fix(platformctl): observe image repo digests during plan #297

Merged

pdurlej merged 1 commit from codex/plan/image-repodigests-observation into main

2026-05-16 12:37:03 +02:00

codex commented

2026-05-16 11:29:53 +02:00

Collaborator

Canary status: missing - Forgejo checks plus operator merge gate required before merge

Canary Context Pack

Product story

F2 no-op smokes should fail only on real drift. np-meerkat-frontend failed after #296 because platformctl plan compared the cataloged repo digest with only the container tag and image ID from docker inspect, even though docker image inspect proved the running image has the cataloged RepoDigest.

What changed

platformctl plan now performs a second read-only observation: docker image inspect <container-image-id> --format '{{json .RepoDigests}}'.
The discovered repo digests are added to observed image candidates before image drift comparison.
Tests cover the Meerkat failure shape: image ID differs from repo digest, but repo digest matches the manifest.

Why it changed

This is a false drift signal in an agent-visible deploy lane. Per ADR-0018, carrying false red signals is not acceptable as normal operating state.

Files touched

control-plane/platformctl/plan.py
control-plane/platformctl/tests/test_plan_phase3.py

Runtime evidence

Failed run: API 1189, UI #933, module np-meerkat-frontend
Plan artifact: status=drift, exitCode=1, only change container.image
Observed candidates in failed plan: tag latest + image ID sha256:7c6b...
RS2000 read-only evidence: docker image inspect sha256:7c6b... returns ghcr.io/fbuchner/meerkat-crm-frontend@sha256:32f73297..., matching module.yaml
Local make_plan simulation with live inspect + image RepoDigests returns status=in-sync, exitCode=0

Known constraints

This PR does not retry the smoke. Retry happens only after merge.
This does not change apply behavior or mutate production.
If docker image inspect fails, the plan keeps existing behavior and simply lacks repo digest candidates.

Explicit out-of-scope

No Meerkat runtime change.
No manifest digest rewrite to image ID.
No backend/F3 smoke.

Requested decision

Approve merge if checks are green, then rerun np-meerkat-frontend smoke once.

Merge blockers

Plan tests fail.
The new observation command is not read-only.
The Meerkat live-observation simulation does not return in-sync.

Spec sources read

control-plane/platformctl/plan.py - image drift comparison and remote observation
control-plane/platformctl/tests/test_plan_phase3.py - plan contract tests
modules/np-meerkat-frontend/module.yaml - desired image claim from failed smoke
compose/apps/compose.yaml - canonical service imported in #296

Verification

pytest -q control-plane/platformctl/tests/test_plan_phase3.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py tests/test_platform_host_agent_wrapper.py -> 47 passed
git diff --check -> passed
Read-only RS2000 inspect + local make_plan() simulation for np-meerkat-frontend -> status=in-sync, exitCode=0

Refs: #142, #269, PR #296, run #933/API 1189

Canary status: missing - Forgejo checks plus operator merge gate required before merge ## Canary Context Pack ### Product story F2 no-op smokes should fail only on real drift. `np-meerkat-frontend` failed after #296 because `platformctl plan` compared the cataloged repo digest with only the container tag and image ID from `docker inspect`, even though `docker image inspect` proved the running image has the cataloged `RepoDigest`. ### What changed - `platformctl plan` now performs a second read-only observation: `docker image inspect <container-image-id> --format '{{json .RepoDigests}}'`. - The discovered repo digests are added to observed image candidates before image drift comparison. - Tests cover the Meerkat failure shape: image ID differs from repo digest, but repo digest matches the manifest. ### Why it changed This is a false drift signal in an agent-visible deploy lane. Per ADR-0018, carrying false red signals is not acceptable as normal operating state. ### Files touched - `control-plane/platformctl/plan.py` - `control-plane/platformctl/tests/test_plan_phase3.py` ### Runtime evidence - Failed run: API `1189`, UI `#933`, module `np-meerkat-frontend` - Plan artifact: `status=drift`, `exitCode=1`, only change `container.image` - Observed candidates in failed plan: tag `latest` + image ID `sha256:7c6b...` - RS2000 read-only evidence: `docker image inspect sha256:7c6b...` returns `ghcr.io/fbuchner/meerkat-crm-frontend@sha256:32f73297...`, matching `module.yaml` - Local make_plan simulation with live inspect + image RepoDigests returns `status=in-sync`, `exitCode=0` ### Known constraints - This PR does not retry the smoke. Retry happens only after merge. - This does not change apply behavior or mutate production. - If `docker image inspect` fails, the plan keeps existing behavior and simply lacks repo digest candidates. ### Explicit out-of-scope - No Meerkat runtime change. - No manifest digest rewrite to image ID. - No backend/F3 smoke. ### Requested decision Approve merge if checks are green, then rerun `np-meerkat-frontend` smoke once. ### Merge blockers - Plan tests fail. - The new observation command is not read-only. - The Meerkat live-observation simulation does not return in-sync. ## Spec sources read - `control-plane/platformctl/plan.py` - image drift comparison and remote observation - `control-plane/platformctl/tests/test_plan_phase3.py` - plan contract tests - `modules/np-meerkat-frontend/module.yaml` - desired image claim from failed smoke - `compose/apps/compose.yaml` - canonical service imported in #296 ## Verification - `pytest -q control-plane/platformctl/tests/test_plan_phase3.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py tests/test_platform_host_agent_wrapper.py` -> 47 passed - `git diff --check` -> passed - Read-only RS2000 inspect + local `make_plan()` simulation for `np-meerkat-frontend` -> `status=in-sync`, `exitCode=0` Refs: #142, #269, PR #296, run #933/API 1189

codex added 1 commit

2026-05-16 11:29:53 +02:00

fix(platformctl): observe image repo digests during plan

canary-required / collect-diff (pull_request) Successful in 3s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 19s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 17s

Details

python-ci / Python 3.11 (pull_request) Successful in 35s