gowalk-cicd 1.0.193 → 1.0.195

package/backend-action/action.yml

@@ -222,6 +222,8 @@ runs:
           "${{ github.action_path }}/runtime_env.py" \
           "${{ github.action_path }}/runtime_env_parse.py" \
           "${{ github.action_path }}/runtime_model.py" \
+          "${{ github.action_path }}/runtime_healthcheck.py" \
+          "${{ github.action_path }}/runtime_image_health.py" \
           "${{ github.action_path }}/runtime_host.py" \
           "${{ github.action_path }}/native_profile.py" \
           "${{ github.action_path }}/runtime_launch.py" \

package/backend-action/health_rollout.py

@@ -0,0 +1,167 @@
+"""Operator-only, exact-container health-cache adoption with a retained-container rollback."""
+import argparse
+import json
+import os
+import re
+import time
+from pathlib import Path
+from urllib.parse import quote
+
+import health_rollout_credit as credit
+from health_rollout_engine import Engine, MARKER, healthy, probe, unshared
+from health_rollout_spec import ROLES, receipt, scope, specification, unchanged, verified
+from runtime_host import host_enabled, start_lock
+from runtime_launch import START_LOCK
+from runtime_readback import profile
+
+
+def allowed(app, service, identifier, image):
+    if (not re.fullmatch('[a-z0-9][a-z0-9-]{0,79}', app) or service not in ROLES
+            or not re.fullmatch('[a-f0-9]{64}', identifier) or not re.fullmatch('sha256:[a-f0-9]{64}', image)):
+        raise ValueError('rollout_scope_invalid')
+    host_enabled()
+    document = profile(app)
+    if document is not None:
+        value = json.loads(document)
+        if value.get('disabled') or service in value.get('remove_services', []):
+            raise ValueError('runtime_disabled')
+    if Path('/opt/gowalk-backend-native', app + '.json').exists():
+        raise ValueError('native_runtime_unsupported')
+    return document
+
+
+def completed(engine, app, service, identifier, image, dry_run):
+    filters = quote(json.dumps({'label': [MARKER + '=' + identifier]}), safe='')
+    matches = engine.request('GET', '/containers/json?all=1&filters=' + filters)
+    if len(matches) != 1:
+        raise ValueError('original_container_missing')
+    current = engine.inspect(matches[0]['Id'])
+    scope(current, app, service, image)
+    if not current['State']['Running'] or current['State'].get('Health', {}).get('Status') != 'healthy':
+        raise ValueError('replacement_health_unconfirmed')
+    if not dry_run:
+        probe(engine, current['Id'], current['Config']['Healthcheck']['Test'])
+    return receipt(app, service, identifier, current['Id'], 'already_applied')
+
+
+def candidate(engine, old, body, name, staged, reservation):
+    if old['Name'].lstrip('/') != staged:
+        engine.request('POST', '/containers/' + old['Id'] + '/rename?name=' + quote(staged, safe=''))
+    current = engine.inspect(old['Id'])
+    unchanged(old, current)
+    if current['State']['Running']:
+        engine.request('POST', '/containers/' + old['Id'] + '/stop?t=10')
+    replacement = engine.inspect(name, missing=True)
+    if replacement is None:
+        result = engine.request('POST', '/containers/create?name=' + quote(name, safe=''), body)
+        replacement = engine.inspect(result['Id'])
+    verified(replacement, body, old)
+    credit.retain(replacement['Id'], reservation)
+    if not replacement['State']['Running']:
+        engine.request('POST', '/containers/' + replacement['Id'] + '/start')
+    return replacement['Id']
+
+
+def confirmed(engine, method, path, proof):
+    try:
+        engine.request(method, path)
+    except Exception:
+        if not proof():
+            raise
+
+
+def rollback(engine, old, name, reservation):
+    replacement = engine.inspect(name, missing=True)
+    if replacement is not None and replacement['Id'] != old['Id']:
+        if (replacement['Config'].get('Labels', {}).get(MARKER) != old['Id']
+                or replacement['Image'] != old['Image']):
+            raise ValueError('rollback_name_conflict')
+        confirmed(engine, 'DELETE', '/containers/' + replacement['Id'] + '?force=1&v=0',
+                  lambda: engine.inspect(replacement['Id'], missing=True) is None)
+    retained = engine.inspect(old['Id'])
+    unchanged(old, retained, reservation_changes=True)
+    if retained['Name'].lstrip('/') != name:
+        confirmed(engine, 'POST', '/containers/' + old['Id'] + '/rename?name=' + quote(name, safe=''),
+                  lambda: engine.inspect(old['Id'])['Name'].lstrip('/') == name)
+    if not retained['State']['Running']:
+        confirmed(engine, 'POST', '/containers/' + old['Id'] + '/start',
+                  lambda: engine.inspect(old['Id'])['State']['Running'])
+    healthy(engine, old['Id'], engine.deadline)
+    probe(engine, old['Id'], old['Config']['Healthcheck']['Test'])
+    if replacement is not None and replacement['Id'] != old['Id']:
+        credit.forget(replacement['Id'], reservation)
+
+
+def apply(engine, app, service, old, body, name, staged, original_profile, reservation):
+    try:
+        replacement = candidate(engine, old, body, name, staged, reservation)
+        current = healthy(engine, replacement, min(time.monotonic() + 40, engine.deadline - 25))
+        verified(current, body, old)
+        probe(engine, replacement, old['Config']['Healthcheck']['Test'])
+        host_enabled()
+        if profile(app) != original_profile:
+            raise ValueError('runtime_profile_changed')
+        unchanged(old, engine.inspect(old['Id']))
+        try:
+            engine.request('DELETE', '/containers/' + old['Id'] + '?v=0')
+        except Exception:
+            if engine.inspect(old['Id'], missing=True) is not None:
+                raise
+        return receipt(app, service, old['Id'], replacement)
+    except Exception:
+        try:
+            rollback(engine, old, name, reservation)
+        except Exception:
+            raise ValueError('rollback_unconfirmed') from None
+        raise ValueError('rollout_failed_restored') from None
+
+
+def rollout(app, service, identifier, image, dry_run=False):
+    original_profile = allowed(app, service, identifier, image)
+    with start_lock(START_LOCK):
+        if allowed(app, service, identifier, image) != original_profile:
+            raise ValueError('runtime_profile_changed')
+        engine = Engine()
+        old = engine.inspect(identifier, missing=True)
+        if old is None:
+            return completed(engine, app, service, identifier, image, dry_run)
+        if old['Id'] != identifier:
+            raise ValueError('runtime_changed')
+        scope(old, app, service, image)
+        body = specification(old)
+        reservation = credit.original(old)
+        suffix = '.gowalk-health-' + identifier[:12]
+        current_name = old['Name'].lstrip('/')
+        recovering = current_name.endswith(suffix)
+        name = current_name[:-len(suffix)] if recovering else current_name
+        if not recovering and (not old['State']['Running']
+                               or old['State'].get('Health', {}).get('Status') != 'healthy'):
+            raise ValueError('original_health_unconfirmed')
+        unshared(engine, old)
+        unchanged(old, engine.inspect(identifier))
+        if dry_run:
+            return receipt(app, service, identifier, status='recovery_required' if recovering else 'eligible')
+        return apply(engine, app, service, old, body, name, name + suffix, original_profile, reservation)
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    for name in ('project', 'service', 'container_id', 'image_id'):
+        parser.add_argument(name)
+    parser.add_argument('--dry-run', action='store_true')
+    args = parser.parse_args(argv)
+    try:
+        if os.geteuid() != 0:
+            raise ValueError('operator_root_required')
+        result = rollout(args.project, args.service, args.container_id, args.image_id, args.dry_run)
+    except Exception as error:
+        code = str(error) if isinstance(error, ValueError) and re.fullmatch('[a-z_]+', str(error)) else 'unclassified'
+        result = receipt(args.project, args.service, args.container_id, status=code)
+        print(json.dumps(result, separators=(',', ':')))
+        return 1
+    print(json.dumps(result, separators=(',', ':')))
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())

