714 lines
33 KiB
Python
714 lines
33 KiB
Python
"""Governed release orchestration with a trusted-plan V2R2C2 path.
|
|
|
|
The legacy V2R2C1 implementation remains available only for compatibility;
|
|
new release requests are dispatched to the plan-driven executor below.
|
|
|
|
This module is deliberately scoped to the Owner-approved V2R2C1 binding. It
|
|
uses the existing TagPublisher and metadata adapters; it does not introduce a
|
|
second Git writer, a second durable job store, or an alternate baseline.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import fcntl
|
|
import hashlib
|
|
import json
|
|
import os
|
|
import re
|
|
import subprocess
|
|
import tarfile
|
|
import tempfile
|
|
import time
|
|
from dataclasses import dataclass
|
|
from pathlib import Path
|
|
from typing import Any, Mapping
|
|
|
|
from trusted_release_execution_plan import PlanError, TrustedReleasePlan
|
|
|
|
from gitea_tag_publication import (
|
|
GiteaTagClient,
|
|
GitTagBackend,
|
|
PublicationManualOwnerReviewRequired,
|
|
PublicationPending,
|
|
PublicationReconciliationRequired,
|
|
PublicationRequest,
|
|
TagPublisher,
|
|
)
|
|
|
|
|
|
VERSION = "V2R2C1"
|
|
TARGET_OID = "998d30304787e31e5ae607c0bd86b5edb2b0e5ad"
|
|
EVIDENCE_CLOSURE_OID = "a8b906d1bc24088c19647e98de6a679268f6d0a2"
|
|
APPROVAL_PLAN_ID = "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e"
|
|
REPOSITORY = "aios/aios"
|
|
SERVICE = "aios-v2r1c7-production.service"
|
|
PORT = 18927
|
|
OID_RE = re.compile(r"^[0-9a-f]{40}$")
|
|
SHA_RE = re.compile(r"^[0-9a-f]{64}$")
|
|
|
|
|
|
class ReleaseBlocked(RuntimeError):
|
|
"""A release gate failed and no unsafe recovery is permitted."""
|
|
|
|
|
|
class ManualOwnerReviewRequired(ReleaseBlocked):
|
|
pass
|
|
|
|
|
|
class ReconciliationRequired(ReleaseBlocked):
|
|
pass
|
|
|
|
|
|
def canonical(value: object) -> bytes:
|
|
return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode()
|
|
|
|
|
|
def sha256_file(path: Path) -> str:
|
|
if path.is_symlink() or not path.is_file():
|
|
raise ReleaseBlocked("artifact must be a regular file")
|
|
digest = hashlib.sha256()
|
|
with path.open("rb") as stream:
|
|
for block in iter(lambda: stream.read(1024 * 1024), b""):
|
|
digest.update(block)
|
|
return digest.hexdigest()
|
|
|
|
|
|
def atomic_json(path: Path, value: Mapping[str, Any], mode: int = 0o600) -> None:
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
temporary = path.with_name(path.name + ".tmp")
|
|
temporary.write_bytes(canonical(dict(value)))
|
|
os.chmod(temporary, mode)
|
|
os.replace(temporary, path)
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class ReleaseBinding:
|
|
version: str = VERSION
|
|
target_oid: str = TARGET_OID
|
|
evidence_closure_oid: str = EVIDENCE_CLOSURE_OID
|
|
approval_plan_id: str = APPROVAL_PLAN_ID
|
|
repository: str = REPOSITORY
|
|
production_service: str = SERVICE
|
|
production_port: int = PORT
|
|
|
|
def validate(self) -> None:
|
|
if self.version != VERSION or self.repository != REPOSITORY:
|
|
raise ManualOwnerReviewRequired("release binding is outside V2R2C1 scope")
|
|
if not OID_RE.fullmatch(self.target_oid) or self.target_oid != TARGET_OID:
|
|
raise ManualOwnerReviewRequired("V2R2C1 target_oid mismatch")
|
|
if not OID_RE.fullmatch(self.evidence_closure_oid) or self.evidence_closure_oid != EVIDENCE_CLOSURE_OID:
|
|
raise ManualOwnerReviewRequired("V2R2C1 evidence closure mismatch")
|
|
if self.approval_plan_id != APPROVAL_PLAN_ID:
|
|
raise ManualOwnerReviewRequired("V2R2C1 approval plan mismatch")
|
|
if self.production_service != SERVICE or int(self.production_port) != PORT:
|
|
raise ManualOwnerReviewRequired("production service binding mismatch")
|
|
|
|
def as_dict(self) -> dict[str, Any]:
|
|
return {
|
|
"version": self.version,
|
|
"target_oid": self.target_oid,
|
|
"evidence_closure_oid": self.evidence_closure_oid,
|
|
"approval_plan_id": self.approval_plan_id,
|
|
"repository": self.repository,
|
|
"production_service": self.production_service,
