2813 lines
98 KiB
Python
2813 lines
98 KiB
Python
from __future__ import annotations
|
|
|
|
from collections.abc import Callable
|
|
from typing import Any
|
|
|
|
from sqlmodel import Session, select
|
|
|
|
from ..connectors.deluge import DelugeConnector
|
|
from ..connectors.plex import PlexConnector
|
|
from ..db.models import Approval, JobRun
|
|
from .audit_logger import log_event
|
|
from .job_runner import (
|
|
complete_job,
|
|
create_job,
|
|
prepare_job,
|
|
set_job_progress,
|
|
start_job,
|
|
)
|
|
from .setup_service import apply_stored_connector_settings
|
|
|
|
GENERIC_EXECUTOR_ACTIONS = {
|
|
"container.restart",
|
|
"controller.artifact.promote",
|
|
"controller.managed-storage.initialize",
|
|
"deployment.targets.sync",
|
|
"deployment.runnerless.provision",
|
|
"deployment.target.deploy_workmesh",
|
|
"deployment.target.register_portfolio",
|
|
"deployment.target.register_privatemuse",
|
|
"deployment.target.reconcile_media_codec_dashboard",
|
|
"deployment.webhook.repair_privatemuse",
|
|
"privatemuse.comfyui.install_artifact",
|
|
}
|
|
|
|
DEDICATED_ENDPOINT_ACTIONS = {
|
|
"deluge.pause_torrent",
|
|
"deluge.resume_torrent",
|
|
"media_pipeline.check",
|
|
"media_pipeline.diagnose",
|
|
"notifications.evaluate_safety",
|
|
"plex.scan_library",
|
|
"prowlarr.search_test",
|
|
"radarr.add_movie",
|
|
"sonarr.add_series",
|
|
"unraid.vm.start",
|
|
"unraid.vm.resume",
|
|
"unraid.vm.pause",
|
|
"widefrog.retry_failed",
|
|
"widefrog.scan_library",
|
|
}
|
|
|
|
APPROVAL_EXECUTOR_ACTIONS = {
|
|
"container.restart",
|
|
"controller.artifact.promote",
|
|
"runner.fleet.upgrade_v2",
|
|
"runner.fleet.specialize",
|
|
"runner.statistics.configure",
|
|
"hub.migration.prepare_permissions",
|
|
"deployment.targets.sync",
|
|
"deployment.runnerless.provision",
|
|
"deployment.target.deploy_workmesh",
|
|
"deployment.target.promote_workmesh",
|
|
"deployment.target.register_portfolio",
|
|
"deployment.target.register_privatemuse",
|
|
"deployment.target.reconcile_media_codec_dashboard",
|
|
"deployment.webhook.repair_privatemuse",
|
|
"privatemuse.comfyui.install_artifact",
|
|
"deluge.pause_all",
|
|
"deluge.resume_all",
|
|
"plex.scan_all_libraries",
|
|
"unraid.vm.start",
|
|
"unraid.vm.resume",
|
|
"unraid.vm.pause",
|
|
}
|
|
|
|
MCP_TYPED_EXECUTOR_ACTIONS = APPROVAL_EXECUTOR_ACTIONS | {
|
|
"controller.managed-storage.initialize",
|
|
}
|
|
|
|
HUMAN_APPROVAL_ONLY_ACTIONS = {"deployment.target.promote_workmesh", "privatemuse.comfyui.install_artifact"}
|
|
|
|
_APPROVAL_STEPS = {
|
|
"deluge.pause_all": [
|
|
"Load approved request",
|
|
"Reload connector settings",
|
|
"Pause all torrents",
|
|
"Record result",
|
|
],
|
|
"deluge.resume_all": [
|
|
"Load approved request",
|
|
"Reload connector settings",
|
|
"Resume all torrents",
|
|
"Record result",
|
|
],
|
|
"plex.scan_all_libraries": [
|
|
"Load approved request",
|
|
"Reload connector settings",
|
|
"Scan all Plex libraries",
|
|
"Record result",
|
|
],
|
|
}
|
|
|
|
_DIRECT_STEPS = {
|
|
"deluge.pause_all": [
|
|
"Validate MCP policy",
|
|
"Reload connector settings",
|
|
"Pause all torrents",
|
|
"Record result",
|
|
],
|
|
"deluge.resume_all": [
|
|
"Validate MCP policy",
|
|
"Reload connector settings",
|
|
"Resume all torrents",
|
|
"Record result",
|
|
],
|
|
"plex.scan_all_libraries": [
|
|
"Validate MCP policy",
|
|
"Reload connector settings",
|
|
"Scan all Plex libraries",
|
|
"Record result",
|
|
],
|
|
}
|
|
|
|
|
|
def action_execution_profile(
|
|
action: str, policy_decision: str, capability: str
|
|
) -> dict[str, Any]:
|
|
if policy_decision == "blocked":
|
|
mode = "blocked"
|
|
surface = None
|
|
elif action in GENERIC_EXECUTOR_ACTIONS:
|
|
mode = "command_center"
|
|
surface = "/command-center"
|
|
elif action in APPROVAL_EXECUTOR_ACTIONS and policy_decision == "approval_required":
|
|
mode = "approval_then_execute"
|
|
surface = "/approvals"
|
|
elif action in DEDICATED_ENDPOINT_ACTIONS or capability == "read_only":
|
|
mode = "dedicated_surface"
|
|
surface = None
|
|
else:
|
|
mode = "governance_only"
|
|
surface = None
|
|
|
|
return {
|
|
"executionMode": mode,
|
|
"executionSupported": mode
|
|
in {"command_center", "approval_then_execute", "dedicated_surface"},
|
|
"commandExecutionSupported": mode == "command_center",
|
|
"executionSurface": surface,
|
|
}
|
|
|
|
|
|
def approval_execution_supported(action: str) -> bool:
|
|
return action in APPROVAL_EXECUTOR_ACTIONS
|
|
|
|
|
|
def mcp_execution_supported(action: str) -> bool:
|
|
"""MCP is a no-human-approval surface; never admit human-only executors."""
|
|
return action in MCP_TYPED_EXECUTOR_ACTIONS and action not in HUMAN_APPROVAL_ONLY_ACTIONS
|
|
|
|
|
|
def _execute_deployment_target_sync(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .gitea_project_auto_registration import GiteaProjectAutoRegistration
|
|
|
|
action = "deployment.targets.sync"
|
|
target = "jens/*"
|
|
steps = [
|
|
"Read owned Gitea repositories through the bounded catalog client",
|
|
"Validate repository deployment descriptors and Compose topology",
|
|
"Register exact-SHA controller targets where contracts are valid",
|
|
"Install exact-target deployment policies without deploying applications",
|
|
]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(session, job, 20, "Reconciling bounded Gitea deployment targets.")
|
|
try:
|
|
result = GiteaProjectAutoRegistration().sync(session, force=True)
|
|
status = str(result.get("status") or "error")
|
|
summary = result.get("summary") if isinstance(result.get("summary"), dict) else {}
|
|
success = status == "ok"
|
|
message = (
|
|
"Deployment target catalog reconciled."
|
|
if success
|
|
else str(result.get("reason") or "Deployment target catalog reconciliation failed.")
|
|
)
|
|
except Exception as exc:
|
|
success = False
|
|
status = "error"
|
|
summary = {}
|
|
message = f"{type(exc).__name__}: deployment target catalog reconciliation failed"
|
|
result = {"status": status}
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-project-catalog",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"total": summary.get("total", 0),
|
|
"registered": summary.get("registered", 0),
|
|
"knownUnconfigured": summary.get("knownUnconfigured", 0),
|
|
"conflicts": summary.get("conflicts", 0),
|
|
"errors": summary.get("errors", 0),
|
|
"changed": summary.get("changedThisSync", 0),
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else "failed",
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"summary": {
|
|
"total": summary.get("total", 0),
|
|
"registered": summary.get("registered", 0),
|
|
"knownUnconfigured": summary.get("knownUnconfigured", 0),
|
|
"conflicts": summary.get("conflicts", 0),
|
|
"errors": summary.get("errors", 0),
|
|
"changed": summary.get("changedThisSync", 0),
|
|
},
|
|
}
|
|
|
|
|
|
def _execute_workmesh_first_deployment(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .workmesh_first_deployment import WorkMeshFirstDeployment
|
|
|
|
action = "deployment.target.deploy_workmesh"
|
|
target = "jens/workmesh"
|
|
steps = [
|
|
"Verify the fixed WorkMesh v0.1.0 protected-main release contract",
|
|
"Create or validate the external mode-0600 WorkMesh runtime environment",
|
|
"Reserve the fixed loopback port set and reconcile the exact-source controller target",
|
|
"Run the official deployment-controller preflight and transactional first deploy",
|
|
"Verify the controller-owned deployment receipt without exposing secret values",
|
|
]
|
|
service = WorkMeshFirstDeployment()
|
|
tracked_job_id = service.tracked_job_id(session)
|
|
job = session.get(JobRun, tracked_job_id) if tracked_job_id else None
|
|
orphan_running = False
|
|
if job is None:
|
|
job = session.exec(
|
|
select(JobRun)
|
|
.where(JobRun.action_id == action, JobRun.target == target, JobRun.status == "running")
|
|
.order_by(JobRun.started_at.desc())
|
|
).first()
|
|
if job is not None:
|
|
orphan_running = True
|
|
else:
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
|
|
try:
|
|
deployment = (
|
|
{
|
|
"status": "outcome_unknown",
|
|
"reason": "An earlier WorkMesh deployment job is running without matching durable execution state; reconcile it before another deploy",
|
|
}
|
|
if orphan_running
|
|
else service.run(session, job=job)
|
|
)
|
|
status = str(deployment.get("status") or "error")
|
|
execution_id = str(deployment.get("execution_id") or "")
|
|
if status == "deployed":
|
|
success = True
|
|
message = "WorkMesh v0.1.0 first deployment completed with controller receipt evidence."
