mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: remove stale code queue execution gate

Browse Source
This commit is contained in:
Codex
2026-05-29 02:36:29 +00:00
parent 8b76f455ad
commit 5b01dad112
6 changed files with 6 additions and 391 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/src/check.ts
-4
View File
@@ -49,7 +49,6 @@ const syntaxFiles = [
"scripts/code-queue-submit-summary-contract-test.ts",
"scripts/code-queue-cli-read-terminal-contract-test.ts",
"scripts/code-queue-gh-auth-redaction-contract-test.ts",
"scripts/code-queue-execution-plane-contract-test.ts",
"scripts/d601-recovery-guardrails-contract-test.ts",
"scripts/hwlab-cd-wrapper-contract-test.ts",
"scripts/code-queue-queues-shape-contract-test.ts",
@@ -363,7 +362,6 @@ export function runChecks(config: UniDeskConfig, options: CheckOptions = default
fileItem("scripts/code-queue-submit-summary-contract-test.ts"),
fileItem("scripts/code-queue-submit-routing-contract-test.ts"),
fileItem("scripts/code-queue-gh-auth-redaction-contract-test.ts"),
fileItem("scripts/code-queue-execution-plane-contract-test.ts"),
fileItem("scripts/code-queue-queues-shape-contract-test.ts"),
fileItem("scripts/code-queue-supervisor-disclosure-contract-test.ts"),
fileItem("scripts/code-queue-commander-view-contract-test.ts"),
@@ -424,7 +422,6 @@ export function runChecks(config: UniDeskConfig, options: CheckOptions = default
items.push(commandItem("code-queue:submit-summary-contract", ["bun", "scripts/code-queue-submit-summary-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:submit-routing-contract", ["bun", "scripts/code-queue-submit-routing-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:gh-auth-redaction-contract", ["bun", "scripts/code-queue-gh-auth-redaction-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:execution-plane-contract", ["bun", "scripts/code-queue-execution-plane-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:queues-shape-contract", ["bun", "scripts/code-queue-queues-shape-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:supervisor-disclosure-contract", ["bun", "scripts/code-queue-supervisor-disclosure-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:commander-view-contract", ["bun", "scripts/code-queue-commander-view-contract-test.ts"], 30_000));
@@ -470,7 +467,6 @@ export function runChecks(config: UniDeskConfig, options: CheckOptions = default
items.push(skippedItem("code-queue:submit-summary-contract", "Code Queue submit summary contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:submit-routing-contract", "Code Queue submit routing contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:gh-auth-redaction-contract", "Code Queue GitHub auth output redaction contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:execution-plane-contract", "Code Queue execution plane drift contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:queues-shape-contract", "Code Queue queues shape contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:supervisor-disclosure-contract", "Code Queue supervisor disclosure contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:commander-view-contract", "Code Queue commander view contract is opt-in with script checks", "--scripts-typecheck or --full"));
scripts/src/code-queue-execution-plane.ts
+2 -178
View File
@@ -11,7 +11,6 @@ interface ExecutionPlaneOptions {
worktreePath: string;
full: boolean;
raw: boolean;
skipProbe: boolean;
timeoutMs: number;
}
@@ -109,21 +108,6 @@ interface ResidualObservation {
};
}
interface JudgeProbeObservation {
ok: boolean;
attempted: boolean;
behaviorVersion: string | null;
expectedBehaviorVersion: string;
configured: boolean | null;
model: string | null;
hits: number | null;
total: number | null;
hitRate: number | null;
serviceProxyPath: string | null;
error: string | null;
raw: unknown;
}
export interface CodeQueueExecutionPlaneObservation {