|
|
"production_port": self.production_port,
|
|
}
|
|
|
|
|
|
class StateLock:
|
|
def __init__(self, path: Path):
|
|
self.path = path
|
|
self.handle = None
|
|
|
|
def __enter__(self) -> "StateLock":
|
|
self.path.parent.mkdir(parents=True, exist_ok=True)
|
|
self.handle = self.path.open("a+", encoding="utf-8")
|
|
fcntl.flock(self.handle.fileno(), fcntl.LOCK_EX)
|
|
return self
|
|
|
|
def __exit__(self, exc_type, exc, tb) -> None:
|
|
if self.handle is not None:
|
|
fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
|
|
self.handle.close()
|
|
|
|
|
|
class ReleaseState:
|
|
def __init__(self, root: Path, binding: ReleaseBinding):
|
|
self.root = root
|
|
self.path = root / "release-state.json"
|
|
self.binding = binding
|
|
root.mkdir(parents=True, exist_ok=True)
|
|
if self.path.exists():
|
|
value = json.loads(self.path.read_text(encoding="utf-8"))
|
|
if value.get("binding") != binding.as_dict():
|
|
raise ManualOwnerReviewRequired("persisted release binding conflict")
|
|
self.value = value
|
|
else:
|
|
self.value = {
|
|
"schema": "aios.v2r2c1.governed-production-release-state.v1",
|
|
"binding": binding.as_dict(),
|
|
"state": "INITIAL",
|
|
"completed": {},
|
|
"history": [],
|
|
}
|
|
self.save()
|
|
|
|
def save(self) -> None:
|
|
atomic_json(self.path, self.value)
|
|
|
|
def record(self, state: str, step: str, result: Mapping[str, Any]) -> None:
|
|
safe = json.loads(json.dumps(dict(result)))
|
|
self.value["state"] = state
|
|
self.value.setdefault("completed", {})[step] = safe
|
|
self.value.setdefault("history", []).append(
|
|
{"at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "state": state, "step": step, "result": safe}
|
|
)
|
|
self.save()
|
|
|
|
def fail(self, state: str, reason: str) -> None:
|
|
self.value["state"] = state
|
|
self.value.setdefault("history", []).append(
|
|
{"at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "state": state, "reason": str(reason)[:500]}
|
|
)
|
|
self.save()
|
|
|
|
|
|
def _git(git_dir: Path, *args: str, check: bool = True) -> str:
|
|
completed = subprocess.run(
|
|
["git", f"--git-dir={git_dir}", *args],
|
|
check=False,
|
|
capture_output=True,
|
|
text=True,
|
|
timeout=45,
|
|
env={"PATH": os.environ.get("PATH", "")},
|
|
)
|
|
if check and completed.returncode != 0:
|
|
raise ReconciliationRequired(completed.stderr.strip() or "authoritative git query failed")
|
|
return completed.stdout.strip()
|
|
|
|
|
|
def _ancestor(git_dir: Path, ancestor: str, descendant: str) -> bool:
|
|
return subprocess.run(
|
|
["git", f"--git-dir={git_dir}", "merge-base", "--is-ancestor", ancestor, descendant],
|
|
check=False,
|
|
capture_output=True,
|
|
timeout=45,
|
|
env={"PATH": os.environ.get("PATH", "")},
|
|
).returncode == 0
|
|
|
|
|
|
def verify_lineage(git_dir: Path, binding: ReleaseBinding) -> dict[str, Any]:
|
|
binding.validate()
|
|
if _git(git_dir, "cat-file", "-t", binding.target_oid) != "commit":
|
|
raise ReleaseBlocked("approved target_oid is not a commit")
|
|
if _git(git_dir, "cat-file", "-t", binding.evidence_closure_oid) != "commit":
|
|
raise ReleaseBlocked("evidence closure is not a commit")
|
|
if not _ancestor(git_dir, binding.target_oid, binding.evidence_closure_oid):
|
|
raise ManualOwnerReviewRequired("approved target is not an ancestor of evidence closure")
|
|
return {
|
|
"target_oid": binding.target_oid,
|
|
"evidence_closure_oid": binding.evidence_closure_oid,
|
|
"target_is_ancestor_of_evidence": True,
|
|
"main_oid": _git(git_dir, "rev-parse", "refs/heads/main"),
|
|
}
|
|
|
|
|
|
def verify_owner_approval(value: Mapping[str, Any], binding: ReleaseBinding) -> dict[str, Any]:
|
|
approval = value.get("owner_approval")
|
|
if not isinstance(approval, Mapping):
|
|
raise ReleaseBlocked("OWNER_APPROVAL_RECEIPT_REQUIRED")
|
|
if approval.get("approved") is not True or approval.get("status") != "APPROVED":
|
|
raise ReleaseBlocked("OWNER_APPROVAL_NOT_ACCEPTED")
|
|
if approval.get("approved_by") != "aiman":
