872 Commits

Author	SHA1	Message	Date
autonomic-bot	faef8a9685	claim(m2-redfix): M2 RE-CLAIMED — F-redfix-4 remedied at redfix-m2-harness@b5f2b10 (warm state keyed by stack namespace); clearing condition re-run green on cc-ci, unit suite 315->325; awaiting Adversary ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FS8p1esg57UAC69riNvuBX	2026-07-09 00:13:57 +00:00
autonomic-bot	397c303188	journal(redfix): wake #8 — VETO F-redfix-4 reproduced independently, root-caused, fixed at b5f2b10; decision recorded (warm state keyed by stack namespace); B-redfix-5 residual filed ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FS8p1esg57UAC69riNvuBX	2026-07-09 00:13:47 +00:00
autonomic-bot	cfea875b2b	status(redfix): claim WITHDRAWN — standing VETO F-redfix-4 (keycloak warm-state slot collision); M2 reopened, do not merge redfix-m2-harness ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FS8p1esg57UAC69riNvuBX	2026-07-09 00:01:57 +00:00
autonomic-bot	78af2c995a	note(redfix): post-verdict JOURNAL consult — warm-state dimension never considered (F-redfix-4 is a blind spot, not a deferral)	2026-07-08 23:58:32 +00:00
autonomic-bot	941d5e81c1	review(redfix): VETO — keycloak enrollment not collision-free in warm state (F-redfix-4) ... Post-reboot re-confirmation #8. New break-it probe on the two HARNESS fixes (previously only sha-reachability checked, never content, never second-order effects). mumble 07fc6d4: CLEAN — attempts 12->36 @5.0s = claimed 180s; all assertions unchanged, so a dead server still FAILs. Budget widened without weakening the test. keycloak 61211db: correct at the domain/stack layer, but its own invariant is FALSE. canonical_domain() separates the two deployments by domain, yet warm STATE is keyed by recipe: warmsnap.snap_dir("keycloak") is ONE slot shared by the live-warm reconciler (warm-keycloak, stateful=True) and the newly-enrolled data-warm canonical (warm-canon-keycloak, seeded via promote_canonical -> seed_canonical, no WARM_DOMAINS guard). Proved by execution on cc-ci in a scratch CCCI_WARM_ROOT against the real idle canon stack: snapshot(canon) -> snapshot(other stack) destroys the canonical known-good, and restore(canon) raises SnapshotError. Fails closed (no cross-stack data write), but: 1. every stateful reconciler upgrade deterministically destroys the canonical snapshot; 2. the reconciler's rollback restore() is OUTSIDE its try/except and its snapshot->restore window spans deploy+wait_healthy (health_timeout 900). A sweep promote landing there makes the rollback raise AFTER abra.undeploy(live) -> live keycloak left undeployed = outage of the shared OIDC provider lasuite-*/drone depend on. Exactly the hazard canon §2.B's de-enrollment exception existed to prevent. 3. prune_stale()'s documented "keycloak untouched" invariant becomes false once seeded. Undetectable by the M2 run: /var/lib/ci-warm/keycloak/ holds only last_good (no canonical.json, no snapshot/) vs cryptpad which has both — the promote deployed but seed_canonical never ran, registry-advance being deferred to the operator's merge. First seed happens post-merge, unexercised. VETO scoped to keycloak. M1 classifications and the discourse/mattermost-lts/gitea/bluesky-pds/ mumble fixes are unaffected and remain PASS. Clears when the two deployments use disjoint warm-state paths and each restore() returns its own stack's volumes. Node left clean: real warm root untouched, volumes intact, live keycloak 200 throughout.	2026-07-08 23:58:01 +00:00
autonomic-bot	1e513e7fe1	journal(redfix): wake #7 — consumed Adversary re-confirmation #7 (content-anchored break-it probe: each M2 fix sha grepped in a cold bare clone with its parent as negative control; mattermost-lts/gitea/bluesky-pds fixes present, absent in parents). All 4 recipe fixes now content-anchored, not sha-anchored. DONE stands, no VETO, no inbox, no action. Loop stopped	2026-07-08 23:49:44 +00:00
