ski-model-deploy 3.0.3__tar.gz

ski_model_deploy-3.0.3/PKG-INFO

@@ -0,0 +1,124 @@
+Metadata-Version: 2.4
+Name: ski-model-deploy
+Version: 3.0.3
+Summary: Deploy and verify signed Knowledge Graphs against a SKI Model runtime.
+Author-email: KpiFinity <hello@kpifinity.com>
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/kpifinity/ski-framework
+Project-URL: Documentation, https://kpifinity.github.io/ski-framework/
+Project-URL: Issues, https://github.com/kpifinity/ski-framework/issues
+Keywords: ski-framework,compliance,knowledge-graph,deployment
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: click<9,>=8.1.7
+Requires-Dist: pydantic<3,>=2.13.4
+Requires-Dist: python-dotenv<2,>=1.2.2
+Requires-Dist: pyyaml<7,>=6.0.1
+Requires-Dist: jinja2<4,>=3.1.6
+Requires-Dist: httpx<0.29,>=0.27
+Requires-Dist: cryptography<48,>=46
+Requires-Dist: docker<8,>=7
+Requires-Dist: psycopg[binary]<4,>=3.1.18
+
+# ski-model-deploy
+
+> Install from PyPI: `pip install ski-model-deploy` (publishing starts with the first release after June 2026).
+
+> **⚠ STATUS: EARLY ALPHA (v0.1.0a0).** Alpha-quality tooling. See the
+> repo root `README.md` for the project-wide status.
+
+Deploy and configure the SKI Model inference engine on-premise.
+
+`ski-model-deploy` is the deployment toolkit for the SKI Framework v2.1
+runtime. (In pre-v2.1 docs this tool was called `milm-deploy`.)
+
+## What it does
+
+1. Generate a deployment configuration for a sector deployment.
+2. **Verify the Ed25519 signature of a Knowledge Graph and register it
+   with the deployment.** Signature verification is mandatory — there is
+   no `--no-verify` escape hatch.
+3. Stand up the SKI Model stack via Docker (Kubernetes manifests planned
+   for v0.2).
+4. Surface deployment status and a basic health view.
+
+## Installation
+
+```bash
+pip install -e tools/ski-model-deploy
+```
+
+## Quick start
+
+```bash
+# 1. Initialise a deployment config (writes deployment-config.yaml).
+ski-model-deploy init --name energy-prod --sector energy
+
+# 2. Load a SIGNED Knowledge Graph (this will refuse to load an unsigned KG).
+ski-model-deploy load-kg \
+  --config deployment-config.yaml \
+  --kg /path/to/signed-kg.json
+
+# 3. Start the stack.
+ski-model-deploy start --config deployment-config.yaml
+
+# 4. Status.
+ski-model-deploy status --config deployment-config.yaml
+```
+
+## Commands
+
+| Command | Purpose |
+|---|---|
+| `init`      | Create a new deployment configuration. |
+| `load-kg`   | Verify a signed KG and register it. Signature verification is mandatory. |
+| `start`     | Bring up the stack (docker compose for the alpha; k8s planned). |
+| `stop`      | Tear down the stack. |
+| `status`    | Report deployment status as JSON. |
+
+`--help` is supported on every command.
+
+## Environment variables
+
+The runtime (the SKI Model service itself) reads its own environment
+variables documented in
+`reference-implementation/.env.example`. The deployer cares about a
+small subset relevant to its own operation:
+
+| Variable | Default | Notes |
+|---|---|---|
+| `SKI_API_KEY` | required | Used for `--api-key` on `status` health probes. |
+| `LEDGER_DSN` | required | Audit ledger DSN. |
+| `OLLAMA_BASE_URL` | `http://ollama:11434` | Default inference backend URL. |
+| `SKI_MODEL_NAME` | `qwen2.5:7b-instruct` | Model the runtime should use. |
+| `SKI_MODEL_FILE_SHA256` | optional | If set, the runtime refuses to start unless the pulled model artefact matches. |
+
+A non-conformant `anthropic` demo backend exists in the runtime. The
+deployer does not encourage or wire it in. It is intentionally
+inconvenient to enable.
+
+## Signature verification — mandatory
+
+This tool will REFUSE to load a Knowledge Graph that:
+
+- has no `signature` block, or
+- has `algorithm: "DEMO_UNSIGNED"`, or
+- has a signature that does not verify under the embedded public key.
+
+There is no `--no-verify`, no `verify_signature=False`, no override flag.
+If you absolutely need to load an unsigned KG (for local prototyping
+only), you must set `KG_REQUIRE_SIGNATURE=false` on the runtime, which
+makes the deployment non-conformant and is reported as such by the
+conformance test suite.
+
+## Licensing
+
+Apache 2.0. See [`../../LICENSE`](../../LICENSE).