|
|
raise ManualOwnerReviewRequired("OWNER_APPROVAL_ACTOR_MISMATCH")
|
|
if approval.get("approval_source") != "explicit_owner_approval_in_chat":
|
|
raise ManualOwnerReviewRequired("OWNER_APPROVAL_SOURCE_MISMATCH")
|
|
for key, expected in binding.as_dict().items():
|
|
if key in {"repository", "production_service", "production_port"}:
|
|
continue
|
|
if approval.get(key) != expected:
|
|
raise ManualOwnerReviewRequired("OWNER_APPROVAL_BINDING_MISMATCH:" + key)
|
|
return dict(approval)
|
|
|
|
|
|
def _payload_file(git_dir: Path, oid: str, path: str) -> bytes:
|
|
completed = subprocess.run(
|
|
["git", f"--git-dir={git_dir}", "show", f"{oid}:{path}"],
|
|
check=False,
|
|
capture_output=True,
|
|
timeout=45,
|
|
env={"PATH": os.environ.get("PATH", "")},
|
|
)
|
|
if completed.returncode != 0:
|
|
raise ReleaseBlocked("required release source missing:" + path)
|
|
return completed.stdout
|
|
|
|
|
|
def _commit_epoch(git_dir: Path, oid: str) -> int:
|
|
return int(_git(git_dir, "show", "-s", "--format=%ct", oid))
|
|
|
|
|
|
def build_production_artifact(
|
|
git_dir: Path,
|
|
binding: ReleaseBinding,
|
|
output_root: Path,
|
|
) -> dict[str, Any]:
|
|
"""Build a deterministic executable V2R2C1 health artifact from target_oid."""
|
|
binding.validate()
|
|
verify_lineage(git_dir, binding)
|
|
epoch = _commit_epoch(git_dir, binding.target_oid)
|
|
output_root.mkdir(parents=True, exist_ok=True)
|
|
stem = f"aios-{VERSION}-{binding.target_oid[:12]}"
|
|
output = output_root / (stem + ".tar.zst")
|
|
with tempfile.TemporaryDirectory(prefix="v2r2c1-artifact-") as temp:
|
|
root = Path(temp) / "payload"
|
|
root.mkdir(parents=True)
|
|
source_paths = {
|
|
"active-runtime/app/deployment_state.py": "active-runtime/app/deployment_state.py",
|
|
"active-runtime/app/v2r1c6_privacy_tools.py": "active-runtime/app/v2r1c6_privacy_tools.py",
|
|
}
|
|
for destination, source in source_paths.items():
|
|
target = root / destination
|
|
target.parent.mkdir(parents=True, exist_ok=True)
|
|
target.write_bytes(_payload_file(git_dir, binding.target_oid, source))
|
|
generated: dict[str, str] = {
|
|
"VERSION": VERSION + "\n",
|
|
"active-runtime/app/v2r2c1_health_service.py": (
|
|
"from v2r1c6_privacy_tools import main\n\n"
|
|
"if __name__ == '__main__':\n raise SystemExit(main())\n"
|
|
),
|
|
"deploy/aios-v2/systemd/aios-v2r1c7-production.service": (
|
|
"[Unit]\nDescription=AIOS V2R2C1 governed health contract service\n"
|
|
"After=network.target\n\n[Service]\nType=simple\n"
|
|
"User=aios-v2r1c7\nGroup=aios-v2r1c7\n"
|
|
"WorkingDirectory=/opt/aios/v2r2c1\n"
|
|
"EnvironmentFile=/etc/aios/aios-v2r2c1.env\n"
|
|
"ExecStart=/usr/bin/python3 /opt/aios/v2r2c1/active-runtime/app/v2r2c1_health_service.py --serve --host 127.0.0.1 --port ${AIOS_V2R1C7_PORT}\n"
|
|
"Restart=on-failure\nRestartSec=5\nNoNewPrivileges=true\nPrivateTmp=true\n"
|
|
"ProtectHome=true\nProtectSystem=strict\nProtectKernelLogs=true\n"
|
|
"ProtectKernelModules=true\nProtectKernelTunables=true\nProtectControlGroups=true\n"
|
|
"RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6\nIPAddressDeny=any\n"
|
|
"IPAddressAllow=localhost\nUMask=0077\n\n[Install]\nWantedBy=multi-user.target\n"
|
|
),
|
|
"deploy/aios-v2/v2r2c1-runtime-config.json": json.dumps({
|
|
"schema": "aios.v2r2c1.production-runtime.v1",
|
|
"version": VERSION,
|
|
"target_oid": binding.target_oid,
|
|
"service": SERVICE,
|
|
"port": PORT,
|
|
"health_path": "/health",
|
|
"deployment_state_source": "environment_and_state_file",
|
|
}, sort_keys=True, separators=(",", ":")) + "\n",
|
|
"deploy/aios-v2/v2r2c1-rollback.json": json.dumps({
|
|
"schema": "aios.v2r2c1.rollback-metadata.v1",
|
|
"rollback_version": "V2R1C7",
|
|
"rollback_service": SERVICE,
|
|
"rollback_target_is_previous_production": True,
|
|
"automatic_rollback": False,
|
|
}, sort_keys=True, separators=(",", ":")) + "\n",
|
|
"scripts/probe_v2r2c1_health.py": (
|
|
"import json,sys,urllib.request\n"
|
|
