fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/status_projection.py

@@ -0,0 +1,97 @@
+"""Sanitized provisioning status shared by CLI and operator projections."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+from fdai_deployment_cli.compiler import GENESIS_ENTRY_IDS_BY_VERSION
+from fdai_deployment_cli.progress import ProgressSnapshot
+from fdai_deployment_cli.state import ProvisionEvent, RunState
+
+_TERMINAL_STAGE_STATES = frozenset({RunState.COMPLETED, RunState.READY})
+
+
+def project_status(
+    events: Sequence[ProvisionEvent],
+    *,
+    progress: ProgressSnapshot | None = None,
+) -> dict[str, object]:
+    """Project one bounded run without exposing target or evidence identifiers."""
+
+    if not events:
+        raise ValueError("provision journal is empty")
+    latest = events[-1]
+    if any(event.run_id != latest.run_id for event in events):
+        raise ValueError("provision journal contains multiple run ids")
+    stage_ids = GENESIS_ENTRY_IDS_BY_VERSION[latest.manifest_version]
+    completed = {
+        event.stage
+        for event in events
+        if event.state in _TERMINAL_STAGE_STATES and event.stage in stage_ids
+    }
+    stages = [
+        {
+            "id": stage,
+            "status": _stage_status(stage, latest=latest, completed=completed),
+        }
+        for stage in stage_ids
+    ]
+    currently_completed = {str(stage["id"]) for stage in stages if stage["status"] == "completed"}
+    ready = latest.state is RunState.READY
+    result: dict[str, object] = {
+        "schema_version": "fdai.provision-status.v1",
+        "type": "provision.snapshot",
+        "run_id": latest.run_id,
+        "sequence": latest.sequence,
+        "attempt": latest.attempt,
+        "state": latest.state.value,
+        "current_stage": latest.stage,
+        "stages_completed": len(currently_completed),
+        "stages_total": len(stage_ids),
+        "last_progress_at": latest.occurred_at,
+        "reason_code": latest.reason_code,
+        "ready": ready,
+        "readiness": {
+            "database": "database" in currently_completed,
+            "semantic": "semantic-defaults" in currently_completed,
+            "models": "model-deployments" in currently_completed,
+            "runtime": "console" in currently_completed,
+            "inventory": "initial-inventory" in currently_completed,
+            "system": ready,
+        },
+        "stages": stages,
+    }
+    if progress is not None:
+        if progress.sequence > latest.sequence:
+            raise ValueError("progress sequence cannot exceed the journal sequence")
+        result["checkpoints_completed"] = progress.checkpoints_completed
+        result["checkpoints_total"] = progress.checkpoints_total
+        result["inventory"] = {
+            "resources_observed": progress.resources_observed,
+            "resources_expected": progress.resources_expected,
+            "pages_completed": progress.pages_completed,
+            "pages_expected": progress.pages_expected,
+        }
+    return result
+
+
+def _stage_status(
+    stage: str,
+    *,
+    latest: ProvisionEvent,
+    completed: set[str],
+) -> str:
+    if stage == latest.stage:
+        if latest.state in _TERMINAL_STAGE_STATES:
+            return "completed"
+        if latest.state is RunState.WAITING:
+            return "waiting"
+        if latest.state in {RunState.BLOCKED, RunState.FAILED, RunState.INCOMPLETE}:
+            return latest.state.value
+        if latest.state is RunState.CANCELLED:
+            return "cancelled"
+        return "active"
+    return "completed" if stage in completed else "pending"
+
+
+__all__ = ["project_status"]

