cloudfall CLI phase 3: health, backup, propose/approve, operator approve, migrate on treaty

CHANGELOG.md

@@ -80,6 +80,21 @@ Notable changes to Cloudfall. The format follows
   A missing playbook, inventory, or role directory exits 2 before Ansible
   starts. `playbook run --check` is now `--dry-run`; Ansible's play log
   streams to stderr. `cloudfall-engine manifest` describes every command
+- **Breaking:** seven commands that run Ansible move to treaty: `health`,
+  `backup run`, `backup verify`, `operations propose`, `operations approve`,
+  `operator approve` and `migrate`. Ansible runs through treaty in the
+  project directory, so `--timeout` and Ctrl-C stop it, and `doctor` checks
+  ansible-playbook. `operations approve` and `migrate` still change nothing
+  without `--yes`; that preview answers `effect: noop` with
+  `data.status` `pending` or `plan`. New exit codes, each with the result
+  in `data`: 87 `ENGINE_STEP_FAILED` (an inventory render or playbook
+  failed, was 1), 88 `UNHEALTHY` (was 1), 89 `CHECK_FAILED` when check mode
+  fails in `propose` (was 1), 90 `NOT_VERIFIED` when an approved run fails
+  or does not verify (was 1), 3 `PARTIAL_FAILURE` for a paused `migrate`.
+  A failed `migrate` step's own code and message move from the top-level
+  `error` to `error.context`. `deploy`, `rollback`, `restart` and
+  `data migrate` stay on argparse until treaty #183, since their plan
+  answer has a `wouldRun` key
 - **Breaking:** six more `cloudfall` commands run on treaty: `init`,
   `add ssh-key`, `add server-type`, `add server`, `dashboard build` and
   `services inspect`. Their answer is the treaty envelope described below,

sdk/src/cloudfall/agent_tools.py

@@ -40,6 +40,7 @@
     DeployOptions,
     EngineContext,
     LifecycleError,
+    StepRunner,
     backup_service,
     build_release_artifact,
     deploy,
@@ -48,6 +49,7 @@
     restart,
     rollback,
     run_engine_playbook,
+    subprocess_step,
     verify_backup,
 )
 from cloudfall.migrate import MigrateError, MigrateOptions, execute_migration
@@ -125,6 +127,8 @@ class AgentConfig:
     gateway_ca_path: Path | None = None
     gateway_certificate_path: Path | None = None
     gateway_key_path: Path | None = None
+    run: StepRunner = subprocess_step
+    """Starts each engine step: ``subprocess`` here, ``ctx.run`` under treaty."""
 
     def context(self) -> EngineContext:
         """Return the engine execution context shared by mutating tools."""
@@ -133,6 +137,7 @@ def context(self) -> EngineContext:
             schema_directory=self.schema_directory,
             engine_directory=self.engine_directory,
             inventory_file=self.inventory_file,
+            run=self.run,
         )