fix(platformctl): force compose up for backup-gated F3 #409

Merged

pdurlej merged 1 commit from codex/fix/f3-force-compose-up into main

2026-05-24 09:18:09 +02:00

codex commented

2026-05-24 09:16:45 +02:00

Collaborator

Canary status: missing — rely on required Forgejo checks before merge

Canary Context Pack

Product story

The deploy-control F3 dispatch after #408 was green but did not recreate the container. The plan was in-sync because platformctl currently observes container image/status, not bind mounts. For backup-gated compose-only F3 changes, the operator needs a workflow-native way to force the intended docker compose up instead of falling back to manual SSH.

What changed

Added platformctl apply --force-compose-up.
Added force_compose_up workflow_dispatch input to platformctl-auto-apply.yml.
Restricted that input to the existing allow_stateful=true / BACKUP_DONE_F3 manual F3 path.
Added tests covering in-sync forced apply and workflow contract wiring.

Why it changed

Run #2156 (platformctl-auto-apply.yml) accepted the deploy-control F3 backup ref and exited success, but produced apply.status=noop and left the live /repo mount unchanged. This PR keeps mutation inside the trusted workflow rather than doing an ad-hoc production docker compose up from the terminal.

Files touched

.forgejo/workflows/platformctl-auto-apply.yml
control-plane/platformctl/apply.py
control-plane/platformctl/cli.py
control-plane/platformctl/tests/test_apply_phase3.py
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py

Relevant context

#408 removed the deploy-control legacy root mount in compose.
Run #2156 evidence: scope eligible, backup ref accepted, plan in-sync, apply noop, health OK but runtime mount unchanged.
#387 Phase 1 legacy cleanup.

Runtime evidence

No production mutation in this PR. Current backup remains available at /opt/pdurlej-platform/backups/deploy-control-20260524T070134Z.tar.gz with metadata exit_code=0 and mode 0600.

Known constraints

--force-compose-up intentionally does not make plan smarter. It is an explicit escape hatch for already reviewed, backup-gated manual F3 compose-only changes. It is wired only through manual dispatch with allow_stateful=true; push auto-apply cannot set it.

Explicit out-of-scope

Compose mount diff detection in platformctl plan.
Any change to backup creation.
Any direct production restart outside workflow.

Requested decision

Merge, then rerun platformctl-auto-apply.yml for deploy-control with:

allow_stateful=true
backup_ref=/opt/pdurlej-platform/backups/deploy-control-20260524T070134Z.tar.gz
stateful_confirm=BACKUP_DONE_F3
force_compose_up=true

Merge blockers

Required tests fail.
Concern that manual F3 forced compose up should require a different input phrase.

Spec sources read

.forgejo/workflows/platformctl-auto-apply.yml — workflow F3 dispatch gates.
control-plane/platformctl/apply.py — noop/apply behavior.
control-plane/platformctl/cli.py — apply CLI surface.
control-plane/platformctl/tests/test_apply_phase3.py — apply regression tests.
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py — workflow contract tests.
Run #2156 artifact/log evidence — no secret content used; only status/plan/apply metadata.

Validation

python3 -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py → 84 passed
python3 -m platformctl.cli --help → exit 0
git diff --check → pass

Refs #387

Canary status: missing — rely on required Forgejo checks before merge ## Canary Context Pack ### Product story The deploy-control F3 dispatch after #408 was green but did not recreate the container. The plan was `in-sync` because platformctl currently observes container image/status, not bind mounts. For backup-gated compose-only F3 changes, the operator needs a workflow-native way to force the intended `docker compose up` instead of falling back to manual SSH. ### What changed - Added `platformctl apply --force-compose-up`. - Added `force_compose_up` workflow_dispatch input to `platformctl-auto-apply.yml`. - Restricted that input to the existing `allow_stateful=true` / `BACKUP_DONE_F3` manual F3 path. - Added tests covering in-sync forced apply and workflow contract wiring. ### Why it changed Run #2156 (`platformctl-auto-apply.yml`) accepted the `deploy-control` F3 backup ref and exited success, but produced `apply.status=noop` and left the live `/repo` mount unchanged. This PR keeps mutation inside the trusted workflow rather than doing an ad-hoc production `docker compose up` from the terminal. ### Files touched - `.forgejo/workflows/platformctl-auto-apply.yml` - `control-plane/platformctl/apply.py` - `control-plane/platformctl/cli.py` - `control-plane/platformctl/tests/test_apply_phase3.py` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` ### Relevant context - #408 removed the deploy-control legacy root mount in compose. - Run #2156 evidence: scope eligible, backup ref accepted, plan `in-sync`, apply `noop`, health OK but runtime mount unchanged. - #387 Phase 1 legacy cleanup. ### Runtime evidence No production mutation in this PR. Current backup remains available at `/opt/pdurlej-platform/backups/deploy-control-20260524T070134Z.tar.gz` with metadata exit_code=0 and mode 0600. ### Known constraints `--force-compose-up` intentionally does not make plan smarter. It is an explicit escape hatch for already reviewed, backup-gated manual F3 compose-only changes. It is wired only through manual dispatch with `allow_stateful=true`; push auto-apply cannot set it. ### Explicit out-of-scope - Compose mount diff detection in `platformctl plan`. - Any change to backup creation. - Any direct production restart outside workflow. ### Requested decision Merge, then rerun `platformctl-auto-apply.yml` for `deploy-control` with: - `allow_stateful=true` - `backup_ref=/opt/pdurlej-platform/backups/deploy-control-20260524T070134Z.tar.gz` - `stateful_confirm=BACKUP_DONE_F3` - `force_compose_up=true` ### Merge blockers - Required tests fail. - Concern that manual F3 forced compose up should require a different input phrase. ## Spec sources read - `.forgejo/workflows/platformctl-auto-apply.yml` — workflow F3 dispatch gates. - `control-plane/platformctl/apply.py` — noop/apply behavior. - `control-plane/platformctl/cli.py` — apply CLI surface. - `control-plane/platformctl/tests/test_apply_phase3.py` — apply regression tests. - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` — workflow contract tests. - Run #2156 artifact/log evidence — no secret content used; only status/plan/apply metadata. ## Validation - `python3 -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` → 84 passed - `python3 -m platformctl.cli --help` → exit 0 - `git diff --check` → pass Refs #387

codex added 1 commit

2026-05-24 09:16:45 +02:00

fix(platformctl): force compose up for backup-gated F3

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 21s

Details

python-ci / Python 3.11 (pull_request) Successful in 40s