SILVER/NODEDC_PLATFORM
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(deploy): register execution plan module ownership transition

Browse Source
This commit is contained in:
Codex
2026-07-23 23:27:36 +03:00
parent 73364b4acb
commit f02a1d4125
4 changed files with 1146 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/deploy-runner/nodedc-deploy
+525
View File
@@ -651,6 +651,53 @@ ENGINE_MCP_EXECUTION_PLAN_TELEMETRY_RUNTIME_TARGET_SHA256 = {
ENGINE_MCP_EXECUTION_PLAN_TELEMETRY_RUNTIME_NEW_PATHS = (
ENGINE_MCP_EXECUTION_PLAN_TELEMETRY_RUNTIME_DESCRIPTOR_REL,
)
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_DESCRIPTOR_REL = (
"nodedc-source/server/deployTransitions/executionPlanModuleOwnershipV3.json"
)
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_ARTIFACT_ENTRIES = (
"nodedc-source/server/l2ExecutionPlan/materializer.js",
"nodedc-source/server/routes/engineAgentGateway.js",
"nodedc-source/server/assets/execution-plans/v1/catalog.json",
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_DESCRIPTOR_REL,
ENGINE_NODE_INTELLIGENCE_DESCRIPTOR_REL,
)
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_PREDECESSOR_SHA256 = {
"nodedc-source/server/l2ExecutionPlan/materializer.js":
"ee3bcfd06b3a5fa46800df974a2dedfdd55eeaf662329f837486c011a9bd713e",
"nodedc-source/server/routes/engineAgentGateway.js":
"9020cf49a3558c0497fed4ecfd81367cbc11b5b249881804c29fe437900c71f8",
"nodedc-source/server/assets/execution-plans/v1/catalog.json":
"5bdfc92284a7c836ff326e3a89b559110e376b32efd34b5f23f2bec272745781",
ENGINE_NODE_INTELLIGENCE_DESCRIPTOR_REL:
"03b2ba120c3929e9cf99940ddc927082de376ceff762895a84103144202aef42",
}
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_FOUNDATION_SHA256 = {
"nodedc-source/server/routes/n8n.js":
"391fc81228fdacd6efc6c0868991a3485f71869708e49ac15819db6ccce1bfce",
"nodedc-source/server/l2ExecutionPlan/catalog.js":
"c35b4c7ad9319aabbf1366a11ff52a6e99d961893bafdfcb4e84fc5f24fc04be",
"nodedc-source/server/l2ExecutionPlan/compiler.js":
"6b783ad15c26dc7de0645082c8a426002d943138c70bf31a240247b16a33b6a0",
ENGINE_MCP_EXECUTION_PLAN_MATERIALIZATION_DESCRIPTOR_REL:
"52c0152cff49c251be5581a9209d2e63ba710c16e815bdd6ece24f7c9dd7e480",
ENGINE_MCP_EXECUTION_PLAN_TELEMETRY_RUNTIME_DESCRIPTOR_REL:
"68b275efb6303284336d8b637c966c24d891a4bd0b3fec4fb83247359929ef79",
}
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_TARGET_SHA256 = {
"nodedc-source/server/l2ExecutionPlan/materializer.js":
"dabf0073520049d7a04d1962b29e591ae092b87b287a50534ad2d98b03ae683c",
"nodedc-source/server/routes/engineAgentGateway.js":
"17c5f502b3ceacc45278eef7418d08e1e55a8b3e46e00942e559d25566fdba41",
"nodedc-source/server/assets/execution-plans/v1/catalog.json":
"7e34b93aa30b06cd52853b48013baef2970cc27e4fddc333a1011dc73ea8c08a",
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_DESCRIPTOR_REL:
"d187d539a219fec453e06c55c3f5486ef66059371b4ae9b145266307b2af9889",
ENGINE_NODE_INTELLIGENCE_DESCRIPTOR_REL:
"4cdeb85ebb2e43f088f095f75b7fc31aabd8ab81c8ac96ded4aafd7dbd8e30bd",
}
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_NEW_PATHS = (
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_DESCRIPTOR_REL,
)
ENGINE_AGENT_FULL_GRANT_MIGRATION_ARTIFACT_ENTRIES = (
ENGINE_AGENT_FULL_GRANT_MIGRATION_STORE_REL,
)
@@ -3350,6 +3397,7 @@ def validate_engine_node_intelligence_transition(payload_dir, entries):
"const ENGINE_AGENT_MCP_VERSION = '0.7.0'",
"const ENGINE_AGENT_MCP_VERSION = '0.8.0'",
"const ENGINE_AGENT_MCP_VERSION = '0.9.0'",
"const ENGINE_AGENT_MCP_VERSION = '0.10.0'",
)
):
