From cbeceea22fe18e160c6668030977e8365ba591b4 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Thu, 9 Jul 2026 08:20:35 +0000 Subject: [PATCH] status(redfix): wedge does not self-heal + blast radius bounded to keycloak (Adversary-confirmed widening) Adversary (75f6655) independently re-derived the upgrade-path site and CONFIRMED the widening of B-redfix-5: "my wake-#41 framing was too narrow; do not revert". Nothing reverted. It supplied three facts I had not established. Re-derived each from source rather than accepting them: - reconcile()'s only try is :520-525; sole caller main():556 does not catch -> a raise at :514/:536 escapes to SystemExit with keycloak already undeployed. Nothing redeploys it; recovery is MANUAL. - WARM_CANONICAL = True at 07fc6d4 -> the pre-fix canonical seed is a real arming action, not hypothetical. - WARM_DOMAINS == {keycloak}; keycloak is the only stateful:True SPECS entry (traefik is False) -> blast radius is exactly one warm unit. Folded the two operator-actionable ones into STATUS (does-not-self-heal; bounded to keycloak) and tightened the pre-fix-seed line from hypothetical to fact. The bound also stops the precondition reading as a fleet-wide hazard. No DoD item touched. M1+M2 PASS stand, ## DONE stands, no VETO. Docs-only. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01YZmH4rVNue3irZ6EsZzavb --- machine-docs/JOURNAL-redfix.md | 29 +++++++++++++++++++++++++++++ machine-docs/STATUS-redfix.md | 14 ++++++++++++-- 2 files changed, 41 insertions(+), 2 deletions(-) diff --git a/machine-docs/JOURNAL-redfix.md b/machine-docs/JOURNAL-redfix.md index 1540117..cdc648e 100644 --- a/machine-docs/JOURNAL-redfix.md +++ b/machine-docs/JOURNAL-redfix.md @@ -1719,3 +1719,32 @@ canonical seed writes `domain=warm-canon-keycloak…` into the live slot and arm No VETO to answer, no DoD item touched, no gate to claim. Docs-only. B-redfix-8 not re-probed — still operator-rotation-only, and wake #41 deliberately stopped re-probing it for the same reason I do here. + +## Wake #43 — 2026-07-09 — Adversary CONFIRMED the widening; folded its three new facts into STATUS + +`543d566`: the Adversary re-derived site (a) cold from `b5f2b10` and **confirmed** it — "my wake-#41 framing +was too narrow; the Builder is right. Widening CONFIRMED, do not revert." It also independently reproduced +my docker-absent probe artifact on `restore()` (dies at `_assert_undeployed:205`, upstream of the guard at +`:209`) and accepted the reachability correction. Nothing to revert; my open question is answered. + +It asserted three facts I had *not* established. Symmetry demands I not take those on faith either, so I +re-derived all three from source before letting them into STATUS: + +- **Nothing upstream catches.** `reconcile()` spans `:448-551`; its only `try` is `:520-525`, wrapping + `deploy_version` + `wait_healthy`. Sole caller `main():556` is a bare `result = reconcile(argv[1])`. + So a raise at `:514`/`:536` escapes to `SystemExit` with keycloak already undeployed. **Confirmed.** +- **Arming condition is real.** `git show 07fc6d4:tests/keycloak/recipe_meta.py` → `WARM_CANONICAL = True`. + A pre-fix canonical seed genuinely writes the foreign domain into the bare-recipe slot. **Confirmed.** +- **Blast radius one unit.** `WARM_DOMAINS == {"keycloak"}`; `SPECS["keycloak"]["stateful"] is True`, + `SPECS["traefik"]["stateful"] is False`. **Confirmed.** + +Two of those change what an operator would *do*, so they went into STATUS: the wedge **does not self-heal** +(no code path redeploys; recovery is manual), and it is **bounded to keycloak**. The third (arming condition +real) tightened the existing "do not run a pre-fix canonical seed" line from a hypothetical into a fact. +The "blast radius" note also stops the precondition reading as a whole-fleet hazard, which would be its own +kind of overstatement. + +Both loops have now independently derived the same structure from source and agree. B-redfix-5 stays +deferred, correctly scoped to both call sites; it still needs the operator's safety call (redeploy +`last_good` on unrestored data vs. die loudly), which is exactly why it was filed rather than fixed inline. +No VETO, no gate, no DoD item touched. Phase remains `## DONE`. B-redfix-8 untouched — operator rotation. diff --git a/machine-docs/STATUS-redfix.md b/machine-docs/STATUS-redfix.md index f6b9d01..702490d 100644 --- a/machine-docs/STATUS-redfix.md +++ b/machine-docs/STATUS-redfix.md @@ -84,8 +84,18 @@ because the live slot holds no snapshot at all (`read_meta` → `None` → "a sl to claim"). It is unreachable for that reason — **not** because F-redfix-4 is closed. The only state that creates a foreign live-slot meta is a **pre-fix (`07fc6d4`) canonical seed**, which -wrote the canonical's domain into the shared slot `/var/lib/ci-warm/keycloak/`. So: do not run a canonical -keycloak seed from `07fc6d4` between now and the merge. +wrote the canonical's domain into the shared slot `/var/lib/ci-warm/keycloak/`. The seed is a real, not +hypothetical, arming action: `tests/keycloak/recipe_meta.py` carries `WARM_CANONICAL = True` at `07fc6d4` +too. So: do not run a canonical keycloak seed from `07fc6d4` between now and the merge. + +**The wedge does not self-heal.** `reconcile()`'s only `try/except` is `warm_reconcile.py:520-525` (it wraps +`deploy_version` + `wait_healthy`), and its sole caller `main():556` does not catch either. A raise at `:514` +or `:536` therefore escapes to `SystemExit` with live keycloak already undeployed by the preceding +`abra.undeploy()` — no code path redeploys it. Recovery is manual. + +**Blast radius: keycloak only.** `warm.WARM_DOMAINS == {"keycloak"}` and `keycloak` is the only `SPECS` entry +with `stateful: True` (`traefik` is `stateful: False` — version-rollback-only, never snapshots). No other +warm unit reaches either call site. **HOW to verify the precondition** (on cc-ci; `python3` is absent there, so `ls`/`cat`):