fix(auto-apply): gate F3 stateful no-op smokes #299

Merged

pdurlej merged 1 commit from codex/f3/stateful-noop-gate into main

2026-05-16 13:06:32 +02:00

codex commented

2026-05-16 13:00:49 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Canary Context Pack

Product story

F3 is the first stateful smoke phase. It must be possible to run it through the trusted auto-apply lane, but only after an operator-run backup exists and only when the plan is a no-op. Stateful drift must stop before apply.

What changed

Adds explicit workflow_dispatch inputs for F3 stateful smoke: allow_stateful, backup_ref, and stateful_confirm.
Extends auto_apply_scope.py so stateful modules remain blocked by default, but one manual stateful module can be allowed when backup_ref matches backup-before-apply.sh output.
Adds a workflow guard: when the stateful override is active, plan must return in-sync (exitCode=0) or the job refuses apply.

Why it changed

The current auto-apply v1 guard correctly blocks stateful modules. Operator has now explicitly approved backup-before then F3, with uptime-kuma as the first low-blast stateful target. This PR opens that lane without weakening push auto-apply or allowing stateful drift applies.

Files touched

.forgejo/workflows/platformctl-auto-apply.yml
control-plane/platformctl/ci/auto_apply_scope.py
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py

Relevant context

scripts/cutover/backup-before-apply.sh writes /opt/pdurlej-platform/backups/<module>-<timestamp>.<suffix>.
scripts/cutover/README.md recommends Class E / uptime-kuma as a first F3 candidate.
Meerkat F2 is green after #298/run 1214.

Runtime evidence

np-meerkat-frontend run API 1214 / UI #956: plan in-sync, apply noop, health OK, no watchdog restart.
No F3 production mutation was run before this guard.

Known constraints

The F3 lane is manual-only. Push auto-apply remains stateless-only. The workflow does not read the backup file; it requires a backup reference string and this session verifies the backup on RS2000 before dispatching.

Explicit out-of-scope

No stateful apply is performed by this PR.
No backup retention policy changes.
No restore automation.

Requested decision

Merge after checks. Operator has already approved the next runtime sequence: backup-before, then F3 uptime-kuma smoke.

Merge blockers

Stateful modules must remain blocked by default.
Stateful F3 override must be manual-only and single-module.
Stateful F3 must refuse apply when plan detects drift.

Spec sources read

.forgejo/workflows/platformctl-auto-apply.yml - active trusted-main auto-apply lane.
control-plane/platformctl/ci/auto_apply_scope.py - auto-apply eligibility guard.
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py - CI contract tests.
scripts/cutover/backup-before-apply.sh - backup artifact naming and operator-run contract.
scripts/cutover/README.md - F3 stateful candidate guidance.
modules/uptime-kuma/module.yaml - first F3 target statefulness and runtime fields.

Verification

python3 YAML parse for .forgejo/workflows/platformctl-auto-apply.yml
git diff --check
uv run --project control-plane pytest control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_plan_phase3.py tests/test_platform_host_agent_wrapper.py -> 54 passed
auto_apply_scope.py --module uptime-kuma blocks by default with exit 4
auto_apply_scope.py --module uptime-kuma --allow-stateful --backup-ref /opt/pdurlej-platform/backups/uptime-kuma-20260516T110000Z.tar.gz returns eligible

Refs: #142, #298

Canary status: missing - fire canary 3+3 manually before merge ## Canary Context Pack ### Product story F3 is the first stateful smoke phase. It must be possible to run it through the trusted auto-apply lane, but only after an operator-run backup exists and only when the plan is a no-op. Stateful drift must stop before apply. ### What changed - Adds explicit `workflow_dispatch` inputs for F3 stateful smoke: `allow_stateful`, `backup_ref`, and `stateful_confirm`. - Extends `auto_apply_scope.py` so stateful modules remain blocked by default, but one manual stateful module can be allowed when `backup_ref` matches `backup-before-apply.sh` output. - Adds a workflow guard: when the stateful override is active, `plan` must return in-sync (`exitCode=0`) or the job refuses apply. ### Why it changed The current auto-apply v1 guard correctly blocks `stateful` modules. Operator has now explicitly approved `backup-before` then F3, with `uptime-kuma` as the first low-blast stateful target. This PR opens that lane without weakening push auto-apply or allowing stateful drift applies. ### Files touched - `.forgejo/workflows/platformctl-auto-apply.yml` - `control-plane/platformctl/ci/auto_apply_scope.py` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` ### Relevant context - `scripts/cutover/backup-before-apply.sh` writes `/opt/pdurlej-platform/backups/<module>-<timestamp>.<suffix>`. - `scripts/cutover/README.md` recommends Class E / `uptime-kuma` as a first F3 candidate. - Meerkat F2 is green after #298/run 1214. ### Runtime evidence - `np-meerkat-frontend` run API `1214` / UI `#956`: plan in-sync, apply noop, health OK, no watchdog restart. - No F3 production mutation was run before this guard. ### Known constraints The F3 lane is manual-only. Push auto-apply remains stateless-only. The workflow does not read the backup file; it requires a backup reference string and this session verifies the backup on RS2000 before dispatching. ### Explicit out-of-scope - No stateful apply is performed by this PR. - No backup retention policy changes. - No restore automation. ### Requested decision Merge after checks. Operator has already approved the next runtime sequence: backup-before, then F3 `uptime-kuma` smoke. ### Merge blockers - Stateful modules must remain blocked by default. - Stateful F3 override must be manual-only and single-module. - Stateful F3 must refuse apply when plan detects drift. ## Spec sources read - `.forgejo/workflows/platformctl-auto-apply.yml` - active trusted-main auto-apply lane. - `control-plane/platformctl/ci/auto_apply_scope.py` - auto-apply eligibility guard. - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - CI contract tests. - `scripts/cutover/backup-before-apply.sh` - backup artifact naming and operator-run contract. - `scripts/cutover/README.md` - F3 stateful candidate guidance. - `modules/uptime-kuma/module.yaml` - first F3 target statefulness and runtime fields. ## Verification - `python3` YAML parse for `.forgejo/workflows/platformctl-auto-apply.yml` - `git diff --check` - `uv run --project control-plane pytest control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_plan_phase3.py tests/test_platform_host_agent_wrapper.py` -> 54 passed - `auto_apply_scope.py --module uptime-kuma` blocks by default with exit 4 - `auto_apply_scope.py --module uptime-kuma --allow-stateful --backup-ref /opt/pdurlej-platform/backups/uptime-kuma-20260516T110000Z.tar.gz` returns eligible Refs: #142, #298

codex added 1 commit

2026-05-16 13:00:49 +02:00

fix(auto-apply): gate F3 stateful no-op smokes

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

python-ci / Python 3.12 (pull_request) Successful in 37s