die("Engine node-intelligence gateway MCP version is not registered")
@@ -4583,6 +4631,54 @@ process.stdout.write('engine-mcp-execution-plan-telemetry-runtime:0.9.0:compiler
}
def accept_engine_mcp_execution_plan_module_ownership_runtime():
root = component_root("engine")
validate_engine_mcp_execution_plan_module_ownership_slice(
root,
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_ARTIFACT_ENTRIES,
)
live = run_engine_backend_probe(
(
"node",
"--input-type=module",
"-e",
"""
const fs=await import('node:fs/promises');
const gateway=await import('file:///app/server/routes/engineAgentGateway.js');
const catalogModule=await import('file:///app/server/l2ExecutionPlan/catalog.js');
const materializer=await import('file:///app/server/l2ExecutionPlan/materializer.js');
const catalog=await catalogModule.loadExecutionPlanCatalog();
const source=await fs.readFile('/app/server/l2ExecutionPlan/materializer.js','utf8');
const plan=gateway.engineAgentTools.find((item)=>item.name==='engine_plan_l2_execution_plan_materialization');
const strategies=plan?.inputSchema?.properties?.strategy?.enum||[];
const adoption=plan?.inputSchema?.properties?.moduleAdoption?.properties||{};
const geliosV9=catalog.packages?.find((item)=>item.id==='gelios.provider.v9');
const legacy=catalog.packages?.some((item)=>item.id==='gelios.provider.v8');
const unmanaged=materializer.materializationState({source:{},nodes:[{id:'existing'}],edges:[]});
if(gateway.ENGINE_AGENT_MCP_VERSION!=='0.10.0'||strategies.join(',')!=='create_or_reconcile_owned,adopt_existing,adopt_existing_module'||!adoption.preserveBoundNodeIds||!source.includes('execution_plan_module_retire_boundary_not_closed')||!source.includes('manual_webhook_same_method')||/gelios|robot2b/i.test(source)||geliosV9?.contractDigest!=='sha256:7dd4ce4a45ce76e884ffa1e304bfaa521f552e9a45e535930f2d17b882ae23ed'||!legacy||unmanaged!=='unmanaged_existing')process.exit(2);
process.stdout.write('engine-mcp-execution-plan-module-ownership:0.10.0:module-scoped:shared-boundary:v3');
""".strip(),
),
"Engine MCP execution plan module ownership",
container_id=engine_backend_container_id(),
)
expected = (
"engine-mcp-execution-plan-module-ownership:"
"0.10.0:module-scoped:shared-boundary:v3"
)
if live != expected:
die(
"Engine MCP execution plan module ownership live acceptance "
"mismatch"
)
return {
"target_sha256": dict(
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_TARGET_SHA256
),
"live": live,
}
def validate_no_lifecycle_scripts(payload_dir, label):
forbidden = ("preinstall", "install", "postinstall", "prepare", "prepack", "postpack")
for package_path in payload_dir.rglob("package.json"):
@@ -5569,6 +5665,157 @@ def validate_engine_mcp_execution_plan_telemetry_runtime_slice(
die("Engine MCP execution plan telemetry runtime contains provider hardcode")
def validate_engine_mcp_execution_plan_module_ownership_slice(
payload_dir,
entries,
):
if (
tuple(entries)
!= ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_ARTIFACT_ENTRIES
):
die(
"Engine MCP execution plan module ownership files.txt exact "
"set/order mismatch"
)
for rel, expected_sha256 in (
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_TARGET_SHA256.items()
):
path = payload_dir / rel
try:
path_stat = path.lstat()
except FileNotFoundError:
die(
"Engine MCP execution plan module ownership target is "
f"missing: {rel}"
)
if (
stat.S_ISLNK(path_stat.st_mode)
or not stat.S_ISREG(path_stat.st_mode)
or sha256_file(path) != expected_sha256
):
die(
"Engine MCP execution plan module ownership target sha256 "
f"mismatch: {rel}"
)
descriptor = read_strict_json(
payload_dir
/ ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_DESCRIPTOR_REL,
"Engine MCP execution plan module ownership descriptor",
max_bytes=32 * 1024,
)
expected_descriptor = {
"schemaVersion": "nodedc.engine.deploy-transition/v1",
"id": "engine-mcp-l2-execution-plan-module-ownership-v3",
"component": "engine",
"scope": "external-mcp-l2-authoring-runtime",
"mcpVersion": "0.10.0",
"sourcePaths": [
"nodedc-source/server/l2ExecutionPlan/materializer.js",
"nodedc-source/server/routes/engineAgentGateway.js",
"nodedc-source/server/assets/execution-plans/v1/catalog.json",
],
"moduleOwnership": {
"schemaVersion":
"nodedc.engine.materialized-execution-plan-module/v1",
"adoptionStrategy": "adopt_existing_module",
"reconciliationStrategy": "create_or_reconcile_owned",
"nodeBindings": "exact-one-to-one",
"retirementScope": "closed-module-boundary",
"unrelatedNodes": "preserved",
"unrelatedEdges": "preserved",
"internalEdges": "server-derived-from-trusted-plan",
"wholeGraphReplacement": "not-required",
},
"sharedBoundary": {
"runtimeKinds": ["ndc.manual-trigger"],
"nodeTypes": ["n8n-nodes-base.webhook"],
"compatibility": "same-node-type-and-http-method",
"configurationAuthority": "existing-graph",
"providerCredentialNodes": "must-be-engine-managed",
"publisherNodes": "must-be-engine-managed",
},
"providerPackageTrust": {
"addedPackageId": "gelios.provider.v9",
"addedPackageDigest":
"sha256:7dd4ce4a45ce76e884ffa1e304bfaa521f552e9a45e535930f2d17b882ae23ed",
"legacyPackageId": "gelios.provider.v8",
"legacyPackagePreserved": True,
"telemetryRegistryDigest":
"sha256:8338dd1f3e757dae5a0fc558e41b3a5cc6395c33c94841ce4d2af976e1911381",
"telemetryProjectionDigest":
"sha256:ecdafb13173338f10043a08603ddd5cd1f6091f1c54d7fbb7e8a9606fbbdef65",
"providerLogicAuthority": "trusted-provider-package",
},
"engineProviderHardcode": False,
"embeddedCodexChanged": False,
}
if descriptor != expected_descriptor:
die(
"Engine MCP execution plan module ownership descriptor "
"contract mismatch"
)
materializer_source = (
payload_dir / "nodedc-source/server/l2ExecutionPlan/materializer.js"
).read_text(encoding="utf-8")
gateway_source = (
payload_dir / "nodedc-source/server/routes/engineAgentGateway.js"
).read_text(encoding="utf-8")
for marker in (
"nodedc.engine.materialized-execution-plan-module/v1",
"adopt_existing_module",
"preserveBoundNodeIds",
"execution_plan_module_retire_boundary_not_closed",
"manual_webhook_same_method",
):
if marker not in materializer_source:
die(
"Engine MCP execution plan module ownership contract "
f"marker missing: {marker}"
)
if (
"const ENGINE_AGENT_MCP_VERSION = '0.10.0'" not in gateway_source
or "preserveBoundNodeIds" not in gateway_source
or "adopt_existing_module" not in gateway_source
):
die("Engine MCP execution plan module ownership gateway mismatch")
if re.search(r"gelios|robot2b", materializer_source, re.IGNORECASE):
die("Engine MCP execution plan module ownership contains provider hardcode")
catalog = read_strict_json(
payload_dir
/ "nodedc-source/server/assets/execution-plans/v1/catalog.json",
"Engine execution plan catalog",
max_bytes=512 * 1024,
)
package_by_id = {
package.get("id"): package
for package in catalog.get("packages", [])
if isinstance(package, dict)
}
if (
package_by_id.get("gelios.provider.v9", {}).get("contractDigest")
!= "sha256:7dd4ce4a45ce76e884ffa1e304bfaa521f552e9a45e535930f2d17b882ae23ed"
or "gelios.provider.v8" not in package_by_id
):
die("Engine MCP execution plan module ownership catalog mismatch")
node_intelligence_descriptor = read_engine_node_intelligence_descriptor(
