imbi-api 2.9.3__tar.gz → 2.10.0__tar.gz

{imbi_api-2.9.3 → imbi_api-2.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imbi-api
-Version: 2.9.3
+Version: 2.10.0
 Summary: Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications.
 Author-email: Alex Campbell <alexc@aweber.com>, Dave Shawley <daves@aweber.com>, "Gavin M. Roy" <gavinr@aweber.com>
 License: BSD-3-Clause
@@ -20,7 +20,7 @@ Requires-Dist: cyclonedx-python-lib<12,>=11.7
 Requires-Dist: fastapi
 Requires-Dist: filetype
 Requires-Dist: httpx<1,>=0.28.1
-Requires-Dist: imbi-common[databases,llm,sentry,server]==2.9.2
+Requires-Dist: imbi-common[databases,llm,sentry,server]==2.10.0
 Requires-Dist: jinja2
 Requires-Dist: jsonpatch>=1.33
 Requires-Dist: mcp>=1.26.0

{imbi_api-2.9.3 → imbi_api-2.10.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "imbi-api"
-version = "2.9.3"
+version = "2.10.0"
 description = "Imbi is a DevOps Service Management Platform designed to provide an efficient way to manage a large environment that contains many services and applications."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -28,7 +28,7 @@ dependencies = [
   "fastapi",
   "filetype",
   "httpx>=0.28.1,<1",
-  "imbi-common[databases,llm,sentry,server]==2.9.2",
+  "imbi-common[databases,llm,sentry,server]==2.10.0",
   "jinja2",
   "jsonpatch>=1.33",
   "mcp>=1.26.0",

{imbi_api-2.9.3 → imbi_api-2.10.0}/src/imbi_api/commit_sync/service.py

@@ -25,6 +25,8 @@ from imbi_common.plugins.base import PluginContext, ServicePlugin
 from imbi_common.plugins.errors import PluginNotFoundError
 from imbi_common.plugins.registry import RegistryEntry, get_plugin
 
+from imbi_api import models
+from imbi_api.identity import repository as identity_repository
 from imbi_api.plugins import parse_options
 from imbi_api.plugins.credentials import get_plugin_credentials
 
@@ -137,6 +139,61 @@ async def _resolve_plugin(
     )
 
 
+def _identity_plugin_slugs(service_plugins: list[ServicePlugin]) -> list[str]:
+    """Return connected plugin slugs registered as identity plugins."""
+    slugs: list[str] = []
+    for plugin in service_plugins:
+        try:
+            entry = get_plugin(plugin.slug)
+        except PluginNotFoundError:
+            continue
+        if entry.manifest.plugin_type == 'identity':
+            slugs.append(plugin.slug)
+    return slugs
+
+
+def _make_user_resolver(
+    db: graph.Graph, service_plugins: list[ServicePlugin]
+) -> abc.Callable[[str], abc.Awaitable[str | None]] | None:
+    """Build the ``PluginContext.resolve_user_by_identity`` resolver.
+
+    Maps an external identity *subject* (a GitHub numeric user id) to the
+    matching Imbi user's email by querying the graph directly -- no HTTP,
+    since this runs inside imbi-api on a background backfill.  Connected
+    plugins are filtered to identity plugins; ``None`` is returned when
+    none qualify so the action skips the lookups entirely.  A subject
+    resolving to two different users across plugins is treated as
+    unresolved (logged), never mis-attributed.
+    """
+    identity_slugs = _identity_plugin_slugs(service_plugins)
+    if not identity_slugs:
+        return None
+
+    async def _resolve(subject: str) -> str | None:
+        emails: set[str] = set()
+        for slug in identity_slugs:
+            user_id = await identity_repository.find_user_by_subject(
+                db, slug, subject
+            )
+            if user_id is None:
+                continue
+            users = await db.match(models.User, {'id': user_id})
+            if users:
+                emails.add(users[0].email)
+        if len(emails) > 1:
+            LOGGER.error(
+                'Identity subject %r resolved to multiple Imbi users via '
+                'plugins %r: %r — leaving unattributed',
+                subject,
+                identity_slugs,
+                sorted(emails),
+            )
+            return None
+        return next(iter(emails), None)
+
+    return _resolve
+
+
 async def _build_context(
     db: graph.Graph,
     org_slug: str,
@@ -174,6 +231,9 @@ async def _build_context(
         project_type_slugs=project_type_slugs,
         third_party_service_slug=resolved.tps_slug or None,
         service_connections=service_connections,
+        resolve_user_by_identity=_make_user_resolver(
+            db, resolved.service_plugins
+        ),
     )
 