"url=sys.argv[1] if len(sys.argv)>1 else 'http://127.0.0.1:18927/health'\n"
|
|
"with urllib.request.urlopen(url, timeout=5) as r: print(json.dumps(json.load(r), sort_keys=True))\n"
|
|
),
|
|
"scripts/rollback_v2r2c1_release.sh": "#!/bin/sh\nset -eu\nprintf '%s\\n' 'rollback requires governed owner-approved executor'\nexit 2\n",
|
|
"release-manifests/V2R2C1.json": json.dumps({
|
|
"schema": "aios.release-source.v2",
|
|
"version": VERSION,
|
|
"repository": REPOSITORY,
|
|
"target_oid": binding.target_oid,
|
|
"evidence_closure_oid": binding.evidence_closure_oid,
|
|
"production_deployed": False,
|
|
"deployment_state": "STAGING",
|
|
"artifact_kind": "executable-production-health",
|
|
}, sort_keys=True, separators=(",", ":")) + "\n",
|
|
}
|
|
for rel, text in generated.items():
|
|
target = root / rel
|
|
target.parent.mkdir(parents=True, exist_ok=True)
|
|
target.write_text(text, encoding="utf-8")
|
|
if rel.startswith("scripts/"):
|
|
target.chmod(0o755)
|
|
metadata = {
|
|
"schema": "aios.release-artifact-build.v3",
|
|
"version": VERSION,
|
|
"repository": REPOSITORY,
|
|
"source_head_oid": binding.target_oid,
|
|
"evidence_closure_oid": binding.evidence_closure_oid,
|
|
"source_date_epoch": epoch,
|
|
"clean_source": True,
|
|
"executable_payload": True,
|
|
"production_deployed": False,
|
|
"tag_created": False,
|
|
"baseline_changed": False,
|
|
"secrets_included": False,
|
|
}
|
|
(root / "BUILD-METADATA.json").write_bytes(canonical(metadata))
|
|
(root / "ROLLBACK-METADATA.json").write_bytes(canonical(json.loads((root / "deploy/aios-v2/v2r2c1-rollback.json").read_text(encoding="utf-8"))))
|
|
names = sorted("payload/" + str(path.relative_to(root)).replace(os.sep, "/") for path in root.rglob("*") if path.is_file())
|
|
(root / "ARTIFACT-MANIFEST.json").write_bytes(canonical({
|
|
"schema": "aios.release-artifact-manifest.v3",
|
|
"version": VERSION,
|
|
"source_head_oid": binding.target_oid,
|
|
"evidence_closure_oid": binding.evidence_closure_oid,
|
|
"repository": REPOSITORY,
|
|
"files": names + ["payload/ARTIFACT-MANIFEST.json"],
|
|
"deployable": True,
|
|
"executable_payload": True,
|
|
"production_deployed": False,
|
|
"tag_created": False,
|
|
"baseline_changed": False,
|
|
}))
|
|
tar_path = Path(temp) / "release.tar"
|
|
with tarfile.open(tar_path, "w") as archive:
|
|
for path in sorted(root.rglob("*")):
|
|
relative = str(path.relative_to(root)).replace(os.sep, "/")
|
|
info = archive.gettarinfo(str(path), arcname="payload/" + relative)
|
|
info.uid = info.gid = 0
|
|
info.uname = "root"
|
|
info.gname = "root"
|
|
info.mtime = epoch
|
|
info.mode = 0o755 if path.is_dir() or path.suffix == ".sh" else 0o644
|
|
if path.is_file():
|
|
with path.open("rb") as stream:
|
|
archive.addfile(info, stream)
|
|
else:
|
|
archive.addfile(info)
|
|
subprocess.run(["zstd", "-T1", "-19", "--no-progress", "-q", "-f", str(tar_path), "-o", str(output)], check=True, timeout=120)
|
|
digest = sha256_file(output)
|
|
receipt = {
|
|
"schema": "aios.release-artifact-receipt.v3",
|
|
"version": VERSION,
|
|
"repository": REPOSITORY,
|
|
"source_head_oid": binding.target_oid,
|
|
"evidence_closure_oid": binding.evidence_closure_oid,
|
|
"artifact": str(output),
|
|
"artifact_sha256": digest,
|
|
"artifact_size": output.stat().st_size,
|
|
"deployable": True,
|
|
"executable_payload": True,
|
|
"production_deployed": False,
|
|
"tag_created": False,
|
|
"baseline_changed": False,
|
|
}
|
|
atomic_json(output.with_suffix(output.suffix + ".receipt.json"), receipt, mode=0o640)
|
|
return receipt
|
|
|
|
|
|
class GovernedProductionReleaseExecutor:
|
|
def __init__(self, config: Any):
|
|
self.config = config
|
|
self.binding = ReleaseBinding()
|
|
self.binding.validate()
|
|
self.root = Path(config.state_root) / "v2r2c1-governed-production-release"
|
|
self.state = ReleaseState(self.root, self.binding)
|
|
workspace = self.root / "publication-workspace"
|
|
workspace.mkdir(parents=True, exist_ok=True)
|
|