payload_dir / ENGINE_NODE_INTELLIGENCE_DESCRIPTOR_REL,
"Engine MCP execution plan module ownership node-intelligence descriptor",
)
if (
node_intelligence_descriptor.get("action") != "activate"
or node_intelligence_descriptor.get("releaseId")
!= ENGINE_NODE_INTELLIGENCE_RELEASE_ID
or node_intelligence_descriptor.get("source", {}).get("gatewaySha256")
!= ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_TARGET_SHA256[
ENGINE_NODE_INTELLIGENCE_GATEWAY_REL
]
):
die(
"Engine MCP execution plan module ownership node-intelligence "
"attestation contract mismatch"
)
def validate_engine_agent_full_grant_migration_slice(payload_dir, entries):
if tuple(entries) != ENGINE_AGENT_FULL_GRANT_MIGRATION_ARTIFACT_ENTRIES:
die("Engine agent full grant migration files.txt exact set/order mismatch")
@@ -5996,6 +6243,10 @@ def load_artifact(artifact, work_dir):
manifest["component"],
entries,
)
and not is_engine_mcp_execution_plan_module_ownership_slice(
manifest["component"],
entries,
)
and not is_engine_provider_authority_diagnostics_slice(
manifest["component"],
entries,
@@ -6045,6 +6296,14 @@ def load_artifact(artifact, work_dir):
payload_dir,
entries,
)
if is_engine_mcp_execution_plan_module_ownership_slice(
manifest["component"],
entries,
):
validate_engine_mcp_execution_plan_module_ownership_slice(
payload_dir,
entries,
)
if is_engine_provider_security_catalog_slice(manifest["component"], entries):
validate_engine_provider_security_catalog_payload(payload_dir, entries)
if touches_engine_credential_sink(manifest["component"], entries):
@@ -6074,6 +6333,10 @@ def load_artifact(artifact, work_dir):
manifest["component"],
entries,
)
and not is_engine_mcp_execution_plan_module_ownership_slice(
manifest["component"],
entries,
)
and (
touches_engine_data_product_publish_grant(entries)
or ENGINE_DATA_PRODUCT_PUBLISH_GRANT_OVERRIDE_REL in entries
@@ -6286,6 +6549,15 @@ def is_engine_mcp_execution_plan_telemetry_runtime_slice(component, entries):
)
def is_engine_mcp_execution_plan_module_ownership_slice(component, entries):
return (
component == "engine"
and entries is not None
and tuple(entries)
== ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_ARTIFACT_ENTRIES
)
def is_engine_agent_full_grant_migration_slice(component, entries):
return (
component == "engine"
@@ -6964,6 +7236,83 @@ def preflight_engine_mcp_execution_plan_telemetry_runtime_predecessor():
}
def preflight_engine_mcp_execution_plan_module_ownership_predecessor():
root = component_root("engine")
actual = {}
for rel, expected_sha256 in (
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_PREDECESSOR_SHA256.items()
):
path = root / rel
try:
path_stat = path.lstat()
except FileNotFoundError:
die(
"Engine MCP execution plan module ownership predecessor is "
f"missing: {rel}"
)
if stat.S_ISLNK(path_stat.st_mode) or not stat.S_ISREG(path_stat.st_mode):
die(
"Engine MCP execution plan module ownership predecessor is "
f"unsafe: {rel}"
)
actual_sha256 = sha256_file(path)
if actual_sha256 != expected_sha256:
die(
"Engine MCP execution plan module ownership predecessor drift "
f"detected: path={rel} expected={expected_sha256} "
f"actual={actual_sha256}"
)
actual[rel] = actual_sha256
foundation = {}
for rel, expected_sha256 in (
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_FOUNDATION_SHA256.items()
):
path = root / rel
try:
path_stat = path.lstat()
except FileNotFoundError:
die(
"Engine MCP execution plan module ownership foundation is "
f"missing: {rel}"
)
if (
stat.S_ISLNK(path_stat.st_mode)
or not stat.S_ISREG(path_stat.st_mode)
or sha256_file(path) != expected_sha256
