mosaicstack/stack
1
0
Fork 1
Code Issues 200 Pull Requests 10 Actions Packages Projects Releases 15 Wiki Activity

fix(ci): make upgrade rollback signal control deterministic #1056

New Issue
Open
opened 2026-08-05 19:13:16 +00:00 by be-coder-08 · 0 comments
be-coder-08 commented 2026-08-05 19:13:16 +00:00
Collaborator
Copy Link
Copy Source

Problem

The upgrade-guard control in test-upgrade-rollback.sh is nondeterministic. The unchanged control failed on Woodpecker mosaic pipelines 2208, 2209, and 2211 at the same assertion, but passed on 2210:

[control] without 'exit 1' the trap resumes and reports sync success (the bug)

The TERM-injecting cp shim signals its parent and immediately finishes. Depending on scheduling, Bash can observe either the successful child completion or an interrupted/non-zero wait before the no-exit control resumes. A flaky negative control makes a green guard non-discriminating and cannot be retried away.

Required property

Make signal delivery deterministic without weakening the control. The control must still prove that stripping the explicit trap exit allows the installer to resume and emit its own file phase complete success marker. It must still fail when the explicit exit remains or another mechanism terminates the parent.

Scope

One gate-only change on its own PR, based on main. No C1 installer/fixture/manifest changes.

Acceptance

  • Repeated runs in the exact prebuilt CI-base image are stable.
  • A negative-control mutation retaining exit 1 makes the resume assertion fail, proving the control is not vacuous.
  • Full upgrade-guard chain passes.
  • Independent code and security review pass at the exact head.
## Problem The `upgrade-guard` control in `test-upgrade-rollback.sh` is nondeterministic. The unchanged control failed on Woodpecker `mosaic` pipelines 2208, 2209, and 2211 at the same assertion, but passed on 2210: `[control] without 'exit 1' the trap resumes and reports sync success (the bug)` The TERM-injecting `cp` shim signals its parent and immediately finishes. Depending on scheduling, Bash can observe either the successful child completion or an interrupted/non-zero wait before the no-exit control resumes. A flaky negative control makes a green guard non-discriminating and cannot be retried away. ## Required property Make signal delivery deterministic without weakening the control. The control must still prove that stripping the explicit trap exit allows the installer to resume and emit its own `file phase complete` success marker. It must still fail when the explicit exit remains or another mechanism terminates the parent. ## Scope One gate-only change on its own PR, based on `main`. No C1 installer/fixture/manifest changes. ## Acceptance - Repeated runs in the exact prebuilt CI-base image are stable. - A negative-control mutation retaining `exit 1` makes the resume assertion fail, proving the control is not vacuous. - Full `upgrade-guard` chain passes. - Independent code and security review pass at the exact head.
be-coder-08 added the bug label 2026-08-05 19:13:16 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
be-coder-05 be-coder-06 be-coder-07 be-coder-08 coder-mos1 coder-mos2 f10-coder jason.woltje (Jason Woltje) merge-gate mos-dt-0 pepper rev-974 (Rev-974 (Mosaic reviewer seat, web1)) rev-security-02 scooby (Scooby)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1056