package/backend-action/health_rollout_credit.py

@@ -0,0 +1,39 @@
+"""Preserve the original container's trusted redeployment admission credit across health adoption."""
+import stat
+
+from memory_agent import DEFAULT, record
+from runtime_host import AGENT_STATE, ROOT_UID
+
+
+def read(identifier, default=None):
+    path = AGENT_STATE / identifier
+    try:
+        info = path.lstat()
+    except FileNotFoundError:
+        return default
+    if (not stat.S_ISREG(info.st_mode) or info.st_uid != ROOT_UID or info.st_mode & 0o022 or info.st_size > 64):
+        raise ValueError('reservation_record_invalid')
+    try:
+        value = int(path.read_text())
+    except (OSError, ValueError):
+        raise ValueError('reservation_record_invalid') from None
+    if value <= 0:
+        raise ValueError('reservation_record_invalid')
+    return value
+
+
+def original(row):
+    return read(row['Id'], row['HostConfig'].get('MemoryReservation') or DEFAULT)
+
+
+def retain(identifier, amount):
+    record(identifier, amount)
+    if read(identifier) != amount:
+        raise ValueError('reservation_record_changed')
+
+
+def forget(identifier, amount):
+    if read(identifier) is not None:
+        if read(identifier) != amount:
+            raise ValueError('reservation_record_changed')
+        (AGENT_STATE / identifier).unlink()

