fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/standalone_application_completion.py

@@ -0,0 +1,151 @@
+"""Complete standalone identity and application deployment from verified Foundation context."""
+
+from __future__ import annotations
+
+import importlib
+import sys
+from collections.abc import Callable
+from contextlib import redirect_stdout
+from pathlib import Path
+from typing import Any
+
+from fdai_service_contracts.product_profile import ProductAddOn
+
+from fdai_deployment_cli.application_state_adoption import ApplicationStateAdoption
+from fdai_deployment_cli.catalog_review_profile import CatalogReviewDeploymentProfile
+from fdai_deployment_cli.control_package import ControlPackage
+from fdai_deployment_cli.deployment_deadline import DeploymentDeadline
+from fdai_deployment_cli.deployment_kit import DeploymentKit
+from fdai_deployment_cli.deployment_progress import begin_stage, terminal_output
+from fdai_deployment_cli.development_authority_profile import (
+    DevelopmentAuthorityDeploymentProfile,
+)
+from fdai_deployment_cli.hub_image_trust import HubImageSelection
+from fdai_deployment_cli.notification_recipients_input import (
+    NotificationRecipientsDeploymentInput,
+)
+from fdai_deployment_cli.operational_evidence_verifier_input import (
+    OperationalEvidenceVerifierDeploymentInput,
+)
+from fdai_deployment_cli.runtime_profile import RuntimeDeploymentProfile
+from fdai_deployment_cli.standalone_application import deploy_standalone_application
+
+
+def complete_application(
+    *,
+    kit: DeploymentKit | None,
+    prepared: Any,
+    status: dict[str, Any],
+    scripts: Path,
+    deadline: DeploymentDeadline,
+    selected_runtime: RuntimeDeploymentProfile,
+    trial_token: Path | None,
+    application_state_adoption: ApplicationStateAdoption | None,
+    foundation_state_receipt_digest: str,
+    current_operator_object_id: Callable[[], str],
+    foundation_adoption_receipt_digest: str | None = None,
+    catalog_review_profile: CatalogReviewDeploymentProfile | None = None,
+    operational_evidence_verifier_input: OperationalEvidenceVerifierDeploymentInput | None = None,
+    notification_recipients: NotificationRecipientsDeploymentInput | None = None,
+    development_authority_profile: DevelopmentAuthorityDeploymentProfile | None = None,
+    clear_development_authority_profile: bool = False,
+    control_package: ControlPackage | None = None,
+    source_snapshot: Path | None = None,
+    source_snapshot_digest: str | None = None,
+    source_root: Path | None = None,
+    foundation_recovery_directory: Path | None = None,
+    hub_selection: HubImageSelection | None = None,
+) -> dict[str, object]:
+    """Configure identity and complete one exact standalone application deployment."""
+
+    source_commit = str(getattr(prepared, "source_commit", "") or getattr(kit, "source_commit", ""))
+    if not source_commit:
+        raise ValueError("application source commit is unavailable")
+    entra_bindings: dict[str, str] | None = None
+    if selected_runtime.product_profile.selects(ProductAddOn.ENTERPRISE_IDENTITY_GOVERNANCE):
+        begin_stage("identity")
+        sys.path.insert(0, str(scripts))
+        try:
+            supervisor = importlib.import_module("genesis_supervisor")
+            entra = importlib.import_module("genesis_entra")
+            approval_prompt = importlib.import_module("genesis_approval_prompt")
+            actor_digest = approval_prompt.current_actor_digest(prepared.run_binding)
+            with (
+                terminal_output("Identity configuration and any required approval"),
+                redirect_stdout(sys.stderr),
+            ):
+                entra_bindings = supervisor._configure_entra(
