Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 autonomic-bot
|
e83cd46806 | ||
|
autonomic-bot
|
2a7cdcdee4 |
@@ -9,9 +9,6 @@
|
||||
- [x] Verify no Ghost resources leak after the retry — no `ghos-*`/`dev-ghost` stacks, services, or volumes
|
||||
- [x] M1 current evidence Adversary-verified — PASS @2026-09-07T21:29:58Z
|
||||
- [x] M2 current operator-ready outcome Adversary-verified — PASS @2026-09-07T21:29:58Z
|
||||
- [x] Fresh current PR#8 post-proxy retry — comment 16237, build #50, level 5/5
|
||||
- [x] Fresh PR#8 cleanup and duplicate inventory — exactly one open PR, no Ghost resources
|
||||
- [x] Fresh M1/M2 revalidation Adversary-verified — PASS @2026-10-13T03:14:20Z
|
||||
|
||||
## Adversary findings
|
||||
|
||||
|
||||
@@ -131,19 +131,3 @@ The authoritative host artifact `/var/lib/cc-ci-runs/1332/results.json` reports
|
||||
proxy subnet `10.10.0.0/16` and no matching Ghost stacks, services, volumes, or networks. The
|
||||
unauthenticated Drone API endpoint returned HTTP 401, so no claim is based on that endpoint; the
|
||||
host artifact and Gitea result comment remain the verification sources.
|
||||
|
||||
## 2026-10-13T03:14Z — Fresh PR#8 revalidation
|
||||
|
||||
Live inventory found exactly one open Ghost upgrade PR: PR#8, branch `upgrade-ee04ca9`, head
|
||||
`ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d`; PRs #1 through #7 are closed. The proxy network is
|
||||
`10.10.0.0/16`.
|
||||
|
||||
Triggered `!testme` as Gitea comment `16237` at `2026-10-13T03:11:52Z`. The bridge created build
|
||||
#50 and result comment `16238`. The cold artifact `/var/lib/cc-ci-runs/50/results.json` reports
|
||||
level 5, `install`, `upgrade`, `backup`, `restore`, `custom`, and `lint` all passing, with
|
||||
`clean_teardown=true`, `no_secret_leak=true`, and no skipped stages. The upgrade stage included
|
||||
`tests.ghost.test_upgrade.test_upgrade_preserves_state`.
|
||||
|
||||
Host probes after completion found no `ghos-*` or `dev-ghost` stacks, services, volumes, or
|
||||
networks. The Adversary independently recorded M1 and M2 PASS at `2026-10-13T03:14:20Z` in
|
||||
`REVIEW-ghost.md`.
|
||||
|
||||
@@ -145,21 +145,3 @@ Builder may write `## DONE` to STATUS-ghost.md.
|
||||
- Current Swarm cleanup probe found no Ghost-named resources, and the phase's current PR head matches the level-5 result artifact.
|
||||
|
||||
**Fresh verdict:** M1 and M2 PASS. The ghost phase is operator-ready; the 2026-06-12 failures remain historical, pre-proxy/load-confounded evidence and are not evidence against the current PR.
|
||||
|
||||
## Fresh revalidation
|
||||
|
||||
**M1: PASS @2026-10-13T03:14:20Z**
|
||||
|
||||
- Cold Gitea inventory shows exactly one open Ghost upgrade PR: #8, `chore: upgrade ghost to 6.69.0-alpine`, head `ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d`, branch `upgrade-ee04ca9`.
|
||||
- The fresh `!testme` comment is Gitea comment #16237 at 2026-10-13T03:11:52Z. Its result comment #16238 links Drone build #50 and reports pass.
|
||||
- Cold Drone API check for build #50 reports `success` with parameters `RECIPE=ghost`, `PR=8`, `REF=ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d`; the exec pipeline and both steps also report success.
|
||||
- Cold host artifact `/var/lib/cc-ci-runs/50/results.json` matches PR #8 and the full level-5 matrix: install, upgrade, backup, restore, custom, and lint are all `pass`; `clean_teardown=true`, `no_secret_leak=true`, and no stages are skipped.
