pdurlej/platform

Fork 0

fix(platformctl): land Phase 3 apply stack on main #215

Merged

pdurlej merged 7 commits from codex/rescue/phase3-apply-main-landing into main

2026-05-12 01:51:38 +02:00

codex commented

2026-05-12 01:37:44 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

P0 RESCUE — Operator Merge Checklist

Merge only this PR: P0 RESCUE — land Phase 3 apply stack on main.
Do not touch #163–#167 again, even though Forgejo shows them as merged.

After merge, ask Codex for this verification:

git fetch origin
git merge-base --is-ancestor c964686 origin/main
git show origin/main:control-plane/platformctl/health.py >/dev/null
git show origin/main:control-plane/forgejo-actions/apply.yaml | rg 'Verify plan artifact integrity|AUDIT_LOG_'

Move to P1 recovery batches only after that verification is green.

What this PR does

Rescues the Phase 3 apply stack onto main. PRs #163–#167 are marked merged in Forgejo, but they were merged into stacked branch bases rather than landing their final changes on main. This branch was rebuilt from fresh origin/main and cherry-picked only the missing apply/plan/workflow commits.

Canary Context Pack

Product story

RS2000 migration close-out depends on platformctl apply actually existing on main, not only appearing merged in Forgejo history. This PR makes the repo state match the operator-visible merge state without asking Piotr to reason about stacked PR internals.

What changed

Lands plan source/provenance hardening from #163.
Lands approved no-op apply behavior and freshness checks from #164.
Lands compose apply execution from #165.
Lands apply status artifacts from #166.
Lands apply workflow evidence/integrity hardening from #167.

Why it changed

The stacked PR chain was merged into intermediate branch bases. main currently has #161 and #162 but not the final #163–#167 apply stack.

Files touched

control-plane/platformctl/plan.py
control-plane/platformctl/apply.py
control-plane/forgejo-actions/apply.yaml
targeted platformctl tests

Relevant context

#161 health rollup is already on main and must remain there.
#162 approval binding is already on main.
#163–#167 are Forgejo-merged but not fully landed on main.

Runtime evidence

No production mutation. This is repo/control-plane code only.

Known constraints

Do not merge origin/codex/issues/142-apply-workflow-wiring directly into main; that diff would delete the health rollup files from #161.

Explicit out-of-scope

No RS2000 SSH commands.
No production apply.
No P1 recovery runbook batches in this PR.
No image prune prompt.

Requested decision

Full/security-sensitive review: approve this PR as the single safe landing point for the missing Phase 3 apply stack.

Merge blockers

Any deletion of control-plane/platformctl/health.py or control-plane/platformctl/tests/test_health_phase3.py.
Any canary finding that the apply workflow can mutate without merged PR approval.
Any evidence that origin/main already contains c964686 before merge, making this PR redundant.

Spec sources read

prompts/codex-recovery-batch-2026-05-11.md — P1 sequencing after P0.
runbooks/recovery-section-template.md — P1 constraints, not edited here.
Live Forgejo API for PRs #161–#167 — verified merged/base/head state.
control-plane/forgejo-actions/apply.yaml on origin/main — verified missing plan integrity/per-run audit state before rescue.

Implementation notes

Cherry-picked onto fresh origin/main in this order:

4cf379e fix(platformctl): bind apply plans to source sha
a959b97 fix(platformctl): harden plan provenance binding
8cd6663 fix(platformctl): allow approved no-op apply
70f1c19 fix(platformctl): harden no-op apply plans
d404d5a feat(platformctl): execute approved compose apply
01f7606 feat(platformctl): persist apply status artifacts
c964686 fix(platformctl): wire apply workflow evidence

Test plan

PYTHONPATH=control-plane pytest \
  control-plane/platformctl/tests/test_plan_phase3.py \
  control-plane/platformctl/tests/test_apply_phase3.py \
  control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py \
  control-plane/platformctl/tests/test_health_phase3.py \
  control-plane/platformctl/tests/test_smoke.py \
  -q
# 88 passed

Anti-footgun checks passed:

git diff --name-status origin/main..HEAD | rg '^D\s+control-plane/platformctl/health.py' && exit 1 || true
git diff --name-status origin/main..HEAD | rg '^D\s+control-plane/platformctl/tests/test_health_phase3.py' && exit 1 || true
git show HEAD:control-plane/platformctl/health.py >/dev/null
git show HEAD:control-plane/platformctl/tests/test_health_phase3.py >/dev/null
git show HEAD:control-plane/forgejo-actions/apply.yaml | rg 'Verify plan artifact integrity|AUDIT_LOG_|exit_code='