):
die(
"Engine MCP execution plan module ownership foundation drift "
f"detected: {rel}"
)
foundation[rel] = expected_sha256
for rel in ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_NEW_PATHS:
path = root / rel
if path.exists() or path.is_symlink():
die(
"Engine MCP execution plan module ownership new path already "
f"exists: {rel}"
)
backend = preflight_engine_credential_backend_runtime()
if backend["mode"] != "verified-derived-retry":
die(
"Engine MCP execution plan module ownership requires the active "
"immutable backend"
)
return {
"mode":
"execution-plan-telemetry-runtime-v2-to-module-ownership-v3",
"predecessor_sha256": actual,
"foundation_sha256": foundation,
"target_sha256": dict(
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_TARGET_SHA256
),
"new_paths": tuple(
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_NEW_PATHS
),
"backend_mode": backend["mode"],
}
def preflight_engine_agent_full_grant_migration_predecessor():
root = component_root("engine")
store_path = root / ENGINE_AGENT_FULL_GRANT_MIGRATION_STORE_REL
@@ -7021,6 +7370,7 @@ def component_services(component, entries=None):
or is_engine_mcp_telemetry_catalog_slice(component, entries)
or is_engine_mcp_execution_plan_materialization_slice(component, entries)
or is_engine_mcp_execution_plan_telemetry_runtime_slice(component, entries)
or is_engine_mcp_execution_plan_module_ownership_slice(component, entries)
or is_engine_provider_security_catalog_slice(component, entries)
):
# This slice updates only the existing Engine backend control plane.
@@ -9233,6 +9583,7 @@ def plan_artifact(artifact):
mcp_telemetry_catalog_preflight = None
mcp_execution_plan_materialization_preflight = None
mcp_execution_plan_telemetry_runtime_preflight = None
mcp_execution_plan_module_ownership_preflight = None
provider_catalog_preflight = None
with tempfile.TemporaryDirectory(prefix="plan-", dir=TMP_DIR) as tmp:
manifest, entries, payload_dir = load_artifact(artifact, Path(tmp))
@@ -9312,6 +9663,13 @@ def plan_artifact(artifact):
mcp_execution_plan_telemetry_runtime_preflight = (
preflight_engine_mcp_execution_plan_telemetry_runtime_predecessor()
)
if is_engine_mcp_execution_plan_module_ownership_slice(
manifest["component"],
entries,
):
mcp_execution_plan_module_ownership_preflight = (
preflight_engine_mcp_execution_plan_module_ownership_predecessor()
)
if is_engine_provider_security_catalog_slice(manifest["component"], entries):
provider_catalog_preflight = preflight_engine_provider_security_catalog_predecessor()
@@ -9366,6 +9724,12 @@ def plan_artifact(artifact):
entries,
)
)
touches_mcp_execution_plan_module_ownership = (
is_engine_mcp_execution_plan_module_ownership_slice(
component,
entries,
)
)
touches_agent_grant_migration = is_engine_agent_full_grant_migration_slice(
component,
entries,
@@ -9385,6 +9749,7 @@ def plan_artifact(artifact):
or touches_mcp_telemetry_catalog
or touches_mcp_execution_plan_materialization
or touches_mcp_execution_plan_telemetry_runtime
or touches_mcp_execution_plan_module_ownership
or touches_agent_grant_migration
):
credential_backend_preflight = preflight_engine_credential_backend_runtime()
@@ -9454,6 +9819,17 @@ def plan_artifact(artifact):
"Engine MCP execution plan telemetry runtime requires the "
"active immutable credential backend"
)
if touches_mcp_execution_plan_module_ownership:
if mcp_execution_plan_module_ownership_preflight is None:
die(
"Engine MCP execution plan module ownership preflight is "
"missing"
)
if credential_backend_preflight["mode"] != "verified-derived-retry":
die(
