pdurlej/platform

Fork 0

feat(platformctl): add tailscale transport adapter #158

Merged

pdurlej merged 1 commit from codex/issues/142-phase3-transport into main

2026-05-10 23:10:50 +02:00

codex commented

2026-05-10 03:33:20 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Phase 3 needs a remote execution transport before plan, health, and later apply can talk to RS 2000 in a controlled way. This PR adds the Tailscale SSH adapter while keeping runtime mutation at zero.

What changed

Added TailscaleTransport with host alias/IP resolution, root-user refusal, structured CompletedProcess-like result dicts, and legacy run_ssh() compatibility.
Added retry/backoff for transient SSH failures: 3 retries after initial attempt, backoffs 5s/15s/45s.
Wired safety.check_command() before SSH execution so sacred-path mutation commands are refused before any network call.
Added hermetic tests with mocked subprocess.run and sleep; no real SSH is executed.

Why it changed

Packet 3.1 requires the Tailscale SSH transport adapter before platformctl can perform remote read-only inspection or gated apply work.

Files touched

control-plane/platformctl/transport/tailscale.py
control-plane/platformctl/transport/__init__.py
control-plane/platformctl/transport/tests/test_tailscale.py

Relevant context

prompts/codex-cutover-flight/phase-3-operational.md Packet 3.1
network/tailscale-acl.hujson codex/platform-host-agent restrictions
PLATFORM_CHARTER.md sacred-path / platformctl control-plane sections
docs/forgejo-agent-operations.md
AGENTS.md security-sensitive class of service

Runtime evidence

No runtime mutation and no real SSH. Tests use mocked subprocess calls only.

Known constraints

This is stacked on PR #157 (codex/issues/142-phase3-safety) because transport depends on the hardened safety.check_command() behavior. Merge #157 first, then rebase/merge this PR.

Explicit out-of-scope

No real platformctl plan remote inspect yet.
No platformctl apply mutation.
No production SSH execution.
No Tailscale ACL runtime changes.

Requested decision

Review as security-sensitive Packet 3.1 foundation. Merge only after #157 and normal canary/owner process.

Merge blockers

Any path where TailscaleTransport.run() can execute a sacred-path mutation before check_command() refuses it.
Retry behavior that retries normal command failures instead of transient SSH failures.
Any test path that performs real SSH or depends on RS 2000 availability.

Spec sources read

prompts/codex-cutover-flight/dispatch.md — phase sequencing and gates
prompts/codex-cutover-flight/phase-3-operational.md — Packet 3.1 acceptance criteria
network/tailscale-acl.hujson — host aliases and platform-host-agent SSH scope
PLATFORM_CHARTER.md — sacred paths and control-plane context
docs/forgejo-agent-operations.md — Forgejo/identity protocol
AGENTS.md — security-sensitive class of service and PR rules
control-plane/platformctl/transport/tailscale.py — implementation target
control-plane/platformctl/plan.py and apply.py — existing transport call sites
control-plane/platformctl/tests/test_smoke.py — local test conventions

Tests

PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/transport/tests/test_tailscale.py -q — 7 passed
PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_safety_phase3.py -q — 128 passed
PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests control-plane/platformctl/transport/tests -q — 318 passed
PYTHONPATH=control-plane python3 -m platformctl.cli validate modules/honcho-redis --strict-v2 --json — pass
git diff --check — clean

Refs #142

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Phase 3 needs a remote execution transport before `plan`, `health`, and later `apply` can talk to RS 2000 in a controlled way. This PR adds the Tailscale SSH adapter while keeping runtime mutation at zero. ### What changed - Added `TailscaleTransport` with host alias/IP resolution, root-user refusal, structured CompletedProcess-like result dicts, and legacy `run_ssh()` compatibility. - Added retry/backoff for transient SSH failures: 3 retries after initial attempt, backoffs `5s/15s/45s`. - Wired `safety.check_command()` before SSH execution so sacred-path mutation commands are refused before any network call. - Added hermetic tests with mocked `subprocess.run` and sleep; no real SSH is executed. ### Why it changed Packet 3.1 requires the Tailscale SSH transport adapter before platformctl can perform remote read-only inspection or gated apply work. ### Files touched - `control-plane/platformctl/transport/tailscale.py` - `control-plane/platformctl/transport/__init__.py` - `control-plane/platformctl/transport/tests/test_tailscale.py` ### Relevant context - `prompts/codex-cutover-flight/phase-3-operational.md` Packet 3.1 - `network/tailscale-acl.hujson` codex/platform-host-agent restrictions - `PLATFORM_CHARTER.md` sacred-path / platformctl control-plane sections - `docs/forgejo-agent-operations.md` - `AGENTS.md` security-sensitive class of service ### Runtime evidence No runtime mutation and no real SSH. Tests use mocked subprocess calls only. ### Known constraints This is stacked on PR #157 (`codex/issues/142-phase3-safety`) because transport depends on the hardened `safety.check_command()` behavior. Merge #157 first, then rebase/merge this PR. ### Explicit out-of-scope - No real `platformctl plan` remote inspect yet. - No `platformctl apply` mutation. - No production SSH execution. - No Tailscale ACL runtime changes. ### Requested decision Review as security-sensitive Packet 3.1 foundation. Merge only after #157 and normal canary/owner process. ### Merge blockers - Any path where `TailscaleTransport.run()` can execute a sacred-path mutation before `check_command()` refuses it. - Retry behavior that retries normal command failures instead of transient SSH failures. - Any test path that performs real SSH or depends on RS 2000 availability. ## Spec sources read - `prompts/codex-cutover-flight/dispatch.md` — phase sequencing and gates - `prompts/codex-cutover-flight/phase-3-operational.md` — Packet 3.1 acceptance criteria - `network/tailscale-acl.hujson` — host aliases and platform-host-agent SSH scope - `PLATFORM_CHARTER.md` — sacred paths and control-plane context - `docs/forgejo-agent-operations.md` — Forgejo/identity protocol - `AGENTS.md` — security-sensitive class of service and PR rules - `control-plane/platformctl/transport/tailscale.py` — implementation target - `control-plane/platformctl/plan.py` and `apply.py` — existing transport call sites - `control-plane/platformctl/tests/test_smoke.py` — local test conventions ## Tests - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/transport/tests/test_tailscale.py -q` — 7 passed - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_safety_phase3.py -q` — 128 passed - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests control-plane/platformctl/transport/tests -q` — 318 passed - `PYTHONPATH=control-plane python3 -m platformctl.cli validate modules/honcho-redis --strict-v2 --json` — pass - `git diff --check` — clean Refs #142

