mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 04:36:40 +00:00
kevinveenbirkenbachandClaude Opus 5
57cee99cf9
roles/sys-svc-container/templates/deploy.yml.j2 appends `node.role == manager` at :11-13 for any role carrying `placement: manager`, and `node.labels.<SANDBOX_NODE_LABEL> == true` at :18-20 for any role whose `services.kata.enabled` is truthy. Both land in the same `_constraints` list, which swarm evaluates as a conjunction. roles/svc-virt-kata/tasks/00_core.yml :62-70 adds that label only `when: not (IS_STACK_HOST | bool)`, so the manager never carries it and the two constraints have an empty intersection. The pin therefore does not move the workload to the manager, it makes it unschedulable, and the failure surfaces as a converge timeout rather than as a placement error. That is why web-app-hermes was proposed for such a pin during the GitLab#1 investigation and why the proposal was rejected. The existing default-placement-manager rule cannot catch this: it only checks that a nocheck marker is present, never that the justification holds, so a pin excused on general grounds still ships. This rule demands its own marker for the one case that is arithmetically impossible. It reads YAML rather than matching lines, because `kata` is a top-level sibling service in meta/services.yml and not a key inside the pinned service block, so the correlation spans the file. File scope is right: both constraints are role-scoped, not service-scoped. The line number for the report and for the nocheck still comes from a match; only the verdict comes from the parsed document. A templated `enabled` is not statically decidable and is passed over rather than guessed at. Green across all roles today, and a scratch control confirms it fires on a pin plus kata, stays silent on either half alone, on a template, and on the nocheck. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Tests 🧪
All automated tests for Infinito.Nexus live here.
| Directory | Type | Guide |
|---|---|---|
unit/ |
Unit tests (isolated, no I/O) | unit.md |
integration/ |
Integration tests (real component boundaries) | integration.md |
external/ |
Opt-in live third-party checks, excluded from make test |
external.md |
e2e/ |
End-to-end Playwright tests | playwright.md |
regression/ |
Regression guard rules | regression.md |
lint/ |
Structural lint checks | lint.md |
Run each suite via the make targets documented in the linked guides.