Skip to content

fix(cli): release the configuration writer before Docker effects - #840

Open
Medformatik wants to merge 2 commits into
mainfrom
fix/cli-writer-before-docker
Open

Medformatik wants to merge 2 commits into
mainfrom
fix/cli-writer-before-docker

Conversation

@Medformatik

@Medformatik Medformatik commented Nov 9, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

openmapx services start held the configuration writer across docker compose, so a starting ops-agent could not take that lock and the documented fresh install failed.
The CLI now takes the writer and release-store lock only around checks and commits, and holds only the target lease while Docker runs.
Before each Docker effect a writer step re-checks the generation and the release selection, and after the effect the next step fails the lifecycle if either changed.
Cancellation or deadline expiry now still records failed, through a narrow core entry that can write only failed or unknown and refuses settlement-only leases.

Behaviour to know

A release reselection during a Docker effect is now detected and fails the lifecycle, where the lock used to block it.
The next change in this series releases targets after such a contained failure.

Verified

Lifecycle and receipt tests pass (33), and pnpm check-types passes.
Not run locally: the full node project, left to CI. A real fresh install is exercised by the install CI job later in this series.

Release and upgrade impact

No package release: the only core code @openmapx/extension-cli reaches through @openmapx/integration-framework is AnchoredDirectory; the lifecycle, receipt and lease code changed here is not reachable from it, so its behaviour is unchanged.

`services start` held the configuration writer across `docker compose up`.
The operations agent takes that writer at startup, so it waited, exited and
restarted, and a fresh install could never come up.

Hold the writer and release-store lock only inside short steps around checks
and commits, keeping just the target lease between them. Each Docker effect is
preceded by a generation and release-selection re-check inside a step and
followed by another, so a writer that moves either while the lock is free
fails the lifecycle instead of being recorded as applied.

An effect cancelled between steps now keeps its last signed receipt phase,
because a cancelled lease cannot open another writer step. The target fence
stays in place and callers treat the receipt as unresolved.
Once the writer is released between steps, a lease cancelled or expired
during a Docker effect could no longer take lifecycle ownership, so the
receipt stayed at its last phase with no failure recorded.

Add a receipt-only entry to the lifecycle store. It needs a live writer and
the exact physical lease owner, refuses a lease restored for settlement, and
writes only the failed and unknown phases. The outer failure path records
through it. If recording fails, the original failure still propagates and the
command warns that its targets stay fenced.
@Medformatik Medformatik added the docker Container images and Docker build or deployment tooling label Nov 9, 2026
@Medformatik Medformatik self-assigned this Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docker Container images and Docker build or deployment tooling

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant