Repository navigation
feat(sp01): SafePush admission, RSI promotion gate and slice oracles - #168
Open
trukhinyuri wants to merge 3 commits into
Open
trukhinyuri wants to merge 3 commits into
trukhinyuri wants to merge 3 commits into
Conversation
trukhinyuri
force-pushed
the
codex/safepush-admission
branch
from
November 1, 2026 17:10
ec1cc52 to
eb45b0c
Compare
Signed-off-by: Iurii Trukhin <yuri@trukhin.com>
trukhinyuri
force-pushed
the
codex/safepush-admission
branch
from
November 6, 2026 00:02
eb45b0c to
e982c7b
Compare
…ce delivery contract SP01 adds the guardrails that let a delivery slice be accepted against a pre-approved oracle instead of waiting on a per-slice manual sign-off: - pkg/rsi: deterministic promotion gate (G1-G7) with change classes K0-K4, protected control files, two-slot last-known-good rollback invariants (S1-S6), mutation, holdout and seeded-error thresholds, and a kill switch that lowers the autonomy ceiling when the change failure rate is exceeded. - pkg/sliceoracles and contracts/slice-oracles/oracles-32.json: the batch of 32 slice oracles (C01-C28, SP01, DBAAS, DNSAAS, FILESAAS), the split of hardware-gated slices, and validation that two concurrent write PRs own disjoint paths. - roadmap: C15-C17, C20 and the standalone OCS services split into CORE (after C11) and QUAL (after C13 and C14); C24 follows C14; at most two concurrent write PRs per repository for distinct slices.
trukhinyuri
changed the title
The SP01 oracle could never pass. There was no evaluate command and no slice profile. Every candidate also needed a live canary, deploy history and a recovery drill, although a merge into this repository deploys nothing. pkg/rsi now separates merge admission from deploy admission. Deploy admission runs every gate and needs an S1-S6 receipt. A merge claim with deployment evidence is evaluated as deploy. Merge admission is allowed only into opencloudtech/CloudRING main. A first deploy without history needs K4. Profile keys must match field names exactly, and references must name a record. cloudringctl rsi evaluate runs a slice profile. All 32 slice oracles use it, and the declared class of each oracle covers its allowed paths. cmd/cloudring-mutation measures G2 on the changed lines. It mutates the files go build compiles, needs a green baseline before and after the mutants, and confirms each kill with a second failing run. gremlins v0.6.0 counted build failures as kills and never ran the tests of cmd/ packages, so its statuses are no longer used. EXECUTION_CONTRACT.md documents the admission rules and the G2 method.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR delivers slice SP01 from
roadmap/DELIVERY_SLICES.md. C02 and C08 promotion depend on it.SafePush checks GitHub CI workflow-run provenance before it admits a push. This part is the earlier SafePush branch with 15 files.
pkg/rsiadds a deterministic promotion gate. It classifies each change and protects control files. It keeps two last-known-good slots and enforces invariants S1–S6. A kill switch lowers the autonomy ceiling when the change failure rate is too high.pkg/sliceoraclesloads 32 slice oracles fromcontracts/slice-oracles/oracles-32.json. It allows at most two concurrent write PRs per repository. They must target different slices and disjoint paths. Paths are normalized before the check.The roadmap splits core and qualification work for the service slices. C24 now follows C14. C02 now requires SP01.
Checked locally on the branch head.
go vetis clean.go testpasses in 60 packages. Thepkg/rsifuzz test passes for 20 seconds. GitHub Actions has not run yet.