fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/standalone_residual_successor.py

@@ -0,0 +1,431 @@
+"""Govern one create-only successor after a residual apply is verified incomplete."""
+
+from __future__ import annotations
+
+import json
+import subprocess
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+
+from fdai_deployment_cli.contracts import canonical_digest
+from fdai_deployment_cli.private_output import write_private_output
+from fdai_deployment_cli.standalone_host_state import (
+    file_digest,
+    moment,
+    private_json,
+    replace_private_json,
+)
+from fdai_deployment_cli.standalone_host_values import plan_summary
+from fdai_deployment_cli.standalone_residual_apply import (
+    _DIGEST,
+    _STAGES,
+    _required_digest,
+    _required_source_commit,
+    _runtime_platform,
+    _runtime_profile_digest,
+    _validate_residual_claim,
+    _zero_change,
+    seal_terraform_plan,
+)
+from fdai_deployment_cli.standalone_review import validate_plan_review
+
+
+def successor_prerequisite_verified(work_dir: Path, stage: str) -> bool:
+    """Require completed focused private access before the one substrate successor."""
+
+    if stage != "substrate":
+        return False
+    receipt_path = work_dir / "access-receipt.json"
+    if not receipt_path.exists() or receipt_path.is_symlink():
+        return False
+    receipt = private_json(receipt_path, "focused private access receipt")
+    return (
+        receipt.get("schema_version") == "fdai.standalone-application-apply-receipt.v1"
+        and receipt.get("state") == "applied"
+        and receipt.get("control_plane_readback_verified") is True
+        and receipt.get("mutation_performed") is True
+    )
+
+
+def prepare_residual_successor_review(
+    *,
+    work_dir: Path,
+    stage: str,
+    context: dict[str, object],
+    infra: Path,
+    variables: Path,
+    targets: tuple[str, ...],
+    original_review: dict[str, object],
+    original_claim: dict[str, object],
+    residual_review: dict[str, object],
+    residual_claim: dict[str, object],
+    successor_prerequisite_verified: bool,
+) -> dict[str, object]:
+    """Create one fresh create-only successor plan after verified residual non-convergence."""
+
+    _validate_residual_claim(
+        stage=stage,
+        context=context,
+        original_review=original_review,
+        original_claim=original_claim,
+        residual_review=residual_review,
+        residual_claim=residual_claim,
+    )
+    if not successor_prerequisite_verified:
+        raise ValueError("standalone residual successor prerequisite is not verified")
+    operation = _operation(stage)
+    plan_path = work_dir / f"{operation}.tfplan"
+    review_path = work_dir / f"{operation}-review.json"
+    claim_path = work_dir / f"{operation}-claim.json"
+    if claim_path.exists() or claim_path.is_symlink():
+        raise ValueError("standalone residual successor claim already exists")
+    plan_path.unlink(missing_ok=True)
+    review_path.unlink(missing_ok=True)
+    command = [
+        "terraform",
+        "plan",
+        "-detailed-exitcode",
+        "-input=false",
+        "-no-color",
+        f"-var-file={variables}",
+        f"-out={plan_path}",
+        *(f"-target={target}" for target in targets),
+    ]
+    completed = subprocess.run(
+        command,
+        cwd=infra,
+        check=False,
+        capture_output=True,
+        timeout=1800,
+        umask=0o077,
+    )
+    if completed.returncode != 2:
+        plan_path.unlink(missing_ok=True)
+        raise ValueError("standalone residual successor plan is unavailable")
+    seal_terraform_plan(plan_path)
+    shown = subprocess.run(
+        ("terraform", "show", "-json", str(plan_path)),
+        cwd=infra,
+        check=False,
+        capture_output=True,
+        text=True,
+        timeout=300,
+        umask=0o077,
+    )
+    if shown.returncode != 0:
+        raise ValueError("standalone residual successor projection failed")
+    try:
+        summary = plan_summary(json.loads(shown.stdout))
+    except json.JSONDecodeError as exc:
+        raise ValueError("standalone residual successor projection is invalid") from exc
+    counts = summary.get("action_counts")
+    if (
+        not isinstance(counts, dict)
+        or type(counts.get("create")) is not int
+        or counts["create"] <= 0
+        or any(counts.get(action, 0) != 0 for action in ("update", "delete"))
+        or type(counts.get("replace", 0)) is not int