package/backend-action/health_rollout_engine.py

@@ -0,0 +1,84 @@
+"""Private, bounded Docker transport for the operator's selected health-check rollout."""
+import http.client
+import json
+import socket
+import subprocess
+import time
+from urllib.parse import quote
+
+MARKER = 'io.gowalk.backend.health-original'
+SOCKET = '/var/run/docker.sock'
+
+
+class Engine:
+    def __init__(self):
+        self.deadline = time.monotonic() + 90
+
+    def request(self, method, path, body=None, missing=False, raw=False):
+        remaining = self.deadline - time.monotonic()
+        if remaining <= 0:
+            raise ValueError('rollout_deadline')
+        connection = http.client.HTTPConnection('localhost', timeout=min(10, remaining))
+        connection.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        connection.sock.settimeout(min(10, remaining))
+        try:
+            connection.sock.connect(SOCKET)
+            data = None if body is None else json.dumps(body).encode()
+            connection.request(method, '/v1.45' + path, data, {'Content-Type': 'application/json'})
+            response = connection.getresponse()
+            content = response.read(2 * 1024 * 1024 + 1)
+            if missing and response.status == 404:
+                return None
+            if len(content) > 2 * 1024 * 1024 or response.status not in (200, 201, 204, 304):
+                raise ValueError('engine_operation_failed')
+            return content if raw else json.loads(content) if content else None
+        finally:
+            connection.close()
+
+    def inspect(self, identifier, missing=False):
+        return self.request('GET', '/containers/' + quote(identifier, safe='') + '/json', missing=missing)
+
+
+def unshared(engine, original):
+    identifiers = [row['Id'] for row in engine.request('GET', '/containers/json?all=1')]
+    if len(identifiers) > 1024:
+        raise ValueError('container_inventory_limit')
+    template = ('{"id":{{json .Id}},"network":{{json .HostConfig.NetworkMode}},'
+                '"pid":{{json .HostConfig.PidMode}},"ipc":{{json .HostConfig.IpcMode}},'
+                '"volumes":{{json .HostConfig.VolumesFrom}},"links":{{json .HostConfig.Links}}}')
+    result = subprocess.run(['docker', 'inspect', '--format', template, *identifiers],
+                            capture_output=True, text=True, timeout=15, check=True)
+    if len(result.stdout) > 1024 * 1024:
+        raise ValueError('container_inventory_limit')
+    references = {original['Id'], original['Id'][:12], original['Name'].lstrip('/')}
+    for line in result.stdout.splitlines():
+        row = json.loads(line)
+        if row['id'] == original['Id']:
+            continue
+        names = [row[field][10:] if row[field].startswith('container:') else row[field]
+                 for field in ('network', 'pid', 'ipc')]
+        names += [value.split(':')[0].lstrip('/') for field in ('volumes', 'links') for value in row[field] or []]
+        if references.intersection(names):
+            raise ValueError('container_has_consumers')
+
+
+def probe(engine, identifier, test):
+    command = test[1:] if test[0] == 'CMD' else ['/bin/sh', '-c', test[1]]
+    created = engine.request('POST', '/containers/' + identifier + '/exec',
+                             {'AttachStdout': False, 'AttachStderr': False, 'Cmd': command})
+    engine.request('POST', '/exec/' + created['Id'] + '/start', {'Detach': False, 'Tty': False}, raw=True)
+    result = engine.request('GET', '/exec/' + created['Id'] + '/json')
+    if result['Running'] or result['ExitCode'] != 0:
+        raise ValueError('original_probe_failed')
+
+
+def healthy(engine, identifier, deadline):
+    while time.monotonic() < deadline:
+        current = engine.inspect(identifier)
+        status = current['State'].get('Health', {}).get('Status')
+        if current['State']['Running'] and status == 'healthy':
+            return current
+        if not current['State']['Running'] or status == 'unhealthy':
+            raise ValueError('container_health_failed')
+        time.sleep(1)
+    raise ValueError('container_health_timeout')

