41 lines
2.8 KiB
Markdown
41 lines
2.8 KiB
Markdown
# JOURNAL — Phase 1e (generic-harness corrections)
|
||
|
||
Append-only Builder log: what I did + verifying command/output + next.
|
||
|
||
## 2026-05-28 — Phase 1e bootstrap + orientation
|
||
- Read the phase plan (`plan-phase1e-harness-corrections.md`) + plan.md §6.1/§7/§9. Phase 1d is DONE
|
||
(STATUS-1d ## DONE, DG1–DG8 Adversary PASS). Studied the harness: `runner/run_recipe_ci.py`
|
||
(deploy-once orchestrator), `runner/harness/{discovery,generic,lifecycle,abra}.py`, `tests/conftest.py`,
|
||
`tests/_generic/*`, the overlays (custom-html/keycloak/cryptpad/n8n/matrix-synapse), and
|
||
`tests/unit/test_discovery.py`.
|
||
- Access re-verified: `ssh cc-ci 'hostname && whoami'` → `nixos` / `root`.
|
||
- Settled the three open decisions (HC1 deploy-count, HC2 allowlist, HC3 opt-out) in DECISIONS.md.
|
||
- Created STATUS-1e / BACKLOG-1e / JOURNAL-1e. Order of work: E0 (HC2) → E1 (HC3) → E2 (HC1) → E3.
|
||
- Key design notes:
|
||
- HC3 op/assertion split: orchestrator performs each mutating op once; generic + overlay both run as
|
||
assertions after. Op results (pre-upgrade identity, snapshot_id) passed via run-scoped
|
||
`$CCCI_OP_STATE_FILE`. Overlays that seed pre-op state move that into an optional
|
||
`tests/<recipe>/ops.py` (`pre_<op>(domain, meta)`); overlay `test_<op>.py` become assertion-only.
|
||
- HC1: re-checkout PR head (recorded as recipe HEAD right after fetch) then `abra app deploy --chaos`;
|
||
moved-assertion accepts the chaos label as proof PR-head deployed; deploy-count counts only
|
||
`deploy_app` (app new), not the in-place chaos redeploy.
|
||
|
||
Next: E0 — implement the HC2 allowlist + discovery gate + unit tests.
|
||
|
||
## 2026-05-28 — E0 / HC2 repo-local trust gate (DONE, CLAIMED)
|
||
- Implemented the approval allowlist (`tests/repo-local-approved.txt`, default empty ⇒ default-deny)
|
||
+ centralized gate in `runner/harness/discovery.py`: `approved_recipes()`/`repo_local_approved()`/
|
||
`_gated()`. Split overlay resolution into `resolve_overlay_op` (repo-local>cc-ci, gated) + `generic_op`
|
||
(the floor) for HC3; kept back-compat `resolve_op` (override). `custom_tests`/`install_steps`/new
|
||
`pre_op_hook` all route repo-local through `_gated`. Allowlist path overridable via
|
||
`CCCI_REPO_LOCAL_APPROVED_FILE`.
|
||
- Rewrote `tests/unit/test_discovery.py` for the gate (approved-vs-not for overlay/custom/hook/pre-op +
|
||
the generic floor + default-empty-allowlist invariant).
|
||
- Verified on cc-ci (tar-piped working tree → /root/cc-ci; cc-ci has no rsync):
|
||
`cc-ci-run -m pytest tests/unit -q` → **8 passed in 0.06s**
|
||
And the cc-ci-authored hook is unaffected (DG5):
|
||
discovery.install_steps("custom-html-tiny", None) → ('cc-ci', '.../tests/custom-html-tiny/install_steps.sh')
|
||
- Committed d38a695, pushed. Gate E0/HC2 CLAIMED for Adversary.
|
||
|
||
Next: E1 (HC3) — orchestrator op/assertion split + additive generic + opt-out + overlay migration.
|