kavi/kua-deploy
1
0
Fork 0
Code Issues 4 Pull requests 1 Projects Releases Packages Wiki Activity

P1: evaluate DB safety against the fetched deploy commit #2

New issue
Open
opened 2026-07-10 17:36:11 +00:00 by kavi · 0 comments
kavi commented 2026-07-10 17:36:11 +00:00
Owner
Copy link

Muralla release dry-run on 2026-07-10 exposed a false block: /root/apps/muralla was clean but stale on main@86ef83e0d (21 migration dirs), while production DB had 24 applied and origin/production already contained those migrations. kua-db therefore reported 3 orphaned migrations.

Root cause: deploy() runs kuaDbSafeCheck(appName) before git fetch and checkout of the deploy branch. Safety is evaluated against an unrelated stale working tree, not the commit that will be built.

Acceptance:

  • Under the existing per-app lock, validate the working tree and fetch/checkout the exact deploy branch before calling kua-db safety.
  • Record the candidate commit in progress before the DB gate and prove the checked disk tree is that commit.
  • A blocked DB gate must perform no build, compose, migration, or runtime mutation.
  • Preserve fail-loud dirty-tree behavior and do not discard operator changes.
  • Add regression tests for call order and stale-clean checkout behavior.
  • Prepare a reviewed PR only. Do not deploy kua-deploy or touch sol-prod.

This must land only after the production-to-main security reconciliation in #1.

Muralla release dry-run on 2026-07-10 exposed a false block: /root/apps/muralla was clean but stale on main@86ef83e0d (21 migration dirs), while production DB had 24 applied and origin/production already contained those migrations. kua-db therefore reported 3 orphaned migrations. Root cause: deploy() runs kuaDbSafeCheck(appName) before git fetch and checkout of the deploy branch. Safety is evaluated against an unrelated stale working tree, not the commit that will be built. Acceptance: - Under the existing per-app lock, validate the working tree and fetch/checkout the exact deploy branch before calling kua-db safety. - Record the candidate commit in progress before the DB gate and prove the checked disk tree is that commit. - A blocked DB gate must perform no build, compose, migration, or runtime mutation. - Preserve fail-loud dirty-tree behavior and do not discard operator changes. - Add regression tests for call order and stale-clean checkout behavior. - Prepare a reviewed PR only. Do not deploy kua-deploy or touch sol-prod. This must land only after the production-to-main security reconciliation in #1.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
production
feat/app-inspect-endpoint
fix/oneshot-verification
fix/isolated-deploy-checkouts
fix/compose-service-discovery
fix/registry-diff-readback
fix/phase05-audit-hardening
fix/hostname-gal-default
fix/node-ip-drift
fix/3-release-ff-only
fix/1-reconcile-prod-to-main
fix/progress-reset-started-at
prod-20260810213147
prod-20260810003320
prod-20260810002920
prod-20260810001807
prod-20260810001304
prod-20260810000520
prod-20260810000238
prod-20260809080555
prod-20260809080408
prod-20260809075705
prod-20260809075542
prod-20260809075408
prod-20260809074926
prod-20260717011008
prod-20260715060232
v0.1.0
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
kavi/kua-deploy#2
No description provided.