From 093ecd9ea04612948bbad558dc02c42d2d36cb1c Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Fri, 26 Jun 2026 18:11:37 +0000
Subject: [PATCH] fix(web-probe): require sentinel mirror object readiness

---
 scripts/src/hwlab-node-web-sentinel-cicd.ts | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/scripts/src/hwlab-node-web-sentinel-cicd.ts b/scripts/src/hwlab-node-web-sentinel-cicd.ts
index 94d26b11..dbc12dc6 100644
--- a/scripts/src/hwlab-node-web-sentinel-cicd.ts
+++ b/scripts/src/hwlab-node-web-sentinel-cicd.ts
@@ -901,10 +901,16 @@ function probeSourceMirror(state: SentinelCicdState, timeoutSeconds: number): Re
     `expected=${shellQuote(expectedCommit ?? "")}`,
     "commit=$(kubectl -n " + shellQuote(namespace) + " exec deploy/git-mirror-http -- sh -lc \"git --git-dir=\\\"$repo_path\\\" rev-parse \\\"refs/heads/$branch\\\" 2>/dev/null\" 2>/dev/null)",
     "rc=$?",
-    "node - \"$rc\" \"$commit\" \"$expected\" \"$repo_path\" \"$branch\" <<'NODE'",
-    "const [rc, commit, expected, repoPath, branch] = process.argv.slice(2);",
+    "object_rc=1",
+    "if [ \"$rc\" -eq 0 ]; then",
+    "  kubectl -n " + shellQuote(namespace) + " exec deploy/git-mirror-http -- sh -lc \"git --git-dir=\\\"$repo_path\\\" cat-file -e \\\"$commit^{commit}\\\" 2>/dev/null\" >/dev/null 2>&1",
+    "  object_rc=$?",
+    "fi",
+    "node - \"$rc\" \"$object_rc\" \"$commit\" \"$expected\" \"$repo_path\" \"$branch\" <<'NODE'",
+    "const [rc, objectRc, commit, expected, repoPath, branch] = process.argv.slice(2);",
     "const present = Number(rc) === 0 && /^[0-9a-f]{40}$/i.test(commit || '');",
-    "console.log(JSON.stringify({ ok: present && (!expected || commit === expected), mode: 'internal-git-mirror', present, commit: present ? commit : null, expectedCommit: expected || null, branch, repoPath, persistentMirrorPresent: present, readUrl: process.env.SOURCE_GIT_MIRROR_READ_URL || null, valuesRedacted: true }));",
+    "const objectPresent = present && Number(objectRc) === 0;",
+    "console.log(JSON.stringify({ ok: objectPresent && (!expected || commit === expected), mode: 'internal-git-mirror', present, objectPresent, commit: present ? commit : null, expectedCommit: expected || null, branch, repoPath, persistentMirrorPresent: objectPresent, readUrl: process.env.SOURCE_GIT_MIRROR_READ_URL || null, valuesRedacted: true }));",
     "NODE",
   ].join("\n");
   const result = runCommand(["trans", stringAt(state.controlPlaneNode, "kubeRoute"), "sh", "--", `export SOURCE_GIT_MIRROR_READ_URL=${shellQuote(stringAt(state.cicd, "source.gitMirrorReadUrl"))}\n${script}`], repoRoot, { timeoutMs: Math.min(timeoutSeconds, 60) * 1000 });