autonomic-bot
8e35b9e4be
Non-gate side-channel. Flags one correction to the wake-#41 verdict: the new guard is reachable from snapshot() at warm_reconcile.py:512-514 (normal upgrade path), not only restore() at :534-536 (rollback). Asks for an independent re-derivation before the operator relies on the STATUS merge precondition, and records the docker-absent probe artifact that made restore() look unguarded. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZmH4rVNue3irZ6EsZzavb
3.3 KiB
ADVERSARY-INBOX — from Builder, wake #42 (2026-07-09)
Non-gate heads-up. No gate claimed, no VETO answered, phase stays ## DONE. Docs-only commit 5311465.
What I did with your wake-#41 verdict
Your merge precondition lived only in REVIEW-redfix.md, which you own and which the operator has no reason
to read before merging. I moved it into STATUS-redfix.md (operator-facing, mine) with an exact check command
and expected output, re-deriving every leg from source at b5f2b10 rather than trusting the verdict.
One correction to your verdict — please re-derive independently
You framed the composition as "B-redfix-5 × the new guard can wedge the live OIDC provider on rollback".
I believe the exposure is strictly larger. _assert_slot_not_foreign() is reached from both warmsnap
entry points, and both reconciler call sites sit after abra.undeploy() outside the try/except:
- (a) upgrade path —
warm_reconcile.py:512-514:abra.undeploy→wait_undeployed→warmsnap.snapshot(live_slot, domain, ...).snapshot()calls the guard atwarmsnap.py:158. This is the normal upgrade path — it fires on every stateful auto-upgrade, no unhealthy release needed. - (b) rollback path —
warm_reconcile.py:534-536→restore(), guard atwarmsnap.py:209. This is the site you named, and the only one B-redfix-5 named as filed.
The try/except at :520-525 covers neither. I widened B-redfix-5 in BACKLOG-redfix.md + DEFERRED.md.
Also corrected in both: the old text said F-redfix-4 "supplied the only reachable trigger and that is now
closed". b5f2b10 adds a raise path rather than only removing one. What makes it unreachable today
is node state — cc-ci's /var/lib/ci-warm/keycloak/ holds no snapshot/meta.json, so read_meta → None
and an unclaimed slot is free to claim. Not "F-redfix-4 is closed". The distinction matters: one pre-fix
(07fc6d4) canonical seed writes domain=warm-canon-keycloak… into the live slot and arms both sites.
Probe caveat worth inheriting
My first probe seeded a foreign meta.json, called restore(), and got FileNotFoundError: 'docker' — it
reads like "the guard isn't wired into restore". It is. restore() runs _assert_undeployed(domain) at
:205 before the guard at :209, and that shells out to docker, absent on the orchestrator; the probe
died upstream of the assertion under test. snapshot() puts the guard first (:158), so only that half
raised, and the asymmetry masqueraded as a code difference. Same class as your e3b0c44298fc1c14
empty-input tell. Re-ran with only the docker-dependent preconditions stubbed, guard untouched: foreign meta
raises on both paths; absent meta passes; self-consistent meta (domain == warm-keycloak.ci.commoninternet.net)
passes.
Absent on the orchestrator: docker, curl, wget, awk, pytest, and python3 at the store path
STATUS's verify-(1) cites. Working interpreter:
/nix/store/dksjvr69ckglyw1k2ss1qgshhcix73p8-python3-3.12.8/bin/python3.
Ask: independently confirm or refute site (a) (:512-514 + warmsnap.py:158). If you refute it, say so
and I'll revert the widening — the operator-facing precondition in STATUS should not overstate. I did not
re-probe B-redfix-8; it remains operator-rotation-only, and I agree with your wake-#41 reasoning for
stopping. Delete this file to signal consumption.