From d55933d78132d3f0e17f22ba923fa7b14e79abb1 Mon Sep 17 00:00:00 2001 From: whyour Date: Sat, 22 Aug 2026 16:42:36 +0800 Subject: [PATCH] fix(ci): track restarted provider evidence --- ...-plugin-package-recovery-e2e-live-audit.cjs | 5 ++++- ...ugin-package-recovery-e2e-live-contract.cjs | 3 ++- ...redential-test-kubernetes-live-contract.cjs | 18 ++++++++++++++++-- ...3PluginPackageRecoveryE2ELiveAudit.test.cjs | 3 ++- ...uginPackageRecoveryE2ELiveContract.test.cjs | 8 +++++++- ...edentialTestKubernetesLiveContract.test.cjs | 14 ++++++++++++++ 6 files changed, 45 insertions(+), 6 deletions(-) diff --git a/scripts/ql3-plugin-package-recovery-e2e-live-audit.cjs b/scripts/ql3-plugin-package-recovery-e2e-live-audit.cjs index 1e7ba9aa..d059f448 100644 --- a/scripts/ql3-plugin-package-recovery-e2e-live-audit.cjs +++ b/scripts/ql3-plugin-package-recovery-e2e-live-audit.cjs @@ -5,10 +5,12 @@ const fs = require('node:fs'); const path = require('node:path'); const { + postgresqlControlSchemaContract, postgresqlMainMigrationStream, } = require('../packages/ql3-cluster-postgres/dist/migration/migration.js'); const FIXTURE = 'qinglong/plugin-package-recovery-e2e-live-contract@v3'; +const CONTRACT_VERSION = postgresqlControlSchemaContract.contractVersion; const MIGRATION_COUNT = postgresqlMainMigrationStream.migrations.length; const LIMITATIONS = Object.freeze([ 'isolated PostgreSQL uses explicit TLS disable; production manifests remain verify-full', @@ -274,7 +276,7 @@ function validatePluginPackageRecoveryE2ELiveReport(report) { if ( !exactKeys(database, databaseKeys) || database?.migrationCount !== MIGRATION_COUNT || - database?.capabilityVersion !== 64 || + database?.capabilityVersion !== CONTRACT_VERSION || database?.initialState !== 'active' || database?.upgradeState !== 'failed' || !SHA256.test(database?.initialActiveLockDigest ?? '') || @@ -488,6 +490,7 @@ if (require.main === module) { } module.exports = { + CONTRACT_VERSION, FIXTURE, GATE_KEYS, LIMITATIONS, diff --git a/scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs b/scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs index 09ce2464..9bb25448 100644 --- a/scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs +++ b/scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs @@ -15,6 +15,7 @@ const { createFixture, } = require('./ql3-plugin-package-recovery-e2e-fixture.cjs'); const { + CONTRACT_VERSION, MIGRATION_COUNT, } = require('./ql3-plugin-package-recovery-e2e-live-audit.cjs'); @@ -1287,7 +1288,7 @@ SELECT json_build_object( ).stdout; const value = JSON.parse(output); assert.equal(value.migrationCount, MIGRATION_COUNT); - assert.equal(value.capabilityVersion, 64); + assert.equal(value.capabilityVersion, CONTRACT_VERSION); assert.equal(value.initialState, 'active'); assert.equal(value.initialActiveLockDigest, fixture.initial.lock.lockDigest); assert.equal(value.upgradeState, 'failed'); diff --git a/scripts/ql3-provider-credential-test-kubernetes-live-contract.cjs b/scripts/ql3-provider-credential-test-kubernetes-live-contract.cjs index ce4d4078..aaa41ec8 100644 --- a/scripts/ql3-provider-credential-test-kubernetes-live-contract.cjs +++ b/scripts/ql3-provider-credential-test-kubernetes-live-contract.cjs @@ -289,6 +289,18 @@ function providerPods(fixture) { ]).items; } +function providerObservationKey(pod) { + assert.match(pod?.metadata?.uid ?? '', /^[A-Za-z0-9][A-Za-z0-9._-]+$/); + const provider = pod?.status?.containerStatuses?.find( + (container) => container.name === 'provider', + ); + assert.ok(provider); + assert.ok( + Number.isSafeInteger(provider.restartCount) && provider.restartCount >= 0, + ); + return `${pod.metadata.uid}:${provider.restartCount}`; +} + function applyExecutorNetworkPolicy(fixture, providerPodIp) { const egress = [ { @@ -1604,10 +1616,11 @@ async function main() { providerPodIp: pod.status.podIP, }); const count = evidence.requestCount; - const previous = requestObservations.get(pod.metadata.uid) ?? 0; + const observationKey = providerObservationKey(pod); + const previous = requestObservations.get(observationKey) ?? 