Canary status: missing — fire canary 3+3 manually before merge ## P0 RESCUE — Operator Merge Checklist 1. Merge only this PR: **P0 RESCUE — land Phase 3 apply stack on main**. 2. Do not touch #163–#167 again, even though Forgejo shows them as merged. 3. After merge, ask Codex for this verification: ```bash git fetch origin git merge-base --is-ancestor c964686 origin/main git show origin/main:control-plane/platformctl/health.py >/dev/null git show origin/main:control-plane/forgejo-actions/apply.yaml | rg 'Verify plan artifact integrity|AUDIT_LOG_' ``` 4. Move to P1 recovery batches only after that verification is green. ## What this PR does Rescues the Phase 3 apply stack onto `main`. PRs #163–#167 are marked merged in Forgejo, but they were merged into stacked branch bases rather than landing their final changes on `main`. This branch was rebuilt from fresh `origin/main` and cherry-picked only the missing apply/plan/workflow commits. ## Canary Context Pack ### Product story RS2000 migration close-out depends on `platformctl apply` actually existing on `main`, not only appearing merged in Forgejo history. This PR makes the repo state match the operator-visible merge state without asking Piotr to reason about stacked PR internals. ### What changed - Lands plan source/provenance hardening from #163. - Lands approved no-op apply behavior and freshness checks from #164. - Lands compose apply execution from #165. - Lands apply status artifacts from #166. - Lands apply workflow evidence/integrity hardening from #167. ### Why it changed The stacked PR chain was merged into intermediate branch bases. `main` currently has #161 and #162 but not the final #163–#167 apply stack. ### Files touched - `control-plane/platformctl/plan.py` - `control-plane/platformctl/apply.py` - `control-plane/forgejo-actions/apply.yaml` - targeted platformctl tests ### Relevant context - #161 health rollup is already on `main` and must remain there. - #162 approval binding is already on `main`. - #163–#167 are Forgejo-merged but not fully landed on `main`. ### Runtime evidence No production mutation. This is repo/control-plane code only. ### Known constraints Do not merge `origin/codex/issues/142-apply-workflow-wiring` directly into `main`; that diff would delete the health rollup files from #161. ### Explicit out-of-scope - No RS2000 SSH commands. - No production apply. - No P1 recovery runbook batches in this PR. - No image prune prompt. ### Requested decision Full/security-sensitive review: approve this PR as the single safe landing point for the missing Phase 3 apply stack. ### Merge blockers - Any deletion of `control-plane/platformctl/health.py` or `control-plane/platformctl/tests/test_health_phase3.py`. - Any canary finding that the apply workflow can mutate without merged PR approval. - Any evidence that `origin/main` already contains `c964686` before merge, making this PR redundant. ## Spec sources read - `prompts/codex-recovery-batch-2026-05-11.md` — P1 sequencing after P0. - `runbooks/recovery-section-template.md` — P1 constraints, not edited here. - Live Forgejo API for PRs #161–#167 — verified merged/base/head state. - `control-plane/forgejo-actions/apply.yaml` on `origin/main` — verified missing plan integrity/per-run audit state before rescue. ## Implementation notes Cherry-picked onto fresh `origin/main` in this order: ```text 4cf379e fix(platformctl): bind apply plans to source sha a959b97 fix(platformctl): harden plan provenance binding 8cd6663 fix(platformctl): allow approved no-op apply 70f1c19 fix(platformctl): harden no-op apply plans d404d5a feat(platformctl): execute approved compose apply 01f7606 feat(platformctl): persist apply status artifacts c964686 fix(platformctl): wire apply workflow evidence ``` ## Test plan ```bash PYTHONPATH=control-plane pytest \ control-plane/platformctl/tests/test_plan_phase3.py \ control-plane/platformctl/tests/test_apply_phase3.py \ control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py \ control-plane/platformctl/tests/test_health_phase3.py \ control-plane/platformctl/tests/test_smoke.py \ -q # 88 passed ``` Anti-footgun checks passed: ```bash git diff --name-status origin/main..HEAD | rg '^D\s+control-plane/platformctl/health.py' && exit 1 || true git diff --name-status origin/main..HEAD | rg '^D\s+control-plane/platformctl/tests/test_health_phase3.py' && exit 1 || true git show HEAD:control-plane/platformctl/health.py >/dev/null git show HEAD:control-plane/platformctl/tests/test_health_phase3.py >/dev/null git show HEAD:control-plane/forgejo-actions/apply.yaml | rg 'Verify plan artifact integrity|AUDIT_LOG_|exit_code=' ```

