from __future__ import annotations from collections.abc import Callable from typing import Any from sqlmodel import Session, select from ..connectors.deluge import DelugeConnector from ..connectors.plex import PlexConnector from ..db.models import Approval, JobRun from .audit_logger import log_event from .job_runner import ( complete_job, create_job, prepare_job, set_job_progress, start_job, ) from .setup_service import apply_stored_connector_settings GENERIC_EXECUTOR_ACTIONS = { "container.restart", "controller.artifact.promote", "controller.managed-storage.initialize", "deployment.targets.sync", "deployment.runnerless.provision", "deployment.target.deploy_workmesh", "deployment.target.register_portfolio", "deployment.target.register_privatemuse", "deployment.target.reconcile_media_codec_dashboard", "deployment.webhook.repair_privatemuse", "privatemuse.comfyui.install_artifact", } DEDICATED_ENDPOINT_ACTIONS = { "deluge.pause_torrent", "deluge.resume_torrent", "media_pipeline.check", "media_pipeline.diagnose", "notifications.evaluate_safety", "plex.scan_library", "prowlarr.search_test", "radarr.add_movie", "sonarr.add_series", "unraid.vm.start", "unraid.vm.resume", "unraid.vm.pause", "widefrog.retry_failed", "widefrog.scan_library", } APPROVAL_EXECUTOR_ACTIONS = { "container.restart", "controller.artifact.promote", "runner.fleet.upgrade_v2", "runner.fleet.specialize", "runner.statistics.configure", "hub.migration.prepare_permissions", "deployment.targets.sync", "deployment.runnerless.provision", "deployment.target.deploy_workmesh", "deployment.target.promote_workmesh", "deployment.target.register_portfolio", "deployment.target.register_privatemuse", "deployment.target.reconcile_media_codec_dashboard", "deployment.webhook.repair_privatemuse", "privatemuse.comfyui.install_artifact", "deluge.pause_all", "deluge.resume_all", "plex.scan_all_libraries", "unraid.vm.start", "unraid.vm.resume", "unraid.vm.pause", } MCP_TYPED_EXECUTOR_ACTIONS = APPROVAL_EXECUTOR_ACTIONS | { "controller.managed-storage.initialize", } HUMAN_APPROVAL_ONLY_ACTIONS = {"deployment.target.promote_workmesh", "privatemuse.comfyui.install_artifact"} _APPROVAL_STEPS = { "deluge.pause_all": [ "Load approved request", "Reload connector settings", "Pause all torrents", "Record result", ], "deluge.resume_all": [ "Load approved request", "Reload connector settings", "Resume all torrents", "Record result", ], "plex.scan_all_libraries": [ "Load approved request", "Reload connector settings", "Scan all Plex libraries", "Record result", ], } _DIRECT_STEPS = { "deluge.pause_all": [ "Validate MCP policy", "Reload connector settings", "Pause all torrents", "Record result", ], "deluge.resume_all": [ "Validate MCP policy", "Reload connector settings", "Resume all torrents", "Record result", ], "plex.scan_all_libraries": [ "Validate MCP policy", "Reload connector settings", "Scan all Plex libraries", "Record result", ], } def action_execution_profile( action: str, policy_decision: str, capability: str ) -> dict[str, Any]: if policy_decision == "blocked": mode = "blocked" surface = None elif action in GENERIC_EXECUTOR_ACTIONS: mode = "command_center" surface = "/command-center" elif action in APPROVAL_EXECUTOR_ACTIONS and policy_decision == "approval_required": mode = "approval_then_execute" surface = "/approvals" elif action in DEDICATED_ENDPOINT_ACTIONS or capability == "read_only": mode = "dedicated_surface" surface = None else: mode = "governance_only" surface = None return { "executionMode": mode, "executionSupported": mode in {"command_center", "approval_then_execute", "dedicated_surface"}, "commandExecutionSupported": mode == "command_center", "executionSurface": surface, } def approval_execution_supported(action: str) -> bool: return action in APPROVAL_EXECUTOR_ACTIONS def mcp_execution_supported(action: str) -> bool: """MCP is a no-human-approval surface; never admit human-only executors.""" return action in MCP_TYPED_EXECUTOR_ACTIONS and action not in HUMAN_APPROVAL_ONLY_ACTIONS def _execute_deployment_target_sync( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .gitea_project_auto_registration import GiteaProjectAutoRegistration action = "deployment.targets.sync" target = "jens/*" steps = [ "Read owned Gitea repositories through the bounded catalog client", "Validate repository deployment descriptors and Compose topology", "Register exact-SHA controller targets where contracts are valid", "Install exact-target deployment policies without deploying applications", ] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress(session, job, 20, "Reconciling bounded Gitea deployment targets.") try: result = GiteaProjectAutoRegistration().sync(session, force=True) status = str(result.get("status") or "error") summary = result.get("summary") if isinstance(result.get("summary"), dict) else {} success = status == "ok" message = ( "Deployment target catalog reconciled." if success else str(result.get("reason") or "Deployment target catalog reconciliation failed.") ) except Exception as exc: success = False status = "error" summary = {} message = f"{type(exc).__name__}: deployment target catalog reconciliation failed" result = {"status": status} completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-project-catalog", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "total": summary.get("total", 0), "registered": summary.get("registered", 0), "knownUnconfigured": summary.get("knownUnconfigured", 0), "conflicts": summary.get("conflicts", 0), "errors": summary.get("errors", 0), "changed": summary.get("changedThisSync", 0), }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, }, ) return { "success": success, "status": "success" if success else "failed", "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, "summary": { "total": summary.get("total", 0), "registered": summary.get("registered", 0), "knownUnconfigured": summary.get("knownUnconfigured", 0), "conflicts": summary.get("conflicts", 0), "errors": summary.get("errors", 0), "changed": summary.get("changedThisSync", 0), }, } def _execute_workmesh_first_deployment( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .workmesh_first_deployment import WorkMeshFirstDeployment action = "deployment.target.deploy_workmesh" target = "jens/workmesh" steps = [ "Verify the fixed WorkMesh v0.1.0 protected-main release contract", "Create or validate the external mode-0600 WorkMesh runtime environment", "Reserve the fixed loopback port set and reconcile the exact-source controller target", "Run the official deployment-controller preflight and transactional first deploy", "Verify the controller-owned deployment receipt without exposing secret values", ] service = WorkMeshFirstDeployment() tracked_job_id = service.tracked_job_id(session) job = session.get(JobRun, tracked_job_id) if tracked_job_id else None orphan_running = False if job is None: job = session.exec( select(JobRun) .where(JobRun.action_id == action, JobRun.target == target, JobRun.status == "running") .order_by(JobRun.started_at.desc()) ).first() if job is not None: orphan_running = True else: job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) try: deployment = ( { "status": "outcome_unknown", "reason": "An earlier WorkMesh deployment job is running without matching durable execution state; reconcile it before another deploy", } if orphan_running else service.run(session, job=job) ) status = str(deployment.get("status") or "error") execution_id = str(deployment.get("execution_id") or "") if status == "deployed": success = True message = "WorkMesh v0.1.0 first deployment completed with controller receipt evidence." elif status == "in_progress": success = False message = "WorkMesh v0.1.0 first deployment is still running." elif status == "outcome_unknown": success = False message = str(deployment.get("reason") or "WorkMesh deployment outcome requires reconciliation.") else: success = False message = str(deployment.get("reason") or "WorkMesh v0.1.0 first deployment failed closed.") except Exception as exc: status = "error" execution_id = "" success = False deployment = {"status": status} message = f"{type(exc).