ski_model_deploy-3.0.3/README.md

@@ -0,0 +1,94 @@
+# ski-model-deploy
+
+> Install from PyPI: `pip install ski-model-deploy` (publishing starts with the first release after June 2026).
+
+> **⚠ STATUS: EARLY ALPHA (v0.1.0a0).** Alpha-quality tooling. See the
+> repo root `README.md` for the project-wide status.
+
+Deploy and configure the SKI Model inference engine on-premise.
+
+`ski-model-deploy` is the deployment toolkit for the SKI Framework v2.1
+runtime. (In pre-v2.1 docs this tool was called `milm-deploy`.)
+
+## What it does
+
+1. Generate a deployment configuration for a sector deployment.
+2. **Verify the Ed25519 signature of a Knowledge Graph and register it
+   with the deployment.** Signature verification is mandatory — there is
+   no `--no-verify` escape hatch.
+3. Stand up the SKI Model stack via Docker (Kubernetes manifests planned
+   for v0.2).
+4. Surface deployment status and a basic health view.
+
+## Installation
+
+```bash
+pip install -e tools/ski-model-deploy
+```
+
+## Quick start
+
+```bash
+# 1. Initialise a deployment config (writes deployment-config.yaml).
+ski-model-deploy init --name energy-prod --sector energy
+
+# 2. Load a SIGNED Knowledge Graph (this will refuse to load an unsigned KG).
+ski-model-deploy load-kg \
+  --config deployment-config.yaml \
+  --kg /path/to/signed-kg.json
+
+# 3. Start the stack.
+ski-model-deploy start --config deployment-config.yaml
+
+# 4. Status.
+ski-model-deploy status --config deployment-config.yaml
+```
+
+## Commands
+
+| Command | Purpose |
+|---|---|
+| `init`      | Create a new deployment configuration. |
+| `load-kg`   | Verify a signed KG and register it. Signature verification is mandatory. |
+| `start`     | Bring up the stack (docker compose for the alpha; k8s planned). |
+| `stop`      | Tear down the stack. |
+| `status`    | Report deployment status as JSON. |
+
+`--help` is supported on every command.
+
+## Environment variables
+
+The runtime (the SKI Model service itself) reads its own environment
+variables documented in
+`reference-implementation/.env.example`. The deployer cares about a
+small subset relevant to its own operation:
+
+| Variable | Default | Notes |
+|---|---|---|
+| `SKI_API_KEY` | required | Used for `--api-key` on `status` health probes. |
+| `LEDGER_DSN` | required | Audit ledger DSN. |
+| `OLLAMA_BASE_URL` | `http://ollama:11434` | Default inference backend URL. |
+| `SKI_MODEL_NAME` | `qwen2.5:7b-instruct` | Model the runtime should use. |
+| `SKI_MODEL_FILE_SHA256` | optional | If set, the runtime refuses to start unless the pulled model artefact matches. |
+
+A non-conformant `anthropic` demo backend exists in the runtime. The
+deployer does not encourage or wire it in. It is intentionally
+inconvenient to enable.
+
+## Signature verification — mandatory
+
+This tool will REFUSE to load a Knowledge Graph that:
+
+- has no `signature` block, or
+- has `algorithm: "DEMO_UNSIGNED"`, or
+- has a signature that does not verify under the embedded public key.
+
+There is no `--no-verify`, no `verify_signature=False`, no override flag.
+If you absolutely need to load an unsigned KG (for local prototyping
+only), you must set `KG_REQUIRE_SIGNATURE=false` on the runtime, which
+makes the deployment non-conformant and is reported as such by the
+conformance test suite.
+
+## Licensing
+
+Apache 2.0. See [`../../LICENSE`](../../LICENSE).

ski_model_deploy-3.0.3/pyproject.toml

@@ -0,0 +1,48 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "ski-model-deploy"
+version = "3.0.3"
+description = "Deploy and verify signed Knowledge Graphs against a SKI Model runtime."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "Apache-2.0"
+authors = [{ name = "KpiFinity", email = "hello@kpifinity.com" }]
+keywords = ["ski-framework", "compliance", "knowledge-graph", "deployment"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: System Administrators",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = [
+    "click>=8.1.7,<9",
+    "pydantic>=2.13.4,<3",
+    "python-dotenv>=1.2.2,<2",
+    "pyyaml>=6.0.1,<7",
+    "jinja2>=3.1.6,<4",
+    "httpx>=0.27,<0.29",
+    "cryptography>=46,<48",
+    "docker>=7,<8",
+    "psycopg[binary]>=3.1.18,<4",
+]
+
+[project.urls]
+Homepage = "https://github.com/kpifinity/ski-framework"
+Documentation = "https://kpifinity.github.io/ski-framework/"
+Issues = "https://github.com/kpifinity/ski-framework/issues"
+
+[project.scripts]
+ski-model-deploy = "ski_model_deploy.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+ski_model_deploy = ["py.typed"]

ski_model_deploy-3.0.3/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

ski_model_deploy-3.0.3/src/ski_model_deploy/__init__.py

@@ -0,0 +1,9 @@
+"""ski-model-deploy — deploy and verify signed Knowledge Graphs against a SKI Model runtime."""
+
+from .deployer import Deployer, UnsignedKGError
+from .models import DeploymentConfig, DeploymentStatus
+
+__version__ = "3.0.3"
+__author__ = "KpiFinity"
+
+__all__ = ["Deployer", "DeploymentConfig", "DeploymentStatus", "UnsignedKGError"]

