SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(deploy): register L1 credential reuse transition

Browse Source
This commit is contained in:
Codex
2026-07-24 17:20:01 +03:00
parent 34769af350
commit c19b0789c7
3 changed files with 899 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/deploy-runner/nodedc-deploy
+395
View File
@@ -759,6 +759,34 @@ ENGINE_MCP_NORMALIZED_IDENTITY_SEARCH_TARGET_SHA256 = {
ENGINE_MCP_NORMALIZED_IDENTITY_SEARCH_NEW_PATHS = (
ENGINE_MCP_NORMALIZED_IDENTITY_SEARCH_DESCRIPTOR_REL,
)
ENGINE_MCP_L1_CREDENTIAL_REUSE_DESCRIPTOR_REL = (
"nodedc-source/server/deployTransitions/l1CredentialReuseV1.json"
)
ENGINE_MCP_L1_CREDENTIAL_REUSE_ARTIFACT_ENTRIES = (
"nodedc-source/server/routes/n8n.js",
ENGINE_MCP_L1_CREDENTIAL_REUSE_DESCRIPTOR_REL,
)
ENGINE_MCP_L1_CREDENTIAL_REUSE_PREDECESSOR_SHA256 = {
"nodedc-source/server/routes/n8n.js":
"a2bc69c72f68e57ed27120d0c88f4ffe6310bbf0c4360c8b0dba0953ccaaf522",
}
ENGINE_MCP_L1_CREDENTIAL_REUSE_FOUNDATION_SHA256 = {
"nodedc-source/server/routes/engineAgentGateway.js":
"4a9524fd954320277042c783b7b19cbb2172f075f27652c0eebfd743ffc47872",
ENGINE_MCP_NORMALIZED_IDENTITY_SEARCH_DESCRIPTOR_REL:
"41738185fe103642912b0aa1c29c51860970c38f9f916cc3725e79e258b9ea7e",
ENGINE_NODE_INTELLIGENCE_DESCRIPTOR_REL:
"3e7aeb1d28eb291461f79cd656ece6488bc6d372124088e92f53bf89c3373f61",
}
ENGINE_MCP_L1_CREDENTIAL_REUSE_TARGET_SHA256 = {
"nodedc-source/server/routes/n8n.js":
"6620e4bdd573e9f6b636a4b059eafef76d59da2fdb2183038fa5ec95357d8478",
ENGINE_MCP_L1_CREDENTIAL_REUSE_DESCRIPTOR_REL:
"2ada49ef8bb2f146a9ea8d3c9ab5ee55f6a4e1b17e0f4b62a16f27368bd0eb05",
}
ENGINE_MCP_L1_CREDENTIAL_REUSE_NEW_PATHS = (
ENGINE_MCP_L1_CREDENTIAL_REUSE_DESCRIPTOR_REL,
)
ENGINE_AGENT_FULL_GRANT_MIGRATION_ARTIFACT_ENTRIES = (
ENGINE_AGENT_FULL_GRANT_MIGRATION_STORE_REL,
)
@@ -4785,6 +4813,47 @@ process.stdout.write('engine-mcp-normalized-identity-search:0.11.0:canonical-fac
}
def accept_engine_mcp_l1_credential_reuse_runtime():
root = component_root("engine")
validate_engine_mcp_l1_credential_reuse_slice(
root,
ENGINE_MCP_L1_CREDENTIAL_REUSE_ARTIFACT_ENTRIES,
)
live = run_engine_backend_probe(
(
"node",
"--input-type=module",
"-e",
"""
const route=await import('file:///app/server/routes/n8n.js');
const slot='httpBearerAuth';
const entry={nodeDcCredentialId:'credential-provider',n8nCredentialId:'runtime-provider',type:slot,name:'Provider read access',source:'manual',status:'ok',data:{token:'synthetic'}};
const sameL1=new Set([entry.nodeDcCredentialId]);
const otherL1=new Set(['credential-other']);
const graph={nodes:[{id:'source-reader',data:{n8n:{type:'n8n-nodes-base.httpRequest',parameters:{url:'https://api.provider.example/v1/items'},credentials:{[slot]:{id:entry.n8nCredentialId,name:entry.name,nodeDcCredentialId:entry.nodeDcCredentialId}}}}}]};
const target={type:'n8n-nodes-base.httpRequest',parameters:{url:'https://api.provider.example/v1/identity'}};
const deniedTarget={type:'n8n-nodes-base.httpRequest',parameters:{url:'https://untrusted.example/collect'}};
const allowed=route.buildEngineAgentCredentialTransportPolicy({...entry,data:{allowedHttpRequestDomains:'all'}},graph,slot,target);