|
|
elif status == "in_progress":
|
|
success = False
|
|
message = "WorkMesh v0.1.0 first deployment is still running."
|
|
elif status == "outcome_unknown":
|
|
success = False
|
|
message = str(deployment.get("reason") or "WorkMesh deployment outcome requires reconciliation.")
|
|
else:
|
|
success = False
|
|
message = str(deployment.get("reason") or "WorkMesh v0.1.0 first deployment failed closed.")
|
|
except Exception as exc:
|
|
status = "error"
|
|
execution_id = ""
|
|
success = False
|
|
deployment = {"status": status}
|
|
message = f"{type(exc).__name__}: WorkMesh first-deploy reconciliation failed"
|
|
|
|
if status in {"in_progress", "outcome_unknown"}:
|
|
if job.status not in {"succeeded", "failed", "cancelled"}:
|
|
completed = set_job_progress(
|
|
session,
|
|
job,
|
|
max(job.progress, 90 if status == "outcome_unknown" else 25),
|
|
message,
|
|
)
|
|
else:
|
|
completed = job
|
|
elif job.status in {"succeeded", "failed", "cancelled"}:
|
|
completed = job
|
|
else:
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
|
|
outward_status = (
|
|
status
|
|
if status in {"in_progress", "outcome_unknown"}
|
|
else "success"
|
|
if success
|
|
else "failed"
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-target",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result=outward_status,
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"repository": deployment.get("repository", target),
|
|
"revision": deployment.get("revision"),
|
|
"composeProject": deployment.get("compose_project"),
|
|
"containers": deployment.get("containers"),
|
|
"ports": deployment.get("ports"),
|
|
"executionId": execution_id or None,
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"secretsReturned": False,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": outward_status,
|
|
"result": outward_status,
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
**({"executionId": execution_id} if execution_id else {}),
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
def _execute_portfolio_target_enrollment(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .portfolio_deployment_recovery import PortfolioDeploymentRecovery
|
|
|
|
action = "deployment.target.register_portfolio"
|
|
target = "jens/portfolio"
|
|
steps = [
|
|
"Validate the fixed Portfolio deployment contract",
|
|
"Verify or re-attest the proven live Portfolio web/API pair",
|
|
"Atomically reconcile the paired controller target state",
|
|
"Preserve exact-source deployment provenance",
|
|
]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(session, job, 20, "Validating fixed Portfolio deployment target.")
|
|
try:
|
|
enrollment = PortfolioDeploymentRecovery().run()
|
|
status = str(enrollment.get("status") or "error")
|
|
success = status in {"enrolled", "already-enrolled", "reconciled"}
|
|
message = str(
|
|
enrollment.get("reason")
|
|
or (
|
|
"Portfolio deployment target state verified."
|
|
if success
|
|
else "Portfolio deployment target enrollment failed."
|
|
)
|
|
)
|
|
except Exception as exc:
|
|
success = False
|
|
status = "error"
|
|
message = f"{type(exc).__name__}: Portfolio deployment target enrollment failed"
|
|
enrollment = {"status": status}
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-target",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"repository": enrollment.get("repository"),
|
|
"composeProject": enrollment.get("compose_project"),
|
|
"containers": enrollment.get("containers"),
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else "failed",
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
def _execute_privatemuse_target_enrollment(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .privatemuse_deployment_recovery import PrivateMuseDeploymentRecovery
|
|
|
|
action = "deployment.target.register_privatemuse"
|
|
target = "jens/privatemuse"
|
|
steps = [
|
|
"Validate the fixed PrivateMuse deployment contract",
|
|
"Verify or re-attest the proven live PrivateMuse production trio",
|
|
"Atomically reconcile only the bounded controller receipt state",
|
|
"Preserve immutable images, media, models and exact-source provenance",
|
|
]
|
|
recovery = PrivateMuseDeploymentRecovery()
|
|
candidate_job = prepare_job(
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
tracked, admitted = recovery.admit_job(session, candidate_job)
|
|
tracked_job_id = str(tracked.get("jobId") or "")
|
|
job = session.get(JobRun, tracked_job_id)
|
|
if job is None:
|
|
raise RuntimeError("PrivateMuse recovery owner job is unavailable")
|
|
if admitted:
|
|
start_job(session, job)
|
|
set_job_progress(
|
|
session, job, 20, "Validating fixed PrivateMuse deployment target."
|
|
)
|
|
try:
|
|
enrollment = recovery.run(
|
|
session=session,
|
|
job_id=job.id if admitted else candidate_job.id,
|
|
)
|
|
status = str(enrollment.get("status") or "error")
|
|
success = status in {"enrolled", "already-enrolled", "reconciled"}
|
|
message = str(
|
|
enrollment.get("reason")
|
|
or (
|
|
"PrivateMuse deployment target state verified."
|
|
if success
|
|
else "PrivateMuse deployment target enrollment failed."
|
|
)
|
|
)
|
|
except Exception as exc:
|
|
guarded = recovery.guarded_unknown_result(
|
|
session,
|
|
reason=(
|
|
"PrivateMuse recovery crossed its durable execution boundary but "
|
|
"local result handling failed; reconcile the recorded execution and "
|
|
"do not retry"
|
|
),
|
|
)
|
|
if guarded is not None:
|
|
success = False
|
|
status = "outcome_unknown"
|
|
message = str(guarded["reason"])
|
|
enrollment = guarded
|
|
else:
|
|
success = False
|
|
status = "error"
|
|
message = (
|
|
f"{type(exc).__name__}: PrivateMuse deployment target enrollment failed"
|
|
)
|
|
enrollment = {"status": status}
|
|
|
|
execution_id = str(enrollment.get("execution_id") or "")
|
|
original_job_id = str(enrollment.get("original_job_id") or job.id)
|
|
original_job = session.get(JobRun, original_job_id)
|
|
result_job = original_job or job
|
|
evidence_summary = (
|
|
f"{status}; executionId={execution_id}; {message}"
|
|
if execution_id
|
|
else f"{status}; {message}"
|
|
)
|
|
if status in {"in_progress", "outcome_unknown"}:
|
|
if result_job.status not in {"succeeded", "failed", "cancelled"}:
|
|
completed = set_job_progress(
|
|
session,
|
|
result_job,
|
|
max(result_job.progress, 90 if status == "outcome_unknown" else 5),
|
|
evidence_summary,
|
|
)
|
|
else:
|
|
completed = result_job
|
|
elif result_job.status in {"succeeded", "failed", "cancelled"}:
|
|
completed = result_job
|
|
else:
|
|
completed = complete_job(
|
|
session,
|
|
result_job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=evidence_summary,
|
|
)
|
|
outward_status = (
|
|
status
|
|
if status in {"in_progress", "outcome_unknown"}
|
|
else "success"
|
|
if success
|
|
else "failed"
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-target",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result=outward_status,
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"repository": enrollment.get("repository"),
|
|
"composeProject": enrollment.get("compose_project"),
|
|
"containers": enrollment.get("containers"),
|
|
"executionId": execution_id or None,
|
|
"originalJobId": original_job_id,
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": outward_status,
|
|
"result": outward_status,
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
**({"executionId": execution_id} if execution_id else {}),
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
|
|
def _execute_media_codec_dashboard_reconciliation(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .media_codec_dashboard_deployment_reconciliation import (
|
|
MediaCodecDashboardDeploymentReconciliation,
|
|
)
|
|
|
|
action = "deployment.target.reconcile_media_codec_dashboard"
|
|
target = "jens/media-codec-dashboard"
|
|
steps = [
|
|
"Validate the fixed Media Codec Dashboard deployment contract",
|
|
"Verify the live immutable dashboard runtime",
|
|
"Reconcile only the bounded controller deployment state",
|
|
"Preserve containers, images, mounts and exact-source provenance",
|
|
]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(
|
|
session,
|
|
job,
|
|
20,
|
|
"Validating fixed Media Codec Dashboard deployment state.",
|
|
)
|
|
try:
|
|
reconciliation = MediaCodecDashboardDeploymentReconciliation().run()
|
|
status = str(reconciliation.get("status") or "error")
|
|
success = status == "reconciled"
|
|
message = str(
|
|
reconciliation.get("reason")
|
|
or (
|
|
"Media Codec Dashboard deployment state reconciled."