|
||||
- This evidence is post-proxy and current; the 2026-06-12 failures remain historical and were not used as current recipe evidence.
|
||||
|
||||
**M2: PASS @2026-10-13T03:14:20Z**
|
||||
|
||||
- Exactly one relevant open Ghost upgrade PR remains: #8. The prior PR #7 is no longer open, and no duplicate open upgrade PR is present.
|
||||
- The operator-facing result comment #16238 is green and links build #50.
|
||||
- Cold Swarm probes found no `ghos-*` or `dev-ghost` stacks, services, volumes, or networks after build #50; the proxy subnet remains `10.10.0.0/16`.
|
||||
|
||||
**Fresh verdict:** M1 and M2 PASS. The current Ghost upgrade PR is operator-ready, the fresh post-proxy retry is green, the historical failure classification remains valid, and no Ghost resources leak.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# STATUS — phase ghost (ghost upgrade re-evaluation)
|
||||
|
||||
**Updated:** 2026-10-13T03:14:20Z
|
||||
**Updated:** 2026-09-07T21:35Z
|
||||
**Phase:** ghost
|
||||
**Builder:** autonomic-bot
|
||||
|
||||
@@ -8,18 +8,18 @@
|
||||
|
||||
## DONE
|
||||
|
||||
Both M1 and M2 have fresh Adversary PASSes dated 2026-10-13T03:14:20Z. The current canonical
|
||||
Ghost upgrade PR is #8; historical PR#7 is closed.
|
||||
Both M1 and M2 have fresh Adversary PASSes dated 2026-09-07T21:29:58Z. The current canonical
|
||||
Ghost upgrade PR is #7; historical PR#4 was merged after the June completion.
|
||||
|
||||
| Check | Result |
|
||||
|---|---|
|
||||
| Current Ghost PR | PR#8, `upgrade-ee04ca9`, head `ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d` |
|
||||
| Fresh post-proxy retry | Gitea comment `16237`; Drone build #50 |
|
||||
| Build #50 | success, level 5/5; install, upgrade, backup, restore, custom, and lint passed |
|
||||
| PR result comment | Gitea comment `16238` reports passed and links build #50 |
|
||||
| Current Ghost PR | PR#7, `upgrade-808ac05`, head `14575de6209ab2c4fb29d95fe454b761070cd351` |
|
||||
| Fresh post-proxy retry | Gitea comment `15814`; Drone build #1332 |
|
||||
| Build #1332 | success, level 5/5; install, upgrade, backup, restore, custom, and lint passed |
|
||||
| PR result comment | Gitea comment `15815` reports passed and links build #1332 |
|
||||
| Post-run cleanup | no `ghos-*`/`dev-ghost` stacks, services, or volumes |
|
||||
| M1 Adversary PASS | `REVIEW-ghost.md`, 2026-10-13T03:14:20Z |
|
||||
| M2 Adversary PASS | `REVIEW-ghost.md`, 2026-10-13T03:14:20Z |
|
||||
| M1 Adversary PASS | `REVIEW-ghost.md`, 2026-09-07T21:29:58Z |
|
||||
| M2 Adversary PASS | `REVIEW-ghost.md`, 2026-09-07T21:29:58Z |
|
||||
|
||||
### Definition-of-Done checklist (ghost phase)
|
||||
|
||||
@@ -32,22 +32,22 @@ Ghost upgrade PR is #8; historical PR#7 is closed.
