25 Commits

Author	SHA1	Message	Date
autonomic-bot	78af2c995a	note(redfix): post-verdict JOURNAL consult — warm-state dimension never considered (F-redfix-4 is a blind spot, not a deferral)	2026-07-08 23:58:32 +00:00
autonomic-bot	941d5e81c1	review(redfix): VETO — keycloak enrollment not collision-free in warm state (F-redfix-4) ... Post-reboot re-confirmation #8. New break-it probe on the two HARNESS fixes (previously only sha-reachability checked, never content, never second-order effects). mumble 07fc6d4: CLEAN — attempts 12->36 @5.0s = claimed 180s; all assertions unchanged, so a dead server still FAILs. Budget widened without weakening the test. keycloak 61211db: correct at the domain/stack layer, but its own invariant is FALSE. canonical_domain() separates the two deployments by domain, yet warm STATE is keyed by recipe: warmsnap.snap_dir("keycloak") is ONE slot shared by the live-warm reconciler (warm-keycloak, stateful=True) and the newly-enrolled data-warm canonical (warm-canon-keycloak, seeded via promote_canonical -> seed_canonical, no WARM_DOMAINS guard). Proved by execution on cc-ci in a scratch CCCI_WARM_ROOT against the real idle canon stack: snapshot(canon) -> snapshot(other stack) destroys the canonical known-good, and restore(canon) raises SnapshotError. Fails closed (no cross-stack data write), but: 1. every stateful reconciler upgrade deterministically destroys the canonical snapshot; 2. the reconciler's rollback restore() is OUTSIDE its try/except and its snapshot->restore window spans deploy+wait_healthy (health_timeout 900). A sweep promote landing there makes the rollback raise AFTER abra.undeploy(live) -> live keycloak left undeployed = outage of the shared OIDC provider lasuite-*/drone depend on. Exactly the hazard canon §2.B's de-enrollment exception existed to prevent. 3. prune_stale()'s documented "keycloak untouched" invariant becomes false once seeded. Undetectable by the M2 run: /var/lib/ci-warm/keycloak/ holds only last_good (no canonical.json, no snapshot/) vs cryptpad which has both — the promote deployed but seed_canonical never ran, registry-advance being deferred to the operator's merge. First seed happens post-merge, unexercised. VETO scoped to keycloak. M1 classifications and the discourse/mattermost-lts/gitea/bluesky-pds/ mumble fixes are unaffected and remain PASS. Clears when the two deployments use disjoint warm-state paths and each restore() returns its own stack's volumes. Node left clean: real warm root untouched, volumes intact, live keycloak 200 throughout.	2026-07-08 23:58:01 +00:00
autonomic-bot	4682aa1216	review(redfix): post-reboot re-confirmation #7 — DONE stands, no VETO. Zero delta since #6 (Builder JOURNAL append only). New break-it probe: verified fix CONTENT (not just sha reachability) at every M2 anchor via cold bare clones — mattermost-lts 4ca7f418 adds backupbot.restore.post-hook, gitea a0f2db8 adds app.ini.init + docker-setup cp, bluesky-pds 4987ba9 adds FQ APP_HOST with no leftover bare app alias — each with its parent commit as a negative control (0 matches pre-fix). All 4 recipe fixes now content-anchored. All findings closed ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HHWWoceR5fHLTEwW8b3QnQ	2026-07-08 23:42:52 +00:00
autonomic-bot	c6593bbf6e	review(redfix): post-reboot re-confirmation #6 — DONE stands, no VETO. Zero delta since #5 (only a Builder JOURNAL append). Break-it probe on evidence-anchor rot: cold bare-cloned all 3 remaining recipe mirrors — mattermost-lts 4ca7f418, gitea a0f2db8, bluesky-pds 4987ba9 all REACHABLE with subjects matching their asserted fixes, and harness branch redfix-m2-harness still pins exactly 07fc6d4 (mumble) with 61211db (keycloak) reachable. Rot confined to discourse (F-redfix-3, CLOSED). All findings closed ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WY7MNKwa6gascKiXER9ZbN	2026-07-08 23:36:00 +00:00
autonomic-bot	805c44e42d	review(redfix): post-reboot re-confirmation #5 — DONE stands, no VETO. Audited Builder's F-redfix-3 addendum (612412c): append-only (+54/-0), my files + DONE line + historical shas untouched, no gate reopened. Ran its published repro verbatim in a fresh clone: ede6399 → official image 3.5.3 + 0 sidekiq, both EXPECTED met. Ruled out vacuous zero (file exists, blob, services:app: present) and added negative control (d7c8c47 added sidekiq, 0c4539b removed it) — fix COMMIT still reachable, only sha labels rotted. F-redfix-3 remedy verified, not just asserted	2026-07-08 23:29:09 +00:00
autonomic-bot	1271c248b9	review(redfix): post-reboot re-confirmation #4 — DONE stands, no VETO (M1+M2 intact, both findings closed) + NEW non-blocking F-redfix-3 (CLOSED): discourse M2 evidence shas 9ff5e19/53ba0910 gone from mirror (branch rebased+extended by later phases), but fix CONTENT re-verified at HEAD ede6399 — official image + 0 sidekiq; other 3 recipe shas + harness branch pin exactly	2026-07-08 23:22:05 +00:00
