mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-21 18:08:20 +08:00
feat(ql3): rehearse reviewed automation rollback
This commit is contained in:
whyour
@@ -0,0 +1,479 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -eu
|
||||
|
||||
OPERATOR_IMAGE='@@OPERATOR_IMAGE@@'
|
||||
OPERATOR_ID='@@OPERATOR_ID@@'
|
||||
ARCHITECTURE='@@ARCHITECTURE@@'
|
||||
SOURCE_REVISION='@@SOURCE_REVISION@@'
|
||||
ARCHIVE='@@ARCHIVE@@'
|
||||
VARIANT='@@VARIANT@@'
|
||||
|
||||
PLAN_ID='019f8680-143d-4000-8000-000000000201'
|
||||
REVIEW_ID='019f8680-143d-4000-8000-000000000301'
|
||||
APPLICATION_ID='019f8680-143d-4000-8000-000000000401'
|
||||
AUTOMATION_ID='019f8680-143d-4000-8000-000000000461'
|
||||
AUTOMATION_DECISION_ID='019f8680-143d-7000-8000-000000000471'
|
||||
AUTOMATION_MUTATION_ID='019f8680-143d-4000-8000-000000000481'
|
||||
|
||||
fail() {
|
||||
printf '%s\n' "QingLong Local Alpha reconciliation rehearsal failed: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
phase() {
|
||||
printf '%s\n' "QingLong Local Alpha reconciliation phase: $1" >&2
|
||||
}
|
||||
|
||||
usage() {
|
||||
printf '%s\n' \
|
||||
'usage: sh reconciliation-rehearsal.sh prepare edge|standalone /absolute/rehearsal-root /absolute/capture-root /absolute/new/reconciliation-root <legacy-timezone|none>' \
|
||||
' sh reconciliation-rehearsal.sh review edge|standalone /absolute/rehearsal-root /absolute/capture-root /absolute/reconciliation-root /absolute/review-decisions.ndjson' \
|
||||
' sh reconciliation-rehearsal.sh apply-rollback edge|standalone /absolute/rehearsal-root /absolute/capture-root /absolute/reconciliation-root /absolute/automation-decisions.ndjson /absolute/legacy-root' >&2
|
||||
exit 2
|
||||
}
|
||||
|
||||
safe_absolute_path() {
|
||||
case "$1" in
|
||||
/|*[!A-Za-z0-9_./@-]*|*'/../'*|*'/./'*|*'/..'|*'/.'|*'//'*|*/)
|
||||
return 1
|
||||
;;
|
||||
/*) return 0 ;;
|
||||
*) return 1 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
valid_digest() {
|
||||
[ "${#1}" -eq 64 ] || return 1
|
||||
case "$1" in *[!0-9a-f]*) return 1 ;; *) return 0 ;; esac
|
||||
}
|
||||
|
||||
extract_digest() {
|
||||
result_file=$1
|
||||
field=$2
|
||||
value=$(sed -n "s/^.*\"$field\":\"\([0-9a-f][0-9a-f]*\)\".*$/\1/p" "$result_file")
|
||||
valid_digest "$value" || fail "$field is missing or invalid in $result_file"
|
||||
printf '%s' "$value"
|
||||
}
|
||||
|
||||
extract_unsigned() {
|
||||
result_file=$1
|
||||
field=$2
|
||||
value=$(sed -n "s/^.*\"$field\":\([0-9][0-9]*\).*$/\1/p" "$result_file")
|
||||
case "$value" in ''|*[!0-9]*) fail "$field is missing or invalid in $result_file" ;; esac
|
||||
printf '%s' "$value"
|
||||
}
|
||||
|
||||
extract_capture_id() {
|
||||
result_file=$1
|
||||
value=$(sed -n 's/^.*"captureId":"\([0-9a-f-][0-9a-f-]*\)".*$/\1/p' "$result_file")
|
||||
case "$value" in
|
||||
????????-????-4???-[89ab]???-????????????) printf '%s' "$value" ;;
|
||||
*) fail "captureId is missing or invalid in $result_file" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
non_overlapping() {
|
||||
left=$1
|
||||
right=$2
|
||||
[ "$left" != "$right" ] || return 1
|
||||
case "$left/" in "$right"/*) return 1 ;; esac
|
||||
case "$right/" in "$left"/*) return 1 ;; esac
|
||||
return 0
|
||||
}
|
||||
|
||||
canonical_directory() {
|
||||
selected=$1
|
||||
label=$2
|
||||
safe_absolute_path "$selected" || fail "$label is not a safe canonical absolute path"
|
||||
[ -d "$selected" ] || fail "$label does not exist"
|
||||
[ ! -L "$selected" ] || fail "$label must not be a symbolic link"
|
||||
[ "$(realpath "$selected")" = "$selected" ] || fail "$label is not canonical"
|
||||
}
|
||||
|
||||
private_decision_file() {
|
||||
decision_file=$1
|
||||
decision_label=$2
|
||||
safe_absolute_path "$decision_file" || fail "$decision_label is not a safe canonical absolute path"
|
||||
[ -f "$decision_file" ] || fail "$decision_label does not exist"
|
||||
[ ! -L "$decision_file" ] || fail "$decision_label must not be a symbolic link"
|
||||
[ "$(realpath "$decision_file")" = "$decision_file" ] || fail "$decision_label is not canonical"
|
||||
size=$(stat -c %s "$decision_file")
|
||||
[ "$size" -ge 2 ] && [ "$size" -le 4194304 ] || fail "$decision_label is empty or too large"
|
||||
file_mode=$(stat -c %a "$decision_file")
|
||||
[ "$file_mode" = 400 ] || [ "$file_mode" = 600 ] || fail "$decision_label must have mode 0400 or 0600"
|
||||
decision_parent=${decision_file%/*}
|
||||
[ -n "$decision_parent" ] || decision_parent=/
|
||||
canonical_directory "$decision_parent" "$decision_label parent"
|
||||
[ "$(stat -c %a "$decision_parent")" = 700 ] || fail "$decision_label parent must have mode 0700"
|
||||
extra_entry=$(find "$decision_parent" -mindepth 1 -maxdepth 1 ! -path "$decision_file" -print -quit)
|
||||
[ -z "$extra_entry" ] || fail "$decision_label parent must contain only the selected decision file"
|
||||