|
||||
|
||||
## M1 — State inventory and clean retry
|
||||
|
||||
**Result:** current canonical Ghost upgrade PR verified by build #50.
|
||||
**Result:** current canonical Ghost upgrade PR verified by build #1332.
|
||||
|
||||
### Live inventory
|
||||
|
||||
| Check | Result |
|
||||
|---|---|
|
||||
| Open Ghost PRs | PR#8 only: `upgrade-ee04ca9` at `ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d` |
|
||||
| Historical PR#7 | closed; not the current upgrade PR |
|
||||
| Historical duplicates | PR#1 through PR#7 closed |
|
||||
| Open Ghost PRs | PR#7 only: `upgrade-808ac05` at `14575de6209ab2c4fb29d95fe454b761070cd351` |
|
||||
| Historical PR#4 | closed 2026-06-15; not the current upgrade PR |
|
||||
| Historical duplicates | PR#3, PR#5, and PR#6 closed |
|
||||
| Proxy subnet | `10.10.0.0/16` |
|
||||
| Ghost stacks/services/volumes before retry | none |
|
||||
| Fresh retry | Gitea comment `16237` at 2026-10-13T03:11:52Z; Drone build #50 success, level 5/5 |
|
||||
| Fresh retry | Gitea comment `15814` at 2026-09-07T21:29:04Z; Drone build #1332 success, level 5/5 |
|
||||
|
||||
### Adversary verification inputs
|
||||
|
||||
**WHAT:** M1 and M2 claim the current live PR `recipe-maintainers/ghost#8` and fresh post-proxy build #50.
|
||||
**WHAT:** M1 is in progress. The correct live PR is `recipe-maintainers/ghost#7`, not historical PR#4. Build #1332 is the fresh post-proxy retry for its current head.
|
||||
|
||||
**HOW:**
|
||||
|
||||
@@ -56,12 +56,12 @@ set -a; . /srv/cc-ci/cc-ci-plan/load-env.sh; set +a
|
||||
curl -fsS -u "$GITEA_USERNAME:$GITEA_PASSWORD" \
|
||||
"https://$GITEA_URL/api/v1/repos/recipe-maintainers/ghost/pulls?state=open" \
|
||||
| jq -r '.[] | [.number, .state, .head.sha, .head.ref] | @tsv'
|
||||
ssh cc-ci 'docker network inspect proxy --format "{{range .IPAM.Config}}{{.Subnet}}{{end}}"; docker stack ls --format "{{.Name}}" | rg "^(ghos-|dev-ghost)" || true; jq -c "{recipe,pr,ref,level,results,flags,skips}" /var/lib/cc-ci-runs/50/results.json'
|
||||
ssh cc-ci 'docker network inspect proxy --format "{{range .IPAM.Config}}{{.Subnet}}{{end}}"; docker stack ls --format "{{.Name}}" | rg "^(ghos-|dev-ghost)" || true'
|
||||
```
|
||||
|
||||
**EXPECTED:** one open PR (`8`, `ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d`, `upgrade-ee04ca9`), proxy subnet `10.10.0.0/16`, and no Ghost stack output. Build #50 reports `success`, level `5`, all lifecycle results `pass`, `clean_teardown=true`, and `no_secret_leak=true`.
|
||||
**EXPECTED:** one open PR (`7`, `14575de6209ab2c4fb29d95fe454b761070cd351`, `upgrade-808ac05`), proxy subnet `10.10.0.0/16`, and no Ghost stack output. Build #1332 reports `success`, level `5`, and all lifecycle results `pass`.
|
||||
|
||||
**WHERE:** Gitea issue comments `16237` and `16238`; Drone URL `https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/50`; host artifact `/var/lib/cc-ci-runs/50/results.json`; Adversary evidence in `REVIEW-ghost.md`.
|
||||
**WHERE:** Gitea issue comment `15814`; Drone URL `https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1332`.
|
||||
|
||||
---
|
||||
|
||||
@@ -74,6 +74,5 @@ ssh cc-ci 'docker network inspect proxy --format "{{range .IPAM.Config}}{{.Subne
|
||||
| 519 | 2026-06-12T03:03Z | d88f5801 | ❌ FAIL | pre-proxy-fix, MySQL timing under load |
|
||||
| 557 | 2026-06-12T21:51Z | d88f5801 | ❌ FAIL | pre-proxy-fix |
|
||||
| **612** | **2026-06-13T06:13Z** | **d88f5801** | **✅ PASS level 5/5** | **post-proxy-fix** |
|
||||
| **50** | **2026-10-13T03:12Z** | **ee04ca9e** | **✅ PASS level 5/5** | **fresh current PR#8 retry** |
|
||||
|
||||
Proxy /16 fix: 2026-06-13T05:38Z (pvfix phase).