"Engine MCP execution plan module ownership requires the "
"active immutable credential backend"
)
if touches_agent_grant_migration:
agent_grant_migration_predecessor_sha256 = (
preflight_engine_agent_full_grant_migration_predecessor()
@@ -9968,6 +10344,81 @@ def plan_artifact(artifact):
print("node_intelligence_image=preserved")
print("mcp_nginx=untouched")
print("embedded_ai_workspace=untouched")
if mcp_execution_plan_module_ownership_preflight:
print(
"engine_mcp_module_ownership_transition="
f"{mcp_execution_plan_module_ownership_preflight['mode']}"
)
print("engine_mcp_version=0.10.0")
print("engine_mcp_surface=external-codex")
print(
"engine_mcp_materialization_strategies="
"create_or_reconcile_owned,adopt_existing,adopt_existing_module"
)
print("engine_mcp_module_node_bindings=exact-one-to-one")
print("engine_mcp_module_retirement_boundary=closed")
print("engine_mcp_shared_manual_webhook=compatible-config-preserved")
print("engine_mcp_provider_credential_nodes=engine-managed")
print("engine_mcp_publisher_nodes=engine-managed")
print("engine_provider_package_added=gelios.provider.v9")
print("engine_provider_package_legacy=gelios.provider.v8:preserved")
print("node_intelligence_descriptor=attested-gateway-successor")
print("node_intelligence_release=2.33.2-974a9fb3492f")
print("node_intelligence_image=preserved")
for foundation_path, foundation_sha256 in (
mcp_execution_plan_module_ownership_preflight[
"foundation_sha256"
].items()
):
print(
"engine_mcp_execution_plan_module_ownership_foundation_sha256"
f"[{foundation_path}]={foundation_sha256}"
)
for changed_path in (
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_ARTIFACT_ENTRIES
):
print(
"engine_mcp_execution_plan_module_ownership_changed_path="
f"{changed_path}"
)
if changed_path in mcp_execution_plan_module_ownership_preflight[
"predecessor_sha256"
]:
print(
"engine_mcp_execution_plan_module_ownership_predecessor_sha256"
f"[{changed_path}]="
f"{mcp_execution_plan_module_ownership_preflight['predecessor_sha256'][changed_path]}"
)
elif changed_path in mcp_execution_plan_module_ownership_preflight[
"new_paths"
]:
print(
"engine_mcp_execution_plan_module_ownership_predecessor_state"
f"[{changed_path}]=absent"
)
else:
die(
"Engine MCP execution plan module ownership plan has no "
f"predecessor state: {changed_path}"
)
print(
"engine_mcp_execution_plan_module_ownership_target_sha256"
f"[{changed_path}]="
f"{mcp_execution_plan_module_ownership_preflight['target_sha256'][changed_path]}"
)
print(
"backend_current_barrier="
f"{mcp_execution_plan_module_ownership_preflight['backend_mode']}"
)
print("backend_force_recreate=yes")
print("backend_pull=never")
print("l2_graph=untouched")
print("n8n_l1=untouched")
print("engine_ui=untouched")
print("engine_databases=untouched")
print("credentials=preserved")
print("mcp_nginx=untouched")
print("embedded_ai_workspace=untouched")
if transition_descriptor:
print(f"n8n_transition={transition_descriptor['action']}")
print(f"n8n_version={transition_descriptor['n8nVersion']}")
@@ -11094,6 +11545,10 @@ def component_healthchecks(component, entries=None, services=None):
component,
entries,
)
or is_engine_mcp_execution_plan_module_ownership_slice(
component,
entries,
)
or is_engine_agent_full_grant_migration_slice(component, entries)
or is_engine_mcp_control_plane_slice(component, entries)
or is_engine_mcp_ontology_sdk_slice(component, entries)
@@ -11523,6 +11978,12 @@ def run_healthchecks(component, entries=None, services=None):
entries,
)
)
touches_mcp_execution_plan_module_ownership = (
is_engine_mcp_execution_plan_module_ownership_slice(
