Description
Stateless pods need state that follows the lease, since an RWO volume cannot. Add STATE_BACKEND=kubernetes (file stays the default) behind the existing persist seam, using pre-created ConfigMaps named by config.
Scope: control state, boot manifest, git fetch status, fetched git blueprint blobs (one object per source, with a per-source size cap under 1 MiB) so a git host outage at boot is not fatal.
Rules (from review of internal/control/control.go, which reads once at NewStore and overwrites the whole document on every write):
- Leader-only writes; the standby opens the backend read-only.
- Writes use resourceVersion compare-and-swap; a conflict reloads, reapplies and retries.
- On acquiring the lease, re-read and ApplyControl the snapshot before the first tick.
- Never needs create/list/watch: objects are pre-created, so RBAC can be get/update/patch by resourceNames.
Acceptance Criteria
- #1 STATE_BACKEND=kubernetes persists control state, boot manifest, fetch status and capped git blobs to named ConfigMaps
- #2 Concurrent-write test: a stale writer gets a conflict and converges without losing the other write
- #3 New leader re-reads and applies state before its first tick
- #4 Needs only get/update/patch on the named objects; file backend unchanged
Definition of Done
- #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
- #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
- #3 just dump — inventory diffed against signals/
Implementation Plan
Frozen HA seam section5; file default preserved, named precreated ConfigMap backend for control/manifest/status/capped blobs; CAS conflict reapply; acquisition re-read beforetick; unknown outcome503/notready; fakeclient publicboundary/failfirst proof then fullgate/security/CodeRabbit preland. No cluster interaction.
Implementation Notes
loop1: implementation attempts 0; frozen order waits for SKT-0092 (lease HA), SKT-0093 (standby readiness), and SKT-0098 (runtime console base path). All unlanded/parked. Frozen reviewed backend API design retained; no backend/ConfigMap source implementation. Resume after accepted prerequisite lands/gates.
loop2: implementation attempts 0; dependency-held by SKT-0092 (lease HA with crash-only fencing), whose final authorized implementation attempt failed compilation and was not landed. No downstream source changes. Resume in frozen order after prerequisite accepted land and green composed gate; owner must first authorize further HA repair.
loop3: implementation attempts0; dependency-held by SKT-0092 (lease HA with crash-only fencing). Attempt5 local gate and review completed, but security rejects retained-runtime-red proof provenance; final Astra rescue confirms incompatible premise, no HA land. Resume frozen order only after corrected proof contract or valid missing evidence, accepted HA land and green composed gate. No downstream source changes.
loop4: implementation attempts0; HA source landed ddee479 but composed gate remains red, owned by SKT-0109 (resolve late Faro POST test-oracle proof defect). No readiness/console/backend/chart code begun. Resume frozen order only after owner-authorized HA proof repair and green composed gate; readiness+console first, then state backend, then chart.
loop5 attempts0; dependency-held: SKT-0109 (late Faro POST oracle) candidate unlanded because full gate exposes independent coordinator-loss assertion/admission discrepancy. No downstream source changes. Resume only after authorized repair and prerequisite accepted land/composed green.
loop7 implementation attempts0; dependency park: H93/B98 must land before S94; R13 park itself is not a blocker per goal. Resume frozen order after prerequisite accepted land/green gate; no candidate/source changes this run.
loop8 attempts0, priorcountsunchanged. Parkneedsdependency: B98mustland first; U115publicationrepairlanded but console/readinesschainblockedR12. ResumefrozenbackendseamafterB98.
loop10: new implementation attempts0, historical implementation count0 unchanged. Dependency park on SKT-0098 (runtime console base path) acceptance and land; no gate or acceptance claimed. Resume frozen serial order after prerequisite green/land, using retained exact candidate where provided; no reset or reconstruction from prose.
This run: Dependency SKT-0098 (runtime console base path) unaccepted/unlanded; performance prerequisite reverted after CI489.278s. Retained input unchanged; zero new implementation attempts. Resume frozen order after prerequisite accepted land and gate.
This run: four implementation cycles total (worker2, rescue1+rescue2), ceilingreachedwithoutreset. Initialresponse-lossfixture correctedforactualtypedclientmediaformat; securityfoundmutableGitrefdouble-resolution, finalrepairbindsbytesimmutableSHA viaadditivecapability andnativeGitHTTPSmovingrefnegative/positiveproof. FakeclientconsumerCASbothwrites/orderedapply/receiptloss/mismatch/resetinterveningwrite/unknown503readiness/cap/standby/acquisitionbeforeactualfirsttick andfilecompatproofsgreen. Rootland708afee1ab5b04af9483fc113be26fb9b3b9d2c5, exactCI38081516479 all10jobs green; cleancomposedgate0 withactual30embedinputs. FullCodeRabbit21filesplus4delta allfinal23covered zero majorcritical/unreviewed; two minorsretainedper frozenRBAC andtruthfulhealth. Securityfull+deltaPASS. No liveclusterproofclaimed; no signal/emissioninventorychange.
loop12: four implementation cycles total in this authorized ladder (worker2, rescue1, rescue2), no reset. Done with immutable-source/response-loss/acquisition proofs, full plus delta reviews, exact-SHA CI and composed gate.
Final Summary
Named ConfigMap persistence now supports control, boot and revision-bound cached Git/source status with conditional writes and response-loss reconciliation. Lease activation re-reads state/source topology before the first tick; standby never writes. File mode and frozen APIs remain compatible. All four criteria have exact landedSHA CI and composed proof.