Resolve settled-System teardown route in the database, not by server upgrade order

Open
  • Is something wrong?
#3,598 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
postgresql, python, sql
Domain
authorization, backend, database

Research direction

Start with the resolver's latest definition in src/kdive/db/schema/0167_unrouted_preparing_teardown_route.sql and the settlement update in 0194_stranded_activation_settlement.sql, then read _enqueue_authority_teardown in src/kdive/mcp/tools/lifecycle/systems/admin.py. Done means a forward-only migration makes the resolver return no route for settled activations, with a real-database test for settled and unsettled Systems and updated migration-window tests and ADR-0816 notes.

Written by the indexing model from the issue text.

Description

area:core-platform effort:S priority:P3 risk:daytime-only status:ready type:bug

Problem

An older server still routes a settled System's teardown to the external-boot authority. Settlement supersedes only allocating and current authority rows, so a retired row survives, and resolve_external_boot_system_teardown_dispatch_binding still returns a route for it. #3551 closes this in the new server code only; the database offers no protection, so ADR-0816 relies on upgrade order ("do not use the tool until every server is upgraded"). An authority teardown that finalizes for a settled System marks it torn_down while the worker's domain still runs.

Evidence

  • src/kdive/db/schema/0167_unrouted_preparing_teardown_route.sql:6- (latest definition of the resolver): the first branch joins external_boot_authorities with state IN ('current', 'retired') for the newest activation whose state is not torn_down. A settled activation is abandoned, so it passes.
  • src/kdive/db/schema/0194_stranded_activation_settlement.sql:282-284: settlement sets state = 'superseded' only WHERE state IN ('allocating', 'current'), leaving retired rows.
  • src/kdive/mcp/tools/lifecycle/systems/admin.py:101-104,809: the resolver's only caller, _enqueue_authority_teardown. route_external_boot_teardown (admin.py:575-) reads the settlement first, but only in current code.
  • ADR-0816 amendment (#3551), Consequences: an old server routes a settled System to the authority over its retired row.
  • PR #3579 WORK:REVIEW follow-up candidate 1.

Expected

The resolver returns no route when the newest activation is settled, so no server version can enqueue an authority teardown for a settled System, and the rollout no longer depends on upgrade order for this fence.

Proposed approach

Add a forward-only migration that replaces the resolver (CREATE OR REPLACE, same signature and grants) and adds AND NOT EXISTS (SELECT 1 FROM public.external_boot_activation_settlements s WHERE s.activation_id = newest.id AND s.settled_at IS NOT NULL) to both branches. An old server then fails closed through its existing external_boot_teardown_authority_unresolved path. Add a real-database test: a settled System with a retired authority row resolves to no route, and an unsettled one is unchanged. Update the ADR-0816 upgrade-order note and the runbook upgrade paragraph, and add the new migration row to the migration-window tests.

Provenance

Follow-up from campaign 4c2c8dc9e59d-7f9a87f5-2251-458a-bb30-04fbb2d4b05c, PR #3579.

Dominant language
Python
Stars
0
Forks
0
Avg merge
9h 13m
Merged PRs (30d)
197

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from randomparity/kdive

All issues in randomparity/kdive

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.