ops: allow host agent current deploy root #244

Merged

pdurlej merged 1 commit from codex/auto-deploy/host-agent-current-root into main

2026-05-12 11:10:15 +02:00

codex commented

2026-05-12 11:01:06 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

The auto-deploy lane is waiting for deploy-host, but the next runtime blocker is already visible: platform-host-agent-wrapper only allows the legacy root. The host agent must allow the new canonical root before #242 can prove plan -> apply noop -> health.

What changed

Added audited RS2000 host-side artifacts:

ops/rs2000/platform-host-agent-wrapper desired host wrapper;
ops/rs2000/README.md install/safety notes;
tests/test_platform_host_agent_wrapper.py wrapper behavior tests.

The wrapper remains narrow: true, constrained docker inspect, and single-service docker compose up -d <service> for allowlisted compose files only. It now supports both:

legacy: /opt/vps-home-platform-infra/compose/apps/compose.yaml
canonical: /opt/pdurlej-platform/current/compose/apps/compose.yaml

Why it changed

#234 auto-apply uses PLATFORMCTL_REMOTE_ROOT=/opt/pdurlej-platform/current. Without this wrapper change, the deploy runner can be registered correctly and still fail at the host allowlist boundary.

Files touched

ops/rs2000/README.md
ops/rs2000/platform-host-agent-wrapper
tests/test_platform_host_agent_wrapper.py

Relevant context

#234 added the active auto-apply skeleton.
#241 added canonical compose candidate under compose/**.
Current RS2000 wrapper at /usr/local/sbin/platform-host-agent-wrapper only allows the legacy root.

Runtime evidence

No host wrapper was installed by this PR. Local tests passed:

PYTHONPATH=control-plane pytest tests/test_platform_host_agent_wrapper.py control-plane/platformctl/tests/test_apply_phase3.py -q
# 47 passed

git diff --check

RS2000 read-only finding before this PR:

platformctl-auto-apply.yml run #481 / API id #601 is waiting for deploy-host.
forgejo-deploy-runner.service is not present yet.
/opt/pdurlej-platform/current is not present yet.
current wrapper only knows /opt/vps-home-platform-infra.

Known constraints

Merge alone does not install the wrapper on RS2000. Installation is a separate explicit operator/deploy-runner step:

install -o root -g root -m 0755 ops/rs2000/platform-host-agent-wrapper \
  /usr/local/sbin/platform-host-agent-wrapper

Explicit out-of-scope

No RS2000 file write in this PR.
No runner registration.
No service restart.
No broad shell/SSH/root permission expansion.

Requested decision

Approve the host-agent allowlist update so the deploy root can move to /opt/pdurlej-platform/current without widening the command surface.

Merge blockers

Any reviewer finding that arbitrary compose files, shell metacharacters, or root shell become possible.
Any reviewer finding that the canonical root support bypasses service-name validation.

Operator Merge Checklist

Merge this before trying to re-run #242 auto-apply.
After merge, install the wrapper on RS2000 as a separate explicit host step.
Do not start deploy runner until wrapper + deploy root are both ready.

Spec sources read

control-plane/platformctl/apply.py — compose command shape and remote root behavior.
Live RS2000 /usr/local/sbin/platform-host-agent-wrapper — current host allowlist behavior.
ops/rs2000/README.md — install/safety contract added in this PR.

Refs #142
Refs #242

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story The auto-deploy lane is waiting for `deploy-host`, but the next runtime blocker is already visible: `platform-host-agent-wrapper` only allows the legacy root. The host agent must allow the new canonical root before #242 can prove plan -> apply noop -> health. ### What changed Added audited RS2000 host-side artifacts: - `ops/rs2000/platform-host-agent-wrapper` desired host wrapper; - `ops/rs2000/README.md` install/safety notes; - `tests/test_platform_host_agent_wrapper.py` wrapper behavior tests. The wrapper remains narrow: `true`, constrained `docker inspect`, and single-service `docker compose up -d <service>` for allowlisted compose files only. It now supports both: - legacy: `/opt/vps-home-platform-infra/compose/apps/compose.yaml` - canonical: `/opt/pdurlej-platform/current/compose/apps/compose.yaml` ### Why it changed #234 auto-apply uses `PLATFORMCTL_REMOTE_ROOT=/opt/pdurlej-platform/current`. Without this wrapper change, the deploy runner can be registered correctly and still fail at the host allowlist boundary. ### Files touched - `ops/rs2000/README.md` - `ops/rs2000/platform-host-agent-wrapper` - `tests/test_platform_host_agent_wrapper.py` ### Relevant context - #234 added the active auto-apply skeleton. - #241 added canonical compose candidate under `compose/**`. - Current RS2000 wrapper at `/usr/local/sbin/platform-host-agent-wrapper` only allows the legacy root. ### Runtime evidence No host wrapper was installed by this PR. Local tests passed: ```bash PYTHONPATH=control-plane pytest tests/test_platform_host_agent_wrapper.py control-plane/platformctl/tests/test_apply_phase3.py -q # 47 passed git diff --check ``` RS2000 read-only finding before this PR: - `platformctl-auto-apply.yml` run #481 / API id #601 is `waiting` for `deploy-host`. - `forgejo-deploy-runner.service` is not present yet. - `/opt/pdurlej-platform/current` is not present yet. - current wrapper only knows `/opt/vps-home-platform-infra`. ### Known constraints Merge alone does not install the wrapper on RS2000. Installation is a separate explicit operator/deploy-runner step: ```bash install -o root -g root -m 0755 ops/rs2000/platform-host-agent-wrapper \ /usr/local/sbin/platform-host-agent-wrapper ``` ### Explicit out-of-scope - No RS2000 file write in this PR. - No runner registration. - No service restart. - No broad shell/SSH/root permission expansion. ### Requested decision Approve the host-agent allowlist update so the deploy root can move to `/opt/pdurlej-platform/current` without widening the command surface. ### Merge blockers - Any reviewer finding that arbitrary compose files, shell metacharacters, or root shell become possible. - Any reviewer finding that the canonical root support bypasses service-name validation. ## Operator Merge Checklist 1. Merge this before trying to re-run #242 auto-apply. 2. After merge, install the wrapper on RS2000 as a separate explicit host step. 3. Do not start deploy runner until wrapper + deploy root are both ready. ## Spec sources read - `control-plane/platformctl/apply.py` — compose command shape and remote root behavior. - Live RS2000 `/usr/local/sbin/platform-host-agent-wrapper` — current host allowlist behavior. - `ops/rs2000/README.md` — install/safety contract added in this PR. Refs #142 Refs #242

codex added 1 commit

2026-05-12 11:01:06 +02:00

ops: allow host agent current deploy root

canary-required / collect-diff (pull_request) Successful in 4s

Details

python-ci / Python 3.11 (pull_request) Successful in 46s

Details

python-ci / Python 3.12 (pull_request) Successful in 48s

Details

python-ci / Python 3.13 (pull_request) Successful in 47s

Details

canary-required / canary (pull_request) Successful in 13s