const denied=route.buildEngineAgentCredentialTransportPolicy({...entry,data:{allowedHttpRequestDomains:'all'}},graph,slot,deniedTarget);
if(route.engineAgentCandidateScope(entry,{localEntries:[]},sameL1)!=='l1'||route.engineAgentCandidateScope(entry,{localEntries:[]},otherL1)!==''||route.engineAgentCredentialMayReuseWithinL1({...entry,source:'workflow-inline'})||!allowed.bindable||allowed.policy?.allowedHosts?.join(',')!=='api.provider.example'||denied.bindable)process.exit(2);
process.stdout.write('engine-mcp-l1-credential-reuse:0.11.0:same-l1:opaque-ref:v1');
""".strip(),
),
"Engine MCP L1 credential reuse",
container_id=engine_backend_container_id(),
)
expected = (
"engine-mcp-l1-credential-reuse:"
"0.11.0:same-l1:opaque-ref:v1"
)
if live != expected:
die("Engine MCP L1 credential reuse live acceptance mismatch")
return {
"target_sha256": dict(ENGINE_MCP_L1_CREDENTIAL_REUSE_TARGET_SHA256),
"live": live,
}
def validate_no_lifecycle_scripts(payload_dir, label):
forbidden = ("preinstall", "install", "postinstall", "prepare", "prepack", "postpack")
for package_path in payload_dir.rglob("package.json"):
@@ -6104,6 +6173,95 @@ def validate_engine_mcp_normalized_identity_search_slice(payload_dir, entries):
)
def validate_engine_mcp_l1_credential_reuse_slice(payload_dir, entries):
if tuple(entries) != ENGINE_MCP_L1_CREDENTIAL_REUSE_ARTIFACT_ENTRIES:
die(
"Engine MCP L1 credential reuse files.txt exact set/order "
"mismatch"
)
for rel, expected_sha256 in (
ENGINE_MCP_L1_CREDENTIAL_REUSE_TARGET_SHA256.items()
):
path = payload_dir / rel
try:
path_stat = path.lstat()
except FileNotFoundError:
die(f"Engine MCP L1 credential reuse target is missing: {rel}")
if (
stat.S_ISLNK(path_stat.st_mode)
or not stat.S_ISREG(path_stat.st_mode)
or sha256_file(path) != expected_sha256
):
die(
"Engine MCP L1 credential reuse target sha256 mismatch: "
f"{rel}"
)
descriptor = read_strict_json(
payload_dir / ENGINE_MCP_L1_CREDENTIAL_REUSE_DESCRIPTOR_REL,
"Engine MCP L1 credential reuse descriptor",
max_bytes=32 * 1024,
)
expected_descriptor = {
"schemaVersion": "nodedc.engine.deploy-transition/v1",
"id": "engine-mcp-l1-credential-reuse-v1",
"component": "engine",
"scope": "external-mcp-l2-authoring",
"mcpVersion": "0.11.0",
"sourcePath": "nodedc-source/server/routes/n8n.js",
"visibilityProof": {
"scope": "same-l1-workflow",
"source": "local-registry-provenance",
"instanceScope": "preserved",
},
"binding": {
"listTool": "engine_list_l2_credential_refs",
"applyOperation": "assignCredentialRef",
"returns": ["label", "status", "scope", "opaque-ref"],
"neverReturns": [
"native-credential-id",
"logical-credential-id",
"credential-data",
"credential-value",
],
},
"transportPolicy": {
"httpsRequired": True,
"redirectsDisabled": True,
"hostAuthority": [
"credential-allowlist",
"same-l1-observed-host",
],
},
"managedGrants": "target-local",
"crossL1Sharing": False,
}
if descriptor != expected_descriptor:
die("Engine MCP L1 credential reuse descriptor contract mismatch")
route_source = (
payload_dir / "nodedc-source/server/routes/n8n.js"
).read_text(encoding="utf-8")
for marker in (
"function engineAgentCredentialMayReuseWithinL1",
"function buildEngineAgentL1CredentialContext",
"return 'l1'",
"candidateScope === 'l1' ? l1Context.graph : graph",