codex added 7 commits

2026-05-12 01:37:44 +02:00

fix(platformctl): bind apply plans to source sha 8dcf0bb558

fix(platformctl): harden plan provenance binding e343f29458

fix(platformctl): allow approved no-op apply 163d7efd59

fix(platformctl): harden no-op apply plans d4939e3434

feat(platformctl): execute approved compose apply 52aa8122c4

feat(platformctl): persist apply status artifacts 88126e15b9

fix(platformctl): wire apply workflow evidence

canary-required / collect-diff (pull_request) Successful in 4s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

python-ci / Python 3.11 (pull_request) Successful in 44s

Details

python-ci / Python 3.12 (pull_request) Successful in 45s

Details

python-ci / Python 3.13 (pull_request) Successful in 44s

Details

canary-required / canary (pull_request) Successful in 12s

Details

f32fcb3847

codex added the

class/security-sensitive

labels

2026-05-12 01:37:53 +02:00

codex referenced this pull request

2026-05-12 01:38:14 +02:00

[coordination-lane] Cutover Flight Phase 2: v2 catalog to gate #142

codex referenced this pull request

2026-05-12 01:41:33 +02:00

P1 DOCS BATCH 01/04 docs(runbooks): fill recovery sections for Class A core stateful modules #216

codex referenced this pull request

2026-05-12 01:42:33 +02:00

P1 DOCS BATCH 02/04 docs(runbooks): fill recovery sections for stateful storage modules #217

codex referenced this pull request

2026-05-12 01:43:27 +02:00

P1 DOCS BATCH 03/04 docs(runbooks): fill recovery sections for edge modules #218

codex referenced this pull request

2026-05-12 01:44:20 +02:00

P1 DOCS BATCH 04/04 docs(runbooks): fill recovery sections for AI runtime modules #219

codex referenced this pull request

2026-05-12 01:44:44 +02:00

[coordination-lane] Cutover Flight Phase 2: v2 catalog to gate #142

pdurlej merged commit 7078db58bf into main

2026-05-12 01:51:38 +02:00

pdurlej referenced this pull request from a commit

2026-05-12 01:51:39 +02:00

Merge pull request 'fix(platformctl): land Phase 3 apply stack on main' (#215) from codex/rescue/phase3-apply-main-landing into main

claude referenced this pull request

2026-05-12 01:56:39 +02:00

governance: ADR-0017 — no stacked PRs to main + 4-layer guard (operator-protection) #220

codex referenced this pull request from a commit

2026-05-12 01:56:39 +02:00

governance: ADR-0017 — no stacked PRs to main + 4-layer guard (pre/post-merge + cousin + operator)

claude referenced this pull request

2026-05-12 08:17:04 +02:00

ops(forgejo): enable branch protection on main with base-is-main / guard required (QUEUED — post-RS2000 cutover only) #243

claude referenced this pull request

2026-05-12 08:17:27 +02:00

governance: ADR-0017 — no stacked PRs to main + 4-layer guard (operator-protection) #220

claude commented

2026-05-12 08:17:27 +02:00

Collaborator

Role: advisor (claude / Pan Herbatka, orchestrator lane)

Cross-reference for context only — does NOT request changes to this PR.

ADR-0017 (PR #220) ships the stack-guard layers that would have caught the 2026-05-11/12 silent-stack-merge trap. Layer 1 mechanical block requires Forgejo branch protection toggle, which is tracked as issue #243 with explicit precondition: this PR (#215) must merge AND first platformctl apply cutover must complete + 24h smoke pass before operator enables protection.

Means: nothing in this PR's path is blocked or affected by ADR-0017. Cutover proceeds as planned. Branch protection activation comes AFTER cutover stabilizes.

Pan Herbatka spi już za 5 min — let me know via PR #220 if anything looks off. 🍵

**Role:** advisor (claude / Pan Herbatka, orchestrator lane) Cross-reference for context only — does NOT request changes to this PR. ADR-0017 (PR #220) ships the stack-guard layers that would have caught the 2026-05-11/12 silent-stack-merge trap. Layer 1 mechanical block requires Forgejo branch protection toggle, which is tracked as **issue #243** with explicit precondition: **this PR (#215) must merge AND first `platformctl apply` cutover must complete + 24h smoke pass** before operator enables protection. Means: nothing in this PR's path is blocked or affected by ADR-0017. Cutover proceeds as planned. Branch protection activation comes AFTER cutover stabilizes. Pan Herbatka spi już za 5 min — let me know via PR #220 if anything looks off. 🍵