GameCult/Idunn
Watch
9
0
Fork
You've already forked Idunn
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deployment brake is a stop: DeploymentStop record, signed release path deleted, record v6 #4

Merged
eureka merged 2 commits from eureka-self/brake-is-a-stop into main 2026-11-13 17:43:21 +00:00
Conversation 0 Commits 2 Files changed 11 +1255 -792
eureka commented 2026-11-13 17:43:20 +00:00
Owner
Copy link

Follow-up idunn-deploy-provenance:follow_up:steward-brake-cuts (decisions in chat-mind-20261113T125202436Z-t51); cut_spec idunn-deploy-provenance:cut_spec:cut-brake-is-a-stop.r1. First of two brake cuts; the steward store is next.

The deployment brake is a stop, not a per-deploy approval: DeploymentStop (idunn.deployment_stop.v1, new src/brake.rs) is read by one reader. Engaged waits (naming who and why), Absent or Clear admits, Unreadable fails closed with the exact deployment-brake-clear remedy. The signed release path (operator anchor, enroll/export, consumed-once scan, durable re-verification, verifier) is deleted. The stop is read at Sealing, at the static flip intent and at the entry to Fencing; after a flip intent or fencing the transaction runs to its end. by is the process uid's login name, never an argument. Deploys, static deploys and rollbacks all use it. idunn-provision deployment-brake-engage|clear|status take --store --runtime-id --reason. Transaction record v6 (key 38 deployment_admitted_at_unix_millis), v5/v4 legacy lifts, boot migration; key 16 kept as a never-written legacy field. Forward-only: an Idunn that predates v6 cannot read a migrated store. A store holding an old v1 brake record reads Unreadable and the target stays held until someone runs deployment-brake-clear.

Tests: 579 passed / 107 failed on the branch; the 107 are the root-only tests failing identically on base 114803c6 (identical by name). Soul: first pass rejected (an engaged stop did not halt in-flight work, fail-open on read errors, vacuous tests, v1 remedy); fixed in b230703; delta pass accepted with Lows (flock comment unverified, a missing authority dir fails closed, by records root under sudo).

Not verified: anything as root, a real v1 store, cross-process replace_stop, non-unix paths. gamecult-ops runbooks that call the deleted verbs are not updated here (separate follow-up). Deploy nothing.

🤖 Generated with Claude Code

Follow-up `idunn-deploy-provenance:follow_up:steward-brake-cuts` (decisions in `chat-mind-20261113T125202436Z-t51`); cut_spec `idunn-deploy-provenance:cut_spec:cut-brake-is-a-stop.r1`. First of two brake cuts; the steward store is next. The deployment brake is a stop, not a per-deploy approval: `DeploymentStop` (`idunn.deployment_stop.v1`, new `src/brake.rs`) is read by one reader. Engaged waits (naming who and why), Absent or Clear admits, Unreadable fails closed with the exact `deployment-brake-clear` remedy. The signed release path (operator anchor, enroll/export, consumed-once scan, durable re-verification, verifier) is deleted. The stop is read at Sealing, at the static flip intent and at the entry to Fencing; after a flip intent or fencing the transaction runs to its end. `by` is the process uid's login name, never an argument. Deploys, static deploys and rollbacks all use it. `idunn-provision deployment-brake-engage|clear|status` take `--store --runtime-id --reason`. Transaction record v6 (key 38 `deployment_admitted_at_unix_millis`), v5/v4 legacy lifts, boot migration; key 16 kept as a never-written legacy field. **Forward-only: an Idunn that predates v6 cannot read a migrated store.** A store holding an old v1 brake record reads Unreadable and the target stays held until someone runs `deployment-brake-clear`. Tests: 579 passed / 107 failed on the branch; the 107 are the root-only tests failing identically on base 114803c6 (identical by name). Soul: first pass rejected (an engaged stop did not halt in-flight work, fail-open on read errors, vacuous tests, v1 remedy); fixed in b230703; delta pass accepted with Lows (flock comment unverified, a missing authority dir fails closed, `by` records `root` under sudo). Not verified: anything as root, a real v1 store, cross-process `replace_stop`, non-unix paths. gamecult-ops runbooks that call the deleted verbs are not updated here (separate follow-up). Deploy nothing. 🤖 Generated with [Claude Code](https://claude.com/claude-code) 
Delete the signed release path (deployment_brake_release, the operator
enroll/export verbs, the anchor option and flag, the consumed-once scan,
the durable re-verification, DeploymentAuthorization::validate_shape).
src/brake.rs is the one reader and writer of the stop
(idunn.deployment_stop.v1: engaged|clear, by from the process uid, reason,
at, sequence). Absent or clear admits; a foreign, corrupt, symlinked,
other-runtime or foreign-owned store fails closed. advance_sealing stamps
deployment_admitted_at_unix_millis (key 38) for Deploy and Rollback alike,
so static releases and rollbacks use the same stop.

Control record v6: key 38 changes canonical bytes, so v5 gets a legacy
layout, a lift, boot migration and pinned bytes tests. Key 16 stays a
never-written legacy field so old terminal records decode.

idunn-provision: deployment-brake-engage|clear|status take --store,
--runtime-id, --reason only; status exits nonzero unless deployments admit.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Re-read the stop at the static flip intent and at entry into Fencing for a
  deploy (stop_note, the same path as Sealing). After the intent or fencing
  the transaction runs to its end; documented.
- Absent means NotFound in an existing directory; every other lookup error,
  a zero-length file and a missing parent fail closed. Unreadable names the
  idunn-provision deployment-brake-clear command.
- replace_stop is the operator's break-glass: it replaces v1, foreign,
  ambiguous, zero-length and caller-owned undecodable stores, never a symlink
  or another user's file.
- Mutation-proven tests: foreign-owner Clear, Unreadable admitting at
  Sealing, author from USER.
- docs: stop semantics, v6 downgrade hazard and backup; legacy script no
  longer requires the store and drops the signed-grant wording; two stale
  doc lines.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
eureka merged commit 58e744b745 into main 2026-11-13 17:43:21 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
GameCult/Idunn!4
No description provided.