ci(chart-freeze): the platform's chart copy is frozen — the chart lives in MeshWeaver.Deploy by rbuergi · Pull Request #7194 · Systemorph/MeshWeaver

rbuergi · 2026-10-25T12:35:57Z

The owner decided that this repository's chart is frozen: all chart edits go to Systemorph/MeshWeaver.Deploy, and #7127 deletes this copy. This PR adds a guard so the two copies cannot drift apart again.

Why

Systemorph/MeshWeaver.Deploy#1 seeded MeshWeaver.Deploy from this repository's chart material at fdcbc25983. After that, both copies stayed editable, and both changed (#7143, #7159, #7184, #7170, #7119 here; Deploy#2 and Deploy#3 there). Two pipelines baked hosting-operator:main, one from each copy, so :main flapped between two charts. Systemorph/MeshWeaver.Deploy#4 ports this repository's changes since the seed into Deploy.

What

scripts/check-chart-freeze.py reads git diff --name-status --no-renames <merge base> HEAD. It refuses any frozen path that is added, modified, retyped, or renamed into, with the message the chart lives in Systemorph/MeshWeaver.Deploy. A pure deletion passes. A line it cannot parse counts as a violation, so it never passes by default.
Frozen means exactly what Deploy#1 copied:
- deploy/helm/, deploy/helm-db/, deploy/aks/values.aks.yaml, deploy/aks/manifests/, deploy/aks/scripts/, deploy/homebrew/
- .github/workflows/chart-gate.yml, .github/workflows/homebrew.yml
- scripts/check-config-key-coverage.py, .github/scripts/test-bundle-registry.py
Exempt: .github/scripts/build-run.py and deploy/build-host/**. main-cd builds the build-host runner image from them here, and the Deploy chart gate reads them from a declared checkout of this repository.
dotnet-test.yml gets a new job, Chart frozen (lives in MeshWeaver.Deploy):
- It runs on every pull request, with no path filter and no credential, and runs its self-test first.
- It is a needs: of Consolidate test results and has its own != 'success' fail step. It cannot be skipped into green.
The policy chart-lives-in-deploy is added to the register. Chart Ownership and the Runner Pool records the move.

Verified locally

check-chart-freeze.py --self-test passes all 15 cases (the listing is read with -z, and a frozen directory matches its own path):
- modification, addition, single-file modification, retype, a non-ASCII addition, a directory replaced by a symlink, a rename into a frozen path, a mixed diff, an unknown status and a dangling status are refused;
- a deletion of every frozen kind (the move(deploy): the deployment reference leaves core for the public MeshWeaver.Deploy #7127 shape), the build-host exemptions, unrelated paths and prefix lookalikes pass.
Negative control on real history: --base fdcbc25983 (the seed) against this branch's main reports 21 frozen paths changed and exits 1. Those changes are feat(build): standing build hosts — follow lane, sandboxed host runner, build-host chart, CD hand-over #7143, fix(build-hosts): host pods select workload=ci-build, the label the CI node pools carry #7159, feat(ocr): a local Tesseract OCR service (deploy/ocr) #7184, fix(homebrew): azure-cli is a cask now; the formula no longer depends on it #7170 and chore(operator): the hosting operator leaves core for MeshWeaver.Plugins (delete half) #7119, now ported by Deploy#4.
move(deploy): the deployment reference leaves core for the public MeshWeaver.Deploy #7127 passes: its diff against its merge base has 210 entries, 182 of them deletions of frozen paths. The script exits 0.
This PR passes: --base origin/main exits 0.
Other checks:
- check-workflow-timeouts: 124 jobs, 0 violations. check-workflow-yaml-keys, check-workflow-permission-pairing and check-workflow-shell report no live finding.
- MeshWeaver.Documentation.Test builds Release -warnaserror with 0 errors. Its 14 workflow and doc guard classes (MainRunsAreNeverCancelled, SharedRuleExemptionIsOneEventPredicate, WorkflowJobIfContext, DocumentationFrontMatter, CiRestBudget, …) run 171 tests: 171 passed, 0 failed.

What this means for other open work

move(deploy): the deployment reference leaves core for the public MeshWeaver.Deploy #7127 is unaffected: it only deletes.
After main is merged in, move(deploy): the deployment reference leaves core for the public MeshWeaver.Deploy #7127 must also delete the build-host chart files main gained since it was cut (deploy/helm/templates/build-host/*, deploy/aks/scripts/test-build-hosts.sh and its testdata). They are frozen, so deleting them is the only change allowed.
Any open pull request that edits a frozen chart path turns red here and must move to MeshWeaver.Deploy. Examples: the chart half of feat(chart): build hosts — the chart can create the build-cache claim #7189 and feat(build-hosts): versioned build servers — the v/ and alias/ contract and retention #7191. Their build-run.py and deploy/build-host/ halves stay here and pass.

