mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5
86f7d8c4f5
The image runs this module from a layer that holds three files of utils: __init__.py, install/__init__.py and install/collections.py, the sliceef45d69dc3cut so the source tree cannot invalidate the collection install.67f5398985established that the module therefore stays on the standard library, andd4ae5cf9f0broke it 15 minutes later by routing the reads through utils.cache.files to satisfy the cache-read lint. The import raises ModuleNotFoundError: No module named 'utils.cache' in that layer, which no import inside a full checkout can show, because this repository installs utils into site-packages. Nothing turned red. The caller reads only the exit code, and the module's contract is exit 1 with the missing collections on stdout, so a crash - exit 1, nothing on stdout - is indistinguishable from work to do. Every image build since has reinstalled every collection with --force-with-deps, which is the cost the check exists to avoid. The deploy job the traceback was found in finished green. The reads go back to Path.read_text with a cache-read marker each. The cache was never earning its place here: read_text is an lru_cache keyed on the path, and one run reads the requirements file once and one MANIFEST.json per collection, eight distinct paths, none of them twice. Copying utils/cache into the slice instead would work - the closure is three stdlib-only files - but it binds a package with 51 commits in the last twelve months to the layer that installs ansible, in front of a cache with no possible hit. The caller now exits 3 when a non-zero status arrives with an empty stdout, a state the contract cannot produce, so the next crash stops the install instead of quietly reinstalling everything. all.sh runs under set -e and touches the stamp only after ansible.sh returns, so the failure also leaves the stamp stale rather than recording an install that did not happen. The probe that would have caught this builds the slice in a tempdir from the Dockerfile's own COPY lines and runs the module inside it. It has to pass python -S: without it the interpreter resolves every submodule from the installed checkout however the slice is built, and the test passes on a module that cannot import in the image. Verified by injecting the import back into the tempdir copy, which reproduces the traceback verbatim. Delta measured by loading the committed module and this one side by side: identical on both requirements files, against the real collections directory and an empty one, on a missing file, on non-UTF-8 input and on a corrupt MANIFEST.json. The one behavioural difference is that a file changed within a process is now read fresh rather than from the memo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>