2 Commits

Include renames

Author	SHA1	Message	Date
sysadminandClaude Opus 5	824c42f7e3	fix(drain): fail closed on missing or unproven acknowledgement evidence (#661) ... The acks_or_timeout check treated an absent `acks` key as proof that no session needed to acknowledge: `drain_state.get("acks") or {}` collapsed absent, None, and empty into the same value, and the resulting empty mapping satisfied `no_sessions_to_ack`. The impact report's counts.sessions_live_other was never consulted, so absence of evidence was read as evidence of absence. Reproduced at head 1cbbde0089: with sessions_live_other = 3 and the acknowledgement key absent, acks_or_timeout passed with detail "no other live sessions required to acknowledge", the proof minted clean, and gate_apply_restart returned verdict allow — a restart authorized against three live sessions with zero acknowledgement evidence, and the resulting artifact carried a valid signature. Whether acknowledgement is required is now derived from the impact report, never from the shape of the drain state: - _live_session_count() reads counts.sessions_live_other and returns None for a missing, malformed, negative, or bool value, so an unreadable report fails closed instead of reading as "nobody was live". - Absent, None, non-mapping, empty, partially-covering, and unparseable or stale acknowledgement data all fail closed while live sessions require acknowledgement. - _is_acknowledged() no longer coerces with str(); only an explicit "ack"/"acked"/"acknowledged" string counts, so None, timestamps, and "pending"/"stale" markers are never read as an acknowledgement. - Present-but-unacknowledged entries fail closed even when the report claims zero live sessions: that contradiction is not safe to resolve in favour of the restart. - ack_timeout_policy_applied stays strict (`value is True`), so an absent, null, or non-boolean value cannot open the gate on its own. The genuine no-other-live-sessions case still passes, now justified by the report proving sessions_live_other == 0 rather than by the absence of data. Adds AcknowledgementFailClosedTests: 14 cases / 26 subtests covering missing, null, empty, malformed, stale, partial-coverage, and unproven-count inputs, the valid-acknowledgement and zero-live-session paths, timeout-policy strictness, and that a failed check blocks proof.clean, verification, and the restart gate. Restart-surface suite: 132 passed, 38 subtests (branch baseline 118 passed, 12 subtests; +14 new tests, no regressions). Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01VEaP3TohHLFWkp3Z2mmuZw	2026-07-24 22:36:25 -04:00
sysadmin	1cbbde0089	feat(restart): pre-restart drain proof and hard gate (#661) ... Add `drain_proof.py`: a machine-verifiable DrainProof artifact plus a fail-closed verifier and the hard gate the sanctioned restart-apply path must consult, so a restart can never proceed on a stale or false "ready" claim (#655 umbrella, child of #658 coordinator / #659 drain / #660 checkpoints). - DrainProof: HMAC-SHA256 keyed proof-id over a canonical body using a per-process secret -> non-forgeable within the process; a proof minted in a prior daemon process will not verify after restart. Short TTL (120s). - build_drain_proof(): mints the proof from the #658 impact report + the drain-mode outcomes. Checklist: no in-flight mutations, assignments stopped, checkpoints complete, handoffs ok, leases handled, acks-or- timeout. Every check fails closed on missing/ambiguous evidence; the no-in-flight-mutations and leases-handled checks are derived from the authoritative impact report, not self-reported. - verify_drain_proof(): fail-closed — rejects missing, malformed, expired, signature-mismatched (forged/tampered/prior-process), unclean, or stale-fingerprint proofs; recomputes cleanliness from the checks rather than trusting the flag. - gate_apply_restart(): allow only on a valid clean proof; deny -> durable incident descriptor; break-glass is the only bypass and is never silent. - Checkpoint completeness is a supplied input, not a hard dependency on the (still-unmerged #660) checkpoint schema. Wire the gate into gitea_request_mcp_restart: dry_run=False now enforces the hard gate (drain_proof_json required; break-glass via request_break_glass + GITEA_BREAKGLASS_RESTART_AUTHORIZATION env). The tool still performs no actual restart — execution remains a further child. Tests: tests/test_drain_proof.py — 25 cases covering AC#1-4 (apply without proof denied, successful drain verifiable, open unsafe mutation fails, pass/fail/expired), forgery/tamper/wrong-secret/stale-fingerprint rejection, break-glass bypass, and secret hygiene. 25/25 pass (coordinator suite unaffected: 40/40 together). Links #652 #653 #655 #658 #659 #660. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01E7Fv9Bp2XWgvaWa4M1kdR7 (cherry picked from commit e7bcc952bb3e820fda95acbecefeaebfa5f8fcff)	2026-07-24 17:17:13 -04:00