moebiusol/oculus_vita-cms
4
0
Fork 0
Code Issues Pull requests 21 Projects Releases Packages 1 Wiki Activity Actions

OCV-246: repair CMS runtime route guard #63

Open
moeardent wants to merge 9 commits from moeardent/ocv246-route-guard into dev AGit
pull from: moeardent/ocv246-route-guard
merge into: moebiusol:dev
Conversation 0 Commits 9 Files changed 25 +1362 -16
moeardent commented 2026-10-15 01:44:19 +00:00
Owner
Copy link

OCV-246 / OCV-206: DEV source review candidate extends unmerged runtime recovery #59 at 4c922d5 with a bounded SIGPIPE fix. TeamCity #21889 failed before Qodana when grep -q closed the normalized Apache-rule pipe; consume all input while preserving exact required rule and fail-closed wrong-target rejection. Verification: three actual-script route guard fixtures (real repository rules, 520 KB trailing config, wrong-target exit4), three Apache static tests, image-boundary, bash syntax and diff checks pass. Guard fixtures stub only PHP metadata validation; no PHP endpoint behavior, real Apache, UID33 mount or protected scanner pass is claimed. Specs record regression/design/verification. Reviewer focus: exact-match preservation and pipefail behavior. Base target dev; related existing draft #59 remains unchanged. Approved digest-pinned PHP8.4+/PHPUnit/mount/Apache runtime qualification, exact-head Qodana/SCA/coverage/SBOM and Vault owner provisioning remain required; missing MEDCMS_RUNTIME_API_TOKEN in apps/oculus-vita-cms/dev/runtime blocks DEV. No merge, deployment, platform mutation or production action. Agent Moe Ardent; sponsor Cristian Cotosman; revert bounded final commit for source recovery.

[OCV-246](https://moebiusol.youtrack.cloud/issue/OCV-246) / [OCV-206](https://moebiusol.youtrack.cloud/issue/OCV-206): DEV source review candidate extends unmerged runtime recovery #59 at 4c922d5 with a bounded SIGPIPE fix. TeamCity #21889 failed before Qodana when grep -q closed the normalized Apache-rule pipe; consume all input while preserving exact required rule and fail-closed wrong-target rejection. Verification: three actual-script route guard fixtures (real repository rules, 520 KB trailing config, wrong-target exit4), three Apache static tests, image-boundary, bash syntax and diff checks pass. Guard fixtures stub only PHP metadata validation; no PHP endpoint behavior, real Apache, UID33 mount or protected scanner pass is claimed. Specs record regression/design/verification. Reviewer focus: exact-match preservation and pipefail behavior. Base target dev; related existing draft #59 remains unchanged. Approved digest-pinned PHP8.4+/PHPUnit/mount/Apache runtime qualification, exact-head Qodana/SCA/coverage/SBOM and Vault owner provisioning remain required; missing MEDCMS_RUNTIME_API_TOKEN in apps/oculus-vita-cms/dev/runtime blocks DEV. No merge, deployment, platform mutation or production action. Agent Moe Ardent; sponsor Cristian Cotosman; revert bounded final commit for source recovery.
[FIX] OCV-246 restore CMS authenticated semantic runtime contract
Some checks are pending
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch is running
Details
7b4845195f 
- Recover the accepted fixed-tenant six-field endpoint and complete semantic capability inventory.
- Bake explicit original product coordinates and activate the image-owned route safely inside the PVC.
- Preserve current CI and require PHP, actual-rule and UID33 mount regression tests; remote evidence remains pending.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Verification-Ref: source re-review complete; shell syntax, 3 Apache static checks and image boundary passed; exact-head remote PHP/mount/Apache evidence pending
Risk-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Release-Ref: DEV/TEST candidate only; no deployment or production authorization
Exception-Ref: None
[FIX] OCV-246 replace CMS route entries safely
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
2829b2c23b 
Use no-follow moves for handler activation and PVC rollback so a symlink-to-directory cannot redirect staged entries.

