Publish curated Unraid-AppOps-Gateway source from 84f2a9958b2bdf1c1c13553925026d75f32703c3

backend/app/mcp_server.py

@@ -14,6 +14,7 @@ from typing import Any
 from mcp.server import MCPServer
 from mcp.server.transport_security import TransportSecuritySettings
 from mcp.types import ToolAnnotations
+from pydantic import StrictBool
 from sqlmodel import Session, select
 
 from .api.routes_actions import action_registry as build_action_registry
@@ -679,13 +680,32 @@ def appops_hub_component_status(plan_id: str) -> dict[str, Any]:
     return _json(DeploymentBrokerClient().hub_component_operation("status", {"planId": plan_id}))
 
 
+@appops_mcp.tool(name="appops.registered_legacy.observe", annotations=_READ_ONLY_TOOL)
+@_tracked("appops.registered_legacy.observe")
+def appops_registered_legacy_observe(repository: str) -> dict[str, Any]:
+    """Read registered runtime fingerprints, container/image IDs and mismatched key names only."""
+    return _json(DeploymentBrokerClient().registered_legacy_operation("observe", {"repository": repository}))
+
+
 @appops_mcp.tool(name="appops.registered_legacy.baseline", annotations=_READ_ONLY_TOOL)
 @_tracked("appops.registered_legacy.baseline")
-def appops_registered_legacy_baseline(repository: str, request_id: str) -> dict[str, Any]:
-    """Observe an existing registered runtime whose previous source revision is unknown."""
-    return _json(DeploymentBrokerClient().registered_legacy_operation("baseline", {
-        "repository": repository, "requestId": request_id,
-    }))
+def appops_registered_legacy_baseline(
+    repository: str, request_id: str, capture_runtime_environment: StrictBool = False,
+    expected_source_fingerprint: str | None = None, expected_runtime_fingerprint: str | None = None,
+    expected_state_sha256: str | None = None, expected_container_ids: dict[str, str] | None = None,
+) -> dict[str, Any]:
+    """Seal a registered baseline; opt-in runtime environment capture requires all observed CAS bindings. Values stay private."""
+    bindings = {"expectedSourceFingerprint": expected_source_fingerprint,
+                "expectedRuntimeFingerprint": expected_runtime_fingerprint,
+                "expectedStateSha256": expected_state_sha256, "expectedContainerIds": expected_container_ids}
+    if type(capture_runtime_environment) is not bool or (
+        not capture_runtime_environment and any(value is not None for value in bindings.values())
+    ) or (capture_runtime_environment and any(value is None for value in bindings.values())):
+        raise ValueError("registered capture contract is invalid")
+    payload: dict[str, Any] = {"repository": repository, "requestId": request_id}
+    if capture_runtime_environment:
+        payload.update(captureRuntimeEnvironment=True, **bindings)
+    return _json(DeploymentBrokerClient().registered_legacy_operation("baseline", payload))
 
 
 @appops_mcp.tool(name="appops.registered_legacy.preflight", annotations=_READ_ONLY_TOOL)