__name__}: WorkMesh first-deploy reconciliation failed" if status in {"in_progress", "outcome_unknown"}: if job.status not in {"succeeded", "failed", "cancelled"}: completed = set_job_progress( session, job, max(job.progress, 90 if status == "outcome_unknown" else 25), message, ) else: completed = job elif job.status in {"succeeded", "failed", "cancelled"}: completed = job else: completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) outward_status = ( status if status in {"in_progress", "outcome_unknown"} else "success" if success else "failed" ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-target", risk=risk, policy_decision="allowed", reason=reason, result=outward_status, execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "repository": deployment.get("repository", target), "revision": deployment.get("revision"), "composeProject": deployment.get("compose_project"), "containers": deployment.get("containers"), "ports": deployment.get("ports"), "executionId": execution_id or None, }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, "secretsReturned": False, }, ) return { "success": success, "status": outward_status, "result": outward_status, "message": message, "jobId": completed.id, "auditId": audit.id, **({"executionId": execution_id} if execution_id else {}), "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def _execute_portfolio_target_enrollment( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .portfolio_deployment_recovery import PortfolioDeploymentRecovery action = "deployment.target.register_portfolio" target = "jens/portfolio" steps = [ "Validate the fixed Portfolio deployment contract", "Verify or re-attest the proven live Portfolio web/API pair", "Atomically reconcile the paired controller target state", "Preserve exact-source deployment provenance", ] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress(session, job, 20, "Validating fixed Portfolio deployment target.") try: enrollment = PortfolioDeploymentRecovery().run() status = str(enrollment.get("status") or "error") success = status in {"enrolled", "already-enrolled", "reconciled"} message = str( enrollment.get("reason") or ( "Portfolio deployment target state verified." if success else "Portfolio deployment target enrollment failed." ) ) except Exception as exc: success = False status = "error" message = f"{type(exc).__name__}: Portfolio deployment target enrollment failed" enrollment = {"status": status} completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-target", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "repository": enrollment.get("repository"), "composeProject": enrollment.get("compose_project"), "containers": enrollment.get("containers"), }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, }, ) return { "success": success, "status": "success" if success else "failed", "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def _execute_privatemuse_target_enrollment( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .privatemuse_deployment_recovery import PrivateMuseDeploymentRecovery action = "deployment.target.register_privatemuse" target = "jens/privatemuse" steps = [ "Validate the fixed PrivateMuse deployment contract", "Verify or re-attest the proven live PrivateMuse production trio", "Atomically reconcile only the bounded controller receipt state", "Preserve immutable images, media, models and exact-source provenance", ] recovery = PrivateMuseDeploymentRecovery() candidate_job = prepare_job( action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) tracked, admitted = recovery.admit_job(session, candidate_job) tracked_job_id = str(tracked.get("jobId") or "") job = session.get(JobRun, tracked_job_id) if job is None: raise RuntimeError("PrivateMuse recovery owner job is unavailable") if admitted: start_job(session, job) set_job_progress( session, job, 20, "Validating fixed PrivateMuse deployment target." ) try: enrollment = recovery.run( session=session, job_id=job.id if admitted else candidate_job.id, ) status = str(enrollment.get("status") or "error") success = status in {"enrolled", "already-enrolled", "reconciled"} message = str( enrollment.get("reason") or ( "PrivateMuse deployment target state verified." if success else "PrivateMuse deployment target enrollment failed." ) ) except Exception as exc: guarded = recovery.guarded_unknown_result( session, reason=( "PrivateMuse recovery crossed its durable execution boundary but " "local result handling failed; reconcile the recorded execution and " "do not retry" ), ) if guarded is not None: success = False status = "outcome_unknown" message = str(guarded["reason"]) enrollment = guarded else: success = False status = "error" message = ( f"{type(exc).__name__}: PrivateMuse deployment target enrollment failed" ) enrollment = {"status": status} execution_id = str(enrollment.get("execution_id") or "") original_job_id = str(enrollment.get("original_job_id") or job.id) original_job = session.get(JobRun, original_job_id) result_job = original_job or job evidence_summary = ( f"{status}; executionId={execution_id}; {message}" if execution_id else f"{status}; {message}" ) if status in {"in_progress", "outcome_unknown"}: if result_job.status not in {"succeeded", "failed", "cancelled"}: completed = set_job_progress( session, result_job, max(result_job.progress, 90 if status == "outcome_unknown" else 5), evidence_summary, ) else: completed = result_job elif result_job.status in {"succeeded", "failed", "cancelled"}: completed = result_job else: completed = complete_job( session, result_job, status="succeeded" if success else "failed", result_summary=evidence_summary, ) outward_status = ( status if status in {"in_progress", "outcome_unknown"} else "success" if success else "failed" ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-target", risk=risk, policy_decision="allowed", reason=reason, result=outward_status, execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "repository": enrollment.get("repository"), "composeProject": enrollment.get("compose_project"), "containers": enrollment.get("containers"), "executionId": execution_id or None, "originalJobId": original_job_id, }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, }, ) return { "success": success, "status": outward_status, "result": outward_status, "message": message, "jobId": completed.id, "auditId": audit.id, **({"executionId": execution_id} if execution_id else {}), "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def _execute_media_codec_dashboard_reconciliation( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .media_codec_dashboard_deployment_reconciliation import ( MediaCodecDashboardDeploymentReconciliation, ) action = "deployment.target.reconcile_media_codec_dashboard" target = "jens/media-codec-dashboard" steps = [ "Validate the fixed Media Codec Dashboard deployment contract", "Verify the live immutable dashboard runtime", "Reconcile only the bounded controller deployment state", "Preserve containers, images, mounts and exact-source provenance", ] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress( session, job, 20, "Validating fixed Media Codec Dashboard deployment state.", ) try: reconciliation = MediaCodecDashboardDeploymentReconciliation().run() status = str(reconciliation.get("status") or "error") success = status == "reconciled" message = str( reconciliation.get("reason") or ( "Media Codec Dashboard deployment state reconciled." if success else "Media Codec Dashboard deployment-state reconciliation failed." ) ) except Exception as exc: success = False status = "error" reconciliation = {"status": status} message = ( f"{type(exc).