codex added 1 commit

2026-05-10 03:33:20 +02:00

feat(platformctl): add tailscale transport adapter

canary-required / collect-diff (pull_request) Successful in 3s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 15s

Details

python-ci / Python 3.11 (pull_request) Successful in 43s

Details

python-ci / Python 3.12 (pull_request) Successful in 43s

Details

python-ci / Python 3.13 (pull_request) Successful in 43s

Details

canary-required / canary (pull_request) Successful in 12s

Details

c4f7a50f7e

codex added the

class/security-sensitive

label

2026-05-10 03:33:34 +02:00

codex commented

2026-05-10 03:35:50 +02:00

Author

Collaborator

Packet 3.1 transport status for stacked PR #158:

Branch: codex/issues/142-phase3-transport
Base: codex/issues/142-phase3-safety (PR #157 must merge first)
Commit: c4f7a50 (feat(platformctl): add tailscale transport adapter)
Runtime: no production SSH, no production mutation; tests mock subprocess only

Local verification:

PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/transport/tests/test_tailscale.py -q — 7 passed
PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_safety_phase3.py -q — 128 passed
PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests control-plane/platformctl/transport/tests -q — 318 passed
PYTHONPATH=control-plane python3 -m platformctl.cli validate modules/honcho-redis --strict-v2 --json — pass
git diff --check — clean

Ollama Cloud expensive review, final counted pass:

deepseek-v4-pro:cloud — APPROVE, blocking findings: None
minimax-m2.7:cloud — APPROVE, blocking findings: None
kimi-k2.6:cloud — APPROVE, blocking findings: None

Non-blocking hardening notes surfaced: document trust boundary for PLATFORMCTL_*_SSH_HOST env overrides; consider wrapping OSError/missing ssh binary into SSHError; be aware OpenSSH return code 255 is ambiguous. None were marked merge blockers.

Official canary status remains missing; this still needs normal platform canary/owner merge process before merge.

Packet 3.1 transport status for stacked PR #158: - Branch: `codex/issues/142-phase3-transport` - Base: `codex/issues/142-phase3-safety` (PR #157 must merge first) - Commit: `c4f7a50` (`feat(platformctl): add tailscale transport adapter`) - Runtime: no production SSH, no production mutation; tests mock subprocess only Local verification: - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/transport/tests/test_tailscale.py -q` — 7 passed - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_safety_phase3.py -q` — 128 passed - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests control-plane/platformctl/transport/tests -q` — 318 passed - `PYTHONPATH=control-plane python3 -m platformctl.cli validate modules/honcho-redis --strict-v2 --json` — pass - `git diff --check` — clean Ollama Cloud expensive review, final counted pass: - `deepseek-v4-pro:cloud` — APPROVE, blocking findings: None - `minimax-m2.7:cloud` — APPROVE, blocking findings: None - `kimi-k2.6:cloud` — APPROVE, blocking findings: None Non-blocking hardening notes surfaced: document trust boundary for `PLATFORMCTL_*_SSH_HOST` env overrides; consider wrapping `OSError`/missing ssh binary into `SSHError`; be aware OpenSSH return code 255 is ambiguous. None were marked merge blockers. Official canary status remains `missing`; this still needs normal platform canary/owner merge process before merge.

codex referenced this pull request

2026-05-10 03:35:50 +02:00

[coordination-lane] Cutover Flight Phase 2: v2 catalog to gate #142

codex referenced this pull request

2026-05-10 03:43:00 +02:00

feat(platformctl): implement read-only plan drift check #159