Deploy public authenticated AutoML gateway

execution_metadata.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import tempfile
 import zipfile
 from datetime import datetime, timezone
@@ -22,6 +23,19 @@ from ui_contracts import DecisionSource, DecisionTrace, FeatureExtractionReport,
 EXECUTION_METADATA_KEY = "execution_metadata"
 EXECUTION_METADATA_SCHEMA_VERSION = 1
 APPROVED_RESEARCH_KEY = "approved_research"
+TRUSTED_EXTRACTOR_KEY = "trusted_extractor"
+_EXTRACTOR_ID_PATTERN = re.compile(r"^[a-z][a-z0-9_]{2,63}$")
+_EXTRACTOR_VERSION_PATTERN = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$")
+_SHA256_PATTERN = re.compile(r"^[0-9a-f]{64}$")
+_TRUSTED_EXTRACTOR_FIELDS = {
+    "schema_version",
+    "extractor_id",
+    "version",
+    "configuration",
+    "bundle_hash",
+    "required_assets",
+}
+_TRUSTED_ASSET_FIELDS = {"asset_id", "sha256", "size_bytes"}
 _APPROVED_RESEARCH_FIELDS = {
     "schema_version",
     "research_plan",
@@ -39,6 +53,8 @@ _PIPELINE_CONFIG_FIELDS = {
     "transform_tool",
     "ml_tool",
     "image_backend",
+    "image_backbone",
+    "extractor_configuration",
 }
 
 
@@ -140,6 +156,7 @@ def make_execution_metadata(
     decision_traces: Sequence[DecisionTrace | Mapping[str, Any]] = (),
     *,
     approved_research: Mapping[str, Any] | None = None,
+    trusted_extractor: Mapping[str, Any] | None = None,
 ) -> dict[str, Any]:
     """Return the canonical JSON-safe execution metadata container."""
 
@@ -163,11 +180,16 @@ def make_execution_metadata(
         if approved_research
         else {}
     )
+    extractor_binding = (
+        normalize_trusted_extractor_binding(trusted_extractor)
+        if trusted_extractor
+        else {}
+    )
     if approved:
         approval_trace = DecisionTrace.from_mapping(approved["approval_trace"])
         if all(trace.trace_id != approval_trace.trace_id for trace in traces):
             traces.insert(0, approval_trace)
-    if report is None and not traces and not approved:
+    if report is None and not traces and not approved and not extractor_binding:
         return {}
     result = {
         "schema_version": EXECUTION_METADATA_SCHEMA_VERSION,
@@ -176,9 +198,77 @@ def make_execution_metadata(
     }
     if approved:
         result[APPROVED_RESEARCH_KEY] = approved
+    if extractor_binding:
+        result[TRUSTED_EXTRACTOR_KEY] = extractor_binding
     return result
 