for authority_root in "$rehearsal_root" "$capture_root" "$reconciliation_root"; do
|
||||
non_overlapping "$decision_file" "$authority_root" || fail "$decision_label must be outside all authority roots"
|
||||
non_overlapping "$decision_parent" "$authority_root" || fail "$decision_label parent must be outside all authority roots"
|
||||
done
|
||||
}
|
||||
|
||||
[ "$#" -ge 1 ] || usage
|
||||
mode=$1
|
||||
[ "$mode" = apply-rollback ] && [ "$#" -eq 7 ] || {
|
||||
[ "$mode" != apply-rollback ] && [ "$#" -eq 6 ] || usage
|
||||
}
|
||||
profile=$2
|
||||
rehearsal_root=$3
|
||||
capture_root=$4
|
||||
reconciliation_root=$5
|
||||
phase_input=$6
|
||||
legacy_root=${7:-}
|
||||
|
||||
case "$mode" in prepare|review|apply-rollback) ;; *) usage ;; esac
|
||||
case "$profile" in edge|standalone) ;; *) usage ;; esac
|
||||
case "$VARIANT" in headless|console) ;; *) fail 'embedded Trial Kit variant is invalid' ;; esac
|
||||
[ "$(uname -s)" = Linux ] || fail 'reconciliation rehearsal requires a Linux Docker host'
|
||||
for tool in docker sha256sum grep sed stat date realpath find mv rm; do
|
||||
command -v "$tool" >/dev/null 2>&1 || fail "$tool is required"
|
||||
done
|
||||
canonical_directory "$rehearsal_root" 'rehearsal root'
|
||||
canonical_directory "$capture_root" 'capture root'
|
||||
safe_absolute_path "$reconciliation_root" || fail 'reconciliation root is not a safe canonical absolute path'
|
||||
non_overlapping "$rehearsal_root" "$capture_root" || fail 'rehearsal and capture roots overlap'
|
||||
non_overlapping "$rehearsal_root" "$reconciliation_root" || fail 'rehearsal and reconciliation roots overlap'
|
||||
non_overlapping "$capture_root" "$reconciliation_root" || fail 'capture and reconciliation roots overlap'
|
||||
if [ -n "$legacy_root" ]; then
|
||||
canonical_directory "$legacy_root" 'legacy root'
|
||||
for authority_root in "$rehearsal_root" "$capture_root" "$reconciliation_root"; do
|
||||
non_overlapping "$legacy_root" "$authority_root" || fail 'legacy root overlaps an authority root'
|
||||
done
|
||||
fi
|
||||
|
||||
script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
|
||||
(CDPATH= cd -- "$script_dir" && sha256sum --check SHA256SUMS)
|
||||
docker info >/dev/null 2>&1 || fail 'docker daemon is unavailable'
|
||||
docker load --input "$script_dir/$ARCHIVE" >/dev/null
|
||||
operator_identity=$(docker image inspect --format '{{.Id}}|{{.Architecture}}|{{.Config.User}}|{{index .Config.Labels "org.opencontainers.image.revision"}}|{{index .Config.Labels "io.qinglong.lifecycle"}}|{{index .Config.Labels "io.qinglong.network"}}' "$OPERATOR_IMAGE")
|
||||
[ "$operator_identity" = "$OPERATOR_ID|$ARCHITECTURE|65532:65532|$SOURCE_REVISION|short-lived|none-by-default" ] || fail 'operator image identity is incompatible'
|
||||
|
||||
uid=$(id -u)
|
||||
gid=$(id -g)
|
||||
[ "$uid" -eq 0 ] && allow_root_service=true || allow_root_service=false
|
||||
plan_root="$reconciliation_root/plan"
|
||||
review_root="$reconciliation_root/review"
|
||||
diagnostic_root="$reconciliation_root/diagnostics"
|
||||
application_root="$reconciliation_root/application"
|
||||
automation_root="$reconciliation_root/automation"
|
||||
automation_decision_root="$reconciliation_root/automation-decision"
|
||||
automation_apply_root="$reconciliation_root/automation-apply"
|
||||
command_root="$reconciliation_root/commands"
|
||||
result_root="$reconciliation_root/results"
|
||||
target_database="$rehearsal_root/sqlite/qinglong3.sqlite"
|
||||
issuer_keyring="$rehearsal_root/reconciliation-review-issuer.keyring"
|
||||
owner_peppers="$rehearsal_root/owner-peppers"
|
||||
owner_credential="$rehearsal_root/owner-credential.json"
|
||||
|
||||
run_deploy() {
|
||||
subcommand=$1
|
||||
command_file=$2
|
||||
result_file=$3
|
||||
input_file=${4:-}
|
||||
set -- docker run --rm --read-only --user "$uid:$gid" --network none \
|
||||
--cap-drop ALL --security-opt no-new-privileges \
|
||||
--memory 128m --memory-swap 128m --cpus 0.5 --pids-limit 32 \
|
||||
--tmpfs /tmp:rw,nosuid,nodev,noexec,size=8m \
|
||||
--mount "type=bind,src=$rehearsal_root,dst=$rehearsal_root" \
|
||||
--mount "type=bind,src=$capture_root,dst=$capture_root,readonly" \
|
||||
--mount "type=bind,src=$reconciliation_root,dst=$reconciliation_root"
|
||||
[ -z "$legacy_root" ] || set -- "$@" \
|
||||
--mount "type=bind,src=$legacy_root,dst=$legacy_root,readonly"
|
||||
[ -z "$input_file" ] || set -- "$@" \
|
||||
--mount "type=bind,src=$decision_parent,dst=$decision_parent,readonly"
|
||||
set -- "$@" "$OPERATOR_IMAGE" deploy "$subcommand" \
|
||||
--command-file "$command_root/$command_file"
|
||||
result_stage="$result_root/.$result_file.$$"
|
||||
[ ! -e "$result_stage" ] || fail 'result staging path already exists'
|
||||
if "$@" >"$result_stage"; then
|
||||
chmod 0600 "$result_stage"
|
||||
mv -f "$result_stage" "$result_root/$result_file"
|
||||
else
|
||||
status=$?