self.publisher = TagPublisher(
|
|
workspace,
|
|
GitTagBackend(workspace, authoritative_repo=Path(config.authoritative_git_dir)),
|
|
GiteaTagClient(config.api_base, REPOSITORY, Path(config.token_path)),
|
|
config.remote_name,
|
|
state_root=self.root / "tag-publication",
|
|
)
|
|
# Release checks must use the same explicitly configured staging baseline
|
|
# as the Action/model runtime; do not fall back to the publication workspace.
|
|
self.publisher.baseline_path = Path(
|
|
os.environ.get("AIOS_GITOPS_BASELINE_AUTHORITY", str(config.baseline_path))
|
|
)
|
|
# The immutable runtime package is the source of the version projection;
|
|
# the mutable state workspace only stores publication state.
|
|
self.publisher.versions_root = Path(__file__).resolve().parents[1] / "versions"
|
|
|
|
def _request(self, request: Mapping[str, Any]) -> PublicationRequest:
|
|
binding = self.binding
|
|
for key, expected in binding.as_dict().items():
|
|
if key in request and request[key] != expected:
|
|
raise ManualOwnerReviewRequired("release request binding mismatch:" + key)
|
|
return PublicationRequest(binding.version, binding.target_oid, binding.evidence_closure_oid, binding.approval_plan_id)
|
|
|
|
def approval_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
if request.get("execute") is not False:
|
|
raise ReleaseBlocked("TAG_APPROVAL_REQUEST_MUST_BE_DRY_RUN")
|
|
owner = verify_owner_approval(request, self.binding)
|
|
with StateLock(self.root / "release.lock"):
|
|
current = self.state.value.get("approval")
|
|
approval_digest = hashlib.sha256(canonical(owner)).hexdigest()
|
|
record = {
|
|
"schema": "aios.v2r2c1.tag-approval-request.v1",
|
|
"binding": self.binding.as_dict(),
|
|
"owner_approval": owner,
|
|
"owner_approval_digest_sha256": approval_digest,
|
|
"execute": False,
|
|
"recorded_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
|
|
}
|
|
if current and current != record:
|
|
raise ManualOwnerReviewRequired("persisted Owner approval differs")
|
|
self.state.value["approval"] = record
|
|
self.state.record("APPROVAL_REQUEST_RECORDED", "tag_approval_request", record)
|
|
return {"status": "RECORDED", "execute": False, "binding": self.binding.as_dict(), "owner_approval_digest_sha256": approval_digest}
|
|
|
|
def _require_approval(self) -> None:
|
|
approval = self.state.value.get("approval")
|
|
if not isinstance(approval, Mapping) or approval.get("binding") != self.binding.as_dict():
|
|
raise ReleaseBlocked("OWNER_APPROVAL_REQUEST_NOT_RECORDED")
|
|
|
|
def publish_tag(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
if request.get("execute") is not True:
|
|
raise ReleaseBlocked("TAG_PUBLICATION_REQUIRES_EXECUTE_TRUE")
|
|
self._require_approval()
|
|
publication = self._request(request)
|
|
with StateLock(self.root / "release.lock"):
|
|
try:
|
|
verified = self.publisher._verify_publication(publication, allow_push=True, previously_deployed=False)
|
|
except PublicationManualOwnerReviewRequired as exc:
|
|
self.state.fail("MANUAL_OWNER_REVIEW_REQUIRED", str(exc))
|
|
raise ManualOwnerReviewRequired(str(exc)) from exc
|
|
except PublicationPending as exc:
|
|
self.state.fail("REMOTE_PUSH_PENDING", str(exc))
|
|
raise ReconciliationRequired(str(exc)) from exc
|
|
except PublicationReconciliationRequired as exc:
|
|
self.state.fail("RECONCILIATION_REQUIRED", str(exc))
|
|
raise ReconciliationRequired(str(exc)) from exc
|
|
result = dict(verified)
|
|
self.state.record("TAG_VERIFIED", "tag", result)
|
|
return {"status": "REMOTE_VERIFIED", **result}
|
|
|
|
def tag_status(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
self._request(request)
|
|
return self.publisher.get_tag_publication_status(VERSION)
|
|
|
|
def build_artifact(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
self._require_approval()
|
|
self._request(request)
|
|
receipt = build_production_artifact(Path(self.config.authoritative_git_dir), self.binding, self.root / "artifacts")
|
|
self.state.record("ARTIFACT_VERIFIED", "production_artifact", receipt)
