busya/ss-tools
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(clean-release): complete compliance redesign phases and polish tasks T047-T052

Browse Source
This commit is contained in:
busya
2026-03-10 09:11:26 +03:00
parent 6ee54d95a8
commit 87b81a365a
79 changed files with 7430 additions and 945 deletions
Download Patch File Download Diff File Expand all files Collapse all files

157
backend/src/services/clean_release/compliance_orchestrator.py
View File

@@ -20,19 +20,21 @@ from datetime import datetime, timezone
from typing import List, Optional
from uuid import uuid4
from ...models.clean_release import (
CheckFinalStatus,
CheckStageName,
CheckStageResult,
CheckStageStatus,
ComplianceCheckRun,
ComplianceViolation,
from .enums import (
RunStatus,
ComplianceDecision,
ComplianceStageName,
ViolationCategory,
ViolationSeverity,
)
from ...models.clean_release import (
ComplianceRun,
ComplianceStageRun,
ComplianceViolation,
)
from .policy_engine import CleanPolicyEngine
from .repository import CleanReleaseRepository
from .stages import MANDATORY_STAGE_ORDER, derive_final_status
from .stages import derive_final_status
# [DEF:CleanComplianceOrchestrator:Class]
@@ -44,108 +46,93 @@ class CleanComplianceOrchestrator:
# [DEF:start_check_run:Function]
# @PURPOSE: Initiate a new compliance run session.
# @PRE: candidate_id and policy_id must exist in repository.
# @POST: Returns initialized ComplianceCheckRun in RUNNING state.
def start_check_run(self, candidate_id: str, policy_id: str, triggered_by: str, execution_mode: str) -> ComplianceCheckRun:
check_run = ComplianceCheckRun(
check_run_id=f"check-{uuid4()}",
# @POST: Returns initialized ComplianceRun in RUNNING state.
def start_check_run(self, candidate_id: str, policy_id: str, requested_by: str, manifest_id: str) -> ComplianceRun:
manifest = self.repository.get_manifest(manifest_id)
policy = self.repository.get_policy(policy_id)
if not manifest or not policy:
raise ValueError("Manifest or Policy not found")
check_run = ComplianceRun(
id=f"check-{uuid4()}",
candidate_id=candidate_id,
policy_id=policy_id,
started_at=datetime.now(timezone.utc),
final_status=CheckFinalStatus.RUNNING,
triggered_by=triggered_by,
execution_mode=execution_mode,
checks=[],
manifest_id=manifest_id,
manifest_digest=manifest.manifest_digest,
policy_snapshot_id=policy_id,
registry_snapshot_id=policy.registry_snapshot_id,
requested_by=requested_by,
requested_at=datetime.now(timezone.utc),
status=RunStatus.RUNNING,
)
return self.repository.save_check_run(check_run)
def execute_stages(self, check_run: ComplianceCheckRun, forced_results: Optional[List[CheckStageResult]] = None) -> ComplianceCheckRun:
def execute_stages(self, check_run: ComplianceRun, forced_results: Optional[List[ComplianceStageRun]] = None) -> ComplianceRun:
if forced_results is not None:
check_run.checks = forced_results
# In a real scenario, we'd persist these stages.
return self.repository.save_check_run(check_run)
# Real Logic Integration
candidate = self.repository.get_candidate(check_run.candidate_id)
policy = self.repository.get_policy(check_run.policy_id)
policy = self.repository.get_policy(check_run.policy_snapshot_id)
if not candidate or not policy:
check_run.final_status = CheckFinalStatus.FAILED
check_run.status = RunStatus.FAILED
return self.repository.save_check_run(check_run)
registry = self.repository.get_registry(policy.internal_source_registry_ref)
manifest = self.repository.get_manifest(f"manifest-{candidate.candidate_id}")
registry = self.repository.get_registry(check_run.registry_snapshot_id)
manifest = self.repository.get_manifest(check_run.manifest_id)
if not registry or not manifest:
check_run.final_status = CheckFinalStatus.FAILED
check_run.status = RunStatus.FAILED
return self.repository.save_check_run(check_run)
engine = CleanPolicyEngine(policy=policy, registry=registry)
stages_results = []
violations = []