+                    prepared=prepared,
+                    status=status,
+                    actor_digest=actor_digest,
+                    plan=entra.plan_entra(
+                        spa_display_name=entra.scoped_spa_display_name(str(prepared.target_binding))
+                    ),
+                    foundation_handoff_path=(
+                        foundation_recovery_directory / "recovery-private-handoff.json"
+                        if foundation_recovery_directory is not None
+                        else None
+                    ),
+                )
+            entra_bindings["CURRENT_OPERATOR_OBJECT_ID"] = current_operator_object_id()
+        finally:
+            sys.path.remove(str(scripts))
+    application = deploy_standalone_application(
+        kit=kit,
+        prepared=prepared,
+        foundation_status=status,
+        entra_bindings=entra_bindings,
+        scripts=scripts,
+        trial_token=trial_token,
+        timeout_seconds=deadline.remaining(),
+        runtime_profile=selected_runtime,
+        application_state_adoption=application_state_adoption,
+        catalog_review_profile=(
+            catalog_review_profile or CatalogReviewDeploymentProfile.unselected()
+        ),
+        operational_evidence_verifier_input=operational_evidence_verifier_input,
+        notification_recipients=notification_recipients,
+        development_authority_profile=development_authority_profile,
+        clear_development_authority_profile=clear_development_authority_profile,
+        control_package=control_package,
+        source_snapshot=source_snapshot,
+        source_snapshot_digest=source_snapshot_digest,
+        source_root=source_root,
+        foundation_recovery_directory=foundation_recovery_directory,
+        **({"hub_selection": hub_selection} if hub_selection is not None else {}),
+    )
+    deadline.remaining()
+    result: dict[str, object] = {
+        "schema_version": "fdai.standalone-azure-deployment.v2",
+        "state": "deployment-ready",
+        "source_commit": source_commit,
+        "foundation_state_receipt_digest": foundation_state_receipt_digest,
+        "application_receipt_digest": application["receipt_digest"],
+        "catalog_review_receipt_digest": application["catalog_review_receipt_digest"],
+        "catalog_review_state": application["catalog_review_state"],
+        "runtime_profile_digest": selected_runtime.digest,
+        "runtime_platform": selected_runtime.runtime_platform.value,
+        "database_placement": selected_runtime.database_placement.value,
+        "product_profile": selected_runtime.product_profile.model_dump(mode="json"),
+        "application_converged": True,
+        "deployment_ready": True,
+        "inventory_ready": application.get("inventory_ready") is True,
+        "license_mode": application["license_mode"],
+        "mutation_performed": True,
+        "subscription_ready": False,
+    }
+    if source_snapshot_digest is not None:
+        result["source_snapshot_digest"] = source_snapshot_digest
+        result["provenance"] = "operator-selected-source"
+        result["release_signature_verified"] = False
+    elif kit is not None:
+        result["kit_manifest_digest"] = kit.verification.manifest_digest
+        result["runtime_release_digest"] = kit.runtime.digest
+    if control_package is not None:
+        result["control_package_digest"] = control_package.archive_digest
+        result["control_package_version"] = control_package.version
+    if foundation_adoption_receipt_digest is not None:
+        result["foundation_adoption_receipt_digest"] = foundation_adoption_receipt_digest
+    if hub_selection is not None:
+        result.update(hub_selection.metadata())
+    return result

