pdurlej/platform

Fork 0

docs(manifests): reconcile catalog drift #773

Merged

pdurlej merged 1 commit from codex/issues/728-manifest-index-drift into main

2026-06-10 20:32:50 +02:00

codex commented

2026-06-10 20:24:49 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

The module catalog should agree with authoritative manifests and the current tombstone shape, so agents do not chase stale compose services or classify user-app modules with platform change policy.

What changed

Reconciled modules/INDEX.yaml lifecycle drift for openclaw-mail-gateway and umami.
Mirrored vault criticality downgrade from core to standard in manifest and index, and changed its SLO availability to best-effort.
Tombstoned vault, vault-bootstrap, and np-silverbullet by setting runtime.orchestrator: external and dropping dangling compose references.
Aligned kan-mcp, kan-migrate, kan-postgres, and kan-web to user-app/default-v1 change policy.

Why it changed

Issue #728 captured deslop audit drift where validated manifests, modules/INDEX.yaml, and retired compose services no longer agreed.

Files touched

modules/INDEX.yaml
modules/vault/module.yaml
modules/vault-bootstrap/module.yaml
modules/np-silverbullet/module.yaml
modules/kan-mcp/module.yaml
modules/kan-migrate/module.yaml
modules/kan-postgres/module.yaml
modules/kan-web/module.yaml

Relevant context

Forgejo issue #728 acceptance criteria.
Existing external tombstone pattern in audio-mcp-legacy, signal-bridge-legacy, and teamspeak3.
Advisory scouts: Ollama Cloud DeepSeek + GLM and AntiGravity/Gemini on a sanitized packet. Their actionable checks were folded into local validation; no cloud output is treated as approval.

Runtime evidence

No runtime mutation was performed. Local compose metadata check reports zero tombstone modules with dangling compose service references.

Known constraints

This is desired-state/catalog metadata only. It does not delete data, stop services, run deploys, change secrets, or migrate Vault.

Explicit out-of-scope

Runtime cleanup or compose edits.
Vault-to-Infisical migration.
Exposure/auth changes for any module.
Auto-apply, deploy, merge, or automerge.

Requested decision

Run required canary for modules/ changes and merge if review agrees the catalog drift is reconciled.

Merge blockers

platformctl validate all --json fails.
Any modules/INDEX.yaml lifecycle mismatch remains.
Any sunset/archived tombstone still references a non-existent compose service.

Spec sources read

Forgejo issue #728: task scope and acceptance criteria.
docs/forgejo-agent-operations.md: actor identity and PR/comment protocol.
modules/INDEX.yaml: affected catalog entries.
modules/openclaw-mail-gateway/module.yaml, modules/umami/module.yaml: authoritative lifecycle values.
modules/vault/module.yaml, modules/vault-bootstrap/module.yaml, modules/np-silverbullet/module.yaml: tombstone targets.
modules/kan-mcp/module.yaml, modules/kan-migrate/module.yaml, modules/kan-postgres/module.yaml, modules/kan-web/module.yaml: change_policy targets.
modules/audio-mcp-legacy/module.yaml, modules/signal-bridge-legacy/module.yaml, modules/teamspeak3/module.yaml: existing tombstone pattern.
schema/module.schema.json: external orchestrator validation shape.
compose/apps/compose.yaml: local check for missing compose service references.

Test Plan

git diff --check
UV_CACHE_DIR=/private/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json
Index lifecycle parity script: checked=88 mismatches=0
Tombstone dangling compose reference script: compose_services=41 tombstone_dangling_compose_refs=0
Targeted compose-key scan for vault, vault-bootstrap, and np-silverbullet: no compose_file / compose_service matches.

