fix(plan): allow host-agent repo digest observation #298

Merged

pdurlej merged 1 commit from codex/plan/host-agent-repodigests-allowlist into main

2026-05-16 12:53:37 +02:00

codex commented

2026-05-16 12:48:43 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Canary Context Pack

Product story

The canonical Meerkat frontend smoke is blocked by a false image drift: platformctl plan now knows how to compare registry RepoDigests, but the RS2000 host-agent forced-command wrapper still rejects the read-only docker image inspect command needed to collect them.

What changed

Allow platform-host-agent to run only docker image inspect sha256:<64> --format '{{json .RepoDigests}}.
Keep tag-based image inspection and arbitrary formats denied.
Add a plan diagnostic when RepoDigest observation fails, so this failure mode is visible in artifacts instead of silently degrading to false drift.

Why it changed

Run API 1202 / UI #946 picked up immediately on runner 5, but artifact still showed Meerkat image drift with candidates limited to the tag and local image id. Direct runner-path test showed platform-host-agent: denied for the new digest lookup command.

Files touched

ops/rs2000/platform-host-agent-wrapper
tests/test_platform_host_agent_wrapper.py
control-plane/platformctl/plan.py
control-plane/platformctl/tests/test_plan_phase3.py

Relevant context

PR #297 added RepoDigest observation to platformctl plan.
PR #296 imported Meerkat canonical compose.
Issue #142 RS2000 cutover lane.

Runtime evidence

Meerkat retry after #297: run API 1202, UI #946, immediate runner pickup, no watchdog restart.
Artifact platformctl-auto-apply-1202 showed status=drift, observed=[tag, sha256:image-id], no RepoDigests.
Runner-path command returned platform-host-agent: denied for docker image inspect sha256:... --format '{{json .RepoDigests}}'.

Known constraints

This is a host forced-command allowlist. The wrapper remains narrow: no shell metacharacters, no tag lookup, no arbitrary image inspect format, no compose widening.

Explicit out-of-scope

No F3 smoke in this PR.
No production wrapper installation in the PR itself.
No direct PAT/Infisical changes.

Requested decision

Merge this Full/security-sensitive fix, then install the audited wrapper on RS2000 and retry np-meerkat-frontend before F3.

Merge blockers

The wrapper must not allow arbitrary image inspection or tag-based probing.
Tests must pass.

Spec sources read

ops/rs2000/platform-host-agent-wrapper - live forced-command policy mirrored in repo.
tests/test_platform_host_agent_wrapper.py - wrapper contract tests.
control-plane/platformctl/plan.py - RepoDigest observation path.
control-plane/platformctl/tests/test_plan_phase3.py - plan observation tests.

Verification

bash -n ops/rs2000/platform-host-agent-wrapper
git diff --check
uv run --project control-plane pytest tests/test_platform_host_agent_wrapper.py control-plane/platformctl/tests/test_plan_phase3.py -> 23 passed

Refs: #142, #296, #297

Canary status: missing - fire canary 3+3 manually before merge ## Canary Context Pack ### Product story The canonical Meerkat frontend smoke is blocked by a false image drift: `platformctl plan` now knows how to compare registry RepoDigests, but the RS2000 host-agent forced-command wrapper still rejects the read-only `docker image inspect` command needed to collect them. ### What changed - Allow `platform-host-agent` to run only `docker image inspect sha256:<64> --format '{{json .RepoDigests}}`. - Keep tag-based image inspection and arbitrary formats denied. - Add a plan diagnostic when RepoDigest observation fails, so this failure mode is visible in artifacts instead of silently degrading to false drift. ### Why it changed Run API `1202` / UI `#946` picked up immediately on runner `5`, but artifact still showed Meerkat image drift with candidates limited to the tag and local image id. Direct runner-path test showed `platform-host-agent: denied` for the new digest lookup command. ### Files touched - `ops/rs2000/platform-host-agent-wrapper` - `tests/test_platform_host_agent_wrapper.py` - `control-plane/platformctl/plan.py` - `control-plane/platformctl/tests/test_plan_phase3.py` ### Relevant context - PR #297 added RepoDigest observation to `platformctl plan`. - PR #296 imported Meerkat canonical compose. - Issue #142 RS2000 cutover lane. ### Runtime evidence - Meerkat retry after #297: run API `1202`, UI `#946`, immediate runner pickup, no watchdog restart. - Artifact `platformctl-auto-apply-1202` showed `status=drift`, `observed=[tag, sha256:image-id]`, no RepoDigests. - Runner-path command returned `platform-host-agent: denied` for `docker image inspect sha256:... --format '{{json .RepoDigests}}'`. ### Known constraints This is a host forced-command allowlist. The wrapper remains narrow: no shell metacharacters, no tag lookup, no arbitrary image inspect format, no compose widening. ### Explicit out-of-scope - No F3 smoke in this PR. - No production wrapper installation in the PR itself. - No direct PAT/Infisical changes. ### Requested decision Merge this Full/security-sensitive fix, then install the audited wrapper on RS2000 and retry `np-meerkat-frontend` before F3. ### Merge blockers - The wrapper must not allow arbitrary image inspection or tag-based probing. - Tests must pass. ## Spec sources read - `ops/rs2000/platform-host-agent-wrapper` - live forced-command policy mirrored in repo. - `tests/test_platform_host_agent_wrapper.py` - wrapper contract tests. - `control-plane/platformctl/plan.py` - RepoDigest observation path. - `control-plane/platformctl/tests/test_plan_phase3.py` - plan observation tests. ## Verification - `bash -n ops/rs2000/platform-host-agent-wrapper` - `git diff --check` - `uv run --project control-plane pytest tests/test_platform_host_agent_wrapper.py control-plane/platformctl/tests/test_plan_phase3.py` -> 23 passed Refs: #142, #296, #297

codex added 1 commit

2026-05-16 12:48:43 +02:00

fix(plan): allow host-agent repo digest observation

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 18s

Details

python-ci / Python 3.12 (pull_request) Successful in 37s