Skip to content

mirror-history: end-to-end validation (mirror -> promote -> delete -> re-run) #163

Closed
#248
Closed
mirror-history: end-to-end validation (mirror -> promote -> delete -> re-run)#163
#248
Labels
acquireRelated to the Acquire stageagent-managedCreated/managed by My Feature EngineerfeatureNew feature or requestfeature:mirror-historyMirror-history capabilitytype:taskImplementation work item

Description

@toddysm
toddysm
opened on Jul 31, 2026

Part of #157.

Validate the whole flow end-to-end.

Scenario

  1. Mirror an image into quarantine/<image> (history entry recorded).
  2. Promote it and delete the tag from quarantine (:mirror-history keeps the package alive; no last-tagged-version delete workaround needed).
  3. Re-run the mirror: it reports skipped (already synchronized) instead of re-copying.
  4. force re-run still copies and records.
  5. Dashboard Acquisition view shows the per-repo synchronized history and no longer shows a history-only package as awaiting promotion.

Also: get_errors clean, actionlint + shellcheck -S warning clean on new/changed run blocks, per-service pytest green.

Depends on: #159, #161.

Activity

  1. toddysm
    added
    featureNew feature or request
    acquireRelated to the Acquire stage
    on Jul 31, 2026
  2. toddysm
    added
    type:taskImplementation work item
    feature:mirror-historyMirror-history capability
    agent-managedCreated/managed by My Feature Engineer
    on Oct 27, 2026

  3. toddysm commented on Oct 27, 2026

    @toddysm
    toddysm
    on Oct 27, 2026
    OwnerAuthor

    Implementation checkpoint: In progress

    Claimed by instance 25e59c6f-a570-4253-aa3b-430d640485e0 after confirming no existing owner or checkpoint.

    • Branch: feature/mirror-history/e2e-163-25e59c6f.
    • Worktree: temporary session-owned mirror-history-163-worktree; exact local ownership path is retained in the session claim.
    • Base commit: 8240d0b83b2cd315f20d92ce3bc1bc198d328f46; no implementation commits or unpushed changes yet.
    • Testing mode: hosted; normal GitHub Actions and Copilot review explicitly authorized.
    • Approved design: existing mirror-history architecture on main and this issue’s five-step lifecycle, confirmed by the requester on 2026-10-27.
    • Live writes/deletes restricted to disposable ghcr.io/toddysm/{quarantine,golden}/mirror-history-e2e-<run-id> test namespaces; normal image repositories will not be modified.
    • Next: add repeatable lifecycle validation, tests and user instructions; capture registry and dashboard evidence; merge only after passing checks and settled reviews.

    Dependencies #159 and #161 are closed. Tracking is issues-only; no project board for this repository.

  4. toddysm
    added a parent issue on Oct 27, 2026

  5. toddysm commented on Oct 27, 2026

    @toddysm
    toddysm
    on Oct 27, 2026
    OwnerAuthor

    Implementation checkpoint: In review

    Pull request: #248 (Closes #163).

    • Instance: 25e59c6f-a570-4253-aa3b-430d640485e0; branch feature/mirror-history/e2e-163-25e59c6f; temporary session-owned worktree retained.
    • Tested and pushed head: f6f2c5f5f0436a7413f7093809c9e298a4cc639f; clean tracked working tree, no unpushed changes.
    • Testing mode: hosted, with normal Actions and authorized Copilot review. No suppressions or protection changes.
    • Local evidence: 20 new regression tests plus 55 existing relevant tests passed; mypy and compileall clean; actionlint 1.7.12 clean; ShellCheck 0.11.0 at warning severity clean on 18 shell blocks; 20 documentation links valid. Evidence was checked for credentials before publication.
    • Local graph suites remain an environment coverage gap (package-mirror wheel failure); the hosted checks job must run all library/service suites before publishing registry fixtures.
    • Live test uses only the approved disposable fixture namespaces and actual mirror/promote/delete workflows and service HTTP calls. Registry writes have not yet been claimed as validated.
    • Next: require complete live lifecycle/cleanup evidence, green CodeQL and settled review; fix feedback with commit-referenced replies before resolving threads. Parent Acquire: persist mirror history to skip re-synchronizing already-mirrored (and promoted) digests #157 remains open until the separate close-out PR merges.

  6. toddysm commented on Oct 27, 2026

    @toddysm
    toddysm
    on Oct 27, 2026
    OwnerAuthor

    Validation checkpoint: first live failure fixed; still in review

    PR: #248. Instance 25e59c6f-a570-4253-aa3b-430d640485e0, branch feature/mirror-history/e2e-163-25e59c6f, temporary session-owned worktree retained and clean. Last pushed/tested head: 746ebcce405fb06a72c3173460f44b13b61bcc6d; no unpushed changes. Testing mode: hosted.

    Initial live run https://github.com/toddysm/cssc-framework/actions/runs/40559532913 passed all 162 hosted regression/library/service tests, including the graph suites unavailable locally. Fixture publication and the initial mirror worked. The real package-service history read exposed a producer bug: GHCR blob CDN redirects were not followed by OciRegistryClient. Both fixture packages were deleted and verified absent after that failure.

