fix(platformctl): block missing compose services in auto-apply #295

Merged

pdurlej merged 1 commit from codex/269/auto-apply-compose-guard into main

2026-05-16 09:32:31 +02:00

codex commented

2026-05-16 09:27:30 +02:00

Collaborator

Canary status: missing — normal CI/canary-required will run on PR.

Canary Context Pack

Product story

Auto-apply should fail closed before any deploy lane claims a module is safe. #269 showed a dangerous false-positive class: a module manifest can point at compose/apps/compose.yaml even when the service is absent from the canonical compose tree. The old behavior allowed the workflow to reach plan/apply/health, where a no-op health pass could look like apply readiness.

What changed

auto_apply_scope.py now verifies that each allowed module's spec.runtime.compose_service exists in the referenced compose file or its include: tree.
Missing services become blocked modules with an explicit blocker message.
Tests cover #269 via np-meerkat-frontend.

Why it changed

np-meerkat-frontend is live as an orphaned container but absent from the current canonical compose tree. Investigation also showed matrix-well-known is absent from canonical compose, which means prior green no-op smokes were health evidence, not compose-management evidence. The safe response is to block false eligibility until each service is imported intentionally.

Files touched

control-plane/platformctl/ci/auto_apply_scope.py
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py

Relevant context

Issue #269: Meerkat frontend missing from canonical compose.
Issue #142 release ramp evidence: no-op smokes were green, but guard must distinguish health-only evidence from compose-readiness.
ADR-0018: agent-visible false green signals must be fixed at root.

Runtime evidence

np-meerkat-frontend and np-meerkat-backend containers are live, but current /opt/vps-home-platform-infra/compose/apps/compose.yaml does not contain either service.
Current repo compose/apps/compose.yaml also lacks np-meerkat-frontend.
Old backup compose from 2026-04-06 contains Meerkat services, but importing that into current canonical compose without investigation would be a runtime guess.
Local scope checks:
- mirotalk-sfu remains eligible.
- np-meerkat-frontend is blocked: compose service missing.
- matrix-well-known is also blocked: compose service missing.

Known constraints

This PR is a guard, not a compose import. It intentionally makes hidden data gaps visible.

Explicit out-of-scope

Does not import Meerkat compose.
Does not smoke Meerkat.
Does not change runtime containers.
Does not remove orphan containers.

Requested decision

Merge as a safety guard. Then decide/import missing canonical compose services in larger batches.

Merge blockers

Any CI failure.
Any reviewer finding that compose include: handling is incomplete.

Spec sources read

Issue #269 body — problem statement and resolution options.
control-plane/platformctl/ci/auto_apply_scope.py — guard implementation.
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py — existing CI script contract tests.
compose/apps/compose.yaml, compose/core/compose.yaml, compose/edge/compose.yaml, compose/base/compose.yaml — canonical compose service presence check.
modules/np-meerkat-frontend/module.yaml, modules/np-meerkat-backend/module.yaml — affected manifests.

Refs #269
Refs #142

Canary status: missing — normal CI/canary-required will run on PR. ## Canary Context Pack ### Product story Auto-apply should fail closed before any deploy lane claims a module is safe. #269 showed a dangerous false-positive class: a module manifest can point at `compose/apps/compose.yaml` even when the service is absent from the canonical compose tree. The old behavior allowed the workflow to reach plan/apply/health, where a no-op health pass could look like apply readiness. ### What changed - `auto_apply_scope.py` now verifies that each allowed module's `spec.runtime.compose_service` exists in the referenced compose file or its `include:` tree. - Missing services become blocked modules with an explicit blocker message. - Tests cover #269 via `np-meerkat-frontend`. ### Why it changed `np-meerkat-frontend` is live as an orphaned container but absent from the current canonical compose tree. Investigation also showed `matrix-well-known` is absent from canonical compose, which means prior green no-op smokes were health evidence, not compose-management evidence. The safe response is to block false eligibility until each service is imported intentionally. ### Files touched - `control-plane/platformctl/ci/auto_apply_scope.py` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` ### Relevant context - Issue #269: Meerkat frontend missing from canonical compose. - Issue #142 release ramp evidence: no-op smokes were green, but guard must distinguish health-only evidence from compose-readiness. - ADR-0018: agent-visible false green signals must be fixed at root. ### Runtime evidence - `np-meerkat-frontend` and `np-meerkat-backend` containers are live, but current `/opt/vps-home-platform-infra/compose/apps/compose.yaml` does not contain either service. - Current repo `compose/apps/compose.yaml` also lacks `np-meerkat-frontend`. - Old backup compose from 2026-04-06 contains Meerkat services, but importing that into current canonical compose without investigation would be a runtime guess. - Local scope checks: - `mirotalk-sfu` remains eligible. - `np-meerkat-frontend` is blocked: compose service missing. - `matrix-well-known` is also blocked: compose service missing. ### Known constraints This PR is a guard, not a compose import. It intentionally makes hidden data gaps visible. ### Explicit out-of-scope - Does not import Meerkat compose. - Does not smoke Meerkat. - Does not change runtime containers. - Does not remove orphan containers. ### Requested decision Merge as a safety guard. Then decide/import missing canonical compose services in larger batches. ### Merge blockers - Any CI failure. - Any reviewer finding that compose `include:` handling is incomplete. ## Spec sources read - Issue #269 body — problem statement and resolution options. - `control-plane/platformctl/ci/auto_apply_scope.py` — guard implementation. - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` — existing CI script contract tests. - `compose/apps/compose.yaml`, `compose/core/compose.yaml`, `compose/edge/compose.yaml`, `compose/base/compose.yaml` — canonical compose service presence check. - `modules/np-meerkat-frontend/module.yaml`, `modules/np-meerkat-backend/module.yaml` — affected manifests. Refs #269 Refs #142

codex added 1 commit

2026-05-16 09:27:30 +02:00

fix(platformctl): block missing compose services in auto-apply

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s