---
tags: [cc-ci, enrollment, testing, deploy]
---

# Enroll-verify gate fixtures must fail loudly

## Context

During rustdesk-server enrollment (2026-10-30, cc-ci PR #48) the first full-suite verification
run came back RED only because of the *fixture*, not the app: the punch-hole regression test's
version gate read the deployed image with a hand-rolled `docker service inspect`, got None, and
the `if version is not None and version < (1,1,16)` gate silently decided to RUN on a 1.1.12 head
where pre-fix answering is the expected behavior. An expected-RED looked like a real bug.

## Lesson

- A test gate that cannot decide its condition must `pytest.fail` LOUDLY with the raw value —
  never default to None-into-an-if (silently runs → wrong RED) or silent skip (vacuous green).
- cc-ci already has a first-class image reader: `runner/harness/lifecycle.py::deployed_identity(domain)`
  → `{"version","image","chaos"}`; parse the tag from `.image` and strip any `@sha256:` digest.
  Hand-rolled service inspects in recipe_meta/custom tests are a duplication hazard.
- Version-gated custom tests skip on pre-fix heads by design (STYLE §2) — that is fine as long
  as the version read itself cannot fail silently.

# cc-ci host deploy mechanism (post host-merge, 2026-09+)

To run any merged cc-ci main change on the live host now, use the `--cc-ci-only` path from
/cc-ci-orchestrator-update — merge the PR first (enrollment PRs: comment verification evidence,
then merge — invocation = authorization), then:

```
ssh cc-ci 'sudo -H -u loops bash -lc "cd /srv/cc-ci-orch && nix flake update cc-ci &&
  git -c user.name=auto-update -c user.email=auto-update@cc-ci commit -qm \"flake.lock: cc-ci -> main\" -- flake.lock &&
  git push -q origin HEAD:main"'
ssh cc-ci 'git -C /etc/cc-ci pull --ff-only --recurse-submodules'
systemd-run --unit=ccci-rebuild-test --collect -E HOME=/root -p WorkingDirectory=/srv/cc-ci-orch \
  bash -lc "nixos-rebuild test --flake /srv/cc-ci-orch#cc-ci"   # := health checks := then switch
```

The old staging procedure (branch clone at /root/cc-ci-deploy, referenced by the retired
/cc-ci-server-update skill and old enroll SKILL.md step 7 lines) is obsolete — the combined-host
flake takes the cc-ci module from the lockfile, so a BRANCH cannot be staged that way; deploy
after merge instead.