fdai_deployment_cli/support_install.py

@@ -0,0 +1,257 @@
+"""Install an isolated deployment-support interpreter from authenticated local wheels."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import shutil
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+from fdai_deployment_cli.contracts import load_json_object
+from fdai_deployment_cli.offline_kit import (
+    _copy_verified_file,
+    _read_regular,
+    verify_offline_kit,
+)
+from fdai_deployment_cli.private_output import _open_private_parent, write_private_output
+
+_PREFIX = "support/python/"
+_REQUIREMENT = re.compile(r"[A-Za-z0-9_.-]+(?:\[[A-Za-z0-9_,.-]+\])?==[A-Za-z0-9_.!+-]+")
+_HASH = re.compile(r"--hash=sha256:[0-9a-f]{64}")
+_RUNTIME_PACKAGES = {
+    "fdai-service-contracts",
+    "fdai-core-control-plane",
+    "fdai-operator-service",
+    "fdai-document-ingestion-api",
+    "fdai-document-processing-worker",
+    "fdai-isolated-executor-service",
+}
+_SUPPORT_PACKAGES = {"fdai-github-app-auth", "fdai-runtime-diagnostics"}
+
+
+class SupportInstallationError(ValueError):
+    """An authenticated support payload cannot be installed or verified."""
+
+
+def _package_versions(
+    inventory: dict[str, object], requirements: bytes, digests: dict[str, str]
+) -> dict[str, str]:
+    runtime = inventory.get("packages")
+    support = inventory.get("support_packages")
+    if not isinstance(runtime, dict) or set(runtime) != _RUNTIME_PACKAGES:
+        raise ValueError("support inventory MUST include every runtime distribution")
+    if not isinstance(support, dict) or not set(support) <= _SUPPORT_PACKAGES:
+        raise ValueError("support inventory contains unsupported workspace dependencies")
+    lines = set(requirements.decode("utf-8").splitlines())
+    versions: dict[str, str] = {}
+    for name, record in {**runtime, **support}.items():
+        if not isinstance(record, dict):
+            raise SupportInstallationError("support package record is invalid")
+        version, wheel = record.get("version"), record.get("wheel")
+        if not isinstance(version, str) or not isinstance(wheel, str):
+            raise SupportInstallationError("support package version and wheel MUST be declared")
+        digest = digests.get(_PREFIX + wheel)
+        if digest is None or f"{name}=={version} --hash=sha256:{digest}" not in lines:
+            raise ValueError(
+                "support requirements do not pin every owned wheel to its signed digest"
+            )
+        versions[name] = version
+    return versions
+
+
+def _verify_installed_packages(content: bytes, expected: dict[str, str]) -> None:
+    if len(content) > 1024 * 1024:
+        raise ValueError("installed package readback exceeds its size limit")
+    entries = json.loads(content)
+    if not isinstance(entries, list):
+        raise SupportInstallationError("installed package readback is invalid")
+    observed: dict[str, str] = {}
+    for entry in entries:
+        if not isinstance(entry, dict):
+            raise SupportInstallationError("installed package entry is invalid")
+        name, version = entry.get("name"), entry.get("version")
+        if not isinstance(name, str) or not isinstance(version, str):
+            raise SupportInstallationError("installed package identity is invalid")
+        normalized = re.sub(r"[-_.]+", "-", name.lower())
+        if normalized in observed:
+            raise ValueError("installed package readback contains duplicate distributions")
+        observed[normalized] = version
+    if any(observed.get(name) != version for name, version in expected.items()):
+        raise ValueError("installed runtime packages do not match the signed inventory")
+
+
+def _validate_requirements(content: bytes) -> None:
+    """Refuse editable, source, index, local-path, and direct-URL requirements."""
+    for raw in content.decode("utf-8").splitlines():
+        line = raw.strip().rstrip("\\").strip()
+        if not line or line.startswith("#"):
+            continue
+        if _HASH.fullmatch(line):
+            continue
+        if (
+            _REQUIREMENT.match(line) is None
+            or "@" in line
+            or "://" in line
+            or re.search(r"--(?!hash=sha256:)", line)
+        ):
+            raise ValueError(
+                "support requirements MUST contain only pinned hashed wheel requirements"
+            )
+
+
+def install_support(
+    kit: Path,
+    *,
+    work_dir: Path,
+    release_root_pem: bytes,
+    cli_version: str,
+    platform_tag: str,
+) -> dict[str, object]:
+    """Install support libraries, never runtime services, into a new private workdir.
+
+    Keys come from the caller's independently trusted verification boundary.
+    Installation disables index access, downloads, source builds and caches.
+    A failed installation retains its private workspace without a success receipt;
+    it is never resumed by reusing an existing environment or running Azure.
+    """
+    started = time.monotonic()
+    parent = _open_private_parent(work_dir / "support-installation.json")
+    os.close(parent)
+    if any(work_dir.iterdir()):
+        raise ValueError("support installation requires an empty private work directory")
+    verification = verify_offline_kit(
+        kit, release_root_pem=release_root_pem, cli_version=cli_version, platform_tag=platform_tag
+    )
+    digests = dict(verification.file_digests)
+    sizes = dict(verification.file_sizes)
+    inventory_path = _PREFIX + "inventory.json"
+    requirements_path = _PREFIX + "requirements/support.txt"
