pdurlej/platform

Fork 0

fix(platformctl): harden apply status artifacts #670

Merged

pdurlej merged 1 commit from codex/204-205-apply-status-artifacts into main

2026-06-01 15:17:09 +02:00

codex commented

2026-06-01 15:15:07 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

platformctl apply status artifacts are operator and agent evidence. They need to be durable enough to trust after process crashes, and their reported paths need to be unambiguous in CI and local runs.

What changed

Flush and fsync the temporary status artifact file before atomic replacement.
Best-effort fsync the containing directory after replacement when the platform supports it.
Resolve relative state_root values to absolute status artifact paths before writing and returning them.
Add regression tests for fsync-before-replace ordering and absolute returned artifact paths.

Why it changed

M06 apply-hardening needs status artifact writes that do not create false-green evidence and do not leave relative paths that different agents or CI jobs can interpret differently.

Files touched

control-plane/platformctl/apply.py
control-plane/platformctl/tests/test_apply_phase3.py

Relevant context

M06 apply-hardening closeout
Issue #204: fsync apply status artifacts before replace
Issue #205: absolute apply status artifact paths
Existing platformctl apply status artifact behavior in control-plane/platformctl/apply.py

Runtime evidence

No runtime apply, no production mutation, no SSH, no Forgejo mutation beyond this PR creation. This is local code and test hardening only.

Known constraints

Status artifact write failures remain non-fatal to apply results through the existing _attach_status_artifact behavior. Directory fsync is intentionally best-effort because not every filesystem supports directory fsync.

Explicit out-of-scope

No break-glass policy changes.
No actor identity binding changes.
No runtime apply, service restart, live DB apply, or destructive operation.
No changes to Infisical inventory work currently dirty in the worktree.

Requested decision

Review and merge if checks stay green.

Merge blockers

Any regression in platformctl apply status artifact write behavior.
Any test failure in targeted M06 apply/CI/health tests.
Any reviewer finding that absolute path resolution leaks private data beyond already-local state paths.

Spec sources read

control-plane/platformctl/apply.py — apply status artifact writer and attach path.
control-plane/platformctl/tests/test_apply_phase3.py — existing apply/status artifact tests and regression placement.
/Users/pd/.codex/skills/bmadx/SKILL.md — X3 gate/routing instructions requested by operator.
/Users/pd/.codex/skills/bmad-method-codex/SKILL.md — BMAD sync/check protocol requested by operator.

Validation

python3 "$HOME/.codex/skills/bmad-method-codex/scripts/sync_bmad_method.py" sync — passed
python3 "$HOME/.codex/skills/bmad-method-codex/scripts/sync_bmad_method.py" check --json — passed, is_optimal=true
python3 "$HOME/.codex/skills/bmadx/scripts/sync_bmadx.py" check --gear X3 --compact — passed, execution_allowed=true
UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_apply_phase3.py — 101 passed
UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_apply_phase3.py platformctl/tests/test_apply_env_file.py platformctl/tests/test_pr_sanity.py platformctl/tests/test_forgejo_ci_scripts_contract.py platformctl/tests/test_health_phase3.py — 202 passed
PYTHONPATH=control-plane UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run --project control-plane python -m platformctl.cli validate all --json — passed, exitCode=0

