admin
7e1d2898bd
gates / gates (push) Successful in 8s
R-216, the hub half. ResolveManagedFloor's own comment says it exists to "never push a controller past the agent it depends on", and it compared against ArtifactManifest.MinAgent — which by ITS own comment describes the GOLDEN's controller. publish-train-rules.md rule 3 states the rule about the FLOOR's controller. Measured live: golden 0.192.0 / MinAgent 0.113.0, floor 0.200.0, agent 0.120.0 — served, and the box was pushed onto a controller needing agent 0.125.0. A floor ABOVE the vouched golden is now HELD with its own reason (HeldBeyondGolden), reusing Part D's dashboard visibility. Nobody types a number twice: the vouched MinAgent keeps its meaning, the guard stops applying it to versions it does not describe. An uncoupled release is untouched; an unparseable golden degrades rather than gating. R-222: the report ACK's escrow object gains superseded_present / superseded_at, counting only rows that actually carry an identity blob. One boolean and one timestamp, for one message. No read path — that link is still unbuilt. Red-proof: removing the floor-above-golden branch reproduces the campaign's measurement.
183 lines
7.8 KiB
Go
183 lines
7.8 KiB
Go
package store
|
|
|
|
import "testing"
|
|
|
|
// setHostAgent enrolls a host for customerID and records its agent version (the reality column).
|
|
func setHostAgent(t *testing.T, s *Store, customerID, hostID, agentVer string) {
|
|
t.Helper()
|
|
if err := s.UpsertHost(&Host{HostID: hostID, CustomerID: customerID, APIKey: hostID + "-key"}); err != nil {
|
|
t.Fatalf("UpsertHost: %v", err)
|
|
}
|
|
if agentVer != "" {
|
|
if err := s.SaveHostReport(hostID, customerID, []byte(`{}`), HostReportDenorm{AgentVersion: agentVer}); err != nil {
|
|
t.Fatalf("SaveHostReport: %v", err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// ResolveManagedFloor gates the served controller floor on the box's agent meeting the golden's
|
|
// MinAgent (Part D — the hub-enforced "agent BEFORE controller floor" rule).
|
|
func TestResolveManagedFloor(t *testing.T) {
|
|
base := func(t *testing.T) *Store {
|
|
s := newTestStore(t)
|
|
_ = s.SetGlobalMinControllerVersion("0.113.0") // the controller floor
|
|
return s
|
|
}
|
|
|
|
t.Run("uncoupled release (MinAgent empty) → serve the floor, no gating", func(t *testing.T) {
|
|
s := base(t)
|
|
_ = s.SetArtifactManifest(ArtifactManifest{GoldenVersion: "0.113.0", MinAgent: ""})
|
|
setHostAgent(t, s, "c1", "h1", "0.70.0") // ancient agent, but release is uncoupled
|
|
fd := s.ResolveManagedFloor("c1")
|
|
if fd.Held || fd.Floor != "0.113.0" {
|
|
t.Fatalf("uncoupled must serve: %+v", fd)
|
|
}
|
|
})
|
|
|
|
t.Run("agent ≥ MinAgent → serve the floor", func(t *testing.T) {
|
|
s := base(t)
|
|
_ = s.SetArtifactManifest(ArtifactManifest{GoldenVersion: "0.113.0", MinAgent: "0.81.0"})
|
|
setHostAgent(t, s, "c1", "h1", "0.82.0")
|
|
fd := s.ResolveManagedFloor("c1")
|
|
if fd.Held || fd.Floor != "0.113.0" {
|
|
t.Fatalf("at/above MinAgent must serve: %+v", fd)
|
|
}
|
|
})
|
|
|
|