checkedAt: string;
namespace: string;
@@ -135,7 +119,6 @@ export interface CodeQueueExecutionPlaneObservation {
services: ServiceObservation[];
worktree: WorktreeObservation;
residual: ResidualObservation;
judgeProbe: JudgeProbeObservation;
commandDiagnostics: Record<string, unknown>;
}
@@ -154,7 +137,6 @@ interface DriftSignal {
const expectedNamespace = "unidesk";
const expectedWorktreePath = "/home/ubuntu/cq-deploy";
export const expectedJudgeProbeBehaviorVersion = "code-queue-judge-probe:v1";
const expectedDeployments = [
{ name: "code-queue", role: "scheduler" as const, schedulerEnabled: "true" },
@@ -188,7 +170,7 @@ function parsePositiveInteger(value: string | undefined, fallback: number, max:
}
function parseExecutionPlaneOptions(args: string[]): ExecutionPlaneOptions {
const knownFlags = new Set(["--full", "--raw", "--skip-probe"]);
const knownFlags = new Set(["--full", "--raw"]);
const knownValues = new Set(["--namespace", "--kubeconfig", "--worktree", "--timeout-ms"]);
for (let index = 0; index < args.length; index += 1) {
const arg = args[index] ?? "";
@@ -207,7 +189,6 @@ function parseExecutionPlaneOptions(args: string[]): ExecutionPlaneOptions {
worktreePath: optionValue(args, ["--worktree"]) ?? expectedWorktreePath,
full: raw || hasFlag(args, "--full"),
raw,
skipProbe: hasFlag(args, "--skip-probe"),
timeoutMs: parsePositiveInteger(optionValue(args, ["--timeout-ms"]), 15_000, 60_000),
};
}
@@ -456,7 +437,6 @@ function collectResidual(): ResidualObservation {
worktreePath: expectedWorktreePath,
full: false,
raw: false,
skipProbe: true,
timeoutMs: 15_000,
};
const docker = runTran(["D601", "argv", "docker", "ps", "-a", "--filter", "name=code-queue-backend", "--format", "{{.Names}}\t{{.Status}}\t{{.Image}}"], remoteOptions, 15_000);
@@ -496,100 +476,6 @@ function collectResidual(): ResidualObservation {
};
}
function parseJson(text: string): unknown {
try {
return JSON.parse(text) as unknown;
} catch {
return null;
}
}
function asRecord(value: unknown): Record<string, unknown> | null {
return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record<string, unknown> : null;
}
function stringValue(value: unknown): string | null {
return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
}
function numberValue(value: unknown): number | null {
return typeof value === "number" && Number.isFinite(value) ? value : null;
}
function collectJudgeProbe(options: ExecutionPlaneOptions): JudgeProbeObservation {
if (options.skipProbe) {
return {
ok: false,
attempted: false,
behaviorVersion: null,
expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
configured: null,
model: null,
hits: null,
total: null,
hitRate: null,
serviceProxyPath: null,
error: "--skip-probe requested",
raw: null,
};
}
const paths = [
`/api/v1/namespaces/${options.namespace}/services/code-queue/proxy/api/judge/probe`,
`/api/v1/namespaces/${options.namespace}/services/code-queue:4222/proxy/api/judge/probe`,
`/api/v1/namespaces/${options.namespace}/services/code-queue:http/proxy/api/judge/probe`,
];
for (const path of paths) {
const probe = runKubectl(["--request-timeout=15s", "get", "--raw", path], options);
if (!probe.ok) continue;
const raw = parseJson(probe.stdout);
const record = asRecord(raw);
if (record === null) {
return {
ok: false,
attempted: true,
behaviorVersion: null,
expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
configured: null,
model: null,
hits: null,
total: null,
hitRate: null,
serviceProxyPath: path,
error: "judge probe returned non-JSON response",
raw: probe.stdout.slice(0, 2000),
};
}
return {
ok: record.ok === true,
attempted: true,
behaviorVersion: stringValue(record.behaviorVersion ?? asRecord(record.behavior)?.version ?? record.version),
expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
configured: typeof record.configured === "boolean" ? record.configured : null,
model: stringValue(record.model),
