Skip to content

fix(fleet): adopt the released 1.6 standard configuration #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jjziets merged 1 commit into from
Nov 2, 2026
Merged

fix(fleet): adopt the released 1.6 standard configuration #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 37 additions & 18 deletions .traceweaver/intent-contract.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,22 +69,41 @@
"verification_id": "VER-PAIR-006",
"validation_id": "VAL-PAIR-006"
}
]
],
"service_recovery_amendment_projection": {
"date": "2026-11-02",
"authority_plan": "../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/architecture/continuation-amendment.json",
"plan_sha256": "159af8421e4dde61e4ecc4f47849a1ddd7f07cd6fb158d247256f0bb36ed316e",
"owner_approval": "../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/owner-approval.json",
"implementation_contract_sha256": "91b873c548da7d10a113c8fbb74f09540559ba51339514c738e081d0dc75cf01",
"authority_gate": "../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/go/recovery-source-go.json",
"reviewed_vv": "../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/go/recovery-vv-root-reviewed.json",
"requirement": "REQ-FLEETUPDATE-001",
"trace": "TRACE-FLEETUPDATE-001",
"verification": "VER-FLEETUPDATE-001",
"validation": "VAL-FLEETUPDATE-001",
"source_only": true,
"native_acceptance": "held",
"production_writes": "disabled",
"publication": "held"
},
"main16_compatibility": {
"work_item_id": "FLEET-MAIN16-COMPAT-20261102",
"requirement": "REQ-FLEETUPDATE-001",
"trace": "TRACE-FLEETUPDATE-001",
"verification": "VER-FLEETUPDATE-001",
"validation": "VAL-FLEETUPDATE-001",
"approved_amendment_sha256": "159af8421e4dde61e4ecc4f47849a1ddd7f07cd6fb158d247256f0bb36ed316e",
"accepted_plan": "../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/main16-compat/plan/plan.json",
"root_source_go": "../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/main16-compat/plan/root-source-go.json",
"frozen_profile_sha256": "dd1692f7a21e9d9331049970d7176af59cf9cc7ee9a3f3fb975c227b08424a5d",
"released_main_source": "8e2b421b65f6d8d47f780e5681d0f3d690686a6d",
"stock_profile": "standard-8e2b421",
"evidence_directory": "../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/main16-compat",
"frozen_data_exception": "Exact copied Main template and independently rendered static inputs retain original bytes; external matrix SHA256 mapping replaces new inline anchors.",
"must_not_change": "auth/current target/lifecycle/dependencies/versions/customer settings/publication/native authority",
"acceptance": "Local candidate only; final independent review, protected CI/native/installed browser/site acceptance held",
"prior_recovery_budget_reset": false,
"new_native_budget": 0
}
}

service_recovery_amendment_projection:
date: 2026-11-02
authority_plan: ../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/architecture/continuation-amendment.json
plan_sha256: 159af8421e4dde61e4ecc4f47849a1ddd7f07cd6fb158d247256f0bb36ed316e
owner_approval: ../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/owner-approval.json
implementation_contract_sha256: 91b873c548da7d10a113c8fbb74f09540559ba51339514c738e081d0dc75cf01
authority_gate: ../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/go/recovery-source-go.json
reviewed_vv: ../../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/go/recovery-vv-root-reviewed.json
requirement: REQ-FLEETUPDATE-001
trace: TRACE-FLEETUPDATE-001
verification: VER-FLEETUPDATE-001
validation: VAL-FLEETUPDATE-001
source_only: true
native_acceptance: held
production_writes: disabled
publication: held
15 changes: 15 additions & 0 deletions requirements.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,21 @@ verified. No feature version bump or publication is part of this worktree change
# CryptoLabs Proxy scoped requirements


## Main 1.6 stock-profile compatibility evidence

`FLEET-MAIN16-COMPAT-20261102` is a bounded integration repair under the existing
REQ-FLEETUPDATE-001 authority. The owner-approved amendment SHA256 is
`159af8421e4dde61e4ecc4f47849a1ddd7f07cd6fb158d247256f0bb36ed316e`.
The accepted [child plan](../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/main16-compat/plan/plan.json)
and [root source GO](../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/main16-compat/plan/root-source-go.json)
bound this repair to the exact released Main `8e2b421` standard profile. Existing
Fleet and pairing requirement statements remain authoritative. Verification
uses VER-FLEETUPDATE-001 and the [worktree RED and V&V definition](../artifacts/ipmi-readiness-20261026/fleet-ui-20261102/execution/main16-compat/definition/).
Local implementation, package evidence and final independent review do not close
VAL-FLEETUPDATE-001; protected CI, native and installed browser/site acceptance
remain separately held. No recovery or native operation budget is reset.


