sean/pipelines
Watch
1
0
Fork
You've already forked pipelines
 0
Code Issues Pull requests Projects Releases 758 Packages Wiki Activity

fix(release): delete a retryably-Failed evidence exporter so the deferred export can converge #2047

Merged
pipeline-bot merged 1 commit from fix/export-retry-adoption into trunk 2026-08-14 19:44:22 +00:00
Conversation 0 Commits 1 Files changed 3 +44 -6
sean commented 2026-08-14 19:41:17 +00:00
Owner
Copy link

The signer adoption wedge, one obligation later: reconcileEvidenceExport released the latched name on Failed, but the Failed workflow kept its deterministic name and the paced resubmission ADOPTED it. All six deferred evidence exports are frozen this way live right now — without this, tonight's quota GC clears and nothing converges.

Fix mirrors PR #2046: delete the aged Failed exporter (finishedAt older than evidenceRetryDelay, via argoengine.Times) before releasing the name; a fresh failure stays latched until the delay passes. The envtest used to perform the manual unwedge itself (k8sClient.Delete before recovery) — it now proves the operator needs no hand. DOMAIN-MODEL durable-evidence caveat updated to the true split (release export self-heals; deployment audit manual-by-design).

130/130 guards, full controller suite green. Once deployed, the operator un-freezes the six wedged exports on its own.

The signer adoption wedge, one obligation later: reconcileEvidenceExport released the latched name on Failed, but the Failed workflow kept its deterministic name and the paced resubmission ADOPTED it. All six deferred evidence exports are frozen this way live right now — without this, tonight's quota GC clears and nothing converges. Fix mirrors PR #2046: delete the aged Failed exporter (finishedAt older than evidenceRetryDelay, via argoengine.Times) before releasing the name; a fresh failure stays latched until the delay passes. The envtest used to perform the manual unwedge itself (k8sClient.Delete before recovery) — it now proves the operator needs no hand. DOMAIN-MODEL durable-evidence caveat updated to the true split (release export self-heals; deployment audit manual-by-design). 130/130 guards, full controller suite green. Once deployed, the operator un-freezes the six wedged exports on its own.
Same adoption wedge as the provenance signer, one obligation later: on
a Failed exporter the operator released the latched name, but the Failed
workflow kept its deterministic name, so the paced resubmission adopted
it and re-latched the failure. All six releases with deferred evidence
froze exactly here on 2026-08-14 — the codeberg convergence could never
happen without a manual delete.

Now an aged Failed exporter (finished more than evidenceRetryDelay ago,
via argoengine.Times) is deleted before the name is released, so the
next pass submits a genuinely fresh exporter. A freshly-Failed one stays
latched until the delay passes — the delay is the pace.

The envtest previously performed the manual unwedge itself
(k8sClient.Delete on the Failed exporter before the recovery episode),
which is how the adoption wedge hid. It now proves the operator deletes
the aged exporter, that a fresh failure is paced, and that recovery
needs no hand.

DOMAIN-MODEL.md: the 'export is not recoverable' caveat is replaced with
the true split — release evidence export self-heals; the Deployment
audit stays manual-by-design.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/pipelines!2047
No description provided.