hits: numberValue(record.hits),
total: numberValue(record.total),
hitRate: numberValue(record.hitRate),
serviceProxyPath: path,
error: record.ok === true ? null : stringValue(record.error) ?? "judge probe returned ok=false",
raw,
};
}
return {
ok: false,
attempted: true,
behaviorVersion: null,
expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
configured: null,
model: null,
hits: null,
total: null,
hitRate: null,
serviceProxyPath: null,
error: "judge probe could not be read through Kubernetes API service proxy",
raw: null,
};
}
function digestFromText(value: string | null): string | null {
if (value === null) return null;
const match = value.match(/sha256:[0-9a-f]{64}/iu);
@@ -613,20 +499,6 @@ class LiveExecutionPlaneCollector implements ExecutionPlaneCollector {
services: [],
worktree,
residual,
judgeProbe: {
ok: false,
attempted: false,
behaviorVersion: null,
expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
configured: null,
model: null,
hits: null,
total: null,
hitRate: null,
serviceProxyPath: null,
error: "D601 k3s guard did not pass; runtime probe skipped",
raw: null,
},
commandDiagnostics: { guard: diagnostics },
};
}
@@ -641,7 +513,6 @@ class LiveExecutionPlaneCollector implements ExecutionPlaneCollector {
services: collectServices(options),
worktree,
residual,
judgeProbe: collectJudgeProbe(options),
commandDiagnostics: { guard: diagnostics },
};
}
@@ -800,34 +671,6 @@ function driftSignals(observation: CodeQueueExecutionPlaneObservation): DriftSig
});
}
if (!observation.judgeProbe.attempted) {
signals.push({
code: "deployment-drift",
severity: "warning",
field: "judgeProbe.behaviorVersion",
message: "/api/judge/probe behavior version was not checked",
expected: expectedJudgeProbeBehaviorVersion,
observed: observation.judgeProbe.error,
});
} else if (observation.judgeProbe.behaviorVersion !== expectedJudgeProbeBehaviorVersion) {
signals.push({
code: "deployment-drift",
severity: "blocker",
field: "judgeProbe.behaviorVersion",
message: "/api/judge/probe behavior version does not match the repo contract",
expected: expectedJudgeProbeBehaviorVersion,
observed: observation.judgeProbe.behaviorVersion,
});
} else if (!observation.judgeProbe.ok) {
signals.push({
code: "deployment-drift",
severity: "blocker",
field: "judgeProbe.ok",
message: "/api/judge/probe returned a non-ready result",
expected: true,
observed: observation.judgeProbe.error,
});
}
return signals;
}
@@ -881,23 +724,6 @@ function compactDeployment(deployment: DeploymentObservation): Record<string, un
};
}
function compactJudgeProbe(probe: JudgeProbeObservation, full: boolean): Record<string, unknown> {
return {
ok: probe.ok,
attempted: probe.attempted,
behaviorVersion: probe.behaviorVersion,
expectedBehaviorVersion: probe.expectedBehaviorVersion,
configured: probe.configured,
model: probe.model,
hits: probe.hits,
total: probe.total,
hitRate: probe.hitRate,
serviceProxyPath: probe.serviceProxyPath,
error: probe.error,
...(full ? { raw: probe.raw } : {}),
};
}
function evaluateObservation(observation: CodeQueueExecutionPlaneObservation, options: ExecutionPlaneOptions): Record<string, unknown> {
const formalSignals = observation.deployments.flatMap(deploymentFormalSignals);
const deploymentDriftSignals = driftSignals(observation);
@@ -939,7 +765,6 @@ function evaluateObservation(observation: CodeQueueExecutionPlaneObservation, op
artifactDigest: uniqueDigests.length === 1 ? uniqueDigests[0] : null,
deploymentCommit: uniqueCommits.length === 1 ? uniqueCommits[0] : null,
mountedWorktreeHead: observation.worktree.head,
judgeProbeBehaviorVersion: observation.judgeProbe.behaviorVersion,
},
guard: {
status: observation.guard.status,
@@ -959,7 +784,7 @@ function evaluateObservation(observation: CodeQueueExecutionPlaneObservation, op
signalCount: deploymentDriftSignals.length,
signals: deploymentDriftSignals.slice(0, options.full ? undefined : 5),