 

{imbi_api-2.9.3 → imbi_api-2.10.0}/src/imbi_api/domain/models.py

@@ -55,6 +55,7 @@ __all__ = [
     'ServiceApplicationSecrets',
     'Session',
     'TOTPSecret',
+    'TeamMembership',
     'ThirdPartyService',
     'ThirdPartyServiceCreate',
     'ThirdPartyServiceResponse',
@@ -224,6 +225,15 @@ class OrgMembership(pydantic.BaseModel):
     role: str
 
 
+class TeamMembership(pydantic.BaseModel):
+    """Team membership for API responses."""
+
+    model_config = pydantic.ConfigDict(extra='ignore')
+    team_name: str
+    team_slug: str
+    organization_slug: str
+
+
 class Role(models.Node):  # type: ignore[misc]
     """Role for grouping permissions."""
 
@@ -445,12 +455,14 @@ class CurrentUserResponse(UserResponse):
     """Response model for the authenticated user's own profile.
 
     Extends ``UserResponse`` with the caller's effective permission set
-    so the UI can gate features in a single request. Only exposed via
+    and team memberships so the UI can gate features and offer
+    membership-scoped filters in a single request. Only exposed via
     ``GET /users/me`` — the per-email endpoint deliberately omits
     permissions to avoid disclosing one user's grants to another.
     """
 
     permissions: list[str] = []
+    teams: list[TeamMembership] = []
 
 
 class PasswordChangeRequest(pydantic.BaseModel):

{imbi_api-2.9.3 → imbi_api-2.10.0}/src/imbi_api/domain/scoring.py

@@ -58,7 +58,12 @@ class PolicyCreate(pydantic.BaseModel):
     slug: str
     description: str | None = None
     category: typing.Literal[
-        'attribute', 'presence', 'link_presence', 'age', 'analysis_result'
+        'attribute',
+        'presence',
+        'link_presence',
+        'age',
+        'analysis_result',
+        'deployment_status',
     ] = 'attribute'
     weight: int = pydantic.Field(ge=0, le=100)
     enabled: bool = True
@@ -67,6 +72,7 @@ class PolicyCreate(pydantic.BaseModel):
     attribute_name: str | None = None
     link_slug: str | None = None
     result_slug: str | None = None
+    environment_slug: str | None = None
     present_score: int | None = pydantic.Field(default=None, ge=0, le=100)
     missing_score: int | None = pydantic.Field(default=None, ge=0, le=100)
     value_score_map: dict[str, int] | None = None
@@ -85,6 +91,7 @@ class PolicyUpdate(pydantic.BaseModel):
     attribute_name: str | None = None
     link_slug: str | None = None
     result_slug: str | None = None
+    environment_slug: str | None = None
     weight: int | None = pydantic.Field(default=None, ge=0, le=100)
     enabled: bool | None = None
     priority: int | None = None

{imbi_api-2.9.3 → imbi_api-2.10.0}/src/imbi_api/endpoints/dashboard.py

@@ -37,8 +37,11 @@ class DatastoreStatus(pydantic.BaseModel):
     status: typing.Literal['ok', 'error']
     latency_ms: float | None = None
     # Bytes on disk (Postgres/ClickHouse) or resident memory (Valkey,
-    # which is in-memory). ``None`` when the size probe failed.
+    # which is in-memory). ``None`` when the size probe failed. For
+    # ClickHouse this is the Imbi application database; ``total_bytes``
+    # carries the whole-server footprint (incl. ``system.*``).
     size_bytes: int | None = None
+    total_bytes: int | None = None
     detail: str | None = None
 