|
|
if success
|
|
else "Media Codec Dashboard deployment-state reconciliation failed."
|
|
)
|
|
)
|
|
except Exception as exc:
|
|
success = False
|
|
status = "error"
|
|
reconciliation = {"status": status}
|
|
message = (
|
|
f"{type(exc).__name__}: "
|
|
"Media Codec Dashboard deployment-state reconciliation failed"
|
|
)
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-target",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"repository": reconciliation.get("repository"),
|
|
"container": reconciliation.get("container"),
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else "failed",
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
def _execute_privatemuse_webhook_repair(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .privatemuse_webhook_repair import PrivateMuseWebhookRepair
|
|
|
|
action = "deployment.webhook.repair_privatemuse"
|
|
target = "jens/privatemuse"
|
|
steps = [
|
|
"Validate the fixed PrivateMuse runnerless webhook contract",
|
|
"Verify controller-owned webhook secret and Gitea repository identity",
|
|
"Create or repair only the exact PrivateMuse push hook",
|
|
"Re-read the hook and verify active main-only push delivery metadata",
|
|
]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(session, job, 20, "Validating fixed PrivateMuse webhook state.")
|
|
try:
|
|
repair = PrivateMuseWebhookRepair().run()
|
|
status = str(repair.get("status") or "error")
|
|
success = status == "repaired"
|
|
message = str(
|
|
repair.get("reason")
|
|
or (
|
|
"PrivateMuse runnerless webhook verified or repaired."
|
|
if success
|
|
else "PrivateMuse runnerless webhook repair failed."
|
|
)
|
|
)
|
|
except Exception as exc:
|
|
success = False
|
|
status = "error"
|
|
message = f"{type(exc).__name__}: PrivateMuse runnerless webhook repair failed"
|
|
repair = {"status": status}
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-webhook",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"repository": repair.get("repository"),
|
|
"endpoint": repair.get("endpoint"),
|
|
"branch": repair.get("branch"),
|
|
"event": repair.get("event"),
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"secretMaterialReturned": False,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else status,
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
def _execute_runnerless_target_provisioning(
|
|
session: Session,
|
|
*,
|
|
target: str,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .gitea_project_auto_registration import GiteaProjectAutoRegistration
|
|
from .runnerless_target_provisioning import RunnerlessTargetProvisioning
|
|
|
|
action = "deployment.runnerless.provision"
|
|
application_id = target.strip().lower()
|
|
catalog = GiteaProjectAutoRegistration.catalog(session)
|
|
projects = catalog.get("projects") if isinstance(catalog, dict) else None
|
|
matches = [
|
|
item
|
|
for item in projects or []
|
|
if isinstance(item, dict)
|
|
and str(item.get("applicationId") or "").strip().lower() == application_id
|
|
and bool(item.get("deploymentRegistered"))
|
|
and str(item.get("state") or "") in {"registered", "registered_existing"}
|
|
]
|
|
if len(matches) != 1:
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": (
|
|
"Runnerless provisioning requires exactly one auto-registered "
|
|
"deployment target."
|
|
),
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
project = matches[0]
|
|
repository = str(project.get("repository") or "").strip().lower()
|
|
branch = str(project.get("defaultBranch") or "").strip()
|
|
revision = str(project.get("revision") or "").strip().lower()
|
|
if (
|
|
not repository.startswith("jens/")
|
|
or not branch
|
|
or len(revision) != 40
|
|
or any(character not in "0123456789abcdef" for character in revision)
|
|
):
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "Auto-registered deployment target metadata is incomplete.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
steps = [
|
|
"Resolve the exact auto-registered application target",
|
|
"Verify controller target, repository identity and private Gitea reachability",
|
|
"Create or verify one repository-specific runnerless webhook secret",
|
|
"Install the exact main-push validation triplet and signed Gitea hook",
|
|
"Verify the hook without returning credentials",
|
|
]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=application_id,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(
|
|
session,
|
|
job,
|
|
20,
|
|
"Provisioning exact-target runnerless delivery metadata.",
|
|
)
|
|
try:
|
|
provisioned = RunnerlessTargetProvisioning().run(
|
|
repository=repository,
|
|
branch=branch,
|
|
)
|
|
status = str(provisioned.get("status") or "error")
|
|
success = status == "ready"
|
|
message = str(
|
|
provisioned.get("reason")
|
|
or (
|
|
"Runnerless delivery is ready for the registered target."
|
|
if success
|
|
else "Runnerless delivery provisioning failed."
|
|
)
|
|
)
|
|
except Exception as exc:
|
|
provisioned = {"status": "error"}
|
|
status = "error"
|
|
success = False
|
|
message = (
|
|
f"{type(exc).__name__}: runnerless target provisioning failed"
|
|
)
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=application_id,
|
|
target_type="deployment-webhook",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"applicationId": application_id,
|
|
"repository": repository,
|
|
"revision": revision,
|
|
"branch": provisioned.get("branch"),
|
|
"endpoint": provisioned.get("endpoint"),
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"secretMaterialReturned": False,
|
|
"repositoryCallerSelectable": False,
|
|
"branchCallerSelectable": False,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else status,
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"applicationId": application_id,
|
|
"repository": repository,
|
|
"revision": revision,
|
|
}
|
|
|
|
|
|
def _execute_workmesh_first_deployment(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .workmesh_first_deployment import WorkMeshFirstDeployment
|
|
|
|
action = "deployment.target.deploy_workmesh"
|
|
target = "jens/workmesh"
|
|
steps = [
|
|
"Verify the fixed WorkMesh v0.1.0 protected-main release contract",
|
|
"Create or validate the external mode-0600 WorkMesh runtime environment",
|
|
"Reserve the fixed loopback port set and reconcile the exact-source controller target",
|
|
"Run the official deployment-controller preflight and transactional first deploy",
|
|
"Verify the controller-owned deployment receipt without exposing secret values",
|
|
]
|
|
service = WorkMeshFirstDeployment()
|
|
tracked_job_id = service.tracked_job_id(session)
|
|
job = session.get(JobRun, tracked_job_id) if tracked_job_id else None
|
|
orphan_running = False
|
|
if job is None:
|
|
job = session.exec(
|
|
select(JobRun)
|
|
.where(JobRun.action_id == action, JobRun.target == target, JobRun.status == "running")
|
|
.order_by(JobRun.started_at.desc())
|
|
).first()
|
|
if job is not None:
|
|
orphan_running = True
|
|
else:
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
|
|
try:
|
|
deployment = (
|
|
{
|
|
"status": "outcome_unknown",
|
|
"reason": "An earlier WorkMesh deployment job is running without matching durable execution state; reconcile it before another deploy",
|
|
}
|
|
if orphan_running
|
|
else service.run(session, job=job)
|
|
)
|
|
status = str(deployment.get("status") or "error")
|
|
execution_id = str(deployment.get("execution_id") or "")
|
|
if status == "deployed":
|
|
success = True
|
|
message = "WorkMesh v0.1.0 first deployment completed with controller receipt evidence."
|
|
elif status == "in_progress":
|
|
success = False
|
|
message = "WorkMesh v0.1.0 first deployment is still running."
|
|
elif status == "outcome_unknown":
|
|
success = False
|
|
message = str(deployment.get("reason") or "WorkMesh deployment outcome requires reconciliation.")
|
|
else:
|
|
success = False
|
|
message = str(deployment.get("reason") or "WorkMesh v0.1.0 first deployment failed closed.")
|
|
except Exception as exc:
|
|
status = "error"
|
|
execution_id = ""
|
|
success = False
|
|
deployment = {"status": status}
|
|
message = f"{type(exc).__name__}: WorkMesh first-deploy reconciliation failed"
|
|
|
|
if status in {"in_progress", "outcome_unknown"}:
|
|
if job.status not in {"succeeded", "failed", "cancelled"}:
|
|
completed = set_job_progress(
|
|
session,
|
|
job,
|
|
max(job.progress, 90 if status == "outcome_unknown" else 25),
|
|
message,
|
|
)
|
|
else:
|
|
completed = job
|
|
elif job.status in {"succeeded", "failed", "cancelled"}:
|
|
completed = job
|
|
else:
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
|
|
outward_status = (
|
|
status
|
|
if status in {"in_progress", "outcome_unknown"}
|
|
else "success"
|
|
if success
|
|
else "failed"
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-target",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result=outward_status,
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"repository": deployment.get("repository", target),
|
|
"revision": deployment.get("revision"),
|
|
"composeProject": deployment.get("compose_project"),
|
|
"containers": deployment.get("containers"),
|
|
"ports": deployment.get("ports"),
|
|
"executionId": execution_id or None,
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"secretsReturned": False,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": outward_status,
|
|
"result": outward_status,
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
**({"executionId": execution_id} if execution_id else {}),
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
def _execute_portfolio_target_enrollment(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .portfolio_deployment_recovery import PortfolioDeploymentRecovery
|
|
|
|
action = "deployment.target.register_portfolio"
|
|
target = "jens/portfolio"
|
|
steps = [
|
|
"Validate the fixed Portfolio deployment contract",
|
|
"Verify or re-attest the proven live Portfolio web/API pair",
|
|
"Atomically reconcile the paired controller target state",
|
|
"Preserve exact-source deployment provenance",
|
|
]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(session, job, 20, "Validating fixed Portfolio deployment target.")