 
+def normalize_trusted_extractor_binding(value: Mapping[str, Any]) -> dict[str, Any]:
+    """Validate a package-safe binding without treating it as executable authority."""
+
+    data = _mapping(value, TRUSTED_EXTRACTOR_KEY)
+    if set(data) != _TRUSTED_EXTRACTOR_FIELDS or data.get("schema_version") != 1:
+        raise ValueError("trusted_extractor has an unsupported shape")
+    extractor_id = str(data.get("extractor_id") or "").strip().lower()
+    version = str(data.get("version") or "").strip()
+    bundle_hash = str(data.get("bundle_hash") or "").strip().lower()
+    if not _EXTRACTOR_ID_PATTERN.fullmatch(extractor_id):
+        raise ValueError("trusted_extractor.extractor_id is invalid")
+    if not _EXTRACTOR_VERSION_PATTERN.fullmatch(version):
+        raise ValueError("trusted_extractor.version is invalid")
+    if not _SHA256_PATTERN.fullmatch(bundle_hash):
+        raise ValueError("trusted_extractor.bundle_hash is invalid")
+    configuration = data.get("configuration")
+    if not isinstance(configuration, Mapping) or not all(
+        isinstance(key, str) for key in configuration
+    ):
+        raise ValueError("trusted_extractor.configuration must be a mapping")
+    try:
+        configuration_copy = json.loads(
+            json.dumps(dict(configuration), allow_nan=False)
+        )
+    except (TypeError, ValueError, OverflowError, RecursionError) as exc:
+        raise ValueError("trusted_extractor.configuration must be JSON-safe") from exc
+    if len(json.dumps(configuration_copy).encode("utf-8")) > 32_768:
+        raise ValueError("trusted_extractor.configuration is too large")
+    raw_assets = data.get("required_assets")
+    if not isinstance(raw_assets, (list, tuple)) or len(raw_assets) > 64:
+        raise ValueError("trusted_extractor.required_assets must be a bounded array")
+    assets: list[dict[str, Any]] = []
+    asset_ids: set[str] = set()
+    for raw in raw_assets:
+        asset = _mapping(raw, "trusted extractor asset")
+        if set(asset) != _TRUSTED_ASSET_FIELDS:
+            raise ValueError("trusted extractor asset has an unsupported shape")
+        asset_id = str(asset.get("asset_id") or "").strip()
+        digest = str(asset.get("sha256") or "").strip().lower()
+        size = asset.get("size_bytes")
+        if (
+            not asset_id
+            or len(asset_id) > 128
+            or asset_id in {".", ".."}
+            or "/" in asset_id
+            or "\\" in asset_id
+            or any(ord(character) < 32 for character in asset_id)
+            or asset_id in asset_ids
+        ):
+            raise ValueError("trusted extractor asset_id is invalid or duplicated")
+        if not _SHA256_PATTERN.fullmatch(digest):
+            raise ValueError("trusted extractor asset sha256 is invalid")
+        if isinstance(size, bool) or not isinstance(size, int) or size <= 0:
+            raise ValueError("trusted extractor asset size_bytes must be positive")
+        asset_ids.add(asset_id)
+        assets.append({"asset_id": asset_id, "sha256": digest, "size_bytes": size})
+    return {
+        "schema_version": 1,
+        "extractor_id": extractor_id,
+        "version": version,
+        "configuration": configuration_copy,
+        "bundle_hash": bundle_hash,
+        "required_assets": assets,
+    }
+
+
 def normalize_approved_research(value: Mapping[str, Any]) -> dict[str, Any]:
     """Validate the optional approved plan carried into trusted execution."""
 
@@ -263,6 +353,7 @@ def normalize_execution_metadata(value: Mapping[str, Any]) -> dict[str, Any]:
         data.get("feature_extraction_report"),
         traces,
         approved_research=data.get(APPROVED_RESEARCH_KEY),
+        trusted_extractor=data.get(TRUSTED_EXTRACTOR_KEY),
     )
 
 
@@ -271,12 +362,18 @@ def merge_execution_metadata(
     feature_report: FeatureExtractionReport | Mapping[str, Any] | None = None,
     decision_traces: Sequence[DecisionTrace | Mapping[str, Any]] = (),
     approved_research: Mapping[str, Any] | None = None,
+    trusted_extractor: Mapping[str, Any] | None = None,
 ) -> dict[str, Any]:
     """Merge producer metadata without duplicating stable trace identifiers."""
 
     report = feature_report
     traces: list[DecisionTrace | Mapping[str, Any]] = []
     approved = approved_research
+    extractor_binding: Mapping[str, Any] | None = (
+        normalize_trusted_extractor_binding(trusted_extractor)
+        if trusted_extractor
+        else None
+    )
     for value in values:
         canonical = normalize_execution_metadata(value) if value else {}
         if canonical.get("feature_extraction_report") is not None:
@@ -284,6 +381,11 @@ def merge_execution_metadata(
         traces.extend(canonical.get("decision_traces", ()))
         if canonical.get(APPROVED_RESEARCH_KEY):
             approved = canonical[APPROVED_RESEARCH_KEY]
+        if canonical.get(TRUSTED_EXTRACTOR_KEY):
+            incoming_binding = canonical[TRUSTED_EXTRACTOR_KEY]
+            if extractor_binding is not None and dict(extractor_binding) != dict(incoming_binding):
+                raise ValueError("cannot merge conflicting trusted extractor bindings")
+            extractor_binding = incoming_binding
     traces.extend(decision_traces)
 
     deduplicated: dict[str, DecisionTrace] = {}
@@ -302,6 +404,7 @@ def merge_execution_metadata(
         report,
         [*deduplicated.values(), *anonymous],
         approved_research=approved,
+        trusted_extractor=extractor_binding,
     )
 