## Owner-approved account pairing — PAIR-20261028-01

Source: latest owner approval quoted in `.traceweaver/account-pairing-20261028/authority.json`. Reviewed scope hash: `9b80ccd96837cae1dd63723fa10ce8390dc4305fcc9e65f303a4868a917dc922`. The exact shared protocol is `.traceweaver/account-pairing-20261028/contract.json`. Existing requirements remain authoritative; this appendix governs only the approved pairing increment. Delivery and paid-service acceptance remain held until observed.
Expand Down
17 changes: 14 additions & 3 deletions src/cryptolabs_proxy/standard_adoption.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,15 +230,25 @@ def render_standard(declaration):


PREVIOUS_STANDARD_SOURCE = '444d7c0e06e0f9935971c51872e9f37bd8869282'
MAIN16_STANDARD_SOURCE = '8e2b421b65f6d8d47f780e5681d0f3d690686a6d'
PREVIOUS_STANDARD_TEMPLATES = {'previous-standard-nginx-444d7c0.conf.j2': 'f12e2b9800cbaa0e49e685506cfaad38eb7e568fa6d239fa15277af59073d8de', 'vast-price-manager-auth-blocks.conf.j2': 'b9d7013434557492887b0600bc2afc92227ee17f9efebe55b0cccc4b16bd3f81', 'acme-challenge.conf.j2': '7e594162700825757c9d402971094448aa1834d1f7121ac1c02f152f345e149a', 'fleet-api-routes.conf.j2': '6991ca6bf1dd4b258e8ee7851fc69ef50b19dfe2353570e4911a0ebadc68ed1b', 'vast-price-manager.conf.j2': '32483d169a09c42653396e66c5c7efe1995bd599f44f11ee64fa2f0731a0a2f8', 'standard-service-routes.conf.j2': 'ef0f55aae48e35127d288781e68281a371505ba27384c8fd04dff9200dce3963', 'exporter-auth-routes.conf.j2': '450f4c418c09474ac45b6dd314c47cc090fe7d230a0206b30e48c7975023133b', 'host-forwarding.conf.j2': '35c4a1fe1d3001865a77d7653350b7a61968953b94172dc7063bc31a42c0f9f7'}


def render_previous_standard(declaration):
# TRACEWEAVER: entrypoint=render_previous_standard; req=REQ-FLEETUPDATE-001; trace=TRACE-FLEETUPDATE-001; ver=VER-FLEETUPDATE-001
def render_previous_standard(declaration, *, source=PREVIOUS_STANDARD_SOURCE):
template='previous-standard-nginx-444d7c0.conf.j2'
templates=PREVIOUS_STANDARD_TEMPLATES
if source==MAIN16_STANDARD_SOURCE:
templates={name:digest for name,digest in templates.items() if name!=template}
template='previous-standard-nginx-8e2b421.conf.j2'
templates[template]='05828b78143c5d6cd7cbe60700cfc54b627cb4efff9a7af43439fdb56e25edab'
elif source!=PREVIOUS_STANDARD_SOURCE:
raise AdoptionError('previous_standard_profile_unavailable')
env=get_jinja_env()
for name,expected in PREVIOUS_STANDARD_TEMPLATES.items():
for name,expected in templates.items():
raw=env.loader.get_source(env,name)[0].encode()
if sha256(raw)!=expected: raise AdoptionError('previous_standard_profile_unavailable')
return env.get_template('previous-standard-nginx-444d7c0.conf.j2').render(
return env.get_template(template).render(
domain=declaration['domain'],letsencrypt=declaration['tls']=='letsencrypt',services=declaration['services'],
host_forward_groups=declaration.get('host_forward_groups',[]),acme_challenge=declaration.get('acme_challenge'),
hostname_policy=validate_hostname_policy(declaration.get('hostname_policy'),declaration['domain']),
Expand Down Expand Up @@ -640,6 +650,7 @@ def visit(items):
actual=normalize(tree); expected=normalize(parse_nginx(render_standard(declaration)))
if actual==expected: return 'standard'
if actual==normalize(parse_nginx(render_previous_standard(declaration))): return 'standard-444d7c0'
if actual==normalize(parse_nginx(render_previous_standard(declaration,source=MAIN16_STANDARD_SOURCE))): return 'standard-8e2b421'
legacy=get_jinja_env().loader.get_source(get_jinja_env(),'legacy-bootstrap-nginx.conf')[0].encode()
profiles=[legacy]
for enabled in (False,True): profiles.append(render_managed_vpm_config(legacy,enabled))
Expand Down
Loading
Loading