fdai_deployment_cli/standalone_application_input_recovery.py

@@ -0,0 +1,107 @@
+"""Recover one authoritative AKS application input after an ambiguous apply."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from fdai_deployment_cli.contracts import canonical_digest
+from fdai_deployment_cli.private_output import write_private_output
+from fdai_deployment_cli.standalone_host_state import (
+    private_json,
+    replace_private_json,
+)
+
+
+def bind_authoritative_backend_nsg(
+    *,
+    work_dir: Path,
+    retained: dict[str, object],
+    current: dict[str, object],
+) -> bool:
+    """Bind the sole empty-to-authoritative NSG transition under retained claims."""
+
+    if retained == current:
+        return False
+    original_paths = ("application-claim.json", "application-receipt.json")
+    residual_paths = (
+        "application-claim.json",
+        "application-residual-claim.json",
+        "application-residual-review.json",
+    )
+    ordinary_applied = all((work_dir / name).is_file() for name in original_paths)
+    residual_claimed = all((work_dir / name).is_file() for name in residual_paths)
+    if not ordinary_applied and not residual_claimed:
+        raise ValueError("retained workloads.auto.tfvars.json differs")
+    old_gateway = retained.get("browser_gateway")
+    new_gateway = current.get("browser_gateway")
+    if not isinstance(old_gateway, dict) or not isinstance(new_gateway, dict):
+        raise TypeError("retained workloads.auto.tfvars.json differs")
+    old_nsg = old_gateway.get("backend_nsg_id")
+    new_nsg = new_gateway.get("backend_nsg_id")
+    expected = {
+        **retained,
+        "browser_gateway": {**old_gateway, "backend_nsg_id": new_nsg},
+    }
+    if old_nsg != "" or not isinstance(new_nsg, str) or not new_nsg or expected != current:
+        raise ValueError("retained workloads.auto.tfvars.json differs")
+    original_claim = private_json(work_dir / "application-claim.json", "application claim")
+    claim = {
+        "schema_version": "fdai.application-input-rebind-claim.v1",
+        "field": "browser_gateway.backend_nsg_id",
+        "prior_values_digest": canonical_digest(retained),
+        "current_values_digest": canonical_digest(current),
+        "original_claim_digest": canonical_digest(original_claim),
+        "mutation_performed": False,
+    }
+    if residual_claimed:
+        claim["residual_claim_digest"] = canonical_digest(
+            private_json(
+                work_dir / "application-residual-claim.json",
+                "application residual claim",
+            )
+        )
+    else:
+        claim["application_receipt_digest"] = canonical_digest(
+            private_json(work_dir / "application-receipt.json", "application receipt")
+        )
+    claim["claim_digest"] = canonical_digest(claim)
+    claim_path = work_dir / "application-input-rebind-claim.json"
+    if claim_path.exists():
+        if private_json(claim_path, "application input rebind claim") != claim:
+            raise ValueError("application input rebind claim differs")
+    else:
+        write_private_output(
+            claim_path,
+            json.dumps(claim, sort_keys=True, separators=(",", ":")) + "\n",
+        )
+    replace_private_json(work_dir / "workloads.auto.tfvars.json", current)
+    receipt = {
+        "schema_version": "fdai.application-input-rebind-receipt.v1",
+        "claim_digest": claim["claim_digest"],
+        "field": claim["field"],
+        "authoritative_value_digest": canonical_digest({"backend_nsg_id": new_nsg}),
+        "mutation_performed": True,
+        "subscription_ready": False,
+    }
+    receipt["receipt_digest"] = canonical_digest(receipt)
+    replace_private_json(work_dir / "application-input-rebind-receipt.json", receipt)
+    return True
+
+
+def successor_prerequisite_verified(work_dir: Path, stage: str) -> bool:
+    """Return whether the stage has its exact recovery prerequisite receipt."""
+
+    if stage != "application":
+        return False
+    path = work_dir / "application-input-rebind-receipt.json"
+    if not path.is_file() or path.is_symlink():
+        return False
+    receipt = private_json(path, "application input rebind receipt")
+    digest = receipt.pop("receipt_digest", None)
+    return (
+        canonical_digest(receipt) == digest
+        and receipt.get("schema_version") == "fdai.application-input-rebind-receipt.v1"
+        and receipt.get("field") == "browser_gateway.backend_nsg_id"
+        and receipt.get("mutation_performed") is True
+    )