 
@@ -377,6 +480,13 @@ def execution_metadata_from_manifest(manifest: Mapping[str, Any]) -> dict[str, A
     return normalize_execution_metadata(_mapping(value, EXECUTION_METADATA_KEY))
 
 
+def trusted_extractor_from_manifest(manifest: Mapping[str, Any]) -> dict[str, Any]:
+    """Read the optional package binding; legacy packages return an empty mapping."""
+
+    metadata = execution_metadata_from_manifest(manifest)
+    return dict(metadata.get(TRUSTED_EXTRACTOR_KEY) or {})
+
+
 def manifest_with_execution_metadata(
     manifest: Mapping[str, Any], metadata: Mapping[str, Any]
 ) -> dict[str, Any]:
@@ -393,6 +503,7 @@ __all__ = [
     "EXECUTION_METADATA_KEY",
     "EXECUTION_METADATA_SCHEMA_VERSION",
     "APPROVED_RESEARCH_KEY",
+    "TRUSTED_EXTRACTOR_KEY",
     "execution_metadata_from_manifest",
     "make_decision_trace",
     "make_execution_metadata",
@@ -402,4 +513,6 @@ __all__ = [
     "merge_execution_metadata",
     "normalize_execution_metadata",
     "normalize_approved_research",
+    "normalize_trusted_extractor_binding",
+    "trusted_extractor_from_manifest",
 ]

gateway_app.py

@@ -93,6 +93,7 @@ from gateway_routing import (
     route_existing,
     route_prediction,
     route_uploaded,
+    trusted_gateway_extractor_choices,
 )
 
 
@@ -123,6 +124,7 @@ IMAGE_BACKBONE_CHOICES = [
     "resnet50",
     "densenet121",
     "efficientnet_b0",
+    *trusted_gateway_extractor_choices(),
 ]
 IMAGE_CLASSIFIER_CHOICES = [
     AUTO_CHOICE,
@@ -164,6 +166,7 @@ def _catalog() -> dict[str, Any]:
         "datasets": {
             "No datasets configured": {"targets": [], "image": False}
         },
+        "trusted_extractors": {},
     }
 
 
@@ -1790,6 +1793,11 @@ def existing_ui_handler(
     )
     if approved_research:
         payload["approved_research"] = dict(approved_research)
+        approved_config = dict(approved_research.get("pipeline_config") or {})
+        if approved_config.get("extractor_configuration") is not None:
+            payload["extractor_configuration"] = dict(
+                approved_config["extractor_configuration"]
+            )
     yield from run_existing_remote(payload, session_token, request)
 
 
@@ -1885,6 +1893,11 @@ def uploaded_ui_handler(
     )
     if approved_research:
         payload["approved_research"] = dict(approved_research)
+        approved_config = dict(approved_research.get("pipeline_config") or {})
+        if approved_config.get("extractor_configuration") is not None:
+            payload["extractor_configuration"] = dict(
+                approved_config["extractor_configuration"]
+            )
     yield from run_uploaded_remote(
         payload, train_file, test_file, session_token, request
     )
@@ -1923,7 +1936,7 @@ def parallel_existing_ui_handler(
         config.get("feature_selection_tool") or AUTOMATIC_SELECTION,
         config.get("transform_tool") or AUTOMATIC_SELECTION,
         config.get("ml_tool") or AUTOMATIC_SELECTION,
-        AUTO_CHOICE,
+        config.get("image_backbone") or AUTO_CHOICE,
         AUTO_CHOICE,
         AUTO_CHOICE,
         AUTO_DEVICE,
@@ -1939,6 +1952,10 @@ def parallel_existing_ui_handler(
     )
     if approved_research:
         payload["approved_research"] = dict(approved_research)
+        if config.get("extractor_configuration") is not None:
+            payload["extractor_configuration"] = dict(
+                config["extractor_configuration"]
+            )
     yield from run_existing_remote(payload, session_token, request)
 