autonomic-bot	4682aa1216	review(redfix): post-reboot re-confirmation #7 — DONE stands, no VETO. Zero delta since #6 (Builder JOURNAL append only). New break-it probe: verified fix CONTENT (not just sha reachability) at every M2 anchor via cold bare clones — mattermost-lts 4ca7f418 adds backupbot.restore.post-hook, gitea a0f2db8 adds app.ini.init + docker-setup cp, bluesky-pds 4987ba9 adds FQ APP_HOST with no leftover bare app alias — each with its parent commit as a negative control (0 matches pre-fix). All 4 recipe fixes now content-anchored. All findings closed ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHWWoceR5fHLTEwW8b3QnQ	2026-07-08 23:42:52 +00:00
autonomic-bot	7ac7eb078b	journal(redfix): wake #6 — consumed Adversary re-confirmation #6 (break-it probe of M2 evidence anchors: mattermost-lts/gitea/bluesky-pds/harness-branch all reachable with matching subjects; rot confined to discourse, already CLOSED as F-redfix-3). DONE stands, no VETO, no inbox, no action. Loop stopped	2026-07-08 23:36:25 +00:00
autonomic-bot	c6593bbf6e	review(redfix): post-reboot re-confirmation #6 — DONE stands, no VETO. Zero delta since #5 (only a Builder JOURNAL append). Break-it probe on evidence-anchor rot: cold bare-cloned all 3 remaining recipe mirrors — mattermost-lts 4ca7f418, gitea a0f2db8, bluesky-pds 4987ba9 all REACHABLE with subjects matching their asserted fixes, and harness branch redfix-m2-harness still pins exactly 07fc6d4 (mumble) with 61211db (keycloak) reachable. Rot confined to discourse (F-redfix-3, CLOSED). All findings closed ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WY7MNKwa6gascKiXER9ZbN	2026-07-08 23:36:00 +00:00
autonomic-bot	0302cb2589	journal(redfix): wake #5 — consumed Adversary re-confirmation #5 (audit of my F-redfix-3 addendum: clean, remedy verified, fix commit still reachable). DONE stands, no VETO, no action. Loop stopped	2026-07-08 23:30:05 +00:00
autonomic-bot	805c44e42d	review(redfix): post-reboot re-confirmation #5 — DONE stands, no VETO. Audited Builder's F-redfix-3 addendum (612412c): append-only (+54/-0), my files + DONE line + historical shas untouched, no gate reopened. Ran its published repro verbatim in a fresh clone: ede6399 → official image 3.5.3 + 0 sidekiq, both EXPECTED met. Ruled out vacuous zero (file exists, blob, services:app: present) and added negative control (d7c8c47 added sidekiq, 0c4539b removed it) — fix COMMIT still reachable, only sha labels rotted. F-redfix-3 remedy verified, not just asserted	2026-07-08 23:29:09 +00:00
autonomic-bot	612412c52a	status(redfix): evidence addendum for F-redfix-3 — durable content assertion for the discourse fix (sha pins rotted via later-phase force-push; content re-verified at ede6399); historical shas left unedited on purpose. DONE unchanged, no gate reopened	2026-07-08 23:23:33 +00:00
autonomic-bot	1271c248b9	review(redfix): post-reboot re-confirmation #4 — DONE stands, no VETO (M1+M2 intact, both findings closed) + NEW non-blocking F-redfix-3 (CLOSED): discourse M2 evidence shas 9ff5e19/53ba0910 gone from mirror (branch rebased+extended by later phases), but fix CONTENT re-verified at HEAD ede6399 — official image + 0 sidekiq; other 3 recipe shas + harness branch pin exactly	2026-07-08 23:22:05 +00:00
autonomic-bot	001a1f4d4d	journal(redfix): post-reboot re-confirmation #4 — phase still DONE (M1+M2 PASS, no VETO, no inbox); F-redfix-2 gitignore remedy independently re-tested and holds on origin/main; stray untracked main.go surfaced, not deleted	2026-07-08 23:20:57 +00:00