Closes #204
Closes #205

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story `platformctl apply` status artifacts are operator and agent evidence. They need to be durable enough to trust after process crashes, and their reported paths need to be unambiguous in CI and local runs. ### What changed - Flush and `fsync` the temporary status artifact file before atomic replacement. - Best-effort `fsync` the containing directory after replacement when the platform supports it. - Resolve relative `state_root` values to absolute status artifact paths before writing and returning them. - Add regression tests for fsync-before-replace ordering and absolute returned artifact paths. ### Why it changed M06 apply-hardening needs status artifact writes that do not create false-green evidence and do not leave relative paths that different agents or CI jobs can interpret differently. ### Files touched - `control-plane/platformctl/apply.py` - `control-plane/platformctl/tests/test_apply_phase3.py` ### Relevant context - M06 apply-hardening closeout - Issue #204: fsync apply status artifacts before replace - Issue #205: absolute apply status artifact paths - Existing `platformctl apply` status artifact behavior in `control-plane/platformctl/apply.py` ### Runtime evidence No runtime apply, no production mutation, no SSH, no Forgejo mutation beyond this PR creation. This is local code and test hardening only. ### Known constraints Status artifact write failures remain non-fatal to apply results through the existing `_attach_status_artifact` behavior. Directory fsync is intentionally best-effort because not every filesystem supports directory fsync. ### Explicit out-of-scope - No break-glass policy changes. - No actor identity binding changes. - No runtime apply, service restart, live DB apply, or destructive operation. - No changes to Infisical inventory work currently dirty in the worktree. ### Requested decision Review and merge if checks stay green. ### Merge blockers - Any regression in `platformctl apply` status artifact write behavior. - Any test failure in targeted M06 apply/CI/health tests. - Any reviewer finding that absolute path resolution leaks private data beyond already-local state paths. ## Spec sources read - `control-plane/platformctl/apply.py` — apply status artifact writer and attach path. - `control-plane/platformctl/tests/test_apply_phase3.py` — existing apply/status artifact tests and regression placement. - `/Users/pd/.codex/skills/bmadx/SKILL.md` — X3 gate/routing instructions requested by operator. - `/Users/pd/.codex/skills/bmad-method-codex/SKILL.md` — BMAD sync/check protocol requested by operator. ## Validation - `python3 "$HOME/.codex/skills/bmad-method-codex/scripts/sync_bmad_method.py" sync` — passed - `python3 "$HOME/.codex/skills/bmad-method-codex/scripts/sync_bmad_method.py" check --json` — passed, `is_optimal=true` - `python3 "$HOME/.codex/skills/bmadx/scripts/sync_bmadx.py" check --gear X3 --compact` — passed, `execution_allowed=true` - `UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_apply_phase3.py` — 101 passed - `UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_apply_phase3.py platformctl/tests/test_apply_env_file.py platformctl/tests/test_pr_sanity.py platformctl/tests/test_forgejo_ci_scripts_contract.py platformctl/tests/test_health_phase3.py` — 202 passed - `PYTHONPATH=control-plane UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run --project control-plane python -m platformctl.cli validate all --json` — passed, `exitCode=0` Closes #204 Closes #205

codex added 1 commit

2026-06-01 15:15:07 +02:00

fix(platformctl): harden apply status artifacts

canary-required / collect-diff (pull_request) Successful in 3s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 15s

Details

python-ci / Python 3.11 (pull_request) Successful in 35s

Details

python-ci / Python 3.12 (pull_request) Successful in 36s

Details

python-ci / Python 3.13 (pull_request) Successful in 35s

Details

canary-required / canary (pull_request) Successful in 12s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 16s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 1m5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

ff74a3c8bb

codex added the

agent/codex

class/security-sensitive

risk/process

tier/full

labels

2026-06-01 15:16:16 +02:00

codex added this to the 06 - Agent execution and CI governance milestone

2026-06-01 15:16:16 +02:00

pdurlej merged commit 7e981fb588 into main

2026-06-01 15:17:09 +02:00

pdurlej deleted branch codex/204-205-apply-status-artifacts

2026-06-01 15:17:09 +02:00

pdurlej referenced this pull request from a commit

2026-06-01 15:17:11 +02:00

Merge pull request 'fix(platformctl): harden apply status artifacts' (#670) from codex/204-205-apply-status-artifacts into main

codex commented

2026-06-01 15:20:39 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 670
Commit: ff74a3c8bb7ab15ac98c053e7269fbd1c730d503
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: ABSTAIN
blocker Missing diff prevents review
- Evidence: PR description lists changed files (control-plane/platformctl/apply.py, control-plane/platformctl/tests/test_apply_phase3.py) but the diff is empty. No hunks available to verify the claimed fsync, absolute path resolution, or test additions
- Next: Ensure the diff is included in the review request. Without it, no assessment of correctness, security, or policy compliance can be made.

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `670` - Commit: `ff74a3c8bb7ab15ac98c053e7269fbd1c730d503` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `ABSTAIN` - **`blocker`** Missing diff prevents review - Evidence: `PR description lists changed files (control-plane/platformctl/apply.py, control-plane/platformctl/tests/test_apply_phase3.py) but the diff is empty. No hunks available to verify the claimed fsync, absolute path resolution, or test additions` - Next: Ensure the diff is included in the review request. Without it, no assessment of correctness, security, or policy compliance can be made. ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.