|
||||
rm -f "$result_stage"
|
||||
return "$status"
|
||||
fi
|
||||
}
|
||||
|
||||
if [ "$mode" = prepare ]; then
|
||||
[ ! -e "$reconciliation_root" ] || fail 'new reconciliation root already exists'
|
||||
reconciliation_parent=${reconciliation_root%/*}
|
||||
[ -n "$reconciliation_parent" ] || reconciliation_parent=/
|
||||
canonical_directory "$reconciliation_parent" 'reconciliation root parent'
|
||||
case "$phase_input" in
|
||||
none) legacy_timezone_json=null; legacy_timezone_summary=none ;;
|
||||
''|*[!A-Za-z0-9._+/-]*) fail 'legacy timezone is invalid' ;;
|
||||
*) legacy_timezone_json="\"$phase_input\""; legacy_timezone_summary=$phase_input ;;
|
||||
esac
|
||||
old_umask=$(umask)
|
||||
umask 077
|
||||
mkdir -m 0700 "$reconciliation_root"
|
||||
for directory in plan review diagnostics application automation automation-decision automation-apply commands results; do
|
||||
mkdir -m 0700 "$reconciliation_root/$directory"
|
||||
done
|
||||
umask "$old_umask"
|
||||
capture_result="$rehearsal_root/results/reconciliation-capture-verify.result.json"
|
||||
capture_commit_result="$rehearsal_root/results/reconciliation-capture-commit.result.json"
|
||||
grep -q '"status":"verified"' "$capture_result" || fail 'verified reconciliation capture is missing'
|
||||
capture_id=$(extract_capture_id "$capture_result")
|
||||
capture_bundle_digest=$(extract_digest "$capture_commit_result" bundleDigest)
|
||||
capture_head_digest=$(extract_digest "$capture_result" instanceHeadDigest)
|
||||
prepared_ms=$(($(date +%s) * 1000))
|
||||
cat >"$command_root/plan-prepare.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.plan.prepare","options":{"deploymentRoot":"$rehearsal_root","captureRoot":"$capture_root","planRoot":"$plan_root","allowRootService":$allow_root_service},"request":{"planId":"$PLAN_ID","captureId":"$capture_id","expectedBundleDigest":"$capture_bundle_digest","expectedHeadDigest":"$capture_head_digest","legacyTimezone":$legacy_timezone_json,"preparedAtMs":$prepared_ms}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/plan-prepare.json"
|
||||
phase 'prepare bounded reconciliation plan'
|
||||
run_deploy reconciliation-plan-prepare plan-prepare.json plan-prepare.result.json
|
||||
grep -q '"state":"reconciliation_plan_prepared"' "$result_root/plan-prepare.result.json" || fail 'reconciliation plan was not prepared'
|
||||
plan_preparation_digest=$(extract_digest "$result_root/plan-prepare.result.json" preparationDigest)
|
||||
committed_ms=$((prepared_ms + 1))
|
||||
cat >"$command_root/plan-commit.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.plan.commit","options":{"deploymentRoot":"$rehearsal_root","captureRoot":"$capture_root","planRoot":"$plan_root","allowRootService":$allow_root_service},"request":{"planId":"$PLAN_ID","expectedPreparationDigest":"$plan_preparation_digest","committedAtMs":$committed_ms}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/plan-commit.json"
|
||||
phase 'commit bounded reconciliation plan'
|
||||
run_deploy reconciliation-plan-commit plan-commit.json plan-commit.result.json
|
||||
grep -q '"state":"reconciliation_planned"' "$result_root/plan-commit.result.json" || fail 'reconciliation plan did not commit'
|
||||
plan_digest=$(extract_digest "$result_root/plan-commit.result.json" planDigest)
|
||||
cat >"$command_root/plan-verify.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.plan.verify","options":{"deploymentRoot":"$rehearsal_root","captureRoot":"$capture_root","planRoot":"$plan_root","allowRootService":$allow_root_service},"request":{"planId":"$PLAN_ID","expectedPlanDigest":"$plan_digest"}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/plan-verify.json"
|
||||
run_deploy reconciliation-plan-verify plan-verify.json plan-verify.result.json
|
||||
grep -q '"status":"verified"' "$result_root/plan-verify.result.json" || fail 'reconciliation plan verification failed'
