admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

GL-6 F4 fix: v1.11.3 — --resume repopulates producer-step outputs

Browse Source 
Live-found in the GL-6 drill: `should_skip X || step_X` fully skips a
completed step on --resume, but token/enroll/grows produce IN-MEMORY
outputs (pve token; hub host_id/api_key; volume grows) that later steps
consume — agent_config writes them into the config, provision passes the
grows as flags. A resume that had completed token/enroll but not
agent_config wrote a config missing hub.host_id/proxmox.token (daemon
crash-loop, "hub.host_id is required"); a resume past grows passed
`-rootfs-grow ""` (flag parse error). step_token even had an internal
resume-guard the `|| step_token` dispatch defeated.

Fix: token/enroll/grows now run every pass (all idempotent — token
reuses-or-rotates from the on-disk config, enroll is mint-once-reuse,
grows is a pure recompute); the guard uses _state_has (no misleading
SKIP log). golden's GOLDEN_VOLID is re-derived from the local archive in
the resume block so provision never gets an empty -archive. Harness
+GL6-F4 invariant; 27/27; shellcheck clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-08 13:01:33 +02:00
parent 4cb70ff88b
commit 98bf5a434f
2 changed files with 42 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/hostinstall-mode-harness.sh
+11
View File
@@ -281,6 +281,17 @@ else
verdict FAIL "GL6-ANON empty-cred anonymous-fetch fallback (warn-not-die + conditional auth)"
fi
# GL6-F4 (v1.11.3): the producer steps token/enroll/grows must run UNCONDITIONALLY (not behind
# `should_skip … ||`) so --resume repopulates the in-memory outputs later steps consume; and the
# resume block must re-derive GOLDEN_VOLID from the local archive when golden already completed.
if grep -qE '^step_token$' "$SCRIPT" && grep -qE '^step_grows$' "$SCRIPT" && grep -qE '^step_enroll$' "$SCRIPT" \
&& ! grep -qE 'should_skip (token|grows|enroll) +\|\| +step_' "$SCRIPT" \
&& grep -q 'golden (resumed from local)' "$SCRIPT"; then
verdict PASS "GL6-F4 resume repopulates producer outputs (token/enroll/grows unconditional + golden re-derive)"
else
verdict FAIL "GL6-F4 resume repopulates producer outputs (token/enroll/grows unconditional + golden re-derive)"
fi
# GL4-INV: no forced/lazy unmount and no format op on the drives root — REAL invocations only
# (comment lines and log_* guidance strings legitimately SAY "never umount -l/-f").
if ! grep -vE '^[[:space:]]*#|log_(warn|info|dry|error|success|skip)' "$SCRIPT" | grep -E 'umount +-(l|f)' >/dev/null \