Pairs-with: none — no public type or member is removed.

🤖 Generated with Claude Code

…es in MeshWeaver.Deploy MeshWeaver.Deploy was seeded from this repository's chart material (Deploy#1). Both copies stayed editable and both moved, so two pipelines baked hosting-operator:main from two different charts. The paths Deploy#1 copied are now frozen here (policy chart-lives-in-deploy): - scripts/check-chart-freeze.py refuses a pull request that adds, modifies, retypes or renames into deploy/helm, deploy/helm-db, deploy/aks/{values.aks.yaml,manifests,scripts}, deploy/homebrew, chart-gate.yml, homebrew.yml, check-config-key-coverage.py or test-bundle-registry.py, with "the chart lives in Systemorph/MeshWeaver.Deploy". A pure deletion passes (that is how #7127 removes the copy). build-run.py and deploy/build-host/ stay editable: main-cd builds the build-host image from them. - Job "Chart frozen (lives in MeshWeaver.Deploy)" runs it on every pull request against the merge base, self-test first, and is a need of the required check with its own fail step. - The policy is registered and ChartOwnershipAndRunnerPool records the move. Refs #7127. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Copilot

🟡 Changes recommended

The checker permits frozen-path bypasses and introduces violations of the existing Git path-listing guard.

3 open issues

What changed in this PR

This PR freezes core’s deployment chart material as ownership moves to Systemorph/MeshWeaver.Deploy, while allowing deletion of the old copy for #7127.

Changes:

Adds a chart-freeze checker with self-tests and explicit build-host exemptions.
Connects the new pull-request gate to Consolidate test results.
Documents chart ownership and registers the freeze policy.

File	Description
`src/MeshWeaver.Documentation/Data/Architecture/PolicyNotProse.md`	Registers the chart ownership and freeze policy.
`src/MeshWeaver.Documentation/Data/Architecture/ChartOwnershipAndRunnerPool.md`	Documents the move, frozen paths and exemptions.
`scripts/check-chart-freeze.py`	Adds diff validation and self-tests for the freeze.
`.github/workflows/dotnet-test.yml`	Adds the freeze job and propagates failure to the required check.

_{Review effort: Balanced}

github-actions · 2026-10-25T12:41:46Z

Test Results

25 files ±0 25 suites ±0 56m 53s ⏱️ + 1m 21s
11 684 tests ±0 11 682 ✅ ±0 2 💤 ±0 0 ❌ ±0
11 710 runs ±0 11 708 ✅ ±0 2 💤 ±0 0 ❌ ±0

Results for commit 5220ebc. ± Comparison against base commit f820aaf.

This pull request removes 59 and adds 22 tests. Note that renamed tests count towards both.


   --- End of inner exception stack trace ---
   --- End of inner exception stack trace ---, expected: True)
   --- End of inner exception stack trace ---, kind: "Timeout", layer: null)
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
 ---> (Inner Exception #1) MeshWeaver.Messaging.Hub.Test.InfrastructureFaultTest+ProviderException (0x80004005): Failed to connect to 10.42.18.4:5432<---
 ---> (Inner Exception #1) MeshWeaver.Messaging.HubDisposingException: Hub node/a is shutting down — cannot create "x". The address may reactivate (recycle / restart); retry to get the authoritative answer.
 ---> (Inner Exception #1) System.ArgumentException: Value does not fall within the expected range.<---
 ---> (Inner Exception #1) System.InvalidOperationException: boom<---
 ---> (Inner Exception #1) System.InvalidOperationException: source B is misconfigured<---
…

MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's FIRST member", fault: System.AggregateException: One or more errors occurred. (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.
   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall as an aggregate's SECOND member", fault: System.AggregateException: One or more errors occurred. (The operation has timed out.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> System.TimeoutException: The operation has timed out.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---
, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall nested in an aggregate inside a wrapper", fault: System.InvalidOperationException: outer
 ---> System.AggregateException: One or more errors occurred. (Value does not fall within the expected range.) (Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.)
 ---> System.ArgumentException: Value does not fall within the expected range.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.<---

