redeploy 0.2.78__tar.gz → 0.2.80__tar.gz

{redeploy-0.2.78/redeploy.egg-info → redeploy-0.2.80}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: redeploy
-Version: 0.2.78
+Version: 0.2.80
 Summary: Infrastructure migration toolkit: detect → plan → apply
 License-Expression: Apache-2.0
 Requires-Python: >=3.11
@@ -14,15 +14,13 @@ Requires-Dist: paramiko>=3.0
 Requires-Dist: httpx>=0.25
 Requires-Dist: rich>=13.0
 Requires-Dist: jmespath>=1.0
-Requires-Dist: goal>=2.1.0
-Requires-Dist: costs>=0.1.20
-Requires-Dist: pfix>=0.1.60
+Requires-Dist: costs>=0.2.0
+Requires-Dist: pfix>=0.1.79
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: ruff>=0.4; extra == "dev"
-Requires-Dist: goal>=2.1.0; extra == "dev"
-Requires-Dist: costs>=0.1.20; extra == "dev"
-Requires-Dist: pfix>=0.1.60; extra == "dev"
+Requires-Dist: costs>=0.2.0; extra == "dev"
+Requires-Dist: pfix>=0.1.79; extra == "dev"
 Provides-Extra: op3
 Requires-Dist: op3>=0.1.8; extra == "op3"
 Provides-Extra: mcp
@@ -33,17 +31,17 @@ Requires-Dist: mcp>=1.0; extra == "mcp"
 
 ## AI Cost Tracking
 
-![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.78-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
-![AI Cost](https://img.shields.io/badge/AI%20Cost-$6.32-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-42.0h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
+![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.80-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![AI Cost](https://img.shields.io/badge/AI%20Cost-$1.86-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-58.6h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
 
-- 🤖 **LLM usage:** $6.3244 (100 commits)
-- 👤 **Human dev:** ~$4198 (42.0h @ $100/h, 30min dedup)
+- 🤖 **LLM usage:** $1.8574 (124 commits)
+- 👤 **Human dev:** ~$5861 (58.6h @ $100/h, 30min dedup)
 
-Generated on 2026-05-20 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
+Generated on 2026-09-06 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
 
 ---
 
-![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.78-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.80-blue) ![Python](https://img.shields.io/badge/python-3.11+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
 
 Infrastructure migration and device deploy toolkit — VPS, Raspberry Pi kiosk, Podman Quadlet, k3s.
 
@@ -111,6 +109,24 @@ redeploy run migration.yaml --detect
 redeploy run migration.yaml
 ```
 
+## Safe post-deploy verification
+
+Steps roll back completed actions on failure by default. A post-deploy check
+can fail the run without undoing an otherwise healthy deployment:
+
+```yaml
+extra_steps:
+  - id: smoke_after_commit
+    action: testql
+    query_source: tests/smoke.testql.toon.yaml
+    url: https://example.test
+    rollback_on_failure: false
+```
+
+`redeploy run SPEC --plan-only` evaluates lint and preflight locally without
+contacting the target or writing generated state. Use
+`--preflight-schema-out PATH` when a persisted planning artifact is required.
+
 ## Quick start — Raspberry Pi kiosk
 
