pdurlej/platform

Fork 0

fix(platformctl): anchor plan provenance to git root #639

Merged

pdurlej merged 1 commit from codex/m06-anchor-plan-git-root into main

2026-05-30 14:58:52 +02:00

codex commented

2026-05-30 14:42:18 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Plan artifacts are the apply pipeline trust root. Their source_sha and dirty state must come from the actual git checkout containing the module manifest, not from an ambiguous caller working directory.

What changed

Resolved git toplevel with git rev-parse --show-toplevel before reading HEAD or dirty state, and anchored _new_plan() provenance to the manifest's containing checkout.

Why it changed

Issue #192 begins the provenance hardening segment after the redaction chain. It closes nested/wrong checkout ambiguity before plan-hash tamper evidence is added in #193.

Files touched

control-plane/platformctl/plan.py
control-plane/platformctl/tests/test_plan_phase3.py

Relevant context

Issue #192: PROVENANCE-GIT-ROOT-01
Issue #194 grind order note: redaction before provenance/adversarial tests

Runtime evidence

No runtime mutation. Local validation only.

Known constraints

This PR does not change the plan schema. It changes how existing provenance fields are sourced.

Explicit out-of-scope

No plan hash yet (#193)
No hostile provenance matrix yet (#194)
No runtime apply or service restart

Requested decision

Approve merge if tests and Patchwarden checks are green.

Merge blockers

Plan provenance can still come from an arbitrary nested/wrong directory
Non-git directories produce null/ambiguous provenance instead of fail-closed behavior
Existing apply/plan tests regress

Spec sources read

Forgejo issue #192
docs/forgejo-agent-operations.md
control-plane/platformctl/plan.py
control-plane/platformctl/tests/test_plan_phase3.py
control-plane/platformctl/tests/test_apply_phase3.py
control-plane/platformctl/tests/test_apply_env_file.py

Validation

PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_plan_phase3.py control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_apply_env_file.py — 85 passed
PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json — passed

Closes #192

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Plan artifacts are the apply pipeline trust root. Their `source_sha` and dirty state must come from the actual git checkout containing the module manifest, not from an ambiguous caller working directory. ### What changed Resolved git toplevel with `git rev-parse --show-toplevel` before reading `HEAD` or dirty state, and anchored `_new_plan()` provenance to the manifest's containing checkout. ### Why it changed Issue #192 begins the provenance hardening segment after the redaction chain. It closes nested/wrong checkout ambiguity before plan-hash tamper evidence is added in #193. ### Files touched - `control-plane/platformctl/plan.py` - `control-plane/platformctl/tests/test_plan_phase3.py` ### Relevant context - Issue #192: PROVENANCE-GIT-ROOT-01 - Issue #194 grind order note: redaction before provenance/adversarial tests ### Runtime evidence No runtime mutation. Local validation only. ### Known constraints This PR does not change the plan schema. It changes how existing provenance fields are sourced. ### Explicit out-of-scope - No plan hash yet (#193) - No hostile provenance matrix yet (#194) - No runtime apply or service restart ### Requested decision Approve merge if tests and Patchwarden checks are green. ### Merge blockers - Plan provenance can still come from an arbitrary nested/wrong directory - Non-git directories produce null/ambiguous provenance instead of fail-closed behavior - Existing apply/plan tests regress ## Spec sources read - Forgejo issue #192 - `docs/forgejo-agent-operations.md` - `control-plane/platformctl/plan.py` - `control-plane/platformctl/tests/test_plan_phase3.py` - `control-plane/platformctl/tests/test_apply_phase3.py` - `control-plane/platformctl/tests/test_apply_env_file.py` ## Validation - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_plan_phase3.py control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_apply_env_file.py` — 85 passed - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json` — passed Closes #192

codex added 1 commit

2026-05-30 14:42:18 +02:00

fix(platformctl): anchor plan provenance to git root

canary-required / collect-diff (pull_request) Successful in 5s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 24s

Details

python-ci / Python 3.11 (pull_request) Successful in 44s

Details

python-ci / Python 3.13 (pull_request) Successful in 46s

Details

base-is-main / guard (pull_request) Successful in 2s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 5s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 22s

Details

python-ci / Python 3.12 (pull_request) Successful in 46s

Details

canary-required / canary (pull_request) Successful in 15s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 23s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 4m28s

Details

b9e6131faa

codex added the

class/security-sensitive

label

2026-05-30 14:42:18 +02:00

codex commented

2026-05-30 14:51:42 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 639
Commit: b9e6131faac425fb9ffdf5d392a34d60b643597b
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
medium Missing test for _new_plan() PlanProvenanceError when git_toplevel returns None
- Evidence: control-plane/platformctl/plan.py lines 109-113: _new_plan() raises PlanProvenanceError if git_toplevel() returns None, but test_plan_phase3.py adds tests only for current_source_sha() and source_tree_dirty() returning None/True in that cas
- Next: Add a test case for _new_plan() that verifies PlanProvenanceError is raised when manifest.path.parent is outside a git repository
low Redundant git_toplevel() subprocess calls in _new_plan() flow
- Evidence: control-plane/platformctl/plan.py: _new_plan() calls git_toplevel() at line 109, then passes the resolved root to current_source_sha() and source_tree_dirty() which each call git_toplevel() again internally (lines 76-79 and 91-94), resultin
- Next: Consider refactoring current_source_sha() and source_tree_dirty() to accept an optional pre-resolved toplevel parameter, or restructure to call git_toplevel() once in _new_plan() and pass the resolved root directly to _git_stdout()

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
medium Breaking change: plan provenance now anchored to manifest directory instead of CWD
- Evidence: In plan.py, _new_plan now uses manifest.path.parent to determine git toplevel, whereas previously it defaulted to Path('.') (CWD). This may break existing automation that runs platformctl from a different directory.
- Next: Ensure release notes and documentation highlight this change. Consider adding a deprecation warning if CWD is used.

`redteam` / `kimi-k2.6:cloud`

Status: error
Verdict: -
Note: ReadTimeout: The read operation timed out
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `639` - Commit: `b9e6131faac425fb9ffdf5d392a34d60b643597b` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** Missing test for _new_plan() PlanProvenanceError when git_toplevel returns None - Evidence: `control-plane/platformctl/plan.py lines 109-113: _new_plan() raises PlanProvenanceError if git_toplevel() returns None, but test_plan_phase3.py adds tests only for current_source_sha() and source_tree_dirty() returning None/True in that cas` - Next: Add a test case for _new_plan() that verifies PlanProvenanceError is raised when manifest.path.parent is outside a git repository - **`low`** Redundant git_toplevel() subprocess calls in _new_plan() flow - Evidence: `control-plane/platformctl/plan.py: _new_plan() calls git_toplevel() at line 109, then passes the resolved root to current_source_sha() and source_tree_dirty() which each call git_toplevel() again internally (lines 76-79 and 91-94), resultin` - Next: Consider refactoring current_source_sha() and source_tree_dirty() to accept an optional pre-resolved toplevel parameter, or restructure to call git_toplevel() once in _new_plan() and pass the resolved root directly to _git_stdout() ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** Breaking change: plan provenance now anchored to manifest directory instead of CWD - Evidence: `In plan.py, _new_plan now uses manifest.path.parent to determine git toplevel, whereas previously it defaulted to Path('.') (CWD). This may break existing automation that runs platformctl from a different directory.` - Next: Ensure release notes and documentation highlight this change. Consider adding a deprecation warning if CWD is used. ### `redteam` / `kimi-k2.6:cloud` - Status: `error` - Verdict: `-` - Note: ReadTimeout: The read operation timed out - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.