fix(f3): prepare main redis and postgres smoke #314

Merged

pdurlej merged 1 commit from codex/f3/main-redis-postgres-prep into main

2026-05-17 02:52:56 +02:00

codex commented

2026-05-17 02:44:37 +02:00

Collaborator

Canary status: missing — F3 final-boss prep; rely on required Forgejo checks before merge

Canary Context Pack

Product story

The next F3 tranche is the shared Redis and shared Postgres pair. These are high-blast-radius dependencies for n8n, Forgejo, Infisical, Umami, Matrix, and private operator apps, so backup-before evidence must be real before any stateful smoke.

What changed

Populated strict-v2 metadata for redis and postgres from live RS2000 runtime evidence.
Corrected their Docker volume names to the actual live volumes: home-platform_redis_data and home-platform_pg_data.
Documented restore/blast-radius risks for the shared Redis/Postgres state.
Hardened scripts/cutover/backup-before-apply.sh so Redis BGSAVE can authenticate when Redis has --requirepass in the container command but no REDIS_PASSWORD env var.
Updated scripts/cutover/README.md to document the Redis auth behavior.

Why it changed

Both manifests failed strict-v2, and main Redis would have failed backup-before with NOAUTH because it does not expose REDIS_PASSWORD in the container environment. Running F3 without fixing this would produce either a blocked workflow or false backup confidence.

Files touched

modules/redis/module.yaml
modules/postgres/module.yaml
scripts/cutover/backup-before-apply.sh
scripts/cutover/README.md

Runtime evidence

home-platform-redis-1: running healthy, image redis:7.4.7-alpine, digest redis@sha256:02f2cc4882f8bf87c79a220ac958f58c700bdec0dfb9b9ea61b62fb0e8f1bfcf, volume home-platform_redis_data.
home-platform-postgres-1: running healthy, image postgres:16.12-alpine, digest postgres@sha256:97ff59a4e30e08d1c11bdcd9455e7832368c0572b576c9092cde2df4ae5552a3, volume home-platform_pg_data.
Main Postgres databases observed: forgejo, infisical, integrations, matrix, n8n, np, np_memos, postgres, umami, zeroclaw.
Main Redis has no REDIS_PASSWORD env, but auth can be derived from existing container config and verified without printing the secret.

Known constraints

After merge, release-root-promote must land because the updated backup helper lives under scripts/cutover/**. Backup/smoke must wait until /opt/pdurlej-platform/current points at this merge SHA.

Explicit out-of-scope

No compose changes.
No Redis/Postgres restart.
No backup execution in this PR.
No secret value printed or committed.

Requested decision

Merge to unblock backup-before and F3 no-op smoke for redis and postgres.

Merge blockers

strict-v2 validation failure
shell syntax failure in backup helper
evidence that Redis auth is logged or exposed

BMADX

Gear: X3
Gate: execution_allowed=true, bmad_status=ok
Reason: final-boss shared data layer with production state and restore blast radius.

Spec sources read

modules/redis/module.yaml — target manifest
modules/postgres/module.yaml — target manifest
compose/core/compose.yaml — source of Redis/Postgres service definitions
compose/base/compose.yaml — live volume names
scripts/cutover/backup-before-apply.sh — backup helper being fixed
scripts/cutover/README.md — backup class documentation
modules/honcho-redis/module.yaml — Redis strict-v2 pattern

Verification

python3 "$HOME/.codex/skills/bmadx/scripts/sync_bmadx.py" check --gear X3 --compact
bash -n scripts/cutover/backup-before-apply.sh
control-plane/.venv/bin/python -m platformctl.cli validate --strict-v2 modules/redis/module.yaml
control-plane/.venv/bin/python -m platformctl.cli validate --strict-v2 modules/postgres/module.yaml
control-plane/.venv/bin/pytest control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py -q
git diff --check

Live Redis auth parser smoke (no secret output): redis-auth-config-parse-ok.

