Repository navigation
feat(policy): v1.2.42 built-in event retention, verified archive, size guard, hot-path indexes [t_1d99b96b] - #63
Open
maximalang wants to merge 6 commits into
Open
maximalang wants to merge 6 commits into
maximalang wants to merge 6 commits into
Conversation
added 2 commits
October 7, 2026 22:06
…e guard, hot-path indexes [t_1d99b96b]
…lure status, retry throttle [t_7733d471] F1: PRAGMA auto_vacuum=2 staged in migrate() never persisted — journal_mode=WAL materializes the db header first (fresh stores were silently born in mode NONE), and a staged mode does not cross connections. Issue the pragma BEFORE the WAL switch and re-issue it in full_vacuum() on the vacuuming connection, so legacy auto_vacuum=0 stores actually convert to INCREMENTAL on the advertised operator full vacuum. Proven by freelist + file-size reclamation, not a marker. F2: fleet-policy maintenance exited 0 when the report carried per-batch errors (fail-closed archive verification). Now exits 1 on error/errors. F3: a run with errors no longer stamps retention_last_run_epoch, so the documented retry-next-tick fires; failed attempts are ledgered in retention_last_failure_epoch / retention_consecutive_failures. Ports the independent QA assertions (t_218bc548 comment 6212) into tests/test_v1242_retention_maintenance.py: fresh/legacy conversion + reclamation proof, mode-NONE negative control, CLI exit assertion, throttle preservation across failure.
Owner
Author
…e guard, hot-path indexes [t_1d99b96b]
…lure status, retry throttle [t_7733d471] F1: PRAGMA auto_vacuum=2 staged in migrate() never persisted — journal_mode=WAL materializes the db header first (fresh stores were silently born in mode NONE), and a staged mode does not cross connections. Issue the pragma BEFORE the WAL switch and re-issue it in full_vacuum() on the vacuuming connection, so legacy auto_vacuum=0 stores actually convert to INCREMENTAL on the advertised operator full vacuum. Proven by freelist + file-size reclamation, not a marker. F2: fleet-policy maintenance exited 0 when the report carried per-batch errors (fail-closed archive verification). Now exits 1 on error/errors. F3: a run with errors no longer stamps retention_last_run_epoch, so the documented retry-next-tick fires; failed attempts are ledgered in retention_last_failure_epoch / retention_consecutive_failures. Ports the independent QA assertions (t_218bc548 comment 6212) into tests/test_v1242_retention_maintenance.py: fresh/legacy conversion + reclamation proof, mode-NONE negative control, CLI exit assertion, throttle preservation across failure.
) [t_5857485a] Company decision 2026-10-12: rebase/re-merge the PR #63 branch onto the moved base now; conflict resolution preserves F1/F2 fix intent (verified by range-diff: F1-F3 QA commit 3cfc0b2 = 977e966 byte-identical). Full suite green on the rebase result: 953 passed (uv run pytest). No force-push: this merge commit fast-forwards the reviewed head. # Conflicts: # CHANGELOG.md # src/fleet_policy/runtime.py
Owner
Author
|
Rebase/re-merge на сдвинувшуюся базу выполнен [t_5857485a, company decision 2026-10-12]. Новый head: Что изменилось при разрешении конфликтов:
Верификация:
STOP до merge — слияние по команде company/owner. |
…runk [t_6fa10ff8] Company disposition 2026-10-13 (t_6fa10ff8): PR #63 must not land at 38d21a0 because that head regresses the trunk version labels from 1.2.46 back to 1.2.42 while all ten live profiles run 1.2.46. Version-regressing merges into the protected trunk are prohibited. This commit is the version re-pin only. The branch already carries the current trunk (6985cde) as an ancestor through merge 38d21a0, so no content rebase was needed: the working tree changed version labels and release documentation, nothing else. - pyproject.toml, plugin.yaml, integrations/hermes/fleet-policy-plugin/plugin.yaml, src/fleet_policy/__init__.py, uv.lock: 1.2.42 -> 1.2.47 - tests/test_hardening_v121.py: expected pin 1.2.42 -> 1.2.47 - tests/test_v1242_retention_maintenance.py -> tests/test_v1247_retention_maintenance.py - CHANGELOG.md: retention section heading moved to 1.2.47 with a re-pin note; the 1.2.42 pin it released is recorded free again - docs/FLEET_POLICY.md: storage-maintenance section heading 1.2.47 No policy-semantics change: deny/allow rules, protected paths, approver roles and gates are untouched. 1.2.47 was verified collision-free against the released set (max 1.2.46) and the open-PR heads. Verified locally: pytest 953 passed (plain, repeat, and worker-env run); uv lock --check clean; compileall clean; drift-check ok; build-bundle + verify-bundle ok.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fleet-policy v1.2.42 — built-in event retention, verified archive, size guard, hot-path indexes
Task: fleet-ops t_1d99b96b (ROOT FIX of the 2026-10-07 deny-triage stall: window queries over a 2.8 GB unbounded event store timed out 3× at 240s; the emergency hand-created index cut them 14.5s→0.001s).
What changes
idx_events_created(time window) +idx_events_kind_created(class window) join the existing task window;maintenance_stateKV ledger for cross-process throttling. Index coverage never depends on a manual hotfix again.register,kanban_task_claimed) +fleet-policy maintenanceCLI. Expired events are archived to deterministicJSONL.gz+.sha256sidecar +manifest.jsonlunder.state/fleet-policy-archive/; a batch's primary keys are deleted only after read-back verification (hash + gzip decode + row count). History stays restorable (INSERT OR IGNOREreplay, PK-deduped).wal_autocheckpoint=1000per connection,auto_vacuum=INCREMENTALon fresh stores, gradual freelist drain after runs;fleet-policy maintenance --full-vacuumfor a one-time legacy-store activation.statusnow reportsdb_size_bytes+maintenance_last_run_epoch.Verification (local, Windows worktree)
pytest tests/ -q→ 925 passed, run twice; worker-env variant (HERMES_KANBAN_TASK=t_ci_simulated) → 925 passed.tests/test_v1242_retention_maintenance.py(12 tests): v5 heal idempotency incl. legacy hand-patched stores, EXPLAIN QUERY PLAN provesidx_events_created, archive→verify→delete ordering, tampered archive keeps every row, interval throttle + force bypass, soft/hard guard semantics + per-day dedupe + audit-only without a binding, 30-day storm bounded well under the soft cap.uv lock --checkOK;compileallOK;drift-check{"ok": true};--version→ 1.2.42;build-bundle+verify-bundleOK (87 files).check_version_uniqueness→{"collision": false, "version": "1.2.42"}(1.2.37–1.2.41 are all held by open PRs 56–60).Bans honored
config/fleet-policy.yamlwas NOT modified (a write attempt was denied by the live gate as control-plane mutation — correctly; new knobs are code defaults, existingretentionkeys still override).Post-install readback (consumer card):
sqlite3 ... "PRAGMA index_list('events')"shows both new indexes; one forcedfleet-policy maintenancerun archives expired events and stampsmaintenance_last_run_epochinstatus; DB size trend flat afterwards.