P2: reconcile diverged production→main (prepare REVIEWED PR only — human merges; do NOT deploy) #1

New issue

Closed

opened 2026-07-10 10:31:34 +00:00 by kavi · 0 comments

kavi commented

2026-07-10 10:31:34 +00:00

Owner

Crown-jewel deploy engine. Handoff: ~/audits/HANDOFF-kua-security-fixes-20260710.md; report: ~/audits/kua-deploy-security-audit-20260710.md. SOL-planned, Terra-reviewed.

Context: production @ ed47680 = HARDENED, deployed. main @ d550824 = security-REGRESSED (it reintroduces the removed registry bind-mount + loses hardened behavior). Divergence: main ahead 2, production ahead 3. main's functional commit 6a583a8 is already represented in production. The repo was archived while main was left regressed — until this lands, main must NEVER be deployed. (Just unarchived to do this work; do NOT re-archive after — see task 5.)

Deliverable: ONE reviewed PR into main. Do NOT merge, push to main/production, deploy, or roll out — a human merges + a human deploys.

Procedure (SOL + Terra corrected — follow precisely)

Merge origin/production into a branch off main with a merge commit.
Resolve server.js and docker-compose.yml conflicts to the PRODUCTION versions (production wins — main reintroduces the registry bind-mount, which is wrong).
Verify (Terra's exact method): the non-test tree must equal ed47680. Run git diff --exit-code ed47680 -- . ':(exclude)test/*' (or list the app files explicitly: server.js, docker-compose.yml, package*.json, source) — it must be empty. Do NOT claim an "identical git tree" while the test files differ. Paste the diff proof in the PR.
The ONLY allowed delta is REWRITTEN tests: test/registry-loader.test.js assumes the removed bind-mounted /app/deploy-registry.json (rewrite for the engine-owned registry at /app/data/registry.json); test/sha-comparison.test.js duplicates prod logic instead of importing it (rewrite to import). Do NOT carry them unchanged.
In the PR body, note that main must be BRANCH-PROTECTED before it's deployable again (operator action) — this + the reconcile is what prevents a regressed deploy recurring. Recommend protect-not-re-archive.

Guardrails

NEVER force-push main/production; NEVER deploy/rollout/touch sol-prod (it deploys itself — extremely dangerous).
If the conflict is anything beyond server.js + docker-compose.yml, or the non-test tree cannot be made == ed47680, STOP and report — do not guess on the control plane.
Fetch --all; verify against ed47680 out-of-band. Conventional commits; Closes #<this>; forgejo-pr into main.

Crown-jewel deploy engine. Handoff: `~/audits/HANDOFF-kua-security-fixes-20260710.md`; report: `~/audits/kua-deploy-security-audit-20260710.md`. SOL-planned, Terra-reviewed. **Context:** `production` @ `ed47680` = HARDENED, deployed. `main` @ `d550824` = security-REGRESSED (it reintroduces the removed registry bind-mount + loses hardened behavior). Divergence: main ahead 2, production ahead 3. main's functional commit `6a583a8` is already represented in production. **The repo was archived while main was left regressed — until this lands, main must NEVER be deployed.** (Just unarchived to do this work; do NOT re-archive after — see task 5.) **Deliverable: ONE reviewed PR into `main`. Do NOT merge, push to main/production, deploy, or roll out — a human merges + a human deploys.** ## Procedure (SOL + Terra corrected — follow precisely) 1. Merge `origin/production` into a branch off `main` with a **merge commit**. 2. Resolve `server.js` **and** `docker-compose.yml` conflicts to the **PRODUCTION** versions (production wins — main reintroduces the registry bind-mount, which is wrong). 3. **Verify (Terra's exact method):** the non-test tree must equal `ed47680`. Run `git diff --exit-code ed47680 -- . ':(exclude)test/*'` (or list the app files explicitly: server.js, docker-compose.yml, package*.json, source) — it must be **empty**. Do NOT claim an "identical git tree" while the test files differ. Paste the diff proof in the PR. 4. The ONLY allowed delta is **REWRITTEN** tests: `test/registry-loader.test.js` assumes the removed bind-mounted `/app/deploy-registry.json` (rewrite for the engine-owned registry at `/app/data/registry.json`); `test/sha-comparison.test.js` duplicates prod logic instead of importing it (rewrite to import). Do NOT carry them unchanged. 5. In the PR body, note that **`main` must be BRANCH-PROTECTED** before it's deployable again (operator action) — this + the reconcile is what prevents a regressed deploy recurring. Recommend protect-not-re-archive. ## Guardrails - **NEVER** force-push main/production; **NEVER** deploy/rollout/touch sol-prod (it deploys itself — extremely dangerous). - If the conflict is anything beyond server.js + docker-compose.yml, or the non-test tree cannot be made == `ed47680`, **STOP and report** — do not guess on the control plane. - Fetch `--all`; verify against `ed47680` out-of-band. Conventional commits; `Closes #<this>`; `forgejo-pr` into `main`.

kavi referenced this issue

2026-07-10 17:36:11 +00:00

P1: evaluate DB safety against the fetched deploy commit #2

kavi referenced this issue from a commit

2026-07-10 21:38:59 +00:00

fix(release): ff-only sync local branches to origin before push (closes #3)

kavi referenced this issue

2026-07-10 21:39:16 +00:00

fix(release): ff-only sync local branches to origin before push (unblocks deploys) #4

kavi referenced this issue from a commit

2026-07-10 22:25:04 +00:00

fix(reconcile): bring main up to production (hardened engine-owned registry) — closes #1