|
|
try:
|
|
enrollment = PortfolioDeploymentRecovery().run()
|
|
status = str(enrollment.get("status") or "error")
|
|
success = status in {"enrolled", "already-enrolled", "reconciled"}
|
|
message = str(
|
|
enrollment.get("reason")
|
|
or (
|
|
"Portfolio deployment target state verified."
|
|
if success
|
|
else "Portfolio deployment target enrollment failed."
|
|
)
|
|
)
|
|
except Exception as exc:
|
|
success = False
|
|
status = "error"
|
|
message = f"{type(exc).__name__}: Portfolio deployment target enrollment failed"
|
|
enrollment = {"status": status}
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-target",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"repository": enrollment.get("repository"),
|
|
"composeProject": enrollment.get("compose_project"),
|
|
"containers": enrollment.get("containers"),
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else "failed",
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
def _execute_privatemuse_target_enrollment(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .privatemuse_deployment_recovery import PrivateMuseDeploymentRecovery
|
|
|
|
action = "deployment.target.register_privatemuse"
|
|
target = "jens/privatemuse"
|
|
steps = [
|
|
"Validate the fixed PrivateMuse deployment contract",
|
|
"Verify or re-attest the proven live PrivateMuse production trio",
|
|
"Atomically reconcile only the bounded controller receipt state",
|
|
"Preserve immutable images, media, models and exact-source provenance",
|
|
]
|
|
recovery = PrivateMuseDeploymentRecovery()
|
|
candidate_job = prepare_job(
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
tracked, admitted = recovery.admit_job(session, candidate_job)
|
|
tracked_job_id = str(tracked.get("jobId") or "")
|
|
job = session.get(JobRun, tracked_job_id)
|
|
if job is None:
|
|
raise RuntimeError("PrivateMuse recovery owner job is unavailable")
|
|
if admitted:
|
|
start_job(session, job)
|
|
set_job_progress(
|
|
session, job, 20, "Validating fixed PrivateMuse deployment target."
|
|
)
|
|
try:
|
|
enrollment = recovery.run(
|
|
session=session,
|
|
job_id=job.id if admitted else candidate_job.id,
|
|
)
|
|
status = str(enrollment.get("status") or "error")
|
|
success = status in {"enrolled", "already-enrolled", "reconciled"}
|
|
message = str(
|
|
enrollment.get("reason")
|
|
or (
|
|
"PrivateMuse deployment target state verified."
|
|
if success
|
|
else "PrivateMuse deployment target enrollment failed."
|
|
)
|
|
)
|
|
except Exception as exc:
|
|
guarded = recovery.guarded_unknown_result(
|
|
session,
|
|
reason=(
|
|
"PrivateMuse recovery crossed its durable execution boundary but "
|
|
"local result handling failed; reconcile the recorded execution and "
|
|
"do not retry"
|
|
),
|
|
)
|
|
if guarded is not None:
|
|
success = False
|
|
status = "outcome_unknown"
|
|
message = str(guarded["reason"])
|
|
enrollment = guarded
|
|
else:
|
|
success = False
|
|
status = "error"
|
|
message = (
|
|
f"{type(exc).__name__}: PrivateMuse deployment target enrollment failed"
|
|
)
|
|
enrollment = {"status": status}
|
|
|
|
execution_id = str(enrollment.get("execution_id") or "")
|
|
original_job_id = str(enrollment.get("original_job_id") or job.id)
|
|
original_job = session.get(JobRun, original_job_id)
|
|
result_job = original_job or job
|
|
evidence_summary = (
|
|
f"{status}; executionId={execution_id}; {message}"
|
|
if execution_id
|
|
else f"{status}; {message}"
|
|
)
|
|
if status in {"in_progress", "outcome_unknown"}:
|
|
if result_job.status not in {"succeeded", "failed", "cancelled"}:
|
|
completed = set_job_progress(
|
|
session,
|
|
result_job,
|
|
max(result_job.progress, 90 if status == "outcome_unknown" else 5),
|
|
evidence_summary,
|
|
)
|
|
else:
|
|
completed = result_job
|
|
elif result_job.status in {"succeeded", "failed", "cancelled"}:
|
|
completed = result_job
|
|
else:
|
|
completed = complete_job(
|
|
session,
|
|
result_job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=evidence_summary,
|
|
)
|
|
outward_status = (
|
|
status
|
|
if status in {"in_progress", "outcome_unknown"}
|
|
else "success"
|
|
if success
|
|
else "failed"
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-target",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result=outward_status,
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"repository": enrollment.get("repository"),
|
|
"composeProject": enrollment.get("compose_project"),
|
|
"containers": enrollment.get("containers"),
|
|
"executionId": execution_id or None,
|
|
"originalJobId": original_job_id,
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": outward_status,
|
|
"result": outward_status,
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
**({"executionId": execution_id} if execution_id else {}),
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
|
|
def _execute_media_codec_dashboard_reconciliation(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .media_codec_dashboard_deployment_reconciliation import (
|
|
MediaCodecDashboardDeploymentReconciliation,
|
|
)
|
|
|
|
action = "deployment.target.reconcile_media_codec_dashboard"
|
|
target = "jens/media-codec-dashboard"
|
|
steps = [
|
|
"Validate the fixed Media Codec Dashboard deployment contract",
|
|
"Verify the live immutable dashboard runtime",
|
|
"Reconcile only the bounded controller deployment state",
|
|
"Preserve containers, images, mounts and exact-source provenance",
|
|
]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(
|
|
session,
|
|
job,
|
|
20,
|
|
"Validating fixed Media Codec Dashboard deployment state.",
|
|
)
|
|
try:
|
|
reconciliation = MediaCodecDashboardDeploymentReconciliation().run()
|
|
status = str(reconciliation.get("status") or "error")
|
|
success = status == "reconciled"
|
|
message = str(
|
|
reconciliation.get("reason")
|
|
or (
|
|
"Media Codec Dashboard deployment state reconciled."
|
|
if success
|
|
else "Media Codec Dashboard deployment-state reconciliation failed."
|
|
)
|
|
)
|
|
except Exception as exc:
|
|
success = False
|
|
status = "error"
|
|
reconciliation = {"status": status}
|
|
message = (
|
|
f"{type(exc).__name__}: "
|
|
"Media Codec Dashboard deployment-state reconciliation failed"
|
|
)
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-target",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"repository": reconciliation.get("repository"),
|
|
"container": reconciliation.get("container"),
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else "failed",
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
def _execute_privatemuse_webhook_repair(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .privatemuse_webhook_repair import PrivateMuseWebhookRepair
|
|
|
|
action = "deployment.webhook.repair_privatemuse"
|
|
target = "jens/privatemuse"
|
|
steps = [
|
|
"Validate the fixed PrivateMuse runnerless webhook contract",
|
|
"Verify controller-owned webhook secret and Gitea repository identity",
|
|
"Create or repair only the exact PrivateMuse push hook",
|
|
"Re-read the hook and verify active main-only push delivery metadata",
|
|
]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(session, job, 20, "Validating fixed PrivateMuse webhook state.")
|
|
try:
|
|
repair = PrivateMuseWebhookRepair().run()
|
|
status = str(repair.get("status") or "error")
|
|
success = status == "repaired"
|
|
message = str(
|
|
repair.get("reason")
|
|
or (
|
|
"PrivateMuse runnerless webhook verified or repaired."
|
|
if success
|
|
else "PrivateMuse runnerless webhook repair failed."
