deploy: flawless germination — name-aware fatal template flag, operator un-hardcoded, DO tag race, gate that pages #242

Merged

plat merged 2 commits from deploy-flawless into main

2026-08-31 19:15:37 +00:00

plat commented

2026-08-31 18:50:50 +00:00

Owner

The cousin-deploy failures, fixed at the root — and the gate that was already catching them wired to actually reach a human.

What a fresh deploy hits today: the published genesis seed (r603) still carries the pre-rename plat/_app-template, and germinate's template-flag + visibility special-cases match only app-template — so every sovereign deploy comes up with a private, unflagged template: create_app 422s ("this is not a template repo"), the front door never opens (#234, #231, #236), and the only trace is a WARN in a 30-minute log.

germinate: the template-repo handling is name-aware (both app-template and _app-template) and the post-push verify is now FATAL with the exact fix command — a platform that cannot build apps must not report success.
fork_repoint_operator: promgate PROM_ADMINS, agents PLAT_OPERATORS (off at birth), old-vintage FLEET_REPO/EPISODE_LOG_REPO, and the coldstart trusted-actor allowlist stop naming the parent's operator — a ghost (and registrable) username on every daughter.
deploy/do: explicit digitalocean_tag resource; the firewall no longer races the leader droplet's implicit tag creation on a fresh account. Closes #232.
coldstart: any red gate pages the operator's ntfy topic (Actions secret NTFY_TOPIC, already sealed on this repo). The gate HAS been red on three consecutive nightly reseed PRs (r761/r765/r769) while deployers kept pulling the broken seed — the signal existed; it just never left the forge.

This PR's own coldstart run germinates the CURRENT (broken-vintage) r603 seed — a green gate here is the proof that old-seed daughters heal.

Note: reseed #241 (r769) is still the vehicle that fixes the published seed itself; its gate failure is a separate, undiagnosed break (logs on vxrail ~/ci-gate-logs/).

🤖 Generated with Claude Code

https://claude.ai/code/session_012svX9LqUGpR2s9QCSk2Awd

The cousin-deploy failures, fixed at the root — and the gate that was already catching them wired to actually reach a human. **What a fresh deploy hits today**: the published genesis seed (r603) still carries the pre-rename `plat/_app-template`, and germinate's template-flag + visibility special-cases match only `app-template` — so every sovereign deploy comes up with a private, unflagged template: `create_app` 422s ("this is not a template repo"), the front door never opens (#234, #231, #236), and the only trace is a WARN in a 30-minute log. - **germinate**: the template-repo handling is name-aware (both `app-template` and `_app-template`) and the post-push verify is now **FATAL** with the exact fix command — a platform that cannot build apps must not report success. - **fork_repoint_operator**: promgate `PROM_ADMINS`, agents `PLAT_OPERATORS` (off at birth), old-vintage `FLEET_REPO`/`EPISODE_LOG_REPO`, and the coldstart trusted-actor allowlist stop naming the parent's operator — a ghost (and registrable) username on every daughter. - **deploy/do**: explicit `digitalocean_tag` resource; the firewall no longer races the leader droplet's implicit tag creation on a fresh account. Closes #232. - **coldstart**: any red gate pages the operator's ntfy topic (Actions secret `NTFY_TOPIC`, already sealed on this repo). The gate HAS been red on three consecutive nightly reseed PRs (r761/r765/r769) while deployers kept pulling the broken seed — the signal existed; it just never left the forge. This PR's own coldstart run germinates the CURRENT (broken-vintage) r603 seed — a green gate here is the proof that old-seed daughters heal. Note: reseed #241 (r769) is still the vehicle that fixes the published seed itself; its gate failure is a separate, undiagnosed break (logs on vxrail `~/ci-gate-logs/`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012svX9LqUGpR2s9QCSk2Awd

plat added 2 commits

2026-08-31 18:50:50 +00:00

deploy: template flag is fatal + name-aware, operator knobs re-pointed, DO tag race 2efc2ecd93

- germinate: the app-template repo check matches BOTH names (seeds cut before
  the 2026-08-24 rename carry _app-template — matching only the new name is how
  #234/#236 shipped: private, unflagged, create_app 422s, front door dead).
  Verification is now FATAL, not a WARN lost in a 30-minute log.
- fork_repoint_operator: promgate PROM_ADMINS, agents PLAT_OPERATORS (off at
  birth), FLEET_REPO/EPISODE_LOG_REPO (old vintages) and the coldstart
  trusted-actor allowlist stop naming the parent's operator — a ghost username
  on every daughter, and a registrable one (#236's sibling problem).
- deploy/do: explicit digitalocean_tag resource — the firewall no longer races
  the leader droplet's implicit tag creation on a fresh account (#232).

Closes #232.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012svX9LqUGpR2s9QCSk2Awd

coldstart: a red gate pages the operator

guard-ppt / no-ppt (push) Successful in 16s

Details

guard-ppt / no-ppt (pull_request) Successful in 17s

Details

coldstart / coldstart (pull_request) Successful in 20m25s

Details

49a64dbbea

The gate caught the broken published seed on three consecutive nightly reseed
PRs (r761/r765/r769) — and nobody heard: the red sat on the forge while real
deployers kept getting the broken seed (#234). Any failure now posts to the
operator's ntfy topic; the topic name is an Actions secret (public repo — the
name is the topic's only access control), so daughters without it no-op.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012svX9LqUGpR2s9QCSk2Awd

trevato referenced this pull request

2026-08-31 18:56:47 +00:00

germination: front door (open-platform/www) never comes up — seeded _app-template has is_template=false, so create_app 422s "this is not a template repo" #234

trevato referenced this pull request

2026-08-31 18:56:49 +00:00

coldstart gate: fresh daughters cannot grow the front door — create_app open-platform/www → 422 "this is not a template repo" #231

trevato referenced this pull request

2026-08-31 18:56:52 +00:00

germination: seeded _app-template is private + owned by the plat user — operators expect a discoverable/public app template #236

trevato referenced this pull request

2026-08-31 19:03:43 +00:00

genesis: reseed r769 (automated #14) #241