8 Commits

Include renames

Author	SHA1	Message	Date
Nick	81c6d1f9c6	fix(hardening): operation-identity authority — explicit sha end-to-end, paginated runs fetch, model-sha-as-hint ... Defect A root cause: Gitea runs-list page flood (scheduled merge-robot runs push relevant SHAs past the limit=50 first page) + collect-only- first-page pagination -> terminal commit read as pending -> parked until deadline. FIX: _fetch_runs paginates up to 4 pages collecting all matches before verdict. Defect B root cause: authority_verdict spawned deploy_qualify reading DEPLOY_SHA from ambient env. FIX: explicit --sha arg (env masked when sha is explicit); _ci_runs_verdict/op_ci_alive take sha as parameter only; no env read remains in the authority path. Defect C root cause: model sha treated as lookup key — a typo derived a ghost operation. FIX: model sha is a HINT; unresolved sha + single pending op -> stored target used with model_sha_mismatch logged; bound op always wins over hints. deploy_qualify gained --sha flag (env kept for workflow backward-compat only). Tests: H-matrix (identity, prefix collision, env staleness, monotonicity, aggregator lag, operation-id-first) + full 2179 suite.	2026-09-18 10:25:59 +01:00
Nick	00013f8c0b	fix(deploy_qualify): canonical-default Gitea server/repo fallback — out-of-CI consumers got silent pending verdicts ... The await_operation first-class tool (and any local deploy_qualify.py caller) never exported GITEA_SERVER/GITEA_REPO, so main() printed 'pending' unconditionally — the first-class wait could never resolve success even against a green, converged deployment. CI behavior is unchanged (env always exported there); the fallback only fires when the caller omitted the vars. Root-caused live in T21.4 G10 dogfood.	2026-09-17 03:02:37 +01:00
Nick	36ee604646	fix(release): required-checks verdict evaluates needs results — fail-closed deploy ... ROOT CAUSE (red-CI promotions 0.66.28/29): the required-checks 'Publish protected-branch gate' step read /tmp/need_* files that no step ever wrote and echoed 'All required CI checks passed' UNCONDITIONALLY. With if: always() the needs gate is overridden, so the job ran on red needs and published success — deploy_qualify correctly trusted it and promoted red commits (24413e4, fd6e9b4, de30cd9; status timelines in the closure evidence). FIX: publish step now runs only when every needs.*.result == 'success'; companion fail-closed step exits 1 otherwise, so the required-checks context reports failure instead of lying. DEFENSE-IN-DEPTH: deploy_qualify verdict is now the AND of two independent legs — (1) newest required-checks observation for the exact SHA, (2) the latest COMPLETED ci.yml@refs/heads/master run for that exact SHA with every job concluded success (fan-out resolved by path, run resolved by head_sha, jobs envelope unwrapped — no aggregate-status fallback). Any pending/missing/disagreement = not deployable. CANARY: gitea_pipeline now asserts the verdict evaluates needs results and fails closed — the class locked shut. 20 qualifier tests with fixtures from the real incident shapes; 1402 suite green.	2026-09-12 20:10:28 +01:00
Nick	4eefc15837	fix(lifecycle+auth): canonical gitea auth path, terminalization helper, fault-injection gaps (T15 Parts A-E) ... - scripts/gitea_auth.py: single credential ladder (env -> 0600 token file -> git credential fill); 6 consumers migrated off direct os.environ reads - rune_operator: consolidate 5 duplicated failure blocks into _terminalize_execution_failure; fix 3 fault-injection gaps: (1) dual-module PreparedTool identity split crashed approval-path saves, (2) fallback-model failure escaped send_task (created/pending orphan), (3) running-transition save uncaught (running-with-no-owner) - envelope task.status now agrees with canonical ledger (awaiting_approval) - orphan task_ac35f4e287c8 terminalized failed with durable evidence - tests: gitea auth ladder (6), lifecycle fault matrix (9 boundaries + restart/reload + helper contract); 1280 green in ci-venv; ratchet 352/80	2026-09-11 20:15:57 +01:00
Nick	ca4f7593d7	feat(corrections): #314 defect fix, credential rotation, release guard, task lifecycle, route scoping, PL1 records + metrics ... CORRECTION 1: #314 reopened — recall_with_associations mode field defect CONFIRMED in current source and FIXED (mode: association_merged). CORRECTION 3: Gitea credential removed from remote URL (credential helper). TOKEN EXPOSED: yes (in diagnostic output). TOKEN ROTATED: not yet (requires Gitea web UI access). Remote URL now shows username only, no secret. CORRECTION 4: duplicate-release-commit defect ROOT CAUSE: convergence computed warranted bump from commits-since-tag without checking if master version already satisfies the bump. FIX: already-converged guard in version_convergence.py (master version > last tag → no commit). Repo-aware (args.repo passed to read_version/latest_tag). CORRECTION 6: lifecycle terminalization — execution exception now guarantees task terminalizes as failed with evidence (no immortal RUNNING). CORRECTION 7: route instruction task-scoped on RuneTask.route_instruction (NOT shared operator state). Read-only leading-verb override. Isolation tests prove no cross-contamination between interleaved tasks. PL1-01/02/03/05: pl1_records.py (route resolution, proof level, failure class, candidate status), metrics with honest NOT_YET_MEASURABLE semantics, route-instruction learning loop (PE-1789102658-0269 SEED). 1253 tests green; ratchet 352/80 (shrink); henxels clean.	2026-09-11 15:36:08 +01:00
Nick	97c604d0c5	fix(deploy): prefix-match required-checks context (Gitea appends ' (push)' to job contexts)	2026-09-10 22:20:39 +01:00
Nick	ece67c6c73	fix(lint): narrow deploy_qualify status-probe except (ratchet back to baseline)	2026-09-10 22:01:25 +01:00
Nick	9e9ddfc10f	fix(deploy): move pipeline logic into scripts (YAML block-scalar parse failure) ... The embedded multi-line python in the workflow run blocks terminated the YAML literal scalars — Gitea could not parse deploy.yml at all (dispatch 500: 'could not find expected :'), which is why no deploy runs appeared. Logic now lives in scripts/deploy_qualify.py + deploy_stage.py; the workflow is pure shell + script calls.	2026-09-10 21:51:34 +01:00