|
|
)
|
|
)
|
|
except Exception as exc:
|
|
success = False
|
|
status = "error"
|
|
message = f"{type(exc).__name__}: PrivateMuse runnerless webhook repair failed"
|
|
repair = {"status": status}
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-webhook",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"repository": repair.get("repository"),
|
|
"endpoint": repair.get("endpoint"),
|
|
"branch": repair.get("branch"),
|
|
"event": repair.get("event"),
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"secretMaterialReturned": False,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else status,
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
|
|
def _execute_controller_artifact_promote(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .controller_artifact_promoter import (
|
|
ControllerArtifactPromoter,
|
|
helper_failure_diagnostics,
|
|
safe_helper_diagnostics,
|
|
)
|
|
|
|
action = "controller.artifact.promote"
|
|
target = "tower/deployment-controller"
|
|
steps = [
|
|
"Resolve protected current main and successful push validation",
|
|
"Reuse the immutable image of the live deployment controller",
|
|
"Run one fixed ephemeral controller-promoter helper",
|
|
"Execute the existing rollbackable root controller upgrade procedure",
|
|
"Verify the installed controller release identity",
|
|
]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(session, job, 20, "Promoting fixed root deployment-controller artifact.")
|
|
try:
|
|
result = ControllerArtifactPromoter().run()
|
|
status = str(result.get("status") or "error")
|
|
success = status in {"promoted", "already_applied"}
|
|
message = str(
|
|
result.get("reason")
|
|
or (
|
|
"Root deployment-controller artifact verified."
|
|
if success
|
|
else "Root deployment-controller promotion failed."
|
|
)
|
|
)
|
|
except Exception as exc:
|
|
result = {"status": "error"}
|
|
status = "error"
|
|
success = False
|
|
message = f"{type(exc).__name__}: controller artifact promotion failed"
|
|
|
|
diagnostics = None
|
|
if status == "failed" and result.get("reason") == "controller_promoter_helper_failed":
|
|
diagnostics = safe_helper_diagnostics(result.get("diagnostics"))
|
|
if diagnostics is None:
|
|
diagnostics = helper_failure_diagnostics(result.get("exitCode"))
|
|
exit_code = diagnostics["exitCode"]
|
|
exit_code_summary = str(exit_code) if exit_code is not None else "unknown"
|
|
message = (
|
|
f"Controller promotion helper failed: {diagnostics['code']}; "
|
|
f"phase={diagnostics['phase']}; exitCode={exit_code_summary}."
|
|
)
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
after_state = {
|
|
"status": status,
|
|
"revision": result.get("revision"),
|
|
"controllerVersion": result.get("controllerVersion"),
|
|
"artifactSha256": result.get("artifactSha256"),
|
|
}
|
|
redacted_metadata = {
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"callerRevisionSelectable": False,
|
|
"callerCommandSelectable": False,
|
|
"callerMountSelectable": False,
|
|
"helperTargetSelectable": False,
|
|
}
|
|
if diagnostics is not None:
|
|
after_state["diagnostics"] = diagnostics
|
|
redacted_metadata["diagnostics"] = diagnostics
|
|
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="deployment-controller",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state=after_state,
|
|
redacted_metadata=redacted_metadata,
|
|
)
|
|
operation_result = {
|
|
"success": success,
|
|
"status": "success" if success else status,
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"revision": result.get("revision"),
|
|
"controllerVersion": result.get("controllerVersion"),
|
|
"artifactSha256": result.get("artifactSha256"),
|
|
}
|
|
if diagnostics is not None:
|
|
operation_result["diagnostics"] = diagnostics
|
|
return operation_result
|
|
|
|
|
|
def _execute_runner_fleet_upgrade_v2(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
specialized: bool = False,
|
|
statistics_configuration: bool = False,
|
|
) -> dict[str, Any]:
|
|
from .deployment_broker import DeploymentBrokerClient
|
|
|
|
action = ("runner.statistics.configure" if statistics_configuration else
|
|
"runner.fleet.specialize" if specialized else "runner.fleet.upgrade_v2")
|
|
target = ("tower/projectbrain-runner-statistics" if statistics_configuration else
|
|
"tower/runner-fleet-specialized" if specialized else "tower/runner-fleet-v2")
|
|
steps = [
|
|
"Validate exact fixed runner-fleet target",
|
|
"Call HMAC-signed root controller endpoint",
|
|
"Prove protected main and successful push validation",
|
|
"Execute exact-revision specialized migration script" if specialized
|
|
else "Execute exact-revision fleet-v2 migration script",
|
|
"Verify specialized runner topology",
|
|
]
|
|
if statistics_configuration:
|
|
steps = ["Verify fixed read-only statistics target", "Prove protected controller/runtime source",
|
|
"Lock production configuration", "Provision private independent credential with durable CAS",
|
|
"Configure ProjectBrain for its governed delivery"]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(session, job, 25, f"Requesting {action} through the fixed controller endpoint.")
|
|
try:
|
|
broker = DeploymentBrokerClient()
|
|
result = (broker.runner_statistics_configure(reason=reason) if statistics_configuration else
|
|
broker.runner_fleet_specialize(reason=reason) if specialized else broker.runner_fleet_upgrade_v2(reason=reason))
|
|
status = str(result.get("status") or "error")
|
|
success = status in ({"configured", "already_configured"} if statistics_configuration else
|
|
{"specialized", "already_applied"} if specialized else {"upgraded", "already_applied"})
|
|
message = str(
|
|
result.get("reason")
|
|
or (
|
|
("ProjectBrain read-only statistics configuration verified." if statistics_configuration else
|
|
"Tower runner specialization verified." if specialized
|
|
else "Tower runner-fleet v2 migration verified.")
|
|
if success else
|
|
("ProjectBrain statistics configuration was rejected or failed." if statistics_configuration else
|
|
"Tower runner specialization was rejected or failed." if specialized
|
|
else "Tower runner-fleet v2 migration was rejected or failed.")
|
|
)
|
|
)
|
|
except Exception as exc:
|
|
result = {"status": "error"}
|
|
status = "error"
|
|
success = False
|
|
message = f"{type(exc).__name__}: fixed controller operation failed"
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="runner-fleet",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"revision": result.get("revision"),
|
|
"verifiedRunners": result.get("verifiedRunners"),
|
|
"projectbrainDeliveryRequired": result.get("projectbrainDeliveryRequired"),
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"scriptPathCallerSelectable": False,
|
|
"runnerTargetCallerSelectable": False,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else status,
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"controllerStatus": status,
|
|
"revision": result.get("revision"),
|
|
"verifiedRunners": result.get("verifiedRunners"),
|
|
"projectbrainDeliveryRequired": result.get("projectbrainDeliveryRequired"),
|
|
}
|
|
|
|
|
|
def _execute_hub_migration_prepare_permissions(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
from .deployment_broker import DeploymentBrokerClient
|
|
|
|
action = "hub.migration.prepare_permissions"
|
|
target = "tower/itworx-mcp-hub-permissions"
|
|
state_file = "/mnt/cache/appdata/gitea-deploy-runners/state/itworx-mcp-hub.json"
|
|
fixed_targets = {state_file}
|
|
steps = [
|
|
"Validate the exact fixed MCP Hub permission target",
|
|
"Authenticate the fixed root-controller request with HMAC and replay protection",
|
|
"Verify the running controller is the protected current main release with full-push validation",
|
|
"Reinspect the fixed Hub state file and shared deployment lock",
|
|
"Apply only the fixed state-file mode correction and verify its final metadata",
|
|
]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(session, job, 25, "Requesting fixed MCP Hub permission preparation through the controller.")