__name__}: " "Media Codec Dashboard deployment-state reconciliation failed" ) completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-target", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "repository": reconciliation.get("repository"), "container": reconciliation.get("container"), }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, }, ) return { "success": success, "status": "success" if success else "failed", "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def _execute_privatemuse_webhook_repair( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .privatemuse_webhook_repair import PrivateMuseWebhookRepair action = "deployment.webhook.repair_privatemuse" target = "jens/privatemuse" steps = [ "Validate the fixed PrivateMuse runnerless webhook contract", "Verify controller-owned webhook secret and Gitea repository identity", "Create or repair only the exact PrivateMuse push hook", "Re-read the hook and verify active main-only push delivery metadata", ] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress(session, job, 20, "Validating fixed PrivateMuse webhook state.") try: repair = PrivateMuseWebhookRepair().run() status = str(repair.get("status") or "error") success = status == "repaired" message = str( repair.get("reason") or ( "PrivateMuse runnerless webhook verified or repaired." if success else "PrivateMuse runnerless webhook repair failed." ) ) except Exception as exc: success = False status = "error" message = f"{type(exc).__name__}: PrivateMuse runnerless webhook repair failed" repair = {"status": status} completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-webhook", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "repository": repair.get("repository"), "endpoint": repair.get("endpoint"), "branch": repair.get("branch"), "event": repair.get("event"), }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, "secretMaterialReturned": False, }, ) return { "success": success, "status": "success" if success else status, "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def _execute_runnerless_target_provisioning( session: Session, *, target: str, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .gitea_project_auto_registration import GiteaProjectAutoRegistration from .runnerless_target_provisioning import RunnerlessTargetProvisioning action = "deployment.runnerless.provision" application_id = target.strip().lower() catalog = GiteaProjectAutoRegistration.catalog(session) projects = catalog.get("projects") if isinstance(catalog, dict) else None matches = [ item for item in projects or [] if isinstance(item, dict) and str(item.get("applicationId") or "").strip().lower() == application_id and bool(item.get("deploymentRegistered")) and str(item.get("state") or "") in {"registered", "registered_existing"} ] if len(matches) != 1: return { "success": False, "status": "failed", "result": "blocked", "message": ( "Runnerless provisioning requires exactly one auto-registered " "deployment target." ), "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } project = matches[0] repository = str(project.get("repository") or "").strip().lower() branch = str(project.get("defaultBranch") or "").strip() revision = str(project.get("revision") or "").strip().lower() if ( not repository.startswith("jens/") or not branch or len(revision) != 40 or any(character not in "0123456789abcdef" for character in revision) ): return { "success": False, "status": "failed", "result": "blocked", "message": "Auto-registered deployment target metadata is incomplete.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } steps = [ "Resolve the exact auto-registered application target", "Verify controller target, repository identity and private Gitea reachability", "Create or verify one repository-specific runnerless webhook secret", "Install the exact main-push validation triplet and signed Gitea hook", "Verify the hook without returning credentials", ] job = create_job( session, action_id=action, target=application_id, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress( session, job, 20, "Provisioning exact-target runnerless delivery metadata.", ) try: provisioned = RunnerlessTargetProvisioning().run( repository=repository, branch=branch, ) status = str(provisioned.get("status") or "error") success = status == "ready" message = str( provisioned.get("reason") or ( "Runnerless delivery is ready for the registered target." if success else "Runnerless delivery provisioning failed." ) ) except Exception as exc: provisioned = {"status": "error"} status = "error" success = False message = ( f"{type(exc).__name__}: runnerless target provisioning failed" ) completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=application_id, target_type="deployment-webhook", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "applicationId": application_id, "repository": repository, "revision": revision, "branch": provisioned.get("branch"), "endpoint": provisioned.get("endpoint"), }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, "secretMaterialReturned": False, "repositoryCallerSelectable": False, "branchCallerSelectable": False, }, ) return { "success": success, "status": "success" if success else status, "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, "applicationId": application_id, "repository": repository, "revision": revision, } def _execute_workmesh_first_deployment( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .workmesh_first_deployment import WorkMeshFirstDeployment action = "deployment.target.deploy_workmesh" target = "jens/workmesh" steps = [ "Verify the fixed WorkMesh v0.1.0 protected-main release contract", "Create or validate the external mode-0600 WorkMesh runtime environment", "Reserve the fixed loopback port set and reconcile the exact-source controller target", "Run the official deployment-controller preflight and transactional first deploy", "Verify the controller-owned deployment receipt without exposing secret values", ] service = WorkMeshFirstDeployment() tracked_job_id = service.tracked_job_id(session) job = session.get(JobRun, tracked_job_id) if tracked_job_id else None orphan_running = False if job is None: job = session.exec( select(JobRun) .where(JobRun.action_id == action, JobRun.target == target, JobRun.status == "running") .order_by(JobRun.started_at.desc()) ).first() if job is not None: orphan_running = True else: job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) try: deployment = ( { "status": "outcome_unknown", "reason": "An earlier WorkMesh deployment job is running without matching durable execution state; reconcile it before another deploy", } if orphan_running else service.run(session, job=job) ) status = str(deployment.get("status") or "error") execution_id = str(deployment.get("execution_id") or "") if status == "deployed": success = True message = "WorkMesh v0.1.0 first deployment completed with controller receipt evidence." elif status == "in_progress": success = False message = "WorkMesh v0.1.0 first deployment is still running." elif status == "outcome_unknown": success = False message = str(deployment.get("reason") or "WorkMesh deployment outcome requires reconciliation.") else: success = False message = str(deployment.get("reason") or "WorkMesh v0.1.0 first deployment failed closed.") except Exception as exc: status = "error" execution_id = "" success = False deployment = {"status": status} message = f"{type(exc).__name__}: WorkMesh first-deploy reconciliation failed" if status in {"in_progress", "outcome_unknown"}: if job.status not in {"succeeded", "failed", "cancelled"}: completed = set_job_progress( session, job, max(job.progress, 90 if status == "outcome_unknown" else 25), message, ) else: completed = job elif job.status in {"succeeded", "failed", "cancelled"}: completed = job else: completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) outward_status = ( status if status in {"in_progress", "outcome_unknown"} else "success" if success else "failed" ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-target", risk=risk, policy_decision="allowed", reason=reason, result=outward_status, execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "repository": deployment.get("repository", target), "revision": deployment.get("revision"), "composeProject": deployment.get("compose_project"), "containers": deployment.get("containers"), "ports": deployment.get("ports"), "executionId": execution_id or None, }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, "secretsReturned": False, }, ) return { "success": success, "status": outward_status, "result": outward_status, "message": message, "jobId": completed.id, "auditId": audit.id, **({"executionId": execution_id} if execution_id else {}), "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def _execute_portfolio_target_enrollment( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .portfolio_deployment_recovery import PortfolioDeploymentRecovery action = "deployment.target.register_portfolio" target = "jens/portfolio" steps = [ "Validate the fixed Portfolio deployment contract", "Verify or re-attest the proven live Portfolio web/API pair", "Atomically reconcile the paired controller target state", "Preserve exact-source deployment provenance", ] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress(session, job, 20, "Validating fixed Portfolio deployment target.") try: enrollment = PortfolioDeploymentRecovery().run() status = str(enrollment.get("status") or "error") success = status in {"enrolled", "already-enrolled", "reconciled"} message = str( enrollment.get("reason") or ( "Portfolio deployment target state verified." if success else "Portfolio deployment target enrollment failed." ) ) except Exception as exc: success = False status = "error" message = f"{type(exc).