4.8 KiB
Cached-stage input completion, revision 5
Stable proposal SYNC-SCANNER-JSON-DIGEST-20261101, revision 5. Revision 4 remains sealed at SHA256 64c73100f2347470fda1b8b3194dbf6a8009291d9d80223af463b3c5ecab52fd; its complete scope, controls, estimates and recovery remain the baseline. Revision 5 has not run natively and needs exact review because its cached-staging code changes.
Verified diagnosis
The first revision-4 access failure made no native changes. Subsequent founder diagnostics authenticated to the expected node with the founder admin group. Its receipt was preserved before the unchanged authorized retry.
The retry passed preflight, server dry-run and live tool self-test, then timed out while sending the binary to the existing-artifact staging command. Rollback verified the old policy/template, all 171 fragments, exact hook metadata and real receiver probes; repaired markitect-main coverage remains intact. No deployment patch or six-file source application occurred.
Read-only tests on the actual pod verified the cached artifacts. With empty input, verification completed normally. With 3,437,906 synthetic input bytes, both WebSocket and SPDY reached successful remote cache verification but the client timed out. When the same read-only check consumed and counted all input before returning, both transports completed successfully and verified the entire byte count. Receipts are sealed here. This confirms the input-handling distinction; no claim about a particular upstream bug is needed.
Only revised staging behavior
The existing fast path returned without reading the caller's already-sent binary. Revision 5 adds only these lines before the unchanged cached success response:
received=$(wc -c)
test "$received" -eq "$(stat -c %s "$new/receive-secret-scan")"
This completes the input stream and refuses a short/empty upload. Cached binaries still must pass all existing identity/hash/mode/marker checks; the cached path writes no artifact. Fresh staging is byte-for-byte unchanged. The adapter binary, pinned Gitleaks, detection profile, two deployment fields, resource/image/strategy/security-context values and six source postimages are unchanged.
A small reviewed envelope substitutes this one stage script when the sealed revision-4 controller invokes it. Every other controller operation delegates unchanged to revision 4, including live runtime self-test, immutable ConfigMap reuse/UID pinning, portable hook migration, exact known-mode restoration, complete inventories, conditional patch, Ready wait, pre/post receiver probes and guarded rollback. Errors retain the artifact-staging label. Fresh receipt: /tmp/forge-scanner-rollout-r5-receipt.json; earlier receipts are not overwritten or removed. Source followthrough uses that receipt and the revision-5 approval digest with the same six exact candidates.
Founder launcher after exact review: /tmp/forge-scanner-rollout-r5.sh. The agent does not access the admin kubeconfig. The acknowledgement binds reviewed bytes and grants no separate credential or authority.
Verification and recovery
Four cases passed in the pinned Forgejo image: fresh staging, cached staging with the complete actual binary, cached empty-input refusal, and cached short-input refusal. Cached binary/scanner hashes remained unchanged. Two envelope tests verify that only the stage call changes, arguments/input/timeouts pass through, and the only stage delta is consumption/counting. Native read-only consuming-input controls passed on both transports. Revision-4's eight image cases, full 171-repository/1,539-hook controller tests, runtime self-test and three controller checks remain applicable; scanner code/binary and source candidates are unchanged.
The same guarded revision-4 rollback restores old deployment fields and old hook bytes/modes, preserves protected content, verifies old-policy probes, and retains the completed coverage repair and all staged public artifacts. Failed/unverified outcomes remain in the same trial. Unknown concurrent drift is retained for founder review; recovery is not guaranteed. Installing coverage does not retroactively admit historical objects or establish full Forgejo write/lifecycle coverage.
Cost, interruption and authorization
Same estimate as revision 4: infrastructure increment EUR 0, 20–35 attended minutes, expected 1–3 minute Recreate interruption with bounded rollback/probes; not an availability guarantee. Founder time/existing compute and complete security/recovery loss remain unpriced, with illustrative one-hour recovery EUR 100. No autopilot grant, new detector exception, promotion or unchanged-success credit.
The existing revision-4 approval is preserved. This new cached-input behavior needs exact revision-5 review under docs/agent-autonomy-decision.md: "Approval is bound to the reviewed proposal revision; changing that revision requires review again."