|
|
try:
|
|
result = DeploymentBrokerClient().hub_migration_prepare_permissions(reason=reason)
|
|
status = str(result.get("status") or "blocked")
|
|
revision_value = result.get("revision")
|
|
revision = (
|
|
revision_value
|
|
if isinstance(revision_value, str)
|
|
and len(revision_value) == 40
|
|
and all(character in "0123456789abcdef" for character in revision_value)
|
|
else None
|
|
)
|
|
|
|
changed_value = result.get("changedTargets", [])
|
|
changed_targets = (
|
|
changed_value
|
|
if isinstance(changed_value, list)
|
|
and all(isinstance(path, str) and path in fixed_targets for path in changed_value)
|
|
and len(changed_value) == len(set(changed_value))
|
|
else None
|
|
)
|
|
changed_details_value = result.get("changedTargetDetails", [])
|
|
target_names = {
|
|
state_file: "state_file",
|
|
}
|
|
changed_details = (
|
|
changed_details_value
|
|
if isinstance(changed_details_value, list)
|
|
and all(
|
|
isinstance(item, dict)
|
|
and set(item) == {"name", "path", "observedMode", "sameIdentityAtPath"}
|
|
and isinstance(item.get("path"), str)
|
|
and item.get("path") in fixed_targets
|
|
and item.get("name") == target_names.get(item.get("path"))
|
|
and isinstance(item.get("observedMode"), str)
|
|
and len(item["observedMode"]) == 4
|
|
and item["observedMode"].startswith("0")
|
|
and all(character in "01234567" for character in item["observedMode"])
|
|
and isinstance(item.get("sameIdentityAtPath"), bool)
|
|
and changed_targets is not None
|
|
and item["path"] in changed_targets
|
|
for item in changed_details_value
|
|
)
|
|
and len({item["path"] for item in changed_details_value}) == len(changed_details_value)
|
|
else None
|
|
)
|
|
uncertain_value = result.get("uncertainTargets", [])
|
|
uncertain_targets = (
|
|
uncertain_value
|
|
if isinstance(uncertain_value, list)
|
|
and all(isinstance(path, str) and path in fixed_targets for path in uncertain_value)
|
|
and len(uncertain_value) == len(set(uncertain_value))
|
|
else None
|
|
)
|
|
expected_verified = {
|
|
"state_file": {
|
|
"path": state_file,
|
|
"uid": 0,
|
|
"gid": 0,
|
|
"mode": "0600",
|
|
"aclPresent": False,
|
|
},
|
|
}
|
|
verified_value = result.get("verifiedTargets")
|
|
verified_targets = None
|
|
if isinstance(verified_value, list) and len(verified_value) == len(expected_verified):
|
|
by_name = {
|
|
item.get("name"): item
|
|
for item in verified_value
|
|
if isinstance(item, dict) and isinstance(item.get("name"), str)
|
|
}
|
|
if set(by_name) == set(expected_verified) and all(
|
|
all(by_name[name].get(key) == value for key, value in expected.items())
|
|
for name, expected in expected_verified.items()
|
|
):
|
|
verified_targets = [
|
|
{"name": name, **expected_verified[name]}
|
|
for name in ("state_file",)
|
|
]
|
|
|
|
has_controller_projection = all(
|
|
key in result
|
|
for key in (
|
|
"revision",
|
|
"changedTargets",
|
|
"changedTargetDetails",
|
|
"uncertainTargets",
|
|
)
|
|
)
|
|
success = (
|
|
status in {"prepared", "already_compliant"}
|
|
and has_controller_projection
|
|
and revision is not None
|
|
and changed_targets is not None
|
|
and changed_details is not None
|
|
and uncertain_targets == []
|
|
and verified_targets is not None
|
|
and (bool(changed_targets) if status == "prepared" else not changed_targets)
|
|
)
|
|
if success:
|
|
message = (
|
|
"The fixed MCP Hub state-file permission was prepared and verified."
|
|
if status == "prepared"
|
|
else "The fixed MCP Hub state-file permission was already compliant and verified."
|
|
)
|
|
elif (
|
|
status == "partial"
|
|
and has_controller_projection
|
|
and revision is not None
|
|
and changed_targets is not None
|
|
and changed_details is not None
|
|
and uncertain_targets is not None
|
|
and (changed_targets or uncertain_targets)
|
|
and len(changed_details) == len(changed_targets)
|
|
and {item["path"] for item in changed_details} == set(changed_targets)
|
|
):
|
|
message = "Permission preparation stopped partway; inspect the exact changed and uncertain fixed targets before retrying."
|
|
elif (
|
|
status in {
|
|
"blocked",
|
|
"unauthorized",
|
|
"missing_config",
|
|
"missing_secret",
|
|
"runtime_identity_unavailable",
|
|
"controller_source_mismatch",
|
|
"preflight_rejected",
|
|
"configuration_unavailable",
|
|
"exact_source_unavailable",
|
|
"invalid_request",
|
|
"invalid_body_size",
|
|
"authentication_rejected",
|
|
"forbidden",
|
|
}
|
|
and changed_targets == []
|
|
and changed_details == []
|
|
and uncertain_targets == []
|
|
):
|
|
status = "blocked"
|
|
message = "The fixed MCP Hub permission request was rejected before any target change."
|
|
else:
|
|
status = "outcome_unknown"
|
|
changed_targets = []
|
|
changed_details = []
|
|
uncertain_targets = sorted(fixed_targets)
|
|
verified_targets = None
|
|
message = (
|
|
"The controller request outcome is unknown; the fixed Hub state file may have changed. "
|
|
"Inspect it before retrying."
|
|
)
|
|
except Exception:
|
|
result = {"status": "outcome_unknown"}
|
|
status = "outcome_unknown"
|
|
revision = None
|
|
changed_targets = []
|
|
changed_details = []
|
|
uncertain_targets = sorted(fixed_targets)
|
|
verified_targets = None
|
|
success = False
|
|
message = (
|
|
"The controller request outcome is unknown; the fixed Hub state file may have changed. "
|
|
"Inspect it before retrying."
|
|
)
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="mcp-hub-permissions",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "outcome_unknown" if status == "outcome_unknown" else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"revision": revision,
|
|
"changedTargets": changed_targets,
|
|
"changedTargetDetails": changed_details,
|
|
"uncertainTargets": uncertain_targets,
|
|
"verifiedTargets": verified_targets,
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"targetSelectionCallerSelectable": False,
|
|
"pathOrCommandCallerSelectable": False,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else status,
|
|
"result": "success" if success else "outcome_unknown" if status == "outcome_unknown" else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"controllerStatus": status,
|
|
"revision": revision,
|
|
"changedTargets": changed_targets,
|
|
"changedTargetDetails": changed_details,
|
|
"uncertainTargets": uncertain_targets,
|
|
"verifiedTargets": verified_targets,
|
|
}
|
|
|
|
|
|
def _approved_connector_call(action: str) -> tuple[Callable[[], dict[str, Any]], str]:
|
|
if action == "deluge.pause_all":
|
|
return lambda: DelugeConnector().pause_all(), "all_torrents_paused"
|
|
if action == "deluge.resume_all":
|
|
return lambda: DelugeConnector().resume_all(), "all_torrents_resumed"
|
|
if action == "plex.scan_all_libraries":
|
|
return lambda: PlexConnector().scan_all_libraries(), "scan_all_started"
|
|
raise ValueError("No approved executor is registered for this action.")
|
|
|
|
|
|
def execute_governed_action(
|
|
session: Session,
|
|
*,
|
|
action: str,
|
|
target: str,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
"""Execute a typed action after the trusted MCP boundary has evaluated policy.
|
|
|
|
This path deliberately does not create or consume an Approval row. It is used by
|
|
authenticated MCP automation in no-human-approval mode. The central policy still
|
|
fails closed for ``blocked`` actions before this function is called, and only the
|
|
small allowlist of typed rollback/post-check capable executors below is reachable.
|
|
"""
|
|
|
|
if not mcp_execution_supported(action):
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "unsupported",
|
|
"message": "No typed MCP executor is registered for this action.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
if action == "controller.artifact.promote":
|
|
if target.strip().lower() != "tower/deployment-controller":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "Controller artifact promotion accepts only tower/deployment-controller.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
return _execute_controller_artifact_promote(
|
|
session,
|
|
source=source,
|
|
risk=risk,
|
|
reason=reason,
|
|
original_policy_decision=original_policy_decision,
|
|
)
|
|
|
|
if action == "controller.managed-storage.initialize":
|
|
if target != "tower/deployment-controller":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "Managed storage initialization accepts only tower/deployment-controller.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
return _execute_managed_appdata_initialize(
|
|
session,
|
|
source=source,
|
|
risk=risk,
|
|
reason=reason,
|
|
original_policy_decision=original_policy_decision,
|
|
)
|
|
|
|
if action == "hub.migration.prepare_permissions":
|
|
if target.strip().lower() != "tower/itworx-mcp-hub-permissions":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "MCP Hub permission preparation accepts only tower/itworx-mcp-hub-permissions.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
return _execute_hub_migration_prepare_permissions(
|
|
session,
|
|
source=source,
|
|
risk=risk,
|
|
reason=reason,
|
|
original_policy_decision=original_policy_decision,
|
|
)
|
|
|
|
if action == "runner.fleet.upgrade_v2":
|
|
if target.strip().lower() != "tower/runner-fleet-v2":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "Runner fleet v2 upgrade accepts only tower/runner-fleet-v2.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
return _execute_runner_fleet_upgrade_v2(
|
|
session,
|
|
source=source,
|
|
risk=risk,
|
|
reason=reason,
|
|
original_policy_decision=original_policy_decision,
|
|
)
|
|
|
|
if action == "runner.statistics.configure":
|
|
if target.strip().lower() != "tower/projectbrain-runner-statistics":
|
|
return {"success": False, "status": "failed", "result": "blocked",
|
|
"message": "Statistics configuration accepts only tower/projectbrain-runner-statistics.",
|
|
"policyDecision": "blocked", "originalPolicyDecision": original_policy_decision}
|
|
return _execute_runner_fleet_upgrade_v2(
|
|
session, source=source, risk=risk, reason=reason,
|
|
original_policy_decision=original_policy_decision, statistics_configuration=True,
|
|
)
|
|
|
|
if action == "runner.fleet.specialize":
|
|
if target.strip().lower() != "tower/runner-fleet-specialized":
|
|
return {
|
|
"success": False, "status": "failed", "result": "blocked",
|
|
"message": "Runner specialization accepts only tower/runner-fleet-specialized.",
|
|
"policyDecision": "blocked", "originalPolicyDecision": original_policy_decision,
|
|
}
|
|
return _execute_runner_fleet_upgrade_v2(
|
|
session, source=source, risk=risk, reason=reason,
|
|
original_policy_decision=original_policy_decision, specialized=True,
|
|
)
|
|
|
|
if action == "deployment.runnerless.provision":
|
|
return _execute_runnerless_target_provisioning(
|
|
session,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
reason=reason,
|
|
original_policy_decision=original_policy_decision,
|
|
)
|
|
|
|
if action == "deployment.target.deploy_workmesh":
|
|
if target.strip().lower() != "jens/workmesh":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "WorkMesh first deploy accepts only the fixed jens/workmesh target.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
return _execute_workmesh_first_deployment(
|
|
session,
|
|
source=source,
|
|
risk=risk,
|
|
reason=reason,
|
|
original_policy_decision=original_policy_decision,
|
|
)
|
|
|
|
if action == "deployment.target.promote_workmesh":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "approval_required",
|
|
"message": (
|
|
"WorkMesh promotion requires the exact-revision preflight and human approval flow."
