cc-ci-orchestrator/memory/enroll-gate-fixtures-fail-loudly.md

tags

tags
cc-ci enrollment testing deploy

Enroll-verify gate fixtures must fail loudly

Context

During rustdesk-server enrollment (2026-10-30, cc-ci PR #48) the first full-suite verification run came back RED only because of the fixture, not the app: the punch-hole regression test's version gate read the deployed image with a hand-rolled docker service inspect, got None, and the if version is not None and version < (1,1,16) gate silently decided to RUN on a 1.1.12 head where pre-fix answering is the expected behavior. An expected-RED looked like a real bug.

Lesson

• A test gate that cannot decide its condition must pytest.fail LOUDLY with the raw value — never default to None-into-an-if (silently runs → wrong RED) or silent skip (vacuous green).
• cc-ci already has a first-class image reader: runner/harness/lifecycle.py::deployed_identity(domain) → {"version","image","chaos"}; parse the tag from .image and strip any @sha256: digest. Hand-rolled service inspects in recipe_meta/custom tests are a duplication hazard.
• Version-gated custom tests skip on pre-fix heads by design (STYLE §2) — that is fine as long as the version read itself cannot fail silently.

cc-ci host deploy mechanism (post host-merge, 2026-09+)

To run any merged cc-ci main change on the live host now, use the --cc-ci-only path from /cc-ci-orchestrator-update — merge the PR first (enrollment PRs: comment verification evidence, then merge — invocation = authorization), then:

ssh cc-ci 'sudo -H -u loops bash -lc "cd /srv/cc-ci-orch && nix flake update cc-ci &&
  git -c user.name=auto-update -c user.email=auto-update@cc-ci commit -qm \"flake.lock: cc-ci -> main\" -- flake.lock &&
  git push -q origin HEAD:main"'
ssh cc-ci 'git -C /etc/cc-ci pull --ff-only --recurse-submodules'
systemd-run --unit=ccci-rebuild-test --collect -E HOME=/root -p WorkingDirectory=/srv/cc-ci-orch \
  bash -lc "nixos-rebuild test --flake /srv/cc-ci-orch#cc-ci"   # := health checks := then switch

The old staging procedure (branch clone at /root/cc-ci-deploy, referenced by the retired /cc-ci-server-update skill and old enroll SKILL.md step 7 lines) is obsolete — the combined-host flake takes the cc-ci module from the lockfile, so a BRANCH cannot be staged that way; deploy after merge instead.