bin/seed: createdFrom records the API endpoint it was invoked over — an ephemeral port-forward URL costs daughters the tier-1 fork + full genealogy at depth #76

New issue

Closed

opened 2026-07-02 17:19:23 +00:00 by plat · 0 comments

plat commented

2026-07-02 17:19:23 +00:00

Owner

What happened (depth-2 validation for #46)

Minted a granddaughter seed FROM a running daughter (d2a, PORTS=none) the only way a PORTS=none parent can be reached — a kubectl port-forward on the host:

FORGEJO_URL=http://127.0.0.1:3100 FORGEJO_USER=plat PLAT_PAT=<d2a pat> OUT=seed-d2.tar.gz bin/seed

The manifest recorded the invocation endpoint verbatim (bin/seed: echo "createdFrom: $FORGEJO_URL"):

mitosisVersion: 1
profile: lean
createdFrom: http://127.0.0.1:3100    <- ephemeral, host-loopback
domain: d2a.local                     <- the durable identity WAS available (SEED_DOMAIN, from reserved-names bareDomain)

Germinating granddaughter d2b from that seed, the #70 fork chain behaved exactly as designed — and that design surfaced the fidelity gap. The parent was alive and the port-forward was up, so the HOST-side probe passed and germinate committed to tier-1; the migrate is performed by the daughter's Forgejo POD, for which 127.0.0.1:3100 is itself:

mitosis fork tier-1: migrating http://127.0.0.1:3100/plat/mitosis (one-time, mirror=false)…
mitosis fork tier-1: migrate of http://127.0.0.1:3100/plat/mitosis FAILED (Forgejo-side) — falling through
mitosis fork tier-2: migrating https://git.open-platform.sh/plat/mitosis (one-time, mirror=false)…
mitosis fork RESULT: tier-2 src=https://git.open-platform.sh/plat/mitosis

d2b still came up whole (13/13 gate PASS — that is #70's fallback working as intended). The cost of losing tier-1 is genealogy, not availability:

d2b's plat/mitosis records original_url = https://git.open-platform.sh/plat/mitosis.git — the ROOT, not its actual parent d2a.
d2b's ORIGIN carries root's lines + the d2b append; d2a's OWN lineage line (d2a.local germinated-from open-platform.sh …) is absent, because only a tier-1 fork of the actual parent carries the parent's ORIGIN forward:

root: https://git.open-platform.sh/plat/mitosis
open-platform.sh germinated-from open-platform.sh 2026-06-10T03:33:22Z seed=seed.tar.gz
d2b.local germinated-from d2a.local 2026-07-02T16:57:55Z seed=seed-d2.tar.gz
      <- "d2a.local germinated-from open-platform.sh 2026-07-02T15:38:31Z" is MISSING here

So at depth >= 2, every seed minted over a port-forward (the standard way to reach a PORTS=none parent) silently downgrades daughters from tier-1 to tier-2/3 and truncates both the forge-level (original_url) and plain-text (ORIGIN) genealogy to the root.

Fix direction

bin/seed already fetches the parent's durable identity — SEED_DOMAIN from reserved-names.yaml (bareDomain). Record a durable URL in createdFrom instead of the invocation endpoint:

Prefer the parent's public git URL derived from bareDomain: https://git.<SEED_DOMAIN> — the address a daughter's Forgejo pod would actually need to reach for repo-migrate (and the daughter-side [migrations] ALLOW_LOCALNETWORKS shim from #70 already tolerates LAN parents).
Fall back to $FORGEJO_URL only when SEED_DOMAIN is UNKNOWN.
Optionally record both (createdFrom + createdVia) so operators still see how the seed was minted.

germinate needs no change: tier-1 probes createdFrom and falls through exactly as today; a durable createdFrom just makes tier-1 succeed whenever the parent is genuinely reachable.

Evidence: depth-2 chain run on #46 (genesis -> d2a -> seed-d2.tar.gz -> d2b, vxrail, 2026-07-02; both clusters PORTS=none, torn down after).