|
|
),
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
if action == "deployment.targets.sync":
|
|
if target.strip().lower() != "jens/*":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "Deployment target sync accepts only the fixed jens/* catalog target.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
return _execute_deployment_target_sync(
|
|
session,
|
|
source=source,
|
|
risk=risk,
|
|
reason=reason,
|
|
original_policy_decision=original_policy_decision,
|
|
)
|
|
|
|
if action in {"unraid.vm.start", "unraid.vm.resume", "unraid.vm.pause"}:
|
|
from .unraid_vm_service import VM_ACTIONS, execute_vm_action
|
|
|
|
vm_action = next(
|
|
(
|
|
name
|
|
for name, definition in VM_ACTIONS.items()
|
|
if definition["action_id"] == action
|
|
),
|
|
None,
|
|
)
|
|
if vm_action not in {"start", "resume", "pause"}:
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "unsupported",
|
|
"message": "No safe VM executor is registered for this action.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
result = execute_vm_action(
|
|
session,
|
|
vm_id=target,
|
|
action=vm_action,
|
|
source=source,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
)
|
|
return {
|
|
**result,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
if action == "deployment.target.register_portfolio":
|
|
if target.strip().lower() != "jens/portfolio":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "Portfolio target registration accepts only jens/portfolio.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
return _execute_portfolio_target_enrollment(
|
|
session,
|
|
source=source,
|
|
risk=risk,
|
|
reason=reason,
|
|
original_policy_decision=original_policy_decision,
|
|
)
|
|
if action == "deployment.target.register_privatemuse":
|
|
if target.strip().lower() != "jens/privatemuse":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "PrivateMuse target registration accepts only jens/privatemuse.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
return _execute_privatemuse_target_enrollment(
|
|
session,
|
|
source=source,
|
|
risk=risk,
|
|
reason=reason,
|
|
original_policy_decision=original_policy_decision,
|
|
)
|
|
if action == "deployment.target.reconcile_media_codec_dashboard":
|
|
if target.strip().lower() != "jens/media-codec-dashboard":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": (
|
|
"Media Codec Dashboard reconciliation accepts only "
|
|
"jens/media-codec-dashboard."
|
|
),
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
return _execute_media_codec_dashboard_reconciliation(
|
|
session,
|
|
source=source,
|
|
risk=risk,
|
|
reason=reason,
|
|
original_policy_decision=original_policy_decision,
|
|
)
|
|
if action == "deployment.webhook.repair_privatemuse":
|
|
if target.strip().lower() != "jens/privatemuse":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "PrivateMuse webhook repair accepts only jens/privatemuse.",
|
|
"policyDecision": "blocked",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
return _execute_privatemuse_webhook_repair(
|
|
session,
|
|
source=source,
|
|
risk=risk,
|
|
reason=reason,
|
|
original_policy_decision=original_policy_decision,
|
|
)
|
|
if action == "container.restart":
|
|
from .container_restart_service import execute_container_restart
|
|
|
|
result = execute_container_restart(
|
|
session=session,
|
|
action=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
steps=[
|
|
"Validate MCP policy",
|
|
"Resolve container",
|
|
"Restart container",
|
|
"Post-check health",
|
|
],
|
|
policy_override={
|
|
"decision": "allowed",
|
|
"reason": reason,
|
|
"risk": risk,
|
|
},
|
|
)
|
|
return {
|
|
**result,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
apply_stored_connector_settings(session)
|
|
connector_call, default_message = _approved_connector_call(action)
|
|
steps = _DIRECT_STEPS[action]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(session, job, 35, "MCP policy authorized; calling typed connector.")
|
|
|
|
try:
|
|
connector_result = connector_call()
|
|
success = bool(connector_result.get("success"))
|
|
message = str(
|
|
connector_result.get("message")
|
|
or (default_message if success else "connector_action_failed")
|
|
)
|
|
except Exception as exc: # Connector errors must become an audited failed job.
|
|
success = False
|
|
message = f"{type(exc).__name__}: connector action failed"
|
|
connector_result = {"status": "error"}
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="approval",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={"status": connector_result.get("status"), "message": message},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"integration": "mcp",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else "failed",
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
def _execute_managed_appdata_initialize(
|
|
session: Session,
|
|
*,
|
|
source: str,
|
|
risk: str,
|
|
reason: str,
|
|
original_policy_decision: str,
|
|
) -> dict[str, Any]:
|
|
"""Initialize only the fixed storage marker after trust and policy opt-in."""
|
|
from .deployment_broker import DeploymentBrokerClient
|
|
from .enrollment_plane import EnrollmentPlane
|
|
from .secret_store import get_secret
|
|
|
|
action = "controller.managed-storage.initialize"
|
|
target = "tower/deployment-controller"
|
|
trust = EnrollmentPlane.get_trust_config(session)
|
|
if (
|
|
trust is None
|
|
or trust.trusted_appdata_root != "/var/lib/docker/volumes/itworx-managed-appdata/_data"
|
|
or trust.managed_appdata_backup_acknowledged is not True
|
|
):
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="controller",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason="Managed Docker-root storage requires an explicit trusted selector and backup acknowledgement.",
|
|
result="blocked",
|
|
redacted_metadata={"executor": action, "trustOptIn": False},
|
|
)
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "Managed storage is not explicitly selected and acknowledged in enrollment trust.",
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
bootstrap_secret = get_secret(session, trust.bootstrap_secret_ref, touch=False)
|
|
if not bootstrap_secret:
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="controller",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason="Controller bootstrap capability is unavailable by its configured reference.",
|
|
result="failed",
|
|
redacted_metadata={"executor": action, "secretMaterialReturned": False},
|
|
)
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "failed",
|
|
"message": "Controller bootstrap capability is unavailable.",
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
steps = [
|
|
"Verify the exact target, trust selector and backup acknowledgement",
|
|
"Authenticate the fixed controller request with bootstrap HMAC and replay protection",
|
|
"Validate the protected controller, target registry, repository root and fixed Docker volume",
|
|
"Initialize the selector only if the managed Docker volume is empty and unchanged",
|
|
"Re-read the fixed selector and record sanitized controller readiness",
|
|
]
|
|
job = create_job(
|
|
session,
|
|
action_id=action,
|
|
target=target,
|
|
source=source,
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(session, job, 20, "Validating fixed managed-storage initialization prerequisites.")
|
|
try:
|
|
result = DeploymentBrokerClient().initialize_managed_appdata(secret=bootstrap_secret)
|
|
reported_status = result.get("status")
|
|
status = (
|
|
reported_status
|
|
if isinstance(reported_status, str)
|
|
and reported_status in {"initialized", "already_initialized"}
|
|
else "refused"
|
|
)
|
|
success = (
|
|
status in {"initialized", "already_initialized"}
|
|
and result.get("trustedAppdataRoot") == trust.trusted_appdata_root
|
|
and result.get("backupLocation") == "dockerRootDir"
|
|
)
|
|
message = (
|
|
"Managed storage selector initialized and verified."
|
|
if success
|
|
else "Managed storage initialization was refused or unavailable."
|
|
)
|
|
except Exception:
|
|
result = {"status": "error"}
|
|
status = "error"
|
|
success = False
|
|
message = "Managed storage initialization was refused or unavailable."