t.Run("agent < MinAgent → HELD, no floor served, flagged", func(t *testing.T) {
|
|
s := base(t)
|
|
_ = s.SetArtifactManifest(ArtifactManifest{GoldenVersion: "0.113.0", MinAgent: "0.81.0"})
|
|
setHostAgent(t, s, "c1", "h1", "0.79.0")
|
|
fd := s.ResolveManagedFloor("c1")
|
|
if !fd.Held || fd.Floor != "" {
|
|
t.Fatalf("below MinAgent must HOLD: %+v", fd)
|
|
}
|
|
if fd.AgentVersion != "0.79.0" || fd.MinAgent != "0.81.0" {
|
|
t.Fatalf("held decision must carry the inputs: %+v", fd)
|
|
}
|
|
})
|
|
|
|
t.Run("agent_version empty (never reported) → HELD (fail-safe)", func(t *testing.T) {
|
|
s := base(t)
|
|
_ = s.SetArtifactManifest(ArtifactManifest{GoldenVersion: "0.113.0", MinAgent: "0.81.0"})
|
|
setHostAgent(t, s, "c1", "h1", "") // enrolled, no report yet
|
|
fd := s.ResolveManagedFloor("c1")
|
|
if !fd.Held || fd.Floor != "" {
|
|
t.Fatalf("unknown agent must HOLD (never push blind): %+v", fd)
|
|
}
|
|
})
|
|
|
|
t.Run("no floor configured → nothing to gate", func(t *testing.T) {
|
|
s := newTestStore(t) // no global floor
|
|
_ = s.SetArtifactManifest(ArtifactManifest{MinAgent: "0.81.0"})
|
|
setHostAgent(t, s, "c1", "h1", "0.70.0")
|
|
fd := s.ResolveManagedFloor("c1")
|
|
if fd.Held || fd.Floor != "" {
|
|
t.Fatalf("no floor → no gate, no hold: %+v", fd)
|
|
}
|
|
})
|
|
|
|
// Fleet discriminator (the §Part-D companion): in ONE fleet, an at-MinAgent box is served while a
|
|
// below-MinAgent box is held. Companion red-proof: drop the hold branch → both get served → the
|
|
// held assertion fails.
|
|
t.Run("fleet: at-MinAgent served, below-MinAgent held", func(t *testing.T) {
|
|
s := base(t)
|
|
_ = s.SetArtifactManifest(ArtifactManifest{GoldenVersion: "0.113.0", MinAgent: "0.81.0"})
|
|
setHostAgent(t, s, "current", "hc", "0.82.0")
|
|
setHostAgent(t, s, "old", "ho", "0.79.0")
|
|
if fd := s.ResolveManagedFloor("current"); fd.Held || fd.Floor != "0.113.0" {
|
|
t.Errorf("current box must be served: %+v", fd)
|
|
}
|
|
if fd := s.ResolveManagedFloor("old"); !fd.Held || fd.Floor != "" {
|
|
t.Errorf("old box must be held: %+v", fd)
|
|
}
|
|
})
|
|
}
|
|
|
|
// ── R-216: the floor may not be served ABOVE the version the manifest describes ─────────────────
|
|
//
|
|
// `publish-train-rules.md` rule 3 is about the FLOOR's controller; the implementation compared
|
|
// against the GOLDEN's MinAgent. Those are the same number only while the floor sits at or below the
|
|
// golden. Measured live 2026-08-05 (CAMPAIGN-11 Phase 1): golden 0.192.0 / MinAgent 0.113.0, a
|
|
// per-customer floor of 0.200.0, a box on agent 0.120.0 — 0.120.0 ≥ 0.113.0, so the floor was served
|
|
// and the box was pushed onto a controller needing agent 0.125.0. Its customer was then told their
|
|
// correct recovery code was wrong.
|
|
//
|
|
// RED-PROOF: delete the `semver.Compare(d.Floor, d.GoldenVersion) > 0` branch from
|
|
// ResolveManagedFloor and TestResolveManagedFloor_R216_FloorAboveGolden FAILS — the box is served
|
|
// past its agent again, reproducing the campaign's measurement exactly. Demonstrated failing before
|
|
// these tests were kept.