+        or counts.get("replace", 0) not in {0, 1}
+        or (counts.get("replace", 0) == 1 and stage != "application")
+    ):
+        raise ValueError(
+            "standalone residual successor must contain creates and at most one application replacement"
+        )
+    review: dict[str, object] = {
+        "schema_version": "fdai.standalone-application-plan.v1",
+        "stage": stage,
+        "plan_digest": file_digest(plan_path),
+        "target_binding": _required_digest(context, "target_binding"),
+        "source_commit": _required_source_commit(context),
+        "runtime_profile_digest": _runtime_profile_digest(context),
+        "runtime_platform": _runtime_platform(context),
+        "summary": summary,
+        "residual_successor": {
+            "operation": operation,
+            "original_claim_digest": canonical_digest(original_claim),
+            "residual_plan_digest": residual_review["plan_digest"],
+            "residual_claim_digest": canonical_digest(residual_claim),
+        },
+        "expires_at": moment(datetime.now(UTC) + timedelta(hours=1)),
+        "mutation_performed": False,
+        "subscription_ready": False,
+    }
+    review["review_digest"] = canonical_digest(review)
+    replace_private_json(review_path, review)
+    return review
+
+
+def apply_residual_successor(
+    *,
+    work_dir: Path,
+    stage: str,
+    context: dict[str, object],
+    infra: Path,
+    variables: Path,
+    targets: tuple[str, ...],
+    original_review: dict[str, object],
+    original_claim: dict[str, object],
+    residual_review: dict[str, object],
+    residual_claim: dict[str, object],
+    successor_review: dict[str, object],
+    approval: dict[str, object],
+    effect_readback: Callable[[], bool],
+) -> dict[str, object]:
+    """Apply one exact-approved create-only successor and prohibit another successor."""
+
+    _validate_review(
+        stage=stage,
+        context=context,
+        original_review=original_review,
+        original_claim=original_claim,
+        residual_review=residual_review,
+        residual_claim=residual_claim,
+        successor_review=successor_review,
+    )
+    operation = _operation(stage)
+    plan_path = work_dir / f"{operation}.tfplan"
+    if file_digest(plan_path) != successor_review["plan_digest"]:
+        raise ValueError("standalone residual successor plan changed before apply")
+    claim_path = work_dir / f"{operation}-claim.json"
+    claim = _claim(
+        stage=stage,
+        context=context,
+        original_claim=original_claim,
+        residual_claim=residual_claim,
+        successor_review=successor_review,
+        approval=approval,
+    )
+    try:
+        write_private_output(
+            claim_path,
+            json.dumps(claim, sort_keys=True, separators=(",", ":")) + "\n",
+        )
+    except FileExistsError as exc:
+        raise ValueError(
+            "standalone residual successor claim already exists; automatic retry is blocked"
+        ) from exc
+    completed = subprocess.run(
+        ("terraform", "apply", "-input=false", "-no-color", str(plan_path)),
+        cwd=infra,
+        check=False,
+        capture_output=True,
+        timeout=7200,
+        umask=0o077,
+    )
+    if completed.returncode != 0:
+        raise ValueError(
+            f"{stage} residual successor apply failed; verification-only recovery is required"
+        )
+    if not effect_readback() or not _zero_change(infra=infra, variables=variables, targets=targets):
+        raise ValueError(f"{stage} residual successor did not converge")
+    return _write_receipt(
+        work_dir=work_dir,
+        stage=stage,
+        context=context,
+        original_review=original_review,
+        original_claim=original_claim,
+        residual_review=residual_review,
+        residual_claim=residual_claim,
+        successor_review=successor_review,
+        successor_claim=claim,
+        verification_only=False,
+    )
+
+
+def recover_residual_successor(
+    *,
+    work_dir: Path,
+    stage: str,
+    context: dict[str, object],
+    infra: Path,
+    variables: Path,
+    targets: tuple[str, ...],
+    original_review: dict[str, object],
+    original_claim: dict[str, object],
+    residual_review: dict[str, object],
+    residual_claim: dict[str, object],
+    effect_readback: Callable[[], bool],
+) -> dict[str, object]:
+    """Verify one claimed successor without permitting any further apply."""
