feat(signoz): add recoverable Agent99 metadata toolchain route

2026-07-22 21:02:02 +08:00
parent d097013a03
commit 2bff3edcff
23 changed files with 3510 additions and 1111 deletions
--- a/scripts/reboot-recovery/agent99-live-preflight.ps1
+++ b/scripts/reboot-recovery/agent99-live-preflight.ps1
@@ -1221,7 +1221,7 @@ $decision = Get-AgentLivePreflightDecision `
  -AgentRootPresent ([bool](Test-Path $AgentRoot)) `
  -Manifest $manifest `
  -ManifestCheckRequired ([bool]($ReadinessScope -ne "PromotionReserve")) `
-  -ExpectedRuntimeFileCount 20 `
+  -ExpectedRuntimeFileCount 21 `
  -TaskFailureCount $taskFailures.Count `
  -RelayListenerCount $relayListeners.Count `
  -RequiredEvidenceStaleCount $requiredEvidenceStale.Count `
--- a/scripts/reboot-recovery/agent99-remote-atomic-deploy-receiver.ps1
+++ b/scripts/reboot-recovery/agent99-remote-atomic-deploy-receiver.ps1
@@ -38,6 +38,7 @@ $FixedRuntimeFiles = @(
  "agent99-signoz-metadata-executor.ps1",
  "agent99-signoz-credential-provisioner.ps1",
  "agent99-signoz-credential-target.py",
+  "agent99-signoz-toolchain-target.py",
  "agent99-deploy.ps1",
  "agent99-register-tasks.ps1",
  "agent99-alertmanager-alertchain-poll.ps1",
@@ -1080,7 +1081,7 @@ try {
  }
  $sourceRevision = ([string]$envelope.sourceRevision).ToLowerInvariant()
  if ($sourceRevision -notmatch "^[0-9a-f]{40}$") { throw "invalid_source_revision" }
-  if ([int]$envelope.expectedRuntimeFileCount -ne 20) { throw "invalid_expected_runtime_file_count" }
+  if ([int]$envelope.expectedRuntimeFileCount -ne 21) { throw "invalid_expected_runtime_file_count" }

  $traceId = [string]$envelope.traceId
  $runId = [string]$envelope.runId
@@ -1115,7 +1116,7 @@ try {
  $sourceManifest = [pscustomobject]@{
    schemaVersion = "agent99_remote_source_manifest_v1"
    sourceRevision = $sourceRevision
-    fileCount = 20
+    fileCount = 21
    manifestSha256 = $manifestDigest
    files = @($FixedRuntimeFiles | ForEach-Object {
      [pscustomobject]@{ name = $_; sha256 = ([string]($filesByName[$_].sha256)).ToLowerInvariant() }
@@ -1152,7 +1153,7 @@ try {
      status = "check_ready"
      mode = "check"
      sourceRevision = $sourceRevision
-      expectedRuntimeFileCount = 20
+      expectedRuntimeFileCount = 21
      manifestSha256 = $manifestDigest
      plannedStagingPath = $stagePath
      runtimeManifest = $currentManifest
@@ -1239,7 +1240,7 @@ try {
      if (
        [string]$existingSourceManifest.schemaVersion -ne "agent99_remote_source_manifest_v1" -or
        [string]$existingSourceManifest.sourceRevision -ne $sourceRevision -or
-        [int]$existingSourceManifest.fileCount -ne 20 -or
+        [int]$existingSourceManifest.fileCount -ne 21 -or
        [string]$existingSourceManifest.manifestSha256 -ne $manifestDigest
      ) { throw "existing_staging_manifest_mismatch" }
    } catch {
@@ -1266,7 +1267,7 @@ try {
    [string]$prior.launcherContract.sha256 -match "^[0-9a-f]{64}$" -and
    $live.runtimeMatched -and
    $live.sourceRevision -eq $sourceRevision -and
-    $live.fileCount -eq 20 -and
+    $live.fileCount -eq 21 -and
