Publish curated Unraid-AppOps-Gateway source from 84f2a9958b2bdf1c1c13553925026d75f32703c3

backend/app/services/deployment_broker.py

@@ -296,8 +296,29 @@ class DeploymentBrokerClient:
 
     def registered_legacy_operation(self, stage: str, payload: dict[str, Any]) -> dict[str, Any]:
         """Signed fixed-stage metadata adoption/recovery for existing registered targets."""
-        if stage not in {"baseline", "preflight", "adopt", "status", "rollback", "delivery"}:
+        if stage not in {"observe", "baseline", "preflight", "adopt", "status", "rollback", "delivery"}:
             raise ValueError("registered legacy stage is invalid")
+        if stage == "observe" and (not isinstance(payload, dict) or set(payload) != {"repository"}):
+            raise ValueError("registered observation contract is invalid")
+        if stage == "baseline":
+            if not isinstance(payload, dict):
+                raise ValueError("registered capture contract is invalid")
+            base = {"repository", "requestId"}
+            bindings = {"expectedSourceFingerprint", "expectedRuntimeFingerprint", "expectedStateSha256", "expectedContainerIds"}
+            capture = payload.get("captureRuntimeEnvironment", False)
+            if (type(capture) is not bool or (capture is False and
+                    set(payload) not in (base, base | {"captureRuntimeEnvironment"}))):
+                raise ValueError("registered capture contract is invalid")
+            if capture is True:
+                if (set(payload) != base | bindings | {"captureRuntimeEnvironment"}
+                        or any(not isinstance(payload.get(field), str) or not re.fullmatch(r"[0-9a-f]{64}", payload[field])
+                               for field in bindings - {"expectedContainerIds"})
+                        or not isinstance(payload.get("expectedContainerIds"), dict)
+                        or not 1 <= len(payload["expectedContainerIds"]) <= 64
+                        or any(not isinstance(name, str) or not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_.-]{0,127}", name)
+                               or not isinstance(value, str) or not re.fullmatch(r"[0-9a-f]{64}", value)
+                               for name, value in payload["expectedContainerIds"].items())):
+                    raise ValueError("registered capture contract is invalid")
         return self._request(
             "POST", f"/v1/appops/registered-legacy/{stage}",
             secret=settings.mcp_token or "", payload=payload,