   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "a stall wrapped as InnerException", fault: System.InvalidOperationException: outer
 ---> MeshWeaver.Mesh.QueryProviderStalledException: Query provider(s) [pg] did not emit an Initial within the query fan-in's 16s bound for query 'nodeType:NodeType' (user 'system'). The merged Initial gates on EVERY provider, so this query has NO snapshot to answer with — it is reported as unavailable (retryable) rather than left hanging with no error. This is an availability failure, never a permission verdict: a consumer deciding access must fail CLOSED and say it could not establish the answer. Fix the stalled provider; never bump the consumer's timeout.
   --- End of inner exception stack trace ---, expected: True)
MeshWeaver.Compiler.Pipeline.Test.SourcesWatcherStallBackoffTest ‑ The_production_classifier_recognises_a_stall_through_every_wrapping(because: "an aggregate of unrelated faults", fault: System.AggregateException: One or more errors occurred. (The operation has timed out.) (Value does not fall within the expected range.)
 ---> System.TimeoutException: The operation has timed out.
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.ArgumentException: Value does not fall within the expected range.<---
, expected: False)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a bare disposed object with no context — not prova"···, exception: System.ObjectDisposedException: Cannot access a disposed object.
Object name: 'MemoryStream'., kind: "Fault", layer: null)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a cancellation whose timeout cause sits at aggrega"···, exception: System.OperationCanceledException: t
 ---> System.AggregateException: One or more errors occurred. (x) (The operation has timed out.)
 ---> System.InvalidOperationException: x
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.TimeoutException: The operation has timed out.<---

   --- End of inner exception stack trace ---, kind: "Timeout", layer: null)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a driver wrapping a connect timeout", exception: MeshWeaver.Messaging.Hub.Test.FaultClassifierTest+FakeDbException (0x80004005): Failed to connect
 ---> System.TimeoutException: The operation has timed out., kind: "Transient", layer: "Store")
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a hub announcing its disposal", exception: MeshWeaver.Messaging.HubDisposingException: Hub node/a is shutting down — cannot create "stream". The address may reactivate (recycle / restart); retry to get the authoritative answer.
Object name: 'node/a'., kind: "HubTeardown", layer: null)
MeshWeaver.Messaging.Hub.Test.FaultClassifierTest ‑ Classifies(shape: "a mixed aggregate keeps the defect", exception: System.AggregateException: One or more errors occurred. (Success) (boom)
 ---> System.Net.Sockets.SocketException (0x80004005): Success
   --- End of inner exception stack trace ---
 ---> (Inner Exception #1) System.InvalidOperationException: boom<---
, kind: "Fault", layer: null)
…

♻️ This comment has been updated with latest results.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

… matches its own path Review findings on #7194: - git C-quotes a path with a non-ASCII byte, a quote or a control character, so an added deploy/helm/templates/café.yaml reached is_frozen() quoted and passed. The diff is now read with -z and parsed as status/path fields; check-git-path-listings.py is clean (0 of 130). - A frozen directory replaced by a tracked symlink produced D for its files and A deploy/helm, and the directory path itself matched no prefix. A frozen directory now matches its own path too. - The file input is --diff-file (a saved -z listing), so the listing guard no longer reads the option name as an unquoted listing. Self-test: 15 cases, including the non-ASCII addition, the directory-to-symlink swap, a rename into a frozen path, an unknown status and a dangling status. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Copilot

🟡 Changes recommended

Two confirmed path-classification gaps allow prohibited additions to pass the deletion-only gate.

2 open issues

3 resolved since last review

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

The guard permits ancestor-symlink replacements and accepts malformed saved diff records as clean.

2 open issues

Block ancestor symlinks bypassing frozen paths · New
Reject malformed saved diff records · New

2 resolved since last review

_{Review effort: Balanced}

rbuergi · 2026-10-25T14:01:53Z

+
+
+def is_frozen(path: str) -> bool:
+    return _matches(path, FROZEN) and not _matches(path, EXEMPT)


That's true in principle, but I'm not changing this PR for it. The gate exists to stop well-meant edits to a copy that now lives in MeshWeaver.Deploy. Replacing deploy/aks with a symlink to a new editable tree is a deliberate, reviewable restructuring that nobody makes by accident. Also, #7127 has already deleted every frozen path from main (I checked: deploy/aks now holds only the docs, envs and infra), so nothing frozen sits behind such a symlink. Refusing a non-deletion at an ancestor of a frozen path, while keeping the exemptions, is tracked as hardening in triage (rbuergi/Feedback/20261025-chart-freeze-hardening).