|
||||
plan_head_digest=$(extract_digest "$result_root/plan-verify.result.json" instanceHeadDigest)
|
||||
|
||||
review_prepared_ms=$((committed_ms + 1))
|
||||
cat >"$command_root/review-prepare.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.review.prepare","options":{"deploymentRoot":"$rehearsal_root","captureRoot":"$capture_root","planRoot":"$plan_root","reviewRoot":"$review_root","allowRootService":$allow_root_service},"request":{"reviewId":"$REVIEW_ID","planId":"$PLAN_ID","expectedPlanDigest":"$plan_digest","expectedHeadDigest":"$plan_head_digest","preparedAtMs":$review_prepared_ms}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/review-prepare.json"
|
||||
phase 'prepare strong-authentication reconciliation review'
|
||||
run_deploy reconciliation-review-prepare review-prepare.json review-prepare.result.json
|
||||
grep -q '"state":"reconciliation_review_prepared"' "$result_root/review-prepare.result.json" || fail 'reconciliation review was not prepared'
|
||||
review_preparation_digest=$(extract_digest "$result_root/review-prepare.result.json" preparationDigest)
|
||||
|
||||
page_count=0
|
||||
record_count=0
|
||||
for database in legacy target; do
|
||||
for domain in schema_lineage automation secret_and_config run_history plugin_package ai_and_tool identity_policy_audit unknown; do
|
||||
for fact_kind in schema_object table; do
|
||||
offset=0
|
||||
page=0
|
||||
while :; do
|
||||
stem="$database-$domain-$fact_kind-$page"
|
||||
cat >"$command_root/diagnostic-$stem.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.review.diagnostics","options":{"deploymentRoot":"$rehearsal_root","captureRoot":"$capture_root","planRoot":"$plan_root","reviewRoot":"$review_root","allowRootService":$allow_root_service},"request":{"reviewId":"$REVIEW_ID","expectedPreparationDigest":"$review_preparation_digest","database":"$database","domain":"$domain","factKind":"$fact_kind","offset":$offset,"limit":64,"outputPath":"$diagnostic_root/$stem.json"}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/diagnostic-$stem.json"
|
||||
run_deploy reconciliation-review-diagnostics "diagnostic-$stem.json" "diagnostic-$stem.result.json"
|
||||
grep -q '"state":"reconciliation_review_prepared"' "$result_root/diagnostic-$stem.result.json" || fail "diagnostic page failed: $stem"
|
||||
records=$(extract_unsigned "$result_root/diagnostic-$stem.result.json" recordCount)
|
||||
record_count=$((record_count + records))
|
||||
page_count=$((page_count + 1))
|
||||
if grep -q '"complete":true' "$result_root/diagnostic-$stem.result.json"; then
|
||||
break
|
||||
fi
|
||||
offset=$(extract_unsigned "$result_root/diagnostic-$stem.result.json" nextOffset)
|
||||
page=$((page + 1))
|
||||
done
|
||||
done
|
||||
done
|
||||
done
|
||||
cat >"$reconciliation_root/summary.json" <<EOF
|
||||
{"schemaVersion":1,"schema":"qinglong/local-alpha-reconciliation-rehearsal-summary@v1","status":"operator_decision_required","profile":"$profile","variant":"$VARIANT","sourceRevision":"$SOURCE_REVISION","architecture":"$ARCHITECTURE","capture":{"captureId":"$capture_id","bundleDigest":"$capture_bundle_digest"},"plan":{"planId":"$PLAN_ID","planDigest":"$plan_digest"},"review":{"reviewId":"$REVIEW_ID","preparationDigest":"$review_preparation_digest","diagnosticPages":$page_count,"diagnosticRecords":$record_count},"legacyTimezone":"$legacy_timezone_summary","automaticDecision":"not_authorized","next":"supply_external_review_decisions"}
|
||||
EOF
|
||||
chmod 0600 "$reconciliation_root/summary.json"
|
||||
printf '%s\n' \
|
||||
'Bounded reconciliation plan and diagnostic pages are ready.' \
|
||||
"Summary: $reconciliation_root/summary.json" \
|
||||
"Diagnostics: $diagnostic_root" \
|
||||
'No review decision was generated or committed. Supply an external owner-private NDJSON decision file to the review phase.'
