pdurlej/platform

Fork 0

fix(kan): guard shadowed image tag overrides #725

Merged

pdurlej merged 1 commit from codex/issues/724-kan-image-guard into main

2026-06-05 07:34:16 +02:00

codex commented

2026-06-05 07:26:11 +02:00

Collaborator

Summary

add a safe Kan effective image preflight script
flag the exact failure mode where KAN_IMAGE_TAG is shadowed by explicit KAN_WEB_IMAGE, KAN_MIGRATE_IMAGE, or KAN_MCP_IMAGE
add regression coverage that secret-like env keys are ignored and not printed

Scope

Repo hygiene for platform Kan deploys. No secret values, no DB changes, no service restart in this PR.

Runtime note

During recovery, RS2000 runtime KAN_IMAGE_TAG was removed from env/stack.env because all three Kan services are explicitly pinned by KAN_*_IMAGE. No restart was performed; kan-mcp stayed healthy on sha-e38fefe70e53.

Tests

python3 -m py_compile scripts/kan/effective-images.py
python3 -m pytest tests/test_kan_runtime_contract.py -q

Rollback

Revert this PR for repo tooling.
Runtime cleanup rollback: restore env/stack.env.bak-remove-shadowed-kan-image-tag-20260605T052446Z if KAN_IMAGE_TAG needs to return.

Closes #724.

## Summary - add a safe Kan effective image preflight script - flag the exact failure mode where `KAN_IMAGE_TAG` is shadowed by explicit `KAN_WEB_IMAGE`, `KAN_MIGRATE_IMAGE`, or `KAN_MCP_IMAGE` - add regression coverage that secret-like env keys are ignored and not printed ## Scope Repo hygiene for platform Kan deploys. No secret values, no DB changes, no service restart in this PR. ## Runtime note During recovery, RS2000 runtime `KAN_IMAGE_TAG` was removed from `env/stack.env` because all three Kan services are explicitly pinned by `KAN_*_IMAGE`. No restart was performed; `kan-mcp` stayed healthy on `sha-e38fefe70e53`. ## Tests - `python3 -m py_compile scripts/kan/effective-images.py` - `python3 -m pytest tests/test_kan_runtime_contract.py -q` ## Rollback - Revert this PR for repo tooling. - Runtime cleanup rollback: restore `env/stack.env.bak-remove-shadowed-kan-image-tag-20260605T052446Z` if `KAN_IMAGE_TAG` needs to return. Closes #724.

codex added 1 commit

2026-06-05 07:26:11 +02:00

fix(kan): guard shadowed image tag overrides (#724 )

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

python-ci / Python 3.11 (pull_request) Successful in 43s

Details

python-ci / Python 3.12 (pull_request) Successful in 44s

Details

python-ci / Python 3.13 (pull_request) Successful in 44s

Details

canary-required / canary (pull_request) Successful in 13s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 19s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 3m37s

Details

60c13d7076

patchwarden commented

2026-06-05 07:32:47 +02:00

First-time contributor

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 725
Commit: 60c13d70760d47cb2476599794a133f89ef4cb81
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: error
Verdict: -
Note: ReadTimeout: The read operation timed out
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `725` - Commit: `60c13d70760d47cb2476599794a133f89ef4cb81` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `error` - Verdict: `-` - Note: ReadTimeout: The read operation timed out - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.