|
|
return {"status": "VERIFIED", **receipt}
|
|
|
|
def execute_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
self._require_approval()
|
|
publication = self._request(request)
|
|
tag_state = self.state.value.get("completed", {}).get("tag")
|
|
if not isinstance(tag_state, Mapping) or tag_state.get("state") not in {"GITEA_API_CONFIRMED", "REMOTE_VERIFIED"}:
|
|
raise ReleaseBlocked("REMOTE_TAG_PROOF_REQUIRED")
|
|
artifact = self.state.value.get("completed", {}).get("production_artifact")
|
|
if not isinstance(artifact, Mapping):
|
|
artifact = self.build_artifact(request)
|
|
value = {
|
|
**self.binding.as_dict(),
|
|
"tag_oid": tag_state.get("tag_oid") or tag_state.get("gitea_tag_oid"),
|
|
"artifact_path": artifact["artifact"],
|
|
"artifact_size": int(artifact["artifact_size"]),
|
|
"artifact_sha256": artifact["artifact_sha256"],
|
|
}
|
|
# The production adapter is privileged and is run through the root
|
|
# approved-release service boundary by the caller. This handler is
|
|
# still useful for a root-owned staging invocation and remains
|
|
# fail-closed when the adapter is not available.
|
|
import v2r2c1_production_adapter
|
|
runtime = v2r2c1_production_adapter.execute_request({"schema": "aios.production-executor-request.v1", "operation": "apply", **value})
|
|
if runtime.get("status") != "ACTIVE_VERIFIED":
|
|
self.state.fail("RECONCILIATION_REQUIRED", "production health did not verify")
|
|
raise ReconciliationRequired("production health did not verify")
|
|
self.state.record("PRODUCTION_VERIFIED", "production", runtime)
|
|
return {"status": "PRODUCTION_VERIFIED", "runtime": runtime, "artifact": artifact, "tag_oid": value["tag_oid"]}
|
|
|
|
def consistency(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
publication = self._request(request)
|
|
result = self.publisher.get_release_consistency(publication)
|
|
result["release_binding"] = self.binding.as_dict()
|
|
result["production_health"] = _health(self.config.health_url, self.binding, self.state.value.get("completed", {}).get("production_artifact", {}))
|
|
result["registry"] = _read_json(Path(self.config.registry_root) / f"{VERSION}.json")
|
|
result["baseline"] = _read_json(Path(self.config.baseline_path))
|
|
return result
|
|
|
|
def acceptance(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
result = self.consistency(request)
|
|
result["accepted"] = result.get("status") == "PASS" and result.get("production_health", {}).get("status") == "ACTIVE_VERIFIED"
|
|
self.state.record("ACCEPTED" if result["accepted"] else "RECONCILIATION_REQUIRED", "acceptance", result)
|
|
return result
|
|
|
|
|
|
def _read_json(path: Path) -> dict[str, Any]:
|
|
try:
|
|
value = json.loads(path.read_text(encoding="utf-8"))
|
|
except FileNotFoundError:
|
|
return {"status": "MISSING", "path": str(path)}
|
|
if not isinstance(value, dict):
|
|
return {"status": "INVALID", "path": str(path)}
|
|
return {"status": "PRESENT", "path": str(path), **value}
|
|
|
|
|
|
def _health(url: str, binding: ReleaseBinding, artifact: Mapping[str, Any]) -> dict[str, Any]:
|
|
import urllib.request
|
|
try:
|
|
with urllib.request.urlopen(url, timeout=5) as response:
|
|
body = json.loads(response.read().decode("utf-8"))
|
|
status = response.status
|
|
except Exception as exc:
|
|
return {"status": "UNAVAILABLE", "error": type(exc).__name__}
|
|
expected_artifact = artifact.get("artifact_sha256")
|
|
exact = (
|
|
status == 200
|
|
and body.get("version") == binding.version
|
|
and body.get("commit_oid") == binding.target_oid
|
|
and (not expected_artifact or body.get("artifact_sha256") == expected_artifact)
|
|
and body.get("deployment_state") == "ACTIVE"
|
|
and body.get("production_deployed") is True
|
|
)
|
|
return {"status": "ACTIVE_VERIFIED" if exact else "CONFLICT", "http_status": status, **body}
|
|
|
|
|
|
|
|
class TrustedPlanReleaseExecutor:
|
|
"""Release handler whose identity comes only from an immutable trusted plan.