ski_model_deploy-3.0.3/src/ski_model_deploy/cli.py

@@ -0,0 +1,106 @@
+"""Command-line interface for ski-model-deploy."""
+
+from __future__ import annotations
+
+import json
+
+import click
+
+from .deployer import Deployer, UnsignedKGError
+from .utils import load_config, save_config
+
+
+@click.group()
+def main() -> None:
+    """Deploy and configure the SKI Model inference engine."""
+
+
+@main.command()
+@click.option("--name", "-n", required=True, help="Deployment name")
+@click.option(
+    "--sector", "-s", required=True, help="Industry sector (energy, finance, manufacturing, defense)"
+)
+@click.option("--mode", "-m", default="docker", help="Deployment mode (docker, kubernetes, direct)")
+@click.option("--output", "-o", default="deployment-config.yaml", help="Output config file")
+def init(name: str, sector: str, mode: str, output: str) -> None:
+    """Initialise a new SKI Model deployment configuration."""
+    deployer = Deployer()
+    config = deployer.initialize(name=name, sector=sector, mode=mode, config_output=output)
+    click.echo("✓ Deployment initialised")
+    click.echo(f"  Name:   {config.name}")
+    click.echo(f"  Sector: {config.sector}")
+    click.echo(f"  Mode:   {config.mode}")
+    click.echo(f"\nConfiguration saved to: {output}")
+    click.echo("\nNext steps:")
+    click.echo(f"  1. Review:           cat {output}")
+    click.echo(f"  2. Load signed KG:   ski-model-deploy load-kg --config {output} --kg signed-kg.json")
+    click.echo(f"  3. Start the stack:  ski-model-deploy start --config {output}")
+
+
+@main.command(name="load-kg")
+@click.option("--config", "-c", required=True, help="Deployment configuration file")
+@click.option("--kg", "-k", required=True, help="Knowledge Graph JSON file (MUST be signed)")
+def load_kg(config: str, kg: str) -> None:
+    """Verify a signed Knowledge Graph and register it with a deployment.
+
+    Signature verification is MANDATORY. There is no override flag here.
+    To load an unsigned KG you would have to disable signature checking
+    on the server itself (KG_REQUIRE_SIGNATURE=false), which makes the
+    deployment non-conformant.
+    """
+    try:
+        deployer = Deployer(config)
+        if not deployer.config:
+            deployer.config = load_config(config)
+        deployer.load_knowledge_graph(kg_path=kg)
+        save_config(deployer.config, config)
+        click.echo("✓ Knowledge Graph signature verified and registered.")
+        click.echo(f"  Version: {deployer.config.knowledge_graph.version}")
+        click.echo(f"  Path:    {deployer.config.knowledge_graph.path}")
+    except UnsignedKGError as exc:
+        click.echo(f"✗ Refused to load: {exc}", err=True)
+        raise SystemExit(1)
+    except Exception as exc:
+        click.echo(f"Error: {exc}", err=True)
+        raise SystemExit(1)
+
+
+@main.command()
+@click.option("--config", "-c", required=True, help="Deployment configuration file")
+def start(config: str) -> None:
+    """Start a deployed SKI Model stack."""
+    deployer = Deployer(config)
+    if not deployer.config:
+        deployer.config = load_config(config)
+    if deployer.start():
+        click.echo("✓ Deployment started.")
+    else:
+        click.echo("✗ Start failed.", err=True)
+        raise SystemExit(1)
+
+
+@main.command()
+@click.option("--config", "-c", required=True, help="Deployment configuration file")
+def stop(config: str) -> None:
+    deployer = Deployer(config)
+    if not deployer.config:
+        deployer.config = load_config(config)
+    if deployer.stop():
+        click.echo("✓ Deployment stopped.")
+    else:
+        click.echo("✗ Stop failed.", err=True)
+        raise SystemExit(1)
+
+
+@main.command()
+@click.option("--config", "-c", required=True, help="Deployment configuration file")
+def status(config: str) -> None:
+    deployer = Deployer(config)
+    if not deployer.config:
+        deployer.config = load_config(config)
+    s = deployer.get_status()
+    click.echo(json.dumps(s.model_dump(), indent=2, default=str))
+
+
+if __name__ == "__main__":  # pragma: no cover
+    main()