 
@@ -134,13 +137,19 @@ async def _check_postgres(db: graph.Graph) -> DatastoreStatus:
 
 
 async def _check_clickhouse() -> DatastoreStatus:
-    """Probe ClickHouse and read total on-disk size of active parts."""
+    """Probe ClickHouse for the app-database and whole-server disk size.
+
+    ``size`` is the active-part footprint of the connected (Imbi)
+    database; ``total`` spans every database, including ``system.*``.
+    """
     start = time.perf_counter()
     try:
         rows = await asyncio.wait_for(
             clickhouse.query(
-                'SELECT sum(bytes_on_disk) AS size FROM system.parts'
-                " WHERE active AND database != 'system'"
+                'SELECT'
+                ' sumIf(bytes_on_disk, database = currentDatabase()) AS size,'
+                ' sum(bytes_on_disk) AS total'
+                ' FROM system.parts WHERE active'
             ),
             _CHECK_TIMEOUT,
         )
@@ -152,14 +161,16 @@ async def _check_clickhouse() -> DatastoreStatus:
             status='error',
             detail=str(err),
         )
-    raw = rows[0].get('size') if rows else None
-    size = int(raw) if raw is not None else None
+    row = rows[0] if rows else {}
+    size_raw = row.get('size')
+    total_raw = row.get('total')
     return DatastoreStatus(
         name='ClickHouse',
         role='Timeseries data',
         status='ok',
         latency_ms=_ms(start),
-        size_bytes=size,
+        size_bytes=int(size_raw) if size_raw is not None else None,
+        total_bytes=int(total_raw) if total_raw is not None else None,
     )
 
 

{imbi_api-2.9.3 → imbi_api-2.10.0}/src/imbi_api/endpoints/projects.py

@@ -603,7 +603,7 @@ def _latest_deployment_event(
     return latest_ts, latest_by
 
 
-async def _lookup_ops_log_performed_by(
+async def lookup_ops_log_performed_by(
     targets: list[tuple[str, str, str]],
 ) -> dict[tuple[str, str, str], str]:
     """Map ``(project_id, environment_slug, version)`` → ``performed_by``.
@@ -737,7 +737,7 @@ async def _fetch_current_releases(
         ) in latest.items()
         if performed_by is None and (tag or committish)
     ]
-    performed_by_by_key = await _lookup_ops_log_performed_by(enrich_targets)
+    performed_by_by_key = await lookup_ops_log_performed_by(enrich_targets)
     if performed_by_by_key:
         for key, (tag, committish, ts, performed_by) in list(latest.items()):
             if performed_by is not None:
@@ -1499,6 +1499,14 @@ class BlueprintSectionProperty(pydantic.BaseModel):
         alias='x-ui',
         serialization_alias='x-ui',
     )
+    #: Optional value-display transforms (e.g. ``{'format': 'humanize'}``)
+    #: applied to the rendered value, independent of ``x-ui`` color/icon
+    #: resolution (which keys off the raw value).
+    x_display: dict[str, typing.Any] = pydantic.Field(
+        default_factory=dict,
+        alias='x-display',
+        serialization_alias='x-display',
+    )
 
 
 class BlueprintSection(pydantic.BaseModel):
@@ -1507,6 +1515,11 @@ class BlueprintSection(pydantic.BaseModel):
     name: str
     slug: str
     description: str | None = None
+    #: ``project`` for node blueprints (project-level attributes);
+    #: ``environment`` for relationship blueprints on the
+    #: ``Project -[:DEPLOYED_IN]-> Environment`` edge (per-environment
+    #: edge attributes rendered in the Environments card).
+    scope: typing.Literal['project', 'environment'] = 'project'
     properties: dict[str, BlueprintSectionProperty]
 
 
@@ -1568,40 +1581,34 @@ async def get_project_schema(
         graph.parse_agtype(records[0]['env_slugs']) or []
     )
 
-    # Fetch all enabled node blueprints for Project
-    all_blueprints = await db.match(
-        models.Blueprint,
-        {'type': 'Project', 'enabled': True},
-        order_by='priority',
-    )
+    def _build_section(
+        bp: models.Blueprint,
+        scope: typing.Literal['project', 'environment'],
+    ) -> BlueprintSection | None:
+        """Build a schema section from a blueprint, or ``None`` to skip.
 