"managed writer/reader grants",
):
if marker not in route_source:
die(
"Engine MCP L1 credential reuse route marker missing: "
f"{marker}"
)
if (
"LEGACY_CREDENTIAL_SINK_OWNER" not in route_source
or "DATA_PRODUCT_PUBLISH_GRANT_OWNER" not in route_source
or "DATA_PRODUCT_READ_GRANT_OWNER" not in route_source
):
die("Engine MCP L1 credential reuse managed-grant boundary missing")
def validate_engine_agent_full_grant_migration_slice(payload_dir, entries):
if tuple(entries) != ENGINE_AGENT_FULL_GRANT_MIGRATION_ARTIFACT_ENTRIES:
die("Engine agent full grant migration files.txt exact set/order mismatch")
@@ -6604,6 +6762,14 @@ def load_artifact(artifact, work_dir):
payload_dir,
entries,
)
if is_engine_mcp_l1_credential_reuse_slice(
manifest["component"],
entries,
):
validate_engine_mcp_l1_credential_reuse_slice(
payload_dir,
entries,
)
if is_engine_provider_security_catalog_slice(manifest["component"], entries):
validate_engine_provider_security_catalog_payload(payload_dir, entries)
if touches_engine_credential_sink(manifest["component"], entries):
@@ -6641,6 +6807,10 @@ def load_artifact(artifact, work_dir):
manifest["component"],
entries,
)
and not is_engine_mcp_l1_credential_reuse_slice(
manifest["component"],
entries,
)
and (
touches_engine_data_product_publish_grant(entries)
or ENGINE_DATA_PRODUCT_PUBLISH_GRANT_OVERRIDE_REL in entries
@@ -6871,6 +7041,14 @@ def is_engine_mcp_normalized_identity_search_slice(component, entries):
)
def is_engine_mcp_l1_credential_reuse_slice(component, entries):
return (
component == "engine"
and entries is not None
and tuple(entries) == ENGINE_MCP_L1_CREDENTIAL_REUSE_ARTIFACT_ENTRIES
)
def is_engine_agent_full_grant_migration_slice(component, entries):
return (
component == "engine"
@@ -7703,6 +7881,68 @@ def preflight_engine_mcp_normalized_identity_search_predecessor():
}
def preflight_engine_mcp_l1_credential_reuse_predecessor():
root = component_root("engine")
actual = {}
for rel, expected_sha256 in (
ENGINE_MCP_L1_CREDENTIAL_REUSE_PREDECESSOR_SHA256.items()
):
path = root / rel
try:
path_stat = path.lstat()
except FileNotFoundError:
die(f"Engine MCP L1 credential reuse predecessor is missing: {rel}")
if stat.S_ISLNK(path_stat.st_mode) or not stat.S_ISREG(path_stat.st_mode):
die(f"Engine MCP L1 credential reuse predecessor is unsafe: {rel}")
actual_sha256 = sha256_file(path)
if actual_sha256 != expected_sha256:
die(
"Engine MCP L1 credential reuse predecessor drift detected: "
f"path={rel} expected={expected_sha256} actual={actual_sha256}"
)
actual[rel] = actual_sha256
foundation = {}
for rel, expected_sha256 in (
ENGINE_MCP_L1_CREDENTIAL_REUSE_FOUNDATION_SHA256.items()
):
path = root / rel
try:
path_stat = path.lstat()
except FileNotFoundError:
die(f"Engine MCP L1 credential reuse foundation is missing: {rel}")
if (
stat.S_ISLNK(path_stat.st_mode)
or not stat.S_ISREG(path_stat.st_mode)
or sha256_file(path) != expected_sha256
):
die(f"Engine MCP L1 credential reuse foundation drift detected: {rel}")
foundation[rel] = expected_sha256
for rel in ENGINE_MCP_L1_CREDENTIAL_REUSE_NEW_PATHS:
path = root / rel
if path.exists() or path.is_symlink():
die(
"Engine MCP L1 credential reuse new path already exists: "