ski_model_deploy-3.0.3/src/ski_model_deploy/deployer.py

@@ -0,0 +1,192 @@
+"""Deploy and verify Knowledge Graphs against a running SKI Model.
+
+v2.1 changes:
+  * MiLM → SKI Model rename throughout.
+  * Knowledge Graph signature verification is MANDATORY. There is no
+    `verify_signature=False` escape hatch. Per the Phase 1 → Phase 2
+    boundary in the spec, a spec-conformant deployment never loads an
+    unsigned KG. (Operators who insist on testing with an unsigned KG
+    must set `KG_REQUIRE_SIGNATURE=false` on the server itself, which
+    disqualifies the deployment from any conformance level.)
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import time
+from pathlib import Path
+from typing import Dict, Optional
+
+from .models import DeploymentConfig, DeploymentMode, DeploymentStatus, HealthCheck
+from .utils import generate_docker_compose, load_config, save_config
+
+# Signature verification lives in the runtime package so the on-disk
+# format is shared between the deployer and the server.
+try:
+    import sys
+
+    sys.path.insert(
+        0,
+        str(Path(__file__).resolve().parents[5] / "reference-implementation" / "src"),
+    )
+    from ski_model.kg_loader import KnowledgeGraph  # type: ignore
+except Exception:  # pragma: no cover — fall back when run as installed package
+    KnowledgeGraph = None  # type: ignore
+
+
+class UnsignedKGError(RuntimeError):
+    """Raised if signature verification fails or is missing."""
+
+
+class Deployer:
+    """Deploy and manage the SKI Model runtime."""
+
+    def __init__(self, config_path: Optional[str] = None):
+        self.config_path = config_path
+        self.config: Optional[DeploymentConfig] = None
+        self.deployment_start_time: Optional[float] = None
+
+        if config_path and os.path.exists(config_path):
+            self.config = load_config(config_path)
+
+    def initialize(
+        self,
+        name: str,
+        sector: str,
+        mode: str = "docker",
+        config_output: Optional[str] = None,
+    ) -> DeploymentConfig:
+        self.config = DeploymentConfig(name=name, sector=sector, mode=DeploymentMode(mode))
+        if config_output:
+            save_config(self.config, config_output)
+            self.config_path = config_output
+        return self.config
+
+    # ------------------------------------------------------------------
+    # KG loading — signature verification is MANDATORY.
+    # ------------------------------------------------------------------
+
+    def load_knowledge_graph(self, kg_path: str) -> bool:
+        """Verify a Knowledge Graph signature and register it with the deployment.
+
+        Raises UnsignedKGError if the KG has no signature or the signature
+        does not verify. There is no flag to bypass this.
+        """
+        if not os.path.exists(kg_path):
+            raise FileNotFoundError(f"Knowledge Graph not found: {kg_path}")
+
+        with open(kg_path) as f:
+            kg_data = json.load(f)
+
+        if "signature" not in kg_data:
+            raise UnsignedKGError(
+                f"{kg_path} has no signature block. ski-model-deploy refuses "
+                "to load unsigned Knowledge Graphs. Sign with your production "
+                "Ed25519 key first."
+            )
+
+        if KnowledgeGraph is None:
+            # Defensive: we can't verify without the loader. Refuse rather
+            # than pretend.
+            raise UnsignedKGError(
+                "ski-model.kg_loader is unavailable in this environment; "
+                "cannot verify the signature. Refusing to load."
+            )
+
+        try:
+            kg = KnowledgeGraph.from_dict(kg_data, require_signature=True)
+        except Exception as exc:
+            raise UnsignedKGError(f"Signature verification failed for {kg_path}: {exc}") from exc
+
+        if self.config:
+            from .models import KnowledgeGraphConfig
+
+            self.config.knowledge_graph = KnowledgeGraphConfig(
+                path=kg_path,
+                version=kg.version,
+                signature_verified=True,
+            )
+        return True
+
+    # ------------------------------------------------------------------
+    # Lifecycle
+    # ------------------------------------------------------------------
+
+    def start(self, mode: Optional[str] = None) -> bool:
+        if not self.config:
+            raise ValueError("Deployment not initialised. Call initialize() first.")
+        if mode:
+            self.config.mode = DeploymentMode(mode)
+        self.deployment_start_time = time.monotonic()
+        if self.config.mode == DeploymentMode.DOCKER:
+            return self._start_docker()
+        if self.config.mode == DeploymentMode.KUBERNETES:
+            return self._start_kubernetes()
+        if self.config.mode == DeploymentMode.DIRECT:
+            return self._start_direct()
+        raise ValueError(f"Unknown mode: {self.config.mode}")
+
+    def _start_docker(self) -> bool:
+        docker_compose = generate_docker_compose(self.config)
+        Path("docker-compose.yml").write_text(docker_compose)
+        return subprocess.run(["docker", "compose", "up", "-d"], cwd=".").returncode == 0
+
+    def _start_kubernetes(self) -> bool:  # pragma: no cover — planned
+        return True
+
+    def _start_direct(self) -> bool:  # pragma: no cover — planned
+        return True
+
+    def stop(self) -> bool:
+        if self.config and self.config.mode == DeploymentMode.DOCKER:
+            return subprocess.run(["docker", "compose", "down"], cwd=".").returncode == 0
+        return True
+
+    def verify(self, endpoint: str = "https://localhost:8000", api_key: Optional[str] = None) -> bool:
+        try:
+            import httpx
+        except ImportError:
+            return False
+        headers = {"x-api-key": api_key} if api_key else {}
+        try:
+            # Dev-only health probe against self-signed certs. The production
+            # path uses SKI_MODEL_CA_CERT pinning in sidecar/main.py.
+            # Each tool's suppression directive (ruff S501, bandit B501) sits
+            # on the verify=False argument line so the scanner sees it on its
+            # own triggering token. (Phrasing avoids the literal directive
+            # word at column start; ruff RUF100 would otherwise flag this
+            # comment as a misplaced blanket directive.)
+            r = httpx.get(
+                f"{endpoint}/api/health",
+                headers=headers,
+                timeout=5.0,
+                verify=False,  # noqa: S501  # nosec B501
+            )
+            return r.status_code == 200
+        except Exception:
+            return False
+
+    def health_check(self) -> Dict[str, HealthCheck]:
+        return {
+            "ski-model": HealthCheck(service="ski-model", status="healthy", response_time_ms=10.0),
+            "ledger": HealthCheck(service="ledger", status="healthy", response_time_ms=5.0),
+        }
+
+    def get_status(self) -> DeploymentStatus:
+        uptime = int(time.monotonic() - self.deployment_start_time) if self.deployment_start_time else 0
+        return DeploymentStatus(
+            status="RUNNING",
+            mode=self.config.mode if self.config else "unknown",
+            uptime_seconds=uptime,
+            knowledge_graph_loaded=bool(self.config and self.config.knowledge_graph),
+            knowledge_graph_version=(
+                self.config.knowledge_graph.version if self.config and self.config.knowledge_graph else None
+            ),
+            ledger_entries=0,
+            api_healthy=self.verify(),
+            sidecar_connected=bool(self.config and self.config.sidecar.enabled),
+            telemetry_received=0,
+            verdicts_produced=0,
+        )

