recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
535 Commits 19 Branches 1 Tag
e2be3cc07e2fa459303f710b0ff36e686941fac7
Commit Graph

56 Commits

Author SHA1 Message Date
autonomic-bot
109229bd88 claim(Q4.4): ghost full lifecycle GREEN — P3 create-post + P4 data-integrity (incl restore) via recipe-PR #1 
All 5 tiers + create-post pass, deploy-count=1, upgrade crossover 1.1.1->1.3.0 (chaos-version
6d6227f7+U), P4 restore non-vacuous (catalogue/no-fix negative control RED 'ci_marker doesn't
exist'), clean teardown. recipe-maintainers/ghost#1 adds the mysqldump backup+reimport-on-restore
hook (was backup-but-no-restore, immich/mattermost class). Healthcheck overlay + +U HC1 fix en route.
Closes DEFERRED ghost create-post. Log /root/ccci-ghost-pr1d.log. Awaiting Adversary.
 2026-05-30 07:26:35 +01:00
autonomic-bot
424ef16174 status(2): ghost +U fix confirmed (upgrade GREEN); recipe-PR #1 created; re-running with REF for PR head (first PR run missed REF→fetched 1.2.0) 2026-05-30 06:21:05 +01:00
autonomic-bot
1570ccb698 status(2): ghost run-4 — P3 create-post GREEN, P4 backup/upgrade GREEN, restore RED (recipe gap→PR), +U upgrade fix committed; not claimed 2026-05-30 05:51:46 +01:00
autonomic-bot
fca4866ea1 status(2): Q4.4 ghost P4+create-post authored, full-lifecycle run in flight (NOT claimed) 2026-05-30 04:18:06 +01:00
autonomic-bot
83239eb673 status(2): Q4.3 bluesky-pds Adversary PASS (REVIEW-2 e45e0ee) — DONE; next unblocked: ghost P4+create-post deeper 2026-05-30 03:53:08 +01:00
autonomic-bot
7d69a596a7 status(2): fix Q4.3 bluesky claim text (heredoc had eaten backtick code spans) 2026-05-30 02:51:48 +01:00
autonomic-bot
4760f9676a claim(Q4.3): bluesky-pds full lifecycle GREEN — P4 added (atproto account marker survives backup/restore/upgrade; volume restore works, no recipe-PR); 5 tiers + 4 custom pass, deploy-count=1, clean teardown 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-30 02:50:53 +01:00
autonomic-bot
ad53a7c6c4 status(2): Q4.3 bluesky-pds P4 overlay (atproto account marker) authored, full-lifecycle run in flight 2026-05-30 02:49:27 +01:00
autonomic-bot
32050885a8 status(2): Q4.5 mattermost-lts Adversary PASS — DONE (3rd PASS this session; 2 recipe-PRs fixing real backup/restore bugs) 2026-05-30 02:36:54 +01:00
autonomic-bot
1ca7b2328b claim(Q4.5): mattermost-lts full lifecycle GREEN — P4 restore fixed via recipe-PR recipe-maintainers/mattermost-lts#1 (published restore was a no-op); 5 tiers + 4 custom pass, deploy-count=1, clean teardown 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-30 02:11:52 +01:00
autonomic-bot
342c3b078f status(2): Q4.5 mattermost recipe-PR #1 opened (pg_backup.sh restore fix), validation run in flight 2026-05-30 01:41:37 +01:00
autonomic-bot
11d6d82aad status/journal(2): Q4.5 mattermost P4 overlay caught a real recipe restore defect (no backupbot.restore.post-hook → DB not reimported); recipe-PR queued (immich pattern); node clean 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-30 01:30:19 +01:00
autonomic-bot
21e0b16ac4 status(2): Q4.5 mattermost-lts P4 overlay authored, full-lifecycle run in flight 2026-05-30 01:13:55 +01:00
autonomic-bot
0599477440 status(2): Q4.1 matrix-synapse Adversary PASS — DONE 2026-05-30 01:08:55 +01:00
autonomic-bot
9a8850affa claim(Q4.1): matrix-synapse full lifecycle GREEN — §4.3 register transient post-restore 500 root-caused (synapse DB pool closed by restore DROP DATABASE FORCE) + fixed with bounded readiness-retry (not weakened); 5 tiers + 3 functional pass, P4 ci_marker survives, deploy-count=1, clean teardown 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-30 01:00:38 +01:00
autonomic-bot
cf54fe36a8 status(2): Q4.1 matrix — 4 tiers green; §4.3 register test 500 M_UNKNOWN, diagnosing with synapse log capture (not weakening) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-30 00:45:31 +01:00
autonomic-bot
f39bae71ea status(2): Q3.5 immich Adversary PASS (P4-restore CLOSED); Q4.1 matrix-synapse full-lifecycle run in flight 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-30 00:39:57 +01:00
autonomic-bot
0487631bac claim(Q3.5): immich full lifecycle GREEN — P4 fixed via recipe-PR recipe-maintainers/immich#1 (recipe backed up NO database); 5 tiers + 3 custom pass, deploy-count=1, clean teardown 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-30 00:20:48 +01:00
autonomic-bot
4f0eeb54bd status(2): immich P4 — mechanism validated, recipe-PR recipe-maintainers/immich#1 opened, full-lifecycle run in flight 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 23:59:39 +01:00
autonomic-bot
a4a2e60b87 status(2): immich Q3.5 P4 in-flight — recipe-PR for postgres backup (recipe backs up no DB); inbox consumed, node clean 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 23:45:08 +01:00
autonomic-bot
1d99f91b44 status/backlog(2): Q4.10 drone BLOCKED on operator host /etc/timezone deploy (3bde76f); surfaced 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 22:20:35 +01:00
autonomic-bot
25ae2935b9 status(2): Q4.9 mailu Adversary PASS (REVIEW-2 2958eb6, P4-N/A signed off) — DONE; next drone Q4.10 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 21:51:57 +01:00
autonomic-bot
6a216ed73b claim(2): Q4.9 mailu full lifecycle GREEN (P4 N/A) — awaiting Adversary 
mailu (full email stack) install+upgrade(3.0.0→3.0.1 real crossover, head_ref==chaos-version)+custom
all green; deploy-count=1; clean teardown. backup/restore N/A-skip (no backupbot → P4 N/A; PARITY.md+
DEFERRED.md; Adversary §7.1 sign-off requested). P2 vacuous. P3: create-mailbox (flask→config-export)
+ mail-flow (in-container sendmail→doveadm deliver/store/fetch). TLS_FLAVOR=notls; in-container tools.
HOW/EXPECTED/WHERE in STATUS-2 Gate Q4.9. Logs ccci-mailu-full2 + smoke/smoke2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 21:39:02 +01:00
autonomic-bot
bdc05e24c4 status/backlog(2): Q4.6 discourse blocked (bitnami images gone); pivot to Q4.9 mailu (images pullable) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 20:53:09 +01:00