 
@@ -2079,6 +2096,11 @@ def guided_run_ui_handler(
         active_ml = str(
             approved_config.get("ml_tool") or AUTOMATIC_SELECTION
         )
+        active_backbone = str(
+            approved_config.get("image_backbone")
+            or (image_backbone if source == "managed" else upload_backbone)
+            or AUTO_CHOICE
+        )
         state = _guided_snapshot_state(
             initial_state,
             data_source=source,
@@ -2115,7 +2137,7 @@ def guided_run_ui_handler(
             active_feature,
             active_transform,
             active_ml,
-            image_backbone,
+            active_backbone,
             image_classifier,
             image_size,
             image_device,
@@ -2147,7 +2169,7 @@ def guided_run_ui_handler(
             active_feature,
             active_transform,
             active_ml,
-            upload_backbone,
+            active_backbone,
             upload_classifier,
             upload_size,
             upload_device,

gateway_catalog.json

@@ -37,5 +37,45 @@
       ]
     }
   },
-  "schema_version": 1
+  "schema_version": 1,
+  "trusted_extractors": {
+    "trusted_tiny_onnx_v1": {
+      "allowed_configuration_fields": [
+        "image_size",
+        "mean",
+        "normalize",
+        "std"
+      ],
+      "devices": [
+        "cpu",
+        "cuda"
+      ],
+      "display_name": "Trusted Tiny ONNX Embedding",
+      "modality": "image",
+      "output_dimension": 8,
+      "tasks": [
+        "classification"
+      ],
+      "version": "1.0.0"
+    },
+    "trusted_tiny_torchscript_v1": {
+      "allowed_configuration_fields": [
+        "image_size",
+        "mean",
+        "normalize",
+        "std"
+      ],
+      "devices": [
+        "cpu",
+        "cuda"
+      ],
+      "display_name": "Trusted Tiny TorchScript Embedding",
+      "modality": "image",
+      "output_dimension": 8,
+      "tasks": [
+        "classification"
+      ],
+      "version": "1.0.0"
+    }
+  }
 }

gateway_contract.py

@@ -148,6 +148,21 @@ def validate_request(kind: str, value: str | Mapping[str, Any]) -> dict[str, Any
                 )
             except (TypeError, ValueError) as exc:
                 raise ContractError("approved_research is invalid.") from exc
+        if payload.get("extractor_configuration") is not None:
+            configuration = payload["extractor_configuration"]
+            if not isinstance(configuration, Mapping) or not all(
+                isinstance(key, str) for key in configuration
+            ):
+                raise ContractError("extractor_configuration must be a mapping.")
+            try:
+                copied_configuration = json.loads(
+                    json.dumps(dict(configuration), allow_nan=False)
+                )
+            except (TypeError, ValueError, OverflowError, RecursionError) as exc:
+                raise ContractError("extractor_configuration must be JSON-safe.") from exc
+            if len(json.dumps(copied_configuration).encode("utf-8")) > 32_768:
+                raise ContractError("extractor_configuration is too large.")
+            payload["extractor_configuration"] = copied_configuration
     elif "image_batch_size" in payload:
         payload["image_batch_size"] = _bounded_int(
             payload, "image_batch_size", 16
@@ -370,7 +385,14 @@ def load_gateway_catalog(path: str | Path) -> dict[str, Any]:
         raise ContractError("Gateway catalog datasets must be a JSON object.")
     if int(catalog.get("schema_version", 1)) != 1:
         raise ContractError("Unsupported gateway catalog schema version.")
-    normalized: dict[str, Any] = {"schema_version": 1, "datasets": {}}
+    raw_extractors = catalog.get("trusted_extractors", {})
+    if not isinstance(raw_extractors, dict):
+        raise ContractError("Gateway catalog trusted_extractors must be a JSON object.")
+    normalized: dict[str, Any] = {
+        "schema_version": 1,
+        "datasets": {},
+        "trusted_extractors": {},
+    }
     for name, metadata in catalog["datasets"].items():
         if not isinstance(metadata, dict):
             raise ContractError("Gateway catalog dataset metadata must be an object.")
@@ -381,6 +403,27 @@ def load_gateway_catalog(path: str | Path) -> dict[str, Any]:
             "targets": targets,
             "image": bool(metadata.get("image", False)),
         }
+    for extractor_id, metadata in raw_extractors.items():
+        if not isinstance(extractor_id, str) or not isinstance(metadata, dict):
+            raise ContractError("Gateway custom extractor metadata must be an object.")
+        required = {
+            "version",
+            "display_name",
+            "modality",
+            "tasks",
+            "devices",
+            "output_dimension",
+            "allowed_configuration_fields",
+        }
+        if set(metadata) != required:
+            raise ContractError("Gateway custom extractor metadata has an unsupported shape.")
+        if metadata["modality"] != "image":
+            raise ContractError("Gateway custom extractor modality must be image.")
+        if not isinstance(metadata["tasks"], list) or not set(metadata["tasks"]) <= {"classification"}:
+            raise ContractError("Gateway custom extractor tasks are invalid.")
+        if not isinstance(metadata["devices"], list) or not set(metadata["devices"]) <= {"cpu", "cuda"}:
+            raise ContractError("Gateway custom extractor devices are invalid.")
+        normalized["trusted_extractors"][extractor_id] = dict(metadata)
     return normalized
 