fdai_deployment_cli/standalone_application_recovery.py

@@ -0,0 +1,116 @@
+"""Bounded same-invocation recovery for managed-host application stages."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from pathlib import Path
+from typing import Any
+
+from fdai_deployment_cli.deployment_deadline import DeploymentDeadline
+
+RemoteJson = Callable[..., dict[str, Any]]
+PlanAfterRecovery = Callable[..., tuple[dict[str, Any], str]]
+ApprovePlan = Callable[..., Path]
+RequireReceipt = Callable[[dict[str, Any], str], None]
+
+
+def converge_focused_private_access(
+    tunnel: Any,
+    *,
+    remote_root: str,
+    app_work: str,
+    prepared_root: Path,
+    remote_approval: str,
+    deadline: DeploymentDeadline,
+    remote_json: RemoteJson,
+    plan_after_recovery: PlanAfterRecovery,
+    approve_plan: ApprovePlan,
+    require_receipt: RequireReceipt,
+) -> dict[str, Any]:
+    recovery = remote_json(
+        tunnel,
+        remote_root,
+        app_work,
+        ("recover-apply", "--stage", "access"),
+        timeout=deadline.remaining(3600),
+    )
+    if recovery.get("state") == "applied":
+        require_receipt(recovery, "access")
+        return recovery
+    review, command = plan_after_recovery(
+        tunnel,
+        remote_root,
+        app_work,
+        recovery,
+        stage="access",
+        timeout=deadline.remaining(3600),
+    )
+    approval = approve_plan(prepared_root, review, deadline=deadline)
+    tunnel.ssh(("rm", "-f", "--", remote_approval), timeout=60)
+    tunnel.copy_to(approval, remote_approval, timeout=120)
+    try:
+        receipt = remote_json(
+            tunnel,
+            remote_root,
+            app_work,
+            (command, "--stage", "access", "--approval", remote_approval),
+            timeout=deadline.remaining(7200),
+        )
+    finally:
+        approval.unlink(missing_ok=True)
+        tunnel.ssh(("rm", "-f", "--", remote_approval), timeout=60)
+    require_receipt(receipt, "access")
+    return receipt
+
+
+def recover_failed_exact_apply(
+    tunnel: Any,
+    *,
+    remote_root: str,
+    app_work: str,
+    prepared_root: Path,
+    remote_approval: str,
+    stage: str,
+    deadline: DeploymentDeadline,
+    remote_json: RemoteJson,
+    plan_after_recovery: PlanAfterRecovery,
+    approve_plan: ApprovePlan,
+) -> dict[str, Any]:
+    """Verify a failed exact apply, then apply only its separately approved residual."""
+    for phase in range(2):
+        recovery = remote_json(
+            tunnel,
+            remote_root,
+            app_work,
+            ("recover-apply", "--stage", stage),
+            timeout=deadline.remaining(3600),
+        )
+        if recovery.get("state") == "applied":
+            return recovery
+        review, command = plan_after_recovery(
+            tunnel,
+            remote_root,
+            app_work,
+            recovery,
+            stage=stage,
+            timeout=deadline.remaining(3600),
+        )
+        if command != "apply-residual":
+            raise ValueError("failed exact apply did not produce bounded residual recovery")
+        approval = approve_plan(prepared_root, review, deadline=deadline)
+        tunnel.copy_to(approval, remote_approval, timeout=120)
+        try:
+            return remote_json(
+                tunnel,
+                remote_root,
+                app_work,
+                (command, "--stage", stage, "--approval", remote_approval),
+                timeout=deadline.remaining(7200),
+            )
+        except ValueError:
+            if phase == 1:
+                raise
+        finally:
+            approval.unlink(missing_ok=True)
+            tunnel.ssh(("rm", "-f", "--", remote_approval), timeout=60)
+    raise ValueError("failed exact apply exceeded its bounded residual recovery")

fdai_deployment_cli/standalone_approval_input.py

@@ -0,0 +1,24 @@
+"""Bounded interactive-input readiness for standalone plan approval."""
+
+from __future__ import annotations
+
+import select
+import sys
+
+
+def wait_for_approval_input(timeout_seconds: int) -> None:
+    """Wait only on a real terminal within the invocation's remaining budget."""
+
+    if timeout_seconds <= 0:
+        raise TimeoutError("standalone approval deadline expired; no approval was granted")
+    if not sys.stdin.isatty():
+        raise ValueError("standalone approval requires an interactive terminal")
+    try:
+        readable, _, _ = select.select([sys.stdin], [], [], timeout_seconds)
+    except (OSError, ValueError):
+        raise ValueError("standalone approval input is unavailable") from None
+    if not readable:
+        raise TimeoutError("standalone approval input timed out; no approval was granted")
+
+
+__all__ = ["wait_for_approval_input"]