+
+    operation = _operation(stage)
+    review = private_json(work_dir / f"{operation}-review.json", "residual successor review")
+    claim = private_json(work_dir / f"{operation}-claim.json", "residual successor claim")
+    _validate_review(
+        stage=stage,
+        context=context,
+        original_review=original_review,
+        original_claim=original_claim,
+        residual_review=residual_review,
+        residual_claim=residual_claim,
+        successor_review=review,
+        allow_expired=True,
+    )
+    expected = _claim_binding(
+        stage=stage,
+        context=context,
+        original_claim=original_claim,
+        residual_claim=residual_claim,
+        successor_review=review,
+    )
+    if (
+        claim.get("schema_version") != "fdai.standalone-residual-successor-claim.v1"
+        or any(claim.get(key) != value for key, value in expected.items())
+        or not isinstance(claim.get("approval_digest"), str)
+        or _DIGEST.fullmatch(str(claim["approval_digest"])) is None
+        or not isinstance(claim.get("claimed_at"), str)
+        or claim.get("mutation_performed") is not False
+    ):
+        raise ValueError("standalone residual successor claim is invalid")
+    if not _zero_change(infra=infra, variables=variables, targets=targets):
+        raise ValueError("standalone residual successor is not recoverably converged")
+    if not effect_readback():
+        raise ValueError("standalone residual successor readback is incomplete")
+    return _write_receipt(
+        work_dir=work_dir,
+        stage=stage,
+        context=context,
+        original_review=original_review,
+        original_claim=original_claim,
+        residual_review=residual_review,
+        residual_claim=residual_claim,
+        successor_review=review,
+        successor_claim=claim,
+        verification_only=True,
+    )
+
+
+def _validate_review(
+    *,
+    stage: str,
+    context: dict[str, object],
+    original_review: dict[str, object],
+    original_claim: dict[str, object],
+    residual_review: dict[str, object],
+    residual_claim: dict[str, object],
+    successor_review: dict[str, object],
+    allow_expired: bool = False,
+) -> None:
+    _validate_residual_claim(
+        stage=stage,
+        context=context,
+        original_review=original_review,
+        original_claim=original_claim,
+        residual_review=residual_review,
+        residual_claim=residual_claim,
+    )
+    validated_stage, _destructive = validate_plan_review(
+        successor_review, allow_expired=allow_expired
+    )
+    binding = successor_review.get("residual_successor")
+    if (
+        validated_stage != stage
+        or successor_review.get("target_binding") != context.get("target_binding")
+        or successor_review.get("source_commit") != context.get("source_commit")
+        or _runtime_profile_digest(successor_review) != _runtime_profile_digest(context)
+        or not isinstance(binding, dict)
+        or binding
+        != {
+            "operation": _operation(stage),
+            "original_claim_digest": canonical_digest(original_claim),
+            "residual_plan_digest": residual_review.get("plan_digest"),
+            "residual_claim_digest": canonical_digest(residual_claim),
+        }
+    ):
+        raise ValueError("standalone residual successor plan binding is invalid")
+
+
+def _claim(
+    *,
+    stage: str,
+    context: dict[str, object],
+    original_claim: dict[str, object],
+    residual_claim: dict[str, object],
+    successor_review: dict[str, object],
+    approval: dict[str, object],
+) -> dict[str, object]:
+    return {
+        "schema_version": "fdai.standalone-residual-successor-claim.v1",
+        **_claim_binding(
+            stage=stage,
+            context=context,
+            original_claim=original_claim,
+            residual_claim=residual_claim,
+            successor_review=successor_review,
+        ),
+        "approval_digest": canonical_digest(approval),
+        "claimed_at": moment(datetime.now(UTC)),
+        "mutation_performed": False,
+    }
+
+
+def _claim_binding(
+    *,
+    stage: str,
+    context: dict[str, object],
+    original_claim: dict[str, object],
+    residual_claim: dict[str, object],
