SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(deploy): promote private node reconciliation

Browse Source
This commit is contained in:
Codex
2026-07-23 08:43:36 +03:00
parent 23919e384e
commit 93eb13219a
3 changed files with 34 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/deploy-runner/nodedc-deploy
+21 -35
View File
@@ -417,13 +417,13 @@ ENGINE_PROVIDER_ROTATING_SLOT_TARGET_SHA256 = {
"nodedc-source/server/dataProductPublishGrant/providerCatalog.js": "f6cf5f4de9e57f87fb904e2136a9f34d494e1ffc289aec3ed9ed788b5583a062",
}
ENGINE_PROVIDER_AUTHORITY_DIAGNOSTICS_ARTIFACT_ENTRIES = (
"nodedc-source/server/dataProductPublishGrant/providerCatalog.js",
"nodedc-source/server/nodeIntelligence/upstreamProjection.js",
)
ENGINE_PROVIDER_AUTHORITY_DIAGNOSTICS_PREDECESSOR_SHA256 = {
"nodedc-source/server/dataProductPublishGrant/providerCatalog.js": "e4c216b0affd89ddbd48abcec86febd48eb12a4c56507851daeb47f2ccd60c9a",
"nodedc-source/server/nodeIntelligence/upstreamProjection.js": "761a874b102a938bc6018159ddacdaac71ad6ae08e9f0f8d7f3b58a0165a5131",
}
ENGINE_PROVIDER_AUTHORITY_DIAGNOSTICS_TARGET_SHA256 = {
"nodedc-source/server/dataProductPublishGrant/providerCatalog.js": "86e23683054860bb21b47e4e60a13db741088ee214a60704fd4fd24a49ea5852",
"nodedc-source/server/nodeIntelligence/upstreamProjection.js": "2dfa6b4f37d9bfa8b92a8109d4060d02dd2634ceb8f7924504b83ccf3fdd1523",
}
ENGINE_DEPTTRANS_ZONE_AUTHORITY_V1_ARTIFACT_ENTRIES = (
"nodedc-source/server/assets/provider-packages/v1/catalog.json",
@@ -4140,29 +4140,18 @@ def accept_engine_provider_authority_diagnostics_runtime():
"--input-type=module",
"-e",
"""
const module=await import('file:///app/server/dataProductPublishGrant/providerCatalog.js');
const catalog=await module.loadProviderSecurityCatalog();
const slot='ndcProviderRotatingAccessApi';
const credential={id:'native-provider',name:'provider',nodeDcCredentialId:'provider-ref'};
const policy={kind:'httpRequest',allowedHosts:['api.geliospro.com'],requireHttps:true,disableRedirects:true};
const query={sendQuery:true,specifyQuery:'keypair',queryParameters:{parameters:[{name:'incltrip',value:'true'},{name:'inclcntrs',value:'true'},{name:'inclsnsrs',value:'true'},{name:'incllsv',value:'true'}]}};
const read=(id)=>({id,data:{n8n:{id,name:id,type:'n8n-nodes-base.httpRequest',parameters:{method:'GET',url:'https://api.geliospro.com/api/v1/units',...structuredClone(query)},credentials:{[slot]:credential}},nodedcAgentCredentialPolicies:{[slot]:structuredClone(policy)}}});
const publish=(id,dataProductId)=>({id,data:{n8n:{id,name:id,type:'n8n-nodes-ndc.ndcDataProductPublish',parameters:{dataProductId},credentials:{}}}});
const graph={nodes:[read('hot-read'),read('profile-read'),publish('hot-publish','fleet.positions.current.v5'),publish('profile-publish','fleet.units.profile.current.v1')],edges:[{source:'hot-read',target:'hot-publish'},{source:'profile-read',target:'profile-publish'}]};
const hot=module.resolveProviderConnectionFromGraph({graph,targetNodeId:'hot-publish',catalog});
const profile=module.resolveProviderConnectionFromGraph({graph,targetNodeId:'profile-publish',catalog});
const crossed=structuredClone(graph);crossed.edges.push({source:'hot-read',target:'profile-publish'});
const ambiguous=module.resolveProviderConnectionFromGraph({graph:crossed,targetNodeId:'profile-publish',catalog});
const drift=structuredClone(graph);drift.nodes[1].data.n8n.parameters.queryParameters.parameters.pop();
const rejected=module.resolveProviderConnectionFromGraph({graph:drift,targetNodeId:'profile-publish',catalog});
if(!hot.ok||hot.descriptor?.packageId!=='gelios.provider.v7'||hot.descriptor?.providerRequestNodeId!=='hot-read'||!profile.ok||profile.descriptor?.packageId!=='gelios.provider.v8'||profile.descriptor?.providerRequestNodeId!=='profile-read'||ambiguous.blockers?.join(',')!=='publish_grant_provider_request_not_exact'||rejected.blockers?.join(',')!=='publish_grant_provider_request_not_exact')process.exit(2);
