Repository navigation
Preserve the deployed controller graph in the native retirement proof #4840
Description
🤖 Generated by the Agentic Engineer
Problem
The native retirement proof intentionally uses the published controller dependency graph. Automated PR #4834 independently changed two indirect dependencies and merged, although the documented proof requires this graph to remain coupled to its producer. The executable checks only four top-level modules, so a different linked dependency can still report a production-equivalent result.
Intended outcome
Restore the published graph for this anonymous, loopback-only proof; reject independent module changes at execution; and keep automated dependency updates from replacing this fixed fixture. Production dependencies elsewhere must retain normal security updates. Known reachable advisories remain visible under the existing bounded offline exception, not suppressed or described as fixed.
Acceptance
- A changed indirect dependency demonstrably fails the graph guard.
- The published graph passes the real native positive and adversarial controls.
- Automated dependency policy distinguishes the fixed native fixture from ordinary modules.
- Existing cleanup and data-preservation gates are unchanged.
Related to #4266 and #4819. This is a prerequisite for relying on the native retirement proof, not proof that production cleanup has completed.
Metadata
Metadata
Assignees
Type
Fields
Priority
Effort
Start date
Projects
- Status
Activity
devantler commentedon Oct 13, 2026
This is a narrowly bounded live-incident prerequisite: the merged dependency update invalidates the documented conformance identity used to authorize cleanup. It does not establish a production uninstall failure. I am handling this before the protected retirement, despite ordinary WIP being over its ceiling; this exception does not admit unrelated backlog work.
Plan: restore the published module selections, add causal tests for changed declared and linked dependencies (including the producer’s intentional replacements), and prevent independent updater changes only in this fixed native fixture. Normal production dependency updates, vulnerability scans and the existing disclosed offline exception remain in place.
devantler commentedon Oct 13, 2026
New downstream CI evidence for this existing prerequisite: three independent dependency proposals stop in the same native retirement control before making any API request.
48bd0c0fcb0fbb6441996b713592d31323d11405: CI job 115450471748.441635627179124dbe3dc20e66c9c63ceca0826b: CI job 115463528343.21b4136e7431ceaff111967ce492fea49d37d54a: CI job 115463735448.Both native wait-failure cases report
NATIVE_FLUX_POLLER=HOLD_PINSwith no observed requests, and the test rejects this as missing production-equivalent execution. The published driver pins the controller, API and SSA module identities, so these proposals change the identity the fixture is intended to exercise. This is a deliberate admission refusal, not evidence of a production uninstall failure or a transient CI outage. No check was retried or weakened.The existing repair #4841 at
d91031bbd57d6b75b7c44e5a2daf0895903bbad5already covers the complete fixed graph and scoped Renovate/Dependabot policy and is queued. Preserve that delivery owner. After the repair lands, reconcile the pre-existing fixed-fixture proposals with that reviewed policy and independently verify the remaining ordinary dependency updates. This checkpoint proves the observed refusals only; it does not prove the repaired graph has deployed or that portal cleanup has completed.devantler commentedon Oct 13, 2026
Delivery checkpoint: #4841 has been repaired against current main at signed head be2ba4e. The exact published module fingerprints, tidy no-change check, native race suite and actual Helm history/hooks/asynchronous-uninstall control passed. New-head hosted CI remains pending, so this is not delivered yet. The still-active updater #4851 published another head during this run; it has not been taken over, cancelled or closed. The existing fixture-only exclusion in #4841 preserves normal runtime dependency and security checks.