+    successor_review: dict[str, object],
+) -> dict[str, object]:
+    original_claim_digest = canonical_digest(original_claim)
+    residual_claim_digest = canonical_digest(residual_claim)
+    plan_digest = successor_review["plan_digest"]
+    return {
+        "stage": stage,
+        "operation": _operation(stage),
+        "original_claim_digest": original_claim_digest,
+        "residual_claim_digest": residual_claim_digest,
+        "plan_digest": plan_digest,
+        "idempotency_key": canonical_digest(
+            {
+                "target_binding": _required_digest(context, "target_binding"),
+                "original_claim_digest": original_claim_digest,
+                "residual_claim_digest": residual_claim_digest,
+                "plan_digest": plan_digest,
+            }
+        ),
+    }
+
+
+def _write_receipt(
+    *,
+    work_dir: Path,
+    stage: str,
+    context: dict[str, object],
+    original_review: dict[str, object],
+    original_claim: dict[str, object],
+    residual_review: dict[str, object],
+    residual_claim: dict[str, object],
+    successor_review: dict[str, object],
+    successor_claim: dict[str, object],
+    verification_only: bool,
+) -> dict[str, object]:
+    receipt: dict[str, object] = {
+        "schema_version": "fdai.standalone-residual-successor-receipt.v1",
+        "state": "applied",
+        "stage": stage,
+        "plan_digest": successor_review["plan_digest"],
+        "original_plan_digest": original_review["plan_digest"],
+        "residual_plan_digest": residual_review["plan_digest"],
+        "runtime_profile_digest": _runtime_profile_digest(context),
+        "original_claim_digest": canonical_digest(original_claim),
+        "residual_claim_digest": canonical_digest(residual_claim),
+        "successor_claim_digest": canonical_digest(successor_claim),
+        "control_plane_readback_verified": True,
+        "terraform_zero_change_verified": True,
+        "residual_recovery": True,
+        "residual_successor": True,
+        "verification_only_recovery": verification_only,
+        "mutation_performed": True,
+        "subscription_ready": False,
+    }
+    receipt["receipt_digest"] = canonical_digest(receipt)
+    replace_private_json(work_dir / f"{stage}-receipt.json", receipt)
+    return receipt
+
+
+def _operation(stage: str) -> str:
+    if stage not in _STAGES:
+        raise ValueError("standalone residual successor stage is invalid")
+    return f"{stage}-residual-successor"

fdai_deployment_cli/standalone_review.py

@@ -0,0 +1,266 @@
+"""Validate the managed-host plan review before rendering or naming an approval file."""
+
+from __future__ import annotations
+
+import re
+from datetime import UTC, datetime
+from typing import Any
+
+from fdai_deployment_cli.contracts import canonical_digest
+
+_FIELDS = frozenset(
+    {
+        "schema_version",
+        "stage",
+        "plan_digest",
+        "review_digest",
+        "target_binding",
+        "source_commit",
+        "runtime_profile_digest",
+        "runtime_platform",
+        "summary",
+        "expires_at",
+        "mutation_performed",
+        "subscription_ready",
+    }
+)
+_LEGACY_FIELDS = _FIELDS - {"runtime_profile_digest", "runtime_platform"}
+_SERVICE_UPDATE_FIELDS = frozenset({"service", "image", "source_commit", "update_digest"})
+_SERVICE_UPDATE_AUTHORITY_FIELDS = frozenset(
+    {"development_authority_operation", "development_authority_profile_digest"}
+)
+_HISTORICAL_RECONCILIATION_FIELDS = frozenset({"operation", "variables_digest", "mutations"})
+_RESIDUAL_RECOVERY_FIELDS = frozenset(
+    {"operation", "original_plan_digest", "original_claim_digest"}
+)
+_RESIDUAL_SUCCESSOR_FIELDS = frozenset(
+    {
+        "operation",
+        "original_claim_digest",
+        "residual_plan_digest",
+        "residual_claim_digest",
+    }
+)
+_ACTIONS = frozenset({"create", "update", "delete", "replace", "read", "no-op"})
+_ERROR = "standalone plan review is invalid or expired; request a current exact plan"
+
+
+def validate_plan_review(review: dict[str, Any], *, allow_expired: bool = False) -> tuple[str, int]:
+    """Return a safe stage and destructive count without granting execution authority."""