    $live.mismatchCount -eq 0 -and
    $liveLauncherContract.ok -and
    [string]$liveLauncherContract.sha256 -eq [string]$prior.launcherContract.sha256
@@ -1594,7 +1595,7 @@ try {
            $runtimeManifest.exists -and
            $runtimeManifest.runtimeMatched -and
            $runtimeManifest.sourceRevision -eq $sourceRevision -and
-            $runtimeManifest.fileCount -eq 20 -and
+            $runtimeManifest.fileCount -eq 21 -and
            $runtimeManifest.mismatchCount -eq 0 -and
            $launcherContract.ok -and
            [string]$launcherContract.sha256 -eq [string]$deploy.payload.launcherContract.sha256 -and
--- a/scripts/reboot-recovery/deploy-agent99-via-windows99-ssh.sh
+++ b/scripts/reboot-recovery/deploy-agent99-via-windows99-ssh.sh
@@ -20,6 +20,7 @@ RUNTIME_FILES=(
  "agent99-signoz-metadata-executor.ps1"
  "agent99-signoz-credential-provisioner.ps1"
  "agent99-signoz-credential-target.py"
+  "agent99-signoz-toolchain-target.py"
  "agent99-deploy.ps1"
  "agent99-register-tasks.ps1"
  "agent99-alertmanager-alertchain-poll.ps1"
@@ -229,7 +230,7 @@ trace_id, run_id, work_item_id = sys.argv[4:7]
 output_path = Path(sys.argv[7])
 runtime_names = sys.argv[8:]

-if len(runtime_names) != 20 or len(set(runtime_names)) != 20:
+if len(runtime_names) != 21 or len(set(runtime_names)) != 21:
    raise SystemExit("fixed_runtime_file_contract_failed")

 files: list[dict[str, str]] = []
@@ -269,7 +270,7 @@ envelope = {
    "runId": run_id,
    "workItemId": work_item_id,
    "sourceRevision": source_revision,
-    "expectedRuntimeFileCount": 20,
+    "expectedRuntimeFileCount": 21,
    "manifestSha256": manifest_sha256,
    "files": files,
    "livePreflight": {
@@ -421,14 +422,14 @@ stage_token = hashlib.sha256(stage_identity.encode("utf-8")).hexdigest()[:20]
 script = r'''$ErrorActionPreference='Stop';$ProgressPreference='SilentlyContinue'
 $a='C:\Wooo\Agent99';$b=Join-Path $a 'bin';$p=Join-Path $a 'state\runtime-manifest.json'
 $r=[ordered]@{exists=$false;sourceRevision='';runtimeMatched=$false;recordedRuntimeMatched=$false;fileCount=0;mismatchCount=-1;recordedMismatchCount=-1;parseError=''}
-if(Test-Path -LiteralPath $p -PathType Leaf){try{$m=Get-Content -LiteralPath $p -Raw|ConvertFrom-Json;$rows=@($m.files);$seen=@{};$bad=0;foreach($x in $rows){$n=[string]$x.name;if(!$n-or[IO.Path]::GetFileName($n)-ne$n-or$seen.ContainsKey($n)){$bad++;continue};$seen[$n]=1;$q=Join-Path $b $n;$h=if(Test-Path -LiteralPath $q -PathType Leaf){(Get-FileHash -LiteralPath $q -Algorithm SHA256).Hash.ToLowerInvariant()}else{'missing'};if(([string]$x.runtimeSha256).ToLowerInvariant()-ne$h){$bad++}};$r.exists=$true;$r.sourceRevision=[string]$m.sourceRevision;$r.recordedRuntimeMatched=[bool]$m.runtimeMatched;$r.fileCount=[int]$m.fileCount;$r.mismatchCount=$bad;$r.recordedMismatchCount=[int]$m.mismatchCount;$r.runtimeMatched=[bool]($m.runtimeMatched-and$m.fileCount-eq 20-and$m.mismatchCount-eq 0-and$rows.Count-eq 20-and$seen.Count-eq 20-and$bad-eq 0)}catch{$r.exists=$true;$r.parseError=$_.Exception.GetType().Name}}
