Repository navigation
feat(OMN-15521): sanctioned .201 gateway-forwarder deploy path - #2611
Conversation
- scripts/deploy-gateway.sh: builds the omninode-gateway forwarder image from this repo checkout with the same OCI provenance build-args every omnibase-infra runtime container gets (VCS_REF, RUNTIME_VERSION, BUILD_DATE, COMPOSE_PROJECT, RUNTIME_SOURCE_HASH, PROMOTION_CLASS, NON_MAIN_LINEAGE), pins the running container to the resulting image digest, syncs the host compose files from this checkout (replacing the 2026-07-29 hand-copy), and records a rollback target via a registry.json mirroring the omnibase-infra lanes own convention. - docs/runbooks/gateway-lane-deploy.md: procedure + rollback runbook alongside docs/runbooks/cold-lane-full-bringup.md. - tests/scripts/test_deploy_gateway.py: subprocess-driven RED-before/ GREEN-after coverage against the real script (fake docker/sudo), one case per OMN-15521 acceptance criterion (AC1/2/3/4/6; AC5 is explicitly out of scope, it lands on OMN-12912).
macOS ships /bin/bash 3.2.57 (Apple has not updated past 3.2 since bash moved to GPLv3) with no readarray/mapfile (bash 4+) and no local -n namerefs (bash 4.3+). The pre-push governed-selector hook invokes this script under plain bash, which resolves /bin/bash 3.2 in that non- interactive shell -- readarray failed there even though it silently worked under a newer bash picked up by an interactive PATH. Replaced with an inlined while-read-into-array loop at each of the two call sites, matching the rest of scripts/ (deploy-runtime.sh and siblings use no bash-4-only constructs). Re-verified: /bin/bash -n syntax check, a live /bin/bash --print-compose-cmd run, and the full governed-selector scope (scripts/tests/ tests/scripts/ tests/unit/scripts/, 1535 passed / 5 skipped) all green on this host.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 2 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
Comment |
#5862) * evidence: OCC companion pass 1 for OmniNode-ai/omnibase_infra#2611 * evidence: OCC companion self-bind for #5862 --------- Co-authored-by: node-occ-companion-effect <occ-companion-effect@omninode.ai>
|
| Verdict | Meaning | Blocks merge? |
|---|---|---|
passed |
No critical findings | No |
blocked |
CRITICAL findings found | Yes |
degraded |
All models unavailable (infra) | No (pilot) |
Powered by omniintelligence.review_pairing.cli_review — node-based adversarial review via HandlerLlmCliSubprocess (OMN-8468/OMN-8524)
1 participant
OMN-15521 — The .201 gateway-forwarder lane has no sanctioned deploy path
Closes the repo-side + live-deploy gap described in OMN-15521:
omninode-gateway(the
.201operator-edge forwarder bridging cloud MSK → local Redpanda forcloud→local inference, per operator ruling 2026-08-01T17:20Z — "what we are
trying to do is connect our cloud architecture to our 201 box so that we can
use local inference") was hand-deployed on 2026-07-29 by copying files into a
root-owned
/opt/omninode/gateway, was outsidedeploy-runtime.sh's-p omnibase-infrascope, carried noorg.opencontainers.image.revisionlabel, and had no recorded rollback target.
What this adds
scripts/deploy-gateway.sh— builds the gateway-forwarder image from thisrepo checkout with the same OCI provenance build-args every
omnibase-infraruntime container gets, pins the running container to theresulting image digest (never
:latest— the existing systemd unit'sExecStartPrealready hard-asserts a realsha256:<64 hex>), syncs thehost compose files from this checkout (replacing the 2026-07-29 hand-copy
as the source of truth), and records a rollback target via a
registry.jsonmirroring theomnibase-infralane's own convention.docs/runbooks/gateway-lane-deploy.md— procedure + rollback runbookalongside
docs/runbooks/cold-lane-full-bringup.md.tests/scripts/test_deploy_gateway.py— 16 subprocess-driven tests againstthe real script (fake
docker/sudo, matching the existingtest_deploy_runtime_promotion_class.pyconvention), RED-before/GREEN-afterper acceptance criterion.
Seam definition
Fields/paths this change reads or writes across a boundary:
docker/docker-compose.gateway.ymlbuild-argsdocker compose buildVCS_REF,RUNTIME_VERSION,BUILD_DATE,COMPOSE_PROJECT=omninode-gateway,RUNTIME_SOURCE_HASH,BUILD_SOURCE/EXPECTED_BUILD_SOURCE(release),PROMOTION_CLASS(clean-main),NON_MAIN_LINEAGE(false) — same namesdeploy-runtime.sh'sbuild_images()passesdocker image inspect --format='{{.Id}}'→ scriptsha256:<64 hex>digest, read fromorg.opencontainers.image.revision/com.omninode.build_sourceon readback/etc/omninode/gateway/gateway.envGATEWAY_IMAGE=line rewritten to the new digest; every other key (GATEWAY_AWS_*,GATEWAY_TPM_*,GATEWAY_CONTAINER_*) preserved untouched, sourced by the script for compose interpolation/opt/omninode/gateway/{docker-compose.gateway.yml,gateway/beta-gateway-canary.yaml}sudo install -m 0444 -o root -g root)~/.omnibase/gateway/registry.jsonactive_version,git_sha,active_digest,previous_digest,deployed_at,compose_project,gateway_env_file,host_compose_file,rollback_commandonex-gateway-forwardersystemd unitsudo systemctl reloadgateway.envdigest via its existingExecReloaddocker exec omninode-gateway-forwarderls .../nodes/node_bus_forwarder_effect/services/service_gateway_delivery.py,ls .../idempotency/store_sqlite.pyAcceptance-criterion → test map
test_script_exists_and_is_executable,test_runbook_exists_alongside_cold_lane_bringup,test_print_compose_cmd_targets_repo_resident_compose_project(asserts-p omninode-gateway -f docker/docker-compose.gateway.yml, refutes any/opt/omninode/gatewayliteral),test_dry_run_default_performs_no_mutation,test_execute_without_env_file_fails_closedimage.revision/build_source)test_build_command_stamps_oci_provenance_build_args,test_current_compose_file_declares_no_provenance_build_args(RED-before control: the compose file's ownbuild.argsblock never carried these — matches the ticket'srev=(empty)finding),test_execute_deploy_produces_non_empty_image_labelstest_verify_deployment_red_before_files_absent(RED) /test_verify_deployment_green_after_files_present(GREEN) — mechanism-level proof against a fakedocker exec; live proof also captured this session (see below)test_sync_host_files_red_before_stale_copy_diverges(RED) /test_sync_host_files_green_after_diff_is_empty(GREEN, asserts byte-identical compose + canary yaml)test_execute_deploy_writes_registry_with_rollback_target,test_second_deploy_records_previous_digest_as_first_deploys_active(rollback chains correctly across deploys),test_skip_reload_leaves_container_on_previous_digestLive execution against
.201this session (ACs 2/3/4/6, real box)Ran
scripts/deploy-gateway.sh --executeagainst the canonicalomnibase_infraclone on
.201(beebd1d636b9, ancestor of mergeddev, includes #2556):Out-of-band finding, filed separately, not folded into this PR's scope:
restarting the container surfaced a genuinely pre-existing, unrelated defect —
the local
.201broker had never provisionedonex.evt.omnibase-infra.gateway-heartbeat.v1(a topicnode_bus_forwarder_effect/contract.yamlhas declared since before #2556;confirmed via
git show 2375c25a4touching neither the topic list normirror_topic_set). Masked for 3 days because the hand-built container wasnever restarted. Applied a one-off
rpk topic createstopgap to reach agenuinely healthy container and prove the ACs live; filed OMN-15629 for
the durable fix (provisioning should be repo-resident and contract-driven,
not a manual
rpkcommand).Notes
f91527bc23) fixes areadarray/local -n(bash 4+)portability bug in this script itself — macOS ships
/bin/bash3.2 (noreadarray, no namerefs), and the governed pre-push selector invokes thisscript under plain
bash. Rewrote both call sites as inlinedwhile-read-into-array loops (bash-3.2-portable, matching
deploy-runtime.sh's own convention of avoiding bash-4-only constructs).stickybeatz-studio(.200) via patch-transfer withsha256 verification of every changed file (
gates_host=.200). Pre-pushgoverned selector:
scripts/tests/ tests/scripts/ tests/unit/scripts/,1535 passed / 5 skipped (skips are pre-existing, GNU-
realpath/opt-in-fenceplatform gates unrelated to this change).
Evidence-Source: 7b43c030ae0281c9a6d9dc5f863817546b739486
Evidence-Ticket: OMN-15521