__name__}: Portfolio deployment target enrollment failed" enrollment = {"status": status} completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-target", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "repository": enrollment.get("repository"), "composeProject": enrollment.get("compose_project"), "containers": enrollment.get("containers"), }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, }, ) return { "success": success, "status": "success" if success else "failed", "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def _execute_privatemuse_target_enrollment( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .privatemuse_deployment_recovery import PrivateMuseDeploymentRecovery action = "deployment.target.register_privatemuse" target = "jens/privatemuse" steps = [ "Validate the fixed PrivateMuse deployment contract", "Verify or re-attest the proven live PrivateMuse production trio", "Atomically reconcile only the bounded controller receipt state", "Preserve immutable images, media, models and exact-source provenance", ] recovery = PrivateMuseDeploymentRecovery() candidate_job = prepare_job( action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) tracked, admitted = recovery.admit_job(session, candidate_job) tracked_job_id = str(tracked.get("jobId") or "") job = session.get(JobRun, tracked_job_id) if job is None: raise RuntimeError("PrivateMuse recovery owner job is unavailable") if admitted: start_job(session, job) set_job_progress( session, job, 20, "Validating fixed PrivateMuse deployment target." ) try: enrollment = recovery.run( session=session, job_id=job.id if admitted else candidate_job.id, ) status = str(enrollment.get("status") or "error") success = status in {"enrolled", "already-enrolled", "reconciled"} message = str( enrollment.get("reason") or ( "PrivateMuse deployment target state verified." if success else "PrivateMuse deployment target enrollment failed." ) ) except Exception as exc: guarded = recovery.guarded_unknown_result( session, reason=( "PrivateMuse recovery crossed its durable execution boundary but " "local result handling failed; reconcile the recorded execution and " "do not retry" ), ) if guarded is not None: success = False status = "outcome_unknown" message = str(guarded["reason"]) enrollment = guarded else: success = False status = "error" message = ( f"{type(exc).__name__}: PrivateMuse deployment target enrollment failed" ) enrollment = {"status": status} execution_id = str(enrollment.get("execution_id") or "") original_job_id = str(enrollment.get("original_job_id") or job.id) original_job = session.get(JobRun, original_job_id) result_job = original_job or job evidence_summary = ( f"{status}; executionId={execution_id}; {message}" if execution_id else f"{status}; {message}" ) if status in {"in_progress", "outcome_unknown"}: if result_job.status not in {"succeeded", "failed", "cancelled"}: completed = set_job_progress( session, result_job, max(result_job.progress, 90 if status == "outcome_unknown" else 5), evidence_summary, ) else: completed = result_job elif result_job.status in {"succeeded", "failed", "cancelled"}: completed = result_job else: completed = complete_job( session, result_job, status="succeeded" if success else "failed", result_summary=evidence_summary, ) outward_status = ( status if status in {"in_progress", "outcome_unknown"} else "success" if success else "failed" ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-target", risk=risk, policy_decision="allowed", reason=reason, result=outward_status, execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "repository": enrollment.get("repository"), "composeProject": enrollment.get("compose_project"), "containers": enrollment.get("containers"), "executionId": execution_id or None, "originalJobId": original_job_id, }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, }, ) return { "success": success, "status": outward_status, "result": outward_status, "message": message, "jobId": completed.id, "auditId": audit.id, **({"executionId": execution_id} if execution_id else {}), "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def _execute_media_codec_dashboard_reconciliation( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .media_codec_dashboard_deployment_reconciliation import ( MediaCodecDashboardDeploymentReconciliation, ) action = "deployment.target.reconcile_media_codec_dashboard" target = "jens/media-codec-dashboard" steps = [ "Validate the fixed Media Codec Dashboard deployment contract", "Verify the live immutable dashboard runtime", "Reconcile only the bounded controller deployment state", "Preserve containers, images, mounts and exact-source provenance", ] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress( session, job, 20, "Validating fixed Media Codec Dashboard deployment state.", ) try: reconciliation = MediaCodecDashboardDeploymentReconciliation().run() status = str(reconciliation.get("status") or "error") success = status == "reconciled" message = str( reconciliation.get("reason") or ( "Media Codec Dashboard deployment state reconciled." if success else "Media Codec Dashboard deployment-state reconciliation failed." ) ) except Exception as exc: success = False status = "error" reconciliation = {"status": status} message = ( f"{type(exc).__name__}: " "Media Codec Dashboard deployment-state reconciliation failed" ) completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-target", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "repository": reconciliation.get("repository"), "container": reconciliation.get("container"), }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, }, ) return { "success": success, "status": "success" if success else "failed", "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def _execute_privatemuse_webhook_repair( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .privatemuse_webhook_repair import PrivateMuseWebhookRepair action = "deployment.webhook.repair_privatemuse" target = "jens/privatemuse" steps = [ "Validate the fixed PrivateMuse runnerless webhook contract", "Verify controller-owned webhook secret and Gitea repository identity", "Create or repair only the exact PrivateMuse push hook", "Re-read the hook and verify active main-only push delivery metadata", ] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress(session, job, 20, "Validating fixed PrivateMuse webhook state.") try: repair = PrivateMuseWebhookRepair().run() status = str(repair.get("status") or "error") success = status == "repaired" message = str( repair.get("reason") or ( "PrivateMuse runnerless webhook verified or repaired." if success else "PrivateMuse runnerless webhook repair failed." ) ) except Exception as exc: success = False status = "error" message = f"{type(exc).