fix(apply): use allowlisted command for one-shot services #383

Merged

pdurlej merged 1 commit from codex/fix/one-shot-apply-command into main

2026-05-19 01:11:29 +02:00

codex commented

2026-05-19 01:08:05 +02:00

Collaborator

Canary status: missing — rely on required Forgejo checks before merge

Canary Context Pack

Product story

Let the final minio-init one-shot cutoff smoke use the same narrow host-agent command shape as normal compose applies. The terminal one-shot success check belongs in platformctl health, not in a shell command assembled for SSH.

What changed

Removed $(...) / docker wait command substitution from compose_apply_command() for expected_state=exited-success services.
minio-init now applies as docker compose ... up -d minio-init, which is already within the platform-host-agent allowlist.
Updated the apply command contract test.

Why it changed

Run #1473 reached the guarded minio-init path but failed before SSH because platformctl.safety rejected the generated command as unsupported command substitution. That rejection was correct; the apply command was too clever.

Files touched

control-plane/platformctl/apply.py
control-plane/platformctl/tests/test_apply_phase3.py

Relevant context

#379 added minio-init one-shot support.
#381 made workflow exit-code capture robust.
#382 allowed the canonical platform runtime env files through the host wrapper.

Runtime evidence

platformctl-auto-apply run #1473: guard allowed, plan drift only container.state.exited_success, apply crashed on safety rejection before remote mutation.
Local tests: pytest -q control-plane/platformctl/tests/test_apply_phase3.py tests/test_platform_host_agent_wrapper.py -> 60 passed.

Known constraints

This does not make one-shot success synchronous inside apply; the workflow already runs platformctl health after apply, and health knows expected_state=exited-success.

Explicit out-of-scope

No host-agent widening. No direct MinIO mutation. No broader shell command support.

Requested decision

Merge after required checks pass, promote release-root, then retry the guarded minio-init workflow.

Merge blockers

Any concern that one-shot services need synchronous apply semantics instead of health-phase verification.

Spec sources read

control-plane/platformctl/apply.py — generated remote apply command
control-plane/platformctl/tests/test_apply_phase3.py — apply command contract
control-plane/platformctl/health.py — exited-success health semantics
tests/test_platform_host_agent_wrapper.py — allowed host command shape

Canary status: missing — rely on required Forgejo checks before merge ## Canary Context Pack ### Product story Let the final `minio-init` one-shot cutoff smoke use the same narrow host-agent command shape as normal compose applies. The terminal one-shot success check belongs in `platformctl health`, not in a shell command assembled for SSH. ### What changed - Removed `$(...)` / `docker wait` command substitution from `compose_apply_command()` for `expected_state=exited-success` services. - `minio-init` now applies as `docker compose ... up -d minio-init`, which is already within the platform-host-agent allowlist. - Updated the apply command contract test. ### Why it changed Run #1473 reached the guarded `minio-init` path but failed before SSH because `platformctl.safety` rejected the generated command as unsupported command substitution. That rejection was correct; the apply command was too clever. ### Files touched - `control-plane/platformctl/apply.py` - `control-plane/platformctl/tests/test_apply_phase3.py` ### Relevant context - #379 added `minio-init` one-shot support. - #381 made workflow exit-code capture robust. - #382 allowed the canonical platform runtime env files through the host wrapper. ### Runtime evidence - `platformctl-auto-apply` run #1473: guard allowed, plan drift only `container.state.exited_success`, apply crashed on safety rejection before remote mutation. - Local tests: `pytest -q control-plane/platformctl/tests/test_apply_phase3.py tests/test_platform_host_agent_wrapper.py` -> 60 passed. ### Known constraints This does not make one-shot success synchronous inside `apply`; the workflow already runs `platformctl health` after apply, and health knows `expected_state=exited-success`. ### Explicit out-of-scope No host-agent widening. No direct MinIO mutation. No broader shell command support. ### Requested decision Merge after required checks pass, promote release-root, then retry the guarded `minio-init` workflow. ### Merge blockers Any concern that one-shot services need synchronous apply semantics instead of health-phase verification. ## Spec sources read - `control-plane/platformctl/apply.py` — generated remote apply command - `control-plane/platformctl/tests/test_apply_phase3.py` — apply command contract - `control-plane/platformctl/health.py` — `exited-success` health semantics - `tests/test_platform_host_agent_wrapper.py` — allowed host command shape

codex added 1 commit

2026-05-19 01:08:05 +02:00

fix(apply): use allowlisted command for one-shot services

canary-required / collect-diff (pull_request) Successful in 3s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 17s

Details

python-ci / Python 3.11 (pull_request) Successful in 36s