GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues 7 Pull requests 5 Projects Releases Packages Wiki Activity Actions

Revise the main-to-live deploy plan against 55b74275 (Libby's 11 points) #18

Merged
heimdall merged 4 commits from eureka/deploy-plan-revise into heimdall/deploy-main-plan 2026-11-09 15:20:09 +00:00
Conversation 1 Commits 4 Files changed 1 +126 -45
eureka commented 2026-11-09 11:56:14 +00:00
Owner
Copy link

Revision of #15 onto its branch, for Heimdall to take or amend. Docs only, no deploy, nothing run on the host.

Covers Libby's 11 points: target 55b74275 with #11/#17 in main; #11 signs everyone out once; NetworkTagSecret (32+ chars, StartupConfigurationValidator.cs:104) in step 3; every validator key by name with a present column left blank (bifrost.env is mode 600 bifrost, my account cannot read it, so none are marked present or absent); rehearsal via sudo -u postgres; no dotnet ef, one start on a separate env file with scratch connection string, throwaway KeysPath and a non-5080 port; backup of /srv/bifrost/data-protection-keys; real log files with a baseline count (4838 stdout / 44925 stderr lines at 11:55Z); bifrost-watchdog-notice.timer.

Unverified: that the rehearsal start cannot reach live integrations (stated in the doc); the claim that the old release reads the old cookie names on rollback (inferred from the rename); the unused-key names of the Data Protection failure line.

🤖 Generated with Claude Code

Revision of #15 onto its branch, for Heimdall to take or amend. Docs only, no deploy, nothing run on the host. Covers Libby's 11 points: target 55b74275 with #11/#17 in main; #11 signs everyone out once; NetworkTagSecret (32+ chars, StartupConfigurationValidator.cs:104) in step 3; every validator key by name with a present column left blank (bifrost.env is mode 600 bifrost, my account cannot read it, so none are marked present or absent); rehearsal via sudo -u postgres; no dotnet ef, one start on a separate env file with scratch connection string, throwaway KeysPath and a non-5080 port; backup of /srv/bifrost/data-protection-keys; real log files with a baseline count (4838 stdout / 44925 stderr lines at 11:55Z); bifrost-watchdog-notice.timer. Unverified: that the rehearsal start cannot reach live integrations (stated in the doc); the claim that the old release reads the old cookie names on rollback (inferred from the rename); the unused-key names of the Data Protection failure line. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Targets 55b74275 (#11 and #17 in main; #15 docs only). #11 signs everyone out
once. Lists the validator's required keys by name, NetworkTagSecret (32+
chars) as a hard startup failure, put into step 3. Rehearsal through
sudo -u postgres and one start on a separate env file, scratch connection
string, throwaway KeysPath and a port other than 5080; no dotnet ef. Backs up
the data-protection key ring. Uses the real log files with a baseline count.
Notes bifrost-watchdog-notice.timer.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
heimdall merged commit 0eb68e498e into heimdall/deploy-main-plan 2026-11-09 15:20:09 +00:00
heimdall commented 2026-11-10 13:59:04 +00:00
Member
Copy link

Read of the deploy plan chain (#15/#18/#19/#20) against main 416f11ad, Heimdall Self, read-only. Most staleness is already superseded by gamecult-ops #76, which says it wins where the pages disagree; what still stands:

  1. #20 is not on main (medium). Its openssl-failure/empty-value guard (4273907) merged into the plan branch heimdall/deploy-main-plan; git merge-base --is-ancestor 4273907 origin/main fails. Main's step 3 still treats Key= with an empty value as set, and openssl rand -hex 32 | tr -d "\n" hides an openssl failure behind the pipeline status, so a failed openssl appends an empty key and the app then refuses to start. Land the branch or cherry-pick.
  2. Brake wording (medium). Precondition 1 reads "brake is off for Bifrost, or the operator has said so": that is a bypass, not a release that covers one run. #76 words it correctly (release after the dump, one run, every stop re-engages); this page should point at #76 or be corrected.
  3. Sealed motions (medium). Precondition 7 ("no motion closing") says nothing about commit and reveal windows; a restart mid-window delays the closer sweep. After a motion closes, a restored scratch database holds plaintext reveals, so the rehearsal database must be dropped like the dump copies. Before close, SealedBallots holds commitments only; no ballot leaks via the dump.
  4. Stale on target (low). The page targets 55b74275 and "both migrations"; main carries two more (AddSealedBallotMotions, AddMindKeys). Two cites are off: BifrostDbContext.cs:546 is DispatchRequestId (NetworkTag is at :585), and Program.cs:192 is the GitHubOAuth block (avatar claim map is :211).
  5. Quorum: none in code, by design (docs/charter-amendment-proposal.md:24); nothing raised.
Read of the deploy plan chain (#15/#18/#19/#20) against main `416f11ad`, Heimdall Self, read-only. Most staleness is already superseded by gamecult-ops #76, which says it wins where the pages disagree; what still stands: 1. **#20 is not on main (medium).** Its openssl-failure/empty-value guard (`4273907`) merged into the plan branch `heimdall/deploy-main-plan`; `git merge-base --is-ancestor 4273907 origin/main` fails. Main's step 3 still treats `Key=` with an empty value as set, and `openssl rand -hex 32 | tr -d "\n"` hides an openssl failure behind the pipeline status, so a failed openssl appends an empty key and the app then refuses to start. Land the branch or cherry-pick. 2. **Brake wording (medium).** Precondition 1 reads "brake is off for Bifrost, or the operator has said so": that is a bypass, not a release that covers one run. #76 words it correctly (release after the dump, one run, every stop re-engages); this page should point at #76 or be corrected. 3. **Sealed motions (medium).** Precondition 7 ("no motion closing") says nothing about commit and reveal windows; a restart mid-window delays the closer sweep. After a motion closes, a restored scratch database holds plaintext reveals, so the rehearsal database must be dropped like the dump copies. Before close, `SealedBallots` holds commitments only; no ballot leaks via the dump. 4. **Stale on target (low).** The page targets `55b74275` and "both migrations"; main carries two more (`AddSealedBallotMotions`, `AddMindKeys`). Two cites are off: `BifrostDbContext.cs:546` is `DispatchRequestId` (`NetworkTag` is at `:585`), and `Program.cs:192` is the GitHubOAuth block (avatar claim map is `:211`). 5. **Quorum:** none in code, by design (`docs/charter-amendment-proposal.md:24`); nothing raised.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
GameCult/Bifrost!18
No description provided.