fix(forge): make the chain's first-run and recovery checks tell the truth #764
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/forge-chain-drill"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
What
Follow-up to #762 from the first live run of the chain.
sean/forge-drillhas no cluster origin, so Binjovi's hop-2 mirror create fails closed (denied) at boot and heals 30 min later. The drill now asks Binjovi to create it at once (binjovictl service create forgejo/packettown/forge-drill/mirrors/kript --expected-revision N— measured: mirror present one second later) when the CLI has theserviceverb, otherwise waits for the heal (MIRROR_WAITdefault 2400 s). Binjovi still writes the mirror; the drill never does.trunk, the mirror pushesmain, Forgejo moves its DB default tomain, and the on-disk HEAD still saystrunk— a plain clone checked out nothing. Drill:--branch main; guard:origin/main^{tree}before HEAD.Verified
make forge-restore-drill: DRILL PASSED — retention, deliverycode.packet.town -> code.kri.ptin ~13 s through Binjovi's mirror, destroy + restore fromrpool/forge/data@auto-…with identical refs, cleanfsck, canary byte-for-byte from a clone of the snapshot path, Forgejo serving the restored repository; RTO 1 s.make test-forge-packet-town,make test-forge-kri-pt: PASS.bash tests/check.sh:CHECK EXIT=0(109 guards).https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6
Three things the first live run of the chain taught, all measured today. 1. The drill's standing lane, sean/forge-drill, has no cluster origin, so its hop-2 mirror is declared by Binjovi at boot before the packet.town repository exists. That create fails closed (`denied`) and Binjovi heals it thirty minutes later. The drill waited 600 s and gave up. Now it asks Binjovi to create the mirror at once when a binjovictl with the `service` verb is present (`binjovictl service create forgejo/packettown/forge-drill/mirrors/kript --expected-revision N`; measured: the mirror existed one second later), and otherwise waits long enough for the heal (MIRROR_WAIT default 2400 s). Nothing in the drill writes a mirror itself; Binjovi still does. 2. A bare repository's HEAD is Forgejo metadata. Binjovi creates destination repositories with default branch `trunk`, the mirror pushes `main`, Forgejo moves its database default to `main`, and the on-disk HEAD still says `trunk`. A plain clone from the snapshot path therefore checked out nothing and the drill reported CANARY='nothing'. The drill clones `--branch main`; the guard verifies `origin/main^{tree}` before HEAD. 3. A repository that arrived after the newest hourly snapshot is not in it yet. The guard reported that as "recovery without Forgejo does not work". It now names the snapshot and says not-yet-covered, and fails only when a repository OLDER than the newest snapshot is missing from it. Measured and recorded in the README: 9-13 s delivery through both Binjovi-configured hops, 1 s to restore one repository from the snapshot path, Argo CD's refusal to auto-sync a failed revision (fixed in binjovi v0.1.741), the denied-then-heal behaviour of a push-mirror create whose source is absent, and a freshly minted token being refused on first use. The drill passes end to end; both guards pass; tests/check.sh is green. Claude-Session: https://claude.ai/code/session_01XdBRc9CHgFhAxCyHbdVtt6