    The first fix follows redirects without forwarding registry authorization across hosts, preserves HTTP errors without signed query strings, and adds regression tests. All four initial Codex/Copilot findings were fixed, replied to individually with this SHA, and then resolved: untagged referrer removal, bounded transient visibility retries, stable fixture/evidence identity on partial reruns, and independent package cleanup.

    At this exact head, 93 affected local tests and type diagnostics pass; workflow/schema and 18 shell-block diagnostics are clean. Fresh Copilot review is requested. Corrected hosted run: https://github.com/toddysm/cssc-framework/actions/runs/40561160460.

    CI-fix attempts used: 1 of 3. Next: require full live lifecycle and cleanup success plus settled review and CodeQL before merge. No completion claimed yet.

  7. toddysm commented on Oct 27, 2026

    @toddysm
    toddysm
    on Oct 27, 2026
    OwnerAuthor

    Validation checkpoint: promotion cleanup race fixed; still in review

    PR #248 is now at tested/pushed head 364e225446e831788bec30d34dff749469f28a6d, branch feature/mirror-history/e2e-163-25e59c6f, instance 25e59c6f-a570-4253-aa3b-430d640485e0. The owned temporary worktree is clean and fully pushed. Testing mode: hosted.

    The corrected reader passed the initial live registry and actual dashboard/service checks in https://github.com/toddysm/cssc-framework/actions/runs/40561160460. The stronger post-promotion inventory assertion then correctly caught an untagged-referrer leak. Logs showed the regular promotion workflow enumerated the sha256-* fallback index as a separate image job and deleted that discovery tag before image-owned referrer cleanup. The SBOM promotion path already excluded these tags; the regular path now uses the same existing option. Both failed-run fixture packages were deleted and verified absent.

    New component regressions execute the tag-enumeration script with both filter modes and assert promotion-path parity. At this exact head, 95 affected local tests and type diagnostics pass. Three changed workflow schemas and 18 shell blocks are clean at the requested warning severity; unrelated pre-existing info/style diagnostics were not refactored.

    Fresh Copilot review and live run https://github.com/toddysm/cssc-framework/actions/runs/40562725339 are pending. CI-fix attempts used: 2 of 3. No acceptance or completion claimed until the full chain and cleanup pass.

  8. toddysm
    closed this as completedin #248on Oct 27, 2026

  9. toddysm commented on Oct 27, 2026

    @toddysm
    toddysm
    on Oct 27, 2026
    OwnerAuthor

    Merged checkpoint: #163 complete

    Implementation PR #248 merged as 28c7e13f6b660012903e8bc002804fd90cb9303e.

    • Tested/pushed source head: 364e225446e831788bec30d34dff749469f28a6d.
    • Full acceptance run: https://github.com/toddysm/cssc-framework/actions/runs/40562725339 — success.
    • 182 hosted tests passed across the lifecycle harness, both shared libraries, and all four services. CodeQL passed; current-head Copilot review completed with no open findings. All four initial threads received fix-SHA replies before resolution.
    • 95 affected local tests and type/schema/shell diagnostics passed. Editor-specific tooling was unavailable; CLI diagnostics were recorded instead.

    Persisted JSON and rendered-HTML artifacts were downloaded and independently verified:

    Phase History entries Quarantine versions Last entry forced
    initial 1 4 False
    promoted 1 1 False
    skipped 1 1 False
    forced 2 5 True

    The source digest was unchanged throughout: sha256:96649c78a3901cf33ba1251cd9c471afc53d65337051a622e97e60f59e72c72e. Promotion and the skip retained only the original history artifact sha256:39ae3e513a9cdbfa0bbd220deb63d34c3cc6bc20723dde330a625faf734f9019. Force preserved the original entry and appended exactly one new entry. Both disposable packages were then deleted and verified absent; no normal image repository was modified.

    Live testing exposed and fixed real GHCR blob-redirect handling and the concurrent fallback-index promotion/referrer-cleanup race. Credentials and signed download queries are excluded from persisted diagnostics.

    Instance: 25e59c6f-a570-4253-aa3b-430d640485e0; branch feature/mirror-history/e2e-163-25e59c6f; temporary session-owned worktree still retained, clean and fully pushed at the source head. The fetched main tree matches the tested source tree exactly. This is the required merged checkpoint before branch/worktree cleanup.

    Next: remove the merged implementation branch/worktree, merge the separate reviewed inventory close-out PR, and only then close parent #157. Testing mode: hosted. CI-fix attempts used: 2/3 (final run passed).

  10. toddysm commented on Oct 27, 2026

    @toddysm
    toddysm
    on Oct 27, 2026
    OwnerAuthor

    Cleanup checkpoint: implementation handoff complete

    The merged implementation branch was deleted locally and remotely; its verified clean temporary worktree was removed and its ownership claim released. No unpushed or unmerged implementation work remains.

    Parent #157 is completing the separately authorized inventory/documentation close-out in #249 at ac1a6862f415ab7bbed123268d36d1b1dbbb5dd4. The acceptance evidence and verified fixture deletion from https://github.com/toddysm/cssc-framework/actions/runs/40562725339 remain the completion record for this closed task.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    acquireRelated to the Acquire stageagent-managedCreated/managed by My Feature EngineerfeatureNew feature or requestfeature:mirror-historyMirror-history capabilitytype:taskImplementation work item

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions