fix(rs2000): allow compose preflight through host agent #254

Merged

pdurlej merged 1 commit from codex/cutover/host-agent-envfile-preflight into main

2026-05-13 07:17:16 +02:00

codex commented

2026-05-13 07:15:46 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

The dashboard smoke reached the final host gate and was correctly denied by platform-host-agent: the wrapper did not yet allow the new safe preflight command introduced in #252. This PR widens the allowlist narrowly enough for the cutover path while keeping arbitrary shell and arbitrary compose files denied.

What changed

Allows docker compose --env-file /opt/pdurlej-platform/runtime/compose.env -f /opt/pdurlej-platform/current/compose/apps/compose.yaml config --quiet through the forced-command wrapper.
Allows the matching single-service up -d <service> command with that same env-file and compose file.
Keeps legacy no-env-file up -d behavior working.
Adds wrapper tests for config preflight, env-file apply, and unapproved env-file denial.

Why it changed

After #251/#252/#253 merged and runtime setup was prepared, readiness failed before any mutation:

platform-host-agent: denied

The denial is expected with the old wrapper because it only allowed docker compose -f ... up -d service, not --env-file or config --quiet.

Files touched

ops/rs2000/platform-host-agent-wrapper
tests/test_platform_host_agent_wrapper.py

Relevant context

Issue #142 cutover lane
PR #252 env-file/preflight support
PR #253 manual dashboard dispatch target
ops/rs2000/README.md

Runtime evidence

No runtime mutation was performed after the denial. The runtime wrapper has not been changed by this PR yet; operator merge is required first.

Tests:

pytest tests/test_platform_host_agent_wrapper.py -q
7 passed in 1.03s

Known constraints

After merge, the reviewed wrapper still needs to be installed to /usr/local/sbin/platform-host-agent-wrapper before rerunning readiness. That install is an explicit host-side step and will be recorded on #142.

Explicit out-of-scope

No root SSH apply path.
No arbitrary command execution.
No arbitrary env-file paths.
No workflow dispatch in this PR.
No production compose mutation.

Requested decision

Operator merge if the allowlist widening is acceptable.

Merge blockers

Any path that permits arbitrary shell metacharacters.
Any path that permits arbitrary compose files or env files.
Any path that permits multi-service or unbounded compose actions.

Spec sources read

ops/rs2000/platform-host-agent-wrapper — forced-command allowlist
tests/test_platform_host_agent_wrapper.py — wrapper safety contract
ops/rs2000/README.md — host artifact install notes
control-plane/platformctl/apply.py — command shape from #252

Refs #142

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story The dashboard smoke reached the final host gate and was correctly denied by `platform-host-agent`: the wrapper did not yet allow the new safe preflight command introduced in #252. This PR widens the allowlist narrowly enough for the cutover path while keeping arbitrary shell and arbitrary compose files denied. ### What changed - Allows `docker compose --env-file /opt/pdurlej-platform/runtime/compose.env -f /opt/pdurlej-platform/current/compose/apps/compose.yaml config --quiet` through the forced-command wrapper. - Allows the matching single-service `up -d <service>` command with that same env-file and compose file. - Keeps legacy no-env-file `up -d` behavior working. - Adds wrapper tests for config preflight, env-file apply, and unapproved env-file denial. ### Why it changed After #251/#252/#253 merged and runtime setup was prepared, readiness failed before any mutation: ```text platform-host-agent: denied ``` The denial is expected with the old wrapper because it only allowed `docker compose -f ... up -d service`, not `--env-file` or `config --quiet`. ### Files touched - `ops/rs2000/platform-host-agent-wrapper` - `tests/test_platform_host_agent_wrapper.py` ### Relevant context - Issue #142 cutover lane - PR #252 env-file/preflight support - PR #253 manual dashboard dispatch target - `ops/rs2000/README.md` ### Runtime evidence No runtime mutation was performed after the denial. The runtime wrapper has not been changed by this PR yet; operator merge is required first. Tests: ```text pytest tests/test_platform_host_agent_wrapper.py -q 7 passed in 1.03s ``` ### Known constraints After merge, the reviewed wrapper still needs to be installed to `/usr/local/sbin/platform-host-agent-wrapper` before rerunning readiness. That install is an explicit host-side step and will be recorded on #142. ### Explicit out-of-scope - No root SSH apply path. - No arbitrary command execution. - No arbitrary env-file paths. - No workflow dispatch in this PR. - No production compose mutation. ### Requested decision Operator merge if the allowlist widening is acceptable. ### Merge blockers - Any path that permits arbitrary shell metacharacters. - Any path that permits arbitrary compose files or env files. - Any path that permits multi-service or unbounded compose actions. ## Spec sources read - `ops/rs2000/platform-host-agent-wrapper` — forced-command allowlist - `tests/test_platform_host_agent_wrapper.py` — wrapper safety contract - `ops/rs2000/README.md` — host artifact install notes - `control-plane/platformctl/apply.py` — command shape from #252 Refs #142

codex added 1 commit

2026-05-13 07:15:46 +02:00

fix(rs2000): allow compose preflight through host agent

canary-required / collect-diff (pull_request) Successful in 4s

Details

python-ci / Python 3.11 (pull_request) Successful in 38s

Details

python-ci / Python 3.12 (pull_request) Successful in 39s

Details

python-ci / Python 3.13 (pull_request) Successful in 39s

Details

canary-required / canary (pull_request) Successful in 12s