ski_model_deploy-3.0.3/src/ski_model_deploy/models.py

@@ -0,0 +1,127 @@
+"""Data models for ski-model-deploy.
+
+v2.1 changes:
+  * MiLM → SKI Model renames.
+  * `KnowledgeGraphConfig.verify_signature` removed — verification is
+    mandatory at the deployer level, not a knob.
+  * `SecurityConfig.tls_enabled` defaults to True.
+  * `MiLMConfig` renamed to `SkiModelConfig`. The default model is no
+    longer a Claude SKU; the local Ollama model is the default.
+"""
+
+from enum import Enum
+from typing import Any, Dict, Optional
+
+from pydantic import BaseModel, Field
+
+
+class DeploymentMode(str, Enum):
+    DOCKER = "docker"
+    KUBERNETES = "kubernetes"
+    DIRECT = "direct"
+
+
+class DeploymentStatusEnum(str, Enum):
+    UNINITIALIZED = "UNINITIALIZED"
+    INITIALIZING = "INITIALIZING"
+    READY = "READY"
+    RUNNING = "RUNNING"
+    STOPPED = "STOPPED"
+    FAILED = "FAILED"
+
+
+class SkiModelConfig(BaseModel):
+    """SKI Model service configuration."""
+
+    backend: str = "ollama"
+    model: str = "qwen2.5:7b-instruct"
+    temperature: float = Field(0.0, ge=0, le=0)  # must be 0 for determinism
+    seed: int = 42
+    max_tokens: int = 512
+    model_file_sha256: Optional[str] = None
+    timeout_seconds: int = 60
+    max_retries: int = 3
+
+
+class KnowledgeGraphConfig(BaseModel):
+    """Knowledge Graph configuration as known to the deployer."""
+
+    path: str
+    version: str = "v0.1"
+    signature_verified: bool = True  # set by the deployer after verification
+    auto_reload: bool = False
+    reload_interval_seconds: Optional[int] = None
+
+
+class LedgerConfig(BaseModel):
+    backend: str = "postgresql"
+    dsn_env: str = "LEDGER_DSN"
+    hash_algorithm: str = "sha256"
+    # Retention is operator policy. Sensible regulated-industry defaults
+    # are 5-10 years; we don't impose a default here so cleanup scripts
+    # cannot quietly destroy required evidence.
+    retention_days: Optional[int] = None
+    backup_enabled: bool = True
+    backup_interval_days: int = 7
+
+
+class SidecarConfig(BaseModel):
+    enabled: bool = True
+    telemetry_source: str = "file"  # file | http | kafka
+    batch_size: int = 100
+    heartbeat_interval: int = 60
+    kafka_brokers: Optional[str] = None
+    kafka_topic: Optional[str] = None
+    http_endpoint: Optional[str] = None
+    file_path: Optional[str] = None
+
+
+class MonitoringConfig(BaseModel):
+    enabled: bool = True
+    prometheus_port: int = 9090
+    health_check_interval: int = 30
+    log_level: str = "INFO"
+    log_format: str = "json"
+
+
+class SecurityConfig(BaseModel):
+    api_key_required: bool = True
+    tls_enabled: bool = True
+    cert_path: Optional[str] = None
+    key_path: Optional[str] = None
+    api_key: Optional[str] = None
+
+
+class DeploymentConfig(BaseModel):
+    name: str
+    sector: str
+    mode: DeploymentMode = DeploymentMode.DOCKER
+    install_path: str = "/opt/ski-model"
+
+    ski_model: SkiModelConfig = SkiModelConfig()
+    knowledge_graph: Optional[KnowledgeGraphConfig] = None
+    ledger: LedgerConfig = LedgerConfig()
+    sidecar: SidecarConfig = SidecarConfig()
+    monitoring: MonitoringConfig = MonitoringConfig()
+    security: SecurityConfig = SecurityConfig()
+
+
+class DeploymentStatus(BaseModel):
+    status: DeploymentStatusEnum = DeploymentStatusEnum.UNINITIALIZED
+    mode: DeploymentMode = DeploymentMode.DOCKER
+    uptime_seconds: int = 0
+    knowledge_graph_loaded: bool = False
+    knowledge_graph_version: Optional[str] = None
+    ledger_entries: int = 0
+    api_healthy: bool = False
+    sidecar_connected: bool = False
+    telemetry_received: int = 0
+    verdicts_produced: int = 0
+    last_verdict_timestamp: Optional[str] = None
+
+
+class HealthCheck(BaseModel):
+    service: str
+    status: str
+    response_time_ms: float
+    details: Dict[str, Any] = {}