__name__}: PrivateMuse runnerless webhook repair failed" repair = {"status": status} completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-webhook", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "repository": repair.get("repository"), "endpoint": repair.get("endpoint"), "branch": repair.get("branch"), "event": repair.get("event"), }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, "secretMaterialReturned": False, }, ) return { "success": success, "status": "success" if success else status, "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def _execute_controller_artifact_promote( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .controller_artifact_promoter import ( ControllerArtifactPromoter, helper_failure_diagnostics, safe_helper_diagnostics, ) action = "controller.artifact.promote" target = "tower/deployment-controller" steps = [ "Resolve protected current main and successful push validation", "Reuse the immutable image of the live deployment controller", "Run one fixed ephemeral controller-promoter helper", "Execute the existing rollbackable root controller upgrade procedure", "Verify the installed controller release identity", ] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress(session, job, 20, "Promoting fixed root deployment-controller artifact.") try: result = ControllerArtifactPromoter().run() status = str(result.get("status") or "error") success = status in {"promoted", "already_applied"} message = str( result.get("reason") or ( "Root deployment-controller artifact verified." if success else "Root deployment-controller promotion failed." ) ) except Exception as exc: result = {"status": "error"} status = "error" success = False message = f"{type(exc).__name__}: controller artifact promotion failed" diagnostics = None if status == "failed" and result.get("reason") == "controller_promoter_helper_failed": diagnostics = safe_helper_diagnostics(result.get("diagnostics")) if diagnostics is None: diagnostics = helper_failure_diagnostics(result.get("exitCode")) exit_code = diagnostics["exitCode"] exit_code_summary = str(exit_code) if exit_code is not None else "unknown" message = ( f"Controller promotion helper failed: {diagnostics['code']}; " f"phase={diagnostics['phase']}; exitCode={exit_code_summary}." ) completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) after_state = { "status": status, "revision": result.get("revision"), "controllerVersion": result.get("controllerVersion"), "artifactSha256": result.get("artifactSha256"), } redacted_metadata = { "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, "callerRevisionSelectable": False, "callerCommandSelectable": False, "callerMountSelectable": False, "helperTargetSelectable": False, } if diagnostics is not None: after_state["diagnostics"] = diagnostics redacted_metadata["diagnostics"] = diagnostics audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="deployment-controller", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state=after_state, redacted_metadata=redacted_metadata, ) operation_result = { "success": success, "status": "success" if success else status, "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, "revision": result.get("revision"), "controllerVersion": result.get("controllerVersion"), "artifactSha256": result.get("artifactSha256"), } if diagnostics is not None: operation_result["diagnostics"] = diagnostics return operation_result def _execute_runner_fleet_upgrade_v2( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, specialized: bool = False, statistics_configuration: bool = False, ) -> dict[str, Any]: from .deployment_broker import DeploymentBrokerClient action = ("runner.statistics.configure" if statistics_configuration else "runner.fleet.specialize" if specialized else "runner.fleet.upgrade_v2") target = ("tower/projectbrain-runner-statistics" if statistics_configuration else "tower/runner-fleet-specialized" if specialized else "tower/runner-fleet-v2") steps = [ "Validate exact fixed runner-fleet target", "Call HMAC-signed root controller endpoint", "Prove protected main and successful push validation", "Execute exact-revision specialized migration script" if specialized else "Execute exact-revision fleet-v2 migration script", "Verify specialized runner topology", ] if statistics_configuration: steps = ["Verify fixed read-only statistics target", "Prove protected controller/runtime source", "Lock production configuration", "Provision private independent credential with durable CAS", "Configure ProjectBrain for its governed delivery"] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress(session, job, 25, f"Requesting {action} through the fixed controller endpoint.") try: broker = DeploymentBrokerClient() result = (broker.runner_statistics_configure(reason=reason) if statistics_configuration else broker.runner_fleet_specialize(reason=reason) if specialized else broker.runner_fleet_upgrade_v2(reason=reason)) status = str(result.get("status") or "error") success = status in ({"configured", "already_configured"} if statistics_configuration else {"specialized", "already_applied"} if specialized else {"upgraded", "already_applied"}) message = str( result.get("reason") or ( ("ProjectBrain read-only statistics configuration verified." if statistics_configuration else "Tower runner specialization verified." if specialized else "Tower runner-fleet v2 migration verified.") if success else ("ProjectBrain statistics configuration was rejected or failed." if statistics_configuration else "Tower runner specialization was rejected or failed." if specialized else "Tower runner-fleet v2 migration was rejected or failed.") ) ) except Exception as exc: result = {"status": "error"} status = "error" success = False message = f"{type(exc).__name__}: fixed controller operation failed" completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="runner-fleet", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "revision": result.get("revision"), "verifiedRunners": result.get("verifiedRunners"), "projectbrainDeliveryRequired": result.get("projectbrainDeliveryRequired"), }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, "scriptPathCallerSelectable": False, "runnerTargetCallerSelectable": False, }, ) return { "success": success, "status": "success" if success else status, "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, "controllerStatus": status, "revision": result.get("revision"), "verifiedRunners": result.get("verifiedRunners"), "projectbrainDeliveryRequired": result.get("projectbrainDeliveryRequired"), } def _execute_hub_migration_prepare_permissions( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: from .deployment_broker import DeploymentBrokerClient action = "hub.migration.prepare_permissions" target = "tower/itworx-mcp-hub-permissions" state_file = "/mnt/cache/appdata/gitea-deploy-runners/state/itworx-mcp-hub.json" fixed_targets = {state_file} steps = [ "Validate the exact fixed MCP Hub permission target", "Authenticate the fixed root-controller request with HMAC and replay protection", "Verify the running controller is the protected current main release with full-push validation", "Reinspect the fixed Hub state file and shared deployment lock", "Apply only the fixed state-file mode correction and verify its final metadata", ] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress(session, job, 25, "Requesting fixed MCP Hub permission preparation through the controller.") try: result = DeploymentBrokerClient().hub_migration_prepare_permissions(reason=reason) status = str(result.get("status") or "blocked") revision_value = result.get("revision") revision = ( revision_value if isinstance(revision_value, str) and len(revision_value) == 40 and all(character in "0123456789abcdef" for character in revision_value) else None ) changed_value = result.get("changedTargets", []) changed_targets = ( changed_value if isinstance(changed_value, list) and all(isinstance(path, str) and path in fixed_targets for path in changed_value) and len(changed_value) == len(set(changed_value)) else None ) changed_details_value = result.get("changedTargetDetails", []) target_names = { state_file: "state_file", } changed_details = ( changed_details_value if isinstance(changed_details_value, list) and all( isinstance(item, dict) and set(item) == {"name", "path", "observedMode", "sameIdentityAtPath"} and isinstance(item.get("path"), str) and item.get("path") in fixed_targets and item.get("name") == target_names.get(item.get("path")) and isinstance(item.get("observedMode"), str) and len(item["observedMode"]) == 4 and item["observedMode"].startswith("0") and all(character in "01234567" for character in item["observedMode"]) and isinstance(item.get("sameIdentityAtPath"), bool) and changed_targets is not None and item["path"] in changed_targets for item in changed_details_value ) and len({item["path"] for item in changed_details_value}) == len(changed_details_value) else