-    # Match blueprints whose filters intersect the project's own
-    # types/envs. A blueprint with no filter matches everything.
-    # A blueprint with a project_type filter matches if any of
-    # the project's types appear in that list (same for environment).
-    sections: list[BlueprintSection] = []
-    for bp in all_blueprints:
+        A blueprint is skipped when its filter doesn't intersect the
+        project's own types/envs, or when it declares no properties. A
+        blueprint with no filter matches everything; a ``project_type``
+        filter matches if any of the project's types appear in it (same
+        for ``environment``).
+        """
         f = bp.filter
         if f is not None:
             if f.project_type and not type_slugs.intersection(f.project_type):
-                continue
+                return None
             if f.environment and not env_slugs.intersection(f.environment):
-                continue
-
+                return None
         schema = bp.json_schema
         if not schema.properties:
-            continue
-
+            return None
         props: dict[str, BlueprintSectionProperty] = {}
         for prop_name, prop_schema in schema.properties.items():
-            raw_x_ui = (
-                prop_schema.model_extra.get('x-ui')
-                if prop_schema.model_extra
-                else None
-            )
-            x_ui = dict(raw_x_ui or {})
+            extra = prop_schema.model_extra or {}
+            x_ui = dict(extra.get('x-ui') or {})
             if x_ui.get('editable') is None:
                 x_ui['editable'] = True
+            raw_x_display = extra.get('x-display')
             props[prop_name] = BlueprintSectionProperty(
                 type=getattr(prop_schema, 'type', None),
                 format=getattr(prop_schema, 'format', None),
@@ -1611,21 +1618,146 @@ async def get_project_schema(
                 default=getattr(prop_schema, 'default', None),
                 minimum=getattr(prop_schema, 'minimum', None),
                 maximum=getattr(prop_schema, 'maximum', None),
-                **{'x-ui': x_ui},
-            )
-
-        sections.append(
-            BlueprintSection(
-                name=bp.name,
-                slug=bp.slug or '',
-                description=bp.description,
-                properties=props,
+                **{'x-ui': x_ui, 'x-display': dict(raw_x_display or {})},
             )
+        return BlueprintSection(
+            name=bp.name,
+            slug=bp.slug or '',
+            description=bp.description,
+            scope=scope,
+            properties=props,
         )
 
+    # Node blueprints (project-level attributes) ...
+    node_blueprints = await db.match(
+        models.Blueprint,
+        {'type': 'Project', 'enabled': True},
+        order_by='priority',
+    )
+    # ... and relationship blueprints on the
+    # ``Project -[:DEPLOYED_IN]-> Environment`` edge (per-environment edge
+    # attributes), which carry the same JSON-Schema + ``x-ui`` metadata so
+    # the UI renders them with the shared attribute-display logic.
+    rel_blueprints = await db.match(
+        models.Blueprint,
+        {'kind': 'relationship', 'enabled': True},
+        order_by='priority',
+    )
+
+    sections: list[BlueprintSection] = []
+    for bp in node_blueprints:
+        section = _build_section(bp, 'project')
+        if section is not None:
+            sections.append(section)
+    for bp in rel_blueprints:
+        if (
+            bp.source != 'Project'
+            or bp.target != 'Environment'
+            or bp.edge != 'DEPLOYED_IN'
+        ):
+            continue
+        section = _build_section(bp, 'environment')
+        if section is not None:
+            sections.append(section)
+
     return ProjectSchemaResponse(sections=sections)
 