+
+    stage = review.get("stage")
+    summary = review.get("summary")
+    if (
+        set(review)
+        not in (
+            _LEGACY_FIELDS,
+            _LEGACY_FIELDS | {"service_update"},
+            _FIELDS,
+            _FIELDS | {"service_update"},
+            _FIELDS | {"operation"},
+            _FIELDS | {"operation", "service_update"},
+            _FIELDS | {"historical_reconciliation"},
+            _FIELDS | {"residual_recovery"},
+            _FIELDS | {"residual_successor"},
+        )
+        or review.get("schema_version") != "fdai.standalone-application-plan.v1"
+        or not isinstance(stage, str)
+        or stage not in {"access", "substrate", "runtime", "database", "application"}
+        or review.get("mutation_performed") is not False
+        or review.get("subscription_ready") is not False
+        or not isinstance(summary, dict)
+        or not set(summary).issubset({"action_counts", "resource_type_counts", "resource_changes"})
+    ):
+        raise ValueError(_ERROR)
+    service_update = review.get("service_update")
+    service_update_fields = set(service_update) if isinstance(service_update, dict) else set()
+    if service_update is not None and (
+        stage != "application"
+        or not isinstance(service_update, dict)
+        or service_update_fields
+        not in {
+            _SERVICE_UPDATE_FIELDS,
+            _SERVICE_UPDATE_FIELDS | _SERVICE_UPDATE_AUTHORITY_FIELDS,
+        }
+        or service_update.get("service")
+        not in {
+            "core-control-plane",
+            "document-ingestion-api",
+            "document-processing-worker",
+            "isolated-executor",
+            "operator-service",
+        }
+        or not isinstance(service_update.get("image"), str)
+        or re.fullmatch(
+            r"[a-z0-9.-]+(?::[0-9]+)?/[a-z0-9._/-]+@sha256:[0-9a-f]{64}",
+            service_update["image"],
+        )
+        is None
+        or not isinstance(service_update.get("source_commit"), str)
+        or re.fullmatch(r"[0-9a-f]{40}", service_update["source_commit"]) is None
+        or not isinstance(service_update.get("update_digest"), str)
+        or re.fullmatch(r"[0-9a-f]{64}", service_update["update_digest"]) is None
+    ):
+        raise ValueError(_ERROR)
+    if service_update_fields == _SERVICE_UPDATE_FIELDS | _SERVICE_UPDATE_AUTHORITY_FIELDS:
+        if not isinstance(service_update, dict):
+            raise TypeError(_ERROR)
+        authority_operation = service_update["development_authority_operation"]
+        authority_digest = service_update["development_authority_profile_digest"]
+        if (
+            service_update["service"] != "core-control-plane"
+            or authority_operation not in {"select", "clear"}
+            or (
+                authority_operation == "select"
+                and (
+                    not isinstance(authority_digest, str)
+                    or re.fullmatch(r"[0-9a-f]{64}", authority_digest) is None
+                )
+            )
+            or (authority_operation == "clear" and authority_digest != "")
+        ):
+            raise ValueError(_ERROR)
+    if "operation" in review and not _operation_matches_stage(
+        stage, review.get("operation"), service_update
+    ):
+        raise ValueError(_ERROR)
+    historical_reconciliation = review.get("historical_reconciliation")
+    if historical_reconciliation is not None and (
+        stage != "application"
+        or not isinstance(historical_reconciliation, dict)
+        or set(historical_reconciliation) != _HISTORICAL_RECONCILIATION_FIELDS
+        or historical_reconciliation.get("operation") != "historical-reconciliation"
+        or not isinstance(historical_reconciliation.get("variables_digest"), str)
+        or re.fullmatch(r"[0-9a-f]{64}", str(historical_reconciliation["variables_digest"])) is None
+        or not isinstance(historical_reconciliation.get("mutations"), list)
+        or not historical_reconciliation["mutations"]
+        or len(historical_reconciliation["mutations"]) > 64
+        or historical_reconciliation["mutations"]
+        != sorted(set(historical_reconciliation["mutations"]))
+        or any(
+            not isinstance(item, str)
+            or not 0 < len(item) <= 512
+            or not item.isascii()
+            or not item.isprintable()
+            for item in historical_reconciliation["mutations"]
+        )
+    ):
+        raise ValueError(_ERROR)
+    residual_recovery = review.get("residual_recovery")
+    if residual_recovery is not None and (
+        not isinstance(residual_recovery, dict)
+        or set(residual_recovery) != _RESIDUAL_RECOVERY_FIELDS