 ```bash
@@ -509,6 +525,57 @@ extra_steps:
     insert_before: docker_build_pull   # runs before build, not after verify
 ```
 
+## Query-language post-deploy tests — `testql` / `oql` / `aql`
+
+Beyond `http_check`/`inline_script`, redeploy can run **query-language test
+scenarios** as post-deploy verification. Each runs the interpreter **locally**
+(on the controller, where it is installed) and targets the freshly deployed
+host via `url`. The step fails — and thus the deploy fails/rolls back — when the
+scenario fails.
+
+| Action | Default runner | Verdict | Purpose |
+|--------|----------------|---------|---------|
+| `testql` | `testql run --url <url> <file>` | exit 0 (+ optional `expect` in output) | API/GUI smoke of the deployed app |
+| `oql` | `oqlctl <file> -m <mode> --json [--firmware-url <url>]` | JSON `ok == true` (fallback: exit 0) | run an OQL scenario against the deployed runtime/firmware |
+| `aql` | `aql <file> [locale]` | exit 0 (+ optional `expect`, e.g. a variant name) | evaluate an AQL decision model and assert the verdict |
+
+Fields (on top of `url` / `expect`):
+
+- `query_source` — path to the `.testql.toon.yaml` / `.oql` / `.aql` scenario.
+- `query_mode` — OQL mode: `validate` \| `dry-run` \| `execute`.
+- `query_runner` — override the runner binary (absolute path is fine).
+- `query_locale` — AQL locale (`en` \| `pl`).
+- `query_context` — AQL: path to a context JSON for resolve.
+- `command` — full command-template override; placeholders `{url} {source} {mode} {locale} {context}` are substituted (literal `{}` in the command are left intact — no `str.format`).
+
+```yaml
+extra_steps:
+  - id: post_deploy_oql
+    action: oql
+    description: "OQL: real sensor read from the deployed firmware"
+    query_source: deploy-tests/oql/firmware-sensor-read.oql
+    query_mode: execute
+    url: http://192.168.188.122:8202          # oqlctl --firmware-url
+
+  - id: post_deploy_testql
+    action: testql
+    description: "TestQL: API smoke of the deployed app"
+    query_source: deploy-tests/testql/post-deploy-api-smoke.testql.toon.yaml
+    flags: ["--output", "json", "--quiet"]
+    url: http://192.168.188.109:8100          # testql run --url
+
+  - id: post_deploy_aql
+    action: aql
+    description: "AQL: decision model returns the expected variant"
+    query_source: deploy-tests/aql/personalization.en.aql
+    command: "python3 /path/to/aql/cli.py {source} {locale}"
+    query_locale: en
+    expect: technical_deep
+```
+
+A ready example spec lives in c2004: `deploy-tests/post-deploy.redeploy.md`
+(run with `redeploy run deploy-tests/post-deploy.redeploy.md`).
+
 ## Plugin system
 
 Extend the step pipeline with custom action types using `action: plugin`:
@@ -934,7 +1001,9 @@ Language is auto-detected — Polish, English, or any language the model support
 
 redeploy exposes an [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server,
 letting AI assistants (Claude Desktop, VS Code Copilot, custom agents) call redeploy operations
-as structured tools.
+as structured tools. Planning is enabled by default. Deployment, version, generated-command, and SSH
+mutations require the server-side capability `REDEPLOY_MCP_ALLOW_APPLY=1`, an
+`actor`, and the exact `approval_hash` returned for that operation.
 
 ### Start
 

redeploy-0.2.78/PKG-INFO → redeploy-0.2.80/README.md

@@ -1,49 +1,19 @@
-Metadata-Version: 2.4
-Name: redeploy
-Version: 0.2.78
-Summary: Infrastructure migration toolkit: detect → plan → apply
-License-Expression: Apache-2.0
-Requires-Python: >=3.11
-Description-Content-Type: text/markdown
-Requires-Dist: pydantic>=2.0
-Requires-Dist: pyyaml>=6.0
-Requires-Dist: markdown-it-py>=3.0
-Requires-Dist: click>=8.0
-Requires-Dist: loguru>=0.7
-Requires-Dist: paramiko>=3.0
-Requires-Dist: httpx>=0.25
-Requires-Dist: rich>=13.0
-Requires-Dist: jmespath>=1.0
-Requires-Dist: goal>=2.1.0
-Requires-Dist: costs>=0.1.20
-Requires-Dist: pfix>=0.1.60
-Provides-Extra: dev
-Requires-Dist: pytest>=8.0; extra == "dev"
-Requires-Dist: ruff>=0.4; extra == "dev"
-Requires-Dist: goal>=2.1.0; extra == "dev"
-Requires-Dist: costs>=0.1.20; extra == "dev"
-Requires-Dist: pfix>=0.1.60; extra == "dev"
-Provides-Extra: op3
-Requires-Dist: op3>=0.1.8; extra == "op3"
-Provides-Extra: mcp
-Requires-Dist: mcp>=1.0; extra == "mcp"
-
 # redeploy
 
 
 ## AI Cost Tracking
 
-![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.78-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
-![AI Cost](https://img.shields.io/badge/AI%20Cost-$6.32-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-42.0h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
+![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.80-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![AI Cost](https://img.shields.io/badge/AI%20Cost-$1.86-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-58.6h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
 
-- 🤖 **LLM usage:** $6.3244 (100 commits)
-- 👤 **Human dev:** ~$4198 (42.0h @ $100/h, 30min dedup)
+- 🤖 **LLM usage:** $1.8574 (124 commits)
+- 👤 **Human dev:** ~$5861 (58.6h @ $100/h, 30min dedup)
 
-Generated on 2026-05-20 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
+Generated on 2026-09-06 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
 
 ---
 
-![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.78-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.80-blue) ![Python](https://img.shields.io/badge/python-3.11+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
 
 Infrastructure migration and device deploy toolkit — VPS, Raspberry Pi kiosk, Podman Quadlet, k3s.
 
@@ -111,6 +81,24 @@ redeploy run migration.yaml --detect
 redeploy run migration.yaml
 ```
 