f"{rel}"
)
backend = preflight_engine_credential_backend_runtime()
if backend["mode"] != "verified-derived-retry":
die(
"Engine MCP L1 credential reuse requires the active immutable "
"backend"
)
return {
"mode": "normalized-identity-search-v1-to-l1-credential-reuse-v1",
"predecessor_sha256": actual,
"foundation_sha256": foundation,
"target_sha256": dict(ENGINE_MCP_L1_CREDENTIAL_REUSE_TARGET_SHA256),
"new_paths": tuple(ENGINE_MCP_L1_CREDENTIAL_REUSE_NEW_PATHS),
"backend_mode": backend["mode"],
}
def preflight_engine_agent_full_grant_migration_predecessor():
root = component_root("engine")
store_path = root / ENGINE_AGENT_FULL_GRANT_MIGRATION_STORE_REL
@@ -7762,6 +8002,7 @@ def component_services(component, entries=None):
or is_engine_mcp_execution_plan_telemetry_runtime_slice(component, entries)
or is_engine_mcp_execution_plan_module_ownership_slice(component, entries)
or is_engine_mcp_normalized_identity_search_slice(component, entries)
or is_engine_mcp_l1_credential_reuse_slice(component, entries)
or is_engine_provider_security_catalog_slice(component, entries)
):
# This slice updates only the existing Engine backend control plane.
@@ -9976,6 +10217,7 @@ def plan_artifact(artifact):
mcp_execution_plan_telemetry_runtime_preflight = None
mcp_execution_plan_module_ownership_preflight = None
mcp_normalized_identity_search_preflight = None
mcp_l1_credential_reuse_preflight = None
provider_catalog_preflight = None
with tempfile.TemporaryDirectory(prefix="plan-", dir=TMP_DIR) as tmp:
manifest, entries, payload_dir = load_artifact(artifact, Path(tmp))
@@ -10069,6 +10311,13 @@ def plan_artifact(artifact):
mcp_normalized_identity_search_preflight = (
preflight_engine_mcp_normalized_identity_search_predecessor()
)
if is_engine_mcp_l1_credential_reuse_slice(
manifest["component"],
entries,
):
mcp_l1_credential_reuse_preflight = (
preflight_engine_mcp_l1_credential_reuse_predecessor()
)
if is_engine_provider_security_catalog_slice(manifest["component"], entries):
provider_catalog_preflight = preflight_engine_provider_security_catalog_predecessor()
@@ -10135,6 +10384,9 @@ def plan_artifact(artifact):
entries,
)
)
touches_mcp_l1_credential_reuse = (
is_engine_mcp_l1_credential_reuse_slice(component, entries)
)
touches_agent_grant_migration = is_engine_agent_full_grant_migration_slice(
component,
entries,
@@ -10156,6 +10408,7 @@ def plan_artifact(artifact):
or touches_mcp_execution_plan_telemetry_runtime
or touches_mcp_execution_plan_module_ownership
or touches_mcp_normalized_identity_search
or touches_mcp_l1_credential_reuse
or touches_agent_grant_migration
):
credential_backend_preflight = preflight_engine_credential_backend_runtime()
@@ -10244,6 +10497,14 @@ def plan_artifact(artifact):
"Engine MCP normalized identity search requires the active "
"immutable credential backend"
)
if touches_mcp_l1_credential_reuse:
if mcp_l1_credential_reuse_preflight is None:
die("Engine MCP L1 credential reuse preflight is missing")
if credential_backend_preflight["mode"] != "verified-derived-retry":
die(
"Engine MCP L1 credential reuse requires the active immutable "
"credential backend"
)
if touches_agent_grant_migration:
agent_grant_migration_predecessor_sha256 = (