|
||||
|
||||
@@ -27,7 +27,6 @@ from __future__ import annotations
|
||||
|
||||
import json
|
||||
import os
|
||||
import shutil
|
||||
import xml.etree.ElementTree as ET
|
||||
|
||||
from . import level as level_mod
|
||||
@@ -36,17 +35,6 @@ from . import level as level_mod
|
||||
# The dashboard serves these read-only at /runs/<run_id>/... (U0.4). Overridable for tests.
|
||||
RUNS_DIR_DEFAULT = "/var/lib/cc-ci-runs"
|
||||
|
||||
# The artifact files/dirs a run OWNS in its run dir (written fresh every run).
|
||||
_OWNED_ARTIFACTS = (
|
||||
"results.json",
|
||||
"summary.html",
|
||||
"summary.png",
|
||||
"badge.svg",
|
||||
"lint.txt",
|
||||
"screenshot.png",
|
||||
"junit",
|
||||
)
|
||||
|
||||
|
||||
def runs_dir() -> str:
|
||||
return os.environ.get("CCCI_RUNS_DIR", RUNS_DIR_DEFAULT)
|
||||
@@ -61,31 +49,6 @@ def run_id() -> str:
|
||||
return os.environ.get("CCCI_APP_DOMAIN") or os.environ.get("CCCI_RUN_ID") or "manual"
|
||||
|
||||
|
||||
def fresh_artifact_dir(path: str) -> str:
|
||||
"""Ensure the run artifact dir holds no stale artifacts from a PREVIOUS run with the same id.
|
||||
|
||||
Drone build numbers restarted when its DB was re-created (2026-09-27) while /var/lib/cc-ci-runs
|
||||
still holds old-era dirs numbered into the thousands — a new build reusing an old number would
|
||||
otherwise mix old artifacts into the new run's card (observed 2026-10-05: !testme gitea build 35
|
||||
collided with a May-31 run 35 and embedded custom-html-tiny's fossil screenshot.png, because
|
||||
screenshot.capture() skips its snap when out_path already exists). Removes ONLY the files/dirs
|
||||
this run owns (see _OWNED_ARTIFACTS); anything else in the dir is left untouched. Best-effort
|
||||
(R7): never raises into the run."""
|
||||
os.makedirs(path, exist_ok=True)
|
||||
for name in _OWNED_ARTIFACTS:
|
||||
p = os.path.join(path, name)
|
||||
if os.path.isdir(p):
|
||||
shutil.rmtree(p, ignore_errors=True)
|
||||
else:
|
||||
try:
|
||||
os.remove(p)
|
||||
except FileNotFoundError:
|
||||
pass
|
||||
except OSError:
|
||||
pass # R7: a stuck file must never fail the run — the card is best-effort anyway
|
||||
return path
|
||||
|
||||
|
||||
def junit_file(junit_dir: str, tier: str, source: str, path: str) -> str:
|
||||
"""Deterministic per-(tier,source,file) JUnit XML path under junit_dir."""
|
||||
base = os.path.splitext(os.path.basename(path))[0]
|
||||
|
||||
@@ -142,12 +142,11 @@ def capture(domain: str, out_path: str, *, recipe_meta: dict | None = None) -> s
|
||||
page = context.new_page()
|
||||
if hook is not None:
