cc-ci/machine-docs/REVIEW-settings.md

REVIEW — phase settings (Adversary)

SSOT: /srv/cc-ci/cc-ci-plan/plan-phase-settings-ci-server-config.md Gates: M1 (loader + flag + release-tag-first fallback, unit-tested) · M2 (verified live on server)

Status: awaiting Builder bootstrap. No STATUS-settings.md / claim yet as of 2026-06-17T16:45Z. dash phase is DONE (M1+M2 PASS, commit 7507cf4) — this is the next phase.

Baseline captured (pre-change, for the "false = byte-for-byte unchanged" guardrail)

Cold-read of the code I'll be verifying against (no anchoring — code + plan only):

• resolve_upgrade_base is in runner/run_recipe_ci.py:112. Current no-canonical chain: canonical(version, w/ samever step-back) → main-tip (recipe_branch_commit "main") → skip. The plan (§2.C) inserts newest release tag < head BEFORE main-tip on every no-canonical path.
• The samever helper to reuse: warm_reconcile.newest_older_version(tags, version) (runner/warm_reconcile.py:161) — newest version-tag strictly older than version, keyed on version_key. The fallback MUST reuse this (no divergent version ordering) per §2.C / M1.
• recipe_tags(recipe) = git -C <recipe_dir> tag (warm_reconcile.py:267) — tag source.
• NO existing TOML config module today: CI-server config is scattered os.environ.get(...) (CCCI_*, ABRA_DIR, MAX_TESTS, etc.). No settings.toml tracked. So a NEW minimal loader is justified (verify: minimal, extensible, stdlib tomllib only, defaults baked in, graceful on absent/malformed file/unknown key).

Verification checklist I will run when M1 is CLAIMED

• Default is false → this server's upgrade-base resolution byte-for-byte unchanged.
• flag false + canonical present → canonical (unchanged).
• flag false + NO canonical → newest release tag < head (NOT main-tip).
• no canonical AND no older release tag → main-tip.
• none → skip.
• flag true → canonical lookup BYPASSED → same release-tag-first fallback.
• absent file / absent key → default false; malformed file → no crash, clear handling.
• fallback REUSES samever's helper (no parallel version-ordering impl).
• scope narrow: promotion + --quick warm-reattach UNTOUCHED by the flag.
• loader cannot crash the harness on a bad/absent file.

Verdicts

M1: PASS @2026-06-17T17:00Z (claim fed2678 / code cd19c1b) — cold-verified

Verified from my own clone, fresh shell, against plan §2/§3/§5 + the code — not the Builder's narrative. Read JOURNAL only AFTER writing this verdict (contextualization only).

Tests (re-run cold):

• test_upgrade_base.py + test_settings.py → 32 passed.
• Full unit suite → 315 passed (no regression).
• ruff check → All checks passed!; ruff format → 4 files already formatted.

Independent probes (I patched the I/O boundaries myself — did NOT rely on Builder's fixtures):

• Loader (real TOML files written to /tmp): absent/empty/absent-key → False; true→True, false→False; malformed TOML → WARN + False (no crash); string value → TypeError (clear msg); int 1 for bool → TypeError (no silent truthy coercion — good); unknown key + unknown table → warn-and-ignore, valid key still honored; [upgrade] as scalar → warn + defaults. $CCCI_SETTINGS path override honored. Real get() with no /etc/cc-ci/settings.toml (absent on host) → False.
• Resolver matrix (my own monkeypatch of canonical/recipe_tags/main/flag):
  • false + canonical(≠head) → canonical unchanged; tags & main provably NOT consulted (raised if so).
  • false + no canonical → newest release tag < head (10.7.1+26.6.2), main NOT consulted.
  • false + no canonical + only-head tag → main-tip. false + nothing → skip.
  • true + canonical present → BYPASS → release tag 10.7.1, NOT canonical 10.5.0.
  • true + canonical + no older tag → routes full chain → main-tip.

Guardrails checked:

• Default false / no-op for the default path: canonical-present resolution (this server's steady state) is byte-for-byte unchanged — proven by the probe that asserts tags/main are never consulted. NOTE: the no-canonical fallback IS intentionally changed even under false (release-tag-first), per plan §2.C "always-on … improves this server too" and M1's mandated test …prefers_release_tag_over_main_tip. That is the spec, not a regression — it only fires for recipes with no canonical (un-promoted), giving a real release base instead of a WIP main-tip.
• Reuses samever helper: fallback calls warm_reconcile.newest_older_version(recipe_tags(r), head) — the SAME single-source ordering helper as the step-back. No divergent version ordering.
• Narrow scope: skip_canonicals is read ONLY at run_recipe_ci.py:154 in resolve_upgrade_base. promote_canonical / should_promote_canonical / --quick (951/965/1102) do not touch it.
• Stdlib only: loader imports os, sys, tomllib, dataclasses — no third-party.
• No secrets: settings.toml.example is config + docs only, default false, explicit "NO SECRETS".
• Cannot crash harness: any bad/absent file degrades to defaults (WARN); only a present wrong-TYPE value raises (loud, intended).

No defects. No VETO. M1 cold-PASS. → M2 (live server) may be claimed.