[Task] Server update from WebUI only after CLI backup/restore is proven #34

New Issue

2026-07-06T11:31:28+02:00

zemion commented

2026-07-06 11:31:28 +02:00

Imported from the consolidated GovOPlaN product backlog.

Source: /mnt/DATA/Nextcloud/ADD ideas UG/Products/govoplan/backlog.md
Line: 214
Section: Milestones > Milestone 12 - Later Integrations And Mail Capabilities
Source status: DEFERRED.

Imported backlog item:

- [ ] Server update from WebUI only after CLI backup/restore is proven.

Imported from the consolidated GovOPlaN product backlog. - Source: `/mnt/DATA/Nextcloud/ADD ideas UG/Products/govoplan/backlog.md` - Line: `214` - Section: `Milestones > Milestone 12 - Later Integrations And Mail Capabilities` - Source status: `DEFERRED.` Imported backlog item: ```markdown - [ ] Server update from WebUI only after CLI backup/restore is proven. ```

zemion added this to the Milestone 12 - Later Integrations And Mail Capabilities milestone 2026-07-06 13:06:38 +02:00

zemion added the area/webui codex/needs-human module/core

priority

p3

source/backlog-import

labels 2026-07-29 14:15:18 +02:00

zemion added

module/ops area/release area/security codex/ready and removed

codex/needs-human labels 2026-07-30 15:08:52 +02:00

zemion commented

2026-07-30 15:08:52 +02:00

Agreed deployment boundary

This issue is now the Core safety contract behind the installation/update journey in GovOPlaN/govoplan #13 and the Ops child issue.

The browser submits typed operations such as reconcile_release and rollback_release; it never supplies shell commands.
Core persists actor, expected current receipt, immutable reviewed plan, idempotency key, approval, and durable state.
A separate narrow agent owns Docker/orchestrator access, verifies signed image identities, acquires a fenced lock, enforces backup/migration/drain gates, reconciles, probes health, and records evidence.
API and Ops receive status/evidence only; neither gets the Docker socket.
External-orchestrator deployments export a reviewed recipe and remain read-only in WebUI.

Acceptance additions

Request claiming and completion use fencing so a stale agent cannot commit.
Exact receipt preconditions prevent updating a drifted installation.
Backup/restore proof, migration compatibility, maintenance impact, and rollback/forward-recovery are explicit gates.
Progress is reconnectable and audit evidence contains no secrets.

## Agreed deployment boundary This issue is now the Core safety contract behind the installation/update journey in GovOPlaN/govoplan #13 and the Ops child issue. - The browser submits typed operations such as `reconcile_release` and `rollback_release`; it never supplies shell commands. - Core persists actor, expected current receipt, immutable reviewed plan, idempotency key, approval, and durable state. - A separate narrow agent owns Docker/orchestrator access, verifies signed image identities, acquires a fenced lock, enforces backup/migration/drain gates, reconciles, probes health, and records evidence. - API and Ops receive status/evidence only; neither gets the Docker socket. - External-orchestrator deployments export a reviewed recipe and remain read-only in WebUI. ### Acceptance additions - [ ] Request claiming and completion use fencing so a stale agent cannot commit. - [ ] Exact receipt preconditions prevent updating a drifted installation. - [ ] Backup/restore proof, migration compatibility, maintenance impact, and rollback/forward-recovery are explicit gates. - [ ] Progress is reconnectable and audit evidence contains no secrets.

zemion commented

2026-07-31 22:54:25 +02:00

Evaluation after the backup/restore work: the prerequisite is now materially proven (restore drill evidence and backup integrity checks in GovOPlaN/govoplan@3c658fa and GovOPlaN/govoplan-core@b65b488), but the issue itself should remain open.

GovOPlaN has a supervised module installer queue and WebUI module lifecycle flow. It does not yet provide a safe whole-server/container-image update workflow with preflight, migration ordering, worker draining, health verification, rollback, and release provenance. That work belongs in the installation/control-plane UI rather than being inferred from module installation.

Evaluation after the backup/restore work: the prerequisite is now materially proven (restore drill evidence and backup integrity checks in GovOPlaN/govoplan@3c658fa and GovOPlaN/govoplan-core@b65b488), but the issue itself should remain open. GovOPlaN has a supervised module installer queue and WebUI module lifecycle flow. It does not yet provide a safe whole-server/container-image update workflow with preflight, migration ordering, worker draining, health verification, rollback, and release provenance. That work belongs in the installation/control-plane UI rather than being inferred from module installation.

zemion commented

2026-08-01 01:48:10 +02:00

Codex State: progress

Summary

Implemented local safety foundations for a future typed deployment agent: Core recovery ledger, idempotency/request-hash binding, hash-chained checkpoints, fencing-token binding, explicit recovery modes, runtime node drain state, migration advisory locking, and exact-head startup waiting.
The meta deployer now journals every apply before mutation and refuses automatic old-release/config restoration after migration begins.