component,
entries,
)
)
touches_agent_grant_migration = is_engine_agent_full_grant_migration_slice(
component,
entries,
@@ -11543,6 +12004,7 @@ def run_healthchecks(component, entries=None, services=None):
or touches_mcp_telemetry_catalog
or touches_mcp_execution_plan_materialization
or touches_mcp_execution_plan_telemetry_runtime
or touches_mcp_execution_plan_module_ownership
or touches_agent_grant_migration
or touches_mcp_control_plane
or touches_mcp_ontology_sdk
@@ -11567,6 +12029,7 @@ def run_healthchecks(component, entries=None, services=None):
or touches_mcp_telemetry_catalog
or touches_mcp_execution_plan_materialization
or touches_mcp_execution_plan_telemetry_runtime
or touches_mcp_execution_plan_module_ownership
or touches_agent_grant_migration
or touches_mcp_control_plane
or touches_mcp_ontology_sdk
@@ -11796,6 +12259,48 @@ def run_healthchecks(component, entries=None, services=None):
"Engine MCP execution plan telemetry runtime installed state "
"is neither target nor rollback predecessor"
)
if touches_mcp_execution_plan_module_ownership:
root = component_root("engine")
target_state = all(
(root / rel).is_file()
and not (root / rel).is_symlink()
and sha256_file(root / rel) == expected
for rel, expected in (
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_TARGET_SHA256.items()
)
) and all(
(root / rel).is_file()
and not (root / rel).is_symlink()
and sha256_file(root / rel) == expected
for rel, expected in (
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_FOUNDATION_SHA256.items()
)
)
predecessor_state = all(
(root / rel).is_file()
and not (root / rel).is_symlink()
and sha256_file(root / rel) == expected
for rel, expected in (
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_PREDECESSOR_SHA256.items()
)
) and all(
(root / rel).is_file()
and not (root / rel).is_symlink()
and sha256_file(root / rel) == expected
for rel, expected in (
ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_FOUNDATION_SHA256.items()
)
) and all(
not (root / rel).exists() and not (root / rel).is_symlink()
for rel in ENGINE_MCP_EXECUTION_PLAN_MODULE_OWNERSHIP_NEW_PATHS
)
if target_state:
accept_engine_mcp_execution_plan_module_ownership_runtime()
elif not predecessor_state:
die(
"Engine MCP execution plan module ownership installed state "
"is neither target nor rollback predecessor"
)
container_name = COMPONENTS[component].get("health_container")
if container_name:
healthcheck_container(container_name)
@@ -11945,6 +12450,22 @@ def apply_artifact(artifact):
"Engine MCP execution plan telemetry runtime "
"requires the active immutable credential backend"
)
if is_engine_mcp_execution_plan_module_ownership_slice(
component,
entries,
):
preflight_engine_mcp_execution_plan_module_ownership_predecessor()
execution_plan_module_ownership_backend_preflight = (
preflight_engine_credential_backend_runtime()
)
if (
execution_plan_module_ownership_backend_preflight["mode"]
!= "verified-derived-retry"
):
die(
"Engine MCP execution plan module ownership "
"requires the active immutable credential backend"
)
if is_engine_agent_full_grant_migration_slice(component, entries):
preflight_engine_agent_full_grant_migration_predecessor()
migration_backend_preflight = preflight_engine_credential_backend_runtime()
@@ -12210,6 +12731,10 @@ def apply_artifact(artifact):
component,
entries,
)
or is_engine_mcp_execution_plan_module_ownership_slice(
component,
entries,
)
or is_engine_agent_full_grant_migration_slice(component, entries)
or is_engine_mcp_control_plane_slice(component, entries)
or is_engine_mcp_ontology_sdk_slice(component, entries)