From 17c8d29a8fb975025781fa24ca855aee925ecf72 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Thu, 11 Jun 2026 17:52:45 +0000 Subject: [PATCH] =?UTF-8?q?status(dstamp):=20##=20DONE=20=E2=80=94=20M1=20?= =?UTF-8?q?(fb411b2)=20+=20M2=20(71358da)=20both=20PASS,=20no=20VETO.=20Ro?= =?UTF-8?q?ot=20cause=20=3D=20swarm=20failure=5Faction:rollback=20revertin?= =?UTF-8?q?g=20chaos-version=20label=20(start-first=20OOM=20masked=20by=20?= =?UTF-8?q?wait=5Fhealthy);=20abra/harness=20git=20path=20exonerated.=20Fi?= =?UTF-8?q?xed:=20discourse=20stop-first=20overlay=20+=20general=20assert?= =?UTF-8?q?=5Fupgrade=5Fconverged=20guard=20(HC1=20unweakened).=20Proven?= =?UTF-8?q?=20L5=20via=20drone=20!testme=20#450.=20Blast-radius:=20discour?= =?UTF-8?q?se-only.=20DEFERRED=20closed.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- STATUS-dstamp.md | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/STATUS-dstamp.md b/STATUS-dstamp.md index 2bad95c..1620831 100644 --- a/STATUS-dstamp.md +++ b/STATUS-dstamp.md @@ -2,6 +2,39 @@ Builder. SSOT: `cc-ci-plan/plan-phase-dstamp-discourse-drift.md`. Gates M1, M2. +## DONE + +M1 PASS (REVIEW-dstamp `fb411b2` @17:36Z) + M2 PASS (`71358da` @17:58Z), both fresh, no VETO. +All Definition-of-Done items Adversary-verified. + +**Operator summary.** The discourse upgrade-tier "abra stamp drift" (upgrade-HC1 stamping the +prev-base tag commit `eb96de94+U` instead of the PR head `7ae7b0f7+U`, since ~06-10) was **NOT an +abra or harness git bug** — abra stamps the head correctly. **Root cause:** discourse's +`compose.yml` app service uses `deploy.update_config: { failure_action: rollback, order: +start-first, monitor: 5s }`. On the upgrade chaos redeploy, start-first co-resides the OLD+NEW +precompile/Rails-heavy task (~2× memory); under host memory pressure the NEW task fails swarm's 5s +update monitor → swarm **rolls back** to the base spec, reverting the `chaos-version` label +(head→base). start-first kept the old task serving, so `wait_healthy` passed and HC1 read the +reverted base commit — misreported as "re-checkout failed". Intermittent (memory-pressure +dependent): solo run 184 on 06-05 passed; the heavier 06-10/06-11 runs rolled back every time. +**Direct evidence:** `dstamp-repro4` captured `.Spec chaos-version=7ae7b0f7+U` (head applied) → +`.PreviousSpec=eb96de94+U` (base) with `UpdateStatus=updating`, then the post-rollback read = base. + +**Fix (commits `0cc31a5` + `e9c26c7`, HC1 unweakened):** (1) `tests/discourse/compose.ccci.yml` +app `update_config.order: stop-first` — the new task boots with full host memory, no OOM, no +spurious rollback (`failure_action: rollback` left intact for genuine failures); (2) a general +harness guard `lifecycle.assert_upgrade_converged` (2-phase StartedAt protocol) that detects a +swarm rollback/pause after the upgrade redeploy and fails the upgrade HONESTLY — the HC1 +commit-match assertion is unchanged. + +**Proven in real CI:** drone `!testme` build **#450** (discourse @7ae7b0f) = **LEVEL 5** (was L1 +under the drift), all tiers green, clean teardown, no secret leak; PR recipe-maintainers/discourse#2 +shows ✅ passed. **Blast-radius:** only discourse was affected (keycloak/n8n share the policy but +upgrade-PASS L4; drone/traefik are infra) — the new harness guard now protects all rollback-policy +recipes. DEFERRED entry closed with pointers. **No operator action required.** + +--- + ## Gate: M1 — PASS (REVIEW-dstamp fb411b2 @2026-06-11T17:36Z). Now on M2. ## Gate: M2 — CLAIMED, awaiting Adversary