 
+class EnvironmentEdgeUpdate(pydantic.BaseModel):
+    """Edge-property updates for a project's ``DEPLOYED_IN`` edge.
+
+    Keys are blueprint-defined edge attributes (accepted via
+    ``extra='allow'``). A non-null value sets the property; a ``null``
+    value removes it.
+    """
+
+    model_config = pydantic.ConfigDict(extra='allow')
+
+
+@projects_router.patch('/{project_id}/environments/{env_slug}')
+async def patch_project_environment(
+    org_slug: str,
+    project_id: str,
+    env_slug: str,
+    updates: EnvironmentEdgeUpdate,
+    db: graph.Pool,
+    auth: typing.Annotated[
+        permissions.AuthContext,
+        fastapi.Depends(permissions.require_permission('project:write')),
+    ],
+) -> dict[str, typing.Any]:
+    """Update ``DEPLOYED_IN`` edge properties for a single environment.
+
+    Performs targeted per-key ``SET`` / ``REMOVE`` on the one
+    ``(project)-[:DEPLOYED_IN]->(environment)`` edge, so it neither
+    rewrites the other environments' edges nor relies on edge deletion
+    (both of which behave unreliably on some Apache AGE builds). Protected
+    structural keys are rejected. Returns the updated edge properties.
+    """
+    extra = updates.model_extra or {}
+    protected_keys = sorted(k for k in extra if k in _PROTECTED_ENV_KEYS)
+    if protected_keys:
+        raise fastapi.HTTPException(
+            status_code=400,
+            detail=(
+                'Protected environment fields are not editable via this '
+                f'endpoint: {protected_keys!r}'
+            ),
+        )
+    props = dict(extra)
+    if not props:
+        raise fastapi.HTTPException(
+            status_code=400,
+            detail='No editable edge properties provided',
+        )
+
+    params: dict[str, typing.Any] = {
+        'project_id': project_id,
+        'org_slug': org_slug,
+        'env_slug': env_slug,
+    }
+    set_parts: list[str] = []
+    remove_parts: list[str] = []
+    for i, (key, value) in enumerate(props.items()):
+        if value is None:
+            remove_parts.append(f'r.{escape_prop(key)}')
+        else:
+            param = f'edge_{i}'
+            set_parts.append(f'r.{escape_prop(key)} = {{{param}}}')
+            params[param] = value
+
+    mutations = ''
+    if set_parts:
+        mutations += ' SET ' + ', '.join(set_parts)
+    if remove_parts:
+        mutations += ' REMOVE ' + ', '.join(remove_parts)
+
+    query: str = (
+        'MATCH (p:Project {{id: {project_id}}})'
+        '-[:OWNED_BY]->(:Team)'
+        '-[:BELONGS_TO]->(o:Organization {{slug: {org_slug}}})'
+        ' MATCH (p)-[r:DEPLOYED_IN]->'
+        '(e:Environment {{slug: {env_slug}}})-[:BELONGS_TO]->(o)'
+        + mutations
+        + ' RETURN properties(r) AS props'
+    )
+    records = await db.execute(query, params, ['props'])
+    if not records:
+        raise fastapi.HTTPException(
+            status_code=404,
+            detail=(
+                f'Project {project_id!r} is not deployed in '
+                f'environment {env_slug!r}'
+            ),
+        )
+    edge_props: dict[str, typing.Any] = (
+        graph.parse_agtype(records[0]['props']) or {}
+    )
+    return {
+        k: v for k, v in edge_props.items() if k not in _PROTECTED_ENV_KEYS
+    }
+
+
 @projects_router.get('/{project_id}', name='get_project')
 async def get_project(
     org_slug: str,
@@ -2035,9 +2167,16 @@ def _build_update_clauses(
     new_edge_props_tpl = _edge_props_map(new_env_entries)
 
     if data.environments is not None:
-        # MERGE (not CREATE) so the retry loop in
-        # _execute_project_update cannot accumulate duplicate edges
-        # if AGE rolls back the SET phase but not the edge write.
+        # Replace the project's DEPLOYED_IN edges wholesale: delete the
+        # existing ones, then re-create them with inline edge properties
+        # (mirroring ``create_project``). We deliberately avoid
+        # ``MERGE (p)-[r]->(e) SET r = {map}``: some Apache AGE builds
+        # silently no-op a full-property ``SET r = {map}`` on a
+        # relationship, dropping every edge attribute, whereas inline
+        # ``CREATE ... {props}`` persists reliably. The DELETE and CREATE
+        # run in the same transaction as one ``execute`` call, so a
+        # retried attempt (see _execute_project_update) rolls back wholly
+        # and cannot accumulate duplicate edges.
         rel_clauses += (
             ' WITH DISTINCT p, o'
             ' OPTIONAL MATCH'
@@ -2045,15 +2184,12 @@ def _build_update_clauses(
             ' DELETE old_env'
         )
         if new_env_entries:
-            merge_set = (
-                ' SET r =' + new_edge_props_tpl if new_edge_props_tpl else ''
-            )
             rel_clauses += (
                 ' WITH DISTINCT p, o'
                 f' UNWIND {new_env_tpl} AS entry'
                 ' MATCH (e:Environment'
                 ' {{slug: entry.slug}})-[:BELONGS_TO]->(o)'
-                ' MERGE (p)-[r:DEPLOYED_IN]->(e)' + merge_set
+                ' CREATE (p)-[:DEPLOYED_IN' + new_edge_props_tpl + ']->(e)'
             )
 
     return rel_clauses, new_env_params

{imbi_api-2.9.3 → imbi_api-2.10.0}/src/imbi_api/endpoints/releases.py

@@ -27,7 +27,10 @@ from imbi_api import sbom
 from imbi_api.auth import permissions
 from imbi_api.endpoints._helpers import fetch_or_404
 from imbi_api.endpoints.operations_log import complete_opslog_entry
+from imbi_api.endpoints.projects import lookup_ops_log_performed_by
 from imbi_api.plugins import call_with_timeout
+from imbi_api.scoring import OptionalValkeyClient
+from imbi_api.scoring import queue as score_queue
 
