sean/platform-seanfarm
Watch
1
0
Fork
You've already forked platform-seanfarm
 0
Code Issues Pull requests 1 Projects Releases 177 Packages Wiki Activity

cleanup(ci): delete the vacuous acme-approval guard #665

Merged
sean merged 1 commit from fix/retire-vacuous-acme-guard into trunk 2026-08-07 12:44:33 +00:00
Conversation 0 Commits 1 Files changed 2 +12 -67
sean commented 2026-08-07 12:14:35 +00:00
Owner
Copy link

tests/check-acme-approval.sh scanned find apis instances -name '*.yaml' for Stack.spec.tls.acmeServer. c4d0136 deleted its entire scan target — apis/stack/, instances/alice.yaml, instances/bob.yaml. apis/ now holds only platform, and there is no cert-manager / ClusterIssuer / issuerRef / acme content anywhere under apis/+instances/.

So on every CI run since c4d0136 it printed:

$ bash tests/check-acme-approval.sh
  ok: 0 LE-prod value line(s) all carry an approval marker (staging needs none)
$ echo $?
0

A green report from a control that had verified nothing. Its scope comment (:21-25) still cited all three deleted paths as live.

Why delete rather than re-point or floor it

It is an inclusion guard ("every prod URL carries a marker"), and zero ACME lines is now the CORRECT state for this repo. Adding the house non-vacuity floor would make it permanently red. A guard whose only honest configuration is "pass on zero" is not a guard.

For an inclusion invariant, zero matches means "I did not verify what I claim to verify" — the bug class. For an exclusion invariant, zero matches is the assertion. This is an inclusion guard with an empty domain: the degenerate case.

Rejected: re-pointing it at sean/pipelines (a guard cannot scan another repo's working tree in CI, and two guards over one knob drift — the stale one being the dangerous one); rewriting it as an exclusion guard (defensible, but scope escalation into a repo down to one XRD and on a retirement path, guarding a regression nobody has proposed).

Coverage does not move

The live knob is sean/pipelines bundle/dns/issuer.yaml (proved from the live object, not grep: ClusterIssuer/letsencrypt carries argocd.argoproj.io/tracking-id: dns:..., i.e. ArgoCD Application dns = bundle/dns). It is guarded by that repo's own tests/check-acme-approval.sh, which does carry the floor, and which is now proved falsifiable by a companion PR: sean/pipelines#1985, 8/8 mutations caught against 5/5 mutations of the guard itself. Nothing this file was catching goes unguarded, because it was catching nothing.

tests/check.sh keeps a comment pointing at the real guard, so the signpost this file carried is not lost.

The lockstep edit, and why it is in the same commit

tests/check.sh:15 hardcoded the filename. bash "$guard" on a missing file exits 127 — neither 0 nor 2 — so overall=1 and the whole platform suite goes red. Verified both ways:

### file deleted, registration list NOT edited
-----------------------------------------
FAIL: a platform-seanfarm guard failed
EXIT=1

### both edits (the committed state)
[check-composition-fmt-args]
  ok: 12 string-combine patch(es) have verb/arg parity (JSON targets render-parsed)
[check-xrd-required]
  ok: 0 XRD required entr(ies) all present in their sibling properties
[check-native-pr-policy]
  ok: all canonical repositories use rebase-update + fast-forward-only native PR policy
[check-argo-v4]
OK: no embedded CronWorkflows found (search verified against ForgejoRepository)
[check-url-credentials]
  ok: no credential is interpolated into a URL
-----------------------------------------
OK: all runnable platform-seanfarm guards passed
EXIT=0

Blast radius

The only three references to the guard in the repo were CHANGELOG.md, tests/check.sh and the file itself. CHANGELOG is deliberately untouched — append-only history; those entries were true when written.

No ACME server is changed. LE-prod is approved and live.

Noticed in passing, NOT fixed here

check-xrd-required prints ok: 0 XRD required entr(ies) — same vacuous-pass shape, different guard. Out of scope; flagged for a follow-up.

