fix(operator): an automatic Environment records its own canary decision

sean commented

2026-08-15 22:25:24 +00:00

Owner

The operator submitted autoApprove=true for an automatic Environment while validate-request refused that value for every real roll (observed live on the seanfarm-master seanfarm33 deploy), and nothing ever recorded a canary decision in automatic mode — the gate would hold until budget expiry. The gate stays mandatory, decision-recorded, read-only-RBAC; what changes is who records the decision: the operator now records an Environment-attributed automatic canary decision when it observes the run holding at the gate. Manual environments still wait for a human. Red-green envtest + updated canary-gate contract.

sean added 1 commit

2026-08-15 22:25:24 +00:00

fix(operator): an automatic Environment records its own canary decision

pipeline/ci CI green @ 955ac59bded8

Details

955ac59bde

The kernel roll's two halves disagreed. The operator submitted
autoApprove=true for an automatic Environment, while the template's
validate-request refused exactly that value for every real roll —
observed live on linux-deploy-6.18.44-seanfarm33-seanfarm-master-git1
after kernel-production flipped to automatic. Even without that
refusal, nothing ever recorded a canary decision in automatic mode,
so the gate would hold until its budget expired. Automatic mode could
never finish a real kernel roll.

The gate itself does not change: it is mandatory for every real
fleet, it releases only on a decision recorded on the PipelineDeploy,
and the executor's RBAC stays read-only. What changes is who records
the decision. When the operator observes a run holding at the canary
gate and the Target's Environment declares automatic, it records an
approved decision attributed to that Environment
(policyRef environment:<name>, the CEL rule on DeploymentDecision
enforces the attribution). A manual Environment still waits for a
human PipelineApproval. A failed Environment lookup records nothing,
so a read error can never widen into an approval.

validate-request drops the stale refusal; autoApprove is now inert
and documented as such. The canary-gate contract asserts the new
invariant: no caller parameter can release or refuse the gate.

Proven red-green in envtest: automatic gets exactly one attributed
decision (idempotent across reconciles), manual gets none.

pipeline-bot merged commit 955ac59bde into trunk

2026-08-15 22:28:15 +00:00

Rows
Columns

fix(operator): an automatic Environment records its own canary decision #2056