 LOGGER = logging.getLogger(__name__)
 
@@ -163,6 +166,10 @@ class CurrentReleaseEnvironment(pydantic.BaseModel):
     last_event_at: datetime.datetime | None = None
     external_run_url: str | None = None
     ci_status: CheckStatus | None = None
+    #: Deployer of the latest event when observed from a remote (e.g. the
+    #: GitHub ``deployment.creator.login``). ``None`` for in-product deploys,
+    #: where the operator is captured in the operations log instead.
+    performed_by: str | None = None
 
 
 # -- Helpers ------------------------------------------------------------
@@ -711,6 +718,22 @@ async def list_current_releases(
         db, org_slug, project_id, auth, by_env
     )
 
+    # Backfill performed_by from operations_log for events whose AGE edge
+    # left it null (in-product deploy/promote path), mirroring the
+    # project-detail current-releases view so both agree.
+    enrich_targets: list[tuple[str, str, str]] = []
+    for env, release_raw, event in by_env.values():
+        if event is None or event.performed_by is not None:
+            continue
+        if release_raw is None:
+            continue
+        version = str(
+            release_raw.get('tag') or release_raw.get('committish') or ''
+        )
+        if version:
+            enrich_targets.append((project_id, env['slug'], version))
+    performed_by_by_key = await lookup_ops_log_performed_by(enrich_targets)
+
     sortable: list[tuple[int, str, CurrentReleaseEnvironment]] = []
     for env, release_raw, event in by_env.values():
         release_resp = (
@@ -718,6 +741,18 @@ async def list_current_releases(
             if release_raw is not None
             else None
         )
+        performed_by = event.performed_by if event else None
+        if (
+            performed_by is None
+            and event is not None
+            and release_raw is not None
+        ):
+            version = str(
+                release_raw.get('tag') or release_raw.get('committish') or ''
+            )
+            performed_by = performed_by_by_key.get(
+                (project_id, env['slug'], version)
+            )
         item = CurrentReleaseEnvironment(
             environment=ReleaseEnvironmentRef(
                 slug=env['slug'], name=env['name']
@@ -727,6 +762,7 @@ async def list_current_releases(
             last_event_at=event.timestamp if event else None,
             external_run_url=event.external_run_url if event else None,
             ci_status=ci_status_by_slug.get(env['slug']),
+            performed_by=performed_by,
         )
         sortable.append((env.get('sort_order') or 0, env['name'], item))
 
@@ -1170,6 +1206,7 @@ async def record_deployment(
     env_slug: str,
     data: DeploymentEventInput,
     db: graph.Pool,
+    valkey_client: OptionalValkeyClient,
     _auth: typing.Annotated[
         permissions.AuthContext,
         fastapi.Depends(
@@ -1258,6 +1295,12 @@ async def record_deployment(
             datetime.datetime.now(datetime.UTC),
         )
 
+    # A DeploymentStatusPolicy may score this project on its current
+    # deployment status, so a new event can change the score.
+    await score_queue.enqueue_recompute(
+        valkey_client, project_id, 'deployment_status_change'
+    )
+
     return _edge_to_response(env, deployments)
 
 

{imbi_api-2.9.3 → imbi_api-2.10.0}/src/imbi_api/endpoints/scoring_policies.py

@@ -31,6 +31,7 @@ PolicyType = (
     | scoring_common.LinkPresencePolicy
     | scoring_common.AgePolicy
     | scoring_common.AnalysisResultPolicy
+    | scoring_common.DeploymentStatusPolicy
 )
 
 
@@ -58,6 +59,7 @@ _NODE_PROPERTY_KEYS: frozenset[str] = frozenset(
         'attribute_name',
         'link_slug',
         'result_slug',
+        'environment_slug',
         'present_score',
         'missing_score',
         'value_score_map',