+    if inventory_path not in digests or requirements_path not in digests:
+        raise ValueError("offline kit lacks the complete runtime support wheelhouse")
+    wheels = work_dir / "wheelhouse"
+    wheels.mkdir(mode=0o700)
+    for relative in sorted(name for name in digests if name.startswith(_PREFIX)):
+        if time.monotonic() - started > 600:
+            raise ValueError("support installation preparation deadline exceeded")
+        target = wheels / relative.removeprefix(_PREFIX)
+        target.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        _copy_verified_file(
+            kit / relative, target, expected_digest=digests[relative], expected_size=sizes[relative]
+        )
+    inventory_bytes = _read_regular(wheels / "inventory.json", 4 * 1024 * 1024)
+    inventory = load_json_object(
+        inventory_bytes, label="support inventory", max_bytes=4 * 1024 * 1024
+    )
+    if (
+        inventory.get("schema_version") != "fdai.runtime-wheelhouse.v1"
+        or inventory.get("artifact_kind") != "local-runtime-wheelhouse"
+        or inventory.get("status") != "complete"
+        or inventory.get("support_requirements") != "requirements/support.txt"
+    ):
+        raise ValueError("unsupported or incomplete runtime support inventory")
+    if inventory.get("files") != {
+        name.removeprefix(_PREFIX): digest
+        for name, digest in digests.items()
+        if name.startswith(_PREFIX) and name != inventory_path
+    }:
+        raise ValueError("support inventory file map does not match the signed kit")
+    requirements = wheels / "requirements/support.txt"
+    requirement_bytes = _read_regular(requirements, 4 * 1024 * 1024)
+    _validate_requirements(requirement_bytes)
+    versions = _package_versions(inventory, requirement_bytes, digests)
+    locations = sorted(
+        {
+            str((wheels / name.removeprefix(_PREFIX)).parent)
+            for name in digests
+            if name.startswith(_PREFIX) and name.endswith(".whl")
+        }
+    )
+    if not 1 <= len(locations) <= 64:
+        raise ValueError("runtime support inventory MUST contain 1 through 64 wheel directories")
+    executable = shutil.which("uv")
+    if executable is None:
+        raise ValueError("a trusted preinstalled uv executable is required")
+    environment = {
+        key: os.environ[key] for key in ("PATH", "HOME", "SYSTEMROOT") if key in os.environ
+    }
+    environment.update({"UV_OFFLINE": "1", "UV_NO_CACHE": "1", "UV_PYTHON_DOWNLOADS": "never"})
+    venv = work_dir / "support-env"
+
+    def run(arguments: list[str], stage: str, *, capture: bool = False) -> bytes:
+        remaining = 900 - (time.monotonic() - started)
+        if remaining <= 0:
+            raise ValueError("support installation deadline exceeded")
+        print(json.dumps({"stage": stage, "status": "running"}), file=sys.stderr, flush=True)
+        try:
+            completed = subprocess.run(
+                [executable, *arguments],
+                env=environment,
+                cwd=work_dir,
+                stdin=subprocess.DEVNULL,
+                stdout=subprocess.PIPE if capture else subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+                check=True,
+                timeout=min(300, remaining),
+                umask=0o077,
+            )
+        except subprocess.TimeoutExpired as exc:
+            raise ValueError(f"support installation {stage} timed out") from exc
+        except subprocess.CalledProcessError as exc:
+            raise ValueError(
+                f"support installation {stage} failed with exit code {exc.returncode}"
+            ) from exc
+        if capture and not isinstance(completed.stdout, bytes):
+            raise SupportInstallationError("support installation returned no package readback")
+        print(json.dumps({"stage": stage, "status": "completed"}), file=sys.stderr, flush=True)
+        return completed.stdout if capture else b""
+
+    run(["venv", "--no-config", "--offline", "--python", sys.executable, str(venv)], "venv")
+    python = str(venv / "bin/python")
+    links = [argument for location in locations for argument in ("--find-links", location)]
+    run(
+        [
+            "pip",
+            "install",
+            "--no-config",
+            "--offline",
+            "--no-cache",
+            "--no-index",
+            "--only-binary",
+            ":all:",
+            "--require-hashes",
+            "--python",
+            python,
+            *links,
+            "--requirements",
+            str(requirements),
+        ],
+        "install",
+    )
+    run(["pip", "check", "--no-config", "--offline", "--python", python], "dependency-check")
+    observed = run(
+        ["pip", "list", "--no-config", "--offline", "--python", python, "--format", "json"],
+        "package-readback",
+        capture=True,
+    )
+    _verify_installed_packages(observed, versions)
+    result = {
+        "schema_version": "fdai.support-installation.v1",
+        "offline_manifest_digest": verification.manifest_digest,
+        "inventory_digest": hashlib.sha256(inventory_bytes).hexdigest(),
+        "environment": "support-env",
+        "dependencies_verified": True,
+        "packages": versions,
+        "services_started": False,
+        "cloud_mutation_performed": False,
+        "subscription_ready": False,
+    }
+    write_private_output(
+        work_dir / "support-installation.json",
+        json.dumps(result, sort_keys=True, separators=(",", ":")) + "\n",
+    )
+    return result