Closes #728

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story The module catalog should agree with authoritative manifests and the current tombstone shape, so agents do not chase stale compose services or classify user-app modules with platform change policy. ### What changed - Reconciled `modules/INDEX.yaml` lifecycle drift for `openclaw-mail-gateway` and `umami`. - Mirrored `vault` criticality downgrade from `core` to `standard` in manifest and index, and changed its SLO availability to `best-effort`. - Tombstoned `vault`, `vault-bootstrap`, and `np-silverbullet` by setting `runtime.orchestrator: external` and dropping dangling compose references. - Aligned `kan-mcp`, `kan-migrate`, `kan-postgres`, and `kan-web` to `user-app/default-v1` change policy. ### Why it changed Issue #728 captured deslop audit drift where validated manifests, `modules/INDEX.yaml`, and retired compose services no longer agreed. ### Files touched - `modules/INDEX.yaml` - `modules/vault/module.yaml` - `modules/vault-bootstrap/module.yaml` - `modules/np-silverbullet/module.yaml` - `modules/kan-mcp/module.yaml` - `modules/kan-migrate/module.yaml` - `modules/kan-postgres/module.yaml` - `modules/kan-web/module.yaml` ### Relevant context - Forgejo issue #728 acceptance criteria. - Existing external tombstone pattern in `audio-mcp-legacy`, `signal-bridge-legacy`, and `teamspeak3`. - Advisory scouts: Ollama Cloud DeepSeek + GLM and AntiGravity/Gemini on a sanitized packet. Their actionable checks were folded into local validation; no cloud output is treated as approval. ### Runtime evidence No runtime mutation was performed. Local compose metadata check reports zero tombstone modules with dangling compose service references. ### Known constraints This is desired-state/catalog metadata only. It does not delete data, stop services, run deploys, change secrets, or migrate Vault. ### Explicit out-of-scope - Runtime cleanup or compose edits. - Vault-to-Infisical migration. - Exposure/auth changes for any module. - Auto-apply, deploy, merge, or automerge. ### Requested decision Run required canary for `modules/` changes and merge if review agrees the catalog drift is reconciled. ### Merge blockers - `platformctl validate all --json` fails. - Any `modules/INDEX.yaml` lifecycle mismatch remains. - Any sunset/archived tombstone still references a non-existent compose service. ## Spec sources read - Forgejo issue #728: task scope and acceptance criteria. - `docs/forgejo-agent-operations.md`: actor identity and PR/comment protocol. - `modules/INDEX.yaml`: affected catalog entries. - `modules/openclaw-mail-gateway/module.yaml`, `modules/umami/module.yaml`: authoritative lifecycle values. - `modules/vault/module.yaml`, `modules/vault-bootstrap/module.yaml`, `modules/np-silverbullet/module.yaml`: tombstone targets. - `modules/kan-mcp/module.yaml`, `modules/kan-migrate/module.yaml`, `modules/kan-postgres/module.yaml`, `modules/kan-web/module.yaml`: change_policy targets. - `modules/audio-mcp-legacy/module.yaml`, `modules/signal-bridge-legacy/module.yaml`, `modules/teamspeak3/module.yaml`: existing tombstone pattern. - `schema/module.schema.json`: `external` orchestrator validation shape. - `compose/apps/compose.yaml`: local check for missing compose service references. ## Test Plan - `git diff --check` - `UV_CACHE_DIR=/private/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` - Index lifecycle parity script: `checked=88 mismatches=0` - Tombstone dangling compose reference script: `compose_services=41 tombstone_dangling_compose_refs=0` - Targeted compose-key scan for `vault`, `vault-bootstrap`, and `np-silverbullet`: no `compose_file` / `compose_service` matches. Closes #728

codex added 1 commit

2026-06-10 20:24:49 +02:00

docs(manifests): reconcile catalog drift

canary-required / collect-diff (pull_request) Successful in 5s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 19s

Details

canary-required / canary (pull_request) Successful in 14s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 17s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 3m29s

Details

4bd9b759c6

codex added the

tier/full

label

2026-06-10 20:25:37 +02:00

patchwarden commented

2026-06-10 20:29:59 +02:00

First-time contributor

Patchwarden PR sanity

Status: advisory_findings
PR: 773
Commit: 4bd9b759c6485e873fda2d409e333c6cd7211da1
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
medium Vault criticality downgrade may reduce incident response priority during sunset migration
- Evidence: modules/vault/module.yaml line 15: criticality changed from 'core' to 'standard'; modules/INDEX.yaml line 152: same change. SLO availability also changed to 'best-effort' at line 50 of vault/module.yaml
- Next: Confirm with SRE/oncall that vault monitoring and alerting thresholds are adjusted for sunset phase, and that incident response runbooks still cover vault until Infisical migration completes

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
high Tombstoned modules detached from compose while services remain running
- Evidence: modules/vault/module.yaml, modules/vault-bootstrap/module.yaml, and modules/np-silverbullet/module.yaml hunks remove compose_file/compose_service and set orchestrator: external. PR description explicitly lists 'Runtime cleanup or compose ed
- Next: Verify compose/apps/compose.yaml still defines vault, vault-bootstrap, and np-silverbullet; if present, remove them in this PR or file a blocking follow-up before merge to prevent orphaned services from escaping catalog policy enforcement.

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `773` - Commit: `4bd9b759c6485e873fda2d409e333c6cd7211da1` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** Vault criticality downgrade may reduce incident response priority during sunset migration - Evidence: `modules/vault/module.yaml line 15: criticality changed from 'core' to 'standard'; modules/INDEX.yaml line 152: same change. SLO availability also changed to 'best-effort' at line 50 of vault/module.yaml` - Next: Confirm with SRE/oncall that vault monitoring and alerting thresholds are adjusted for sunset phase, and that incident response runbooks still cover vault until Infisical migration completes ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** Tombstoned modules detached from compose while services remain running - Evidence: `modules/vault/module.yaml, modules/vault-bootstrap/module.yaml, and modules/np-silverbullet/module.yaml hunks remove compose_file/compose_service and set orchestrator: external. PR description explicitly lists 'Runtime cleanup or compose ed` - Next: Verify compose/apps/compose.yaml still defines vault, vault-bootstrap, and np-silverbullet; if present, remove them in this PR or file a blocking follow-up before merge to prevent orphaned services from escaping catalog policy enforcement. ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.