None ) uncertain_value = result.get("uncertainTargets", []) uncertain_targets = ( uncertain_value if isinstance(uncertain_value, list) and all(isinstance(path, str) and path in fixed_targets for path in uncertain_value) and len(uncertain_value) == len(set(uncertain_value)) else None ) expected_verified = { "state_file": { "path": state_file, "uid": 0, "gid": 0, "mode": "0600", "aclPresent": False, }, } verified_value = result.get("verifiedTargets") verified_targets = None if isinstance(verified_value, list) and len(verified_value) == len(expected_verified): by_name = { item.get("name"): item for item in verified_value if isinstance(item, dict) and isinstance(item.get("name"), str) } if set(by_name) == set(expected_verified) and all( all(by_name[name].get(key) == value for key, value in expected.items()) for name, expected in expected_verified.items() ): verified_targets = [ {"name": name, **expected_verified[name]} for name in ("state_file",) ] has_controller_projection = all( key in result for key in ( "revision", "changedTargets", "changedTargetDetails", "uncertainTargets", ) ) success = ( status in {"prepared", "already_compliant"} and has_controller_projection and revision is not None and changed_targets is not None and changed_details is not None and uncertain_targets == [] and verified_targets is not None and (bool(changed_targets) if status == "prepared" else not changed_targets) ) if success: message = ( "The fixed MCP Hub state-file permission was prepared and verified." if status == "prepared" else "The fixed MCP Hub state-file permission was already compliant and verified." ) elif ( status == "partial" and has_controller_projection and revision is not None and changed_targets is not None and changed_details is not None and uncertain_targets is not None and (changed_targets or uncertain_targets) and len(changed_details) == len(changed_targets) and {item["path"] for item in changed_details} == set(changed_targets) ): message = "Permission preparation stopped partway; inspect the exact changed and uncertain fixed targets before retrying." elif ( status in { "blocked", "unauthorized", "missing_config", "missing_secret", "runtime_identity_unavailable", "controller_source_mismatch", "preflight_rejected", "configuration_unavailable", "exact_source_unavailable", "invalid_request", "invalid_body_size", "authentication_rejected", "forbidden", } and changed_targets == [] and changed_details == [] and uncertain_targets == [] ): status = "blocked" message = "The fixed MCP Hub permission request was rejected before any target change." else: status = "outcome_unknown" changed_targets = [] changed_details = [] uncertain_targets = sorted(fixed_targets) verified_targets = None message = ( "The controller request outcome is unknown; the fixed Hub state file may have changed. " "Inspect it before retrying." ) except Exception: result = {"status": "outcome_unknown"} status = "outcome_unknown" revision = None changed_targets = [] changed_details = [] uncertain_targets = sorted(fixed_targets) verified_targets = None success = False message = ( "The controller request outcome is unknown; the fixed Hub state file may have changed. " "Inspect it before retrying." ) completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="mcp-hub-permissions", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "outcome_unknown" if status == "outcome_unknown" else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "revision": revision, "changedTargets": changed_targets, "changedTargetDetails": changed_details, "uncertainTargets": uncertain_targets, "verifiedTargets": verified_targets, }, redacted_metadata={ "executor": action, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, "targetSelectionCallerSelectable": False, "pathOrCommandCallerSelectable": False, }, ) return { "success": success, "status": "success" if success else status, "result": "success" if success else "outcome_unknown" if status == "outcome_unknown" else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, "controllerStatus": status, "revision": revision, "changedTargets": changed_targets, "changedTargetDetails": changed_details, "uncertainTargets": uncertain_targets, "verifiedTargets": verified_targets, } def _approved_connector_call(action: str) -> tuple[Callable[[], dict[str, Any]], str]: if action == "deluge.pause_all": return lambda: DelugeConnector().pause_all(), "all_torrents_paused" if action == "deluge.resume_all": return lambda: DelugeConnector().resume_all(), "all_torrents_resumed" if action == "plex.scan_all_libraries": return lambda: PlexConnector().scan_all_libraries(), "scan_all_started" raise ValueError("No approved executor is registered for this action.") def execute_governed_action( session: Session, *, action: str, target: str, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: """Execute a typed action after the trusted MCP boundary has evaluated policy. This path deliberately does not create or consume an Approval row. It is used by authenticated MCP automation in no-human-approval mode. The central policy still fails closed for ``blocked`` actions before this function is called, and only the small allowlist of typed rollback/post-check capable executors below is reachable. """ if not mcp_execution_supported(action): return { "success": False, "status": "failed", "result": "unsupported", "message": "No typed MCP executor is registered for this action.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } if action == "controller.artifact.promote": if target.strip().lower() != "tower/deployment-controller": return { "success": False, "status": "failed", "result": "blocked", "message": "Controller artifact promotion accepts only tower/deployment-controller.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } return _execute_controller_artifact_promote( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, ) if action == "controller.managed-storage.initialize": if target != "tower/deployment-controller": return { "success": False, "status": "failed", "result": "blocked", "message": "Managed storage initialization accepts only tower/deployment-controller.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } return _execute_managed_appdata_initialize( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, ) if action == "hub.migration.prepare_permissions": if target.strip().lower() != "tower/itworx-mcp-hub-permissions": return { "success": False, "status": "failed", "result": "blocked", "message": "MCP Hub permission preparation accepts only tower/itworx-mcp-hub-permissions.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } return _execute_hub_migration_prepare_permissions( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, ) if action == "runner.fleet.upgrade_v2": if target.strip().lower() != "tower/runner-fleet-v2": return { "success": False, "status": "failed", "result": "blocked", "message": "Runner fleet v2 upgrade accepts only tower/runner-fleet-v2.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } return _execute_runner_fleet_upgrade_v2( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, ) if action == "runner.statistics.configure": if target.strip().lower() != "tower/projectbrain-runner-statistics": return {"success": False, "status": "failed", "result": "blocked", "message": "Statistics configuration accepts only tower/projectbrain-runner-statistics.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision} return _execute_runner_fleet_upgrade_v2( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, statistics_configuration=True, ) if action == "runner.fleet.specialize": if target.strip().lower() != "tower/runner-fleet-specialized": return { "success": False, "status": "failed", "result": "blocked", "message": "Runner specialization accepts only tower/runner-fleet-specialized.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } return _execute_runner_fleet_upgrade_v2( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, specialized=True, ) if action == "deployment.runnerless.provision": return _execute_runnerless_target_provisioning( session, target=target, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, ) if action == "deployment.target.deploy_workmesh": if target.strip().lower() != "jens/workmesh": return { "success": False, "status": "failed", "result": "blocked", "message": "WorkMesh first deploy accepts only the fixed jens/workmesh target.