kevinveenbirkenbachandClaude Opus 5 fa3797540a fix(cache): keep a mid-render domain map out of the finished one ...

26 roles resolve a domain in their metadata, so lookup('tls') and lookup('domains') run inside the applications render. Under the re-entry guard those calls receive the unrendered tree, whose service flags are still Jinja strings, and _as_bool reads "{{ 'svc-net-tor' in group_names }}" as false. The resulting map skipped onion injection for every app that does not enable tor literally, and it was cached, so it answered every later read in that process.

Before the applications carrier each worker rendered and poisoned its own cache the same way, which is why the shared Keycloak client registered 5 onion origins then and 65 now. The render state joins the cache key, so the render's own call sites still share one map while a later read builds the finished one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-03 09:31:25 +02:00

..

users

refactor(domains): give local testing a .test domain, leave .example to docs

2026-09-02 13:10:34 +02:00

__init__.py

…

test_applications.py

perf(applications): render the applications SPOT once per play instead of once per task

2026-09-02 23:55:32 +02:00

test_base.py

refactor(domains): give local testing a .test domain, leave .example to docs

2026-09-02 13:10:34 +02:00

test_data.py

…

test_domains.py

fix(cache): keep a mid-render domain map out of the finished one

2026-09-03 09:31:25 +02:00

test_files.py

…

test_variants.py

…

test_yaml.py

…