|
||||
# Recipe-specific safe view (post-login etc.). The hook owns navigation +
|
||||
# the no-secret-page guarantee; we ALWAYS snap the page after it returns.
|
||||
# Never trust a pre-existing out_path: a recycled run artifact dir (drone
|
||||
# build numbers restarted 2026-09-27 while old-era dirs linger) must not get
|
||||
# its fossil screenshot embedded (observed 2026-10-05, !testme gitea #10
|
||||
# build 35). SCREENSHOT(page, ctx) — the uniform ctx convention (rcust P3).
|
||||
# the no-secret-page guarantee; it should call page.screenshot itself, but if
|
||||
# it doesn't, we still snap the resulting page below. SCREENSHOT(page, ctx) —
|
||||
# the uniform ctx convention (rcust P3).
|
||||
hook(page, meta_mod.hook_ctx(domain, recipe_meta))
|
||||
if not os.path.exists(out_path):
|
||||
_snap_with_blank_retry(page, out_path)
|
||||
else:
|
||||
# Default: landing page. Accept any rendered status (200 or an auth redirect to a
|
||||
|
||||
@@ -1184,10 +1184,6 @@ def main() -> int:
|
||||
# {tier,source,file,rc,junit} record; after the run we assemble results.json (per-stage/per-test +
|
||||
# level) into the artifact dir. Best-effort — never changes the verdict (R7).
|
||||
run_artifact_dir = os.path.join(results_mod.runs_dir(), results_mod.run_id())
|
||||
# Collision guard (2026-10-05): drone build numbers restarted when its DB was re-created while
|
||||
# old-era run dirs (same numbers, other recipes' artifacts — e.g. a fossil screenshot.png) are
|
||||
# still on disk. Wipe the files THIS run owns so nothing stale survives into the card.
|
||||
results_mod.fresh_artifact_dir(run_artifact_dir)
|
||||
junit_dir = os.path.join(run_artifact_dir, "junit")
|
||||
records: list[dict] = []
|
||||
|
||||
|
||||
@@ -489,50 +489,3 @@ def test_write_results_roundtrip(tmp_path):
|
||||
assert path.endswith("/42/results.json")
|
||||
with open(path) as f:
|
||||
assert json.load(f)["level"] == 3
|
||||
|
||||
|
||||
def test_fresh_artifact_dir_removes_owned_stale_artifacts(tmp_path):
|
||||
"""Run-dir collision guard (2026-10-05): drone build numbers restarted while old-era run dirs
|
||||
linger in /var/lib/cc-ci-runs — a new build reusing an old number must not mix the old run's
|
||||
artifacts (fossil screenshot.png from ANOTHER recipe) into its card. Only OWNED artifacts go."""
|
||||
d = tmp_path / "35"
|
||||
d.mkdir()
|
||||
(d / "results.json").write_text('{"old": true}')
|
||||
(d / "screenshot.png").write_bytes(b"stale-fossil")
|
||||
(d / "summary.png").write_bytes(b"stale")
|
||||
(d / "badge.svg").write_text("<svg/>")
|
||||
(d / "lint.txt").write_text("old")
|
||||
(d / "summary.html").write_text("<html/>")
|
||||
(d / "junit").mkdir()
|
||||
(d / "junit" / "old.xml").write_text("<x/>")
|
||||
(d / "untracked-thing.bin").write_bytes(b"keep me") # NOT owned — must survive
|
||||
|
||||
R.fresh_artifact_dir(str(d))
|
||||
|
||||
for name in (
|
||||
"results.json",
|
||||
"screenshot.png",
|
||||
"summary.png",
|
||||
"badge.svg",
|
||||
"lint.txt",
|
||||
"summary.html",
|
||||
):
|
||||
assert not (d / name).exists(), f"stale owned artifact {name} survived"
|
||||
assert not (d / "junit").exists(), "stale junit dir survived"
|
||||
assert (d / "untracked-thing.bin").read_bytes() == b"keep me", "unowned file was deleted"
|
||||
|
||||
|
||||
def test_fresh_artifact_dir_creates_missing_dir(tmp_path):
|
||||
d = tmp_path / "36"
|
||||
out = R.fresh_artifact_dir(str(d))
|
||||
assert out == str(d) and d.is_dir()
|
||||
|
||||
|
||||
def test_fresh_artifact_dir_tolerant_of_odd_entries(tmp_path):
|
||||
"""R7: never raise into the run — a dir where an owned name is itself a dir must still work."""