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="action",
|
|
identity=source,
|
|
action_id=action,
|
|
target=target,
|
|
target_type="controller",
|
|
risk=risk,
|
|
policy_decision="allowed",
|
|
reason=reason,
|
|
result="success" if success else "failed",
|
|
execution_plan={"steps": steps, "jobId": completed.id},
|
|
after_state={
|
|
"status": status,
|
|
"trustedAppdataRoot": trust.trusted_appdata_root if success else None,
|
|
"backupLocation": "dockerRootDir" if success else None,
|
|
},
|
|
redacted_metadata={
|
|
"executor": action,
|
|
"target": target,
|
|
"integration": "mcp" if source == "chatgpt-mcp" else "operator",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
"secretMaterialReturned": False,
|
|
},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else "failed",
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
"policyDecision": "allowed",
|
|
"originalPolicyDecision": original_policy_decision,
|
|
}
|
|
|
|
|
|
def execute_approved_action(session: Session, approval: Approval) -> dict[str, Any]:
|
|
if not approval_execution_supported(approval.action):
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "unsupported",
|
|
"message": "Deze goedgekeurde actie heeft nog geen rollback-veilige executor.",
|
|
}
|
|
|
|
if approval.action == "controller.artifact.promote":
|
|
if approval.target.strip().lower() != "tower/deployment-controller":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "Controller artifact promotion accepts only tower/deployment-controller.",
|
|
}
|
|
return _execute_controller_artifact_promote(
|
|
session,
|
|
source="approved_operator",
|
|
risk=approval.risk,
|
|
reason=approval.reason or f"Approved through {approval.id}.",
|
|
original_policy_decision="approval_required",
|
|
)
|
|
|
|
if approval.action == "deployment.runnerless.provision":
|
|
return _execute_runnerless_target_provisioning(
|
|
session,
|
|
target=approval.target,
|
|
source="approved_operator",
|
|
risk=approval.risk,
|
|
reason=approval.reason or f"Approved through {approval.id}.",
|
|
original_policy_decision="approval_required",
|
|
)
|
|
|
|
if approval.action == "runner.fleet.upgrade_v2":
|
|
if approval.target.strip().lower() != "tower/runner-fleet-v2":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "Runner fleet v2 upgrade accepts only tower/runner-fleet-v2.",
|
|
}
|
|
return _execute_runner_fleet_upgrade_v2(
|
|
session,
|
|
source="approved_operator",
|
|
risk=approval.risk,
|
|
reason=approval.reason or f"Approved through {approval.id}.",
|
|
original_policy_decision="approval_required",
|
|
)
|
|
|
|
if approval.action == "runner.statistics.configure":
|
|
if approval.target.strip().lower() != "tower/projectbrain-runner-statistics":
|
|
return {"success": False, "status": "failed", "result": "blocked",
|
|
"message": "Statistics configuration accepts only tower/projectbrain-runner-statistics."}
|
|
return _execute_runner_fleet_upgrade_v2(
|
|
session, source="approved_operator", risk=approval.risk,
|
|
reason=approval.reason or f"Approved through {approval.id}.",
|
|
original_policy_decision="approval_required", statistics_configuration=True,
|
|
)
|
|
|
|
if approval.action == "runner.fleet.specialize":
|
|
if approval.target.strip().lower() != "tower/runner-fleet-specialized":
|
|
return {
|
|
"success": False, "status": "failed", "result": "blocked",
|
|
"message": "Runner specialization accepts only tower/runner-fleet-specialized.",
|
|
}
|
|
return _execute_runner_fleet_upgrade_v2(
|
|
session, source="approved_operator", risk=approval.risk,
|
|
reason=approval.reason or f"Approved through {approval.id}.",
|
|
original_policy_decision="approval_required", specialized=True,
|
|
)
|
|
|
|
if approval.action == "hub.migration.prepare_permissions":
|
|
if approval.target.strip().lower() != "tower/itworx-mcp-hub-permissions":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "MCP Hub permission preparation accepts only tower/itworx-mcp-hub-permissions.",
|
|
}
|
|
return _execute_hub_migration_prepare_permissions(
|
|
session,
|
|
source="approved_operator",
|
|
risk=approval.risk,
|
|
reason=approval.reason or f"Approved through {approval.id}.",
|
|
original_policy_decision="approval_required",
|
|
)
|
|
|
|
if approval.action in {"unraid.vm.start", "unraid.vm.resume", "unraid.vm.pause"}:
|
|
from .unraid_vm_service import execute_approved_vm_action
|
|
|
|
return execute_approved_vm_action(session, approval)
|
|
|
|
if approval.action == "deployment.target.promote_workmesh":
|
|
from .workmesh_promotion import WorkMeshPromotionService
|
|
|
|
return WorkMeshPromotionService().execute_approved(session, approval)
|
|
|
|
if approval.action == "deployment.target.register_portfolio":
|
|
if approval.target.strip().lower() != "jens/portfolio":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "Portfolio target registration accepts only jens/portfolio.",
|
|
}
|
|
return _execute_portfolio_target_enrollment(
|
|
session,
|
|
source="approved_operator",
|
|
risk=approval.risk,
|
|
reason=approval.reason or f"Approved through {approval.id}.",
|
|
original_policy_decision="approval_required",
|
|
)
|
|
if approval.action == "deployment.target.register_privatemuse":
|
|
if approval.target.strip().lower() != "jens/privatemuse":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "PrivateMuse target registration accepts only jens/privatemuse.",
|
|
}
|
|
return _execute_privatemuse_target_enrollment(
|
|
session,
|
|
source="approved_operator",
|
|
risk=approval.risk,
|
|
reason=approval.reason or f"Approved through {approval.id}.",
|
|
original_policy_decision="approval_required",
|
|
)
|
|
if approval.action == "deployment.target.reconcile_media_codec_dashboard":
|
|
if approval.target.strip().lower() != "jens/media-codec-dashboard":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": (
|
|
"Media Codec Dashboard reconciliation accepts only "
|
|
"jens/media-codec-dashboard."
|
|
),
|
|
}
|
|
return _execute_media_codec_dashboard_reconciliation(
|
|
session,
|
|
source="approved_operator",
|
|
risk=approval.risk,
|
|
reason=approval.reason or f"Approved through {approval.id}.",
|
|
original_policy_decision="approval_required",
|
|
)
|
|
if approval.action == "deployment.webhook.repair_privatemuse":
|
|
if approval.target.strip().lower() != "jens/privatemuse":
|
|
return {
|
|
"success": False,
|
|
"status": "failed",
|
|
"result": "blocked",
|
|
"message": "PrivateMuse webhook repair accepts only jens/privatemuse.",
|
|
}
|
|
return _execute_privatemuse_webhook_repair(
|
|
session,
|
|
source="approved_operator",
|
|
risk=approval.risk,
|
|
reason=approval.reason or f"Approved through {approval.id}.",
|
|
original_policy_decision="approval_required",
|
|
)
|
|
if approval.action == "container.restart":
|
|
from .container_restart_service import execute_container_restart
|
|
|
|
return execute_container_restart(
|
|
session=session,
|
|
action=approval.action,
|
|
target=approval.target,
|
|
source="approved_operator",
|
|
risk=approval.risk,
|
|
steps=[
|
|
"Load approved request",
|
|
"Resolve container",
|
|
"Restart container",
|
|
"Post-check health",
|
|
],
|
|
approved=True,
|
|
)
|
|
|
|
apply_stored_connector_settings(session)
|
|
connector_call, default_message = _approved_connector_call(approval.action)
|
|
steps = _APPROVAL_STEPS[approval.action]
|
|
job = create_job(
|
|
session,
|
|
action_id=approval.action,
|
|
target=approval.target,
|
|
source="approved_operator",
|
|
risk=approval.risk,
|
|
policy_decision="approval_required",
|
|
steps=steps,
|
|
)
|
|
start_job(session, job)
|
|
set_job_progress(
|
|
session, job, 35, f"Approval {approval.id} validated; calling connector."
|
|
)
|
|
|
|
try:
|
|
connector_result = connector_call()
|
|
success = bool(connector_result.get("success"))
|
|
message = str(
|
|
connector_result.get("message")
|
|
or (default_message if success else "connector_action_failed")
|
|
)
|
|
except Exception as exc: # Connector errors must become an audited failed job.
|
|
success = False
|
|
message = f"{type(exc).__name__}: connector action failed"
|
|
connector_result = {"status": "error"}
|
|
|
|
completed = complete_job(
|
|
session,
|
|
job,
|
|
status="succeeded" if success else "failed",
|
|
result_summary=message,
|
|
)
|
|
audit = log_event(
|
|
session,
|
|
source="approval",
|
|
identity="operator",
|
|
action_id=approval.action,
|
|
target=approval.target,
|
|
target_type="approval",
|
|
risk=approval.risk,
|
|
policy_decision="approval_required",
|
|
reason=approval.reason or f"Approved through {approval.id}.",
|
|
result="success" if success else "failed",
|
|
execution_plan={
|
|
"steps": steps,
|
|
"approvalId": approval.id,
|
|
"jobId": completed.id,
|
|
},
|
|
after_state={"status": connector_result.get("status"), "message": message},
|
|
redacted_metadata={"approvalId": approval.id, "executor": approval.action},
|
|
)
|
|
return {
|
|
"success": success,
|
|
"status": "success" if success else "failed",
|
|
"result": "success" if success else "failed",
|
|
"message": message,
|
|
"jobId": completed.id,
|
|
"auditId": audit.id,
|
|
}
|