chore(minio-init): prepare W8.1 pilot upgrade packet #502

New issue

Closed

opened 2026-05-26 08:52:26 +02:00 by codex · 1 comment

codex commented

2026-05-26 08:52:26 +02:00

Collaborator

Spec sources (whitelist)

modules/minio-init/module.yaml
modules/minio-init/runbook.md
state/cycle/W8-module-upgrade-prep.md §Pilot Default / Required Evidence Per Upgrade PR / Stop Conditions
decisions/0022-module-source-and-release-boundaries.md §Update workflow
#501 W8.0 readiness output, after it lands

Extracted context

From modules/minio-init/module.yaml:

spec.source.kind: upstream-image
spec.source.repo: minio/mc
spec.source.ref: RELEASE.2025-08-13T08-35-41Z-cpuv1
spec.source.update_policy.mode: propose-pr
spec.artifact.kind: oci-image
spec.artifact.image: minio/mc
spec.runtime.host: rs2000
spec.runtime.expected_state: exited-success
spec.runtime.statefulness: sidecar-bound
spec.release.migration_policy: manual-confirm
spec.release.rollback_capability: manual
spec.release.backup_ref_modules: [minio]

From state/cycle/W8-module-upgrade-prep.md:

First W8.1 candidate: minio-init.
Reason: one-shot helper semantics are documented; not the Forgejo workbench;
lower operator-facing blast radius than Traefik/Forgejo/Infisical/Postgres;
success can prove the update PR + digest + smoke pattern.
Every W8 upgrade PR must include old tag/digest and new tag/digest,
upstream release notes or changelog pointer, risk class, backup-before requirement,
exact smoke command, rollback image/tag/digest, and whether production apply is requested.

From decisions/0022-module-source-and-release-boundaries.md:

A platform update job or agent detects a new upstream version.
The update job opens a platform PR with version/digest delta and release notes.
Risk policy decides whether this is manual, proposed, or auto-mergeable.
Stateful, public-edge, auth, and security-sensitive modules stay manually gated until explicit policy says otherwise.

Do NOT read (unless escape hatch fires)

Forgejo upgrade plan — core/workbench upgrades are W8.final, not this pilot.
Production host logs or runtime files — this issue prepares a PR packet only.
Broad module inventory beyond #501 output — do not re-run W8.0 here.

Allowed touched paths

modules/minio-init/module.yaml (modify, if an exact new tag/digest candidate is verified)
modules/minio-init/runbook.md (modify only for smoke/rollback wording tied to the pilot)
state/cycle/W8-minio-init-pilot.md (create)
state/cycle/W8-module-upgrade-prep.md (modify only to link accepted pilot output)

Why this exists (product-first)

W8 needs one low-blast-radius pilot that proves the platform can review artifact/digest upgrades without jumping straight to Forgejo or stateful core services. minio-init is a one-shot helper with documented side effects, so it is the best first mechanical test if W8.0 confirms the metadata is sufficient.

Why this matters now

The platform has source/artifact metadata for only a small subset of modules. A narrow minio-init pilot gives agents a repeatable upgrade packet format before any broad or core module upgrade wave.

What "done" looks like

#501 is complete or the PR explicitly cites why its output is not needed.
Current upstream minio/mc candidate tag and digest are verified from a primary registry/source at pickup time.
The PR records old tag/digest and candidate tag/digest.
The PR links upstream release notes/changelog or explicitly records that no release notes were found.
Risk class is stated as sidecar-bound and backup-before requirement is explicitly yes/no with rationale.
Exact smoke command and expected result are documented.
Rollback image/tag/digest is documented.
The PR does not apply, recreate, restart, or mutate production.
If the candidate requires production mutation to verify, the PR stops and asks for operator approval instead.

Scope

In scope:

Prepare a platform PR packet for the first W8.1 candidate.
Update desired source/artifact metadata only if the exact upstream candidate is verified.
Improve runbook smoke/rollback instructions if needed.

Out of scope:

Running platformctl apply.
Recreating minio-init or minio.
Creating backups.
Any upgrade to MinIO itself.
Any Forgejo/core/workbench upgrade.

Suggested approach

Wait for or consume #501 W8.0 readiness output.
Verify upstream minio/mc tags/digests using a primary source and record the exact command/source in the PR.
Produce the smallest PR possible: metadata delta plus state/cycle/W8-minio-init-pilot.md evidence packet.
Mark production apply as out of scope unless the operator explicitly comments approval.

Escape hatch

If upstream tag/digest verification is ambiguous, if digest differs by platform without a clear manifest-list answer, or if release notes cannot be tied to the candidate, do not update module.yaml. Instead create only the evidence artifact and mark the issue blocked.

Unknowns / owner questions

None before #501. Runtime execution requires a separate operator approval comment.

Risk class

risk/runtime — platform may not run, recover, validate, behave reproducibly
risk/process — workflow/review/orchestration may produce bad outcomes

Class of service

class/security-sensitive

Trace

Original source: #389, #501, Oracle review platform-pr488-wave-status, and operator approval on 2026-05-26.
Migrated by: codex, 2026-05-26.
Related issues / PRs: #389, #501, #500.