omittedSignals: options.full ? 0 : Math.max(0, deploymentDriftSignals.length - 5),
comparedFields: ["deployment env/annotation commit", "artifact digest", "mounted worktree HEAD", "/api/judge/probe behaviorVersion"],
comparedFields: ["deployment env/annotation commit", "artifact digest", "mounted worktree HEAD"],
},
residual: {
status: deprecatedResidualSignals.some((signal) => signal.code === "deprecated-compose-residual") ? "deprecated-compose-residual" : "none",
@@ -968,7 +793,6 @@ function evaluateObservation(observation: CodeQueueExecutionPlaneObservation, op
containers: observation.residual.composeBackend.containers,
listeners: observation.residual.loopbackPort4222.listeners,
},
judgeProbe: compactJudgeProbe(observation.judgeProbe, options.full),
blockers,
warnings,
commands: {
scripts/src/help.ts
+2 -2
View File
@@ -66,7 +66,7 @@ export function rootHelp(): unknown {
{ command: "codex prompt-lint [prompt|--prompt-file path|--prompt-stdin]", description: "Dry-run lint a runner prompt for DEV test class read-only/live-read/live-mutating authorization without echoing prompt text or touching live services." },
{ command: "codex submit [prompt] [--prompt-file path|--prompt-stdin] [--queue queueId] [--provider-id id] [--cwd path] [--model model] [--execution-mode mode] [--max-attempts N] [--reference-task-id id] [--dry-run]", description: "Submit a Code Queue task through backend-core -> code-queue proxy; --dry-run shows the structured request, routing recommendation, and prompt live-authorization lint while real success only confirms the write and task id." },
{ command: "codex skills-sync --dry-run [--full]", description: "Inspect the controlled runner skills hostPath lifecycle contract without copying files, restarting services, reading secrets, or mutating live runner paths." },
{ command: "codex execution-plane [--full|--raw]", description: "Read-only D601 native k3s Code Queue execution-plane drift inspection; compares formal deployments, deprecated Compose residuals, commit markers, pod digest, mounted worktree HEAD, and judge probe behavior version." },
{ command: "codex execution-plane [--full|--raw]", description: "Read-only D601 native k3s Code Queue execution-plane inspection; compares formal deployments, deprecated Compose residuals, commit markers, pod digest, and mounted worktree HEAD." },
{ command: "codex pr-preflight [--remote] [--push-dry-run --push-dry-run-ref refs/heads/probe/<name>] [--pr-create-dry-run --pr-create-dry-run-head <head>] [--issue N] [--full|--raw]", description: "Read-only PR admission check with compact commander output by default; use --full or --raw to expand the full runtime preflight, tool, and observation payload." },
{ command: "codex task <taskId> [--detail] [--trace --tail|--from-start|--after-seq N|--before-seq N --limit N] [--full]", description: "Fetch the bounded review view by default; --detail is still capped, while --full/trace/output explicitly expand evidence." },
{ command: "codex tasks [--view commander|supervisor|full] [--queue id] [--status status[,status]] [--unread|--unread-only] [--limit N] [--before-id id]", description: "Show Code Queue task state with progressive disclosure; --view commander is the recommended bounded host-commander loop, supervisor keeps compact sections, and full returns detailed rows." },
@@ -432,7 +432,7 @@ function codexHelp(): unknown {
mutation: false,
kubeconfig: "/etc/rancher/k3s/k3s.yaml",
namespace: "unidesk",
defaultPolicy: "compact drift/residual summary; deployments, pods, services and probe detail require --full, raw sanitized observations require --raw",
defaultPolicy: "compact drift/residual summary; deployments, pods and services require --full, raw sanitized observations require --raw",
blockers: ["deployment-drift", "deprecated-compose-residual", "d601-k3s-guard-blocked"],
},
examples: {