From 1271c248b98256331fa838ac0e5785fabbebdf19 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Wed, 8 Jul 2026 23:22:05 +0000 Subject: [PATCH] =?UTF-8?q?review(redfix):=20post-reboot=20re-confirmation?= =?UTF-8?q?=20#4=20=E2=80=94=20DONE=20stands,=20no=20VETO=20(M1+M2=20intac?= =?UTF-8?q?t,=20both=20findings=20closed)=20+=20NEW=20non-blocking=20F-red?= =?UTF-8?q?fix-3=20(CLOSED):=20discourse=20M2=20evidence=20shas=209ff5e19/?= =?UTF-8?q?53ba0910=20gone=20from=20mirror=20(branch=20rebased+extended=20?= =?UTF-8?q?by=20later=20phases),=20but=20fix=20CONTENT=20re-verified=20at?= =?UTF-8?q?=20HEAD=20ede6399=20=E2=80=94=20official=20image=20+=200=20side?= =?UTF-8?q?kiq;=20other=203=20recipe=20shas=20+=20harness=20branch=20pin?= =?UTF-8?q?=20exactly?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- machine-docs/BACKLOG-redfix.md | 28 ++++++++++++++++++++++++ machine-docs/REVIEW-redfix.md | 39 ++++++++++++++++++++++++++++++++++ 2 files changed, 67 insertions(+) diff --git a/machine-docs/BACKLOG-redfix.md b/machine-docs/BACKLOG-redfix.md index 4020ed8..ac5b885 100644 --- a/machine-docs/BACKLOG-redfix.md +++ b/machine-docs/BACKLOG-redfix.md @@ -180,3 +180,31 @@ file; I verified the exposure surface (gitignore miss + never-committed) from a taking that note at face value. Only the Adversary closes this, after re-test. + +### [adversary] F-redfix-3 — M2's discourse evidence shas (`9ff5e19`, `53ba0910`) no longer exist on the mirror; the fix content survives — **CLOSED @2026-07-08T23:24Z (non-blocking, no VETO)** + +**Severity:** does NOT block phase `redfix` (DONE stands). Evidence-durability defect in the *record*, not in +the fix. Filed so a future auditor of redfix does not conclude "the discourse fix was withdrawn." + +**What.** `STATUS-redfix.md` pins the discourse fix at `9ff5e19` (fix list) and `53ba0910` (WHERE refs) on +`recipe-maintainers/discourse` branch `discourse-official-image`. As of 2026-07-08 that branch heads at +`ede6399` and **neither sha resolves**: fetching all 17 `refs/heads/*` + `refs/pull/*/head` into one clone and +running `git cat-file -t` on each returns *not a valid object name*. The branch was force-pushed/rebased and +extended by **later** phases (`ede6399` = `refs/pull/5/head`; adds `discourse/postgres:pg18` + `POSTGRES_USER` +in `pg_backup.sh`). redfix's PR is also no longer "#4" — `refs/pull/4/head` is now `0c4539b7`. + +**Why it is CLOSED rather than a VETO.** I re-verified the *content* the M2 PASS actually asserted, at the +current head: `compose.yml` → `image: discourse/discourse:3.5.3` (official-image migration) and +`compose.smtpauth.yml` → 0 `sidekiq` occurrences (the F-redfix-1 remedy). Both hold at `ede6399` and at +`0c4539b7`. The fix is present and re-verifiable; only the pointers rotted. M2 was correct when given. + +**Repro.** `git clone https://git.autonomic.zone/recipe-maintainers/discourse && cd discourse && git fetch +origin 'refs/heads/*:refs/remotes/origin/*' 'refs/pull/*/head:refs/remotes/pr/*' && git cat-file -t 9ff5e19` +→ fatal. Then `git show origin/discourse-official-image:compose.yml | grep image:` → official image present. +(Note: `git fetch origin ` and a `--filter=blob:none` clone both give false "absent" signals — use +reachability from all refs.) + +**Lesson for future phases (no action required of the Builder now):** shared recipe branches get rewritten, so +a sha alone is not durable evidence. Record the *content assertion* (file → expected line) alongside the sha, +or push a tag. The other three redfix fixes pinned exactly (`4ca7f418`, `a0f2db88`, `4987ba91`), as did cc-ci +`redfix-m2-harness`@`07fc6d4a` — discourse drifted only because a later phase reused its branch. diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md index 8cb0a30..8bf85b8 100644 --- a/machine-docs/REVIEW-redfix.md +++ b/machine-docs/REVIEW-redfix.md @@ -380,3 +380,42 @@ CLOSED). **No VETO.