jason.woltje
17087efe15
Co-authored-by: jason.woltje <jason@diversecanvas.com> Co-committed-by: jason.woltje <jason@diversecanvas.com>
42 lines
2.8 KiB
Desktop File
42 lines
2.8 KiB
Desktop File
[Unit]
|
|
# Mosaic wake FALLBACK safety drain (F7 replacement-before-retirement, EPIC #892,
|
|
# W7). This is the framework-shipped canon-side FALLBACK WAKE: a LOW-FREQUENCY
|
|
# SAFETY drain that fires the canon drain (digest.sh render --from-store) on a
|
|
# per-class cadence bound, INDEPENDENT of the event-driven detector daemon
|
|
# (mosaic-wake.service). Its whole reason to exist is that a stalled/dead detector
|
|
# or daemon can never SILENTLY STARVE delivery: even with nothing pushing, this
|
|
# oneshot periodically drains the durable pending-inbox so the cumulative unacked
|
|
# set still reaches the consumer. It is the §5 retirement precondition (F7) — it
|
|
# must be live + proven-firing BEFORE the legacy mosaic-heartbeat@ timer is reaped,
|
|
# so there is never a coverage gap. Fixed-interval heartbeats are forbidden as the
|
|
# PRIMARY wake mechanism (WAKE-DOCTRINE); they survive ONLY as this per-class
|
|
# fallback cadence, bounded by urgency SLO, never as the steady state.
|
|
#
|
|
# This is a oneshot SERVICE activated by mosaic-wake-fallback.timer; the cadence
|
|
# lives on the TIMER (OnUnitActiveSec), set per-class by the A10 installer via the
|
|
# blank-reset drop-in — never here. The service therefore carries NO [Install]
|
|
# section (the TIMER is what is enabled/wanted); it is triggered, not wanted.
|
|
Description=Mosaic wake fallback safety drain (canon drain: digest.sh render --from-store)
|
|
After=default.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
# Strip loader / noninteractive-shell controls before ExecStart, matching the
|
|
# detector, lease-broker and tmux fleet units in this same directory (defense-in-
|
|
# depth against an injected BASH_ENV/ENV/LD_PRELOAD in the user manager environment).
|
|
UnsetEnvironment=LD_PRELOAD BASH_ENV ENV
|
|
# Operator-owned runtime configuration. This EnvironmentFile carries only WAKE_*
|
|
# NAMES (the per-agent namespace WAKE_AGENT, the lane WAKE_LANE, and — reused from
|
|
# the detector — the pluggable adapter COMMANDS resolved BY NAME at runtime). It
|
|
# carries NEVER any secret and NEVER any endpoint value. The '-' prefix keeps a
|
|
# missing file from masking the installer's dedicated fail-closed install-validate.
|
|
EnvironmentFile=-%h/.config/mosaic/wake/fallback.env
|
|
# THE CANON DRAIN. digest.sh render --from-store drains the durable pending-inbox
|
|
# (store.sh drain) and renders the cumulative-state digest. Running it here, on the
|
|
# timer cadence, is the safety net: it is the SAME drain the delivery path uses, so
|
|
# a stalled detector cannot starve it. Delivery/paste of the rendered digest is the
|
|
# same operator-wired send seam the detector path uses (out of framework scope);
|
|
# this unit guarantees the DRAIN fires on a bounded cadence regardless of detector
|
|
# health. digest render exits 0 on an empty inbox, so a quiet cycle is a clean no-op.
|
|
ExecStart=/bin/bash --noprofile --norc %h/.config/mosaic/tools/wake/digest.sh render --from-store
|