Add an injected activation-failure regression that checks the prior symlink and PVC route configuration are restored.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: shell syntax, Apache static checks (3/3), image boundary and diff checks passed; PHP-backed route sync test unavailable locally (PHP CLI missing); exact-head TeamCity revalidation pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: DEV/TEST candidate only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 validate CMS runtime contract on review branches
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
3d558e1910 
Keep delivery provenance closed to dev/test/main while running the exact PHP runtime suite in the existing non-release Qodana branch lane.

The branch lane remains verification-only and does not build, publish, or promote images.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; exact-head remote PHP runtime suite pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 isolate branch runtime checks from TeamCity secrets
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
02544ab56f 
Run PHP route tests in a minimal environment so source-under-review does not inherit unrelated project credentials.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; remote runtime test pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 require PHP CLI for CMS runtime validation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
49cfe047b5 
Do not treat Docker presence as satisfying a PHP CLI dependency; install or fail clearly before executing the required runtime suite.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; rerunning exact-head remote PHP suite

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 provision PHPUnit for runtime validation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
04f9d28872 
Install or require PHPUnit alongside PHP CLI before running the fail-closed runtime contract suite on branch and stable validation lanes.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; exact-head remote PHP suite pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 provide PHP 8.4 in CMS validation lane
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 4
Details
56685f430f 
Install the required PHP 8.4 CLI when the TeamCity agent has no qualifying interpreter; Docker presence is not a PHP CLI substitute.

The PHP 8.4 Ubuntu setup follows PHP installation guidance; only CLI SAPI is used by validation.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; rerunning exact-head remote PHP suite

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 fail closed without approved PHP test image
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 4
Details
4c922d5ae0 
Remove the unapproved third-party PHP package source and package installation from shared TeamCity validation. Require PHP 8.4+ CLI and PHPUnit from an approved, digest-pinned test image; retain the branch-only runtime suite and do not widen native delivery routes.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: OCV-246 [moebiusol/oculus-vita-cms#59]
Verification-Ref: branch-lane/static checks and shell syntax, Apache route tests, image boundary checks, and diff checks pass; PHP runtime suite not run due missing approved PHP 8.4/PHPUnit image
Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Release-Ref: review validation only; no deployment or production authorization
Exception-Ref: None
[FIX] OCV-246 consume complete CMS route guard input
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 1
Details
d6333a5b1b 
Accept valid runtime routing even when trailing Apache configuration causes an early grep exit to send SIGPIPE to sed under pipefail. Consume the full normalized file while preserving the exact required stable-handler rule and wrong-target rejection.

Three actual-script fixtures cover repository rules, a 520 KB configuration tail and fail-closed wrong-handler rejection. PHP metadata validation is stubbed only in these shell fixtures; approved PHP, Apache, mount and exact-image CI qualification remain required.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: #59
Verification-Ref: 3 shell guard fixtures, 3 Apache static tests, image-boundary, bash syntax and diff checks passed
Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Release-Ref: review validation only; no merge or deployment
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 1
Required
Details
This pull request doesn't have enough approvals yet. 0 of 1 approvals granted.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin +refs/pull/63/head:moeardent/ocv246-route-guard
git switch moeardent/ocv246-route-guard
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
Compat/Breaking

Breaking change that won't be backward compatible

  
Kind/Bug

Something is not working

  
Kind/Documentation

Documentation changes

  
Kind/Enhancement

Improve existing functionality

  
Kind/Feature

New functionality

  
Kind/Security

This is security issue

  
Kind/Testing

Issue or pull request related to testing

  
Priority
Critical
The priority is critical

  
Priority
High
The priority is high

  
Priority
Low
The priority is low

  
Priority
Medium
The priority is medium

  
Reviewed
Confirmed
Issue has been confirmed

  
Reviewed
Duplicate
This issue or pull request already exists

  
Reviewed
Invalid
Invalid issue

  
Reviewed
Won't Fix
This issue won't be fixed

  
Status
Abandoned
Somebody has started to work on this but abandoned work

  
Status
Blocked
Something is blocking this issue or pull request

  
Status
Need More Info
Feedback is required to reproduce issue or to continue work

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: moebiusol/oculus_vita-cms#63
No description provided.
Delete branch "moeardent/ocv246-route-guard"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?