autonomic-bot	67e86ded88	review(redfix): F-redfix-2 CLOSED — gitignore remedy cold-verified (fresh-clone + add -A replay, origin/main, no HTTP exposure); full 51-char key never committed (my prefix-grep was self-contaminated); Builder's symlink correction confirmed — one repo, fix fully applied; rotation left to operator; DONE stands, no VETO; consumed ADVERSARY-INBOX	2026-07-08 23:13:26 +00:00
autonomic-bot	a16c367091	review(redfix): DONE re-confirmed post-reboot #3 (M1+M2 PASS, no VETO) + NEW non-blocking finding F-redfix-2 — live API key in un-gitignored config.json at both Builder clone roots (never committed; one 'git add -A' from a push)	2026-07-08 23:06:44 +00:00
autonomic-bot	ddf3788483	note(redfix): post-reboot re-confirmation — phase remains DONE (M1+M2 PASS, no VETO); node healthy; no pending claim; loop stopped	2026-07-08 20:29:07 +00:00
autonomic-bot	337931065a	review(redfix-M2): PASS 6/6 — discourse re-verified level=5 (F-redfix-1 CLOSED); all 6 canon-sweep fixes cold-verified; node clean; no VETO; Builder cleared to DONE	2026-06-18 07:06:27 +00:00
autonomic-bot	3f5eddfdbd	review(redfix-M2): FAIL — 5/6 PASS (keycloak/mumble/gitea/bluesky/mattermost), discourse FAIL (F-redfix-1: incomplete migration, dangling image-less sidekiq in compose.smtpauth.yml -> R011 lint regression + breaks smtp-auth; run #849 also level=4)	2026-06-18 06:45:46 +00:00
autonomic-bot	21e8ca336e	note(redfix-M2): bluesky-pds component VERIFIED (4/6) — chaos-deploy fix, caddy resolves own app 10.0.5.5 (bare app=foreign 10.10), health 200 {0.4.219}, 0 conn-refused; node clean	2026-06-18 06:21:42 +00:00
autonomic-bot	319ec9cd36	note(redfix-M2): gitea component VERIFIED (3/6) — chaos-deploy fix, no read-only crash, app.ini seeded 1862B, API 1.24.2; canonical unchanged; merge-gating honest	2026-06-18 06:17:57 +00:00
autonomic-bot	6ff71f76b3	note(redfix-M2): mumble component VERIFIED (2/6) — handshake PASS 10.3s (flake confirmed, fix non-weakening); consume inbox (b96b8a4 staleness is bluesky-only, keycloak/mumble unaffected)	2026-06-18 06:13:34 +00:00
autonomic-bot	5babd027f0	note(redfix-M2): keycloak component VERIFIED (1/6) — promote at warm-canon-keycloak, live SSO undisturbed (up 4d, 200); gate verdict pending 5 more	2026-06-18 06:09:23 +00:00
autonomic-bot	966edb3042	note(redfix): idle break-it probe — live keycloak 200 (undisturbed), gitea canonical unchanged (no false promote during rework); M2 not yet claimed	2026-06-18 04:12:39 +00:00
autonomic-bot	fca936ef50	note(redfix): M2 interim corroboration — mattermost-lts run #901 restore tier (test_restore_returns_state) PASSES, clean teardown + no leak; non-contending artifact check, not a verdict; M2 not yet claimed	2026-06-18 02:15:17 +00:00
autonomic-bot	edee91341c	review(redfix-M1): PASS — all 6 classifications cold-verified by my own isolation re-runs. discourse=stale overlay (no timeout, my run converged in min), mattermost=deterministic restore RED, mumble=flake (handshake green isolated), bluesky=recipe app-alias proxy collision (getent app->10.10.0.4, not machinery), gitea=read-only app.ini JWT crash (canonical unchanged), keycloak=warm-domain collision. No VETO. Node clean before+after.	2026-06-18 01:19:27 +00:00
autonomic-bot	14aa55f02b	note(redfix): M1 interim — gitea CONFIRMED by my run + container crash log (LoadCommonSettings JWT save to read-only /etc/gitea/app.ini config mount); genuine recipe defect	2026-06-18 01:09:49 +00:00
autonomic-bot	c9c870f0a6	note(redfix): M1 interim — mattermost CONFIRMED deterministic restore RED (ci_marker does not exist, 91s isolation; no restore.post-hook); genuine recipe defect not load-race	2026-06-18 01:02:16 +00:00
autonomic-bot	968780234b	note(redfix): M1 interim — discourse CONFIRMED (no timeout/wedge; install+backup+restore+custom pass, upgrade reds on PR-faithfulness overlay asserting unreleased official:3.5.3/no-sidekiq); stale overlay test	2026-06-18 00:56:57 +00:00
autonomic-bot	5512dcaba5	note(redfix): M1 interim — mumble CONFIRMED flake (handshake test PASSED in my isolation run, all 5 tiers green, promote ok); bluesky orphan cleaned up	2026-06-18 00:44:44 +00:00
autonomic-bot	0c11b0b39d	note(redfix): M1 interim — bluesky-pds CONFIRMED by my reproduction (getent app->10.10.0.4 proxy collision, real app 10.0.5.6 never resolved; deterministic 000); recipe routing defect not machinery/flake	2026-06-18 00:26:19 +00:00
autonomic-bot	93e1e7d87a	note(redfix): M1 pre-staging — mattermost (no restore.post-hook) + discourse (PR-faithfulness overlay) static claims corroborated via code; owe own discourse isolation run + bluesky diag before any PASS	2026-06-18 00:08:31 +00:00
autonomic-bot	a30e71825e	review(redfix): open phase — REVIEW skeleton, cold access to cc-ci confirmed healthy, awaiting Builder bootstrap + M1 claim	2026-06-17 23:19:36 +00:00