ski_model_deploy-3.0.3/src/ski_model_deploy/utils.py

@@ -0,0 +1,168 @@
+"""Utility functions for ski-model-deploy."""
+
+from __future__ import annotations
+
+import json
+import os
+
+import yaml
+from jinja2 import Template
+
+from .models import DeploymentConfig
+
+
+def load_config(config_path: str) -> DeploymentConfig:
+    if not os.path.exists(config_path):
+        raise FileNotFoundError(f"Configuration not found: {config_path}")
+
+    with open(config_path) as f:
+        if config_path.endswith((".yaml", ".yml")):
+            config_data = yaml.safe_load(f)
+        else:
+            config_data = json.load(f)
+
+    return DeploymentConfig(**config_data)
+
+
+def save_config(config: DeploymentConfig, output_path: str) -> None:
+    data = config.model_dump()
+    if output_path.endswith((".yaml", ".yml")):
+        with open(output_path, "w") as f:
+            yaml.dump(data, f, default_flow_style=False, sort_keys=True)
+    else:
+        with open(output_path, "w") as f:
+            json.dump(data, f, indent=2, default=str)
+
+
+# ---------------------------------------------------------------------------
+# Docker compose template
+# ---------------------------------------------------------------------------
+#
+# Sovereign-by-default: no ANTHROPIC_API_KEY anywhere. Ollama is the
+# inference backend. Operators who want the non-conformant demo backend
+# can override SKI_INFERENCE_BACKEND=anthropic and supply the key out of
+# band, with the caveat that doing so disqualifies the deployment.
+
+DOCKER_COMPOSE_TEMPLATE = """version: '3.8'
+
+services:
+  ollama:
+    image: ollama/ollama:0.3.12
+    container_name: ollama-{{ name }}
+    volumes:
+      - ollama-models:/root/.ollama
+    networks:
+      - ski-network
+    restart: unless-stopped
+
+  ski-model:
+    image: kpifinity/ski-model:0.1.0-alpha
+    container_name: ski-model-{{ name }}
+    ports:
+      - "8000:8000"
+    environment:
+      SKI_INFERENCE_BACKEND: {{ ski_model.backend }}
+      SKI_MODEL_NAME: {{ ski_model.model }}
+      SKI_MODEL_TEMPERATURE: "{{ ski_model.temperature }}"
+      SKI_MODEL_SEED: "{{ ski_model.seed }}"
+      SKI_MODEL_MAX_TOKENS: "{{ ski_model.max_tokens }}"
+      KG_PATH: /app/kg/kg.json
+      KG_REQUIRE_SIGNATURE: "true"
+      TLS_ENABLED: "{{ security.tls_enabled | string | lower }}"
+      API_KEY_REQUIRED: "{{ security.api_key_required | string | lower }}"
+      OLLAMA_BASE_URL: http://ollama:11434
+    volumes:
+      - ./kg.json:/app/kg/kg.json:ro
+      - ski-model-data:/data
+    networks:
+      - ski-network
+    depends_on:
+      - ollama
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-fkS", "https://localhost:8000/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+  {% if sidecar.enabled %}
+  sidecar:
+    image: kpifinity/ski-sidecar:0.1.0-alpha
+    container_name: sidecar-{{ name }}
+    environment:
+      SKI_MODEL_ENDPOINT: https://ski-model:8000
+      TELEMETRY_SOURCE: {{ sidecar.telemetry_source }}
+      TELEMETRY_BATCH_SIZE: "{{ sidecar.batch_size }}"
+      HEARTBEAT_INTERVAL: "{{ sidecar.heartbeat_interval }}"
+      {% if sidecar.kafka_brokers %}KAFKA_BROKERS: {{ sidecar.kafka_brokers }}
+      KAFKA_TOPIC: {{ sidecar.kafka_topic }}{% endif %}
+    networks:
+      - ski-network
+    depends_on:
+      - ski-model
+    restart: unless-stopped
+  {% endif %}
+
+  {% if monitoring.enabled %}
+  prometheus:
+    image: prom/prometheus:v2.50.1
+    container_name: prometheus-{{ name }}
+    ports:
+      - "{{ monitoring.prometheus_port }}:9090"
+    volumes:
+      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - prometheus-data:/prometheus
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+    networks:
+      - ski-network
+    restart: unless-stopped
+  {% endif %}
+
+volumes:
+  ollama-models:
+  ski-model-data:
+  {% if monitoring.enabled %}prometheus-data:{% endif %}
+
+networks:
+  ski-network:
+    driver: bridge
+"""
+
+
+def generate_docker_compose(config: DeploymentConfig) -> str:
+    template = Template(DOCKER_COMPOSE_TEMPLATE)
+    return template.render(
+        name=config.name,
+        ski_model=config.ski_model.model_dump(),
+        sidecar=config.sidecar.model_dump(),
+        monitoring=config.monitoring.model_dump(),
+        security=config.security.model_dump(),
+    )
+
+
+SYSTEMD_TEMPLATE = """[Unit]
+Description=SKI Model inference engine — {{ name }}
+After=network.target
+
+[Service]
+Type=simple
+User=ski-model
+WorkingDirectory={{ install_path }}
+ExecStart=/usr/bin/python3 -m ski_model.server
+EnvironmentFile={{ install_path }}/.env
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+"""
+
+
+def generate_systemd_service(config: DeploymentConfig) -> str:
+    return Template(SYSTEMD_TEMPLATE).render(name=config.name, install_path=config.install_path)
+
+
+def generate_k8s_manifest(config: DeploymentConfig) -> str:
+    """Planned for v0.2 — see reference-implementation/docs/KUBERNETES.md."""
+    return ""

