From 3c63f3c6d3d4a422f1a589defeed0ae9caae15c6 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Thu, 9 Jul 2026 00:20:54 +0000 Subject: [PATCH] =?UTF-8?q?status(redfix):=20##=20DONE=20re-asserted=20?= =?UTF-8?q?=E2=80=94=20M2=20PASS=20@2026-07-09T00:18Z,=20VETO=20CLEARED,?= =?UTF-8?q?=20F-redfix-4=20CLOSED;=20merge=20target=20redfix-m2-harness@b5?= =?UTF-8?q?f2b10;=20B-redfix-5=20recorded=20in=20DEFERRED.md?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01FS8p1esg57UAC69riNvuBX --- machine-docs/DEFERRED.md | 17 +++++++++++++++++ machine-docs/STATUS-redfix.md | 29 +++++++++++++++++++++++++---- 2 files changed, 42 insertions(+), 4 deletions(-) diff --git a/machine-docs/DEFERRED.md b/machine-docs/DEFERRED.md index 1bb9bef..ebf1a38 100644 --- a/machine-docs/DEFERRED.md +++ b/machine-docs/DEFERRED.md @@ -427,3 +427,20 @@ reachable via the operator/dev STAGES escape — production drone runs always ru key on stdout (write to a run-scoped sidecar the test reads), or register the minted key in the harness redaction set so even the RAW log is scrubbed. Low priority (RAW log is access-controlled; key is ephemeral). - **Filed by:** Builder, phase prevb (acknowledging Adversary [F-prevb-C]). + +## B-redfix-5 — warm reconciler's rollback `restore()` is outside the upgrade's `try/except` + +- **What:** in `runner/warm_reconcile.py`, the unhealthy-rollback path is `abra.undeploy(domain)` → + `wait_undeployed` → `warmsnap.restore(...)` → `deploy_version(last_good)`. `restore()` sits OUTSIDE the + `try/except` guarding the upgrade, so if it raises for any reason (absent/corrupt snapshot, docker error) + the exception propagates and `deploy_version(last_good)` never runs — live keycloak is left **undeployed**, + taking down the shared OIDC provider `lasuite-*`/`drone` depend on. +- **Why deferred, not fixed:** structural gap, present at `07fc6d4` and predating the keycloak enrollment. + F-redfix-4 supplied the only *reachable* trigger (the shared snapshot slot) and that is now closed at + `b5f2b10`. Not part of F-redfix-4's published clearing condition; the Adversary explicitly concurred it is + **not a VETO** and was "correctly filed rather than silently fixed". +- **Needed from operator:** decide the safe behaviour for a DB-backed app after a forward migration — + (a) redeploy `last_good` anyway even though data was not restored, or (b) die loudly + leave a breadcrumb + rather than start on unrestored data. That trade-off is a real safety call, not a mechanical fix, which is + why it was not settled inside a remediation commit. +- **Filed by:** Builder, phase redfix (from Adversary F-redfix-4 consequence 3). diff --git a/machine-docs/STATUS-redfix.md b/machine-docs/STATUS-redfix.md index fbd72fb..ae9f649 100644 --- a/machine-docs/STATUS-redfix.md +++ b/machine-docs/STATUS-redfix.md @@ -7,10 +7,31 @@ gitea, keycloak) → isolate → root-cause → classify (flake vs genuine; reci warm-machinery vs load) → FIX each (recipe PR or harness improvement) → verify green. No standing exceptions. Nothing merged. -## Gate: M2 RE-CLAIMED (F-redfix-4 remedy), awaiting Adversary — 2026-07-09 +## DONE — 2026-07-09T00:18Z -Prior DONE was withdrawn under the standing VETO F-redfix-4 (REVIEW-redfix.md re-confirmation #8 -@2026-07-08T23:56Z). The remedy is in. Re-claiming M2 for the keycloak item only. +Phase `redfix` COMPLETE. All six canon-sweep failures investigated in isolation, root-caused, classified, +**FIXED — each via a recipe PR or a harness improvement — and verified green**; no recipe left as a standing +exception; nothing merged (operator merges). Every gate has a fresh Adversary PASS in REVIEW-redfix.md and +there is **no standing VETO**: +- **M1 PASS** @ 2026-06-18T01:18Z (investigation/classification cold-verified). +- **M2 PASS** @ 2026-07-09T00:18Z (F-redfix-4 remedy cold-verified; VETO CLEARED; supersedes the + 2026-06-18T07:06Z M2 PASS, which was given against parent `07fc6d4`). + +Adversary findings F-redfix-1/2/3/4 are all **CLOSED**; no open blocking finding. + +**Merge target: `redfix-m2-harness` @ `b5f2b10`** (not `07fc6d4` — that tip carries the F-redfix-4 defect). +The earlier `## DONE` of 2026-06-18T07:09Z was **withdrawn** on 2026-07-09 under the standing VETO +F-redfix-4 and is re-asserted here only after the remedy was Adversary-verified. Details of that cycle, +and the still-open non-blocking B-redfix-5, are below. + +One deferred, non-blocking item remains recorded (NOT part of any DoD item, NOT a standing finding): +**B-redfix-5** in BACKLOG-redfix.md — `warm_reconcile.py`'s rollback `warmsnap.restore()` sits outside the +upgrade's `try/except`. Pre-dates the enrollment (present at `07fc6d4`); F-redfix-4 supplied the only +*reachable* trigger and that is now closed. Adversary concurred it is not a VETO. + +--- + +### F-redfix-4 remedy (the reason DONE was withdrawn and re-asserted) — 2026-07-09 **WHAT.** F-redfix-4 is fixed at `redfix-m2-harness` @ **`b5f2b10`** (parent `07fc6d4`, the sha the M2 PASS was given against). Warm state is now keyed by a **stack namespace**, not a bare recipe: @@ -107,7 +128,7 @@ The prior DONE text is retained verbatim below as the historical record of what --- -## (HISTORICAL — superseded by the withdrawal above) DONE — 2026-06-18T07:09Z +## (HISTORICAL — withdrawn 2026-07-09 under VETO F-redfix-4; superseded by the DONE above) DONE — 2026-06-18T07:09Z Phase `redfix` COMPLETE. All six canon-sweep failures investigated in isolation, root-caused, classified, **FIXED — each via a recipe PR or a harness improvement — and verified green**; no recipe