|
||||
exit 0
|
||||
fi
|
||||
|
||||
canonical_directory "$reconciliation_root" 'reconciliation root'
|
||||
for directory in "$plan_root" "$review_root" "$diagnostic_root" "$application_root" "$automation_root" "$automation_decision_root" "$automation_apply_root" "$command_root" "$result_root"; do
|
||||
canonical_directory "$directory" 'reconciliation authority directory'
|
||||
done
|
||||
private_decision_file "$phase_input" 'external decision file'
|
||||
if [ -n "$legacy_root" ]; then
|
||||
non_overlapping "$decision_parent" "$legacy_root" || fail 'external decision file parent must be outside legacy root'
|
||||
fi
|
||||
|
||||
if [ "$mode" = review ]; then
|
||||
grep -q '"status":"operator_decision_required"' "$reconciliation_root/summary.json" || fail 'review phase is detached from operator-decision state'
|
||||
review_preparation_digest=$(extract_digest "$result_root/review-prepare.result.json" preparationDigest)
|
||||
review_head_digest=$(extract_digest "$result_root/review-prepare.result.json" instanceHeadDigest)
|
||||
if [ -e "$command_root/review-commit.json" ]; then
|
||||
committed_ms=$(extract_unsigned "$command_root/review-commit.json" committedAtMs)
|
||||
else
|
||||
committed_ms=$(($(date +%s) * 1000))
|
||||
cat >"$command_root/review-commit.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.review.commit","options":{"deploymentRoot":"$rehearsal_root","captureRoot":"$capture_root","planRoot":"$plan_root","reviewRoot":"$review_root","targetDatabasePath":"$target_database","ownerPepperKeyringDirectory":"$owner_peppers","credentialFilePath":"$owner_credential","issuerKeyringPath":"$issuer_keyring","busyTimeoutMs":100,"allowRootService":$allow_root_service},"request":{"reviewId":"$REVIEW_ID","expectedPreparationDigest":"$review_preparation_digest","expectedHeadDigest":"$review_head_digest","decisionFilePath":"$phase_input","committedAtMs":$committed_ms,"authorizationLifetimeMs":60000}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/review-commit.json"
|
||||
fi
|
||||
phase 'commit explicit review decisions with real Owner authentication'
|
||||
run_deploy reconciliation-review-commit review-commit.json review-commit.result.json "$phase_input"
|
||||
grep -q '"state":"reconciliation_reviewed"' "$result_root/review-commit.result.json" || fail 'reconciliation review did not commit'
|
||||
review_digest=$(extract_digest "$result_root/review-commit.result.json" reviewDigest)
|
||||
cat >"$command_root/review-verify.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.review.verify","options":{"deploymentRoot":"$rehearsal_root","captureRoot":"$capture_root","planRoot":"$plan_root","reviewRoot":"$review_root","issuerKeyringPath":"$issuer_keyring","allowRootService":$allow_root_service},"request":{"reviewId":"$REVIEW_ID","expectedReviewDigest":"$review_digest"}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/review-verify.json"
|
||||
run_deploy reconciliation-review-verify review-verify.json review-verify.result.json
|
||||
grep -q '"status":"verified"' "$result_root/review-verify.result.json" || fail 'reconciliation review verification failed'
|
||||
review_head_digest=$(extract_digest "$result_root/review-verify.result.json" instanceHeadDigest)
|
||||
|
||||
application_prepared_ms=$((committed_ms + 1))
|
||||
cat >"$command_root/application-prepare.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.application.prepare","options":{"deploymentRoot":"$rehearsal_root","captureRoot":"$capture_root","planRoot":"$plan_root","reviewRoot":"$review_root","applicationRoot":"$application_root","issuerKeyringPath":"$issuer_keyring","allowRootService":$allow_root_service},"request":{"applicationId":"$APPLICATION_ID","reviewId":"$REVIEW_ID","expectedReviewDigest":"$review_digest","expectedHeadDigest":"$review_head_digest","preparedAtMs":$application_prepared_ms}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/application-prepare.json"
|
||||
phase 'prepare reviewed cross-domain application plan'
|
||||
run_deploy reconciliation-application-prepare application-prepare.json application-prepare.result.json
|
||||
grep -q '"state":"reconciliation_application_prepared"' "$result_root/application-prepare.result.json" || fail 'application plan was not prepared'
|
||||
application_preparation_digest=$(extract_digest "$result_root/application-prepare.result.json" preparationDigest)
|
||||
application_head_digest=$(extract_digest "$result_root/application-prepare.result.json" instanceHeadDigest)
|
||||
application_committed_ms=$((application_prepared_ms + 1))
|
||||
cat >"$command_root/application-commit.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.application.commit","options":{"deploymentRoot":"$rehearsal_root","captureRoot":"$capture_root","planRoot":"$plan_root","reviewRoot":"$review_root","applicationRoot":"$application_root","issuerKeyringPath":"$issuer_keyring","allowRootService":$allow_root_service},"request":{"applicationId":"$APPLICATION_ID","expectedPreparationDigest":"$application_preparation_digest","expectedHeadDigest":"$application_head_digest","committedAtMs":$application_committed_ms}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/application-commit.json"
|
||||
run_deploy reconciliation-application-commit application-commit.json application-commit.result.json
|
||||
grep -q '"state":"reconciliation_application_planned"' "$result_root/application-commit.result.json" || fail 'application plan did not commit'
|
||||
application_plan_digest=$(extract_digest "$result_root/application-commit.result.json" applicationPlanDigest)
|
||||
cat >"$command_root/application-verify.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.application.verify","options":{"deploymentRoot":"$rehearsal_root","captureRoot":"$capture_root","planRoot":"$plan_root","reviewRoot":"$review_root","applicationRoot":"$application_root","issuerKeyringPath":"$issuer_keyring","allowRootService":$allow_root_service},"request":{"applicationId":"$APPLICATION_ID","expectedApplicationPlanDigest":"$application_plan_digest"}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/application-verify.json"
