release-train: staging -> main - #1011
Merged
Merged
Conversation
) Seven unbounded 'k3d cluster list' calls hung the installer on a wedged Docker daemon (client#974). All bounded, with a three-state contract: 2 = UNKNOWN means every probe's READ failed, and _read_ok means 'a read answered THE QUESTION' — deliberately NOT a boolean 'does the cluster exist', because there was one and re-adding it is how this bug returns. Six rounds of review, and the findings that shaped it are worth recording: - UNKNOWN takes the REUSE path, never the create path: _create_new_cluster runs 'k3d cluster create' against a name that may already be in use, on a machine we could not read. Explicit case, not 'if _cluster_exists', so the third outcome is visible at the decision site instead of hidden inside a boolean. - '1)' not '*)': creating was the DEFAULT arm, so any value the contract grows next would land on the one branch that runs create against a machine nobody classified — the destructive direction, reached by default. - rc 3 handled at the THIRD call site, inside _create_new_cluster's 'already exists' recovery, under set -e. It names the actual cause (leftovers holding the name) with the remedy, rather than retrying a create that would refuse forever. - _handle_existing_cluster's row check gained the type == "array" gate it was missing — two functions reading one payload where only one had the guard, in the destructive direction. Closes client#974
…ts (#1005) * docs(199): record egress seal sealed+probe-verified on dev/staging/prod (client-runtime#199) SECURITY §8.2 and SEAL-CHECK EKS section said the per-fleet enforcement was held/pending; the dev/staging/prod tracebloc template fleets are now sealed and egress-enforcement-probe-verified (2026-09-08). Records the runs, the v1.1.6/v1.2.7 CNI substrate on both clusters, and the #416 image-pin durability note. No chart content changed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(199): fix §5.1 stale fleet attribution — staging is on tracebloc-clients-prod (client-runtime#199) @saadqbal: §5.1 still read tb-client-dev-templates (dev/staging) / tracebloc-clients-prod (prod), contradicting §8.2 (and SEAL-CHECK.md) where staging + prod both sit on tracebloc-clients-prod. Since §5.1 is the silent-no-enforcement-risk section, the wrong cluster for staging is the one wrong answer it exists to prevent. Now: tb-client-dev-templates (dev), tracebloc-clients-prod (staging + prod). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(199): fold in @aptracebloc review nits — changelog, task labels, cluster referent (client-runtime#199) - SECURITY.md §11: add the 2026-09-08 seal-milestone entry (changelog was trailing §8.2) - SEAL-CHECK.md fleet table: label staging/prod runs image_classification like the dev row - SEAL-CHECK.md image-durability note: "On this cluster" -> "On each cluster" (spans two now) (§5.1 attribution already corrected in c0ac887, addressing both reviewers.) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Syed Saqlain <syedsaqlain@MacBook-Pro.local> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Syed <saqlain@tracebloc.io>
…(backend#3384) (#1007) * fix(e2e): seed auto-upgrade path-1 baseline as explicitly un-rotated (backend#3384) The Fleet auto-upgrade E2E (k3d) gate red-fails on its own precondition: after the baseline `helm install` of the last published chart, it asserts the rendered Secret carries no MYSQL_ROOT_PASSWORD (the un-rotated starting state path 1 needs to exercise the backend#2879 rotateMysqlRoot guard). That assumption is now false by design: rotateMysqlRootByEnv defaults prod=true (epic backend#947), an unset CLIENT_ENV resolves to prod, so a fresh install is born rotated and mints MYSQL_ROOT_PASSWORD. The chart is correct; the test's baseline assumption is stale. Seed the un-rotated baseline explicitly with --set rotateMysqlRoot=false (the operator override wins over the ByEnv default) on the baseline install and the --reset-values isolate step that re-establishes it before the precondition. Path 5's --reset-values is deliberately left un-flagged (bakedRootRotationOn gates the default off on the existing un-rotated datadir); the born-rotated paths from the ack step onward are untouched. Validated on a live k3d cluster: fresh install with the flag renders no MYSQL_ROOT_PASSWORD, the precondition holds, the guard still refuses naming its runbook, and the acknowledged upgrade still mints (born-rotated paths intact). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(e2e): scope the isolate-reset rotate override note to paths 2-4 (backend#3384) The re-set rotateMysqlRoot=false only deterministically reaches paths 2-4 (they inherit it via --reset-then-reuse-values); path 5 --reset-values discards it and relies on the bakedRootRotationOn gate, as its own NOTE states. Fix the contradictory "paths 2-5" wording (Saqlain review). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
release-train: develop -> staging
…-wide (#1006) * sec(947): bake narrowEdgeuser for stg + prod — edgeuser retired fleet-wide (backend#947) Flips narrowEdgeuserByEnv.{stg,prod} false->true, the LAST step of the backend#1528 edgeuser retirement. Safe now because the consumer migration off edgeuser is verified LIVE on both stg and prod (chart 1.9.107): jobs-manager reads tb_meta (metadata) + tb_ingest (datasets), the account mint runs as root (DB_BOOTSTRAP_USER=root), ingestion Jobs get DB_USER=tb_ingest injected, and requests-proxy uses tb_meta -- nothing authenticates as edgeuser. narrowEdgeuser REVOKEs edgeuser to USAGE on every jobs-manager boot so a reinstall cannot re-grant it; the baked default stays conditional on all three predecessors, so a single-gate step-back declines silently instead of wedging, and assertNarrowEdgeuserIsSafe still fail-closes an explicit misuse. This is the last asymmetric gate: all five *ByEnv gates now ship true for every env. - values.schema.json / _helpers.tpl: narrow prose updated to all-true (else the gate-default-prose-agreement guard reddens). - gate-default-prose-mutations.sh: the LIST-form cases flip from on-polarity over-claims (no gate ships false to over-claim anymore) to the OFF-polarity direction that stale docs can now drift into; comment explains the flip. - edgeuser_narrowing_test.yaml: prod/stg now narrow by default; one case repurposed to the still-reddenable negative (narrow declines when a predecessor is off). helm unittest 695/40, make drift 46/46, shellcheck clean. Promotion gate: the prod flip needs the S0 `SHOW GRANTS FOR edgeuser` snapshot captured as the rollback reference; the train staging soak exercises stg narrowing first. Image edgeuser-literal removal + DROP USER follow this. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * test(947): keep the ON-polarity prose gate exercised via a fixture-patched false leaf (backend#947) The rollout baking narrowEdgeuserByEnv.{stg,prod} true left every real *ByEnv gate shipping true, so no fixture could construct an ON-polarity over-claim against a real gate and the TRUE_CLAIMS branch of the guard went unexercised -- deleting those patterns would leave the suite green (@saadqbal / @cursor Bugbot). Add case (a-on): patch the FIXTURE's OWN values.yaml to flip narrowEdgeuserByEnv.{stg,prod} back to false, so a doc claiming true for stg/prod is a genuine over-claim that reddens PERMANENTLY -- no dependency on any real gate still shipping false, ending the "repoint at the next off gate" treadmill. Proven to have teeth: disarming TRUE_CLAIMS fails this case and only this case. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Syed Saqlain <syedsaqlain@MacBook-Pro.local> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: Syed <saqlain@tracebloc.io>
release-train: develop -> staging
Contributor
Author
|
bugbot run |
tracebloc-release-train
Bot
added
the
gate-nudge