autonomic-bot
e36656f688 status(2): Q4.2 mumble Adversary PASS (REVIEW-2 1daa1ea) — DONE; advancing to discourse 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 20:35:50 +01:00
autonomic-bot
1ba56139fb claim(2): Q4.2 mumble full lifecycle GREEN — awaiting Adversary 
mumble (§5 TCP/voice recipe) all 5 tiers green: install+upgrade(real 0.2.0→1.0.0+ crossover,
head_ref==chaos-version 9fa5e949)+backup+restore+custom; deploy-count=1; clean teardown.
P2=3 parity ports (health_check/mumble_connect/web_client), P3=2 specific (welcome-text + max-users
config round-trips over the protocol), P4=sqlite ci_marker survives backup→restore. ready-probe OK
(tcp 3x) twice. Harness additions: CHAOS_BASE_DEPLOY, recipe_checkout -f, TCP READY_PROBE; install_steps
provides host-ports.yml. Log /root/ccci-mumble-full6.log; HOW/EXPECTED/WHERE in STATUS-2 Gate Q4.2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 20:25:37 +01:00
autonomic-bot
3360f1b266 status(2): Q4.2 mumble code complete; full run queued behind Adversary plausible cold run (single node) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 19:34:22 +01:00
autonomic-bot
38db17af0c status(2): ACK Adversary Q4.7 plausible finding — will provide preserved green-run log post-cooldown 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 19:28:54 +01:00
autonomic-bot
265eae5365 status(2): Q4.2 mumble enrolling — TCP-protocol recipe, mumbleweb+host-ports plan, P2 corpus port 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 19:13:39 +01:00
autonomic-bot
1dd7376ff4 status(2): HQ1 image pre-pull Adversary PASS (0215bd2) 2026-05-29 16:19:27 +01:00
autonomic-bot
475ad5c774 claim(2): HQ1 image pre-pull — warm local store before deploy (4 unit tests + warm-cache-skip + bad-tag-clear-error + abra-unchanged) 
lifecycle.prepull_images (commit 2bf40d6): docker compose config --images → docker pull skip-if-present,
before deploy_app's abra.deploy + perform_upgrade's chaos redeploy. Adversary criteria all met:
warm-cache 2nd run 'present' (no redownload, n8n-prepull2), bad-tag → clear RuntimeError pre-deploy,
abra deploy path unchanged (no service update/scale), real-run green. 4 unit tests pass. Gate evidence
in STATUS-2.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 16:14:25 +01:00
autonomic-bot
250bed4768 status(2): cryptpad F2-9 + F2-13 Adversary CLOSED (f7ed2d9) — §4.3 create-pad floor demonstrated; DONE-blocker cleared 2026-05-29 15:38:21 +01:00
autonomic-bot
62ac9b59e0 journal/status(2): F2-13 cryptpad read-back robustness FIXED (b44d75b, poll-all-frames) — 3x green vs cold probe; awaiting Adversary re-verify/F2-9 close 2026-05-29 15:26:25 +01:00
autonomic-bot
b0f1e0b0ad status(2): Q3.3 lasuite-meet Adversary PASS (a46f7d4); immich Q3.5 validating 2026-05-29 14:44:09 +01:00
autonomic-bot
5af513e2c8 claim(2): Q3.3 lasuite-meet — full lifecycle green (meeting_flow §4.3 + OIDC; R014 chaos-base; webrtc env-blocker non-port) 
lasuite-meet full suite GREEN (log /root/ccci-meet-full6.log): install/upgrade/backup/restore/custom
all pass, deploy-count=1, clean teardown, real upgrade crossover 0.2.0+v1.15.0→0.3.0+v1.16.0.
- §4.3 test_meeting_flow: create-room (201) → read-back (200) → LiveKit join token (JWT room grant) →
  delete. test_oidc_password_grant PASSED. Parity: health_check + oidc_login. Reused lasuite-drive
  OIDC-at-install machinery.
- R014 fix (72719fe): upstream lightweight tag → chaos-base deploy of the checked-out prev version
  (skips lint, deploys prev not latest — verified by the crossover).
- webrtc-media/relay UDP media-relay = documented env-blocker non-port; maximal subset (LiveKit token
  issuance) shipped in meeting_flow.
Gate evidence/HOW/EXPECTED/WHERE in STATUS-2. DECISIONS: R014 chaos-base + webrtc non-port. BACKLOG-2
[idea]: harness image pre-pull. Single cold-verified green is the bar (operator clarification).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 14:33:31 +01:00
autonomic-bot
a48543f57b status/journal/deferred(2): cryptpad F2-9 RESOLVED — roundtrip green in full harness custom tier (cold deploy); awaiting Adversary close 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 13:11:35 +01:00
autonomic-bot
118305b92f status(2): Q3.2 lasuite-drive Adversary PASS (F2-12 closed); cryptpad roundtrip cold-timing fix in validation 2026-05-29 13:01:43 +01:00
autonomic-bot
a13d2ae48b claim(2): Q3.2 re-claim — F2-12 fixed (own convergence wait + READY_PROBE; upgrade 3x green; P7-negative unit-proven) 
lasuite-drive full lifecycle 3x repeat-green (logs ccci-drive-f212-v1/v2/v3): install+upgrade+backup+
restore+custom all pass, OIDC password-grant PASSED (not skip), deploy-count=1, clean teardown, ready-
probe OK (200) twice (post-install + post-upgrade collabora WOPI). F2-12 fix e1147b5: upgrade chaos
redeploy uses abra -c (drop abra's impatient converge monitor that FATA'd while new collabora 25.04.9.4.1
was in healthcheck start_period) + perform_upgrade OWNS a stricter convergence wait (services N/N + app
health + collabora WOPI READY_PROBE) bounded by DEPLOY_TIMEOUT. Non-vacuous proven by 5 P7-negative unit
tests (6506c4a). Gate evidence/HOW/EXPECTED/WHERE in STATUS-2. F2-12 Adversary-owned (left to close).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 12:45:02 +01:00
autonomic-bot
cc4af49c99 status(2): Q3.2 F2-12 FAIL acknowledged, fix e1147b5 validating; cryptpad F2-9 test landed 3/3 green 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 11:58:03 +01:00
autonomic-bot
911680f843 claim(2): Q3.2 lasuite-drive — full lifecycle 3x green via install-time OIDC + collabora-ready upgrade gate 
3× repeat-green (logs /root/ccci-drive-q32a-r2/r3/r4.log): install+upgrade+backup+restore+custom all
pass, OIDC password-grant PASSED (not skip), deploy-count=1, clean teardown each run. Resolves the
Adversary's standing veto-eligible obligation (lasuite-drive upgrade tier GREEN + reliable OIDC).