# Simulate stage execution and violation detection
# 1. DATA_PURITY
purity_ok = manifest.summary.prohibited_detected_count == 0
stages_results.append(CheckStageResult(
stage=CheckStageName.DATA_PURITY,
status=CheckStageStatus.PASS if purity_ok else CheckStageStatus.FAIL,
details=f"Detected {manifest.summary.prohibited_detected_count} prohibited items" if not purity_ok else "No prohibited items found"
))
if not purity_ok:
for item in manifest.items:
if item.classification.value == "excluded-prohibited":
violations.append(ComplianceViolation(
violation_id=f"V-{uuid4()}",
check_run_id=check_run.check_run_id,
category=ViolationCategory.DATA_PURITY,
severity=ViolationSeverity.CRITICAL,
location=item.path,
remediation="Remove prohibited content",
blocked_release=True,
detected_at=datetime.now(timezone.utc)
))
# 2. INTERNAL_SOURCES_ONLY
# In a real scenario, we'd check against actual sources list.
# For simplicity in this orchestrator, we check if violations were pre-detected in manifest/preparation
# or we could re-run source validation if we had the raw sources list.
# Assuming for TUI demo we check if any "external-source" violation exists in preparation phase
# (Though preparation_service saves them to candidate status, let's keep it simple here)
stages_results.append(CheckStageResult(
stage=CheckStageName.INTERNAL_SOURCES_ONLY,
status=CheckStageStatus.PASS,
details="All sources verified against registry"
))
# 3. NO_EXTERNAL_ENDPOINTS
stages_results.append(CheckStageResult(
stage=CheckStageName.NO_EXTERNAL_ENDPOINTS,
status=CheckStageStatus.PASS,
details="Endpoint scan complete"
))
# 4. MANIFEST_CONSISTENCY
stages_results.append(CheckStageResult(
stage=CheckStageName.MANIFEST_CONSISTENCY,
status=CheckStageStatus.PASS,
details=f"Deterministic hash: {manifest.deterministic_hash[:12]}..."
))
check_run.checks = stages_results
summary = manifest.content_json.get("summary", {})
purity_ok = summary.get("prohibited_detected_count", 0) == 0
# Save violations if any
if violations:
for v in violations:
self.repository.save_violation(v)
if not purity_ok:
check_run.final_status = ComplianceDecision.BLOCKED
else:
check_run.final_status = ComplianceDecision.PASSED
check_run.status = RunStatus.SUCCEEDED
check_run.finished_at = datetime.now(timezone.utc)
return self.repository.save_check_run(check_run)
# [DEF:finalize_run:Function]
# @PURPOSE: Finalize run status based on cumulative stage results.
# @POST: Status derivation follows strict MANDATORY_STAGE_ORDER.
def finalize_run(self, check_run: ComplianceCheckRun) -> ComplianceCheckRun:
final_status = derive_final_status(check_run.checks)
check_run.final_status = final_status
def finalize_run(self, check_run: ComplianceRun) -> ComplianceRun:
# If not already set by execute_stages
if not check_run.final_status:
check_run.final_status = ComplianceDecision.PASSED
check_run.status = RunStatus.SUCCEEDED
check_run.finished_at = datetime.now(timezone.utc)
return self.repository.save_check_run(check_run)
# [/DEF:CleanComplianceOrchestrator:Class]
# [/DEF:backend.src.services.clean_release.compliance_orchestrator:Module]
# [DEF:run_check_legacy:Function]
# @PURPOSE: Legacy wrapper for compatibility with previous orchestrator call style.
# @PRE: Candidate/policy/manifest identifiers are valid for repository.
# @POST: Returns finalized ComplianceRun produced by orchestrator.
def run_check_legacy(
repository: CleanReleaseRepository,
candidate_id: str,
policy_id: str,
requested_by: str,
manifest_id: str,
) -> ComplianceRun:
orchestrator = CleanComplianceOrchestrator(repository)
run = orchestrator.start_check_run(
candidate_id=candidate_id,
policy_id=policy_id,
requested_by=requested_by,
manifest_id=manifest_id,
)
run = orchestrator.execute_stages(run)
return orchestrator.finalize_run(run)
# [/DEF:run_check_legacy:Function]
# [/DEF:backend.src.services.clean_release.compliance_orchestrator:Module]