 

gateway_routing.py

@@ -6,7 +6,10 @@ shipped in the source-audited public gateway without pulling in ML code.
 
 from __future__ import annotations
 
+import json
+from functools import lru_cache
 from dataclasses import dataclass
+from pathlib import Path
 from typing import Any, Literal, Mapping
 
 
@@ -177,6 +180,64 @@ def _normalize(value: Any, aliases: Mapping[str, str], field: str) -> str:
         raise RoutingError(f"Unknown {field} value: {value!r}.") from exc
 
 
+@lru_cache(maxsize=1)
+def trusted_gateway_extractor_catalog() -> Mapping[str, Mapping[str, Any]]:
+    """Load the generated public-safe projection of the private registry."""
+
+    path = Path(__file__).resolve().with_name("gateway_catalog.json")
+    if not path.is_file():
+        return {}
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, json.JSONDecodeError):
+        return {}
+    raw = payload.get("trusted_extractors") if isinstance(payload, Mapping) else None
+    if not isinstance(raw, Mapping):
+        return {}
+    result: dict[str, Mapping[str, Any]] = {}
+    required = {
+        "version",
+        "display_name",
+        "modality",
+        "tasks",
+        "devices",
+        "output_dimension",
+        "allowed_configuration_fields",
+    }
+    for extractor_id, metadata in raw.items():
+        normalized_id = _token(extractor_id)
+        if normalized_id != extractor_id or not isinstance(metadata, Mapping):
+            continue
+        if set(metadata) != required:
+            continue
+        tasks = metadata.get("tasks")
+        devices = metadata.get("devices")
+        if (
+            metadata.get("modality") != "image"
+            or not isinstance(tasks, list)
+            or not set(tasks) <= {"classification"}
+            or not isinstance(devices, list)
+            or not devices
+            or not set(devices) <= {"cpu", "cuda"}
+        ):
+            continue
+        result[normalized_id] = dict(metadata)
+    return result
+
+
+def trusted_gateway_extractor_choices() -> tuple[str, ...]:
+    return tuple(sorted(trusted_gateway_extractor_catalog()))
+
+
+def _normalize_backbone(value: Any) -> str:
+    token = _token(value)
+    if token in _BACKBONE_ALIASES:
+        return _BACKBONE_ALIASES[token]
+    if token in trusted_gateway_extractor_catalog():
+        return token
+    raise RoutingError(f"Unknown image backbone value: {value!r}.")
+
+
 def _routing_mode(value: Any) -> str:
     mode = str(value or DUAL_ROUTING_MODE).strip().lower()
     if mode not in VALID_ROUTING_MODES:
@@ -193,9 +254,7 @@ def _normalized_image_fields(
     backend_key = "uploaded_image_backend" if uploaded else "image_backend"
     backend = _normalize(payload.get(backend_key), _BACKEND_ALIASES, "image backend")
     device = _normalize(payload.get("image_device"), _DEVICE_ALIASES, "image device")
-    backbone = _normalize(
-        payload.get("image_backbone"), _BACKBONE_ALIASES, "image backbone"
-    )
+    backbone = _normalize_backbone(payload.get("image_backbone"))
     preset = _normalize(
         payload.get("cancer_preset"), _PRESET_ALIASES, "cancer preset"
     )
@@ -250,6 +309,19 @@ def _normalized_image_fields(
     if effective_backend == "medical_agent" and preset != "auto":
         backbone = _PRESET_BACKBONES[preset]
 
