pdurlej/platform

Fork 0

feat(platformctl): add read-only drift check #781

Merged

pdurlej merged 1 commit from codex/issues/771-drift-check into main

2026-06-10 23:53:57 +02:00

codex commented

2026-06-10 23:37:07 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Canary Context Pack

Product story

Operators and future agents need a narrow, read-only way to compare module image declarations with live Docker observation without treating stale Honcho drift notes as live truth.

What changed

Added platformctl drift-check [module...] [--json].
Added deterministic JSON/human output with exit codes: 0 clean, 2 drift, 5 remote unreachable, 8 partial state.
Added mocked tests for matching digests, digest drift, multiple RepoDigests, missing desired images, missing containers, missing RepoDigests, remote-unreachable precedence, skipped non-compose modules, and CLI JSON exit behavior.

Why it changed

Issue #771 asks for a CI-ready drift-check surface while keeping live checks read-only and converting stale Honcho drift evidence into fixture-based test data instead of a runtime assumption.

Files touched

control-plane/platformctl/cli.py
control-plane/platformctl/drift_check.py
control-plane/platformctl/tests/test_drift_check.py

Relevant context

Existing platformctl diff/plan observation code is reused for Docker inspect command construction and SSH transport.
Kimi red-team findings were applied to avoid treating missing containers as remote outages, to check all RepoDigests, and to keep exit-code precedence deterministic.

Runtime evidence

No live host mutation and no live SSH execution in this PR. Verification is mock-only plus CLI/help import checks.

Known constraints

This command observes Docker state over SSH and must remain read-only.
Manifest digest matching uses Docker RepoDigests. A container image ID alone is not treated as proof of a desired manifest digest; that returns partial state when RepoDigests are unavailable.
Tag-only desired image declarations are compared against the inspected container config image without registry resolution.

Explicit out-of-scope

No runtime restarts, deploys, compose writes, manifest edits, branch protection, or CI wiring.
No registry lookup or remote tag resolution.

Requested decision

Approve the narrow read-only CLI and mocked verification path.

Merge blockers

Any live mutation path in drift-check.
False OK on digest checks when RepoDigests cannot be observed.
Incorrect exit-code precedence for remote/partial/drift results.

Spec sources read

Issue #771 plan text from operator packet.
control-plane/platformctl/cli.py for command registration conventions.
control-plane/platformctl/plan.py for existing read-only observation helpers.
control-plane/platformctl/tests/ focused platformctl test conventions.

Verification

UV_CACHE_DIR=/Users/pd/Developer/platform/.uv-cache PYTHONPATH=control-plane uv run --project control-plane --extra dev pytest control-plane/platformctl/tests/test_drift_check.py -q -> 9 passed
UV_CACHE_DIR=/Users/pd/Developer/platform/.uv-cache PYTHONPATH=control-plane uv run --project control-plane --extra dev pytest control-plane/platformctl/tests -q -> 736 passed
git diff --check -> passed

Closes #771

Canary status: missing - fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Operators and future agents need a narrow, read-only way to compare module image declarations with live Docker observation without treating stale Honcho drift notes as live truth. ### What changed - Added `platformctl drift-check [module...] [--json]`. - Added deterministic JSON/human output with exit codes: `0` clean, `2` drift, `5` remote unreachable, `8` partial state. - Added mocked tests for matching digests, digest drift, multiple RepoDigests, missing desired images, missing containers, missing RepoDigests, remote-unreachable precedence, skipped non-compose modules, and CLI JSON exit behavior. ### Why it changed Issue #771 asks for a CI-ready drift-check surface while keeping live checks read-only and converting stale Honcho drift evidence into fixture-based test data instead of a runtime assumption. ### Files touched - `control-plane/platformctl/cli.py` - `control-plane/platformctl/drift_check.py` - `control-plane/platformctl/tests/test_drift_check.py` ### Relevant context - Existing `platformctl diff`/`plan` observation code is reused for Docker inspect command construction and SSH transport. - Kimi red-team findings were applied to avoid treating missing containers as remote outages, to check all RepoDigests, and to keep exit-code precedence deterministic. ### Runtime evidence No live host mutation and no live SSH execution in this PR. Verification is mock-only plus CLI/help import checks. ### Known constraints - This command observes Docker state over SSH and must remain read-only. - Manifest digest matching uses Docker RepoDigests. A container image ID alone is not treated as proof of a desired manifest digest; that returns partial state when RepoDigests are unavailable. - Tag-only desired image declarations are compared against the inspected container config image without registry resolution. ### Explicit out-of-scope - No runtime restarts, deploys, compose writes, manifest edits, branch protection, or CI wiring. - No registry lookup or remote tag resolution. ### Requested decision Approve the narrow read-only CLI and mocked verification path. ### Merge blockers - Any live mutation path in drift-check. - False OK on digest checks when RepoDigests cannot be observed. - Incorrect exit-code precedence for remote/partial/drift results. ## Spec sources read - Issue #771 plan text from operator packet. - `control-plane/platformctl/cli.py` for command registration conventions. - `control-plane/platformctl/plan.py` for existing read-only observation helpers. - `control-plane/platformctl/tests/` focused platformctl test conventions. ## Verification - `UV_CACHE_DIR=/Users/pd/Developer/platform/.uv-cache PYTHONPATH=control-plane uv run --project control-plane --extra dev pytest control-plane/platformctl/tests/test_drift_check.py -q` -> 9 passed - `UV_CACHE_DIR=/Users/pd/Developer/platform/.uv-cache PYTHONPATH=control-plane uv run --project control-plane --extra dev pytest control-plane/platformctl/tests -q` -> 736 passed - `git diff --check` -> passed Closes #771

codex added 1 commit

2026-06-10 23:37:07 +02:00

feat(platformctl): add read-only drift check

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 19s

Details

python-ci / Python 3.11 (pull_request) Successful in 40s

Details

python-ci / Python 3.13 (pull_request) Successful in 42s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 17s

Details

python-ci / Python 3.12 (pull_request) Successful in 44s

Details

canary-required / canary (pull_request) Successful in 17s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 20s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 4m20s

Details

d02e6c5df7

pdurlej merged commit 5338bb7e3b into main

2026-06-10 23:53:57 +02:00

pdurlej deleted branch codex/issues/771-drift-check

2026-06-10 23:53:57 +02:00

pdurlej referenced this pull request from a commit

2026-06-10 23:53:59 +02:00

Merge pull request 'feat(platformctl): add read-only drift check' (#781) from codex/issues/771-drift-check into main

patchwarden commented

2026-06-11 00:06:25 +02:00

First-time contributor

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 781
Commit: d02e6c5df70ce5a14766e3a68a1e223ad7154e9e
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: error
Verdict: -
Note: ReadTimeout: The read operation timed out
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `781` - Commit: `d02e6c5df70ce5a14766e3a68a1e223ad7154e9e` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `error` - Verdict: `-` - Note: ReadTimeout: The read operation timed out - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.