ski_model_deploy-3.0.3/src/ski_model_deploy.egg-info/PKG-INFO

@@ -0,0 +1,124 @@
+Metadata-Version: 2.4
+Name: ski-model-deploy
+Version: 3.0.3
+Summary: Deploy and verify signed Knowledge Graphs against a SKI Model runtime.
+Author-email: KpiFinity <hello@kpifinity.com>
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/kpifinity/ski-framework
+Project-URL: Documentation, https://kpifinity.github.io/ski-framework/
+Project-URL: Issues, https://github.com/kpifinity/ski-framework/issues
+Keywords: ski-framework,compliance,knowledge-graph,deployment
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: click<9,>=8.1.7
+Requires-Dist: pydantic<3,>=2.13.4
+Requires-Dist: python-dotenv<2,>=1.2.2
+Requires-Dist: pyyaml<7,>=6.0.1
+Requires-Dist: jinja2<4,>=3.1.6
+Requires-Dist: httpx<0.29,>=0.27
+Requires-Dist: cryptography<48,>=46
+Requires-Dist: docker<8,>=7
+Requires-Dist: psycopg[binary]<4,>=3.1.18
+
+# ski-model-deploy
+
+> Install from PyPI: `pip install ski-model-deploy` (publishing starts with the first release after June 2026).
+
+> **⚠ STATUS: EARLY ALPHA (v0.1.0a0).** Alpha-quality tooling. See the
+> repo root `README.md` for the project-wide status.
+
+Deploy and configure the SKI Model inference engine on-premise.
+
+`ski-model-deploy` is the deployment toolkit for the SKI Framework v2.1
+runtime. (In pre-v2.1 docs this tool was called `milm-deploy`.)
+
+## What it does
+
+1. Generate a deployment configuration for a sector deployment.
+2. **Verify the Ed25519 signature of a Knowledge Graph and register it
+   with the deployment.** Signature verification is mandatory — there is
+   no `--no-verify` escape hatch.
+3. Stand up the SKI Model stack via Docker (Kubernetes manifests planned
+   for v0.2).
+4. Surface deployment status and a basic health view.
+
+## Installation
+
+```bash
+pip install -e tools/ski-model-deploy
+```
+
+## Quick start
+
+```bash
+# 1. Initialise a deployment config (writes deployment-config.yaml).
+ski-model-deploy init --name energy-prod --sector energy
+
+# 2. Load a SIGNED Knowledge Graph (this will refuse to load an unsigned KG).
+ski-model-deploy load-kg \
+  --config deployment-config.yaml \
+  --kg /path/to/signed-kg.json
+
+# 3. Start the stack.
+ski-model-deploy start --config deployment-config.yaml
+
+# 4. Status.
+ski-model-deploy status --config deployment-config.yaml
+```
+
+## Commands
+
+| Command | Purpose |
+|---|---|
+| `init`      | Create a new deployment configuration. |
+| `load-kg`   | Verify a signed KG and register it. Signature verification is mandatory. |
+| `start`     | Bring up the stack (docker compose for the alpha; k8s planned). |
+| `stop`      | Tear down the stack. |
+| `status`    | Report deployment status as JSON. |
+
+`--help` is supported on every command.
+
+## Environment variables
+
+The runtime (the SKI Model service itself) reads its own environment
+variables documented in
+`reference-implementation/.env.example`. The deployer cares about a
+small subset relevant to its own operation:
+
+| Variable | Default | Notes |
+|---|---|---|
+| `SKI_API_KEY` | required | Used for `--api-key` on `status` health probes. |
+| `LEDGER_DSN` | required | Audit ledger DSN. |
+| `OLLAMA_BASE_URL` | `http://ollama:11434` | Default inference backend URL. |
+| `SKI_MODEL_NAME` | `qwen2.5:7b-instruct` | Model the runtime should use. |
+| `SKI_MODEL_FILE_SHA256` | optional | If set, the runtime refuses to start unless the pulled model artefact matches. |
+
+A non-conformant `anthropic` demo backend exists in the runtime. The
+deployer does not encourage or wire it in. It is intentionally
+inconvenient to enable.
+
+## Signature verification — mandatory
+
+This tool will REFUSE to load a Knowledge Graph that:
+
+- has no `signature` block, or
+- has `algorithm: "DEMO_UNSIGNED"`, or
+- has a signature that does not verify under the embedded public key.
+
+There is no `--no-verify`, no `verify_signature=False`, no override flag.
+If you absolutely need to load an unsigned KG (for local prototyping
+only), you must set `KG_REQUIRE_SIGNATURE=false` on the runtime, which
+makes the deployment non-conformant and is reported as such by the
+conformance test suite.
+
+## Licensing
+
+Apache 2.0. See [`../../LICENSE`](../../LICENSE).