fdai_deployment_cli/standalone_catalog_checkpoint.py

@@ -0,0 +1,122 @@
+"""Post-application inventory and catalog-review checkpoints."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Any
+
+from fdai_deployment_cli.contracts import canonical_digest
+from fdai_deployment_cli.deployment_progress import begin_stage, progress_detail
+from fdai_deployment_cli.standalone_aks_inventory import require_initial_inventory_receipt
+from fdai_deployment_cli.standalone_trial_activation import require_trial_activation_receipt
+
+
+@dataclass(frozen=True, slots=True)
+class PostApplicationReceipts:
+    inventory: dict[str, Any]
+    catalog_review: dict[str, Any]
+    trial_activation: dict[str, Any] | None = None
+
+    @property
+    def trial_open(self) -> bool:
+        """Whether the read-back Trial window is open under a trusted clock."""
+
+        trial = self.trial_activation
+        return trial is not None and not trial["window_ended"] and not trial["clock_blocked"]
+
+
+def run_post_application_checkpoints(
+    tunnel: Any,
+    *,
+    remote_root: str,
+    app_work: str,
+    runtime_platform: str,
+    remote_json: Callable[..., dict[str, Any]],
+) -> PostApplicationReceipts:
+    """Open the AKS Trial window, then run inventory and the selected-or-skipped review."""
+
+    trial_activation = None
+    if runtime_platform == "aks":
+        progress_detail("Opening the Trial window at the installation's anchored creation time")
+        trial_activation = require_trial_activation_receipt(
+            remote_json(tunnel, remote_root, app_work, ("activate-trial",), timeout=900)
+        )
+    begin_stage("initial-inventory")
+    progress_detail("Collecting and independently reading back the initial inventory")
+    inventory = remote_json(
+        tunnel,
+        remote_root,
+        app_work,
+        ("initial-inventory",),
+        timeout=4200,
+    )
+    require_initial_inventory_receipt(inventory, runtime_platform=runtime_platform)
+    begin_stage("catalog-review")
+    progress_detail("Publishing or explicitly skipping the frozen catalog review")
+    catalog_review = remote_json(
+        tunnel,
+        remote_root,
+        app_work,
+        ("catalog-review",),
+        timeout=600,
+    )
+    require_catalog_review_receipt(catalog_review)
+    return PostApplicationReceipts(
+        inventory=inventory,
+        catalog_review=catalog_review,
+        trial_activation=trial_activation,
+    )
+
+
+def require_catalog_review_receipt(value: dict[str, Any]) -> None:
+    """Accept only an explicit skip or independently observed draft publication."""
+
+    supplied_digest = value.get("receipt_digest")
+    material = {key: item for key, item in value.items() if key != "receipt_digest"}
+    if supplied_digest != canonical_digest(material):
+        raise ValueError("standalone catalog review receipt digest is invalid")
+    if value.get("state") == "skipped":
+        if (
+            value.get("selected") is not False
+            or value.get("reason") != "not_selected"
+            or value.get("mutation_performed") is not False
+        ):
+            raise ValueError("standalone catalog review skip receipt is invalid")
+        return
+    required_labels = value.get("required_labels")
+    observed_labels = value.get("observed_labels")
+    if (
+        value.get("state") != "draft-review-published"
+        or value.get("selected") is not True
+        or not isinstance(required_labels, list)
+        or any(not isinstance(label, str) for label in required_labels)
+        or len(required_labels) != len(set(required_labels))
+        or required_labels != sorted(required_labels)
+        or observed_labels != required_labels
+        or not {"draft", "shadow", "governance", "catalog-review"}.issubset(required_labels)
+        or sum(label.startswith("rule:") for label in required_labels) != 1
+        or sum(label.startswith("action:") for label in required_labels) != 1
+        or value.get("independent_pr_observation_verified") is not True
+        or value.get("independent_observation_scope") != "gitops-pr"
+        or value.get("durable_intent_verified") is not True
+        or value.get("durable_terminal_verified") is not True
+        or value.get("code_path_merge_authority") is not False
+        or value.get("managed_resource_mutation_status") != "unknown"
+        or value.get("managed_resource_mutation_performed") is not None
+        or re.fullmatch(
+            r"(?:[0-9a-f]{40}|[0-9a-f]{64})",
+            str(value.get("publication_head_sha", "")),
+        )
+        is None
+        or re.fullmatch(r"[0-9a-f]{64}", str(value.get("review_document_digest", ""))) is None
+    ):
+        raise ValueError("standalone selected catalog review is incomplete")
+
+
+__all__ = [
+    "PostApplicationReceipts",
+    "require_catalog_review_receipt",
+    "run_post_application_checkpoints",
+]