## What happened (depth-2 validation for #46) Minted a granddaughter seed FROM a running daughter (`d2a`, PORTS=none) the only way a PORTS=none parent can be reached — a `kubectl port-forward` on the host: ``` FORGEJO_URL=http://127.0.0.1:3100 FORGEJO_USER=plat PLAT_PAT=<d2a pat> OUT=seed-d2.tar.gz bin/seed ``` The manifest recorded the invocation endpoint verbatim (`bin/seed`: `echo "createdFrom: $FORGEJO_URL"`): ``` mitosisVersion: 1 profile: lean createdFrom: http://127.0.0.1:3100 <- ephemeral, host-loopback domain: d2a.local <- the durable identity WAS available (SEED_DOMAIN, from reserved-names bareDomain) ``` Germinating granddaughter `d2b` from that seed, the #70 fork chain behaved exactly as designed — and that design surfaced the fidelity gap. The parent was alive and the port-forward was up, so the HOST-side probe passed and germinate committed to tier-1; the migrate is performed by the daughter's Forgejo POD, for which `127.0.0.1:3100` is itself: ``` mitosis fork tier-1: migrating http://127.0.0.1:3100/plat/mitosis (one-time, mirror=false)… mitosis fork tier-1: migrate of http://127.0.0.1:3100/plat/mitosis FAILED (Forgejo-side) — falling through mitosis fork tier-2: migrating https://git.open-platform.sh/plat/mitosis (one-time, mirror=false)… mitosis fork RESULT: tier-2 src=https://git.open-platform.sh/plat/mitosis ``` d2b still came up whole (13/13 gate PASS — that is #70's fallback working as intended). The cost of losing tier-1 is genealogy, not availability: - d2b's `plat/mitosis` records `original_url = https://git.open-platform.sh/plat/mitosis.git` — the ROOT, not its actual parent d2a. - d2b's ORIGIN carries root's lines + the d2b append; d2a's OWN lineage line (`d2a.local germinated-from open-platform.sh …`) is absent, because only a tier-1 fork of the actual parent carries the parent's ORIGIN forward: ``` root: https://git.open-platform.sh/plat/mitosis open-platform.sh germinated-from open-platform.sh 2026-06-10T03:33:22Z seed=seed.tar.gz d2b.local germinated-from d2a.local 2026-07-02T16:57:55Z seed=seed-d2.tar.gz <- "d2a.local germinated-from open-platform.sh 2026-07-02T15:38:31Z" is MISSING here ``` So at depth >= 2, every seed minted over a port-forward (the standard way to reach a PORTS=none parent) silently downgrades daughters from tier-1 to tier-2/3 and truncates both the forge-level (`original_url`) and plain-text (ORIGIN) genealogy to the root. ## Fix direction `bin/seed` already fetches the parent's durable identity — `SEED_DOMAIN` from `reserved-names.yaml` (`bareDomain`). Record a durable URL in `createdFrom` instead of the invocation endpoint: 1. Prefer the parent's public git URL derived from bareDomain: `https://git.<SEED_DOMAIN>` — the address a daughter's Forgejo pod would actually need to reach for repo-migrate (and the daughter-side `[migrations] ALLOW_LOCALNETWORKS` shim from #70 already tolerates LAN parents). 2. Fall back to `$FORGEJO_URL` only when `SEED_DOMAIN` is UNKNOWN. 3. Optionally record both (`createdFrom` + `createdVia`) so operators still see how the seed was minted. `germinate` needs no change: tier-1 probes createdFrom and falls through exactly as today; a durable createdFrom just makes tier-1 succeed whenever the parent is genuinely reachable. Evidence: depth-2 chain run on #46 (genesis -> d2a -> seed-d2.tar.gz -> d2b, vxrail, 2026-07-02; both clusters PORTS=none, torn down after).

plat referenced this issue

2026-07-02 17:21:15 +00:00

/goal /ultracode-workflows [GATE] validated grandchild acceptance gate — secrets+domains+rbac+policy on a VPS depth-2/3 platform #46

plat referenced this issue from a pull request that will close it,

2026-07-02 17:23:07 +00:00

seed: durable createdFrom — real tier-1 genealogy at depth (#76) #77

plat referenced this issue from a commit

2026-07-02 17:23:08 +00:00

seed: createdFrom records the durable public git host, not the invocation endpoint (#76)

plat closed this issue

2026-07-02 17:42:12 +00:00

plat referenced this issue from a commit