preflight_engine_agent_full_grant_migration_predecessor()
@@ -10907,6 +11168,72 @@ def plan_artifact(artifact):
print("credentials=preserved")
print("mcp_nginx=untouched")
print("embedded_ai_workspace=untouched")
if mcp_l1_credential_reuse_preflight:
print(
"engine_mcp_l1_credential_reuse_transition="
f"{mcp_l1_credential_reuse_preflight['mode']}"
)
print("engine_mcp_version=0.11.0")
print("engine_mcp_surface=external-codex")
print("engine_mcp_tool=engine_list_l2_credential_refs")
print("engine_mcp_apply_operation=assignCredentialRef")
print("engine_mcp_credential_scope=same-l1-workflow")
print("engine_mcp_visibility_proof=local-registry-provenance")
print("engine_mcp_cross_l1_sharing=no")
print("engine_mcp_managed_grants=target-local")
print("engine_mcp_native_credential_ids_included=no")
print("engine_mcp_logical_credential_ids_included=no")
print("engine_mcp_credential_values_included=no")
print("engine_mcp_transport_https_required=yes")
print("engine_mcp_transport_redirects_disabled=yes")
for foundation_path, foundation_sha256 in (
mcp_l1_credential_reuse_preflight["foundation_sha256"].items()
):
print(
"engine_mcp_l1_credential_reuse_foundation_sha256"
f"[{foundation_path}]={foundation_sha256}"
)
for changed_path in ENGINE_MCP_L1_CREDENTIAL_REUSE_ARTIFACT_ENTRIES:
print(
"engine_mcp_l1_credential_reuse_changed_path="
f"{changed_path}"
)
if changed_path in mcp_l1_credential_reuse_preflight[
"predecessor_sha256"
]:
print(
"engine_mcp_l1_credential_reuse_predecessor_sha256"
f"[{changed_path}]="
f"{mcp_l1_credential_reuse_preflight['predecessor_sha256'][changed_path]}"
)
elif changed_path in mcp_l1_credential_reuse_preflight["new_paths"]:
print(
"engine_mcp_l1_credential_reuse_predecessor_state"
f"[{changed_path}]=absent"
)
else:
die(
"Engine MCP L1 credential reuse plan has no predecessor "
f"state: {changed_path}"
)
print(
"engine_mcp_l1_credential_reuse_target_sha256"
f"[{changed_path}]="
f"{mcp_l1_credential_reuse_preflight['target_sha256'][changed_path]}"
)
print(
"backend_current_barrier="
f"{mcp_l1_credential_reuse_preflight['backend_mode']}"
)
print("backend_force_recreate=yes")
print("backend_pull=never")
print("l2_graph=untouched")
print("n8n_l1=untouched")
print("engine_ui=untouched")
print("engine_databases=untouched")
print("credentials=preserved")
print("mcp_nginx=untouched")
print("embedded_ai_workspace=untouched")
if transition_descriptor:
print(f"n8n_transition={transition_descriptor['action']}")
print(f"n8n_version={transition_descriptor['n8nVersion']}")
@@ -12041,6 +12368,7 @@ def component_healthchecks(component, entries=None, services=None):
component,
entries,
)
or is_engine_mcp_l1_credential_reuse_slice(component, entries)
or is_engine_agent_full_grant_migration_slice(component, entries)
or is_engine_mcp_control_plane_slice(component, entries)
or is_engine_mcp_ontology_sdk_slice(component, entries)
@@ -12482,6 +12810,9 @@ def run_healthchecks(component, entries=None, services=None):
entries,
)
)
touches_mcp_l1_credential_reuse = (
is_engine_mcp_l1_credential_reuse_slice(component, entries)
)
touches_agent_grant_migration = is_engine_agent_full_grant_migration_slice(
component,
entries,