autonomic-bot	bccba44b00	journal(redfix): F-redfix-2 CLOSED by Adversary — no action required, phase stays DONE ... Read review(redfix) @67e86de: no VETO, M1/M2 PASS intact, remedy cold-verified from a fresh clone of origin/main. Nothing claimed of me. Records the Adversary's self-caught grep contamination (searching history for a secret by a 6-char prefix that our own finding/inbox/journal text now contains tests our prose, not history; re-test against the full 51-char value: 0 commits, never leaked) and its acceptance of my symlink correction. Residual unchanged: key on disk unrotated -- operator's call, not either loop's. Did not edit the Adversary-owned findings section. Terminal condition holds. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018nVVSxRnj3K5MxGGRJzvTe	2026-07-08 23:14:36 +00:00
autonomic-bot	67e86ded88	review(redfix): F-redfix-2 CLOSED — gitignore remedy cold-verified (fresh-clone + add -A replay, origin/main, no HTTP exposure); full 51-char key never committed (my prefix-grep was self-contaminated); Builder's symlink correction confirmed — one repo, fix fully applied; rotation left to operator; DONE stands, no VETO; consumed ADVERSARY-INBOX	2026-07-08 23:13:26 +00:00
autonomic-bot	a10b2e8275	inbox(redfix): notify Adversary F-redfix-2 remedy pushed; correct "both clones" premise (symlink => one repo) ... Journal: /srv/cc-ci/cc-ci and /srv/cc-ci-orch/cc-ci are the same directory (.gitignore inode 3252849 shared; rev-parse --show-toplevel agrees), as are the cc-ci-adv pair, which carries no config.json. So the single .gitignore line closes the exposure on every path; no second remediation pending. Escalated to operator: rotate the Tinfoil key if it ever hit a transcript/log -- gitignore prevents a future commit, it cannot un-expose an already-seen key. Phase redfix remains DONE. F-redfix-2 stays open; only the Adversary closes it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018nVVSxRnj3K5MxGGRJzvTe	2026-07-08 23:09:42 +00:00
autonomic-bot	8cf08fd834	fix(redfix): gitignore config.json (F-redfix-2 remedy) + consume BUILDER-INBOX ... Adversary finding F-redfix-2 (non-blocking): config.json sits untracked AND un-gitignored at both Builder clone roots holding a live-shaped Tinfoil API key (.provider.tinfoil.options.apiKey) -- one `git add -A` from being pushed to git.autonomic.zone. Independently re-verified all four claims from my own clone: untracked, never committed (git log --all -- config.json empty), not ignored, key live-shaped. Latent risk, NOT an existing leak. Remedy: add config.json to the "local secrets / env -- never commit" block. Proved effective by replaying `git add -A` against a scratch GIT_INDEX_FILE: config.json is no longer staged (only .gitignore, main.go). Did not delete/move config.json (foreign file, not created by this loop), did not rotate the key (operator's call -- escalated), did not gitignore main.go (foreign, but no secret in it), did not reopen redfix or touch REVIEW-redfix.md. Phase redfix stays DONE; only the Adversary closes F-redfix-2, after re-test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018nVVSxRnj3K5MxGGRJzvTe	2026-07-08 23:08:27 +00:00
autonomic-bot	a16c367091	review(redfix): DONE re-confirmed post-reboot #3 (M1+M2 PASS, no VETO) + NEW non-blocking finding F-redfix-2 — live API key in un-gitignored config.json at both Builder clone roots (never committed; one 'git add -A' from a push)	2026-07-08 23:06:44 +00:00
autonomic-bot	418ec570ef	journal(redfix): post-reboot re-confirmation #2 — phase still DONE (M1+M2 PASS, no VETO); record warm-gitea pre-merge crash-loop (= M1 root cause, awaits PR #2), foreign wedged procs, and untracked root files left untouched (config.json holds a live-looking API key) ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KKptqtbUkaLHDCmwomwDjy	2026-07-08 23:01:02 +00:00
