gowalk-cicd 1.0.200 → 1.0.201

package/backend-action/health_rollout.py

@@ -39,6 +39,7 @@ def completed(engine, app, service, identifier, image, dry_run):
     scope(current, app, service, image)
     if not current['State']['Running'] or current['State'].get('Health', {}).get('Status') != 'healthy':
         raise ValueError('replacement_health_unconfirmed')
+    engine.configure(current['Config'])
     if not dry_run:
         probe(engine, current['Id'], current['Config']['Healthcheck']['Test'])
     return receipt(app, service, identifier, current['Id'], 'already_applied')
@@ -71,6 +72,7 @@ def confirmed(engine, method, path, proof):
 
 
 def rollback(engine, old, name, reservation):
+    engine.recover()
     if engine.pending_stop is not None:
         engine.stop(old['Id'])
     replacement = engine.inspect(name, missing=True)
@@ -88,7 +90,7 @@ def rollback(engine, old, name, reservation):
     if not retained['State']['Running']:
         confirmed(engine, 'POST', '/containers/' + old['Id'] + '/start',
                   lambda: engine.inspect(old['Id'])['State']['Running'])
-    healthy(engine, old['Id'], engine.deadline)
+    healthy(engine, old['Id'], min(time.monotonic() + engine.timing.health_seconds, engine.deadline))
     probe(engine, old['Id'], old['Config']['Healthcheck']['Test'])
     if replacement is not None and replacement['Id'] != old['Id']:
         credit.forget(replacement['Id'], reservation)
@@ -97,7 +99,7 @@ def rollback(engine, old, name, reservation):
 def apply(engine, app, service, old, body, name, staged, original_profile, reservation):
     try:
         replacement = candidate(engine, old, body, name, staged, reservation)
-        current = healthy(engine, replacement, min(time.monotonic() + 40, engine.deadline - 25))
+        current = healthy(engine, replacement, min(time.monotonic() + engine.timing.health_seconds, engine.deadline))
         verified(current, body, old)
         probe(engine, replacement, old['Config']['Healthcheck']['Test'])
         host_enabled()
@@ -131,6 +133,7 @@ def rollout(app, service, identifier, image, dry_run=False):
             raise ValueError('runtime_changed')
         scope(old, app, service, image)
         body = specification(old)
+        engine.configure(old['Config'])
         reservation = credit.original(old)
         suffix = '.gowalk-health-' + identifier[:12]
         current_name = old['Name'].lstrip('/')

package/backend-action/health_rollout_engine.py

@@ -6,15 +6,26 @@ import subprocess
 import time
 from urllib.parse import quote
 
+from health_rollout_timing import Timing
+
 MARKER = 'io.gowalk.backend.health-original'
 SOCKET = '/var/run/docker.sock'
 
 
 class Engine:
     def __init__(self):
-        self.deadline = time.monotonic() + 90
+        self.started = time.monotonic()
+        self.configure({'Healthcheck': {'Timeout': 5000000000}})
         self.pending_stop = None
 
+    def configure(self, config):
+        self.timing = Timing(config)
+        self.deadline = self.started + self.timing.forward_seconds
+        self.recovery_deadline = self.deadline + self.timing.rollback_seconds
+
+    def recover(self):
+        self.deadline = self.recovery_deadline
+
     def request(self, method, path, body=None, missing=False, raw=False, timeout=10):
         remaining = self.deadline - time.monotonic()
         if remaining <= 0:
@@ -36,14 +47,16 @@ class Engine:
         finally:
             connection.close()
 
