Expired daily files are pruned before a new backup, a verify older than 36 hours raises an alert, and the host monitors call sudo with the production env file. The Linux 0600 check is on the staging quick list.
Co-Authored-By: Grok (agent loop)
Safety-net records move to BUG-1358 through BUG-1361 because staging already uses BUG-1355 through BUG-1357 for capacity.
Co-Authored-By: Grok (agent loop)
Product chose to keep the scheduled backup, but the current recovery point must stay the one created by hand. Daily runs still encrypt and restore-verify, then record a separate latest-backup note.
Co-Authored-By: Grok (agent loop)
Consult, rectification turns, and report generation stop before a credit reservation when the product caps are hit. A full heavy-compute gate waits up to 8 seconds, and one consultation retries that 429 inside the same request.
Co-Authored-By: Grok (agent loop)
Host rehearsal no longer needs Node on the production machine, and a failed cleanup now stops with the rehearsal database name. Docs-only staging heads no longer block rollback. Tests no longer hardcode Windows paths, and a trailing slash on the production site still refuses the test code.
pytest 12 passed; tsc exit 0; lint 0 errors; identity tests 9 passed, 0 cancelled. test:db was not run.
Co-Authored-By: Grok (agent loop)
Gitea run 2828 validated, then publish hit the 60-minute deadline while
Aliyun apt/pip crawled at about 22 kB/s after a 72h cache prune on a
runner with 677 GiB free. Skip BuildKit prune when disk is above the
minimum, split API apt/pip layers, and point apt/pypi at Huawei Cloud.
Image build patches vedastro.check_for_update to a no-op after pip install so import cannot hit pypi or upgrade the pin. Free-tier queue waits are capped to VEDASTRO_TIMEOUT_SECONDS and fail fast as free_tier_rate_limited. Gateway status exposes runtime mode as booleans without secrets. BUG-719 resolved; BUG-720 stays investigating until production env is filled in.
Quality gate now dispatches Migrate Staging Database, waits for success, then dispatches Deploy staging. Automatic migrate attests the in-progress gate run so the two jobs cannot deadlock. Manual migrate is unchanged. Staging schema changes must stay backward-compatible with the currently deployed app.
Leave Migrate Staging Database deploy_sha empty (or type latest) to use the newest successful backend-quality-gate push. Filled 40-hex still takes the original path. Production workflows stay required.
Add Apache-2.0 @4n6h4x0r/stem-branch 0.8.0, a seven-governors adapter,
and POST /api/qizheng, /api/western, /api/ephemeris_events.
BUG-700 remains blocked (do not call --pillars). BUG-701 and BUG-702 are
resolved. BUG-703 is investigating (panchanga Lahiri). Skill is not bumped.
Engine calls already returned markdown; the worker failed because local postgres upsert required onConflict and the appendix write omitted it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Staging PostgREST rejects the executiveSummary JSON-path alias, so GET /api/reports 500s. Persist a plain card_summary column from the Markdown excerpt instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
Docs-only staging HEAD blocked Migrate Staging Database even when an ancestor already had a successful exact-SHA gate, so pending SQL could not be applied.
Co-authored-by: Cursor <cursoragent@cursor.com>
Twenty-four of the last sixty staging pushes were pure documentation, yet each
one ran (and cancelled) the full gate and image publish. Introduce
deploy/gated-paths.txt as the single source of truth for what must rerun the
gate: every Dockerfile COPY source, the Python package inputs, the workflow and
build-context files, and the repository files frontend/tests read at gate time.
Both triggers of backend-quality-gate.yml now carry that exact list; pushes
that touch none of it neither run the gate nor cancel a running code gate.
Because staging head may then legitimately sit ahead of the last tested SHA,
add deploy/is-docs-only-range.sh: it proves <base> is an ancestor of <head>
and that no changed path matches a gated glob, from local history when it is
available and otherwise from the Gitea compare API (per-commit `files`, parent
walk for ancestry, total_commits cross-checked). The publish dispatch and the
deploy-staging head checks accept an advanced head only when that script
succeeds; diverged, older, or code-bearing heads are still refused. In
deploy-staging the check runs after the gate-attested controller bundle is
extracted so only the tested checker and path list are ever executed; the
manual rollback branch is unchanged.
AGENTS.md §6.3/§6.4 describe the new contract: `.deployment.gitCommit` must
equal the latest staging commit that touched a gated path, not staging head.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VawU7Xfd5jS9wUEXz1XYmS
deploy/reclaim-runner-disk.sh ran `docker builder prune --force --all` at the
start of every gate job, so each publish rebuilt the Dockerfile `npm ci` layer
from scratch behind the registry mirror (7-minute image builds became 47).