+## Safe post-deploy verification
+
+Steps roll back completed actions on failure by default. A post-deploy check
+can fail the run without undoing an otherwise healthy deployment:
+
+```yaml
+extra_steps:
+  - id: smoke_after_commit
+    action: testql
+    query_source: tests/smoke.testql.toon.yaml
+    url: https://example.test
+    rollback_on_failure: false
+```
+
+`redeploy run SPEC --plan-only` evaluates lint and preflight locally without
+contacting the target or writing generated state. Use
+`--preflight-schema-out PATH` when a persisted planning artifact is required.
+
 ## Quick start — Raspberry Pi kiosk
 
 ```bash
@@ -509,6 +497,57 @@ extra_steps:
     insert_before: docker_build_pull   # runs before build, not after verify
 ```
 
+## Query-language post-deploy tests — `testql` / `oql` / `aql`
+
+Beyond `http_check`/`inline_script`, redeploy can run **query-language test
+scenarios** as post-deploy verification. Each runs the interpreter **locally**
+(on the controller, where it is installed) and targets the freshly deployed
+host via `url`. The step fails — and thus the deploy fails/rolls back — when the
+scenario fails.
+
+| Action | Default runner | Verdict | Purpose |
+|--------|----------------|---------|---------|
+| `testql` | `testql run --url <url> <file>` | exit 0 (+ optional `expect` in output) | API/GUI smoke of the deployed app |
+| `oql` | `oqlctl <file> -m <mode> --json [--firmware-url <url>]` | JSON `ok == true` (fallback: exit 0) | run an OQL scenario against the deployed runtime/firmware |
+| `aql` | `aql <file> [locale]` | exit 0 (+ optional `expect`, e.g. a variant name) | evaluate an AQL decision model and assert the verdict |
+
+Fields (on top of `url` / `expect`):
+
+- `query_source` — path to the `.testql.toon.yaml` / `.oql` / `.aql` scenario.
+- `query_mode` — OQL mode: `validate` \| `dry-run` \| `execute`.
+- `query_runner` — override the runner binary (absolute path is fine).
+- `query_locale` — AQL locale (`en` \| `pl`).
+- `query_context` — AQL: path to a context JSON for resolve.
+- `command` — full command-template override; placeholders `{url} {source} {mode} {locale} {context}` are substituted (literal `{}` in the command are left intact — no `str.format`).
+
+```yaml
+extra_steps:
+  - id: post_deploy_oql
+    action: oql
+    description: "OQL: real sensor read from the deployed firmware"
+    query_source: deploy-tests/oql/firmware-sensor-read.oql
+    query_mode: execute
+    url: http://192.168.188.122:8202          # oqlctl --firmware-url
+
+  - id: post_deploy_testql
+    action: testql
+    description: "TestQL: API smoke of the deployed app"
+    query_source: deploy-tests/testql/post-deploy-api-smoke.testql.toon.yaml
+    flags: ["--output", "json", "--quiet"]
+    url: http://192.168.188.109:8100          # testql run --url
+
+  - id: post_deploy_aql
+    action: aql
+    description: "AQL: decision model returns the expected variant"
+    query_source: deploy-tests/aql/personalization.en.aql
+    command: "python3 /path/to/aql/cli.py {source} {locale}"
+    query_locale: en
+    expect: technical_deep
+```
+
+A ready example spec lives in c2004: `deploy-tests/post-deploy.redeploy.md`
+(run with `redeploy run deploy-tests/post-deploy.redeploy.md`).
+
 ## Plugin system
 
 Extend the step pipeline with custom action types using `action: plugin`:
@@ -934,7 +973,9 @@ Language is auto-detected — Polish, English, or any language the model support
 
 redeploy exposes an [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server,
 letting AI assistants (Claude Desktop, VS Code Copilot, custom agents) call redeploy operations
-as structured tools.
+as structured tools. Planning is enabled by default. Deployment, version, generated-command, and SSH
+mutations require the server-side capability `REDEPLOY_MCP_ALLOW_APPLY=1`, an
+`actor`, and the exact `approval_hash` returned for that operation.
 
 ### Start
 

{redeploy-0.2.78 → redeploy-0.2.80}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "redeploy"
-version = "0.2.78"
+version = "0.2.80"
 description = "Infrastructure migration toolkit: detect → plan → apply"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -18,9 +18,8 @@ dependencies = [
     "httpx>=0.25",
     "rich>=13.0",
     "jmespath>=1.0",
-    "goal>=2.1.0",
-    "costs>=0.1.20",
-    "pfix>=0.1.60",
+    "costs>=0.2.0",
+    "pfix>=0.1.79",
 ]
 license = "Apache-2.0"
 
@@ -30,9 +29,8 @@ redeploy-mcp = "redeploy.mcp_server:serve"
 
 [project.optional-dependencies]
 dev = ["pytest>=8.0", "ruff>=0.4",
-    "goal>=2.1.0",
-    "costs>=0.1.20",
-    "pfix>=0.1.60",
+    "costs>=0.2.0",
+    "pfix>=0.1.79",
 ]
 op3 = ["op3>=0.1.8"]
 mcp = ["mcp>=1.0"]
@@ -40,9 +38,19 @@ mcp = ["mcp>=1.0"]
 [tool.ruff]
 line-length = 100
 