0; assert.ok(count >= previous); observedProviderRequests += count - previous; - requestObservations.set(pod.metadata.uid, count); + requestObservations.set(observationKey, count); }; applyExecutorNetworkPolicy(fixture, null); @@ -2049,6 +2062,7 @@ module.exports = { canI, deployProvider, executorJob, + providerObservationKey, providerServerSource, terminalJobSnapshot, }; diff --git a/test/back/ql3PluginPackageRecoveryE2ELiveAudit.test.cjs b/test/back/ql3PluginPackageRecoveryE2ELiveAudit.test.cjs index da0ba205..c5f92d9f 100644 --- a/test/back/ql3PluginPackageRecoveryE2ELiveAudit.test.cjs +++ b/test/back/ql3PluginPackageRecoveryE2ELiveAudit.test.cjs @@ -11,6 +11,7 @@ const producerPath = path.join( 'scripts/ql3-plugin-package-recovery-e2e-live-contract.cjs', ); const { + CONTRACT_VERSION, FIXTURE, GATE_KEYS, MIGRATION_COUNT, @@ -64,7 +65,7 @@ function validReport() { }, database: { migrationCount: MIGRATION_COUNT, - capabilityVersion: 64, + capabilityVersion: CONTRACT_VERSION, initialState: 'active', initialActiveLockDigest: lock, upgradeState: 'failed', diff --git a/test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs b/test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs index d353250d..42c60dd4 100644 --- a/test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs +++ b/test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs @@ -7,9 +7,11 @@ const { createFixture, } = require('../../scripts/ql3-plugin-package-recovery-e2e-fixture.cjs'); const { + CONTRACT_VERSION, MIGRATION_COUNT, } = require('../../scripts/ql3-plugin-package-recovery-e2e-live-audit.cjs'); const { + postgresqlControlSchemaContract, postgresqlMainMigrationStream, } = require('../../packages/ql3-cluster-postgres/dist/migration/migration.js'); @@ -64,6 +66,10 @@ test('fixture uses a real HTTPS and content-addressed OCI Distribution surface', test('report migration evidence follows the complete PostgreSQL stream', () => { assert.equal(MIGRATION_COUNT, postgresqlMainMigrationStream.migrations.length); + assert.equal( + CONTRACT_VERSION, + postgresqlControlSchemaContract.contractVersion, + ); }); test('fixture locks are bound to durable version-three approval dispatches', () => { @@ -127,7 +133,7 @@ test('gate runs migration, healthy activation and a durable rejected upgrade', ( assert.match(live, /initialSeed\.state, 'queued'/); assert.match(live, /upgradeSeed\.state, 'queued'/); assert.match(live, /value\.migrationCount, MIGRATION_COUNT/); - assert.match(live, /value\.capabilityVersion, 64/); + assert.match(live, /value\.capabilityVersion, CONTRACT_VERSION/); assert.match(live, /postgresEnvironment\(\s*'PACKAGE_EXECUTOR'/); assert.match(fixture, /assertPostgresPackageExecutorSchemaReady/); assert.match(live, /value\.initialState, 'active'/); diff --git a/test/back/ql3ProviderCredentialTestKubernetesLiveContract.test.cjs b/test/back/ql3ProviderCredentialTestKubernetesLiveContract.test.cjs index 09246eda..615de2a0 100644 --- a/test/back/ql3ProviderCredentialTestKubernetesLiveContract.test.cjs +++ b/test/back/ql3ProviderCredentialTestKubernetesLiveContract.test.cjs @@ -12,6 +12,7 @@ const { canI, deployProvider, executorJob, + providerObservationKey, providerServerSource, terminalJobSnapshot, } = require('../../scripts/ql3-provider-credential-test-kubernetes-live-contract.cjs'); @@ -349,6 +350,19 @@ test('reads provider evidence from the exact ready Pod with trusted TLS SNI', () ); }); +test('starts a fresh provider request baseline after a container restart', () => { + const pod = { + metadata: { uid: 'provider-uid' }, + status: { + containerStatuses: [{ name: 'provider', restartCount: 0 }], + }, + }; + + assert.equal(providerObservationKey(pod), 'provider-uid:0'); + pod.status.containerStatuses[0].restartCount = 1; + assert.equal(providerObservationKey(pod), 'provider-uid:1'); +}); + test('provider fixture logs only generation and authorization decision', () => { const source = providerServerSource(); assert.match(source, /event:'provider_request',generation,allowed/);