+        or residual_recovery.get("operation") != f"{stage}-residual"
+        or any(
+            not isinstance(residual_recovery.get(field), str)
+            or re.fullmatch(r"[0-9a-f]{64}", str(residual_recovery[field])) is None
+            for field in ("original_plan_digest", "original_claim_digest")
+        )
+    ):
+        raise ValueError(_ERROR)
+    residual_successor = review.get("residual_successor")
+    if residual_successor is not None and (
+        not isinstance(residual_successor, dict)
+        or set(residual_successor) != _RESIDUAL_SUCCESSOR_FIELDS
+        or residual_successor.get("operation") != f"{stage}-residual-successor"
+        or any(
+            not isinstance(residual_successor.get(field), str)
+            or re.fullmatch(r"[0-9a-f]{64}", str(residual_successor[field])) is None
+            for field in (
+                "original_claim_digest",
+                "residual_plan_digest",
+                "residual_claim_digest",
+            )
+        )
+    ):
+        raise ValueError(_ERROR)
+    for key, length in (
+        ("plan_digest", 64),
+        ("review_digest", 64),
+        ("target_binding", 64),
+        ("source_commit", 40),
+    ):
+        value = review.get(key)
+        if not isinstance(value, str) or re.fullmatch(rf"[0-9a-f]{{{length}}}", value) is None:
+            raise ValueError(_ERROR)
+    if "runtime_profile_digest" in review or "runtime_platform" in review:
+        runtime_profile_digest = review.get("runtime_profile_digest")
+        if (
+            not isinstance(runtime_profile_digest, str)
+            or re.fullmatch(r"[0-9a-f]{64}", runtime_profile_digest) is None
+            or review.get("runtime_platform") not in {"aks", "container-apps"}
+        ):
+            raise ValueError(_ERROR)
+    counts = summary.get("action_counts")
+    if (
+        not isinstance(counts, dict)
+        or not counts
+        or not set(counts).issubset(_ACTIONS)
+        or any(type(count) is not int or not 0 <= count <= 5000 for count in counts.values())
+    ):
+        raise ValueError(_ERROR)
+    types = summary.get("resource_type_counts", {})
+    if (
+        not isinstance(types, dict)
+        or len(types) > 5000
+        or any(
+            not isinstance(name, str)
+            or re.fullmatch(r"[a-z][a-z0-9_]{0,127}", name) is None
+            or type(count) is not int
+            or not 0 <= count <= 5000
+            for name, count in types.items()
+        )
+    ):
+        raise ValueError(_ERROR)
+    changes = summary.get("resource_changes", [])
+    if not isinstance(changes, list) or len(changes) > 5000:
+        raise ValueError(_ERROR)
+    for change in changes:
+        if not isinstance(change, dict) or set(change) != {"address", "actions"}:
+            raise ValueError(_ERROR)
+        address, actions = change["address"], change["actions"]
+        if (
+            not isinstance(address, str)
+            or not 0 < len(address) <= 512
+            or not address.isascii()
+            or not address.isprintable()
+            or not isinstance(actions, list)
+            or not actions
+            or any(not isinstance(action, str) or action not in _ACTIONS for action in actions)
+        ):
+            raise ValueError(_ERROR)
+    expiry = review.get("expires_at")
+    if not isinstance(expiry, str):
+        raise ValueError(_ERROR)  # noqa: TRY004 - public validator contract
+    try:
+        expires = datetime.fromisoformat(expiry)
+    except ValueError as exc:
+        raise ValueError(_ERROR) from exc
+    if expires.tzinfo is None or (not allow_expired and expires <= datetime.now(UTC)):
+        raise ValueError(_ERROR)
+    document = {key: value for key, value in review.items() if key != "review_digest"}
+    if review["review_digest"] != canonical_digest(document):
+        raise ValueError(_ERROR)
+    return stage, int(counts.get("delete", 0)) + int(counts.get("replace", 0))
+
+
+def _operation_matches_stage(stage: str, operation: object, service_update: object) -> bool:
+    """Bind the managed host's operation name to the reviewed stage or service update."""
+
+    if not isinstance(operation, str):
+        return False
+    if isinstance(service_update, dict):
+        service = str(service_update["service"])
+        return (
+            re.fullmatch(rf"service-update-{re.escape(service)}-[0-9a-f]{{12}}", operation)
+            is not None
+        )
+    if stage == "runtime":
+        return operation in {"runtime", "runtime-cluster"}
+    if stage == "application":
+        return operation in {
+            "application",
+            "application-input-rebind-update",
+            "license-application-update",
+        }
+    return operation == stage