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } return _execute_workmesh_first_deployment( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, ) if action == "deployment.target.promote_workmesh": return { "success": False, "status": "failed", "result": "approval_required", "message": ( "WorkMesh promotion requires the exact-revision preflight and human approval flow." ), "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } if action == "deployment.targets.sync": if target.strip().lower() != "jens/*": return { "success": False, "status": "failed", "result": "blocked", "message": "Deployment target sync accepts only the fixed jens/* catalog target.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } return _execute_deployment_target_sync( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, ) if action in {"unraid.vm.start", "unraid.vm.resume", "unraid.vm.pause"}: from .unraid_vm_service import VM_ACTIONS, execute_vm_action vm_action = next( ( name for name, definition in VM_ACTIONS.items() if definition["action_id"] == action ), None, ) if vm_action not in {"start", "resume", "pause"}: return { "success": False, "status": "failed", "result": "unsupported", "message": "No safe VM executor is registered for this action.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } result = execute_vm_action( session, vm_id=target, action=vm_action, source=source, policy_decision="allowed", reason=reason, ) return { **result, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } if action == "deployment.target.register_portfolio": if target.strip().lower() != "jens/portfolio": return { "success": False, "status": "failed", "result": "blocked", "message": "Portfolio target registration accepts only jens/portfolio.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } return _execute_portfolio_target_enrollment( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, ) if action == "deployment.target.register_privatemuse": if target.strip().lower() != "jens/privatemuse": return { "success": False, "status": "failed", "result": "blocked", "message": "PrivateMuse target registration accepts only jens/privatemuse.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } return _execute_privatemuse_target_enrollment( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, ) if action == "deployment.target.reconcile_media_codec_dashboard": if target.strip().lower() != "jens/media-codec-dashboard": return { "success": False, "status": "failed", "result": "blocked", "message": ( "Media Codec Dashboard reconciliation accepts only " "jens/media-codec-dashboard." ), "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } return _execute_media_codec_dashboard_reconciliation( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, ) if action == "deployment.webhook.repair_privatemuse": if target.strip().lower() != "jens/privatemuse": return { "success": False, "status": "failed", "result": "blocked", "message": "PrivateMuse webhook repair accepts only jens/privatemuse.", "policyDecision": "blocked", "originalPolicyDecision": original_policy_decision, } return _execute_privatemuse_webhook_repair( session, source=source, risk=risk, reason=reason, original_policy_decision=original_policy_decision, ) if action == "container.restart": from .container_restart_service import execute_container_restart result = execute_container_restart( session=session, action=action, target=target, source=source, risk=risk, steps=[ "Validate MCP policy", "Resolve container", "Restart container", "Post-check health", ], policy_override={ "decision": "allowed", "reason": reason, "risk": risk, }, ) return { **result, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } apply_stored_connector_settings(session) connector_call, default_message = _approved_connector_call(action) steps = _DIRECT_STEPS[action] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress(session, job, 35, "MCP policy authorized; calling typed connector.") try: connector_result = connector_call() success = bool(connector_result.get("success")) message = str( connector_result.get("message") or (default_message if success else "connector_action_failed") ) except Exception as exc: # Connector errors must become an audited failed job. success = False message = f"{type(exc).__name__}: connector action failed" connector_result = {"status": "error"} completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="approval", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={"status": connector_result.get("status"), "message": message}, redacted_metadata={ "executor": action, "integration": "mcp", "originalPolicyDecision": original_policy_decision, }, ) return { "success": success, "status": "success" if success else "failed", "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def _execute_managed_appdata_initialize( session: Session, *, source: str, risk: str, reason: str, original_policy_decision: str, ) -> dict[str, Any]: """Initialize only the fixed storage marker after trust and policy opt-in.""" from .deployment_broker import DeploymentBrokerClient from .enrollment_plane import EnrollmentPlane from .secret_store import get_secret action = "controller.managed-storage.initialize" target = "tower/deployment-controller" trust = EnrollmentPlane.get_trust_config(session) if ( trust is None or trust.trusted_appdata_root != "/var/lib/docker/volumes/itworx-managed-appdata/_data" or trust.managed_appdata_backup_acknowledged is not True ): audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="controller", risk=risk, policy_decision="allowed", reason="Managed Docker-root storage requires an explicit trusted selector and backup acknowledgement.", result="blocked", redacted_metadata={"executor": action, "trustOptIn": False}, ) return { "success": False, "status": "failed", "result": "blocked", "message": "Managed storage is not explicitly selected and acknowledged in enrollment trust.", "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } bootstrap_secret = get_secret(session, trust.bootstrap_secret_ref, touch=False) if not bootstrap_secret: audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="controller", risk=risk, policy_decision="allowed", reason="Controller bootstrap capability is unavailable by its configured reference.", result="failed", redacted_metadata={"executor": action, "secretMaterialReturned": False}, ) return { "success": False, "status": "failed", "result": "failed", "message": "Controller bootstrap capability is unavailable.", "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } steps = [ "Verify the exact target, trust selector and backup acknowledgement", "Authenticate the fixed controller request with bootstrap HMAC and replay protection", "Validate the protected controller, target registry, repository root and fixed Docker volume", "Initialize the selector only if the managed Docker volume is empty and unchanged", "Re-read the fixed selector and record sanitized controller readiness", ] job = create_job( session, action_id=action, target=target, source=source, risk=risk, policy_decision="allowed", steps=steps, ) start_job(session, job) set_job_progress(session, job, 20, "Validating fixed managed-storage initialization prerequisites.") try: result = DeploymentBrokerClient().initialize_managed_appdata(secret=bootstrap_secret) reported_status = result.get("status") status = ( reported_status if isinstance(reported_status, str) and reported_status in {"initialized", "already_initialized"} else "refused" ) success = ( status in {"initialized", "already_initialized"} and result.get("trustedAppdataRoot") == trust.trusted_appdata_root and result.get("backupLocation") == "dockerRootDir" ) message = ( "Managed storage selector initialized and verified." if success else "Managed storage initialization was refused or unavailable." ) except Exception: result = {"status": "error"} status = "error" success = False message = "Managed storage initialization was refused or unavailable." completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="action", identity=source, action_id=action, target=target, target_type="controller", risk=risk, policy_decision="allowed", reason=reason, result="success" if