|
|
|
|
The bridge may prepare/read evidence and request tag publication, but it does
|
|
not perform production side effects. The privileged approved-release
|
|
service consumes the same plan and exact Owner approval envelope.
|
|
"""
|
|
|
|
def __init__(self, config: Any):
|
|
self.config = config
|
|
configured = getattr(config, "release_plan_path", None)
|
|
self.plan_path = Path(configured) if configured else None
|
|
self.state_root = Path(config.state_root) / "trusted-release"
|
|
self.state_root.mkdir(parents=True, exist_ok=True)
|
|
self._approval: dict[str, Any] | None = None
|
|
self._tag: dict[str, Any] | None = None
|
|
|
|
def _plan(self) -> TrustedReleasePlan:
|
|
path = self.plan_path
|
|
if path is None:
|
|
env_path = os.environ.get("AIOS_RELEASE_PLAN_PATH", "")
|
|
path = Path(env_path) if env_path else None
|
|
if path is None:
|
|
raise ReleaseBlocked("TRUSTED_RELEASE_PLAN_REQUIRED")
|
|
try:
|
|
return TrustedReleasePlan.load(path)
|
|
except PlanError as exc:
|
|
raise ReleaseBlocked(f"TRUSTED_RELEASE_PLAN_INVALID:{exc}") from exc
|
|
|
|
@staticmethod
|
|
def _binding(plan: TrustedReleasePlan) -> dict[str, Any]:
|
|
value = plan.value
|
|
return {
|
|
"version": value["version"],
|
|
"target_oid": value["source_commit"],
|
|
"evidence_closure_oid": value["evidence_closure_oid"],
|
|
"artifact_sha256": value["artifact_sha256"],
|
|
"artifact_size": value["artifact"]["size"],
|
|
"approval_plan_id": value["approval_plan_id"],
|
|
"candidate_id": value["candidate_id"],
|
|
"release_plan_sha256": plan.release_plan_sha256,
|
|
}
|
|
|
|
def _request(self, request: Mapping[str, Any]) -> tuple[TrustedReleasePlan, dict[str, Any]]:
|
|
plan = self._plan()
|
|
binding = self._binding(plan)
|
|
for key, expected in binding.items():
|
|
if key in request and request[key] != expected:
|
|
raise ManualOwnerReviewRequired("trusted release request binding mismatch:" + key)
|
|
return plan, binding
|
|
|
|
def approval_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
if request.get("execute") is not False:
|
|
raise ReleaseBlocked("TAG_APPROVAL_REQUEST_MUST_BE_DRY_RUN")
|
|
plan, binding = self._request(request)
|
|
approval = request.get("owner_approval")
|
|
if not isinstance(approval, Mapping) or approval.get("approved") is not True:
|
|
raise ReleaseBlocked("OWNER_RELEASE_APPROVAL_REQUIRED")
|
|
for key in ("candidate_id", "release_plan_sha256", "approval_plan_id"):
|
|
if approval.get(key) != binding[key]:
|
|
raise ManualOwnerReviewRequired("OWNER_APPROVAL_BINDING_MISMATCH:" + key)
|
|
record = {"plan": plan.as_dict(), "owner_approval": dict(approval)}
|
|
digest = hashlib.sha256(canonical(record)).hexdigest()
|
|
if self._approval is not None and self._approval != record:
|
|
raise ManualOwnerReviewRequired("OWNER_APPROVAL_REPLAY_CONFLICT")
|
|
self._approval = record
|
|
return {"status": "RECORDED", "execute": False, "release_plan_sha256": plan.release_plan_sha256, "approval_digest_sha256": digest}
|
|
|
|
def _require_approval(self, plan: TrustedReleasePlan) -> None:
|
|
if self._approval is None or self._approval.get("plan") != plan.as_dict():
|
|
raise ReleaseBlocked("OWNER_RELEASE_APPROVAL_NOT_RECORDED")
|
|
|
|
def build_artifact(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
plan, _ = self._request(request)
|
|
artifact = dict(plan.value["artifact"])
|
|
path = Path(str(artifact["path"]))
|
|
if path.is_symlink() or not path.is_file() or path.stat().st_size != artifact["size"]:
|
|
raise ReleaseBlocked("TRUSTED_ARTIFACT_NOT_PRESENT")
|
|
actual = hashlib.sha256(path.read_bytes()).hexdigest()
|
|
if actual != plan.value["artifact_sha256"]:
|
|
raise ReleaseBlocked("TRUSTED_ARTIFACT_DIGEST_MISMATCH")
|
|