+if(Test-Path -LiteralPath $p -PathType Leaf){try{$m=Get-Content -LiteralPath $p -Raw|ConvertFrom-Json;$rows=@($m.files);$seen=@{};$bad=0;foreach($x in $rows){$n=[string]$x.name;if(!$n-or[IO.Path]::GetFileName($n)-ne$n-or$seen.ContainsKey($n)){$bad++;continue};$seen[$n]=1;$q=Join-Path $b $n;$h=if(Test-Path -LiteralPath $q -PathType Leaf){(Get-FileHash -LiteralPath $q -Algorithm SHA256).Hash.ToLowerInvariant()}else{'missing'};if(([string]$x.runtimeSha256).ToLowerInvariant()-ne$h){$bad++}};$r.exists=$true;$r.sourceRevision=[string]$m.sourceRevision;$r.recordedRuntimeMatched=[bool]$m.runtimeMatched;$r.fileCount=[int]$m.fileCount;$r.mismatchCount=$bad;$r.recordedMismatchCount=[int]$m.mismatchCount;$r.runtimeMatched=[bool]($m.runtimeMatched-and$m.fileCount-eq 21-and$m.mismatchCount-eq 0-and$rows.Count-eq 21-and$seen.Count-eq 21-and$bad-eq 0)}catch{$r.exists=$true;$r.parseError=$_.Exception.GetType().Name}}
 $c=[ordered]@{executed=$false;ok=$false;exitCode=-1;errorType=''}
 try{& powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File (Join-Path $b 'agent99-contract-check.ps1') -SourceRoot $b 2>$null|Out-Null;$c.executed=$true;$c.exitCode=$LASTEXITCODE;$c.ok=[bool]($c.exitCode-eq 0)}catch{$c.executed=$true;$c.errorType=$_.Exception.GetType().Name}
 $z=[ordered]@{};foreach($n in 'remoteWritePerformed,liveRuntimeWritePerformed,livePromotionAttempted,livePromotionPerformed,secretValueRead,privateKeyValueRead,tokenValueRead,environmentSecretRead,uiInteraction,vmPowerChange,hostReboot,serviceRestart,scheduledTaskRestart,scheduledTaskModification'.Split(',')){$z[$n]=$false}
 $ready=[bool]($c.executed-and$c.ok-and$c.exitCode-eq 0)
 $status=if($ready){'check_ready'}else{'check_failed_no_apply'}
 $next=if($ready){'rerun_with_apply_and_trace_run_work_item_after_source_commit_and_transport_check'}else{'repair_runtime_contract_before_apply'}
-[ordered]@{schemaVersion='agent99_remote_atomic_deploy_receipt_v1';status=$status;mode='check';sourceRevision='__SOURCE_REVISION__';expectedRuntimeFileCount=20;manifestSha256='__MANIFEST_SHA256__';plannedStagingPath='C:\Wooo\Agent99\deploy\remote-source-__STAGE_TOKEN__';runtimeManifest=[pscustomobject]$r;runtimeContract=[pscustomobject]$c;livePreflight=[ordered]@{executed=$false;reason='apply_only_after_validate_only'};transportPayloadMode='control_command_no_stdin';transientTransportPayloadStored=$false;transientTransportPayloadDeletedBeforeReceiver=$false;transportPayloadContainsSecrets=$false;operationBoundaries=$z;nextSafeAction=$next}|ConvertTo-Json -Compress -Depth 8
+[ordered]@{schemaVersion='agent99_remote_atomic_deploy_receipt_v1';status=$status;mode='check';sourceRevision='__SOURCE_REVISION__';expectedRuntimeFileCount=21;manifestSha256='__MANIFEST_SHA256__';plannedStagingPath='C:\Wooo\Agent99\deploy\remote-source-__STAGE_TOKEN__';runtimeManifest=[pscustomobject]$r;runtimeContract=[pscustomobject]$c;livePreflight=[ordered]@{executed=$false;reason='apply_only_after_validate_only'};transportPayloadMode='control_command_no_stdin';transientTransportPayloadStored=$false;transientTransportPayloadDeletedBeforeReceiver=$false;transportPayloadContainsSecrets=$false;operationBoundaries=$z;nextSafeAction=$next}|ConvertTo-Json -Compress -Depth 8