success else "failed", execution_plan={"steps": steps, "jobId": completed.id}, after_state={ "status": status, "trustedAppdataRoot": trust.trusted_appdata_root if success else None, "backupLocation": "dockerRootDir" if success else None, }, redacted_metadata={ "executor": action, "target": target, "integration": "mcp" if source == "chatgpt-mcp" else "operator", "originalPolicyDecision": original_policy_decision, "secretMaterialReturned": False, }, ) return { "success": success, "status": "success" if success else "failed", "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, "policyDecision": "allowed", "originalPolicyDecision": original_policy_decision, } def execute_approved_action(session: Session, approval: Approval) -> dict[str, Any]: if not approval_execution_supported(approval.action): return { "success": False, "status": "failed", "result": "unsupported", "message": "Deze goedgekeurde actie heeft nog geen rollback-veilige executor.", } if approval.action == "controller.artifact.promote": if approval.target.strip().lower() != "tower/deployment-controller": return { "success": False, "status": "failed", "result": "blocked", "message": "Controller artifact promotion accepts only tower/deployment-controller.", } return _execute_controller_artifact_promote( session, source="approved_operator", risk=approval.risk, reason=approval.reason or f"Approved through {approval.id}.", original_policy_decision="approval_required", ) if approval.action == "deployment.runnerless.provision": return _execute_runnerless_target_provisioning( session, target=approval.target, source="approved_operator", risk=approval.risk, reason=approval.reason or f"Approved through {approval.id}.", original_policy_decision="approval_required", ) if approval.action == "runner.fleet.upgrade_v2": if approval.target.strip().lower() != "tower/runner-fleet-v2": return { "success": False, "status": "failed", "result": "blocked", "message": "Runner fleet v2 upgrade accepts only tower/runner-fleet-v2.", } return _execute_runner_fleet_upgrade_v2( session, source="approved_operator", risk=approval.risk, reason=approval.reason or f"Approved through {approval.id}.", original_policy_decision="approval_required", ) if approval.action == "runner.statistics.configure": if approval.target.strip().lower() != "tower/projectbrain-runner-statistics": return {"success": False, "status": "failed", "result": "blocked", "message": "Statistics configuration accepts only tower/projectbrain-runner-statistics."} return _execute_runner_fleet_upgrade_v2( session, source="approved_operator", risk=approval.risk, reason=approval.reason or f"Approved through {approval.id}.", original_policy_decision="approval_required", statistics_configuration=True, ) if approval.action == "runner.fleet.specialize": if approval.target.strip().lower() != "tower/runner-fleet-specialized": return { "success": False, "status": "failed", "result": "blocked", "message": "Runner specialization accepts only tower/runner-fleet-specialized.", } return _execute_runner_fleet_upgrade_v2( session, source="approved_operator", risk=approval.risk, reason=approval.reason or f"Approved through {approval.id}.", original_policy_decision="approval_required", specialized=True, ) if approval.action == "hub.migration.prepare_permissions": if approval.target.strip().lower() != "tower/itworx-mcp-hub-permissions": return { "success": False, "status": "failed", "result": "blocked", "message": "MCP Hub permission preparation accepts only tower/itworx-mcp-hub-permissions.", } return _execute_hub_migration_prepare_permissions( session, source="approved_operator", risk=approval.risk, reason=approval.reason or f"Approved through {approval.id}.", original_policy_decision="approval_required", ) if approval.action in {"unraid.vm.start", "unraid.vm.resume", "unraid.vm.pause"}: from .unraid_vm_service import execute_approved_vm_action return execute_approved_vm_action(session, approval) if approval.action == "deployment.target.promote_workmesh": from .workmesh_promotion import WorkMeshPromotionService return WorkMeshPromotionService().execute_approved(session, approval) if approval.action == "deployment.target.register_portfolio": if approval.target.strip().lower() != "jens/portfolio": return { "success": False, "status": "failed", "result": "blocked", "message": "Portfolio target registration accepts only jens/portfolio.", } return _execute_portfolio_target_enrollment( session, source="approved_operator", risk=approval.risk, reason=approval.reason or f"Approved through {approval.id}.", original_policy_decision="approval_required", ) if approval.action == "deployment.target.register_privatemuse": if approval.target.strip().lower() != "jens/privatemuse": return { "success": False, "status": "failed", "result": "blocked", "message": "PrivateMuse target registration accepts only jens/privatemuse.", } return _execute_privatemuse_target_enrollment( session, source="approved_operator", risk=approval.risk, reason=approval.reason or f"Approved through {approval.id}.", original_policy_decision="approval_required", ) if approval.action == "deployment.target.reconcile_media_codec_dashboard": if approval.target.strip().lower() != "jens/media-codec-dashboard": return { "success": False, "status": "failed", "result": "blocked", "message": ( "Media Codec Dashboard reconciliation accepts only " "jens/media-codec-dashboard." ), } return _execute_media_codec_dashboard_reconciliation( session, source="approved_operator", risk=approval.risk, reason=approval.reason or f"Approved through {approval.id}.", original_policy_decision="approval_required", ) if approval.action == "deployment.webhook.repair_privatemuse": if approval.target.strip().lower() != "jens/privatemuse": return { "success": False, "status": "failed", "result": "blocked", "message": "PrivateMuse webhook repair accepts only jens/privatemuse.", } return _execute_privatemuse_webhook_repair( session, source="approved_operator", risk=approval.risk, reason=approval.reason or f"Approved through {approval.id}.", original_policy_decision="approval_required", ) if approval.action == "container.restart": from .container_restart_service import execute_container_restart return execute_container_restart( session=session, action=approval.action, target=approval.target, source="approved_operator", risk=approval.risk, steps=[ "Load approved request", "Resolve container", "Restart container", "Post-check health", ], approved=True, ) apply_stored_connector_settings(session) connector_call, default_message = _approved_connector_call(approval.action) steps = _APPROVAL_STEPS[approval.action] job = create_job( session, action_id=approval.action, target=approval.target, source="approved_operator", risk=approval.risk, policy_decision="approval_required", steps=steps, ) start_job(session, job) set_job_progress( session, job, 35, f"Approval {approval.id} validated; calling connector." ) try: connector_result = connector_call() success = bool(connector_result.get("success")) message = str( connector_result.get("message") or (default_message if success else "connector_action_failed") ) except Exception as exc: # Connector errors must become an audited failed job. success = False message = f"{type(exc).__name__}: connector action failed" connector_result = {"status": "error"} completed = complete_job( session, job, status="succeeded" if success else "failed", result_summary=message, ) audit = log_event( session, source="approval", identity="operator", action_id=approval.action, target=approval.target, target_type="approval", risk=approval.risk, policy_decision="approval_required", reason=approval.reason or f"Approved through {approval.id}.", result="success" if success else "failed", execution_plan={ "steps": steps, "approvalId": approval.id, "jobId": completed.id, }, after_state={"status": connector_result.get("status"), "message": message}, redacted_metadata={"approvalId": approval.id, "executor": approval.action}, ) return { "success": success, "status": "success" if success else "failed", "result": "success" if success else "failed", "message": message, "jobId": completed.id, "auditId": audit.id, }