Metadata-Version: 2.4
Name: django-environment-refresh
Version: 0.1.0a2
Summary: Governed Django production-to-nonproduction environment refreshes
Keywords: django,environment,refresh,postgresql
Author: Uncommon Software
License-Expression: Apache-2.0
License-File: LICENSE.md
Classifier: Development Status :: 2 - Pre-Alpha
Classifier: Framework :: Django
Classifier: Framework :: Django :: 6.1
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.14
Classifier: Typing :: Typed
Requires-Dist: cryptography>=49,<51
Requires-Dist: http-message-signatures>=2.0.1,<3
Requires-Dist: pydantic>=2.13.4,<3
Requires-Dist: rfc8785==0.1.4
Requires-Dist: urllib3>=2.7,<3
Requires-Dist: boto3>=1.43.53,<2 ; extra == 'digitalocean'
Requires-Dist: django>=6.1rc1,<6.2 ; extra == 'django'
Requires-Dist: psycopg>=3.3.4,<4 ; extra == 'postgresql'
Maintainer: Uncommon Software
Requires-Python: >=3.14.6, <3.15
Project-URL: Changelog, https://github.com/UncommonSoftware/django-environment-refresh/blob/main/CHANGELOG.md
Project-URL: Documentation, https://github.com/UncommonSoftware/django-environment-refresh/tree/main/docs
Project-URL: Issues, https://github.com/UncommonSoftware/django-environment-refresh/issues
Project-URL: Repository, https://github.com/UncommonSoftware/django-environment-refresh
Project-URL: Security, https://github.com/UncommonSoftware/django-environment-refresh/blob/main/SECURITY.md
Provides-Extra: bunny
Provides-Extra: digitalocean
Provides-Extra: django
Provides-Extra: postgresql
Description-Content-Type: text/markdown

# django-environment-refresh

> [!WARNING]
> **Development status: pre-alpha.** Version `0.1.0a2` is intended for design
> review and synthetic evaluation, not production deployment. The reference
> workflow is not yet fully certified, destructive cleanup requires a separate
> signed approval and durable fail-closed reconciliation, and live provider and
> adopter rehearsals remain required release gates.

`django-environment-refresh` is a reusable Django package for governed,
recipient-initiated refreshes from a source installation into a disposable
non-production recipient.

The PyPI distribution is named `django-environment-refresh`; its Python import
and Django application label are `django_environment_refresh`.

The package is intentionally split along the trust boundary:

- source credentials stay with source-side adapters and workers;
- recipient credentials stay with recipient-side adapters and workers;
- the recipient operator uses the installed Django management command;
- durable control state lives outside every application database being refreshed;
- cleanup is always planned and approved separately.

It includes digest-locked contracts and lifecycle state, mutual peer
attestation, source-side one-use grant administration with ordered audit
receipts, a source Django control API, encrypted resumable artifacts, typed
durable jobs, PostgreSQL/DigitalOcean/Bunny adapter primitives, isolated Django
sanitization, clean-target readiness and atomic cutover/rollback,
exact-resource cleanup planning, and a deterministic conformance harness.

## Sensitive source fields

An application policy may mark an individual text field as `sensitive`, or
declare a named conditional sensitive record set. On the source installation,
the package replaces every selected value with the fixed `[SENSITIVE]`
placeholder before the record is serialized or encrypted. The production row
is never mutated, original values are excluded from evidence, stable identity
fields cannot be marked sensitive, and a missing or failing record selector
blocks export.

This source-side replacement is an additional boundary. Recipient-side
sanitization and validation are still mandatory before a clean target can be
authorized.

See the [quick start](https://github.com/UncommonSoftware/django-environment-refresh/blob/main/docs/quickstart.md),
[runtime composition guide](https://github.com/UncommonSoftware/django-environment-refresh/blob/main/docs/runtime-composition.md),
[public distribution and release guide](https://github.com/UncommonSoftware/django-environment-refresh/blob/main/docs/public-distribution-and-release.md),
[provider and recovery runbooks](https://github.com/UncommonSoftware/django-environment-refresh/blob/main/docs/provider-and-recovery-runbooks.md),
[policy authoring guide](https://github.com/UncommonSoftware/django-environment-refresh/blob/main/docs/policy-authoring.md),
and the [operator guide](https://github.com/UncommonSoftware/django-environment-refresh/blob/main/docs/operator-guide.md).

The implementation's security-bearing decisions are recorded in the
[architecture decision records](https://github.com/UncommonSoftware/django-environment-refresh/tree/main/docs/adr).
Provider and application policies are extension code and do not live in this repository.

## Supported consumer runtimes

| Consumer fixture | Python | Django |
| --- | --- | --- |
| Django 6.1rc1 | 3.14.6 | 6.1rc1 |
| Django 6.1 | 3.14.6 | 6.1 |

The package metadata therefore supports Python `>=3.14.6,<3.15` and the
`django` extra supports Django `>=6.1rc1,<6.2`.

## Development

Install [uv](https://docs.astral.sh/uv/) 0.12.3, then run the bounded local gate:

```console
uv run python scripts/local_gate.py
```

The gate checks the lock, formatting, lint, strict typing, unit tests, package
metadata, wheel contents, one wheel and one sdist, clean core-only installation,
and both independent Django consumer fixtures.

See the [contribution guide](https://github.com/UncommonSoftware/django-environment-refresh/blob/main/CONTRIBUTING.md),
[security policy](https://github.com/UncommonSoftware/django-environment-refresh/blob/main/SECURITY.md),
and [compatibility policy](https://github.com/UncommonSoftware/django-environment-refresh/blob/main/docs/compatibility.md)
before changing a public contract.

The local suite uses synthetic providers and disposable databases. Real cloud
credentials, adopter policies, deployments, rehearsals, independent approvals,
and package publication remain separate environment-owned release gates.

## License

Licensed under the [Apache License 2.0](https://github.com/UncommonSoftware/django-environment-refresh/blob/main/LICENSE.md).
Copyright 2026 Uncommon Software and contributors.