@@ -12504,6 +12835,7 @@ def run_healthchecks(component, entries=None, services=None):
or touches_mcp_execution_plan_telemetry_runtime
or touches_mcp_execution_plan_module_ownership
or touches_mcp_normalized_identity_search
or touches_mcp_l1_credential_reuse
or touches_agent_grant_migration
or touches_mcp_control_plane
or touches_mcp_ontology_sdk
@@ -12530,6 +12862,7 @@ def run_healthchecks(component, entries=None, services=None):
or touches_mcp_execution_plan_telemetry_runtime
or touches_mcp_execution_plan_module_ownership
or touches_mcp_normalized_identity_search
or touches_mcp_l1_credential_reuse
or touches_agent_grant_migration
or touches_mcp_control_plane
or touches_mcp_ontology_sdk
@@ -12843,6 +13176,48 @@ def run_healthchecks(component, entries=None, services=None):
"Engine MCP normalized identity search installed state is "
"neither target nor rollback predecessor"
)
if touches_mcp_l1_credential_reuse:
root = component_root("engine")
target_state = all(
(root / rel).is_file()
and not (root / rel).is_symlink()
and sha256_file(root / rel) == expected
for rel, expected in (
ENGINE_MCP_L1_CREDENTIAL_REUSE_TARGET_SHA256.items()
)
) and all(
(root / rel).is_file()
and not (root / rel).is_symlink()
and sha256_file(root / rel) == expected
for rel, expected in (
ENGINE_MCP_L1_CREDENTIAL_REUSE_FOUNDATION_SHA256.items()
)
)
predecessor_state = all(
(root / rel).is_file()
and not (root / rel).is_symlink()
and sha256_file(root / rel) == expected
for rel, expected in (
ENGINE_MCP_L1_CREDENTIAL_REUSE_PREDECESSOR_SHA256.items()
)
) and all(
(root / rel).is_file()
and not (root / rel).is_symlink()
and sha256_file(root / rel) == expected
for rel, expected in (
ENGINE_MCP_L1_CREDENTIAL_REUSE_FOUNDATION_SHA256.items()
)
) and all(
not (root / rel).exists() and not (root / rel).is_symlink()
for rel in ENGINE_MCP_L1_CREDENTIAL_REUSE_NEW_PATHS
)
if target_state:
accept_engine_mcp_l1_credential_reuse_runtime()
elif not predecessor_state:
die(
"Engine MCP L1 credential reuse installed state is neither "
"target nor rollback predecessor"
)
container_name = COMPONENTS[component].get("health_container")
if container_name:
healthcheck_container(container_name)
@@ -13024,6 +13399,22 @@ def apply_artifact(artifact):
"Engine MCP normalized identity search requires "
"the active immutable credential backend"
)
if is_engine_mcp_l1_credential_reuse_slice(
component,
entries,
):
preflight_engine_mcp_l1_credential_reuse_predecessor()
l1_credential_reuse_backend_preflight = (
preflight_engine_credential_backend_runtime()
)
if (
l1_credential_reuse_backend_preflight["mode"]
!= "verified-derived-retry"
):
die(
"Engine MCP L1 credential reuse requires the "
"active immutable credential backend"
)
if is_engine_agent_full_grant_migration_slice(component, entries):
preflight_engine_agent_full_grant_migration_predecessor()
migration_backend_preflight = preflight_engine_credential_backend_runtime()
@@ -13297,6 +13688,10 @@ def apply_artifact(artifact):
component,
entries,
)
or is_engine_mcp_l1_credential_reuse_slice(
component,
entries,
)
or is_engine_agent_full_grant_migration_slice(component, entries)
or is_engine_mcp_control_plane_slice(component, entries)
or is_engine_mcp_ontology_sdk_slice(component, entries)