Cloud-native deployment boundary product (BL-101)¶

Documented, fail-closed cloud deploy patterns for workers/batch. Dry-run manifest generation only (Kubernetes + Docker Compose). No secret leakage, no always-on QPU, no live cluster create.

Module: scpn_quantum_control.cloud_native_deployment_product

Rules¶

Rule	Behaviour
Product schema	`cloud_native_deployment_product.v1`
Ambient generator	`deployment.cloud_native.generate_cloud_manifests`
Secret-like env	Refuse (ambient + product pre-check)
Always-on QPU	Refuse (BL-47 / BL-95 compose)
Live cluster create	Refuse
Credential loading	Refuse
Unknown pattern	Fail closed

Patterns¶

pattern_id	role
`batch_worker`	Offline batch worker
`stable_core_gate`	Stable-core contract gate job
`offline_research`	Low-replica research packaging demo

Threat model (fail-closed)¶

secret_leakage · always_on_qpu · live_cluster_create · credential_loading · unbounded_cost

Quick start¶

from scpn_quantum_control.cloud_native_deployment_product import (
    assert_cloud_native_deployment_product_integrity,
    build_cloud_native_deployment_product_registry,
    decide_deploy_path,
    materialise_demo_deploy_dry_run_probe,
)

reg = assert_cloud_native_deployment_product_integrity(
    build_cloud_native_deployment_product_registry()
)
assert reg["allows_always_on_qpu_policy"] is False

assert decide_deploy_path(
    "batch_worker", invent_green_always_on_qpu=True
).allowed is False

probe = materialise_demo_deploy_dry_run_probe()
assert "deployment.yaml" in probe.file_names
assert probe.invent_green_live_cluster is False

Public API contracts¶

Pattern and threat discovery¶

API	Contract
`list_deployment_pattern_ids()`	Return stable deployment-pattern identifiers in catalogue order.
`list_threat_ids()`	Return the bounded cloud threat-model identifiers.
`get_deployment_pattern(pattern_id)`	Resolve one immutable pattern row; blank and unknown identifiers raise `ValueError`.
`iter_deployment_patterns(kind=None)`	Return every pattern or a stable kind-filtered tuple.

DeploymentPatternRow validates identity, execution kind, image command, replica posture, QPU/secret/cluster prohibitions, evidence pointers, and claim boundary. ThreatModelRow validates each threat, mitigation, severity, and fail-closed state. Both records provide JSON-ready to_dict() payloads.

Eligibility and manifest dry runs¶

API	Contract
`decide_deploy_path(pattern_id, ...)`	Allow bounded manifest generation and return explicit blockers for always-on QPU, live cluster creation, secret injection, or credential loading.
`compute_spec_digest(name, image, command, replicas=1, env=None)`	Bind a validated deployment specification to a deterministic SHA-256 digest without resolving credentials.
`materialise_deploy_dry_run_probe(pattern_id, ...)`	Compose the ambient manifest generator, reject secret-like environment keys, and return content-addressed filenames without applying them.
`materialise_demo_deploy_dry_run_probe()`	Materialise the deterministic batch-worker dry run.

PathEligibilityDecision keeps outcome, permission, reason, and blockers mutually consistent. MaterialisedDeployDryRunProbe validates its pattern, manifest digest, file set, ambient claim boundary, and false live-cluster, always-on-QPU, and secret flags.

Registry evidence and integrity¶

API	Contract
`map_cloud_native_deployment_public_surfaces()`	Emit deterministic product and ambient generator descriptors with pattern and claim metadata.
`build_cloud_native_deployment_product_registry()`	Build schema-tagged patterns, threats, surfaces, policy flags, counts, and residual-work evidence.
`assert_cloud_native_deployment_product_integrity(payload=None)`	Reject empty, malformed, blank, invalid-kind/severity, duplicate, count-drifted, or permissive QPU/secret/cluster state.

These APIs generate and validate deployment files only. They do not create a cluster, load credentials, submit QPU work, expose secrets, apply manifests, or claim enterprise operations evidence.

Residuals (honest)¶

S101.3 — fuller enterprise packaging / ops runbooks depth
Ambient generator remains the implementation spine

Pack: docs/internal/differentiable_programming/p3_strategic/bl101_cloud_native_deployment_boundary.md
Ambient: scpn_quantum_control.deployment.cloud_native
BL-47 hardware-safe · BL-95 QPU compute · BL-99 campaign harness

Authored by Anulum Fortis & Arcane Sapience (protoscience@anulum.li)