smoke.sh drift detection compares wrong identifier ({{.Image}} vs registry digest) #46

New issue

Closed

opened 2026-05-03 23:30:22 +02:00 by claude · 0 comments

claude commented

2026-05-03 23:30:22 +02:00

Collaborator

Migrated from state/L3/OPEN_LOOPS.md per ADR 0001 + AGENTS.md.

Source

Canary on PR #40 (smoke.sh template) ELEVATED defer 2026-05-03. Operator decision: revert + rewrite. PR #40 to be closed.

What

tests/smoke.sh:147 uses docker inspect {{.Image}} which returns the local image config sha256 (image ID), not the registry pull digest. Manifest image_observed field stores registry pull digest format <repo>:<tag>@sha256:<digest>. Comparison may produce false-positive drift detection (n8n-worker case from PR #40 may have been false-positive).

Container name hardcoded home-platform-${compose_service}-1 — agaria-* / agent-plane-shadow-* / hermes-* use different prefixes
Python deps fragile on homelab (pyyaml + jsonschema rot risk)
Dead code read_field shipped unused
JSON output not safely escaped (quotes/backslashes in check strings)

Owner action

TASK: orchestrator rewrites smoke.sh as separate PR. Scope: minimal viable per STATE_OF_PLATFORM v2 §6 default (fix bugs only; no --remediate mode; defer richer features to platformctl Phase 03).

Acceptance criteria

Drift detection uses {{index .RepoDigests 0}} or equivalent (registry digest format)
Container name lookup reads from runbook OR uses docker compose ls to get project name dynamically
Python deps documented in tests/setup.sh OR core checks simplified to bash-only
Dead code read_field removed
JSON output safely escaped (uses python json.dumps not bash printf)
Re-validate n8n-worker drift result after rewrite
Canary 3+3 fires + passes (within hard 3-iter cap per ADR 0002)
Issue closed when rewrite PR merges

Migrated from `state/L3/OPEN_LOOPS.md` per ADR 0001 + AGENTS.md. ## Source Canary on PR #40 (smoke.sh template) ELEVATED defer 2026-05-03. Operator decision: revert + rewrite. PR #40 to be closed. ## What `tests/smoke.sh:147` uses `docker inspect {{.Image}}` which returns the local image config sha256 (image ID), not the registry pull digest. Manifest `image_observed` field stores registry pull digest format `<repo>:<tag>@sha256:<digest>`. Comparison may produce false-positive drift detection (n8n-worker case from PR #40 may have been false-positive). ## Plus related bugs from same canary (4 NOT_OK): 1. Container name hardcoded `home-platform-${compose_service}-1` — agaria-* / agent-plane-shadow-* / hermes-* use different prefixes 2. Python deps fragile on homelab (pyyaml + jsonschema rot risk) 3. Dead code `read_field` shipped unused 4. JSON output not safely escaped (quotes/backslashes in check strings) ## Owner action TASK: orchestrator rewrites smoke.sh as separate PR. Scope: minimal viable per STATE_OF_PLATFORM v2 §6 default (fix bugs only; no `--remediate` mode; defer richer features to platformctl Phase 03). ## Acceptance criteria - [ ] Drift detection uses `{{index .RepoDigests 0}}` or equivalent (registry digest format) - [ ] Container name lookup reads from runbook OR uses `docker compose ls` to get project name dynamically - [ ] Python deps documented in `tests/setup.sh` OR core checks simplified to bash-only - [ ] Dead code `read_field` removed - [ ] JSON output safely escaped (uses python `json.dumps` not bash printf) - [ ] Re-validate n8n-worker drift result after rewrite - [ ] Canary 3+3 fires + passes (within hard 3-iter cap per ADR 0002) - [ ] Issue closed when rewrite PR merges

claude added the

phase/02

risk/runtime

labels

2026-05-03 23:30:47 +02:00

claude referenced this issue

2026-05-04 01:03:40 +02:00

docs(prompts): tooling-smoke-sh-rewrite master prompt for Codex #50