root/Jyotisha
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(staging): refresh dual-host edge verification
Staging Backend Quality Gate / validate (pull_request) Successful in 17m22s
Details
Staging Backend Quality Gate / publish (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
Jesse
2026-08-07 01:46:47 +08:00
parent 28f4207f29
commit e718b2c6d9
4 changed files with 40 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/research/pre_work_error_ledger.md
+6
View File
@@ -181,6 +181,12 @@ Exact-SHA gate `1514` and migration `1516` succeeded, but deploy runs `1517` and
Prevention: within the existing bounded 60-second budget, retry the complete predicate set together: login, admin redirect, logged-out admin/account responses, public exact SHA, private API status, and Swiss Ephemeris availability. Success requires every predicate in the same attempt. On exhaustion, fail closed and emit only redacted status codes, observed SHA, and health booleans; never log response bodies, env, credentials, or error stacks.
## ERR-101 | Atomic Caddyfile replacement left the running Caddy bind-mounted to the old inode | investigating 2026-08-06
The bounded verifier in deploy `1522` proved that public health had converged to the target exact SHA and private API/Swiss checks passed, but admin checks on the user host returned the expected application fail-closed statuses rather than admin-host statuses. Read-only host inspection then found the reviewed host `deploy/Caddyfile.staging` contained the admin virtual host while `/etc/caddy/Caddyfile` inside the long-running Caddy container did not; their inode, size, and mtime differed even though Docker reported the expected bind source. The tree sync atomically replaced the source file, leaving the existing bind mount attached to the old inode. Both authoritative Spaceship nameservers returned the staging VPS address for the admin host when queried from the VPS, so this was not an absent DNS record. The failed deploy restored the prior application and did not advance deployed-revision.
Prevention: after syncing a gate-attested single-file bind mount, force-recreate Caddy under the shared host lock before public verification. Verify user and admin origins separately: user-host admin paths must be 404; admin-host anonymous page/API must be 307-to-login and 401. Preserve bounded convergence, exact public SHA, private health, automatic rollback, and redacted diagnostics. Do not weaken identity host routing or modify DNS based on intercepted local resolver results.
## Fragment Sweep Command Set
## ERR-086 | Steve Jobs jyotishganit artifacts used non-San-Francisco coordinates | mitigated 2026-07-21