fdai_deployment_cli/target.py

@@ -0,0 +1,46 @@
+"""Canonical secret-free Azure target binding."""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import re
+
+_GUID = re.compile(
+    r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-"
+    r"[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+)
+
+
+def compute_target_binding(*, tenant_id: str, subscription_id: str) -> str:
+    """Bind one concrete tenant and subscription without retaining either value."""
+
+    if _GUID.fullmatch(tenant_id) is None or _GUID.fullmatch(subscription_id) is None:
+        raise ValueError("Azure tenant and subscription MUST be GUIDs")
+    material = f"{tenant_id.lower()}:{subscription_id.lower()}".encode()
+    return hashlib.sha256(material).hexdigest()
+
+
+def azure_target_selection_arguments() -> tuple[str, ...]:
+    """Pin Azure CLI reads when the caller selected one explicit subscription."""
+
+    subscription_id = os.environ.get("AZURE_SUBSCRIPTION_ID", "").strip()
+    if not subscription_id:
+        return ()
+    if _GUID.fullmatch(subscription_id) is None:
+        raise ValueError("AZURE_SUBSCRIPTION_ID MUST be a GUID")
+    return ("--subscription", subscription_id)
+
+
+def require_selected_azure_target(*, subscription_id: str, tenant_id: str) -> None:
+    """Reject an Azure CLI result that differs from explicit non-secret target inputs."""
+
+    selected_subscription = os.environ.get("AZURE_SUBSCRIPTION_ID", "").strip()
+    selected_tenant = os.environ.get("AZURE_TENANT_ID", "").strip()
+    if selected_subscription and selected_subscription.casefold() != subscription_id.casefold():
+        raise ValueError("active Azure subscription differs from AZURE_SUBSCRIPTION_ID")
+    if selected_tenant:
+        if _GUID.fullmatch(selected_tenant) is None:
+            raise ValueError("AZURE_TENANT_ID MUST be a GUID")
+        if selected_tenant.casefold() != tenant_id.casefold():
+            raise ValueError("active Azure tenant differs from AZURE_TENANT_ID")

