From 4d40af102fb0acbe83e377765c386d7674b9f8fd Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Thu, 9 Jul 2026 10:23:29 +0000 Subject: [PATCH] =?UTF-8?q?review(redfix):=20wake=20#54=20=E2=80=94=20cold?= =?UTF-8?q?=20re-verify=20on=20closed=20phase;=20DONE=20+=20no-VETO=20reaf?= =?UTF-8?q?firmed;=20'never=20deploy=2007fc6d4'=20invariant=20HOLDS=20on?= =?UTF-8?q?=20the=20live=20node=20(07fc6d4=20not=20an=20ancestor=20of=20de?= =?UTF-8?q?ployed=20HEAD=20d11f8f5;=20keycloak=20WARM=5FCANONICAL=3DFalse?= =?UTF-8?q?=20is=20a=20real=20assignment).=20STATUS=20mechanism=20CORRECTE?= =?UTF-8?q?D:=20sweep=20runs=20deployed=20/etc/cc-ci,=20not=20origin/main?= =?UTF-8?q?=20=E2=80=94=20guarantee=20is=20a=20property=20of=20what=20is?= =?UTF-8?q?=20deployed.=20No=20gate=20impact.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- machine-docs/REVIEW-redfix.md | 38 +++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md index 3ca4c86..063e8d0 100644 --- a/machine-docs/REVIEW-redfix.md +++ b/machine-docs/REVIEW-redfix.md @@ -1592,3 +1592,41 @@ the single file) is insufficient and rotation alone re-exposes the new value. It (remove userinfo from git's URL layer; use a 0600 credential helper) but touches **no gate / no DoD item** — the dashboard invariant holds and this is host-local FS exposure inside existing operator-only A-redfix-1/ B-redfix-8 scope. **No VETO; `## DONE` stands.** + +--- + +## Wake #54 @2026-07-09T10:2xZ — cold re-verify on closed phase; "never deploy `07fc6d4`" invariant HOLDS (mechanism corrected) + +Reboot on a closed phase. Re-confirmed cold, no reliance on prior notes: `## DONE` stands in +STATUS-redfix.md; the two `## VETO` headings in this file remain historical (one CLEARED, one the +clearing record) — **no standing VETO**; no `ADVERSARY-INBOX.md`; local `HEAD == origin/main` +(`4c62cd0`), zero Builder commits since my last verdict. No gate pending. + +Rather than idle-re-verify a settled gate, I probed the one thing that could **drift** on a closed +phase: the B-redfix-5 precondition, re-anchored at wake #44 to **"never deploy `07fc6d4`"**. + +**Verdict: the invariant HOLDS. The trap is not armed.** But STATUS's stated *mechanism* is loose, +and I record the correction: + +- STATUS says the wedge is disarmed because "*`origin/main`, the tree the sweep runs*, has + `WARM_CANONICAL = False`." **The sweep does not run `origin/main`.** Grepping the callee rather + than the claim: `nightly-sweep.service` ExecStart is a nix-store wrapper that sets + `CCCI_REPO=/etc/cc-ci` and `exec`s `cc-ci-run "$CCCI_REPO/runner/nightly_sweep.py"`. The tree that + actually executes is the **deployed checkout `/etc/cc-ci`**, currently branch `main` @ `d11f8f5`, + working tree **clean**. +- Against that real tree, the load-bearing fact checks out: `tests/keycloak/recipe_meta.py:16` is a + genuine assignment `WARM_CANONICAL = False` (not merely the prose "stays False" in the comment at + line 15 — I confirmed the assignment separately, since a comment is not a value). +- `07fc6d4` **exists** as a commit object in that repo but is **NOT an ancestor of the deployed + HEAD** (`git merge-base --is-ancestor 07fc6d4 HEAD` → false). The precondition is satisfied on the + live node, not just in the plan. +- `nightly-sweep.timer` is live (last fired 2026-07-05T03:04Z, next 2026-07-12T03:05Z), so A-redfix-4's + "recurring, silent" characterisation stands — the disarm rests on tree content, not on the timer + being dormant. + +**Impact: none on any gate or DoD item.** The conclusion STATUS draws is correct; only its reasoning +about *which* tree confers the guarantee was wrong. That distinction matters for the operator: the +guarantee is a property of **what is deployed to `/etc/cc-ci`**, so a future deploy — not a merge to +`origin/main` — is what could arm the wedge. Recorded as a precision fix, not a defect. + +`## DONE` stands. No VETO. Loop stopped; terminal state re-verified.