package/backend-action/health_rollout_spec.py

@@ -0,0 +1,134 @@
+"""Copy an eligible running API's exact private Docker configuration; change only its health command."""
+import copy
+import re
+
+from health_rollout_engine import MARKER
+from runtime_healthcheck import cache_healthcheck
+
+ROLES = frozenset(('api', 'app', 'backend', 'web'))
+
+
+def scope(row, app, service, image):
+    labels = row['Config'].get('Labels') or {}
+    if (labels.get('com.docker.compose.project') != app
+            or labels.get('com.docker.compose.service') != service
+            or labels.get('com.docker.compose.project.working_dir') != '/opt/gowalk-backends/' + app
+            or row['Image'] != image or service not in ROLES
+            or labels.get('com.docker.compose.oneoff', 'false').lower() != 'false'):
+        raise ValueError('runtime_scope_changed')
+
+
+def mounts(row):
+    host = row['HostConfig']
+    declared = {}
+    for binding in host.get('Binds') or []:
+        parts = binding.split(':')
+        if len(parts) not in (2, 3):
+            raise ValueError('mount_unsupported')
+        declared[parts[1]] = parts[0]
+    for binding in host.get('Mounts') or []:
+        if binding.get('Type') not in ('bind', 'volume') or not binding.get('Source'):
+            raise ValueError('mount_unsupported')
+        declared[binding['Target']] = binding['Source']
+    for mounted in row.get('Mounts') or []:
+        kind, target = mounted['Type'], mounted['Destination']
+        if kind == 'tmpfs' and target in (host.get('Tmpfs') or {}):
+            continue
+        source = mounted.get('Name') if kind == 'volume' else mounted.get('Source')
+        if (kind not in ('bind', 'volume') or declared.get(target) != source
+                or kind == 'volume' and re.fullmatch('[a-f0-9]{64}', source or '')):
+            raise ValueError('mount_unsupported')
+
+
+def networks(row):
+    result = {}
+    for name, endpoint in row['NetworkSettings']['Networks'].items():
+        if endpoint.get('IPAMConfig') or endpoint.get('Links'):
+            raise ValueError('network_unsupported')
+        result[name] = {key: copy.deepcopy(endpoint[key]) for key in ('Aliases', 'DriverOpts') if endpoint.get(key)}
+    if not result:
+        raise ValueError('network_unsupported')
+    return {'EndpointsConfig': result}
+
+
+def published_ports(row):
+    declared = row['HostConfig'].get('PortBindings') or {}
+    if row['State']['Running']:
+        actual = {key: value for key, value in row['NetworkSettings'].get('Ports', {}).items() if value}
+        if declared != actual:
+            raise ValueError('dynamic_ports_unsupported')
+        return
+    # Docker clears live bindings on stop; a retained original still holds its exact explicit host ports.
+    for bindings in declared.values():
+        if not isinstance(bindings, list) or not bindings:
+            raise ValueError('dynamic_ports_unsupported')
+        for binding in bindings:
+            port = binding.get('HostPort') if isinstance(binding, dict) else None
+            if not isinstance(port, str) or not re.fullmatch('[0-9]+', port) or not 1 <= int(port) <= 65535:
+                raise ValueError('dynamic_ports_unsupported')
+
+
+def specification(row):
+    host = row['HostConfig']
+    if (not host.get('ReadonlyRootfs') or host.get('AutoRemove') or host.get('Privileged')
+            or host.get('VolumesFrom') or host.get('Links') or host.get('ContainerIDFile')
+            or host.get('PublishAllPorts') or host.get('PidMode') not in ('', 'private')
+            or host.get('IpcMode') not in ('', 'private', 'shareable')
+            or host.get('UTSMode') or host.get('NetworkMode') in ('host', 'none')
+            or host.get('NetworkMode', '').startswith('container:')):
+        raise ValueError('runtime_unsupported')
+    if row['Config'].get('Shell') not in (None, [], ['/bin/sh', '-c']):
+        raise ValueError('custom_shell_unsupported')
+    if (row['Config'].get('StopTimeout') or 10) > 10:
+        raise ValueError('stop_timeout_unsupported')
+    published_ports(row)
+    mounts(row)
+    health = copy.deepcopy(row['Config'].get('Healthcheck') or {})
+    if (health.get('StartPeriod', 0) < 30000000000
+            or (health.get('StartInterval') or 5000000000) > 5000000000
+            or (health.get('Timeout') or 30000000000) > 5000000000):
+        raise ValueError('health_startup_unsupported')
+    service = {'healthcheck': {'test': health.get('Test')},
+               'tmpfs': [name + ':' + options for name, options in (host.get('Tmpfs') or {}).items()],
+               'environment': dict(value.split('=', 1) for value in row['Config'].get('Env') or [])}
+    if not cache_healthcheck(service):
+        raise ValueError('healthcheck_not_eligible')
+    body = copy.deepcopy(row['Config'])
+    body['Image'] = row['Image']
+    body['Healthcheck']['Test'] = service['healthcheck']['test']
+    body.setdefault('Labels', {})[MARKER] = row['Id']
+    body['HostConfig'] = copy.deepcopy(host)
+    body['NetworkingConfig'] = networks(row)
+    return body
+
+
+def unchanged(before, after, reservation_changes=False):
+    hosts = [dict(row['HostConfig']) for row in (before, after)]
+    if reservation_changes:
+        for host in hosts:
+            host.pop('MemoryReservation', None)
+    if hosts[0] != hosts[1] or any(before[field] != after[field] for field in ('Id', 'Image', 'Config')):
+        raise ValueError('runtime_changed')
+
+
+def verified(row, body, original):
+    config = {key: value for key, value in body.items() if key not in ('HostConfig', 'NetworkingConfig')}
+    if (row['Config'] != config or row['Image'] != original['Image'] or row['HostConfig'] != body['HostConfig']):
+        raise ValueError('replacement_config_changed')
+    actual = row['NetworkSettings']['Networks']
+    expected = body['NetworkingConfig']['EndpointsConfig']
+    if set(actual) != set(expected):
+        raise ValueError('replacement_network_changed')
+    for name, endpoint in expected.items():
+        if (not set(endpoint.get('Aliases') or []).issubset(actual[name].get('Aliases') or [])
+                or (endpoint.get('DriverOpts') or {}) != (actual[name].get('DriverOpts') or {})):
+            raise ValueError('replacement_network_changed')
+    before = sorted(original['Mounts'], key=lambda mount: mount['Destination'])
+    after = sorted(row['Mounts'], key=lambda mount: mount['Destination'])
+    if before != after:
+        raise ValueError('replacement_mount_changed')
+
+
+def receipt(app, service, old, new='', status='applied'):
+    return {'schema': 'gowalk-cicd/backend-health-rollout.v1', 'project': app, 'service': service,
+            'original_id': old, 'container_id': new, 'status': status}

package/backend-action/install_runtime.py

@@ -17,7 +17,11 @@ AUTHORIZED_KEYS = Path('/root/.ssh/authorized_keys')
 ROOT_UID = 0
 REQUIRED = (
     'ssh_gate.py', 'native_profile.py', 'native_deploy.py', 'runtime_host.py', 'runtime_launch.py',
-    'runtime_model.py', 'runtime_readback.py', 'runtime_projection.py', 'identity_diagnostics.py',
+    'runtime_model.py', 'runtime_healthcheck.py', 'runtime_image_health.py', 'runtime_readback.py',
+    'runtime_projection.py',
+    'identity_diagnostics.py',
+    'health_rollout.py', 'health_rollout_engine.py', 'health_rollout_spec.py', 'health_rollout_credit.py',
+    'memory_agent.py',
     'runtime_env.py', 'runtime_env_parse.py', 'edge_inputs.py', 'edge_vhost.py', 'edge_health.py',
     'configure_vhost.py', 'vhost_diagnostics.py', 'remote_deploy.sh', 'deploy_evidence.sh',
     'ensure_certificate.sh', 'select_certbot_account.sh',