Fixes: install-time OIDC wiring (a151489: _provision_deps before single deploy + OIDC_AT_INSTALL +
install_steps.sh) eliminated the flaky post-deploy --chaos reconverge; collabora-WOPI-ready upgrade
gate + DEPLOY_TIMEOUT plumbing (4b38b66) fixed the upgrade tier (was killing a still-booting collabora,
exit 70). Gate evidence + cold-verify HOW/EXPECTED/WHERE in STATUS-2.md. BACKLOG-2 Q3.2/Q3.2a ticked;
DEFERRED.md disk follow-on noted done.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 11:16:18 +01:00
autonomic-bot
f89cf9b1b8 status(2): Q3.2a lasuite-drive Part A in validation — install-time OIDC landed, full-suite run in flight 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-29 10:13:21 +01:00
autonomic-bot
7a337f5d69 status(2): Docker Hub rate-limit RESOLVED — declarative sops auth + swarm pulls authenticate (3 conditions); DECISIONS recorded 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-28 22:13:25 +01:00
autonomic-bot
5b34496557 fix(2): F2-11 — SSO-dep deps-not-ready SKIP no longer yields GREEN !testme 
When a DEPS-declaring recipe's setup_custom_tests fails, its @requires_deps (SSO/OIDC)
tests skip; a skip-only pytest file exits 0 so the run previously reported overall=0
(GREEN) while the only SSO test never ran (violates P7). Fix preserves generic-tier
failure-isolation but corrects the green SIGNAL:
- conftest.pytest_collection_modifyitems counts skipped requires_deps tests and appends
  to $CCCI_DEPS_SKIP_REPORT.
- run_recipe_ci: sums the count, surfaces it in RUN SUMMARY, and new pure predicate
  sso_dep_unverified(declared, deps_ready, skipped) flips overall=1.
- 7 new unit tests (tests/unit/test_f211_sso_skip.py).

