ops(svos): v0.0.23 (U22: judge 0.0.2 explain, interface 0.0.8 summaries, UI 0.0.27) staged on nh3-svos; judge.toml explain_seconds; two-card cutover playbooks ready

2026-10-19 02:00:51 -07:00
parent 3bb5c6b726
commit 4b3f7769c0
4 changed files with 108 additions and 1 deletions
@@ -0,0 +1,53 @@
+# nh3-svos -> SVOS v0.0.23 (9a0eec8), U22 card summaries. svos-dev thread 01M59P4Z1VJ4WHJB0N8N1P743K.
+# PRE-REQS: the stage playbook; origin's v0.0.23 == 9a0eec8b69ce (git ls-remote on nh3-dev); Prime AT THE BOARD.
+# This playbook does the release + the JUDGE (step 1 of svos-dev's order): backup, judge.toml explain_seconds, current,
+# front door (UI 0.0.27), restart ONLY svos-judge -> a held card for app-judge (its reads refuse until approved: the task
+# form's draft and admit wait). The INTERFACE restart is a separate playbook, run only after the judge's card is approved
+# (nh3-svos-9a0eec8-v0.0.23-interface.yaml). The kernel is NOT restarted (0.0.23 = 0.0.22 in code). No instance.toml change.
+steps:
+  - name: Pre-reqs present
+    sudo: true
+    shell: test -f /opt/svos/releases/9a0eec8/apps-env/bin/svos-judge && readlink /opt/svos/current && runuser -u svc-svos -- /opt/svos/releases/9a0eec8/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos
+    changed_when: "false"
+  - name: Online backup to /var/lib/svos/backup/pre-9a0eec8 (svos.db and the interface's stores)
+    sudo: true
+    shell: |
+      set -e
+      d=/var/lib/svos/backup/pre-9a0eec8
+      runuser -u svc-svos -- install -d -m 0700 $d
+      runuser -u svc-svos -- python3 -c "
+      import sqlite3, glob, os
+      for src in ['/var/lib/svos/state/svos.db'] + sorted(glob.glob('/var/lib/svos/state/apps/interface/*.sqlite3')):
+          dst = '$d/' + os.path.basename(src)
+          s = sqlite3.connect('file:' + src + '?mode=ro', uri=True); t = sqlite3.connect(dst); s.backup(t); t.close(); s.close()
+          c = sqlite3.connect('file:' + dst + '?mode=ro', uri=True); print(os.path.basename(src), 'integrity', c.execute('pragma integrity_check').fetchone()[0])"
+      runuser -u svc-svos -- cp -p /var/lib/svos/config/apps/judge.toml /var/lib/svos/config/apps/judge.toml.pre-9a0eec8
+  - {name: judge.toml with explain_seconds, upload: {src: configs/svos-apps/judge.toml, dest: /var/lib/svos/config/apps/judge.toml.new, mode: "0600"}, sudo: true}
+  - name: Swap judge.toml (owned by svc-svos)
+    sudo: true
+    shell: |
+      set -e
+      cd /var/lib/svos/config/apps
+      chown svc-svos:svc-svos judge.toml.new && mv judge.toml.new judge.toml && grep -n '^explain_seconds' judge.toml
+  - name: Switch current to 9a0eec8
+    sudo: true
+    shell: ln -sfn /opt/svos/releases/9a0eec8 /opt/svos/current.new && chgrp -h svc-svos /opt/svos/current.new && mv -T /opt/svos/current.new /opt/svos/current && readlink /opt/svos/current
+  - name: Front door inventory (UI 0.0.27 live; 2f29d0d becomes previous)
+    sudo: true
+    shell: /usr/local/sbin/svos-front-inventory 2>&1 | grep -E 'GENERATED|updated|root \*|path /assets' | head -4
+  - name: Restart ONLY svos-judge (raises the held card for app-judge)
+    sudo: true
+    shell: |
+      systemctl restart svos-judge; sleep 6; systemctl is-active svos-judge
+      journalctl -u svos-judge --since "-30s" --no-pager -o cat | grep -iE "manifest|revision|held|error|config" | tail -5 | cut -c1-200 || true
+verify:
+  - name: Judge on 9a0eec8; its manifest revision and card
+    sudo: true
+    shell: |
+      pid=$(systemctl show svos-judge -p MainPID --value); grep -q /opt/svos/releases/9a0eec8 /proc/$pid/maps && echo "judge pid $pid on 9a0eec8"
+      python3 -c "
+      import sqlite3
+      c = sqlite3.connect('file:/var/lib/svos/state/svos.db?mode=ro', uri=True)
+      for r in c.execute(\"select slug, revision, substr(sha256,1,12), state from app_manifests where slug='app-judge' order by revision desc limit 2\"): print(r)
+      for r in c.execute(\"select id, kind, state, created_at, expires_at from cards where slug='app-judge' and kind='manifest' order by created_at desc limit 1\"): print(r)"
+    changed_when: "false"