pdurlej/platform

Fork 0

fix(platformctl): set apply transport timeout #647

Merged

pdurlej merged 1 commit from codex/m06-apply-transport-timeout into main

2026-05-30 16:42:29 +02:00

codex commented

2026-05-30 16:29:22 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Canary Context Pack

Product story

Prevent remote compose hangs from blocking platformctl apply indefinitely by making transport timeouts explicit at the apply call site.

What changed

Added DEFAULT_APPLY_TRANSPORT_TIMEOUT_SECONDS.
Passed that timeout explicitly to both preflight and remote compose apply transport calls.
Updated fake transports and tests to assert timeout propagation.

Why it changed

Issue #202 called out that apply should not rely on implicit transport defaults for mutation-path SSH commands.

Files touched

control-plane/platformctl/apply.py
control-plane/platformctl/tests/test_apply_phase3.py
control-plane/platformctl/tests/test_apply_env_file.py

Relevant context

#202 TRANSPORT-TIMEOUT-01
M06 apply-pipeline runtime safety hardening

Runtime evidence

No runtime mutation. Local validation only.

Known constraints

This PR does not change TailscaleTransport internals. It makes apply's timeout contract explicit at the call site.

Explicit out-of-scope

No SSH calls.
No runtime apply.
No post-apply smoke logic; that remains #201.

Requested decision

Approve and merge if checks stay green.

Merge blockers

Tests fail.
Apply transport calls omit explicit timeout.
Patchwarden flags a safety regression.

Spec sources read

control-plane/platformctl/apply.py - apply transport calls.
control-plane/platformctl/transport/tailscale.py - transport run signature and timeout behavior.
control-plane/platformctl/tests/test_apply_phase3.py - apply tests and fake transport.
control-plane/platformctl/tests/test_apply_env_file.py - env-file apply fake transport.
Forgejo issue #202 - acceptance criteria.

Validation

PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_apply_env_file.py - 101 passed
PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json - pass

Closes #202

Canary status: missing - fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Prevent remote compose hangs from blocking `platformctl apply` indefinitely by making transport timeouts explicit at the apply call site. ### What changed - Added `DEFAULT_APPLY_TRANSPORT_TIMEOUT_SECONDS`. - Passed that timeout explicitly to both preflight and remote compose apply transport calls. - Updated fake transports and tests to assert timeout propagation. ### Why it changed Issue #202 called out that apply should not rely on implicit transport defaults for mutation-path SSH commands. ### Files touched - `control-plane/platformctl/apply.py` - `control-plane/platformctl/tests/test_apply_phase3.py` - `control-plane/platformctl/tests/test_apply_env_file.py` ### Relevant context - #202 TRANSPORT-TIMEOUT-01 - M06 apply-pipeline runtime safety hardening ### Runtime evidence No runtime mutation. Local validation only. ### Known constraints This PR does not change TailscaleTransport internals. It makes apply's timeout contract explicit at the call site. ### Explicit out-of-scope - No SSH calls. - No runtime apply. - No post-apply smoke logic; that remains #201. ### Requested decision Approve and merge if checks stay green. ### Merge blockers - Tests fail. - Apply transport calls omit explicit timeout. - Patchwarden flags a safety regression. ## Spec sources read - `control-plane/platformctl/apply.py` - apply transport calls. - `control-plane/platformctl/transport/tailscale.py` - transport run signature and timeout behavior. - `control-plane/platformctl/tests/test_apply_phase3.py` - apply tests and fake transport. - `control-plane/platformctl/tests/test_apply_env_file.py` - env-file apply fake transport. - Forgejo issue #202 - acceptance criteria. ## Validation - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_apply_env_file.py` - 101 passed - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json` - pass Closes #202

codex added 1 commit

2026-05-30 16:29:23 +02:00

fix(platformctl): set apply transport timeout

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 5s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 25s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 22s

Details

python-ci / Python 3.11 (pull_request) Successful in 48s

Details

python-ci / Python 3.13 (pull_request) Successful in 45s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 23s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

python-ci / Python 3.12 (pull_request) Successful in 47s

Details

canary-required / canary (pull_request) Successful in 15s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 2m38s

Details

52c5c9a8bc

codex added the

class/security-sensitive

label

2026-05-30 16:29:23 +02:00

codex commented

2026-05-30 16:35:56 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 647
Commit: 52c5c9a8bc7651384a89c838fc05af63a2d625d4
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

info sensitive-path-touched Sensitive path touched — control-plane/platformctl/apply.py
- Evidence: control-plane/platformctl/apply.py
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
medium 120s timeout may be insufficient for remote compose operations
- Evidence: control-plane/platformctl/apply.py line 46: DEFAULT_APPLY_TRANSPORT_TIMEOUT_SECONDS = 120 applied to both preflight (line 853) and remote compose (line 886)
- Next: Consider monitoring real-world apply durations post-merge. If compose operations exceed 120s in production, either increase the default or make it configurable via env var (e.g., PLATFORMCTL_APPLY_TIMEOUT_SECONDS)
low Same timeout for preflight and compose despite different expected durations
- Evidence: control-plane/platformctl/apply.py lines 850-854 and 882-886: both transport.run() calls use identical DEFAULT_APPLY_TRANSPORT_TIMEOUT_SECONDS
- Next: Preflight checks should complete in seconds; compose may need minutes. Consider separate timeouts (e.g., DEFAULT_PREFLIGHT_TIMEOUT_SECONDS=30, DEFAULT_COMPOSE_TIMEOUT_SECONDS=120) for clearer intent and better failure diagnostics

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
high Unhandled transport timeout exception crashes apply
- Evidence: control-plane/platformctl/apply.py adds timeout=DEFAULT_APPLY_TRANSPORT_TIMEOUT_SECONDS to both preflight and remote compose transport.run calls (lines ~850-860 and ~882-892), but both remain inside try blocks that only catch SSHError; no e
- Next: Add except clauses for timeout exceptions (e.g., TimeoutError or the transport's timeout type) around both transport.run calls, returning structured error results and invoking rollback for the remote path

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `647` - Commit: `52c5c9a8bc7651384a89c838fc05af63a2d625d4` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings - **`info` `sensitive-path-touched`** Sensitive path touched — `control-plane/platformctl/apply.py` - Evidence: `control-plane/platformctl/apply.py` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** 120s timeout may be insufficient for remote compose operations - Evidence: `control-plane/platformctl/apply.py line 46: DEFAULT_APPLY_TRANSPORT_TIMEOUT_SECONDS = 120 applied to both preflight (line 853) and remote compose (line 886)` - Next: Consider monitoring real-world apply durations post-merge. If compose operations exceed 120s in production, either increase the default or make it configurable via env var (e.g., PLATFORMCTL_APPLY_TIMEOUT_SECONDS) - **`low`** Same timeout for preflight and compose despite different expected durations - Evidence: `control-plane/platformctl/apply.py lines 850-854 and 882-886: both transport.run() calls use identical DEFAULT_APPLY_TRANSPORT_TIMEOUT_SECONDS` - Next: Preflight checks should complete in seconds; compose may need minutes. Consider separate timeouts (e.g., DEFAULT_PREFLIGHT_TIMEOUT_SECONDS=30, DEFAULT_COMPOSE_TIMEOUT_SECONDS=120) for clearer intent and better failure diagnostics ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** Unhandled transport timeout exception crashes apply - Evidence: `control-plane/platformctl/apply.py adds timeout=DEFAULT_APPLY_TRANSPORT_TIMEOUT_SECONDS to both preflight and remote compose transport.run calls (lines ~850-860 and ~882-892), but both remain inside try blocks that only catch SSHError; no e` - Next: Add except clauses for timeout exceptions (e.g., TimeoutError or the transport's timeout type) around both transport.run calls, returning structured error results and invoking rollback for the remote path ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.