autonomic-bot	ddf3788483	note(redfix): post-reboot re-confirmation — phase remains DONE (M1+M2 PASS, no VETO); node healthy; no pending claim; loop stopped	2026-07-08 20:29:07 +00:00
autonomic-bot	b3bdc291b4	status(redfix): ## DONE — phase complete, M1+M2 fresh Adversary PASS, no VETO ... All 6 canon-sweep failures fixed + cold-verified green (mattermost-lts, discourse, keycloak, mumble, gitea, bluesky-pds). No standing exceptions. Nothing merged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bacy8SJhBebNAGoYsi1Fxt	2026-06-18 07:07:14 +00:00
autonomic-bot	337931065a	review(redfix-M2): PASS 6/6 — discourse re-verified level=5 (F-redfix-1 CLOSED); all 6 canon-sweep fixes cold-verified; node clean; no VETO; Builder cleared to DONE	2026-06-18 07:06:27 +00:00
autonomic-bot	29a28176a9	claim(redfix-M2): discourse F-redfix-1 FIXED + level=5 verified — re-claim 6/6 ... Dropped orphaned image-less sidekiq from discourse compose.smtpauth.yml (PR #4 @9ff5e19); R011 lint ✅ (Adversary repro) + own cold run level=5 of 5 all tiers pass. Other 5 fixes unchanged (Adversary PASS). 6/6 verified green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bacy8SJhBebNAGoYsi1Fxt	2026-06-18 06:55:28 +00:00
autonomic-bot	6e64665074	inbox(redfix): consumed Adversary M2 FAIL verdict (discourse F-redfix-1); fix pushed @9ff5e19	2026-06-18 06:47:33 +00:00
autonomic-bot	70afd937c3	note(redfix-M2): BUILDER-INBOX heads-up — discourse smtpauth sidekiq remedy; other 5 solid, don't redo	2026-06-18 06:46:59 +00:00
autonomic-bot	3f5eddfdbd	review(redfix-M2): FAIL — 5/6 PASS (keycloak/mumble/gitea/bluesky/mattermost), discourse FAIL (F-redfix-1: incomplete migration, dangling image-less sidekiq in compose.smtpauth.yml -> R011 lint regression + breaks smtp-auth; run #849 also level=4)	2026-06-18 06:45:46 +00:00
autonomic-bot	21e8ca336e	note(redfix-M2): bluesky-pds component VERIFIED (4/6) — chaos-deploy fix, caddy resolves own app 10.0.5.5 (bare app=foreign 10.10), health 200 {0.4.219}, 0 conn-refused; node clean	2026-06-18 06:21:42 +00:00
autonomic-bot	319ec9cd36	note(redfix-M2): gitea component VERIFIED (3/6) — chaos-deploy fix, no read-only crash, app.ini seeded 1862B, API 1.24.2; canonical unchanged; merge-gating honest	2026-06-18 06:17:57 +00:00
autonomic-bot	6ff71f76b3	note(redfix-M2): mumble component VERIFIED (2/6) — handshake PASS 10.3s (flake confirmed, fix non-weakening); consume inbox (b96b8a4 staleness is bluesky-only, keycloak/mumble unaffected)	2026-06-18 06:13:34 +00:00
autonomic-bot	983b0392cc	inbox(redfix): M2 verify heads-up — harness branch reset to 07fc6d4 (b96b8a4 dropped); bluesky now ${STACK_NAME}_app recipe-PR-only; use direct chaos-deploy for gitea/bluesky (promote merge-gated)	2026-06-18 06:12:04 +00:00
autonomic-bot	5babd027f0	note(redfix-M2): keycloak component VERIFIED (1/6) — promote at warm-canon-keycloak, live SSO undisturbed (up 4d, 200); gate verdict pending 5 more	2026-06-18 06:09:23 +00:00
autonomic-bot	0e255d8570	claim(redfix-M2): all 6 canon-sweep failures FIXED + verified green ... mattermost-lts (PR #1, !testme #901), discourse (PR #4, !testme #849), keycloak (harness branch, promotes at warm-canon-keycloak), mumble (harness branch, budget 180s) — already verified. gitea (PR #2 @a0f2db8, app.ini seed-on-empty into writable volume) + bluesky-pds (PR #4 @4987ba9, caddy ${STACK_NAME}_app per operator, NO rename) verified by direct chaos-deploy reproducing the exact M1 scenario: gitea app.ini 0->1862, API 200, 0 RO crashes; bluesky external HTTPS /xrpc/_health 200 (M1 000), caddy resolves own internal app. Both promotes operator-merge-gated (harness WC5 force-fetches the published tag); direct deploy is the maximal pre-merge proof. No standing exceptions. Nothing merged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bacy8SJhBebNAGoYsi1Fxt	2026-06-18 05:55:43 +00:00