package/backend-action/memory_agent.py

@@ -175,8 +175,11 @@ def run(dry_run, now=None):
     ids, containers = discover()
     now = time.time() if now is None else now
     try:
-        zswap = meminfo().get("SwapTotal", 0) > 0 and ZSWAP.read_text().strip() == "Y"
-    except OSError:
+        memory = meminfo()
+        # Admission leaves 30% of RAM for host headroom; avoid evicting useful pages while it is available.
+        zswap = (memory["MemTotal"] > 0 and 0 <= memory["MemAvailable"] * 10 < memory["MemTotal"] * 3
+                 and memory.get("SwapTotal", 0) > 0 and ZSWAP.read_text().strip() == "Y")
+    except (OSError, KeyError, ValueError, TypeError):
         zswap = False
     with ThreadPoolExecutor(max_workers=8) as pool:
         entries = list(pool.map(lambda container: handle(container, now, zswap, dry_run), containers))

package/backend-action/network_host.py

@@ -138,7 +138,7 @@ def vpn_settings(containers, app, service, bridge):
         if row['id'] != identifiers[0] or row['project'] != app or row['service'] != service:
             raise NetworkFailure('network_scope_mismatch')
         added = set(row['cap_add'] or [])
-        allowed = {'NET_ADMIN', 'NET_BIND_SERVICE', 'CHOWN', 'SETUID', 'SETGID'}
+        allowed = {'NET_ADMIN', 'NET_BIND_SERVICE', 'CHOWN', 'SETUID', 'SETGID', 'SETPCAP'}
         safe = (row['privileged'] is False and row['network_mode'] == bridge['name']
                 and 'NET_ADMIN' in added and added.issubset(allowed)
                 and 'ALL' in (row['cap_drop'] or [])

package/backend-action/runtime_healthcheck.py

@@ -0,0 +1,129 @@
+"""Cache recognized stdlib-only Python probes inside their existing bounded private tmpfs.
+
+Only the health process receives cache settings. CPython writes its own interpreter-tagged
+bytecode and validates source metadata; recreation discards the container's tmpfs cache.
+Probe code, health timing, application environment and filesystem permissions stay intact.
+"""
+import ast
+import re
+import shlex
+
+CACHE_ROOT = '/tmp/.gowalk-healthcheck-pycache'
+MODULES = {'urllib.request', 'urllib.error', 'json', 'sys', '__future__'}
+DYNAMIC = {'__import__', 'eval', 'exec', 'compile', 'getattr', 'setattr', 'import_module', 'load_module'}
+BOOTSTRAP = """import os, stat, sys
+if hasattr(sys, 'pycache_prefix') and sys.pycache_prefix is None:
+ try:
+  cache = {cache}
+  parent = os.lstat(os.path.dirname(cache))
+  safe_parent = (stat.S_ISDIR(parent.st_mode) and parent.st_uid in (0, os.geteuid())
+                 and (parent.st_mode & stat.S_ISVTX or not parent.st_mode & 0o022))
+  if safe_parent:
+   try:
+    os.mkdir(cache, 0o700)
+   except FileExistsError:
+    pass
+   info = os.lstat(cache)
+   if (stat.S_ISDIR(info.st_mode) and info.st_uid == os.geteuid()
+       and stat.S_IMODE(info.st_mode) == 0o700 and os.access(cache, os.W_OK | os.X_OK)):
+    sys.pycache_prefix = cache
+    sys.dont_write_bytecode = False
+ except OSError:
+  pass
+exec(compile(sys.argv.pop(1), '<string>', 'exec', dont_inherit=True))"""
+
+
+def stdlib_probe(source):
+    if not isinstance(source, str) or len(source) > 4096:
+        return False
+    try:
+        tree = ast.parse(source)
+    except (SyntaxError, ValueError, RecursionError):
+        return False
+    modules = set()
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            modules.update(alias.name for alias in node.names)
+        elif isinstance(node, ast.ImportFrom):
+            if node.level or any(alias.name == '*' for alias in node.names):
+                return False
+            modules.add(node.module)
+        elif isinstance(node, ast.Name) and node.id in DYNAMIC:
+            return False
+        elif isinstance(node, ast.Attribute) and (node.attr in DYNAMIC or node.attr.startswith('__')):
+            return False
+    return 'urllib.request' in modules and modules <= MODULES
+
+
+def transform_healthcheck(test):
+    if not isinstance(test, list) or not all(isinstance(word, str) for word in test):
+        return None
+    if test[:1] == ['CMD']:
+        arguments = test[1:]
+    elif test[:1] == ['CMD-SHELL'] and len(test) == 2:
+        try:
+            arguments = shlex.split(test[1])
+        except ValueError:
+            return None
+        if arguments[3:] == ['||', 'exit', '1']:
+            arguments = arguments[:3]
+    else:
+        return None
+    if len(arguments) != 3 or arguments[1] != '-c':
+        return None
+    if not re.fullmatch(r'(?:/(?:[a-zA-Z0-9_.-]+/)*)?python(?:3(?:[.][0-9]+)?)?', arguments[0]):
+        return None
+    if not stdlib_probe(arguments[2]):
+        return None
+    bootstrap = BOOTSTRAP.format(cache=repr(CACHE_ROOT))
+    if test[0] == 'CMD':
+        return ['CMD', arguments[0], '-c', bootstrap, arguments[2]]
+    prefix = re.match(r'(\s*' + re.escape(arguments[0]) + r'\s+)-c(?=\s)', test[1])
+    if prefix is None:
+        return None
+    return ['CMD-SHELL', prefix[1] + '-c ' + shlex.quote(bootstrap) + test[1][prefix.end():]]
+
+
+def bounded_options(options):
+    fields = options.split(',')
+    if 'ro' in fields:
+        return False
+    sizes = [field[5:] for field in fields if field.startswith('size=')]
+    if len(sizes) != 1:
+        return False
+    match = re.fullmatch(r'([0-9]+)([kKmMgG]?)', sizes[0])
+    if not match:
+        return False
+    value = int(match[1]) * {'': 1, 'k': 1024, 'm': 1024 ** 2, 'g': 1024 ** 3}[match[2].lower()]
+    return value >= 16 * 1024 * 1024
+
+
+def bounded_tmpfs(service):
+    mounts = service.get('tmpfs', [])
+    if isinstance(mounts, str):
+        mounts = [mounts]
+    matches = [mount.partition(':')[2] for mount in mounts
+               if isinstance(mount, str) and mount.partition(':')[0] == '/tmp']
+    for volume in service.get('volumes', []):
+        if not isinstance(volume, dict) or volume.get('target') != '/tmp':
+            continue
+        if volume.get('type') != 'tmpfs' or volume.get('read_only'):
+            return False
+        matches.append('size=' + str(volume.get('tmpfs', {}).get('size', '')))
+    return len(matches) == 1 and bounded_options(matches[0])
+
+
+def cache_healthcheck(service):
+    health = service.get('healthcheck', {})
+    if health.get('disable') or not bounded_tmpfs(service):
+        return False
+    environment = service.get('environment', {})
+    if isinstance(environment, list):
+        environment = {item.split('=', 1)[0]: None for item in environment if isinstance(item, str)}
+    if 'PYTHONPYCACHEPREFIX' in environment:
+        return False
+    updated = transform_healthcheck(health.get('test'))
+    if updated is None:
+        return False
+    health['test'] = updated
+    return True