ski_model_deploy-3.0.3/src/ski_model_deploy.egg-info/SOURCES.txt

@@ -0,0 +1,15 @@
+README.md
+pyproject.toml
+src/ski_model_deploy/__init__.py
+src/ski_model_deploy/cli.py
+src/ski_model_deploy/deployer.py
+src/ski_model_deploy/models.py
+src/ski_model_deploy/py.typed
+src/ski_model_deploy/utils.py
+src/ski_model_deploy.egg-info/PKG-INFO
+src/ski_model_deploy.egg-info/SOURCES.txt
+src/ski_model_deploy.egg-info/dependency_links.txt
+src/ski_model_deploy.egg-info/entry_points.txt
+src/ski_model_deploy.egg-info/requires.txt
+src/ski_model_deploy.egg-info/top_level.txt
+tests/test_deployer.py

ski_model_deploy-3.0.3/src/ski_model_deploy.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

ski_model_deploy-3.0.3/src/ski_model_deploy.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+ski-model-deploy = ski_model_deploy.cli:main

ski_model_deploy-3.0.3/src/ski_model_deploy.egg-info/requires.txt

@@ -0,0 +1,9 @@
+click<9,>=8.1.7
+pydantic<3,>=2.13.4
+python-dotenv<2,>=1.2.2
+pyyaml<7,>=6.0.1
+jinja2<4,>=3.1.6
+httpx<0.29,>=0.27
+cryptography<48,>=46
+docker<8,>=7
+psycopg[binary]<4,>=3.1.18

ski_model_deploy-3.0.3/src/ski_model_deploy.egg-info/top_level.txt

@@ -0,0 +1 @@
+ski_model_deploy

ski_model_deploy-3.0.3/tests/test_deployer.py

@@ -0,0 +1,43 @@
+"""Tests for the ski-model-deploy deployer."""
+
+import pytest
+from ski_model_deploy import Deployer
+from ski_model_deploy.models import DeploymentConfig, DeploymentMode
+
+
+class TestDeployer:
+    def test_initialize_deployment(self) -> None:
+        deployer = Deployer()
+        config = deployer.initialize(name="test-system", sector="energy", mode="docker")
+        assert config.name == "test-system"
+        assert config.sector == "energy"
+        assert config.mode == DeploymentMode.DOCKER
+
+    def test_deployer_config_persistence(self) -> None:
+        deployer = Deployer()
+        deployer.initialize(name="test-system", sector="finance")
+        assert deployer.config is not None
+        assert deployer.config.name == "test-system"
+
+
+class TestDeploymentConfig:
+    def test_config_defaults_are_sovereign(self) -> None:
+        config = DeploymentConfig(name="test", sector="energy")
+        # Sovereign-by-default: local Ollama backend, temperature=0, mandatory TLS + API key.
+        assert config.ski_model.backend == "ollama"
+        assert config.ski_model.temperature == 0.0
+        assert config.ski_model.model == "qwen2.5:7b-instruct"
+        assert config.security.tls_enabled is True
+        assert config.security.api_key_required is True
+        assert config.monitoring.enabled is True
+        assert config.ledger.backend == "postgresql"
+
+    def test_config_sidecar_defaults_to_file_source(self) -> None:
+        config = DeploymentConfig(name="test", sector="energy")
+        assert config.sidecar.enabled is True
+        # Default telemetry source is "file" — Kafka is opt-in via compose profile.
+        assert config.sidecar.telemetry_source == "file"
+
+
+if __name__ == "__main__":  # pragma: no cover
+    pytest.main([__file__])