#2045 - fix(evidence): classify codeberg quota 413 as transport — defer, do not stall - sean/pipelines

sean commented

2026-08-14 18:35:19 +00:00

Owner

Per Sean: use in-cluster storage for now instead of codeberg; come back later. The mechanism already exists — the provenance signer keeps a durable MinIO evidence copy and defers the codeberg export on transport-class exhaustion, converged later by pipeline-evidence-export. The gap: HTTP 413 (quota full) was not in the transport class, so it hit the unclassified arm and hard-stalled all four trains instead of deferring.

413 joins 403|429|000|5?? in all seven arms across provenance, evidence-export, deployment-audit and promote-kernel; the guard anchors the new string. Full tests/check.sh: 130/130 green.

Note on landing: this fix rides the same train it unsticks. The live pipeline-provenance CWT gets a break-glass patch (documented separately) so the stalled v0.1.646 retry can defer; this PR then re-asserts the same content from git on the next release deploy.

Per Sean: use in-cluster storage for now instead of codeberg; come back later. The mechanism already exists — the provenance signer keeps a durable MinIO evidence copy and defers the codeberg export on transport-class exhaustion, converged later by pipeline-evidence-export. The gap: HTTP 413 (quota full) was not in the transport class, so it hit the unclassified arm and hard-stalled all four trains instead of deferring. 413 joins 403|429|000|5?? in all seven arms across provenance, evidence-export, deployment-audit and promote-kernel; the guard anchors the new string. Full tests/check.sh: 130/130 green. Note on landing: this fix rides the same train it unsticks. The live pipeline-provenance CWT gets a break-glass patch (documented separately) so the stalled v0.1.646 retry can defer; this PR then re-asserts the same content from git on the next release deploy.

sean added 1 commit

2026-08-14 18:35:19 +00:00

fix(evidence): classify codeberg quota 413 as transport — defer behind the durable copy, do not stall

pipeline/ci CI green @ 39100b51fae4

Details

39100b51fa

The 25 GiB codeberg packages quota filled on 2026-08-14. Every package
PUT returned HTTP 413, which fell into the unclassified arm of put_once,
so all four release trains hard-stalled at provenance — even though the
durable in-cluster evidence copy (MinIO pkg/evidence) plus the deferred
evidence-export executor exist for exactly this failure shape.

413 joins 403/429/000/5xx as the transport class in all seven arms
across the four codeberg publishers (provenance, evidence-export,
deployment-audit, promote-kernel). With DURABLE=1 the provenance signer
now defers the codeberg export and the release proceeds Deployable;
the exporter converges the offsite copy when the quota clears.

tests/codeberg-registry-retry.sh anchors the new class string.

pipeline-bot merged commit 39100b51fa into trunk

2026-08-14 19:30:19 +00:00

Rows
Columns

fix(evidence): classify codeberg quota 413 as transport — defer, do not stall #2045