Refs: #142

Canary status: missing — F3 final-boss prep; rely on required Forgejo checks before merge ## Canary Context Pack ### Product story The next F3 tranche is the shared Redis and shared Postgres pair. These are high-blast-radius dependencies for n8n, Forgejo, Infisical, Umami, Matrix, and private operator apps, so backup-before evidence must be real before any stateful smoke. ### What changed - Populated strict-v2 metadata for `redis` and `postgres` from live RS2000 runtime evidence. - Corrected their Docker volume names to the actual live volumes: `home-platform_redis_data` and `home-platform_pg_data`. - Documented restore/blast-radius risks for the shared Redis/Postgres state. - Hardened `scripts/cutover/backup-before-apply.sh` so Redis `BGSAVE` can authenticate when Redis has `--requirepass` in the container command but no `REDIS_PASSWORD` env var. - Updated `scripts/cutover/README.md` to document the Redis auth behavior. ### Why it changed Both manifests failed strict-v2, and main Redis would have failed backup-before with `NOAUTH` because it does not expose `REDIS_PASSWORD` in the container environment. Running F3 without fixing this would produce either a blocked workflow or false backup confidence. ### Files touched - `modules/redis/module.yaml` - `modules/postgres/module.yaml` - `scripts/cutover/backup-before-apply.sh` - `scripts/cutover/README.md` ### Runtime evidence - `home-platform-redis-1`: `running healthy`, image `redis:7.4.7-alpine`, digest `redis@sha256:02f2cc4882f8bf87c79a220ac958f58c700bdec0dfb9b9ea61b62fb0e8f1bfcf`, volume `home-platform_redis_data`. - `home-platform-postgres-1`: `running healthy`, image `postgres:16.12-alpine`, digest `postgres@sha256:97ff59a4e30e08d1c11bdcd9455e7832368c0572b576c9092cde2df4ae5552a3`, volume `home-platform_pg_data`. - Main Postgres databases observed: `forgejo`, `infisical`, `integrations`, `matrix`, `n8n`, `np`, `np_memos`, `postgres`, `umami`, `zeroclaw`. - Main Redis has no `REDIS_PASSWORD` env, but auth can be derived from existing container config and verified without printing the secret. ### Known constraints After merge, `release-root-promote` must land because the updated backup helper lives under `scripts/cutover/**`. Backup/smoke must wait until `/opt/pdurlej-platform/current` points at this merge SHA. ### Explicit out-of-scope - No compose changes. - No Redis/Postgres restart. - No backup execution in this PR. - No secret value printed or committed. ### Requested decision Merge to unblock backup-before and F3 no-op smoke for `redis` and `postgres`. ### Merge blockers - strict-v2 validation failure - shell syntax failure in backup helper - evidence that Redis auth is logged or exposed ## BMADX - Gear: X3 - Gate: `execution_allowed=true`, `bmad_status=ok` - Reason: final-boss shared data layer with production state and restore blast radius. ## Spec sources read - `modules/redis/module.yaml` — target manifest - `modules/postgres/module.yaml` — target manifest - `compose/core/compose.yaml` — source of Redis/Postgres service definitions - `compose/base/compose.yaml` — live volume names - `scripts/cutover/backup-before-apply.sh` — backup helper being fixed - `scripts/cutover/README.md` — backup class documentation - `modules/honcho-redis/module.yaml` — Redis strict-v2 pattern ## Verification ```bash python3 "$HOME/.codex/skills/bmadx/scripts/sync_bmadx.py" check --gear X3 --compact bash -n scripts/cutover/backup-before-apply.sh control-plane/.venv/bin/python -m platformctl.cli validate --strict-v2 modules/redis/module.yaml control-plane/.venv/bin/python -m platformctl.cli validate --strict-v2 modules/postgres/module.yaml control-plane/.venv/bin/pytest control-plane/platformctl/tests/test_validate.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py -q git diff --check ``` Live Redis auth parser smoke (no secret output): `redis-auth-config-parse-ok`. Refs: #142

codex added 1 commit

2026-05-17 02:44:37 +02:00

fix(f3): prepare main redis and postgres smoke

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 19s

Details

canary-required / canary (pull_request) Successful in 13s