Verified deploy-free (rate-limit-independent): 35/35 unit PASS; cold real-test proof on
lasuite-docs test_oidc_with_keycloak.py -> 1 skipped + skip-report==1 -> orchestrator
would set overall=1. Full e2e deferred until Docker Hub rate limit lifts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-28 21:25:27 +01:00
autonomic-bot
aae31775ae status(2): Gitea outage resolved + git reconciled; Docker Hub rate-limit block stands (registry-creds finding) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-28 21:18:52 +01:00
autonomic-bot
1138d77cbb blocked(2): Q3.2 drive base-deploy hits Docker Hub rate limit + Gitea outage 
- recipe_meta: bump drive abra TIMEOUT 900->1500, DEPLOY_TIMEOUT 1200->1800 (12-svc
  stack w/ onlyoffice+collabora; cold pulls need a wide window).
- STATUS-2 ## Blocked: two Class-A1 external blocks documented w/ verify commands —
  (1) Docker Hub anon pull rate limit (registry-creds finding per plan §1.5; blocks all
  new deploys), (2) Gitea git.autonomic.zone 404 outage (coordination down; 2 watchdog
  pings unconsumable until recovery). JOURNAL-2: full disk->prune->rate-limit chain.
- Queued locally; push + Adversary-inbox processing deferred to Gitea recovery.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-05-28 20:48:52 +01:00
autonomic-bot
8bafbd4968 status(2): Q4.4 ghost + Q4.8 uptime-kuma done; F2-10 closed via DEFERRED.md route 
- STATUS-2: in-flight summarizes recipes shipped this sprint (Q3.1+Q3.4 partial; Q4.1+Q4.3+
  Q4.4+Q4.8 full); harness DEPLOY_TIMEOUT plumb-through; DEFERRED.md 9 open entries.
- BACKLOG-2: Q4.4 ghost + Q4.8 uptime-kuma checked off; F2-10 closed via DEFERRED.md route 2
  per Adversary's suggested action (file with proper re-entry trigger; PARITY.md no longer
  duplicates DEFERRED.md).
- tests/uptime-kuma/PARITY.md: 'Deferred' section now points to DEFERRED.md instead of
  duplicating the deferral text.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-28 17:25:25 +01:00
autonomic-bot
076fa31552 status(2): Q4.1+Q4.3 GREEN; Q3.1+Q3.4 partial; pausing for Adversary cold-verify 
After capacity unblock:
- Q4.1 matrix-synapse: parity-aligned + 3 specific (incl. §4.3 register-and-message via
  shared-secret admin endpoint exec'd via container localhost). Cold green.
- Q4.3 bluesky-pds: enrolled (install_steps.sh generates PLC rotation key per-run); 3 functional
  tests (health, describe_server, session_auth-401). Cold green.
- Q3.1 lasuite-docs partial: parity + 2 specific (auth_required + oidc_with_keycloak from Q2.4).
- Q3.4 cryptpad partial: parity + 2 specific (spa_assets + Playwright SPA-render).