package/backend-action/runtime_image_health.py

@@ -0,0 +1,50 @@
+"""Resolve inherited health probes only from freshly built local images and pin their exact identity."""
+import copy
+import json
+import re
+import subprocess
+
+from runtime_healthcheck import bounded_tmpfs, cache_healthcheck
+
+
+def eligible(service):
+    health = service.get('healthcheck', {})
+    policies = (None, 'never', 'build', 'missing', 'if_not_present')
+    return (bool(service.get('build')) and service.get('pull_policy') in policies
+            and not health.get('disable') and 'test' not in health and bounded_tmpfs(service))
+
+
+def image_health(command, name, service):
+    reference = service.get('image')
+    if not reference:
+        result = subprocess.run(command + ['config', '--images', name],
+                                capture_output=True, text=True, timeout=30, check=True)
+        references = result.stdout.split()
+        if len(references) != 1:
+            raise ValueError('runtime_built_image_ambiguous')
+        reference = references[0]
+    template = '{"Id":{{json .Id}},"Healthcheck":{{json .Config.Healthcheck}}}'
+    result = subprocess.run(['docker', 'image', 'inspect', '--format', template, '--', reference],
+                            capture_output=True, text=True, timeout=30, check=True)
+    image = json.loads(result.stdout)
+    if not isinstance(image, dict) or not re.fullmatch('sha256:[a-f0-9]{64}', str(image.get('Id'))):
+        raise ValueError('runtime_built_image_invalid')
+    return image
+
+
+def inherit_healthchecks(model, command):
+    changed = False
+    for name, service in model['services'].items():
+        if not eligible(service):
+            continue
+        image = image_health(command, name, service)
+        health = image.get('Healthcheck') or {}
+        if not isinstance(health, dict) or not health.get('Test'):
+            continue
+        candidate = copy.deepcopy(service)
+        candidate.setdefault('healthcheck', {})['test'] = health['Test']
+        if cache_healthcheck(candidate):
+            service['healthcheck'] = candidate['healthcheck']
+            service.update(image=image['Id'], pull_policy='never')
+            changed = True
+    return changed

package/backend-action/runtime_launch.py

@@ -8,6 +8,7 @@ import tempfile
 from pathlib import Path
 
 from runtime_host import admit, host_facts, running_containers, start_lock
+from runtime_image_health import inherit_healthchecks
 from runtime_model import configure
 
 PROFILE_ROOT = Path("/opt/gowalk-backend-runtime")
@@ -43,6 +44,8 @@ def launch(app, arguments):
             if profile_snapshot(app) != original_profile:
                 raise ValueError('runtime_profile_changed')
             admit(app, model, host_facts(), running_containers())
+            if inherit_healthchecks(model, command):
+                Path(filename).write_text(json.dumps(model))
             subprocess.run(command + ["up", "-d", "--no-build", "--remove-orphans"], check=True)
     finally:
         Path(filename).unlink()

package/backend-action/runtime_model.py

@@ -3,6 +3,8 @@ import copy
 import math
 import re
 
+from runtime_healthcheck import cache_healthcheck
+
 MIB = 1024 * 1024
 SCHEMA = "gowalk-cicd/backend-runtime.v1"
 SERVICE_FIELDS = {"environment", "command", "entrypoint", "mem_limit", "mem_reservation", "cpus", "pids_limit"}
@@ -98,6 +100,7 @@ def configure(document, profile=None):
         raise ValueError("compose_services_required")
     for service in model["services"].values():
         bound_service(service)
+        cache_healthcheck(service)
     return model
 