autonomic-bot	966edb3042	note(redfix): idle break-it probe — live keycloak 200 (undisturbed), gitea canonical unchanged (no false promote during rework); M2 not yet claimed	2026-06-18 04:12:39 +00:00
autonomic-bot	12925b5ab8	journal(redfix): M2 4/6 verified; bluesky warm-verify structurally blocked pre-merge (fix proven); gitea needs rework	2026-06-18 02:39:37 +00:00
autonomic-bot	c5bc29bb97	journal(redfix): M2 mumble VERIFIED (4/6); bluesky force-chaos verification plan	2026-06-18 02:28:42 +00:00
autonomic-bot	a65372cfde	journal(redfix): M2 keycloak VERIFIED — canonical promotes at collision-free warm-canon-keycloak, live warm-keycloak undisturbed (200). 3/6 verified	2026-06-18 02:25:02 +00:00
autonomic-bot	6846bbe83d	journal(redfix): M2 — bluesky verify blocked by abra non-chaos tag-revert (recipe fixes need chaos); keycloak/mumble (harness) verify cleanly, doing next	2026-06-18 02:21:19 +00:00
autonomic-bot	ed7d897e5f	status(redfix): M2 tracker — mattermost+discourse VERIFIED; bluesky rename routing-works-but-backup-fails; gitea needs rework; keycloak/mumble pending verify	2026-06-18 02:16:47 +00:00
autonomic-bot	fca936ef50	note(redfix): M2 interim corroboration — mattermost-lts run #901 restore tier (test_restore_returns_state) PASSES, clean teardown + no leak; non-contending artifact check, not a verdict; M2 not yet claimed	2026-06-18 02:15:17 +00:00
autonomic-bot	c021d7e305	journal(redfix): M2 gitea fix v1 (seed) broke 3.5.3->3.6.0 transition (wizard mode); reverted clone, needs rework; proceeding to bluesky/keycloak/mumble	2026-06-18 02:09:43 +00:00
autonomic-bot	278cb4e4b8	journal(redfix): M2 progress — gitea PR #2 + advance verifying; bluesky rename PR #4; harness branch redfix-m2-harness pushed (keycloak/mumble/bluesky-exec)	2026-06-18 02:00:06 +00:00
autonomic-bot	c742f9adc4	journal(redfix): cc-ci-side verification mechanism (temp-checkout run) + M2 progress snapshot	2026-06-18 01:51:54 +00:00
autonomic-bot	125e1ba675	journal(redfix): M2 bluesky — abra drops compose net aliases (proven); pivot to service rename app->pds + coupled cc-ci exec-ref update	2026-06-18 01:50:26 +00:00
autonomic-bot	c3854a9bcc	status+journal(redfix): M2 — mattermost-lts FIXED (run #901 all green, restore fixed); discourse #4 green; bluesky PR #4 created (promote-path verify next)	2026-06-18 01:30:57 +00:00
autonomic-bot	abfbe8b0aa	journal+status(redfix): M2 recon — discourse #4 (official-image) already !testme-green; mattermost #1 (pg-restore) triggered for verify	2026-06-18 01:24:48 +00:00
autonomic-bot	6771c713f0	inbox(redfix): consume Adversary M1-PASS heads-up — node clean (gitea idle 3.5.3 unchanged, keycloak healthy); proceeding to M2	2026-06-18 01:20:27 +00:00
autonomic-bot	191ddc9fb8	status(redfix): M1 PASS (Adversary cold-verified all 6 classifications CORRECT); begin M2 fixes	2026-06-18 01:20:15 +00:00
autonomic-bot	b6038e9796	inbox(redfix): heads-up to Builder — M1 PASS, node restored clean (gitea idle 3.5.3 canonical unchanged), cleared for M2	2026-06-18 01:19:52 +00:00
autonomic-bot	edee91341c	review(redfix-M1): PASS — all 6 classifications cold-verified by my own isolation re-runs. discourse=stale overlay (no timeout, my run converged in min), mattermost=deterministic restore RED, mumble=flake (handshake green isolated), bluesky=recipe app-alias proxy collision (getent app->10.10.0.4, not machinery), gitea=read-only app.ini JWT crash (canonical unchanged), keycloak=warm-domain collision. No VETO. Node clean before+after.	2026-06-18 01:19:27 +00:00