+    custom_metadata = trusted_gateway_extractor_catalog().get(backbone)
+    if custom_metadata is not None:
+        if task not in custom_metadata["tasks"]:
+            raise RoutingError(
+                f"Registered custom extractor {backbone!r} does not support {task}."
+            )
+        supported_devices = set(custom_metadata["devices"])
+        requested_device = "cuda" if device == "cuda" else device
+        if requested_device != "auto" and requested_device not in supported_devices:
+            raise RoutingError(
+                f"Registered custom extractor {backbone!r} does not support {requested_device}."
+            )
+
     return {
         "task": task,
         "requested_backend": backend,
@@ -258,6 +330,7 @@ def _normalized_image_fields(
         "backbone": backbone,
         "preset": preset,
         "candidates": candidates,
+        "custom_devices": tuple(custom_metadata["devices"]) if custom_metadata else (),
     }
 
 
@@ -268,6 +341,7 @@ def _route_image(fields: Mapping[str, Any], mode: str) -> RouteDecision:
     device = str(fields["device"])
     backbone = str(fields["backbone"])
     candidates = tuple(fields["candidates"])
+    custom_devices = tuple(fields.get("custom_devices") or ())
 
     if mode == SINGLE_GPU_ROUTING_MODE:
         return RouteDecision(
@@ -316,6 +390,18 @@ def _route_image(fields: Mapping[str, Any], mode: str) -> RouteDecision:
             "all benchmark candidates are CPU-compatible and CPU was selected",
         )
     if backend == "medical_agent":
+        if custom_devices:
+            if device == "cpu" or (device == "auto" and "cuda" not in custom_devices):
+                return RouteDecision(
+                    CPU_PROFILE,
+                    "trusted_custom_extractor_cpu",
+                    "the registered custom extractor is assigned to private CPU execution",
+                )
+            return RouteDecision(
+                GPU_PROFILE,
+                "trusted_custom_extractor_gpu",
+                "the registered custom extractor is assigned to private GPU execution",
+            )
         if device == "cpu":
             return RouteDecision(
                 CPU_PROFILE,
@@ -329,6 +415,18 @@ def _route_image(fields: Mapping[str, Any], mode: str) -> RouteDecision:
         )
     if backend != "existing":
         raise RoutingError(f"Unsupported effective image backend: {backend!r}.")
+    if custom_devices:
+        if device == "cpu" or (device == "auto" and "cuda" not in custom_devices):
+            return RouteDecision(
+                CPU_PROFILE,
+                "trusted_custom_extractor_cpu",
+                "the registered custom extractor is assigned to private CPU execution",
+            )
+        return RouteDecision(
+            GPU_PROFILE,
+            "trusted_custom_extractor_gpu",
+            "the registered custom extractor is assigned to private GPU execution",
+        )
     if backbone in CPU_ONLY_BACKBONES:
         return RouteDecision(
             CPU_PROFILE,
@@ -439,6 +537,47 @@ def route_prediction(
             "gpu_package_required",
             "this model package requires the private GPU backend",
         )
+    execution_metadata = manifest.get("execution_metadata")
+    binding = (
+        execution_metadata.get("trusted_extractor")
+        if isinstance(execution_metadata, Mapping)
+        else None
+    )
+    if binding is not None:
+        if not isinstance(binding, Mapping):
+            raise RoutingError("Trusted extractor package binding is invalid.")
+        extractor_id = str(binding.get("extractor_id") or "").strip().lower()
+        custom_metadata = trusted_gateway_extractor_catalog().get(extractor_id)
+        if custom_metadata is None:
+            raise RoutingError("Model package references an unregistered custom extractor.")
+        supported_devices = set(custom_metadata["devices"])
+        if device == "cpu":
+            if "cpu" not in supported_devices:
+                raise RoutingError("Custom extractor package does not support CPU replay.")
+            return RouteDecision(
+                CPU_PROFILE,
+                "trusted_custom_package_cpu",
+                "registered custom extractor package replay uses private CPU",
+            )
+        if device == "cuda":
+            if "cuda" not in supported_devices:
+                raise RoutingError("Custom extractor package does not support CUDA replay.")
+            return RouteDecision(
+                GPU_PROFILE,
+                "trusted_custom_package_gpu",
+                "registered custom extractor package replay uses private GPU",
+            )
+        if "cuda" in supported_devices:
+            return RouteDecision(
+                GPU_PROFILE,
+                "trusted_custom_package_gpu",
+                "registered custom extractor package replay uses private GPU",
+            )
+        return RouteDecision(
+            CPU_PROFILE,
+            "trusted_custom_package_cpu",
+            "registered custom extractor package replay uses private CPU",
+        )
     if device == "cuda":
         return RouteDecision(
             GPU_PROFILE,