Reclaim build cache in tiers instead: prune entries unused for 72h, re-measure
free space, and escalate to `--all` only while still below MINIMUM_FREE_GIB.
The final threshold check and the "only unheld resources" rules are unchanged.
Contract test asserts the aged prune runs first and that `--all` is only
reachable inside the re-measured conditional.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VawU7Xfd5jS9wUEXz1XYmS
Gitea (git.copse.top) is the only CI/CD control plane; GitHub is a
read-only mirror whose Actions are being disabled in repository settings.
- Delete all 11 `.github/workflows/*.yml` (stale copies of the old design).
- Delete unused Gitea manual workflows `ci.yml`, `test.yml`,
`publish-pypi.yml`, `apply-supabase-profile-migrations.yml`
(0-1 historical runs, no remaining target).
- Fold the full `python -m pytest` tree and `tests/run_all.py` into
`release-quality-gate.yml`, which previously only ran the curated
release profile; update the `run_quality_gate.py` comment accordingly.
- Port `reset-staging-account.yml` to Gitea: `runs-on: xiaoxin`, bounded
exact-SHA checkout, `refs/heads/staging` only, `staging-mutation`
concurrency, same email/confirmation/host/port/user/path assertions.
- Repoint frontend workflow tests at `.gitea/workflows/`, drop the
GitHub-only assertions, add coverage for the new reset workflow, and
remove `tests/test_supabase_profile_migration_workflow.py`.
- Update AGENTS.md §6.8, README.md, and deploy/README.md to the current
production/mirror facts and document the staging account reset.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VawU7Xfd5jS9wUEXz1XYmS
Keep async job and chart-cache files across API recreates, freeze jyotish_api_server.py growth, and fail fast with 429 when rectification or high-rigor compute is saturated.
Co-authored-by: Cursor <cursoragent@cursor.com>
Homepage bootstrap never escaped the loading shell when a new web image changed chunk hashes. Stamp deploymentId, stop caching chat HTML, and hard-reload failed chunk loads once.
Co-authored-by: Cursor <cursoragent@cursor.com>
Staging publish failed resolving python:3.12-slim through m.daocloud.io; the web image already uses the reachable SWR docker.io/library path.
Co-authored-by: Cursor <cursoragent@cursor.com>
Manual SKILL.md updates were blocked by registry sha256 and a byte-equal versions/ gate. Consult now loads the operator-maintained tree; rectification and personal-report stay hashed.
Co-authored-by: Cursor <cursoragent@cursor.com>
xiaoxin's 20-core npm test opened one Docker network per database file and exhausted default address pools. Limit concurrent fixtures and remove unused jyotisha-postgres networks before the gate.
Co-authored-by: Cursor <cursoragent@cursor.com>
Next's output file tracing pulls skills/ into .next/standalone with symlinks
resolved into real directories. The final stage copies the standalone bundle
into /app first, so the later explicit `COPY skills /app/skills` tries to put
the tracked symlink skills/jyotish-vedic-astrology/assets -> ../../assets on
top of a real directory. Whether that is fatal depends on the BuildKit
snapshotter: GitHub's runners tolerate it, Docker 29.1.3 with
containerd-overlayfs refuses with "cannot replace to directory ... with file".
Dropping the traced copy after the build lets the explicit COPY own that tree
deterministically. /app/assets still comes from the standalone bundle, which
outputFileTracingIncludes guarantees, so the symlink resolves.
Verified by building the image and inspecting it: skills/ complete at 1208
files, assets still a symlink that resolves, container boots on Next.js
16.3.1 and serves / with HTTP 200. Reproduced the original failure on the
pre-upgrade commit too, so it predates the Next 16.3.1 upgrade.
Co-authored-by: Cursor <cursoragent@cursor.com>
The staging host currently has .state/deployed-revision unreadable by the
deploy user, so the forward-only revision check failed with 'Permission
denied' before it could compare revisions. Treat an unreadable state file
like a missing one and discover the running revision from the web
container's GITHUB_SHA, in both the workflow step and the server-side
deploy/migration scripts.
- IDENTITY_TEST_OTP env: when set to a 6-digit code, no real email is
delivered; login page surfaces the fixed code so testers can register
and sign in without a mailbox. Opt-in, never set in production.
- email-otp-login: test-channel notice with the pinned code.
- Rectification candidate list restyled with the project design system
(warm canvas, action color, display serif, soft shadow, hover lift).
- Regression tests for config parsing, pinned OTP generation, login UI
notice, and candidate card styles.
