scripts.verify_deployment_identity

Reference › scripts › verify_deployment_identity

scripts/verify_deployment_identity.py is the deployment identity verifier CLI (U-T6), a thin wrapper that calls main from orchestrata_ultimate.promotion.identity, where all the logic lives. It checks that the tree at --root, its VERSION record and every running orchestrata or orchgraph systemd unit are provably the same deployed thing. It exits 0 only when that holds, 1 listing every mismatch, and 2 when it cannot inspect enough to decide, including when it finds no in-scope units. The options are --root, --expect-sha and --json. The deploy script deploy/ship.sh and install-orchestrata.sh --verify are meant to call it instead of repeating the checks by hand (RUL-022). The wrapper puts the repository root at the front of sys.path so the package imports when run directly from a checkout. See also promote_env.

At a glance

Class diagram

No classes; see Functions.

Dependency diagram

API

No public API: the module defines no classes, functions or constants.

Source

Permalink: https://gitlab.com/MSamy/orchestrata-ultimate-architecture/-/blob/a4cbc2bdf/scripts/verify_deployment_identity.py

#!/usr/bin/env python3
"""Deployment identity verifier CLI (U-T6).

Exits 0 only when the tree at ``--root``, its ``VERSION`` record, and every
running ``orchestrata``/``orchgraph`` systemd unit are provably the SAME
deployed thing; exits 1 listing every mismatch; exits 2 when the run cannot
inspect enough to decide (including when zero in-scope units are found).

This is what ``deploy/ship.sh`` §5a/§5b and ``install-orchestrata.sh
--verify`` are meant to call instead of hand-rolling the same checks with a
hardcoded ``--user`` flag (RUL-022). All of the actual logic lives in
``orchestrata_ultimate.promotion.identity`` -- this file is only the CLI
wrapper.

Usage:
    uv run python scripts/verify_deployment_identity.py --root /opt/orchestrata --expect-sha <sha>
    uv run python scripts/verify_deployment_identity.py --root /opt/orchestrata --expect-sha <sha> --json
"""

from __future__ import annotations

import sys
from pathlib import Path

# `scripts/` is a plain directory package with no console-script entry point
# (pyproject.toml, [tool.coverage.run] comment) -- it is on sys.path only when
# the repo root is CWD (pytest's rootdir insertion, `python -c` from root).
# Invoked directly as `python scripts/verify_deployment_identity.py`, Python
# puts scripts/ itself (not the repo root) at sys.path[0], so the module's
# own `from orchestrata_ultimate.promotion.identity import main` below would
# fail -- identity.py itself no longer needs `scripts` importable at all
# (PATH_DIRECTIVES/DEFAULT_GLOBS moved into identity_core.py, U-T6 attempt-4
# finding 4), but THIS file still needs the repo root on sys.path to import
# the `orchestrata_ultimate` package itself from a checkout that has not
# been separately pip-installed. Fix it here, once, before that import.
_REPO_ROOT = str(Path(__file__).resolve().parent.parent)
if _REPO_ROOT not in sys.path:
    sys.path.insert(0, _REPO_ROOT)

from orchestrata_ultimate.promotion.identity import main  # noqa: E402

if __name__ == "__main__":
    raise SystemExit(main())