Skip to content

Qualify native rollout and preserve operator state during upgrades #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
LeiterConsulting merged 1 commit into from
Oct 6, 2026
Merged

Qualify native rollout and preserve operator state during upgrades #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 64 additions & 9 deletions docs/exec_ctrl/REAL_PROJECT_FACILITY_OPERATIONS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
# Controlled real-project trial: an existing application

Date: 2026-10-06. Local correction verified; candidate native acceptance pending.
Date: 2026-10-06. Initial local correction verified; native acceptance subsequently
passed in the authorized follow-up below.
Method: preview 5, `8f0117cf3e36975874a0b96853476391b0f115df`.
Public target: [facility operations](https://github.com/LeiterConsulting/splunk-facility-operations),
baseline `b8209ef7013ca1d1b421415b1226bcfcc8ce99d4`.
Reviewed candidate: `b1fbfa7e342f2d6bb5874fdf255036f3a9a8e3ca`,
[application draft PR](https://github.com/LeiterConsulting/splunk-facility-operations/pull/1).
[application correction](https://github.com/LeiterConsulting/splunk-facility-operations/pull/1).

## Task and authority

Expand Down Expand Up @@ -57,7 +58,7 @@ Skip only known host capability denials for symlink creation; unexpected errors
still fail. The linked-input rejection then passed on Linux. Nearby contributor
and live-data guidance were updated with these contracts.

| Check actually performed | Result and boundary |
| Initial check actually performed | Result and boundary |
| --- | --- |
| Repaired `npm run verify` | Type check, build/package and 11 model tests passed; 15 backend/package tests discovered, 14 passed and one Windows symlink skip |
| Linux backend/package suite | All 15 passed, including actual linked-input rejection and private-file exclusion/inventory preservation fixtures |
Expand All @@ -80,8 +81,8 @@ receipts, screenshots and environment troubleshooting remain private.
The optional offline helper selected declared gates and rehashed explicit source
inputs. The candidate manifest also included its generated lookup and package;
credentials, dependencies, private policy and remote environment state were
excluded. The current record is valid but blocked on candidate native acceptance.
That is an intentional scope hold, not a failed local correction.
excluded. The initial record was valid but blocked on candidate native acceptance.
That was an intentional scope hold, not a failed local correction.

| Deliberate record check | Observed helper result |
| --- | --- |
Expand All @@ -95,7 +96,7 @@ These checks validate declared structure, evidence kinds and subject consistency
The helper did not run the application tests, authenticate approvers or establish
evidence truth. The author reviewed the diff and retained failing/passing reports.

| Trial axis | Observation |
| Initial trial axis | Observation |
| --- | --- |
| Retrieval / blind activation | Not exercised; method/context preloaded, local entry/modules read at the pinned revision |
| Selection | Relevant modules and explicit high-risk gates used; no recursive v1 load |
Expand All @@ -111,6 +112,60 @@ work; it adds no mandatory activation reads, helper behavior or version change.
Framework follow-up validation is recorded in the feedback PR checks.

Independent cross-IDE adoption, organization rulesets, external team connectors,
real provider inference and release/customer acceptance remain untested. Review
and authorized candidate deployment are subsequent gates, separate from this
completed local correction and the already published framework preview.
real provider inference and customer acceptance remain untested. The initial trial
left review and authorized candidate deployment as subsequent gates. The follow-up
below closes the bounded native gate with new evidence, preserving the earlier
results and their original scope.

## Authorized post-merge native follow-up

After both corrections merged, the owner requested deployment and native checks.
Method: merged framework `3a1d26cb32aaecb3d1df117be2f73690da544175`.
Application: merged `b7c89e6418fe2ba84404d837d3cd6b3882f21d79`, with the same Git
tree as the tested application candidate. This remains a controlled authoring run.

Back up scoped operator files, permissions and effective settings before rollout.
Reconstruct the original installer and verify it against its retained digest;
retain it for rollback. No rollback was needed or executed. Upgrade the first
environment, restore approved operator state and verify it before the second.
Both updates rewrote operator metadata and the empty inventory file. Restore the
original bytes and permissions from the protected backups, then repeat affected
native checks. This is meaningful upgrade behavior, not evidence that a sanitized
release package automatically preserves installed state.

A new browser in one environment received an older frontend after an earlier
browser had passed candidate identity. Retain that failure. A project-supported
Web asset-cache refresh followed by new normal and regression browsers yielded
the correct candidate. Exact internal cache/worker causality was not established.
No service restart, provider change or server-side synthetic inventory write was
performed. Connection values, backups, receipts and screenshots remain private.

| Follow-up check actually performed | Result and boundary |
| --- | --- |
| Deployed identity | Raw installed bundle and fresh served assets match the repaired candidate on both supported versions |
| Normal native workflows | Eight service and ten browser checks per environment; 36 passed against the repaired candidate, with no page errors |
| Briefing regressions | Six cases per environment, 12 passed using browser-only synthetic search responses against the installed frontend; no live-source ingestion claim |
| Scoped preservation and identity | Nine checks per environment passed: protected file bytes/permissions, effective settings, inventory, other-app version/enabled flags, app flags, unchanged startup time and raw bundle identity |
| Fresh merged-source verification | 11 model tests, all 15 backend/package tests on Linux and four local browser workflows passed; Windows retains one explicit symlink skip |
| Fresh dependency audits | Runtime and full audits report zero advisories |
| Scanner artifact binding | Rebuild is byte-identical to the earlier inspected/deployed installer; the retained AppInspect 4.2.1 report applies to those bytes, with its original warnings/skips and certification limits |
| Fresh record and source comparison | Exit 0, structurally valid and ready to close; current deployment and live evidence satisfy the declared native gate |

Git checkout normalized line endings in five selected source/test/doc files after
merge reconciliation. The old raw-byte manifest was correctly rejected even
though the canonical Git tree matched the candidate. Fresh verification and a new
20-input manifest identified current inputs; the rebuild matched the deployed
artifact. Historical records and failures were retained, not relabeled as passes
for a different source subject. The helper remained offline and read-only; project
tools performed the network, upgrade and browser operations.

The twelve briefing cases check unknown-only and partial coverage in normal and
recovery phases, and positive verified healthy/recovered behavior. Their synthetic
responses exist only in isolated browsers. Normal native workflows separately
exercise actual lab searches and the deterministic investigation service.

The [delivery module](../../modules/delivery.md) now makes operator-state restoration
and fresh-client asset identity explicit. This adds relevant rollout guidance,
with no activation-entry, adapter, helper, catalog or version change. Independent
adoption, organization policy, native reader-role, real model, cloud certification
and customer acceptance remain outside this completed deployment qualification.
12 changes: 12 additions & 0 deletions modules/delivery.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,18 @@ required behavior in that environment. After an abort, verify the restored
artifact and its behavior; copying an old file alone is not rollback acceptance.
This says nothing about reversing persisted data, which needs its own recovery.

For an upgrade, back up the scoped operator-owned settings, permissions/metadata
and mutable files in a protected location. A sanitized package can still overwrite
installed operator state. Compare relevant bytes, ownership/permissions and
effective settings afterward; restore approved overrides from verified backups
and recheck the affected behavior. State the comparison's coverage explicitly.

Verify served assets as well as installed files. An earlier successful request
does not establish that a later client receives the same artifact. If fresh clients
observe stale assets, use the project's supported cache invalidation within the
authorized rollout scope; coordinate shared caches and recheck runtime identity.
Do not infer cache internals or perform a service restart from that symptom alone.

## Evidence and gate

`delivery-readiness`: artifact/source identity, required checks, rollout/recovery
Expand Down
Loading