recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

review(redfix): post-reboot re-confirmation #7 — DONE stands, no VETO. Zero delta since #6 (Builder JOURNAL append only). New break-it probe: verified fix CONTENT (not just sha reachability) at every M2 anchor via cold bare clones — mattermost-lts 4ca7f418 adds backupbot.restore.post-hook, gitea a0f2db8 adds app.ini.init + docker-setup cp, bluesky-pds 4987ba9 adds FQ APP_HOST with no leftover bare app alias — each with its parent commit as a negative control (0 matches pre-fix). All 4 recipe fixes now content-anchored. All findings closed
Some checks failed
continuous-integration/drone/push Build is failing
Details

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHWWoceR5fHLTEwW8b3QnQ
This commit is contained in:
autonomic-bot
2026-07-08 23:42:52 +00:00
parent 7ac7eb078b
commit 4682aa1216
1 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
machine-docs/REVIEW-redfix.md
View File

@ -473,3 +473,33 @@ CLOSED). **No VETO.** The Builder is cleared to write `## DONE` to STATUS-redfix
reachable but still the right commits. Rot is confined to discourse (already CLOSED as F-redfix-3,
content re-verified at `ede6399`). No new finding; no gate reopened.
Terminal condition met (DONE + fresh PASS on every gate + no VETO). Loop stopped.
### Post-reboot re-confirmation #7 @2026-07-08T23:47Z — DONE stands, no VETO
Pulled: zero delta since #6 apart from a Builder JOURNAL append (`7ac7eb0`, wake #6, "Loop stopped").
`## DONE` still in STATUS-redfix.md; every gate has a fresh PASS; no VETO; no `ADVERSARY-INBOX.md`.
**Break-it probe (new angle — fix CONTENT, not sha reachability).** #6 proved the M2 evidence anchors
were still *reachable* with matching subjects. That is a weaker claim than "the fix is really there":
a reachable sha with a plausible subject could still carry no fix. So I cold `--bare` cloned each
recipe from `git.autonomic.zone/recipe-maintainers/` into a fresh scratch dir and grepped the TREE at
each asserted sha, with the parent commit as a negative control:
* **mattermost-lts @`4ca7f418`** — `compose.yml:63 backupbot.restore.post-hook: "/pg_backup.sh restore"`
present. Parent `4ca7f418^`: **0 matches**. The M1 root cause (missing restore post-hook) is exactly
what the fix commit adds. ✔
* **gitea @`a0f2db8`** — config target is `/etc/gitea/app.ini.init` (`compose.yml:9`) and
`docker-setup.sh.tmpl:27` does `cp /etc/gitea/app.ini.init /etc/gitea/app.ini`, i.e. the RO docker
config no longer overlays the file gitea must persist its JWT into. Parent: **0** occurrences of
`app.ini.init`. Matches the M1 read-only-file-system FATA root cause. ✔
* **bluesky-pds @`4987ba9`** — fix adds `APP_HOST=${STACK_NAME}_app` (fully-qualified swarm name);
diff vs parent is purely additive (parent has no `APP_HOST` at all), and a tree-wide grep at the fix
sha finds **no** leftover bare `- app` network alias. Matches the M1 `app`-alias collision root cause. ✔
Three for three: the asserted commits contain the asserted fixes, and their parents demonstrably do not
(so these are not vacuous greps against content that predates the fix). Combined with #6's anchor-
reachability result and F-redfix-3's content re-verification of discourse at `ede6399`, all four recipe
fixes are now content-anchored, not merely sha-anchored.
No new finding. No gate reopened. All findings CLOSED (F-redfix-1, F-redfix-2, F-redfix-3).
Terminal condition met (DONE + fresh PASS on every gate + no VETO). Loop stopped.