docs(rs2000): record release readiness evidence #294

Merged

pdurlej merged 1 commit from codex/rs2000/release-readiness-evidence into main

2026-05-16 09:32:22 +02:00

codex commented

2026-05-16 09:18:35 +02:00

Collaborator

Canary status: missing — PR relies on normal CI checks; no manual 3+3 fired yet.

Canary Context Pack

Product story

RS2000 is now in the release-readiness lane. The operator needs one current status surface and durable runner docs so tomorrow's agents do not rediscover the same runtime facts or misread the release-root promotion failure.

What changed

Documents that release-root promotion requires NoNewPrivileges=false on forgejo-deploy-runner.service because the workflow uses a narrow sudo helper.
Updates the deploy runner runbook with the exact systemd drop-in and verification commands applied on RS2000.
Refreshes state/STATUS_NOW.md with release-root and F2 no-op ramp evidence.
Extends release-root tests so docs must mention the sudo/drop-in requirement.

Why it changed

PR #293's workflow initially failed because systemd NoNewPrivileges=true prevented sudo from elevating even though sudoers was correct. The runtime fix is now applied and verified; the repo should preserve that lesson for future agents.

Files touched

docs/ci/runner-contract.md
runbooks/forgejo-actions-runner.md
state/STATUS_NOW.md
tests/test_release_root_promote.py

Relevant context

PR #293: release-root promotion lane
Issue #279: release-root drift
Issue #260: deploy runner pickup reliability
ADR-0018: agentic-first clean signals

Runtime evidence

/opt/pdurlej-platform/current -> releases/e5e8fe02a3fc97dc147b9104670128bbc459a39a
release-root run #1131/API #878 succeeded after the systemd drop-in.
no-op smokes #1132/#1134/#1135/#1136/#1137/#1138: plan in-sync, apply noop, health OK.
All six auto-apply runs picked up by runner id=5 in 1s.
Watchdog reported only no stuck trusted-main auto-apply jobs; no restart fired.
docker ps --filter health=unhealthy returned no unhealthy containers; total running containers: 64.

Known constraints

This PR records evidence and runner setup. It does not grant new deploy capability beyond the helper already installed for #293.

Explicit out-of-scope

No real-change apply.
No F3/stateful smoke.
No Infisical Token Auth direct-PAT removal.
No np-meerkat-frontend data-gap fix.

Requested decision

Approve and merge after CI green so release-root docs/status match RS2000 reality.

Merge blockers

Any CI failure.
Any reviewer concern that NoNewPrivileges=false should be represented differently for the narrow sudo helper.

Spec sources read

docs/ci/runner-contract.md — deploy runner contract.
runbooks/forgejo-actions-runner.md — live runner operations runbook.
tests/test_release_root_promote.py — existing release-root contract tests.
state/STATUS_NOW.md — canonical operator-facing status per ADR-0006.

Refs #279
Refs #260

Canary status: missing — PR relies on normal CI checks; no manual 3+3 fired yet. ## Canary Context Pack ### Product story RS2000 is now in the release-readiness lane. The operator needs one current status surface and durable runner docs so tomorrow's agents do not rediscover the same runtime facts or misread the release-root promotion failure. ### What changed - Documents that release-root promotion requires `NoNewPrivileges=false` on `forgejo-deploy-runner.service` because the workflow uses a narrow sudo helper. - Updates the deploy runner runbook with the exact systemd drop-in and verification commands applied on RS2000. - Refreshes `state/STATUS_NOW.md` with release-root and F2 no-op ramp evidence. - Extends release-root tests so docs must mention the sudo/drop-in requirement. ### Why it changed PR #293's workflow initially failed because systemd `NoNewPrivileges=true` prevented sudo from elevating even though sudoers was correct. The runtime fix is now applied and verified; the repo should preserve that lesson for future agents. ### Files touched - `docs/ci/runner-contract.md` - `runbooks/forgejo-actions-runner.md` - `state/STATUS_NOW.md` - `tests/test_release_root_promote.py` ### Relevant context - PR #293: release-root promotion lane - Issue #279: release-root drift - Issue #260: deploy runner pickup reliability - ADR-0018: agentic-first clean signals ### Runtime evidence - `/opt/pdurlej-platform/current -> releases/e5e8fe02a3fc97dc147b9104670128bbc459a39a` - release-root run #1131/API #878 succeeded after the systemd drop-in. - no-op smokes #1132/#1134/#1135/#1136/#1137/#1138: plan in-sync, apply noop, health OK. - All six auto-apply runs picked up by runner id=5 in 1s. - Watchdog reported only `no stuck trusted-main auto-apply jobs`; no restart fired. - `docker ps --filter health=unhealthy` returned no unhealthy containers; total running containers: 64. ### Known constraints This PR records evidence and runner setup. It does not grant new deploy capability beyond the helper already installed for #293. ### Explicit out-of-scope - No real-change apply. - No F3/stateful smoke. - No Infisical Token Auth direct-PAT removal. - No `np-meerkat-frontend` data-gap fix. ### Requested decision Approve and merge after CI green so release-root docs/status match RS2000 reality. ### Merge blockers - Any CI failure. - Any reviewer concern that `NoNewPrivileges=false` should be represented differently for the narrow sudo helper. ## Spec sources read - `docs/ci/runner-contract.md` — deploy runner contract. - `runbooks/forgejo-actions-runner.md` — live runner operations runbook. - `tests/test_release_root_promote.py` — existing release-root contract tests. - `state/STATUS_NOW.md` — canonical operator-facing status per ADR-0006. Refs #279 Refs #260

codex added 1 commit

2026-05-16 09:18:35 +02:00

docs(rs2000): record release readiness evidence

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

python-ci / Python 3.11 (pull_request) Successful in 34s

Details

python-ci / Python 3.12 (pull_request) Successful in 35s