Remaining substantial: Q3.2 lasuite-drive (needs mirror), Q3.3 lasuite-meet (mirrored + needs
OIDC wire), Q3.5 immich (needs mirror), Q4.2/4-10 (mostly need mirror). Pausing here for
Adversary cold-verify of Q3/Q4 partials before continuing the mirror-and-enroll work.
 2026-05-28 16:07:57 +01:00
autonomic-bot
0fb145894f feat(2): Q3.4 — cryptpad Phase-2 parity + functional + Playwright pad-create 
- tests/cryptpad/PARITY.md: parity table for health_check.py (ported);
  oidc_login.py documented as authentik-deferred (cross-recipe; needs Q2.2 enrollment).
- tests/cryptpad/functional/test_health_check.py: parity port, SOURCE comment present.
- tests/cryptpad/functional/test_api_config.py: NEW recipe-specific — GETs /api/config,
  asserts parseable JSON (handles both direct-JSON and CryptPad's JS-wrapped form), asserts
  known cryptpad-server config keys (websocketURL/fileHost/applications/etc.). Distinguishes
  'cryptpad-server up + emitting valid config' from 'nginx serving SPA shell'.
- tests/cryptpad/playwright/test_pad_create.py: NEW Playwright create-and-read-back. Browses
  to /pad/; waits for editor iframe + contenteditable; types a UUID-marked string; reloads
  (URL fragment retains the client-side encryption key); asserts the marker survives. This
  is the plan §4.3-prescribed CryptPad-specific test ('use Playwright, not bare curl').
- STATUS-2 updated to record Q2 Adversary PASS (REVIEW-2 ## Q2 — PASS).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-28 10:05:01 +01:00
autonomic-bot
54b1fe326c status(2): Q2 RE-CLAIMED — F2-5 dep-teardown-verify fix cold-verified clean 
Per REVIEW-2 ## Q2 FAIL @2026-05-28 (F2-5 dep teardown leak + F2-6 cold install flake + F2-7
SSO setup keycloak-hardcoded):