|
|
func TestResolveManagedFloor_R216_FloorAboveGolden(t *testing.T) {
|
|
t.Run("the campaign's exact numbers → HELD, not served", func(t *testing.T) {
|
|
s := newTestStore(t)
|
|
_ = s.SetGlobalMinControllerVersion("0.200.0")
|
|
_ = s.SetArtifactManifest(ArtifactManifest{GoldenVersion: "0.192.0", MinAgent: "0.113.0"})
|
|
setHostAgent(t, s, "c11", "c11-36d660", "0.120.0")
|
|
|
|
fd := s.ResolveManagedFloor("c11")
|
|
if !fd.Held || fd.Floor != "" {
|
|
t.Fatalf("R-216 RETURNED: a floor ABOVE the vouched golden was served, so the hub pushed a controller whose agent requirement it does not know: %+v", fd)
|
|
}
|
|
if !fd.HeldBeyondGolden {
|
|
t.Errorf("the hold must be distinguishable from the ordinary below-MinAgent hold (they need different operator text): %+v", fd)
|
|
}
|
|
if fd.GoldenVersion != "0.192.0" {
|
|
t.Errorf("the decision must carry the golden it compared against: %+v", fd)
|
|
}
|
|
})
|
|
|
|
// The hold is about the FLOOR being unknown, not about the agent — so it holds even for a box
|
|
// whose agent comfortably exceeds the manifest's MinAgent. That is the whole point: the hub cannot
|
|
// know what the served version needs.
|
|
t.Run("held even when the agent clears the manifest's MinAgent", func(t *testing.T) {
|
|
s := newTestStore(t)
|
|
_ = s.SetGlobalMinControllerVersion("0.200.0")
|
|
_ = s.SetArtifactManifest(ArtifactManifest{GoldenVersion: "0.192.0", MinAgent: "0.113.0"})
|
|
setHostAgent(t, s, "c1", "h1", "0.125.0")
|
|
|
|
if fd := s.ResolveManagedFloor("c1"); !fd.Held {
|
|
t.Fatalf("a floor above the golden must hold regardless of the agent: %+v", fd)
|
|
}
|
|
})
|
|
|
|
// SCENARIO C — an uncoupled release is untouched. A fleet must not be frozen by a comparison that
|
|
// now over-fires: with no MinAgent vouched there is no gating at all, above the golden or not.
|
|
t.Run("uncoupled release above the golden → still served (Scenario C)", func(t *testing.T) {
|
|
s := newTestStore(t)
|
|
_ = s.SetGlobalMinControllerVersion("0.200.0")
|
|
_ = s.SetArtifactManifest(ArtifactManifest{GoldenVersion: "0.192.0", MinAgent: ""})
|
|
setHostAgent(t, s, "c1", "h1", "0.70.0")
|
|
|
|
fd := s.ResolveManagedFloor("c1")
|
|
if fd.Held || fd.Floor != "0.200.0" {
|
|
t.Fatalf("an uncoupled release must be served exactly as before: %+v", fd)
|
|
}
|
|
})
|
|
|
|
// The ordinary arrangement — floor at or below the golden — is completely unchanged.
|
|
t.Run("floor at the golden → unchanged behaviour", func(t *testing.T) {
|
|
s := newTestStore(t)
|
|
_ = s.SetGlobalMinControllerVersion("0.192.0")
|
|
_ = s.SetArtifactManifest(ArtifactManifest{GoldenVersion: "0.192.0", MinAgent: "0.113.0"})
|
|
setHostAgent(t, s, "c1", "h1", "0.120.0")
|
|
|
|
fd := s.ResolveManagedFloor("c1")
|
|
if fd.Held || fd.Floor != "0.192.0" {
|
|
t.Fatalf("floor == golden with a satisfied MinAgent must serve: %+v", fd)
|
|
}
|
|
})
|
|
|
|
// An unreadable golden must not gate the fleet — degrade to the pre-existing behaviour.
|
|
t.Run("unparseable golden → falls through to the agent comparison", func(t *testing.T) {
|
|
s := newTestStore(t)
|
|
_ = s.SetGlobalMinControllerVersion("0.200.0")
|
|
_ = s.SetArtifactManifest(ArtifactManifest{GoldenVersion: "", MinAgent: "0.113.0"})
|
|
setHostAgent(t, s, "c1", "h1", "0.120.0")
|
|
|
|
fd := s.ResolveManagedFloor("c1")
|
|
if fd.Held || fd.Floor != "0.200.0" {
|
|
t.Fatalf("an unknown golden must not freeze the fleet: %+v", fd)
|
|
}
|
|
})
|
|
}
|