fdai_deployment_cli/trust/capabilities.json

@@ -0,0 +1,62 @@
+[
+  "audit.append-only",
+  "automation.specialists",
+  "automation.workflow",
+  "chaos.run_experiment",
+  "communication.email",
+  "communication.teams",
+  "cost.metering",
+  "devops.azure-devops",
+  "devops.github",
+  "extensibility.http",
+  "extensibility.kusto",
+  "extensibility.link",
+  "extensibility.mcp",
+  "extensibility.python",
+  "extensibility.shell",
+  "incident.create",
+  "incident.platform-reception",
+  "incident.platform-writeback",
+  "incident.response-filter",
+  "incident.rich-card",
+  "incident.run-mode",
+  "incident.specialist-routing",
+  "investigation.background",
+  "investigation.cross-source",
+  "investigation.delegation",
+  "investigation.parallel",
+  "investigation.report",
+  "investigation.run",
+  "irp.author",
+  "irp.respond",
+  "knowledge.auto-learning",
+  "knowledge.document-search",
+  "knowledge.graph",
+  "knowledge.past-incidents",
+  "knowledge.register",
+  "knowledge.resource-priority",
+  "knowledge.tsg",
+  "knowledge.user-memory",
+  "measurement.dora",
+  "measurement.slo",
+  "observability.activity-log",
+  "observability.deep-diagnostics",
+  "observability.log-query",
+  "observability.metric-discovery",
+  "observability.metric-query",
+  "observability.resource-discovery",
+  "observability.topology",
+  "observability.trace-query",
+  "observability.trend-analysis",
+  "operations.azure-cli-read",
+  "operations.kubectl",
+  "operations.typed-mutation",
+  "paging.on-call",
+  "paging.pagerduty",
+  "reporting.pdf",
+  "reporting.visualization",
+  "safety.human-approval",
+  "scheduler.create_task",
+  "scheduling.history",
+  "scheduling.lifecycle"
+]

fdai_deployment_cli/trust/deployment-bundle-root.pub

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAgA/j+8XAU5LJHp1ZuPDvl/H0yY4F0z42i4wbvdv59yQ=
+-----END PUBLIC KEY-----

fdai_deployment_cli/trust/deployment-release-root.pub

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAgA/j+8XAU5LJHp1ZuPDvl/H0yY4F0z42i4wbvdv59yQ=
+-----END PUBLIC KEY-----

fdai_deployment_cli/trust/upstream-signing-key.pub

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAE8+WXzm6Kf5L/O9MFat/HMmPLtvESGQAIjhZ4zsPsGE=
+-----END PUBLIC KEY-----

fdai_deployment_cli/trust_roots.py

@@ -0,0 +1,50 @@
+"""Package-pinned public roots for standalone deployment verification."""
+
+from __future__ import annotations
+
+from importlib.resources import files
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from cryptography.hazmat.primitives.serialization import load_pem_public_key
+
+_TRUST_PACKAGE = "fdai_deployment_cli"
+_TRUST_DIRECTORY = "trust"
+_DEPLOYMENT_RELEASE_CHANNEL = "DEV"
+
+
+def deployment_release_root_pem() -> bytes:
+    """Return the public key that verifies complete deployment kits."""
+
+    return _read("deployment-release-root.pub")
+
+
+def deployment_bundle_root_pem() -> bytes:
+    """Return the public key that verifies the deployment bundle inside a kit."""
+
+    return _read("deployment-bundle-root.pub")
+
+
+def deployment_release_channel() -> str:
+    """Return the only release channel trusted by this package version."""
+
+    return _DEPLOYMENT_RELEASE_CHANNEL
+
+
+def license_public_key_pem() -> bytes:
+    """Return the upstream integrity public key, the only license verification key."""
+
+    return _read("upstream-signing-key.pub")
+
+
+def _read(name: str) -> bytes:
+    resource = files(_TRUST_PACKAGE).joinpath(_TRUST_DIRECTORY, name)
+    value = resource.read_bytes()
+    if not value.startswith(b"-----BEGIN PUBLIC KEY-----\n") or len(value) > 65_536:
+        raise ValueError("packaged deployment trust root is invalid")
+    try:
+        key = load_pem_public_key(value)
+    except (TypeError, ValueError) as exc:
+        raise ValueError("packaged deployment trust root is invalid") from exc
+    if not isinstance(key, Ed25519PublicKey):
+        raise ValueError("packaged deployment trust root must be Ed25519")
+    return value