…rkflows on PRs, remove a dead installer prerequisite (#1014) - installer-tests.yaml: delete job `unit-bash` (`bats (bash unit, mocked)`). It was a byte-for-byte twin of the REQUIRED `Unit tests` job in standard-checks.yml (same checkout/setup-helm pins, same bounded bats install, same `bats scripts/tests/*.bats`), not itself a required context, and cost 320-388 s on every scripts/** push. Nothing `needs:` it. - e2e-auth-proxy.yaml, e2e-mysql.yaml: give `pull_request` the same `paths:` filter `push` already has. Safe only because neither context is required on any branch (a paths filter on a REQUIRED context hangs every PR outside the filter); each header now states the arming pre-condition (delete the filter + add `edited` in the same PR that makes the check required). - setup-linux.sh: stop installing conntrack / conntrack-tools. Installed on every Linux host since the first k3d-based installer and invoked by nothing -- the cluster is k3s inside k3d and the k3s image ships its own. distro-prereqs.sh no longer asserts it; setup-linux.bats swaps the three package-name tests for two negative tests (mutation-proven: re-adding the line reddens both). scripts/manifest.sha256 regenerated. - Remove the non-existent `openshift` branch from the `branches:` filters of seven workflows (the branch 404s; the branch list has no such name). Verified: actionlint on the 7 workflows, shellcheck -S error + bash -n on the two scripts, full bats suite, `make drift` (46/46 green, manifest check included), `helm lint client/` unchanged. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
… (backend#3384) (#1015) Saqlain review, both non-blocking: - Assert no MYSQL_ROOT_PASSWORD right after the baseline install, so a future published $PREV that born-rotates the baseline fails at its source instead of downstream as the generic backend#2879 precondition. - Hoist secret_key to the top helpers and factor the flag into a shared ROOT_ROT_OFF array used by the baseline install and the isolate reset; path 5 documents its deliberate omission against the named array. Live-validated on k3d: array-expanded install accepted, early assertion holds. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
release-train: develop -> staging
release-train: develop -> staging
tracebloc-release-train
Bot
removed
the
gate-nudge
Contributor
Author
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 929fdbf. Configure here.
tracebloc-release-train
Bot
added
gate-nudge
Contributor
Author
|
Promoted with 1 open Medium/Low Bugbot finding(s), per the severity policy in release-train's README (High stops the line; Medium/Low are recorded and ship, at both hops): Timeout skips cluster autostart setup This is a third look at twice-reviewed code -- it passed per-feature review and functional review on the source branch before the promotion. Fix forward on What the train did with each:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated promotion by the release train (RFC-0008 D14). Head is the train-managed
release-train/to-mainbranch (a mirror ofstaging), so it never collides with a human PR. Merged only when the fr-gate is green.Note
High Risk
Installer tri-state and diagnose behavior changes affect cluster create/reuse and assess messaging on wedged Docker; chart defaults now narrow MySQL edgeuser on stg/prod fresh installs.
Overview
Release train promotion bundling installer hardening, Helm default changes, CI scoping, and documentation updates.
The bash installer now bounds Docker and
k3d cluster listreads and treats cluster presence as tri-state (_cluster_presencereplaces_cluster_exists). Callers incluster.sh,assess.sh, anddiagnose.shdistinguish present / absent / unknown so timeouts are not treated as “no cluster” (avoiding destructive prompts or wrong first-time install messaging)._bounded_captureand_bounded_capture_readsupport macOS-safe captured reads;check-style.shwidens daemon-read gates and adds census rules fork3d cluster list. Linux prereqs drop hostconntrackinstall. BUGBOT.md documents the bounded-read contract.Helm chart 1.9.108 turns on
narrowEdgeuserByEnvfor stg and prod (edgeuser narrowing by default where posture is verified, backend#947), with matching unit tests and schema copy.CI/workflows: remove
openshiftbranch triggers; addpathsfilters onpull_requestfor standalone e2e workflows (with arming notes for required checks); remove duplicateunit-bashfrominstaller-tests.yaml(bats only in requiredstandard-checks).Docs record EKS template fleets as sealed and egress-probe-verified (2026-09-08, client-runtime#199).
Reviewed by Cursor Bugbot for commit 929fdbf. Bugbot is set up for automated code reviews on this repo. Configure here.