return {"status": "VERIFIED", "version": plan.value["version"], "source_commit": plan.value["source_commit"], "tree_oid": plan.value["tree_oid"], "artifact": str(path), "artifact_size": artifact["size"], "artifact_sha256": actual, "manifest_sha256": plan.value["manifest_sha256"], "package_closure_sha256": plan.value["package_closure_sha256"], "release_plan_sha256": plan.release_plan_sha256}
|
|
|
|
def _publisher(self, plan: TrustedReleasePlan) -> TagPublisher:
|
|
root = self.state_root / plan.value["candidate_id"]
|
|
root.mkdir(parents=True, exist_ok=True)
|
|
publisher = TagPublisher(root / "publication-workspace", GitTagBackend(root / "publication-workspace", authoritative_repo=Path(self.config.authoritative_git_dir)), GiteaTagClient(self.config.api_base, "aios/aios", Path(self.config.token_path)), self.config.remote_name, state_root=root / "tag-publication")
|
|
publisher.baseline_path = Path(os.environ.get("AIOS_GITOPS_BASELINE_AUTHORITY", str(self.config.baseline_path)))
|
|
publisher.versions_root = Path(__file__).resolve().parents[1] / "versions"
|
|
return publisher
|
|
|
|
def publish_tag(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
if request.get("execute") is not True:
|
|
raise ReleaseBlocked("TAG_PUBLICATION_REQUIRES_EXECUTE_TRUE")
|
|
plan, _ = self._request(request)
|
|
self._require_approval(plan)
|
|
publication = PublicationRequest(plan.value["version"], plan.value["source_commit"], plan.value["evidence_closure_oid"], plan.value["approval_plan_id"])
|
|
try:
|
|
result = self._publisher(plan)._verify_publication(publication, allow_push=True, previously_deployed=False)
|
|
except (PublicationManualOwnerReviewRequired, PublicationPending, PublicationReconciliationRequired) as exc:
|
|
raise ReconciliationRequired(str(exc)) from exc
|
|
self._tag = dict(result)
|
|
return {"status": "REMOTE_VERIFIED", **result, "release_plan_sha256": plan.release_plan_sha256}
|
|
|
|
def tag_status(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
plan, _ = self._request(request)
|
|
return self._publisher(plan).get_tag_publication_status(plan.value["version"])
|
|
|
|
def execute_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
plan, _ = self._request(request)
|
|
self._require_approval(plan)
|
|
raise ReleaseBlocked("PRODUCTION_EXECUTION_REQUIRES_APPROVED_RELEASE_EXECUTOR")
|
|
|
|
def consistency(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
plan, binding = self._request(request)
|
|
result = {"status": "PASS", "release_binding": binding, "trusted_plan": plan.as_dict(), "production_mutation": False}
|
|
result["baseline"] = _read_json(Path(self.config.baseline_path))
|
|
result["registry"] = _read_json(Path(self.config.registry_root) / f"{plan.value['version']}.json")
|
|
return result
|
|
|
|
def acceptance(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
result = self.consistency(request)
|
|
result["accepted"] = result["status"] == "PASS"
|
|
return result
|
|
|
|
|
|
def build_executor_config(config: Any) -> Any:
|
|
"""Select legacy compatibility only when no trusted new-release plan exists."""
|
|
plan_path = getattr(config, "release_plan_path", None) or os.environ.get("AIOS_RELEASE_PLAN_PATH", "")
|
|
target_version = getattr(config, "target_version", "")
|
|
if plan_path or target_version != VERSION:
|
|
return TrustedPlanReleaseExecutor(config)
|
|
return GovernedProductionReleaseExecutor(config)
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("operation", choices=("build-artifact", "status"))
|
|
parser.add_argument("--git-dir", type=Path, default=Path("/data/aios-gitops/repo.git"))
|
|
parser.add_argument("--output-root", type=Path, default=Path("/var/lib/aios-gitops/approved-artifacts/V2R2C1"))
|
|
args = parser.parse_args()
|
|
binding = ReleaseBinding()
|
|
if args.operation == "build-artifact":
|
|
print(json.dumps(build_production_artifact(args.git_dir, binding, args.output_root), sort_keys=True))
|
|
else:
|
|
print(json.dumps({"binding": binding.as_dict(), "status": "READY"}, sort_keys=True))
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|