rbuergi · 2026-10-25T14:02:09Z

+        status = fields[i]
+        if not status or status[0] not in KNOWN_STATUS or i + 1 >= len(fields):
+            # Past an unreadable field the status/path pairing is lost, so nothing after it can be
+            # read either: one violation names where reading stopped.
+            out.append(("?", status))
+            break
+        # A C or R entry carries two paths; --no-renames should never produce one, but read both.
+        width = 3 if status[0] in "CR" else 2
+        for path in fields[i + 1:i + width]:
+            if is_frozen(path) and status[0] != "D":
+                out.append((status[0], path))
+        i += width


I agree the reader should validate the whole status token and the path count. It isn't reachable on a realistic input, though. --diff-file is git's own -z output saved by CI, never written by hand, so neither a truncated R record nor a Dgarbage status occurs. The production path --base reads git directly. This is tracked together with the ancestor case in rbuergi/Feedback/20261025-chart-freeze-hardening.

Copilot

🔵 Needs a closer look

Human confirmation is needed that the previously raised edge cases cannot let prohibited changes pass the new gate.

2 open issues

_{Review effort: Balanced}

Copilot AI balanced review requested due to automatic review settings October 25, 2026 12:35

rbuergi enabled auto-merge (squash) October 25, 2026 12:36

Copilot started reviewing on behalf of rbuergi October 25, 2026 12:36

View session

Copilot AI reviewed Oct 25, 2026

View reviewed changes

Comment thread scripts/check-chart-freeze.py Resolved

Comment thread scripts/check-chart-freeze.py Resolved

Comment thread scripts/check-chart-freeze.py Resolved

This was referenced Oct 25, 2026

sync: memex-local runs the browser suite from MeshWeaver.Plugins (platform #7179) Systemorph/MeshWeaver.Deploy#7

Merged

move(deploy): the deployment reference leaves core for the public MeshWeaver.Deploy #7127

Merged

Merge origin/main into ci/chart-freeze (both register rows kept)

d4d3a44

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

meshweaver-cloud Bot disabled auto-merge October 25, 2026 12:45

github-actions Bot requested a balanced review from Copilot October 25, 2026 12:45

Copilot started reviewing on behalf of rbuergi October 25, 2026 12:46

View session

rbuergi enabled auto-merge (squash) October 25, 2026 12:47

meshweaver-cloud Bot disabled auto-merge October 25, 2026 12:48

Copilot AI reviewed Oct 25, 2026

View reviewed changes

Comment thread scripts/check-chart-freeze.py Resolved

Comment thread scripts/check-chart-freeze.py Resolved

github-actions Bot requested a balanced review from Copilot October 25, 2026 12:57

Copilot started reviewing on behalf of rbuergi October 25, 2026 12:57

View session

rbuergi mentioned this pull request Oct 25, 2026

move(deploy): the Aspire integration, the deploy AppHost, the example env and the AKS Bicep leave core #7120

Merged

Copilot AI reviewed Oct 25, 2026

View reviewed changes

Merge branch 'main' into ci/chart-freeze

5220ebc

rbuergi requested a balanced review from Copilot October 25, 2026 13:55

Copilot started reviewing on behalf of rbuergi October 25, 2026 13:55

View session

Copilot AI reviewed Oct 25, 2026

View reviewed changes

rbuergi mentioned this pull request Oct 25, 2026

feat(cd): mw-core-tests image as the set's fifth digest, and core's build stages per CI shard (P4 core half) #7204

Merged

rbuergi merged commit c8d0589 into main Oct 25, 2026
61 of 63 checks passed

systemorph Bot mentioned this pull request Oct 27, 2026

Harden check-chart-freeze.py: refuse non-deletions at ancestors of frozen paths and strictly validate --diff-file records #7391

Closed

rbuergi deleted the ci/chart-freeze branch October 31, 2026 09:12

Navigation Menu

Repository navigation

ci(chart-freeze): the platform's chart copy is frozen — the chart lives in MeshWeaver.Deploy - #7194

ci(chart-freeze): the platform's chart copy is frozen — the chart lives in MeshWeaver.Deploy#7194
rbuergi merged 4 commits into
mainfrom
ci/chart-freeze

rbuergi commented Oct 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

rbuergi Oct 25, 2026

Uh oh!

rbuergi Oct 25, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants



		def is_frozen(path: str) -> bool:
		return _matches(path, FROZEN) and not _matches(path, EXEMPT)

Conversation

rbuergi commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Verified locally

What this means for other open work

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

rbuergi Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

rbuergi Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rbuergi commented Oct 25, 2026 •

edited

Loading

github-actions Bot commented Oct 25, 2026 •

edited

Loading