cc-ci

1,557 Commits 49 Branches 1 Tag

3 Commits

Include renames

Author	SHA1	Message	Date
autonomic-bot	542e8cfb11	domain cutover: front doors + drone + per-run naming to ci.autonomic.zone continuous-integration/drone/push Build is failing Details - acme-dns.nix: ONE dual-zone SAN cert (ci+.ci.autonomic.zone AND ci+.ci.commoninternet.net) via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff reads the new cert dir. Single secret pair => zero changes to the traefik reconciler. - dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit parentheses so && does not shadow the dashboard on the new host). - drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow. - harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay on the legacy zone (data-warm volumes; post-bake migration). - URLs in bridge/dashboard defaults + recipe-report.py follow the new names.	2026-09-21 16:52:53 +00:00
autonomic-botandClaude Opus 4.8	b6ef83ab0b	feat(2w): W1 canonical registry module (WC2) + alerts archived runner/harness/canonical.py: data-warm canonical registry + lifecycle — is_enrolled (recipe_meta.WARM_CANONICAL), canonical_domain (warm.stable_domain warm-<recipe>), registry read/write (/var/lib/ci-warm/<recipe>/canonical.json), has_canonical (record + retained volume), deploy_canonical (reattach volume at known-good version), undeploy_keep_volume (idle data-warm), seed_canonical (record + warmsnap snapshot). warm.stable_domain helper added (keycloak path unchanged). +4 unit tests (61 unit pass). Also archived the Adversary's verification alert sentinels to alerts/seen/ (simulated rollback + 2 holds — evidentiary, gate PASSED; dir clean for real alerts). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-05-29 02:15:11 +01:00
autonomic-botandClaude Opus 4.8	1b8d26b504	feat(2w): W0.2 live-warm keycloak dep mode in orchestrator (WC1) - runner/harness/warm.py: stable-domain scheme (warm-<recipe>), is_warm_up probe, live_app_hexes scan, per-run realm_for naming, reap_orphan_realms. - run_recipe_ci.py: split declared deps into live-warm (shared provider + per-run realm, no deploy, realm deleted at teardown) vs cold (co-deploy). Warm path used only when provider is up; cold fallback otherwise. Reap orphan realms at run start (concurrency-safe). deploy-count excludes warm deps. Realm naming now per-run namespaced (<parent>-<6hex>). - dependent tests assert the namespaced realm pattern (stronger than ==parent). Live proof on warm keycloak: realm create -> password-grant JWT -> discovery issuer -> delete(idempotent) -> reap(keeps live hex, deletes orphan): PASS. 43 unit pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-05-28 23:26:02 +01:00

Author

SHA1

Message

Date

autonomic-bot

542e8cfb11

domain cutover: front doors + drone + per-run naming to ci.autonomic.zone

continuous-integration/drone/push Build is failing

Details

- acme-dns.nix: ONE dual-zone SAN cert (ci+*.ci.autonomic.zone AND ci+*.ci.commoninternet.net)
  via the same acmedns account — storage re-keyed by cc-ci-acme-storage-seed.service; handoff
  reads the new cert dir. Single secret pair => zero changes to the traefik reconciler.
- dashboard/bridge/reports: dual Host rules during the bake window (bridge gets explicit
  parentheses so && does not shadow the dashboard on the new host).
- drone abra app renamed to drone.ci.autonomic.zone (fresh DB supported: DRONE_USER_CREATE
  re-injects the sops bridge token); runner RPC + bootstrap-drone-oauth.sh follow.
- harness: app_domain() issues *.ci.autonomic.zone run domains; RUN_APP_RE / stack-name
  regexes / docker-prune accept BOTH zones during the bake. Warm stacks deliberately stay
  on the legacy zone (data-warm volumes; post-bake migration).
- URLs in bridge/dashboard defaults + recipe-report.py follow the new names.

2026-09-21 16:52:53 +00:00

autonomic-botandClaude Opus 4.8

b6ef83ab0b

feat(2w): W1 canonical registry module (WC2) + alerts archived

runner/harness/canonical.py: data-warm canonical registry + lifecycle —
is_enrolled (recipe_meta.WARM_CANONICAL), canonical_domain (warm.stable_domain
warm-<recipe>), registry read/write (/var/lib/ci-warm/<recipe>/canonical.json),
has_canonical (record + retained volume), deploy_canonical (reattach volume at
known-good version), undeploy_keep_volume (idle data-warm), seed_canonical
(record + warmsnap snapshot). warm.stable_domain helper added (keycloak path
unchanged). +4 unit tests (61 unit pass).

Also archived the Adversary's verification alert sentinels to alerts/seen/
(simulated rollback + 2 holds — evidentiary, gate PASSED; dir clean for real alerts).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-29 02:15:11 +01:00

autonomic-botandClaude Opus 4.8

1b8d26b504

feat(2w): W0.2 live-warm keycloak dep mode in orchestrator (WC1)

- runner/harness/warm.py: stable-domain scheme (warm-<recipe>), is_warm_up
  probe, live_app_hexes scan, per-run realm_for naming, reap_orphan_realms.
- run_recipe_ci.py: split declared deps into live-warm (shared provider +
  per-run realm, no deploy, realm deleted at teardown) vs cold (co-deploy).
  Warm path used only when provider is up; cold fallback otherwise. Reap
  orphan realms at run start (concurrency-safe). deploy-count excludes warm
  deps. Realm naming now per-run namespaced (<parent>-<6hex>).
- dependent tests assert the namespaced realm pattern (stronger than ==parent).

Live proof on warm keycloak: realm create -> password-grant JWT -> discovery
issuer -> delete(idempotent) -> reap(keeps live hex, deletes orphan): PASS.
43 unit pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-28 23:26:02 +01:00