From 83758f5e718ef9369e5f10924c89ab8c9db6aa12 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Thu, 9 Jul 2026 00:57:59 +0000 Subject: [PATCH] =?UTF-8?q?review(redfix):=20break-it=20probe=20=E2=80=94?= =?UTF-8?q?=20F-redfix-4=20remedy=20verified=20against=20REAL=20cc-ci=20di?= =?UTF-8?q?sk=20state;=20no=20defect;=20DONE=20stands,=20no=20VETO?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Probed the one claim in b5f2b10 that is empirical rather than diff-checkable: "no migration on cc-ci; keycloak's canonical was never seeded". If false, the new _assert_slot_not_foreign() guard would wedge the live-warm reconciler's snapshot() on every stateful keycloak auto-upgrade. Cold, read-only on cc-ci: keycloak/ + traefik/ hold only last_good (never seeded — claim TRUE); all 17 existing canonical metas carry domain=warm- and none is in WARM_DOMAINS, so the guard passes unchanged (backward compatible); the dropped meta["recipe"] key has no consumer; slot<->stack is 1:1 over all 21 enrolled recipes with live/canonical disjoint exactly for WARM_DOMAINS; prune_stale's keep-set covers all 17 dirs and skips keycloak/ structurally. No new finding. Merge target redfix-m2-harness@b5f2b10 unchanged. Loop stopped. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01AYMsxDCEMh92Qvgf38PjEU --- machine-docs/REVIEW-redfix.md | 46 +++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md index 80ef55c..3474b98 100644 --- a/machine-docs/REVIEW-redfix.md +++ b/machine-docs/REVIEW-redfix.md @@ -651,3 +651,49 @@ live `warm-keycloak…/realms/master` → **200** throughout. M2 keycloak item: **PASS**. All six recipes now have a fresh Adversary PASS; F-redfix-1/2/3/4 all CLOSED; no open blocking finding. The Builder may re-assert `## DONE`. JOURNAL not consulted before this verdict. + +### Post-reboot re-confirmation #11 @2026-07-09T00:58Z — DONE stands, no VETO. Break-it probe: F-redfix-4 remedy vs. REAL cc-ci disk state — **no defect found** + +Terminal state re-checked cold: `## DONE` in STATUS-redfix.md; M1 PASS @2026-06-18T01:18Z + M2 PASS +@2026-07-09T00:18Z; no standing VETO (the `## VETO` heading is annotated CLEARED); no +`ADVERSARY-INBOX.md`; `redfix` is still the newest phase plan (mtime 2026-06-17). Merge target +`redfix-m2-harness` @ `b5f2b10` resolves and is the pushed branch tip; origin/main @ `0539c46`. + +**Probe angle (new, not covered by #4–#8).** Prior probes checked evidence-sha *reachability* (#4/#6), +fix *content* vs parent (#7), and the keycloak slot collision itself (#8, → F-redfix-4). None tested the +remedy's **migration claim**, which is an empirical assertion about cc-ci's disk, not about the diff: +b5f2b10's message claims "zero on-disk change for the existing canonicals, and no migration on cc-ci +(keycloak's canonical was never seeded: its dir holds only last_good)". If that were false, the NEW +`warmsnap._assert_slot_not_foreign()` guard would make the live-warm reconciler's `snapshot()` raise on +every stateful keycloak auto-upgrade — a fail-closed but self-inflicted wedge of the shared OIDC provider, +introduced by the very commit that fixes F-redfix-4. Worth breaking. + +**Cold evidence (read-only, `ssh cc-ci`, nothing mutated).** +1. `find /var/lib/ci-warm -maxdepth 2` — **17** canonical dirs each with `canonical.json` + `snapshot/`; + `keycloak/` and `traefik/` hold **only `last_good`** — no `snapshot/`, no `canonical.json`. The + Builder's "never seeded" claim is **TRUE as observed**, not merely asserted. +2. Read all 17 `snapshot/meta.json`: every one carries `"domain": "warm-.ci.commoninternet.net"` + and the legacy `"recipe"` key. None of those 17 recipes is in `warm.WARM_DOMAINS` (which is + `{keycloak}` alone), so post-fix `canonical_slot(r) == r` and `canonical_domain(r) == warm-…` — the + guard compares `meta["domain"] == domain` and passes. **Backward compatible; no migration needed.** +3. The removed `meta["recipe"]` key is vestigial: `git grep` over b5f2b10 shows **no consumer** reads it + (the `"recipe"` hits in canonical.py/results.py/deps.py are the *registry*/results/deps records, a + different file). So dropping it for `"slot"` regresses nothing. +4. Re-derived the invariants directly against the real on-disk/enrolled sets (worktree at b5f2b10, no + pytest needed — pure path logic): slot↔stack is 1:1 across all 21 enrolled recipes; live/canonical + slots are disjoint **exactly** for `WARM_DOMAINS` (`keycloak → canon-keycloak` vs `keycloak`); all 17 + legacy metas pass the guard; the empty `keycloak/` slot is free to claim while a *foreign* canonical + meta planted there is refused in both `snapshot()` and `restore()`. +5. `prune_stale()` blast radius: enrolled = 21, so `keep = {canonical_slot(r)}` covers **all 17** on-disk + dirs → prunes nothing. `keycloak/` is skipped **structurally** (no `canonical.json`), so the + reconciler's `last_good` cannot be `rmtree`'d — the claimed consequence-4 invariant holds on real disk, + and `prune_stale` derives the stale stack's volumes from `warm.stable_domain()`, so pruning a + `canon-keycloak/` canonical would remove `warm-canon-keycloak…` volumes, never the live `warm-keycloak…` + ones. + +**Verdict: no new finding. DONE stands, no VETO.** The F-redfix-4 remedy at `b5f2b10` is safe to merge +against cc-ci's actual state; its "no migration" claim is verified, not taken on trust. Node left +untouched (read-only `find`/`head`; probe worktree removed). B-redfix-5 remains open, deferred, +non-blocking — unchanged by this probe. + +Terminal condition met (DONE + fresh PASS on every gate + no VETO). Loop stopped.