 

package/backend-action/runtime_projection.py

@@ -3,7 +3,7 @@ import math
 import re
 
 SCHEMA = 'gowalk-cicd/backend-runtime-diagnostics.v1'
-READER_VERSION = '1.0.193'
+READER_VERSION = '1.0.194'
 PROJECT = r'[a-z0-9][a-z0-9-]{0,79}'
 SERVICE = r'[a-z0-9][a-z0-9_-]{0,63}'
 SHA = r'[a-f0-9]{40}'

package/docs/BACKEND_HEALTHCHECKS.md

@@ -0,0 +1,88 @@
+# Python healthcheck bytecode cache
+
+`runtime_healthcheck.py` reduces repeated Python healthcheck import compilation. Runtime launch
+automatically wraps recognized `python -c` probes whose static imports are limited to
+`urllib.request`, `urllib.error`, `json`, `sys` and `__future__`. Application imports, script-file
+probes, dynamic imports, unknown interpreter flags and unrecognized shell commands stay unchanged.
+Both direct `CMD` and simple `CMD-SHELL` probes work, including a terminal `|| exit 1`.
+
+The wrapper uses the original Python executable, passes the original source as an unchanged
+argument, and restores `sys.argv` before compiling it as `<string>` with `dont_inherit=True`.
+It preserves shell quoting and variable expansion, exit status and the original health timing.
+It uses no additional executable, changes no application environment variable, and preserves
+existing cache settings inherited from either Compose or the image. Python before 3.8 simply
+keeps its original bytecode behavior.
+
+Only an existing writable `/tmp` tmpfs with an explicit size of at least 16 MiB qualifies.
+The cache lives at `/tmp/.gowalk-healthcheck-pycache` inside that same container and mount;
+the wrapper neither creates a new mount nor changes its size, ownership or permissions.
+The cache directory is created with mode 0700. An existing directory must be owned by the probe's
+effective UID, private, writable and not a symlink. Its parent must belong to that UID or root and
+be sticky or not group/other-writable. Unsafe paths keep the original uncached probe; the wrapper
+never changes permissions, deletes an existing path or trusts another user's cache.
+The measured Python 3.12 urllib probe cache used 1.5 MiB. CPython generates its own bytecode
+for the running interpreter and source, validates normal cache tags and source metadata,
+and discards this ephemeral cache on container recreation. Cache write failures retain
+normal Python import behavior. Startup imports before the wrapper remain unchanged.
+
+The deployed application, dependencies, credentials, volumes, read-only root filesystem,
+resource limits and probe cadence are preserved. Install the integrity-verified published
+host runtime to make this transform durable for future deployments; installing the helper
+alone does not recreate existing containers. See [host runtime installation](BACKEND_SSH_GATE.md).
+
+For build services inheriting their Dockerfile healthcheck, `runtime_image_health.py` reads only the
+local image ID and healthcheck after a successful build, under the existing host start lock. It
+wraps only a missing Compose test, retaining explicit timing and disabled/custom checks. The private
+launch model pins the transformed service to that inspected image ID with pulling disabled, so a
+moving tag cannot substitute another image's healthcheck. Explicit registry-refresh policies and
+non-build services retain their existing image/pull behavior. No pre-build image healthcheck is reused.
+
+## Adopt an existing API
+
+The released root-only `health_rollout.py` is an explicit operator maintenance command, outside the
+panel's forced SSH command vocabulary. Select one exact Compose project, API service, current full
+container ID and immutable image ID. Inspect eligibility before applying the same selection:
+
+```sh
+python3 -B /opt/gowalk-cicd-runtime/<version>/backend-action/health_rollout.py \
+  <project> <api|app|backend|web> <64-character-container-id> sha256:<64-character-image-id> --dry-run
+python3 -B /opt/gowalk-cicd-runtime/<version>/backend-action/health_rollout.py \
+  <project> <api|app|backend|web> <64-character-container-id> sha256:<64-character-image-id>
+```
+
+Dry-run checks identity, ownership labels, host/profile freezes, current health and supported runtime
+shape without running a probe or changing a container. Its receipt contains only project/service,
+original/replacement IDs and a fixed status. Private configuration stays in process memory.
+The command never resolves current app source, rebuilds, pulls, runs Compose, changes ingress,
+recreates sibling services, or removes volumes/images. Future ordinary deploys apply the same released
+runtime transform; no app source or private profile override is needed.
+
+Only running healthy APIs with read-only root filesystems, supported named volumes/binds and the
+recognized bounded-tmpfs health probe qualify. Writable root filesystems, anonymous/undeclared mounts,
+workers/datastores/one-off containers, auto-remove, host/shared namespaces, namespace/volume/link consumers,
+static IP assignments, dynamic published ports and custom shells refuse. Existing health timing must
+have at least a 30-second startup grace, startup checks at most five seconds apart and a timeout at most
+five seconds. Stop timeout must be at most ten seconds. These preserve health cadence while permitting
+bounded adoption and rollback. Unsupported configurations keep their existing runtime unchanged.
+
+The helper holds the same host start lock as ordinary deployment for a 90-second transaction budget.
+It rechecks exact container/image/configuration and retains the original container under a deterministic
+`.gowalk-health-<old-id-prefix>` name. The replacement uses the existing image ID and copies private env,
+command, entrypoint, user, limits, mounts, published ports and actual network aliases; only its health
+command and the `io.gowalk.backend.health-original` maintenance label change. Its trusted memory-agent
+admission-credit record is copied to the replacement ID before start, preserving future redeploy credit.
+Malformed original records refuse before mutation. The existing memory timer may still adjust the old
+reservation; a race causes restoration that preserves that latest value.
+
+The replacement must pass exact configuration/mount/network readback, Docker health and the original
+HTTP health command before the old container is removed without volumes. Failures remove only the
+marker-bound replacement, restore/start the original and verify its original health before returning
+`rollout_failed_restored`; the replacement's admission record is then removed. A lost reply is confirmed
+by identity/state readback. `rollback_unconfirmed` means recovery needs another exact readback/replay;
+retained containers and records stay available, and unrelated containers are never removed to clear a name.
+
+Replay with the same original ID resumes an interrupted retained-container transaction. After successful
+cleanup it finds the marker-bound healthy replacement and returns `already_applied`. It refuses absent,
+ambiguous or changed runtime evidence. Start with one canary, verify application health externally and
+measure load, then use bounded sequential selections for the remaining eligible services. Never turn this
+maintenance command into a blanket fleet restart.