fdai_deployment_cli-0.1.2.dist-info/METADATA

@@ -0,0 +1,112 @@
+Metadata-Version: 2.4
+Name: fdai-deployment-cli
+Version: 0.1.2
+Summary: Installable FDAI deployment and subscription genesis CLI
+Requires-Python: >=3.12
+Requires-Dist: cryptography<51,>=45
+Requires-Dist: fdai-service-contracts==0.1.0
+Requires-Dist: rich<15,>=14
+Description-Content-Type: text/markdown
+
+# FDAI Deployment CLI
+
+`fdai-deployment-cli` installs the `fdaictl` command. You can install it from a connected package
+source or from a small signed offline wheelhouse. Package installation does not authenticate to
+Azure or grant deployment authority.
+
+## Install from a signed offline package
+
+The offline package contains the CLI wheel, its dependency wheels, one requirements file, one
+checksum list, and one detached Ed25519 signature.
+
+Verify and install it with standard tools:
+
+```bash
+tar -xzf fdai-deployment-cli-0.1.1-offline.tar.gz
+cd package
+openssl pkeyutl -verify -pubin \
+  -inkey /private/trusted-package-signer.pub \
+  -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig
+sha256sum -c SHA256SUMS
+python -m pip install --no-index --find-links wheels -r requirements.txt
+fdaictl --version
+```
+
+The trusted public key should come from the operator, not from the package being verified. Pip
+handles interpreter, ABI, platform, dependency, and installation compatibility.
+
+## Build the offline package
+
+Use one operator-held Ed25519 private key:
+
+```bash
+scripts/deployment/release/build-signed-python-package.sh \
+  --out /private/fdai-python-package \
+  --signing-key /private/deployment-signing-key.pem
+```
+
+The private key must be an owner-only mode-`0600` file. The builder produces:
+
+```text
+fdai-python-package/
+  fdai-deployment-cli-0.1.1-offline.tar.gz
+  signer.pub
+  package/
+    INSTALL.txt
+    requirements.txt
+    SHA256SUMS
+    SHA256SUMS.sig
+    wheels/
+```
+
+No TUF root, nested bundle signature, artifact profile, SBOM, provenance document, deployment
+appliance, runtime image, or Azure receipt is required to complete the Python package.
+
+## Install from a clone
+
+For connected development, use the locked repository environment:
+
+```bash
+uv tool install --from ./packages/deployment-cli fdai-deployment-cli
+fdaictl --version
+```
+
+See the
+[deployment quickstart](../../docs/user-guide/deploy-quickstart.md#install-the-command-once)
+for PATH setup, updates, and editable development.
+
+## Use the command
+
+Run `fdaictl --help` for the current command tree. Common entry points include:
+
+| Command | Purpose |
+|---------|---------|
+| `fdaictl version` | Show the installed CLI version. |
+| `fdaictl doctor` | Check local tools and Azure authentication. |
+| `fdaictl provision inspect` | Inspect a target without changing it. |
+| `fdaictl provision azure` | Start the guarded Azure deployment coordinator. |
+| `fdaictl onboard guided --simulate` | Rehearse the finite stage graph without Azure changes. |
+
+Package verification and Azure deployment are separate operations. Azure plans, approvals, Managed
+Identity, recovery, migrations, service health, and cleanup remain deployment-owner controls after
+the CLI is installed.
+
+## Progress output
+
+Interactive text mode shows the current deployment phase and elapsed time. Use `--progress plain`
+for line-oriented logs, `--progress off` to hide progress, or `--output json` for machine output.
+Progress is not readiness evidence; the final deployment receipts remain authoritative.
+
+## Test
+
+Run the package tests with:
+
+```bash
+uv run --project packages/deployment-cli pytest -q --no-cov packages/deployment-cli/tests
+uv run pytest -q --no-cov tests/integration/scripts/test_package_assurance.py \
+  tests/integration/scripts/test_signed_python_package.py
+```
+
+See [Package Assurance](../../docs/roadmap/architecture/package-assurance.md) for the minimal signing
+contract and [Installable Deployment CLI](../../docs/roadmap/deployment/installable-deployment-cli.md)
+for Azure deployment behavior.