Changed Files

src/govoplan_core/core/recovery.py
src/govoplan_core/core/runtime_coordination.py
src/govoplan_core/db/migration_lock.py
docs/STATE_AND_RECOVERY_CONTRACT.md

Verification

27 focused state/recovery tests plus 9 clean-database migration tests passed

Next / Blocked

Keep open: the typed browser request, separately privileged deployment agent, signed release verification, production backup controller/reference, and reconnectable whole-server update UI are not implemented.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Implemented local safety foundations for a future typed deployment agent: Core recovery ledger, idempotency/request-hash binding, hash-chained checkpoints, fencing-token binding, explicit recovery modes, runtime node drain state, migration advisory locking, and exact-head startup waiting. - The meta deployer now journals every apply before mutation and refuses automatic old-release/config restoration after migration begins. ### Changed Files - `src/govoplan_core/core/recovery.py` - `src/govoplan_core/core/runtime_coordination.py` - `src/govoplan_core/db/migration_lock.py` - `docs/STATE_AND_RECOVERY_CONTRACT.md` ### Verification - `27 focused state/recovery tests plus 9 clean-database migration tests passed` ### Next / Blocked - Keep open: the typed browser request, separately privileged deployment agent, signed release verification, production backup controller/reference, and reconnectable whole-server update UI are not implemented. Suggested status label: `status/in-progress`

zemion commented

2026-08-01 02:04:21 +02:00

Codex State: progress

Summary

Implemented serialized migrations, exact-head runtime waits, distributed fencing, and a recovery ledger with mode-specific plans and hash-chained evidence.
Low-level recovery transitions now lock the operation row and revalidate the recorded lease fence; fenced subprocesses escalate from terminate to kill and preserve the lease-loss exit code.

Changed Files

src/govoplan_core/core/recovery.py
src/govoplan_core/core/runtime_coordination.py
src/govoplan_core/db/migration_lock.py
src/govoplan_core/commands/fenced_run.py

Verification

22 focused state, coordination, migration-lock, and recovery tests passed

Next / Blocked

Do not close until module effects and production backup/restore controls have adopted and drilled the contract.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Implemented serialized migrations, exact-head runtime waits, distributed fencing, and a recovery ledger with mode-specific plans and hash-chained evidence. - Low-level recovery transitions now lock the operation row and revalidate the recorded lease fence; fenced subprocesses escalate from terminate to kill and preserve the lease-loss exit code. ### Changed Files - `src/govoplan_core/core/recovery.py` - `src/govoplan_core/core/runtime_coordination.py` - `src/govoplan_core/db/migration_lock.py` - `src/govoplan_core/commands/fenced_run.py` ### Verification - `22 focused state, coordination, migration-lock, and recovery tests passed` ### Next / Blocked - Do not close until module effects and production backup/restore controls have adopted and drilled the contract. Suggested status label: `status/in-progress`

zemion commented

2026-08-03 07:06:27 +02:00

Codex State: done

Summary

The deferred WebUI update gate is now implemented through Admin module catalog/install-plan preflight and the separate supervised installer-daemon queue.
The CLI path has verified backup/restore hooks, restore checks, rollback drills, durable recovery evidence, restart/health supervision, and unresolved-effect blocking; the WebUI never executes package commands in the API process.

Changed Files

../govoplan-admin/webui/src/features/admin/ModuleManagementPanel.tsx
src/govoplan_core/core/module_installer.py

Verification

Full module-system suite and consolidated focused checks passed after lifecycle recovery adoption.

## Codex State: done ### Summary - The deferred WebUI update gate is now implemented through Admin module catalog/install-plan preflight and the separate supervised installer-daemon queue. - The CLI path has verified backup/restore hooks, restore checks, rollback drills, durable recovery evidence, restart/health supervision, and unresolved-effect blocking; the WebUI never executes package commands in the API process. ### Changed Files - `../govoplan-admin/webui/src/features/admin/ModuleManagementPanel.tsx` - `src/govoplan_core/core/module_installer.py` ### Verification - `Full module-system suite and consolidated focused checks passed after lifecycle recovery adoption.`

zemion closed this issue

2026-08-03 07:06:27 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-core#34