package/docs/BACKEND_MEMORY.md

@@ -10,9 +10,11 @@ that started at least ten minutes ago, it first measures the working set (`memor
   container's limit (`docker update --memory-reservation`). App containers rise at once and fall by 8 MiB or more.
   Datastores (PostgreSQL, PostGIS, TimescaleDB, Redis, Valkey, KeyDB, MySQL, MariaDB, MongoDB or Memcached by
   image, service or command, or service `db`/`database`) only rise, and only with memory beyond their file cache;
-- while swap is present, zswap is enabled (`/sys/module/zswap/parameters/enabled` is `Y`) and `memory.pressure`
+- only when host `MemAvailable` is below 30% of `MemTotal` (the headroom outside admission's 70% reservation cap),
+  while swap is present, zswap is enabled (`/sys/module/zswap/parameters/enabled` is `Y`) and `memory.pressure`
   `some avg60` is below 0.5, writes a quarter of an app container's anonymous memory to `memory.reclaim`,
-  compressing cold pages into zswap. Datastores are never reclaimed.
+  compressing cold pages into zswap. Datastores are never reclaimed. With ample host memory, reservation
+  measurement and updates continue without proactive page eviction; reclaim resumes when headroom falls.
 
 Before its first change to a container, the agent records the reservation admission counted (bytes; 64 MiB when
 unset) in `/var/lib/gowalk-backend-memory/<full container id>` (root-owned, 0644, atomic, fsynced, never
@@ -76,7 +78,8 @@ record, prune, `docker update` or reclaim). A real run prints a `{"name","id","f
 per changed container and a line per error, then the `gowalk-cicd/backend-memory.v1` summary that
 `journalctl _SYSTEMD_UNIT=gowalk-backend-memory.service -n 1 -o cat` shows: `reserved_mib` is the
 admission-equivalent sum after the run, `headroom_mib` what remains of `cap_mib`, `released_mib` what the run
-returned, `zswap` whether reclaim was allowed, `partial` the reclaims completed only in part and `native_mib` null
+returned, `zswap` whether reclaim was allowed by host headroom and swap availability, `partial` the reclaims
+completed only in part and `native_mib` null
 (natives excluded) when native discovery failed. Only unavailable Docker exits 1.
 
 Roll back with `systemctl disable --now gowalk-backend-memory.timer && systemctl stop gowalk-backend-memory.service`

package/docs/BACKEND_SSH_GATE.md

@@ -130,7 +130,7 @@ socket observations before returning. A changed or ambiguous observation refuses
 - `namespace` reports local rootful Linux Docker, existing host forwarding, read-only XFRM/netfilter
   availability and the selected bridge's observed masquerade rule. Existing VPN settings are observed only
   for this app's exact service. `isolated_net_admin` requires that bridge, no privileged mode, dropping ALL,
-  only NET_ADMIN plus optional NET_BIND_SERVICE/CHOWN/SETUID/SETGID for bootstrap and privilege dropping,
+  only NET_ADMIN plus optional NET_BIND_SERVICE/CHOWN/SETUID/SETGID/SETPCAP for bootstrap and privilege dropping,
   and namespace-only forwarding/redirect settings. This observes grants, not that a daemon actually dropped privileges.
   An absent VPN reports `absent`; these observations do not test creating a namespace or applying capabilities.
 - `firewall` reports observed INPUT/FORWARD policies and explicit UDP ACCEPT rules. Effective ingress

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.193",
+  "version": "1.0.195",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {
@@ -42,6 +42,7 @@
     "docs/BACKEND_SSH_GATE.md",
     "docs/BACKEND_NATIVE.md",
     "docs/BACKEND_MEMORY.md",
+    "docs/BACKEND_HEALTHCHECKS.md",
     "docs/CONFIGURATION.md",
     "docs/CI_PERFORMANCE.md",
     "docs/LOCAL_VALIDATION.md"