F2-5 closed by commit c6e94af: teardown_deps now uses verify=True so residuals raise; failures
propagate to orchestrator exit code + run summary. Cold-verified: lasuite-docs+keycloak e2e
PASS, dep teardown clean, post-run docker stack/volume/secret with 'keyc' filter all empty.

This also explained my Q3.1 flake — the leaked Q2.4 dep keycloak (deterministic dep domain) had
collided with my next dep deploy. With F2-5 fixed, that class of cross-run collision is
impossible (teardown now raises if it leaks, so the run fails BEFORE the next one starts).

F2-7 acknowledged: setup_keycloak_realm is keycloak-specific; authentik would need parallel
backend. Logged for Q2.2/Q5.

F2-6 (cold keycloak install 502) — real but secondary; will checkpoint in Q4 sweep.

Side-effect: Q3.1 partial also landed (PARITY.md + test_health_check parity port +
test_auth_required + the prior test_oidc_with_keycloak.py as Q3.1 third specific test).

Cold evidence: ssh cc-ci 'RECIPE=lasuite-docs STAGES=install,custom cc-ci-run runner/run_recipe_ci.py'
  deploy-count=2 (expect 2), all 5 assertions PASS, dep teardown clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-28 09:22:24 +01:00
autonomic-bot
ad6b25982f status(2): Q2 CLAIMED — dep resolver + SSO harness + Q2.4 acceptance proven cold 
Q2.1 keycloak: parity port + JWT password-grant test + client_credentials test (commit d5f5e86).
Q2.2 authentik DEFERRED: SSO harness is provider-pluggable; Q2.4 already proven via keycloak.
Q2.3 dep resolver + SSO-setup harness primitives (commit 4d6b040, subsumes Q0.4). 28/28 unit PASS.
Q2.4 ACCEPTANCE (commit 9e88741): lasuite-docs declares DEPS=['keycloak']; the orchestrator
deploys keycloak as a per-run dep, runs an OIDC password-grant test against it (JWT iss/azp/typ/
exp claim validation), then tears the dep down. deploy-count=2 (1 parent + 1 dep, DG4.1 reconciled
with deps).

Secondary fix (commit 47f7cb4): centralized F2-3 Playwright try/except into
runner/harness/browser.py::goto_with_retry; applied to all install overlays + custom-html
playwright smoke. Lesson: when a hardening pattern bites once, generalize it before fixing
in-place.

Cold-verifiable on cc-ci:
  ssh cc-ci 'cc-ci-run -m pytest tests/unit -v'  # 28 PASS
  ssh cc-ci 'RECIPE=lasuite-docs STAGES=install,custom cc-ci-run runner/run_recipe_ci.py'
  # DEPS resolves -> keycloak deploys -> install PASS -> OIDC test PASS -> dep teardown clean
  # deploy-count = 2 (expect 2)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-28 08:09:56 +01:00