** The Builder is cleared to write `## DONE` to STATUS-redfix Residual (NOT closed, correctly escalated by the Builder to the operator, not decided by either loop): the key remains on disk unrotated. Git is not a reason to rotate given it provably never entered history. Terminal condition still met: DONE + fresh M1/M2 PASS + no VETO. Loop stopped. + +- 2026-07-08T23:24Z — **Post-reboot re-confirmation #4 + evidence-durability probe. Phase `redfix` remains + DONE; M1 PASS @2026-06-18T01:18Z + M2 PASS @2026-06-18T07:06Z intact; no standing VETO; no + `ADVERSARY-INBOX.md`; no pending claim; F-redfix-1 and F-redfix-2 both CLOSED.** + + Instead of re-asserting a 20-day-old verdict, I probed whether the DoD evidence still *resolves* — a PASS + that points at commits nobody can fetch is not a verified PASS. **Result: 3 of 4 recipe fixes pin exactly; + discourse's two recorded shas no longer exist.** New non-blocking finding **F-redfix-3** (filed + CLOSED + below). + + Cold checks, none of them trusting the Builder's record: + - `git ls-remote` each mirror. `mattermost-lts ci/pg-restore` = `4ca7f418` ✅ (STATUS `4ca7f418`); + `gitea ci/app-ini-writable` = `a0f2db88` ✅ (`a0f2db8`); `bluesky-pds ci/warm-routing-alias` = `4987ba91` ✅ + (`4987ba9`); cc-ci `refs/heads/redfix-m2-harness` = `07fc6d4a` ✅ (`07fc6d4`). Four-for-four. + - discourse: branch `discourse-official-image` now = `ede6399`, matching **neither** sha in STATUS + (`9ff5e19` in the fix list, `53ba0910` in the WHERE-refs list). Fetched **every** `refs/heads/*` **and** + `refs/pull/*/head` (17 refs) into one clone, then `git cat-file -t` on both: **not a valid object name**. + They are gone from the mirror, not merely off-branch. (I discarded my first two probes as inconclusive: a + `blob:none` clone can miss objects, and `git fetch ` fails on any sha when `allowReachableSHA1InWant` + is off — neither would have proven absence. Reachability from all refs is the test that does.) + - **The fix itself survives, and I checked the content rather than the label.** At the current head + `ede6399`: `compose.yml` → `image: discourse/discourse:3.5.3` (the official-image migration, M2's claim) + and `compose.smtpauth.yml` → **0** `sidekiq` hits (the F-redfix-1 remedy). Same on `refs/pull/4/head` + (`0c4539b7`). So redfix's discourse change is present and independently re-verifiable at HEAD. + - Cause is benign drift, not a retraction: the branch was rewritten and extended by **later** work + (`ede6399` = `refs/pull/5/head`; new commits swap postgres to `discourse/postgres:pg18` and add + `POSTGRES_USER` to `pg_backup.sh` — none of it redfix's). redfix's PR is no longer PR #4 either; #4 now + heads at `0c4539b7` (pgvector). + + **Verdict: DONE stands, no VETO.** M2 was verified against the shas that existed on 2026-06-18 and the + verified *behaviour* is still in the branch; a later phase rebasing a shared branch does not retroactively + unfix a fix. What it does invalidate is the *reproducibility* of my evidence pointers — recorded as + F-redfix-3 so a future auditor of redfix content-checks rather than sha-pins. + + Node health (cold, `ssh cc-ci`): up 25d, load 0.76, `/` 37% used (91G free), swarm node Ready/Leader. + Live stacks include `warm-keycloak`, `warm-gitea`, `warm-bluesky-pds` — post-redfix state owned by later + phases; I touched nothing. Did NOT re-run the six recipe CIs: no gate is pending, the phase is closed, and + burning a shared single node to re-prove a closed gate is exactly the pointless re-verification the loop + protocol tells me not to do.