+[tool.setuptools]
+include-package-data = false
+
 [tool.setuptools.packages.find]
 where = ["."]
 include = ["redeploy*"]
+exclude = ["redeploy.tests*"]
+
+[tool.setuptools.package-data]
+redeploy = ["**/*.yaml"]
+
+[tool.setuptools.exclude-package-data]
+redeploy = ["tests/*", "tests/**/*"]
 
 [tool.pfix]
 # Self-healing Python configuration
@@ -72,3 +80,9 @@ max_commits = 500
 
 # Cost thresholds for badge colors (USD)
 badge_color_thresholds = { low = 1.0, medium = 5.0, high = 10.0, critical = 50.0 }
+
+[dependency-groups]
+automation = ["goal>=2.2.0"]
+
+[tool.uv.dependency-groups.automation]
+requires-python = ">=3.12"

{redeploy-0.2.78 → redeploy-0.2.80}/redeploy/__init__.py

@@ -7,7 +7,7 @@ Public API (stable from 0.2.0, semver guaranteed)::
 
 Everything not listed in ``__all__`` is internal and may change without notice.
 """
-__version__ = "0.2.78"
+__version__ = "0.2.80"
 
 # ── Core models ───────────────────────────────────────────────────────────────
 from .models import (  # noqa: F401

{redeploy-0.2.78 → redeploy-0.2.80}/redeploy/analyze/checkers/binary.py

@@ -5,15 +5,37 @@ import re
 import shlex
 import shutil
 
-from ..models import AnalysisResult, IssueSeverity
+from ..models import IssueSeverity
 from .base import Checker
 
 _WRAPPERS = frozenset({"sudo", "env", "command", "nohup", "time", "exec"})
 _KEYWORDS = frozenset({
     "if", "then", "else", "fi", "for", "do", "done", "while", "case", "esac",
     "function", "in", "until", "select", "echo", "true", "false", "test", "[", "[[",
+    "break", "continue", "return", "exit", "shift", "read", "printf", "cd", "pwd",
+    "export", "readonly", "local", "declare", "typeset", "unset", "set", "source", ".",
+    "alias", "unalias", "trap", "wait", "jobs", "fg", "bg", "getopts", "hash",
 })
 _SEPARATORS = frozenset({"&&", "||", "|", ";", "(", ")", "{", "}"})
+_REMOTE_ACTIONS = frozenset({
+    "ssh_cmd",
+    "inline_script",
+    "systemctl_stop",
+    "systemctl_disable",
+    "systemctl_start",
+    "kubectl_delete",
+    "docker_compose_up",
+    "docker_compose_down",
+    "docker_build",
+    "docker_health_wait",
+    "container_log_tail",
+    "podman_build",
+    "ensure_config_line",
+    "raspi_config",
+    "ensure_kanshi_profile",
+    "ensure_autostart_entry",
+    "ensure_browser_kiosk_script",
+})
 
 
 def extract_binaries(cmd: str) -> list[str]:
@@ -57,7 +79,10 @@ class BinaryChecker(Checker):
     def check(self, spec, document, base_dir, result):
         for step in spec.extra_steps:
             action = str(step.get("action") or "")
-            if action in {"ensure_kanshi_profile"}:
+            # Commands for these actions execute on the deployment target.
+            # Checking them with shutil.which() on the controller produces
+            # false warnings and says nothing about target availability.
+            if action in _REMOTE_ACTIONS:
                 continue
             cmd = step.get("command") or ""
             for binary in extract_binaries(cmd):

{redeploy-0.2.78 → redeploy-0.2.80}/redeploy/analyze/checkers/reference.py

@@ -1,7 +1,7 @@
 """Reference integrity checkers for migration specs."""
 from __future__ import annotations
 
-from ..models import AnalysisResult, IssueSeverity
+from ..models import IssueSeverity
 from .base import Checker
 
 
@@ -13,6 +13,18 @@ class ReferenceChecker(Checker):
 
         step_ids = {s.get("id") for s in spec.extra_steps if s.get("id")}
         step_ids |= set(StepLibrary.list())
+        # Strategy steps (for example install_quadlet_files or
+        # stop_<app>) are generated by Planner at runtime and are valid
+        # insertion anchors even though they are absent from extra_steps.
+        try:
+            from ...plan import Planner
+
+            generated = Planner.from_spec(spec).run()
+            step_ids |= {step.id for step in generated.steps}
+        except Exception:
+            # The remaining analyzers report malformed specs. Reference
+            # checking stays best-effort and must not mask their diagnostics.
+            pass
         ref_ids: set[str] = set()
         if document:
             for block in document.blocks: