pdurlej/platform

Fork 0

docs(platformctl): document phase 05 apply gate #658

Merged

pdurlej merged 1 commit from codex/208-phase05-apply-docs into main

2026-06-01 14:03:12 +02:00

codex commented

2026-06-01 08:51:15 +02:00

Collaborator

Canary status: missing - docs/workflow-comment-only update; run canary manually if branch policy requires it.

Canary Context Pack

Product story

Operators and reviewers need to know why the trusted apply workflow sets PLATFORMCTL_PHASE=05, and why that does not bypass the other apply gates.

What changed

Added an inline workflow comment next to PLATFORMCTL_PHASE=05 and documented the Phase 05 runtime-apply semantics in the CI runbook.

Why it changed

Issue #208 / PHASE-DOC-01 asked for explicit documentation that Phase 05 enables real runtime apply while earlier phases remain dry-run/stub gated.

Files touched

control-plane/forgejo-actions/apply.yaml
docs/ci/README.md

Relevant context

control-plane/platformctl/apply.py phase gate: _real_apply_enabled() and the non-dry-run refusal path.
docs/ci/README.md deploy/auto-apply model.

Runtime evidence

No runtime commands were run. Validation:

UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py
PYTHONPATH=control-plane UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run --project control-plane python -m platformctl.cli validate all --json

Results: test_forgejo_ci_scripts_contract.py 42 passed; validate all exitCode 0.

Known constraints

This PR changes documentation and YAML comments only. It does not alter workflow execution, env values, apply behavior, or production runtime.

Explicit out-of-scope

No runtime apply.
No production restart.
No deploy capability change.
No phase-gate behavior change.

Requested decision

Approve if the documented Phase 05 meaning matches current platformctl apply behavior.

Merge blockers

The Phase 05 wording implies it bypasses apply safety gates.
The workflow comment becomes misleading after pending apply-hardening PRs merge.

Spec sources read

Issue #208 - scope and acceptance criteria.
control-plane/platformctl/apply.py - phase gate implementation.
control-plane/forgejo-actions/apply.yaml - workflow env setting.
docs/ci/README.md - target documentation surface.

Closes #208

Canary status: missing - docs/workflow-comment-only update; run canary manually if branch policy requires it. ## Canary Context Pack ### Product story Operators and reviewers need to know why the trusted apply workflow sets `PLATFORMCTL_PHASE=05`, and why that does not bypass the other apply gates. ### What changed Added an inline workflow comment next to `PLATFORMCTL_PHASE=05` and documented the Phase 05 runtime-apply semantics in the CI runbook. ### Why it changed Issue #208 / PHASE-DOC-01 asked for explicit documentation that Phase 05 enables real runtime apply while earlier phases remain dry-run/stub gated. ### Files touched - `control-plane/forgejo-actions/apply.yaml` - `docs/ci/README.md` ### Relevant context - `control-plane/platformctl/apply.py` phase gate: `_real_apply_enabled()` and the non-dry-run refusal path. - `docs/ci/README.md` deploy/auto-apply model. ### Runtime evidence No runtime commands were run. Validation: ```bash UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py PYTHONPATH=control-plane UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run --project control-plane python -m platformctl.cli validate all --json ``` Results: `test_forgejo_ci_scripts_contract.py` 42 passed; `validate all` exitCode 0. ### Known constraints This PR changes documentation and YAML comments only. It does not alter workflow execution, env values, apply behavior, or production runtime. ### Explicit out-of-scope - No runtime apply. - No production restart. - No deploy capability change. - No phase-gate behavior change. ### Requested decision Approve if the documented Phase 05 meaning matches current `platformctl apply` behavior. ### Merge blockers - The Phase 05 wording implies it bypasses apply safety gates. - The workflow comment becomes misleading after pending apply-hardening PRs merge. ## Spec sources read - Issue #208 - scope and acceptance criteria. - `control-plane/platformctl/apply.py` - phase gate implementation. - `control-plane/forgejo-actions/apply.yaml` - workflow env setting. - `docs/ci/README.md` - target documentation surface. Closes #208

codex added this to the 06 - Agent execution and CI governance milestone

2026-06-01 08:51:15 +02:00

codex added the

class/security-sensitive

label

2026-06-01 08:51:15 +02:00

codex added 1 commit

2026-06-01 08:51:15 +02:00

docs(platformctl): document phase 05 apply gate

canary-required / collect-diff (pull_request) Successful in 7s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 7s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 26s

Details

python-ci / Python 3.11 (pull_request) Successful in 45s

Details

python-ci / Python 3.12 (pull_request) Successful in 51s

Details

python-ci / Python 3.13 (pull_request) Successful in 47s

Details

workflow-lint / lint (pull_request) Successful in 7s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 6s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 6s

Details

canary-required / canary (pull_request) Successful in 16s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 27s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 2m53s

Details

034a059a22

codex commented

2026-06-01 09:44:59 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 658
Commit: 034a059a224cb6a2170e1b61890b71f6f6f5d05e
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
medium Documentation claims about apply.py gate behavior unverified in diff
- Evidence: docs/ci/README.md added lines state 'Phase 05 does not bypass the merged-PR SHA, plan validation, sacred-path, or break-glass gates' but apply.py code is not shown in this diff to confirm accuracy
- Next: Verify against control-plane/platformctl/apply.py that _real_apply_enabled() and other gate checks still enforce merged-PR SHA, plan validation, sacred-path, and break-glass gates when PLATFORMCTL_PHASE=05

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
low Documentation may become stale after future apply-hardening PRs
- Evidence: PR description states: 'The workflow comment becomes misleading after pending apply-hardening PRs merge.' The added comment in control-plane/forgejo-actions/apply.yaml and the runbook paragraph in docs/ci/README.md describe current Phase 05
- Next: Add a reminder in the PR or issue tracker to update this documentation when the apply-hardening PRs land, or include a version note in the comment.

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
high YAML comment embeds fragile safety claim omitting other gates
- Evidence: control-plane/forgejo-actions/apply.yaml adds inline comment '# Values below Phase 05, including unset, refuse non-dry-run apply.' directly above PLATFORMCTL_PHASE: '05'. The PR description's merge-blocker section explicitly warns this comm
- Next: Remove the behavioral claim from the workflow file and replace it with a non-stale pointer to docs/ci/README.md (e.g., '# Phase gate semantics: see docs/ci/README.md') so operators do not rely on inline comments that drift from code.

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `658` - Commit: `034a059a224cb6a2170e1b61890b71f6f6f5d05e` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** Documentation claims about apply.py gate behavior unverified in diff - Evidence: `docs/ci/README.md added lines state 'Phase 05 does not bypass the merged-PR SHA, plan validation, sacred-path, or break-glass gates' but apply.py code is not shown in this diff to confirm accuracy` - Next: Verify against control-plane/platformctl/apply.py that _real_apply_enabled() and other gate checks still enforce merged-PR SHA, plan validation, sacred-path, and break-glass gates when PLATFORMCTL_PHASE=05 ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - **`low`** Documentation may become stale after future apply-hardening PRs - Evidence: `PR description states: 'The workflow comment becomes misleading after pending apply-hardening PRs merge.' The added comment in control-plane/forgejo-actions/apply.yaml and the runbook paragraph in docs/ci/README.md describe current Phase 05` - Next: Add a reminder in the PR or issue tracker to update this documentation when the apply-hardening PRs land, or include a version note in the comment. ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** YAML comment embeds fragile safety claim omitting other gates - Evidence: `control-plane/forgejo-actions/apply.yaml adds inline comment '# Values below Phase 05, including unset, refuse non-dry-run apply.' directly above PLATFORMCTL_PHASE: '05'. The PR description's merge-blocker section explicitly warns this comm` - Next: Remove the behavioral claim from the workflow file and replace it with a non-stale pointer to docs/ci/README.md (e.g., '# Phase gate semantics: see docs/ci/README.md') so operators do not rely on inline comments that drift from code. ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.