process.stdout.write('engine-provider-authority:publish-path-scoped:v2');
const module=await import('file:///app/server/nodeIntelligence/upstreamProjection.js');
const privateValidation={nodeId:'private-1',nodeName:'NDC Data Product Publish',valid:true,errors:[],warnings:[]};
const privateOnly=module.reconcilePrivateNodeValidation({valid:false,errorCount:1,warningCount:0,summary:{errorCount:1,warningCount:0},errors:[{node:'NDC Data Product Publish',message:'Unknown node type: \"ndcDataProductPublish\".'}],warnings:[]},['private-1'],[privateValidation]);
const mixed=module.reconcilePrivateNodeValidation({valid:false,errorCount:2,warningCount:0,summary:{errorCount:2,warningCount:0},errors:[{node:'NDC Data Product Publish',message:'Unknown node type: \"ndcDataProductPublish\".'},{nodeId:'built-in-1',nodeName:'HTTP',message:'URL is required'}],warnings:[]},['private-1'],[privateValidation]);
if(!privateOnly.valid||privateOnly.errors?.length!==0||privateOnly.summary?.errorCount!==0||privateOnly.summary?.warningCount!==1||mixed.valid||mixed.errors?.length!==1||mixed.errors?.[0]?.nodeId!=='built-in-1')process.exit(2);
process.stdout.write('engine-private-node-reconciliation:exact-id-or-name:v1');
""".strip(),
),
"Engine provider publish-path authority",
"Engine private node validation reconciliation",
container_id=engine_backend_container_id(),
)
expected = "engine-provider-authority:publish-path-scoped:v2"
expected = "engine-private-node-reconciliation:exact-id-or-name:v1"
if live != expected:
die("Engine provider authority diagnostics live acceptance mismatch")
return {
@@ -4639,19 +4628,16 @@ def validate_engine_provider_authority_diagnostics_slice(payload_dir, entries):
):
die(f"Engine provider authority diagnostics target sha256 mismatch: {rel}")
source = (
payload_dir / "nodedc-source/server/dataProductPublishGrant/providerCatalog.js"
payload_dir / "nodedc-source/server/nodeIntelligence/upstreamProjection.js"
).read_text(encoding="utf-8")
required_markers = (
"publish_grant_provider_request_not_exact",
"publish_grant_provider_credential_binding_invalid",
"publish_grant_provider_transport_policy_not_exact",
"publish_grant_provider_request_path_unreachable",
"publish_grant_provider_credential_identity_mismatch",
"exactRequestMatches",
"reachableRequestNodes",
"isUnknownPrivateNodeIssue",
"issue?.nodeName || issue?.node",
"privateResults",
"NDC_PRIVATE_NODE_VALIDATED_BY_ENGINE_CATALOG",
)
if any(marker not in source for marker in required_markers):
die("Engine provider authority diagnostics reason-code contract mismatch")
die("Engine private node validation reconciliation contract mismatch")
def validate_engine_depttrans_zone_authority_v1_slice(payload_dir, entries):
@@ -5496,7 +5482,7 @@ def preflight_engine_provider_authority_diagnostics_predecessor():
if backend["mode"] != "verified-derived-retry":
die("Engine provider authority diagnostics requires the active immutable backend")
return {
"mode": "publish-path-scoped-provider-request-authority",
"mode": "private-node-name-reconciliation",
"predecessor_sha256": actual,
"target_sha256": dict(ENGINE_PROVIDER_AUTHORITY_DIAGNOSTICS_TARGET_SHA256),
"backend_mode": backend["mode"],
@@ -8093,9 +8079,9 @@ def plan_artifact(artifact):
print("engine_ui=untouched")
print("engine_databases=untouched")
if provider_authority_diagnostics_preflight:
print("engine_provider_authority_transition=publish-path-scoped-provider-request-authority")
print("engine_provider_packages=gelios.provider.v7,gelios.provider.v8")
print("engine_data_products=fleet.positions.current.v5,fleet.units.profile.current.v1")
print("engine_validation_transition=private-node-name-reconciliation")
print("engine_validation_boundary=engine-pinned-private-node-catalog")
print("private_node_identity=node-id-or-exact-display-name")
print("provider_credential_values=preserved")
for changed_path in ENGINE_PROVIDER_AUTHORITY_DIAGNOSTICS_ARTIFACT_ENTRIES:
print(f"engine_provider_authority_changed_path={changed_path}")