|
||||
run_deploy reconciliation-application-verify application-verify.json application-verify.result.json
|
||||
grep -q '"status":"verified"' "$result_root/application-verify.result.json" || fail 'application plan verification failed'
|
||||
application_head_digest=$(extract_digest "$result_root/application-verify.result.json" instanceHeadDigest)
|
||||
|
||||
legacy_timezone=$(sed -n 's/^.*"legacyTimezone":"\([^"]*\)".*$/\1/p' "$reconciliation_root/summary.json")
|
||||
[ "$legacy_timezone" != none ] || legacy_timezone=
|
||||
[ -n "$legacy_timezone" ] && timezone_json="\"$legacy_timezone\"" || timezone_json=null
|
||||
automation_prepared_ms=$((application_committed_ms + 1))
|
||||
cat >"$command_root/automation-plan.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.automation.plan","options":{"deploymentRoot":"$rehearsal_root","applicationRoot":"$application_root","automationRoot":"$automation_root","allowRootService":$allow_root_service},"request":{"automationId":"$AUTOMATION_ID","applicationId":"$APPLICATION_ID","expectedApplicationPlanDigest":"$application_plan_digest","expectedHeadDigest":"$application_head_digest","decisionFilePath":"$phase_input","projectId":"default","legacyTimezone":$timezone_json,"preparedAtMs":$automation_prepared_ms}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/automation-plan.json"
|
||||
phase 'materialize reviewed Automation row plan'
|
||||
run_deploy reconciliation-automation-plan automation-plan.json automation-plan.result.json "$phase_input"
|
||||
grep -q '"state":"reconciliation_automation_planned"' "$result_root/automation-plan.result.json" || fail 'Automation plan did not materialize'
|
||||
grep -q '"outcome":"ready"' "$result_root/automation-plan.result.json" || fail 'Automation plan requires manual resolution or has no applicable rows'
|
||||
automation_plan_digest=$(extract_digest "$result_root/automation-plan.result.json" automationPlanDigest)
|
||||
automation_head_digest=$(extract_digest "$result_root/automation-plan.result.json" instanceHeadDigest)
|
||||
cat >"$command_root/automation-verify.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.automation.verify","options":{"deploymentRoot":"$rehearsal_root","applicationRoot":"$application_root","automationRoot":"$automation_root","allowRootService":$allow_root_service},"request":{"automationId":"$AUTOMATION_ID","expectedAutomationPlanDigest":"$automation_plan_digest"}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/automation-verify.json"
|
||||
run_deploy reconciliation-automation-verify automation-verify.json automation-verify.result.json
|
||||
grep -q '"status":"verified"' "$result_root/automation-verify.result.json" || fail 'Automation plan verification failed'
|
||||
automation_head_digest=$(extract_digest "$result_root/automation-verify.result.json" instanceHeadDigest)
|
||||
|
||||
decision_prepared_ms=$((automation_prepared_ms + 1))
|
||||
cat >"$command_root/automation-decision-prepare.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.automation.decision.prepare","options":{"deploymentRoot":"$rehearsal_root","applicationRoot":"$application_root","automationRoot":"$automation_root","automationDecisionRoot":"$automation_decision_root","allowRootService":$allow_root_service},"request":{"decisionId":"$AUTOMATION_DECISION_ID","automationId":"$AUTOMATION_ID","expectedAutomationPlanDigest":"$automation_plan_digest","expectedHeadDigest":"$automation_head_digest","preparedAtMs":$decision_prepared_ms}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/automation-decision-prepare.json"
|
||||
run_deploy reconciliation-automation-decision-prepare automation-decision-prepare.json automation-decision-prepare.result.json
|
||||
grep -q '"state":"reconciliation_automation_decision_prepared"' "$result_root/automation-decision-prepare.result.json" || fail 'Automation decision authority was not prepared'
|
||||
decision_preparation_digest=$(extract_digest "$result_root/automation-decision-prepare.result.json" preparationDigest)
|
||||
eligible_count=$(extract_unsigned "$result_root/automation-plan.result.json" eligibleCount)
|
||||
conflict_count=$(extract_unsigned "$result_root/automation-plan.result.json" conflictCount)
|
||||
row_count=$(extract_unsigned "$result_root/automation-plan.result.json" rowCount)
|
||||
[ "$eligible_count" -gt 0 ] && [ "$conflict_count" -eq 0 ] || fail 'Automation plan is not eligible for bounded reviewed application'
|
||||
cat >"$reconciliation_root/summary.json" <<EOF
|
||||
{"schemaVersion":1,"schema":"qinglong/local-alpha-reconciliation-rehearsal-summary@v1","status":"automation_decision_required","profile":"$profile","variant":"$VARIANT","sourceRevision":"$SOURCE_REVISION","architecture":"$ARCHITECTURE","review":{"reviewId":"$REVIEW_ID","reviewDigest":"$review_digest","decisionAuthority":"authenticated_user"},"application":{"applicationId":"$APPLICATION_ID","applicationPlanDigest":"$application_plan_digest"},"automation":{"automationId":"$AUTOMATION_ID","automationPlanDigest":"$automation_plan_digest","rowCount":$row_count,"eligibleCount":$eligible_count,"conflictCount":$conflict_count},"decision":{"decisionId":"$AUTOMATION_DECISION_ID","preparationDigest":"$decision_preparation_digest"},"automaticRowDecision":"not_authorized","next":"supply_external_automation_decisions"}
|
||||
EOF
|
||||
chmod 0600 "$reconciliation_root/summary.json"
|
||||
printf '%s\n' \
|
||||
'Authenticated review and Automation plan are ready.' \
|
||||
"Summary: $reconciliation_root/summary.json" \
|
||||
"Automation plan: $automation_root/$AUTOMATION_ID/plan.ndjson" \
|
||||
'No Automation row decision was generated or applied. Supply an external owner-private NDJSON decision file to the apply-rollback phase.'
|
||||
exit 0
|
||||
fi
|
||||
|
||||
grep -q '"status":"automation_decision_required"' "$reconciliation_root/summary.json" || fail 'apply-rollback phase is detached from Automation decision state'
|
||||
decision_preparation_digest=$(extract_digest "$result_root/automation-decision-prepare.result.json" preparationDigest)
|
||||
decision_head_digest=$(extract_digest "$result_root/automation-decision-prepare.result.json" instanceHeadDigest)
|
||||
if [ -e "$command_root/automation-decision-commit.json" ]; then
|
||||
committed_ms=$(extract_unsigned "$command_root/automation-decision-commit.json" committedAtMs)
|
||||
else
|
||||
committed_ms=$(($(date +%s) * 1000))
|
||||
cat >"$command_root/automation-decision-commit.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.automation.decision.commit","options":{"deploymentRoot":"$rehearsal_root","applicationRoot":"$application_root","automationRoot":"$automation_root","automationDecisionRoot":"$automation_decision_root","targetDatabasePath":"$target_database","ownerPepperKeyringDirectory":"$owner_peppers","credentialFilePath":"$owner_credential","busyTimeoutMs":100,"allowRootService":$allow_root_service},"request":{"decisionId":"$AUTOMATION_DECISION_ID","automationId":"$AUTOMATION_ID","expectedPreparationDigest":"$decision_preparation_digest","expectedHeadDigest":"$decision_head_digest","decisionFilePath":"$phase_input","committedAtMs":$committed_ms,"authorizationLifetimeMs":60000}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/automation-decision-commit.json"
|
||||
fi
|
||||
phase 'commit explicit Automation row decisions with real Owner authentication'
|
||||
run_deploy reconciliation-automation-decision-commit automation-decision-commit.json automation-decision-commit.result.json "$phase_input"
|
||||
grep -q '"state":"reconciliation_automation_reviewed"' "$result_root/automation-decision-commit.result.json" || fail 'Automation decisions did not commit'
|
||||
decision_digest=$(extract_digest "$result_root/automation-decision-commit.result.json" decisionDigest)
|
||||
cat >"$command_root/automation-decision-verify.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.automation.decision.verify","options":{"deploymentRoot":"$rehearsal_root","applicationRoot":"$application_root","automationRoot":"$automation_root","automationDecisionRoot":"$automation_decision_root","allowRootService":$allow_root_service},"request":{"decisionId":"$AUTOMATION_DECISION_ID","automationId":"$AUTOMATION_ID","expectedDecisionDigest":"$decision_digest"}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/automation-decision-verify.json"
|
||||
run_deploy reconciliation-automation-decision-verify automation-decision-verify.json automation-decision-verify.result.json
|
||||
grep -q '"status":"verified"' "$result_root/automation-decision-verify.result.json" || fail 'Automation decision verification failed'
|
||||
decision_head_digest=$(extract_digest "$result_root/automation-decision-verify.result.json" instanceHeadDigest)
|
||||
|
||||
apply_options="\"deploymentRoot\":\"$rehearsal_root\",\"applicationRoot\":\"$application_root\",\"automationRoot\":\"$automation_root\",\"automationDecisionRoot\":\"$automation_decision_root\",\"automationApplyRoot\":\"$automation_apply_root\",\"targetDatabasePath\":\"$target_database\",\"ownerPepperKeyringDirectory\":\"$owner_peppers\",\"credentialFilePath\":\"$owner_credential\",\"busyTimeoutMs\":100,\"allowRootService\":$allow_root_service"
|
||||
if [ -e "$command_root/automation-apply.json" ]; then
|
||||
applied_ms=$(extract_unsigned "$command_root/automation-apply.json" appliedAtMs)
|
||||
else
|
||||
applied_ms=$((committed_ms + 1))
|
||||
cat >"$command_root/automation-apply.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.automation.apply","options":{$apply_options},"request":{"decisionId":"$AUTOMATION_DECISION_ID","automationId":"$AUTOMATION_ID","expectedDecisionDigest":"$decision_digest","expectedHeadDigest":"$decision_head_digest","mutationId":"$AUTOMATION_MUTATION_ID","requestId":"alpha-reconciliation-automation-apply","appliedAtMs":$applied_ms}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/automation-apply.json"
|
||||
fi
|
||||
phase 'apply reviewed Automation rows under the bounded operator envelope'
|
||||
run_deploy reconciliation-automation-apply automation-apply.json automation-apply.result.json
|
||||
grep -q '"state":"reconciliation_automation_applied"' "$result_root/automation-apply.result.json" || fail 'Automation rows did not apply'
|
||||
apply_digest=$(extract_digest "$result_root/automation-apply.result.json" applyDigest)
|
||||
applied_head_digest=$(extract_digest "$result_root/automation-apply.result.json" instanceHeadDigest)
|
||||
cat >"$command_root/automation-apply-verify.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.automation.apply.verify","options":{$apply_options},"request":{"decisionId":"$AUTOMATION_DECISION_ID","automationId":"$AUTOMATION_ID","expectedApplyDigest":"$apply_digest"}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/automation-apply-verify.json"
