recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

status(redfix): accept A-redfix-2 + A-redfix-3 — correct the self-heal mechanism and retract the "both clones" evidence

Browse Source 
Both claims re-derived independently before editing; both of mine were wrong.

A-redfix-2: "no code path redeploys it" is FALSE. abra.undeploy() leaves the app
.env, so the next reconcile() takes the fresh-deploy branch (:471-479), which
redeploys and never calls warmsnap. Self-healing is blocked by the absence of a
re-trigger (warm-keycloak.service: Type=oneshot, RemainAfterExit=true, no timer,
no Restart=), so it heals on reboot/nixos-rebuild and RE-WEDGES on the next due
upgrade while the foreign snapshot/meta.json remains. Operator remediation is to
DELETE the foreign snapshot/, not to redeploy keycloak. Failure presents as an
intermittent flake, not a permanent outage.

A-redfix-3: /srv/cc-ci is a symlink to /srv/cc-ci-orch, so the two main.go paths
are the same inode (3254604, links=1). The "present in both clones" premise is
void and proves nothing about the file's origin (still unexplained; inert).

Docs-only. No DoD item, gate, or verdict affected: ## DONE stands, M1 + M2 PASS
stand, merge target b5f2b10 unchanged, no VETO. The B-redfix-5 merge precondition
is unchanged and still correct.
This commit is contained in:
autonomic-bot
2026-07-09 08:35:51 +00:00
parent 10576574c5
commit 8276ecdfe0
2 changed files with 84 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
machine-docs/JOURNAL-redfix.md
View File

@ -1748,3 +1748,37 @@ Both loops have now independently derived the same structure from source and agr
deferred, correctly scoped to both call sites; it still needs the operator's safety call (redeploy
`last_good` on unrestored data vs. die loudly), which is exactly why it was filed rather than fixed inline.
No VETO, no gate, no DoD item touched. Phase remains `## DONE`. B-redfix-8 untouched — operator rotation.
## Wake #43 (Builder) — 2026-07-09T08:3xZ — I accept A-redfix-2 and A-redfix-3; both of my claims were wrong
The Adversary probed two operator-facing claims I wrote (`68b51d5`, `42bc4e4`) and refuted both. I re-derived
each from source/node before editing — not taking the verdict on faith — and both hold up.
**A-redfix-2 (mechanism wrong, conclusion right).** I wrote "no code path redeploys it. Recovery is manual."
The conclusion (keycloak stays down) is right; the *reason* I gave is false. I reasoned from the absence of a
`try/except` around the `abra.undeploy()` sites and stopped there, never asking what the *next* invocation of
`reconcile()` does. It takes the fresh-deploy branch (`:471-479`): `abra.undeploy()` doesn't remove the app
`.env`, so `current_version` still resolves while `is_deployed` is False. That branch redeploys and never calls
`warmsnap`, so the foreign meta can't block it. What actually stops the healing is that nothing *re-runs* the
unit — `warm-keycloak.service` is `Type=oneshot`/`RemainAfterExit=true` with no timer and no `Restart=`
(confirmed on the node). So it heals on the next reboot/`nixos-rebuild switch` and **re-wedges on the next due
upgrade**, because the foreign `snapshot/meta.json` is still in the slot.
Why this correction matters and is not cosmetic: my wording implied the remedy was to *redeploy keycloak*. An
operator who did that would see it come back, conclude it was fixed, and get re-wedged at the next upgrade. The
actual remedy is **deleting the foreign `snapshot/`**. My text hid the recurrence and pointed at the wrong fix.
It also mis-describes the failure's *shape*: intermittent flake, not permanent outage.
**A-redfix-3 (evidence void).** I claimed `main.go` was in "both clones", inferring it was written by something
outside git. But `/srv/cc-ci` is a symlink to `/srv/cc-ci-orch` (`ls -la /srv/`) — the two paths are the same
inode (`3254604`, `links=1`). One file, seen twice. The inference carries zero information; the file's origin is
still unexplained. Lesson: I treated two *paths* as two *clones* without stat-ing them. Cheap check, skipped.
Both edits are docs-only, in STATUS-redfix.md. No DoD item, gate, or verdict is affected: `## DONE` stands,
M1 + M2 PASS stand, merge target `b5f2b10` unchanged, no VETO. The B-redfix-5 merge precondition itself is
unchanged and still correct — A-redfix-2 corrects only the mechanism + remediation sentences beneath it.
Also re-probed B-redfix-8 this wake with the sound (local, not `ssh`) probe: `3fcea78925015fc9` → **still
unrotated**, and the empty-input control printed `e3b0c44298fc1c14`, distinct — so the probe read the real file
rather than silently hashing nothing. B-redfix-8 remains OPEN/HIGH/operator-rotation-only. Class-A1 credential;
I must not rotate it.