3dc005df1c
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
53 lines
2.5 KiB
Markdown
53 lines
2.5 KiB
Markdown
---
|
|
id: RPF-WP-0028
|
|
type: workplan
|
|
title: "Make Forgejo image protection survive checkout replacement"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
created: "2026-09-05"
|
|
updated: "2026-09-05"
|
|
state_hub_workstream_id: "622d1208-b085-5ec2-9fb7-5e41f23e1843"
|
|
---
|
|
|
|
# Make Forgejo image protection survive checkout replacement
|
|
|
|
Source: State Hub message `868a2326-cdad-4256-be4c-7cd6c8ec4b5b`. Reviewed against current repository state
|
|
on 2026-09-05. Repository implementation and live inventory migration are complete.
|
|
|
|
## Implement and verify durable publication
|
|
|
|
```task
|
|
id: RPF-WP-0028-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "869d4114-3642-5e69-88d1-1d14e5547634"
|
|
```
|
|
|
|
Implemented scripts/refresh_live_images.py and make live-images-refresh. Publication validates exports before mutation, locks concurrent writers, retains all previous cluster entries, and fsyncs an atomic replacement. Offline tests prove repeatability, multi-cluster retention, and preservation on missing, empty, or malformed input.
|
|
|
|
The local prune CLI was additionally hardened on 2026-09-05 to refuse apply
|
|
before credential lookup if any explicitly requested export is missing,
|
|
unreadable, empty, or comment-only. Regression coverage includes a valid file
|
|
alongside a bad one, proving partial coverage cannot authorize deletion.
|
|
|
|
## Install production projection and rollout refresh
|
|
|
|
```task
|
|
id: RPF-WP-0028-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "2d0795ba-ccc0-5ba9-8315-2deb4d0d71a6"
|
|
```
|
|
|
|
Requires the production host inventory, activity-core directory mount/configuration update, and cluster rollout hook adoption. Follow docs/forgejo-package-prune.md. Preserve the restored union and worker refusal on missing/empty inventory; do not manually trigger prune. Completed 2026-09-05: installed the versioned helper outside the checkout,
|
|
seeded all 51 restored entries and merged a fresh railiance01 export (86 total),
|
|
added the read-only directory mount, rolled out actcore-worker, and synced the
|
|
exact definition override. API readback confirms the durable path. The resolver
|
|
accepts that path and refuses missing input before subprocess execution; the
|
|
command construction check used a mock and did not run prune. A post-rollout
|
|
capture succeeded. Activity-core's refresh target delegates to this hook; invoke
|
|
it after subsequent cluster rollouts (no new periodic schedule was introduced).
|
|
Evidence: `docs/evidence/RPF-WP-0028-live-inventory-2026-09-05.json`.
|
|
Source revisions: platform `da42f76`, activity-core `4083f31`.
|