|
||||
d = tmp_path / "37"
|
||||
d.mkdir()
|
||||
(d / "screenshot.png").mkdir() # perverse: a DIRECTORY named screenshot.png
|
||||
(d / "junit").mkdir()
|
||||
R.fresh_artifact_dir(str(d))
|
||||
assert not (d / "screenshot.png").exists() and not (d / "junit").exists()
|
||||
|
||||
@@ -184,78 +184,3 @@ def test_screenshot_reachable_through_real_load_path(tmp_path):
|
||||
hook = S._load_screenshot_hook(meta)
|
||||
assert callable(hook), "SCREENSHOT hook did not survive the orchestrator load path (R2)"
|
||||
assert S._load_screenshot_hook(meta_mod.load("no-such", tests_dir=str(tmp_path))) is None
|
||||
|
||||
|
||||
# ---- capture() fossil guard (2026-10-05) -----------------------------------------------------
|
||||
# Drone build numbers restarted when its DB was re-created while /var/lib/cc-ci-runs still holds
|
||||
# old-era dirs numbered into the thousands; run 35 (!testme gitea #10) collided with a May-31 run
|
||||
# 35 and embedded custom-html-tiny's fossil screenshot.png because the hook branch SKIPPED the
|
||||
# snap when out_path already existed. capture() must always snap fresh.
|
||||
|
||||
|
||||
class _FakeLaunchable:
|
||||
def __init__(self, page):
|
||||
self._page = page
|
||||
self.chromium = self
|
||||
|
||||
def launch(self, args=None):
|
||||
return self
|
||||
|
||||
def new_context(self, **kw):
|
||||
return self
|
||||
|
||||
def new_page(self):
|
||||
return self._page
|
||||
|
||||
def close(self):
|
||||
pass
|
||||
|
||||
|
||||
class _FakeSyncPlaywright:
|
||||
"""sync_playwright() replacement: context-manager factory handing out one fake browser."""
|
||||
|
||||
def __init__(self, page):
|
||||
self._page = page
|
||||
|
||||
def __call__(self):
|
||||
return self
|
||||
|
||||
def __enter__(self):
|
||||
return _FakeLaunchable(self._page)
|
||||
|
||||
def __exit__(self, *exc):
|
||||
return False
|
||||
|
||||
|
||||
def _install_fake_playwright(monkeypatch, page):
|
||||
import types
|
||||
|
||||
fake_api = types.ModuleType("playwright.sync_api")
|
||||
fake_api.sync_playwright = _FakeSyncPlaywright(page)
|
||||
fake = types.ModuleType("playwright")
|
||||
fake.sync_api = fake_api
|
||||
monkeypatch.setitem(sys.modules, "playwright", fake)
|
||||
monkeypatch.setitem(sys.modules, "playwright.sync_api", fake_api)
|
||||
|
||||
|
||||
def test_capture_overwrites_fossil_screenshot(tmp_path, monkeypatch):
|
||||
"""A pre-existing out_path in a recycled run artifact dir must never be embedded: the hook
|
||||
branch snaps fresh regardless (the old exists-guard returned the fossil as 'captured')."""
|
||||
out_path = str(tmp_path / "screenshot.png")
|
||||
with open(out_path, "wb") as f:
|
||||
f.write(b"STALE-FOSSIL-FROM-ANOTHER-RECIPE" * 400)
|
||||
|
||||
fired = {}
|
||||
page = _FakePage([35707]) # one real-sized frame, like a painted page
|
||||
|
||||
def hook(p, ctx):
|
||||
fired["yes"] = True # navigation only — hooks never save the PNG themselves
|
||||
|
||||
_install_fake_playwright(monkeypatch, page)
|
||||
got = S.capture("gitea.example.org", out_path, recipe_meta={"SCREENSHOT": hook})
|
||||
|
||||
assert got == out_path, "capture must report success after snapping fresh"
|
||||
assert fired.get("yes"), "SCREENSHOT hook must run"
|
||||
assert page.shots == 1, "capture must snap exactly once — the fossil is not a captured frame"
|
||||
with open(out_path, "rb") as f:
|
||||
assert f.read(4) == b"\x89PNG", "out_path still holds the fossil — snap did not overwrite"
|
||||
|
||||
Reference in New Issue
Block a user