 if(-not$ready){exit 65}'''
 script = (
    script.replace("__SOURCE_REVISION__", source_revision)
--- a/scripts/reboot-recovery/tests/test_agent99_live_preflight_decision.py
+++ b/scripts/reboot-recovery/tests/test_agent99_live_preflight_decision.py
@@ -105,7 +105,7 @@ def _base_case() -> dict[str, Any]:
            "exists": True,
            "sourceRevision": "a" * 40,
            "runtimeMatched": True,
-            "fileCount": 20,
+            "fileCount": 21,
            "mismatchCount": 0,
            "parseError": "",
        },
@@ -154,7 +154,7 @@ $parameters = @{{
  AgentRootPresent = [bool]$case.agentRootPresent
  Manifest = $case.manifest
  ManifestCheckRequired = [bool]$case.manifestCheckRequired
-  ExpectedRuntimeFileCount = 20
+  ExpectedRuntimeFileCount = 21
  TaskFailureCount = [int]$case.taskFailureCount
  RelayListenerCount = [int]$case.relayListenerCount
  RequiredEvidenceStaleCount = [int]$case.requiredEvidenceStaleCount
@@ -208,7 +208,7 @@ def test_warning_receipt_is_visible_without_weakening_integrity_blockers() -> No
    )
    assert "deploymentEligible = [bool]($blockingReasons.Count -eq 0)" in decision
    assert "preflightGreen = [bool]$decision.deploymentEligible" in source
-    assert "-ExpectedRuntimeFileCount 20" in source
+    assert "-ExpectedRuntimeFileCount 21" in source
    assert "warningReasons = $warningReasons" in source
    assert "selfHealthPerformanceIssues = @(" in source
    assert 'if ($safeHost -notmatch "^[A-Za-z0-9.:-]{1,128}$")' in source
--- a/scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py
+++ b/scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py
@@ -28,6 +28,7 @@ EXPECTED_RUNTIME_FILES = (
    "agent99-signoz-metadata-executor.ps1",
    "agent99-signoz-credential-provisioner.ps1",
    "agent99-signoz-credential-target.py",
+    "agent99-signoz-toolchain-target.py",
    "agent99-deploy.ps1",
    "agent99-register-tasks.ps1",
    "agent99-alertmanager-alertchain-poll.ps1",
@@ -90,7 +91,7 @@ def test_sender_and_receiver_allow_exactly_the_deployer_runtime_bundle() -> None
    )
    assert preflight_count is not None
    assert int(preflight_count.group(1)) == len(EXPECTED_RUNTIME_FILES)
-    assert "expectedRuntimeFileCount\": 20" in sender
+    assert "expectedRuntimeFileCount\": 21" in sender
    assert "$filesByName.Count -ne $FixedRuntimeFiles.Count" in receiver
    assert "required_runtime_file_missing" in receiver
    assert "duplicate_runtime_file" in receiver
@@ -265,7 +266,7 @@ def test_receiver_rolls_back_failed_deploy_or_failed_independent_post_verifier()
    )
    assert "$livePreflight.sourceRevision -eq $sourceRevision" in source
    assert "$runtimeManifest.sourceRevision -eq $sourceRevision" in source
-    assert '$runtimeManifest.fileCount -eq 20' in source
+    assert '$runtimeManifest.fileCount -eq 21' in source
    assert "function Invoke-AgentWindowsControlBaseline" in source
    assert "function Get-AgentRunEvidenceToken" in source
    assert "$evidenceRunToken = Get-AgentRunEvidenceToken -Value $RunId" in source