            snapshot_digest = receipt.get("source_snapshot_digest")
+            if not isinstance(snapshot_digest, str):
+                raise ValueError("source snapshot digest is unavailable")
+            if (
+                verify_source_snapshot(snapshot, expected_digest=snapshot_digest)
+                != source.to_mapping()
+            ):
+                raise ValueError("source snapshot differs from the selected checkout")
+        else:
+            if snapshot.exists() or snapshot.is_symlink():
+                raise ValueError(
+                    "incomplete source snapshot requires review; no automatic replacement"
+                )
+            snapshot_digest = materialize_source(source, snapshot)
+        result: dict[str, object] = {
+            "schema_version": "fdai.source-deployment-preparation.v1",
+            "state": "prepared",
+            "provenance": "operator-selected-source",
+            "source_commit": source.commit,
+            "source_input_digest": source.digest,
+            "source_snapshot_digest": snapshot_digest,
+            "intent_digest": canonical_digest(intent),
+            "runtime_profile_digest": runtime_profile.digest,
+            "release_signature_verified": False,
+            "apply_authorized": False,
+            "mutation_performed": False,
+            "deployment_ready": False,
+            "subscription_ready": False,
+        }
+        if hub_selection_digest is not None:
+            result["hub_selection_digest"] = hub_selection_digest
+            result["image_artifact_source"] = "hub-signed-images"
+            result["image_signature_verified"] = True
+        result["receipt_digest"] = canonical_digest(result)
+        source.reverify()
+        if not receipt_path.exists():
+            write_private_bytes(receipt_path, canonical_bytes(result))
+        elif read_private_bytes(receipt_path, max_bytes=65_536) != canonical_bytes(result):
+            raise ValueError("retained source preparation receipt differs")
+        return result
+    finally:
+        os.close(lock)