|
||||
run_deploy reconciliation-automation-apply-verify automation-apply-verify.json automation-apply-verify.result.json
|
||||
grep -q '"state":"reconciliation_automation_applied"' "$result_root/automation-apply-verify.result.json" || fail 'applied Automation verification failed'
|
||||
|
||||
if [ -e "$command_root/automation-rollback.json" ]; then
|
||||
rolled_back_ms=$(extract_unsigned "$command_root/automation-rollback.json" rolledBackAtMs)
|
||||
else
|
||||
rolled_back_ms=$((applied_ms + 1))
|
||||
cat >"$command_root/automation-rollback.json" <<EOF
|
||||
{"schemaVersion":1,"operation":"local.deployment.reconciliation.automation.apply.rollback","options":{$apply_options},"request":{"decisionId":"$AUTOMATION_DECISION_ID","automationId":"$AUTOMATION_ID","expectedApplyDigest":"$apply_digest","expectedHeadDigest":"$applied_head_digest","rolledBackAtMs":$rolled_back_ms}}
|
||||
EOF
|
||||
chmod 0600 "$command_root/automation-rollback.json"
|
||||
fi
|
||||
phase 'explicitly roll back the reviewed Automation application'
|
||||
run_deploy reconciliation-automation-apply-rollback automation-rollback.json automation-rollback.result.json
|
||||
grep -q '"state":"reconciliation_automation_rolled_back"' "$result_root/automation-rollback.result.json" || fail 'Automation rollback did not complete'
|
||||
rollback_head_digest=$(extract_digest "$result_root/automation-rollback.result.json" instanceHeadDigest)
|
||||
run_deploy reconciliation-automation-apply-verify automation-apply-verify.json automation-rollback-verify.result.json
|
||||
grep -q '"state":"reconciliation_automation_rolled_back"' "$result_root/automation-rollback-verify.result.json" || fail 'rolled-back Automation verification failed'
|
||||
adopted_tasks=$(extract_unsigned "$result_root/automation-apply.result.json" adoptedTaskCount)
|
||||
adopted_triggers=$(extract_unsigned "$result_root/automation-apply.result.json" adoptedTriggerCount)
|
||||
cat >"$reconciliation_root/summary.json" <<EOF
|
||||
{"schemaVersion":1,"schema":"qinglong/local-alpha-reconciliation-rehearsal-summary@v1","status":"reconciliation_automation_rolled_back","profile":"$profile","variant":"$VARIANT","sourceRevision":"$SOURCE_REVISION","architecture":"$ARCHITECTURE","review":{"reviewId":"$REVIEW_ID","authority":"authenticated_user"},"automation":{"automationId":"$AUTOMATION_ID","decisionId":"$AUTOMATION_DECISION_ID","decisionDigest":"$decision_digest","applyDigest":"$apply_digest","adoptedTaskCount":$adopted_tasks,"adoptedTriggerCount":$adopted_triggers,"rollbackHeadDigest":"$rollback_head_digest"},"target":"restored_to_pre_automation_snapshot","completion":"not_attempted","targetRestart":"not_attempted","legacyRestart":"not_attempted","next":"review_rollback_evidence"}
|
||||
EOF
|
||||
chmod 0600 "$reconciliation_root/summary.json"
|
||||
printf '%s\n' \
|
||||
'Reviewed Automation application and explicit rollback completed.' \
|
||||
"Summary: $reconciliation_root/summary.json" \
|
||||
"Apply evidence: $result_root/automation-apply-verify.result.json" \
|
||||
"Rollback evidence: $result_root/automation-rollback-verify.result.json" \
|
||||
'No reconciliation completion, target restart, Legacy restart, Secret/Config application, or Run History mutation was attempted.'
|
||||
@@ -82,15 +82,26 @@ gid=$(id -g)
|
||||
run_inspect() {
|
||||
command_file=$1
|
||||
result_file=$2
|
||||
docker run --rm --read-only --user "$uid:$gid" --network none \
|
||||
--cap-drop ALL --security-opt no-new-privileges \
|
||||
--memory 128m --memory-swap 128m --cpus 0.5 --pids-limit 32 \
|
||||
--tmpfs /tmp:rw,nosuid,nodev,noexec,size=8m \
|
||||
--mount "type=bind,src=$legacy_root,dst=$legacy_root,readonly" \
|
||||
--mount "type=bind,src=$evidence_root,dst=/var/lib/qinglong3" \
|
||||
"$OPERATOR_IMAGE" adoption run \
|
||||
--command-file "/var/lib/qinglong3/$command_file" \
|
||||
>"$evidence_root/results/$result_file"
|
||||
result_stage="$evidence_root/results/.$result_file.$$"
|
||||
attempt=1
|
||||
while [ "$attempt" -le 2 ]; do
|
||||
if docker run --rm --read-only --user "$uid:$gid" --network none \
|
||||
--cap-drop ALL --security-opt no-new-privileges \
|
||||
--memory 128m --memory-swap 128m --cpus 0.5 --pids-limit 32 \
|
||||
--tmpfs /tmp:rw,nosuid,nodev,noexec,size=8m \
|
||||
--mount "type=bind,src=$legacy_root,dst=$legacy_root,readonly" \
|
||||
--mount "type=bind,src=$evidence_root,dst=/var/lib/qinglong3" \
|
||||
"$OPERATOR_IMAGE" adoption run \
|
||||
--command-file "/var/lib/qinglong3/$command_file" \
|
||||
>"$result_stage"
|
||||
then
|
||||
chmod 0600 "$result_stage"
|
||||
mv "$result_stage" "$evidence_root/results/$result_file"
|
||||
return 0
|
||||
fi
|
||||
attempt=$((attempt + 1))
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
run_inspect sqlite-inspect.json sqlite-inspect.result.json
|
||||
|
||||
Reference in New Issue
Block a user