caravan/lib/ at main · gazagnaire.org/caravan · Tangled

gazagnaire.org / caravan

0

Declarative provisioning that converges a provider to a spec

0

caravan / lib

4 folders 3 files

at main

Thomas Gazagnaire caravan: drop the target field that armed nothing, and quote a power argv 2d ago

caravan: drop the target field that armed nothing, and quote a power argv A spool target carried a device-key, decoded and handed to the backend, where only admit_provision reads it -- and that runs only inside Ground.report, which this CLI never calls. Admission happens when a report is written; the CLI observes reports it did not write. So the field named a gate that could never run, and an operator setting it had every reason to think claims were being checked. The gate itself is real and tested; it belongs to the fleet service, which uses the library and holds its own keys, as the keys for a drained window already do. Saying so in the config interface is the fix; carrying a dead field is not. Landed 50e2e0e claimed a target "now pins the device's public half", which was wrong in exactly this way. Separately, a power command was split on bare spaces, so `command pdu --label "rack 4" cycle %s` reached the tool as five arguments where it meant four. It now splits on whitespace with double-quoted runs held together, and prints back in a form that parses -- an unterminated quote is an error rather than a guess at where it ended. Still an argv and still no shell, so the quoting decides word boundaries and nothing else.

2 days ago

caravan: revoke the API keys the secret store supersedes A key's secret half is revealed only at creation, so a run that cannot see the locally retained access key can never use that key again -- and minted another. Nothing revoked the old one. Every key ever minted on the broker application kept SecretManagerSecretAccess over the folder, for good, and the only bound on how many was how often the local half went missing. The plan now retires what it supersedes. Minting comes first, so the folder is never left with no key that can read it, and the retained key is never in the revoked set, so a converged store keeps working. Doing this by wholesale is safe because the listing is scoped to the broker application and that application is adopted only when it carries this store's ownership marker: no key belonging to anything else is in reach.

2 days ago

caravan: authenticate the issuing counter, and say when a window refuses one The drained watermark and the witness floor were given tags; the counter the operator issues sequences from was left plain, in the same directory, against the same adversary. Rewinding it does not forge a command -- it makes the next intents carry sequences at or below what the drain has already spent, so every one is refused as a replay and the outbox quietly stops accepting work. It carries a tag now, and a counter that is present and unusable stops the queueing rather than silently restarting the sequence at one. Quarantining an intent was also silent. The file moving to refused/ was the only evidence, so an operator whose command was refused over a signature learned nothing without going to look. The move now logs what it refused, why, and that the next window is not blocked by it.

2 days ago

caravan: a conflicted target fails the rollout Driving a fleet asked only "is anything pending?", and a target whose verdict is a conflict has no pending plan: it closes the gate by refusing. So the rollout read as finished, printed the conflict, and exited zero. A fleet that cannot roll out reported success, and anything gating on the exit status -- a CI step, a deploy script -- passed on it. A conflict is now its own answer, Blocked, carrying the target it refused on. It is not a gate and never becomes one, so it cannot be waited out; the driver reports it as the error it is. Everything ordered after the conflict is Held, so stopping there loses nothing a later pass would find.

2 days ago

caravan: a conflicted target fails the rollout Driving a fleet asked only "is anything pending?", and a target whose verdict is a conflict has no pending plan: it closes the gate by refusing. So the rollout read as finished, printed the conflict, and exited zero. A fleet that cannot roll out reported success, and anything gating on the exit status -- a CI step, a deploy script -- passed on it. A conflict is now its own answer, Blocked, carrying the target it refused on. It is not a gate and never becomes one, so it cannot be waited out; the driver reports it as the error it is. Everything ordered after the conflict is Held, so stopping there loses nothing a later pass would find.

2 days ago

caravan: a conflicted target fails the rollout Driving a fleet asked only "is anything pending?", and a target whose verdict is a conflict has no pending plan: it closes the gate by refusing. So the rollout read as finished, printed the conflict, and exited zero. A fleet that cannot roll out reported success, and anything gating on the exit status -- a CI step, a deploy script -- passed on it. A conflict is now its own answer, Blocked, carrying the target it refused on. It is not a gate and never becomes one, so it cannot be waited out; the driver reports it as the error it is. Everything ordered after the conflict is Held, so stopping there loses nothing a later pass would find.

2 days ago

caravan: give the API one shape The engine threaded a provider handle through every call instead of packing it once, the CLI held a backend as a first-class module, and the toplevel mixed bare types with loose helpers, so a reader learned each corner of the API separately rather than one shape everywhere. Provider settings were a flat bag of options each documented "X targets only": a target file could spell a field its provider does not have, and a required one went unchecked until apply. The provider is now the member that carries its own settings, which puts both in the decoder and changes the shape of every target file. Moving the defaults into Spec.v leaves the loader without a second copy of them.

2 days ago