Repository navigation
release: open main again — both platform keys rotated, tripwire green on the fix - #322
Merged
Merged
Conversation
Claim audited: "we are ready for a new full (40-lesson) run."
HARD 1 — views-models still pins VIEWS_POSTPROCESSING_PIN="1.1.1" in both
launchers. A run launched now installs the build whose findability guard checks
2 of 110 artefacts and cannot see the sidecar by construction — the exact defect
that made today's delivery unservable. 1.4.0 exists, is tagged, is on PyPI, and
is referenced by nothing. views-models#439 carries the one-line diff.
HARD 2 — a fresh launcher environment is unbuildable (views-models#516, open).
xarray is unpinned in postprocessors/{un_fao,un_crafd}/requirements.txt, and
views-datafactory's `xarray>=2024.1,<2026` cap permits 2025.12.0, which requires
pandas>=2.1 against the platform's pandas 1.5.3. Today's pod works only because
xarray was hand-pinned to 2024.3.0 on it. So the claim holds only if the run
reuses that exact pod and its env survives the launcher's dry-run check.
SOFT 3 — the SELECTION half of the findability guard still depends on an ordering
guarantee that does not exist. #314 made the per-object half order-independent;
the legs loop still resolves through pipeline-core's get_latest_file_id, which
documents "newest by creation timestamp" and takes files_list[0] from an unsorted
result. Held since August, so order has been favourable rather than guaranteed,
and the set it indexes into grows ~120 documents per run at 40 lessons. The
failure mode is a FALSE invisible-delivery on a healthy run. Stub S7 below.
SOFT 4 — ADR-013 §4.6's capacity inequality (assembled-run size x safety factor
<= consumer serving RAM) is an open maintainer item, and its reference figure is
28.6 GB at 36 months, already stated as larger than the serving host's RAM. 40
lessons raises it ~11%. Whether that matters depends on the run's S, which this
seat does not know — recorded rather than asserted.
PASSED — P4, the one I most expected to break: the new per-object query works on
the live path. `_build_partner_read_store` sets store.model_path = None, and
get_predictions_by_metadata injects `filters["name"]` only when model_path has a
model_name, so the C-77 suppression holds for documents() as well as for
latest_file_id. Verified in pipeline-core at datastore.py:423-432.
Only S7 is assertable in this repo. HARD 1 and HARD 2 are other repositories'
state and views-models is not in this repo's CI sibling checkout (ADR-016), so a
test reaching for them would pass vacuously — a guard that cannot fire (C-102).
They are recorded in the module docstring with their issue numbers instead.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ANY1CCy9Xo7zjMY4XJ69v9
…adiness docs(falsify): 40-lesson run readiness — FALSIFIED, two hard, two soft
… the fix, not the escape
C-84 predicted a total seam outage on 2026-11-17 and C-110 predicted that the
tripwire guarding it would close `main` from 2026-10-18. Both happened, on the
day, and `main` was gated for eleven days with nothing queued behind it.
Cleared by rotating, not by acknowledging. `ACKNOWLEDGED_UNTIL` was never set.
VIEWS Pipeline Core (36 scopes) -> pipeline-core-writer (6 load-bearing)
UN FAO / faoapi-legacy-shared-RETIRING (36) -> faoapi-server (4, all reads)
Each successor was verified live BEFORE its predecessor was stood down:
appwrite_store STORE_ACTIVE (1007 files), unfao_delivery DELIVERING, 3
collections / 1006 documents, and faoapi's own smoke test ALL PASS with
appwrite=True and both legs serving 1,030 cells.
KEY_EXPIRY now carries 2027-10-29 for both. The dates are DECLARED (one-year
expiry set at creation), not read back from the console, and the comment says
so — the times are approximate and immaterial at a 30-day window.
The warning text is rewritten because it described a world that no longer
exists. "Neither can carry traffic while the other is replaced" was a property
of the keys being SHARED across every identity on the seam. The successors
serve different consumers with different scopes, so the next rotation is two
independent operations; the message now says to rotate them separately, and a
guard asserts that it does.
The finding worth keeping: scope sets derived from source were wrong TWICE —
once by the pipeline-core seat tracing every call site, once independently
here. Appwrite split the vocabulary into documentsdb.* / tables.*+rows.* /
vectorsdb.*, and what authorises appwrite==19.2.0 is the three scopes the
console tags Deprecated. The server named them itself:
401 general_unauthorized_scope missing scopes (["collections.read"])
401 general_unauthorized_scope missing scopes (["documents.read"])
views-faoapi's own guard had already written the rule, and their C-282 was the
first instance of this exact error. Create-before-delete made the rediscovery
free: the old key carried production throughout. ADRs requested at
views-pipeline-core#572 and views-faoapi#543.
Also recorded in C-110: shortening LEAD_DAYS from 30 to 7 was attempted during
the incident and does not clear the check — measured, it reddens two other
guards instead. The obvious shortcut is closed, deliberately.
