cc-ci/machine-docs/JOURNAL-1e.md

JOURNAL — Phase 1e (generic-harness corrections)

Append-only Builder log: what I did + verifying command/output + next.

2026-05-28 — Phase 1e bootstrap + orientation

• Read the phase plan (plan-phase1e-harness-corrections.md) + plan.md §6.1/§7/§9. Phase 1d is DONE (STATUS-1d ## DONE, DG1–DG8 Adversary PASS). Studied the harness: runner/run_recipe_ci.py (deploy-once orchestrator), runner/harness/{discovery,generic,lifecycle,abra}.py, tests/conftest.py, tests/_generic/*, the overlays (custom-html/keycloak/cryptpad/n8n/matrix-synapse), and tests/unit/test_discovery.py.
• Access re-verified: ssh cc-ci 'hostname && whoami' → nixos / root.
• Settled the three open decisions (HC1 deploy-count, HC2 allowlist, HC3 opt-out) in DECISIONS.md.
• Created STATUS-1e / BACKLOG-1e / JOURNAL-1e. Order of work: E0 (HC2) → E1 (HC3) → E2 (HC1) → E3.
• Key design notes:
  • HC3 op/assertion split: orchestrator performs each mutating op once; generic + overlay both run as assertions after. Op results (pre-upgrade identity, snapshot_id) passed via run-scoped $CCCI_OP_STATE_FILE. Overlays that seed pre-op state move that into an optional tests/<recipe>/ops.py (pre_<op>(domain, meta)); overlay test_<op>.py become assertion-only.
  • HC1: re-checkout PR head (recorded as recipe HEAD right after fetch) then abra app deploy --chaos; moved-assertion accepts the chaos label as proof PR-head deployed; deploy-count counts only deploy_app (app new), not the in-place chaos redeploy.

Next: E0 — implement the HC2 allowlist + discovery gate + unit tests.

2026-05-28 — E0 / HC2 repo-local trust gate (DONE, CLAIMED)

• Implemented the approval allowlist (tests/repo-local-approved.txt, default empty ⇒ default-deny)
  • centralized gate in runner/harness/discovery.py: approved_recipes()/repo_local_approved()/ _gated(). Split overlay resolution into resolve_overlay_op (repo-local>cc-ci, gated) + generic_op (the floor) for HC3; kept back-compat resolve_op (override). custom_tests/install_steps/new pre_op_hook all route repo-local through _gated. Allowlist path overridable via CCCI_REPO_LOCAL_APPROVED_FILE.
• Rewrote tests/unit/test_discovery.py for the gate (approved-vs-not for overlay/custom/hook/pre-op + the generic floor + default-empty-allowlist invariant).
• Verified on cc-ci (tar-piped working tree → /root/cc-ci; cc-ci has no rsync): cc-ci-run -m pytest tests/unit -q → 8 passed in 0.06s And the cc-ci-authored hook is unaffected (DG5): discovery.install_steps("custom-html-tiny", None) → ('cc-ci', '.../tests/custom-html-tiny/install_steps.sh')
• Committed d38a695, pushed. Gate E0/HC2 CLAIMED for Adversary.

Next: E1 (HC3) — orchestrator op/assertion split + additive generic + opt-out + overlay migration.