## Spec sources (whitelist) - `modules/minio-init/module.yaml` - `modules/minio-init/runbook.md` - `state/cycle/W8-module-upgrade-prep.md` §Pilot Default / Required Evidence Per Upgrade PR / Stop Conditions - `decisions/0022-module-source-and-release-boundaries.md` §Update workflow - #501 W8.0 readiness output, after it lands ## Extracted context > From `modules/minio-init/module.yaml`: > ``` > spec.source.kind: upstream-image > spec.source.repo: minio/mc > spec.source.ref: RELEASE.2025-08-13T08-35-41Z-cpuv1 > spec.source.update_policy.mode: propose-pr > spec.artifact.kind: oci-image > spec.artifact.image: minio/mc > spec.runtime.host: rs2000 > spec.runtime.expected_state: exited-success > spec.runtime.statefulness: sidecar-bound > spec.release.migration_policy: manual-confirm > spec.release.rollback_capability: manual > spec.release.backup_ref_modules: [minio] > ``` > From `state/cycle/W8-module-upgrade-prep.md`: > ``` > First W8.1 candidate: minio-init. > Reason: one-shot helper semantics are documented; not the Forgejo workbench; > lower operator-facing blast radius than Traefik/Forgejo/Infisical/Postgres; > success can prove the update PR + digest + smoke pattern. > Every W8 upgrade PR must include old tag/digest and new tag/digest, > upstream release notes or changelog pointer, risk class, backup-before requirement, > exact smoke command, rollback image/tag/digest, and whether production apply is requested. > ``` > From `decisions/0022-module-source-and-release-boundaries.md`: > ``` > A platform update job or agent detects a new upstream version. > The update job opens a platform PR with version/digest delta and release notes. > Risk policy decides whether this is manual, proposed, or auto-mergeable. > Stateful, public-edge, auth, and security-sensitive modules stay manually gated until explicit policy says otherwise. > ``` ## Do NOT read (unless escape hatch fires) - Forgejo upgrade plan — core/workbench upgrades are W8.final, not this pilot. - Production host logs or runtime files — this issue prepares a PR packet only. - Broad module inventory beyond #501 output — do not re-run W8.0 here. ## Allowed touched paths - `modules/minio-init/module.yaml` (modify, if an exact new tag/digest candidate is verified) - `modules/minio-init/runbook.md` (modify only for smoke/rollback wording tied to the pilot) - `state/cycle/W8-minio-init-pilot.md` (create) - `state/cycle/W8-module-upgrade-prep.md` (modify only to link accepted pilot output) ## Why this exists (product-first) W8 needs one low-blast-radius pilot that proves the platform can review artifact/digest upgrades without jumping straight to Forgejo or stateful core services. `minio-init` is a one-shot helper with documented side effects, so it is the best first mechanical test if W8.0 confirms the metadata is sufficient. ## Why this matters now The platform has source/artifact metadata for only a small subset of modules. A narrow `minio-init` pilot gives agents a repeatable upgrade packet format before any broad or core module upgrade wave. ## What "done" looks like - [ ] #501 is complete or the PR explicitly cites why its output is not needed. - [ ] Current upstream `minio/mc` candidate tag and digest are verified from a primary registry/source at pickup time. - [ ] The PR records old tag/digest and candidate tag/digest. - [ ] The PR links upstream release notes/changelog or explicitly records that no release notes were found. - [ ] Risk class is stated as `sidecar-bound` and backup-before requirement is explicitly yes/no with rationale. - [ ] Exact smoke command and expected result are documented. - [ ] Rollback image/tag/digest is documented. - [ ] The PR does **not** apply, recreate, restart, or mutate production. - [ ] If the candidate requires production mutation to verify, the PR stops and asks for operator approval instead. ## Scope **In scope:** - Prepare a platform PR packet for the first W8.1 candidate. - Update desired source/artifact metadata only if the exact upstream candidate is verified. - Improve runbook smoke/rollback instructions if needed. **Out of scope:** - Running `platformctl apply`. - Recreating `minio-init` or `minio`. - Creating backups. - Any upgrade to MinIO itself. - Any Forgejo/core/workbench upgrade. ## Suggested approach 1. Wait for or consume #501 W8.0 readiness output. 2. Verify upstream `minio/mc` tags/digests using a primary source and record the exact command/source in the PR. 3. Produce the smallest PR possible: metadata delta plus `state/cycle/W8-minio-init-pilot.md` evidence packet. 4. Mark production apply as out of scope unless the operator explicitly comments approval. ## Escape hatch If upstream tag/digest verification is ambiguous, if digest differs by platform without a clear manifest-list answer, or if release notes cannot be tied to the candidate, do not update `module.yaml`. Instead create only the evidence artifact and mark the issue blocked. ## Unknowns / owner questions - None before #501. Runtime execution requires a separate operator approval comment. ## Risk class - [x] `risk/runtime` — platform may not run, recover, validate, behave reproducibly - [x] `risk/process` — workflow/review/orchestration may produce bad outcomes ## Class of service - [ ] `class/security-sensitive` ## Trace - Original source: #389, #501, Oracle review `platform-pr488-wave-status`, and operator approval on 2026-05-26. - Migrated by: codex, 2026-05-26. - Related issues / PRs: #389, #501, #500.

codex added this to the 09 - Module upgrade waves milestone

2026-05-26 08:52:26 +02:00

codex added the

labels

2026-05-26 08:52:26 +02:00

codex referenced this issue

2026-05-26 08:52:53 +02:00

meta(upgrades): plan staged module upgrade waves after metadata and DR #389