Residual, not chased: files.write/documents.write on pipeline-core-writer are
unproven (verifying means writing to production); whether the FAO have adopted
faoapi-caller-fao is unconfirmed and tracked at views-faoapi#543.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ANY1CCy9Xo7zjMY4XJ69v9
Moving C-84 and C-110 into Resolved Concerns appended a separator each where one already followed, leaving `---` / blank / `---`. Adjacent separator pairs went 11 -> 13; now back to 11, matching development. Cosmetic, and caught by the review's own summary pass rather than by a test — `test_register_integrity.py` does not assert separator shape. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ANY1CCy9Xo7zjMY4XJ69v9
…ented values Three findings from the review of 7c4ca88, all real. 1. The diff contradicted itself about the old keys. The docstring said they "were stood down"; the register said one "remains available" as the fallback for the unproven write scopes. Both were in the same change and they cannot both be true. Corrected to what actually happened: the predecessors still EXIST, nothing authenticates with them, and they were kept rather than deleted. The sharper half of that finding: if the old key is the standing fallback, it expires 2026-11-17 and this commit had just removed that date from KEY_EXPIRY — creating exactly the unguarded date this file exists to prevent. Now stated outright in both places: the retained fallback has a deadline, the tripwire deliberately does not guard it (nothing authenticates with it, so it is not this guard's subject), and that is acceptable only because the fallback is a convenience rather than a dependency — a missing write scope is fixed by a console edit, which is what fixed the two read scopes on the day. 2. `assert name == "pipeline-core-writer"` pinned an ordering the same diff admits it invented. The old `name == "VIEWS Pipeline Core"` asserted a console fact: 12:35 vs 16:10, and the earlier key was the one both delivery paths used. After the rotation the ordering is an artefact of two approximate creation times, so the assertion would fail the day someone reads the real values and finds the other key came first — a guard refusing its own documented fix, which is the shape of the literal pin this file already removed once. Dropped, with the reasoning in the docstring. `name in KEY_EXPIRY` stood in its place briefly and was removed too: `days_until_earliest_expiry` returns `min(KEY_EXPIRY, ...)`, so it cannot fail. C-102's family. An assertion that cannot fire reads as cover. 3. `"1h00m apart"` had the same defect. Under the old constants 3h35m was C-84's actual finding and worth pinning; it is now an artefact of the same invented times. Replaced with a format assertion, `\d+h\d{2}m apart`, which proves the gap still renders without pinning a number this file says it invented. Mutation-proven: deleting {gap} from the message fails it. Suite: 526 passed, 3 skipped, 41 xfailed. ruff clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ANY1CCy9Xo7zjMY4XJ69v9
…0-29 chore(creds): both platform keys rotated — tripwire goes green on the fix, not the escape
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Opens
mainagainmainhas been gated since 2026-10-18, when the credential tripwire fired onthe date it had predicted since August. This is the change that clears it — by
rotation, not by acknowledgement.
ACKNOWLEDGED_UNTILwas never set. The requiredtestcheck passes because bothkeys were actually replaced.
What's in it
#321 — both platform Appwrite keys rotated (3 commits)
VIEWS Pipeline Core(36)pipeline-core-writerfaoapi-legacy-shared-RETIRING(36)faoapi-serverEach successor verified live before its predecessor was taken out of service:
appwrite_storeSTORE_ACTIVE (1007 files),unfao_deliveryDELIVERING, 3collections / 1006 documents, and views-faoapi's own smoke test ALL PASS with
appwrite=Trueand both legs serving 1,030 cells.Closes register C-84 (the 2026-11-17 total-outage risk) and C-110 (the
self-inflicted release block). Both moved to Resolved; open count 32 → 30.
#318 — the 40-lesson readiness falsification audit (docs only, already on
development).Why the tripwire's warning text changed
It described a property the keys no longer have. "Neither can carry traffic while
the other is replaced" was true only because both were 36-scope keys shared
across every identity on the seam. The successors serve different consumers with
different scopes, so the next rotation is two independent operations — and the
message now says to rotate them separately.
The finding worth carrying forward
Scope sets derived from source analysis were wrong twice — once by the
pipeline-core seat tracing every call site, once independently here. Appwrite has
split the scope vocabulary, and what actually authorises
appwrite==19.2.0is thescopes the console tags Deprecated. The server named them itself:
Create-before-delete made that discovery free — the old key carried production
throughout. ADRs requested at views-pipeline-core#572 and views-faoapi#543.
Review
Four review agents; the fourth found three real defects in the first commit, all
fixed in
c14de32:they do, their 2026-11-17 expiry had just been removed from
KEY_EXPIRY,creating the kind of unguarded date this file exists to prevent. Now stated
outright: the predecessors exist, nothing authenticates with them, the retained
fallback has a deadline, and the tripwire deliberately does not guard it.
have failed the day someone read the real times from the console. That is the
shape of the literal pin this file already removed once.
"1h00m apart"had the same defect; replaced with a format assertion,mutation-proven.
A replacement assertion (
name in KEY_EXPIRY) was itself removed on inspection —it cannot fail, and a guard that cannot fire reads as cover (C-102's family).
Residual, stated rather than left implicit
files.write/documents.writeonpipeline-core-writerare unproven —verifying them means writing to the production store. The predecessors are
retained as fallback until a real producer run exercises them, and that fallback
expires 2026-11-17.
faoapi-caller-faois unconfirmed, tracked atviews-faoapi#543.
Tests
Full suite green in CI:
Analyze (python),CodeQL,check-branch,testallpass.
🤖 Generated with Claude Code
https://claude.ai/code/session_01ANY1CCy9Xo7zjMY4XJ69v9