`tests/check-acme-approval.sh` scanned `find apis instances -name '*.yaml'` for `Stack.spec.tls.acmeServer`. **c4d0136 deleted its entire scan target** — `apis/stack/`, `instances/alice.yaml`, `instances/bob.yaml`. `apis/` now holds only `platform`, and there is no cert-manager / ClusterIssuer / issuerRef / acme content anywhere under `apis/`+`instances/`. So on every CI run since c4d0136 it printed: ``` $ bash tests/check-acme-approval.sh ok: 0 LE-prod value line(s) all carry an approval marker (staging needs none) $ echo $? 0 ``` A green report from a control that had verified nothing. Its scope comment (`:21-25`) still cited all three deleted paths as live. ## Why delete rather than re-point or floor it It is an **inclusion** guard ("every prod URL carries a marker"), and **zero ACME lines is now the CORRECT state for this repo**. Adding the house non-vacuity floor would make it permanently red. A guard whose only honest configuration is "pass on zero" is not a guard. For an inclusion invariant, zero matches means *"I did not verify what I claim to verify"* — the bug class. For an exclusion invariant, zero matches *is* the assertion. This is an inclusion guard with an empty domain: the degenerate case. **Rejected:** re-pointing it at `sean/pipelines` (a guard cannot scan another repo's working tree in CI, and two guards over one knob drift — the stale one being the dangerous one); rewriting it as an exclusion guard (defensible, but scope escalation into a repo down to one XRD and on a retirement path, guarding a regression nobody has proposed). ## Coverage does not move The live knob is `sean/pipelines bundle/dns/issuer.yaml` (proved from the live object, not grep: `ClusterIssuer/letsencrypt` carries `argocd.argoproj.io/tracking-id: dns:...`, i.e. ArgoCD Application `dns` = `bundle/dns`). It is guarded by that repo's own `tests/check-acme-approval.sh`, which **does** carry the floor, and which is now proved falsifiable by a companion PR: `sean/pipelines#1985`, 8/8 mutations caught against 5/5 mutations of the guard itself. Nothing this file was catching goes unguarded, because it was catching nothing. `tests/check.sh` keeps a comment pointing at the real guard, so the signpost this file carried is not lost. ## The lockstep edit, and why it is in the same commit `tests/check.sh:15` hardcoded the filename. `bash "$guard"` on a missing file exits **127** — neither 0 nor 2 — so `overall=1` and the whole platform suite goes red. Verified both ways: ``` ### file deleted, registration list NOT edited ----------------------------------------- FAIL: a platform-seanfarm guard failed EXIT=1 ### both edits (the committed state) [check-composition-fmt-args] ok: 12 string-combine patch(es) have verb/arg parity (JSON targets render-parsed) [check-xrd-required] ok: 0 XRD required entr(ies) all present in their sibling properties [check-native-pr-policy] ok: all canonical repositories use rebase-update + fast-forward-only native PR policy [check-argo-v4] OK: no embedded CronWorkflows found (search verified against ForgejoRepository) [check-url-credentials] ok: no credential is interpolated into a URL ----------------------------------------- OK: all runnable platform-seanfarm guards passed EXIT=0 ``` ## Blast radius The only three references to the guard in the repo were `CHANGELOG.md`, `tests/check.sh` and the file itself. CHANGELOG is deliberately untouched — append-only history; those entries were true when written. **No ACME server is changed. LE-prod is approved and live.** ## Noticed in passing, NOT fixed here `check-xrd-required` prints `ok: 0 XRD required entr(ies)` — same vacuous-pass shape, different guard. Out of scope; flagged for a follow-up.
cleanup(ci): delete the vacuous acme-approval guard
All checks were successful
pipeline/ci CI green @ 769a995d555c
Details
769a995d55
 
tests/check-acme-approval.sh scanned `find apis instances -name '*.yaml'` for
`Stack.spec.tls.acmeServer`. c4d0136 deleted `apis/stack/`, `instances/alice.yaml`
and `instances/bob.yaml` — its entire scan target. There is now no cert-manager,
ClusterIssuer, issuerRef or acme content anywhere under apis/+instances/, so the
guard matched zero lines and printed

  ok: 0 LE-prod value line(s) all carry an approval marker (staging needs none)

exiting 0 on every CI run: a green report from a control that had verified
nothing since c4d0136. Its scope comment still cited all three deleted paths as
live.

It cannot be repaired in place. It is an INCLUSION guard ("every prod URL carries
a marker"), and zero ACME lines is now the CORRECT state for this repo, so the
house non-vacuity floor would be permanently red. A guard whose only honest
configuration is "pass on zero" is not a guard.

Re-pointing it at sean/pipelines was rejected: a guard cannot scan another repo's
working tree in CI, and two guards over one knob drift — the stale one being the
dangerous one. The LIVE knob is `sean/pipelines bundle/dns/issuer.yaml`, guarded
by that repo's own tests/check-acme-approval.sh, which DOES carry the floor and is
now proved falsifiable by tests/check-acme-approval-contract.sh (8/8 mutations).
tests/check.sh keeps a comment pointing there so the signpost this file carried is
not lost.

De-registering it from tests/check.sh:15 is in the SAME commit by necessity, not
tidiness: `bash "$guard"` on a missing file exits 127, which is neither 0 nor 2,
so `overall=1` turns the whole platform suite red. Verified both ways — deleted +
list untouched: "FAIL: a platform-seanfarm guard failed", exit 1; both edits:
"OK: all runnable platform-seanfarm guards passed", exit 0.

No ACME server is changed. LE-prod is approved and live.
sean merged commit 769a995d55 into trunk 2026-08-07 12:44:33 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
sean/platform-seanfarm!665
No description provided.