-    def inspect(self, identifier, missing=False):
-        return self.request('GET', '/containers/' + quote(identifier, safe='') + '/json', missing=missing)
+    def inspect(self, identifier, missing=False, timeout=10):
+        return self.request('GET', '/containers/' + quote(identifier, safe='') + '/json',
+                            missing=missing, timeout=timeout)
 
     def stop(self, identifier):
         # Docker continues an accepted stop after a lost HTTP reply. Keep that uncertainty
         # until the same-ID stop completes and its stopped state is positively observed.
         self.pending_stop = identifier
-        self.request('POST', '/containers/' + identifier + '/stop?t=10', timeout=20)
+        self.request('POST', '/containers/' + identifier + '/stop?t=' + str(self.timing.stop_seconds),
+                     timeout=self.timing.stop_transport)
         if self.inspect(identifier)['State']['Running']:
             raise ValueError('container_stop_unconfirmed')
         self.pending_stop = None
@@ -76,11 +89,12 @@ def probe(engine, identifier, test):
     command = test[1:] if test[0] == 'CMD' else ['/bin/sh', '-c', test[1]]
     created = engine.request('POST', '/containers/' + identifier + '/exec',
                              {'AttachStdout': False, 'AttachStderr': False, 'Cmd': command})
-    engine.request('POST', '/exec/' + created['Id'] + '/start', {'Detach': False, 'Tty': False}, raw=True)
-    deadline = min(time.monotonic() + 5, engine.deadline)
+    deadline = min(time.monotonic() + engine.timing.probe_seconds, engine.deadline)
+    engine.request('POST', '/exec/' + created['Id'] + '/start', {'Detach': False, 'Tty': False},
+                   raw=True, timeout=max(0, deadline - time.monotonic()))
     while time.monotonic() < deadline:
         result = engine.request('GET', '/exec/' + created['Id'] + '/json',
-                                timeout=max(0.001, deadline - time.monotonic()))
+                                timeout=max(0, deadline - time.monotonic()))
         if not result['Running']:
             if result['ExitCode'] != 0:
                 raise ValueError('original_probe_failed')
@@ -91,11 +105,11 @@ def probe(engine, identifier, test):
 
 def healthy(engine, identifier, deadline):
     while time.monotonic() < deadline:
-        current = engine.inspect(identifier)
+        current = engine.inspect(identifier, timeout=min(10, max(0, deadline - time.monotonic())))
         status = current['State'].get('Health', {}).get('Status')
         if current['State']['Running'] and status == 'healthy':
             return current
         if not current['State']['Running'] or status == 'unhealthy':
             raise ValueError('container_health_failed')
-        time.sleep(1)
+        time.sleep(min(1, max(0, deadline - time.monotonic())))
     raise ValueError('container_health_timeout')

package/backend-action/health_rollout_spec.py

@@ -3,6 +3,7 @@ import copy
 import re
 
 from health_rollout_engine import MARKER
+from health_rollout_timing import probe_seconds, stop_seconds
 from runtime_healthcheck import cache_healthcheck
 
 ROLES = frozenset(('api', 'app', 'backend', 'web'))
@@ -79,15 +80,14 @@ def specification(row):
         raise ValueError('runtime_unsupported')
     if row['Config'].get('Shell') not in (None, [], ['/bin/sh', '-c']):
         raise ValueError('custom_shell_unsupported')
-    if (row['Config'].get('StopTimeout') or 10) > 10:
-        raise ValueError('stop_timeout_unsupported')
+    stop_seconds(row['Config'])
     published_ports(row)
     mounts(row)
     health = copy.deepcopy(row['Config'].get('Healthcheck') or {})
     if (health.get('StartPeriod', 0) < 30000000000
-            or (health.get('StartInterval') or 5000000000) > 5000000000
-            or (health.get('Timeout') or 30000000000) > 5000000000):
+            or (health.get('StartInterval') or 5000000000) > 5000000000):
         raise ValueError('health_startup_unsupported')
+    probe_seconds(row['Config'])
     service = {'healthcheck': {'test': health.get('Test')},
                'tmpfs': [name + ':' + options for name, options in (host.get('Tmpfs') or {}).items()],
                'environment': dict(value.split('=', 1) for value in row['Config'].get('Env') or [])}

package/backend-action/health_rollout_timing.py

@@ -0,0 +1,34 @@
+"""Preserve supported Docker deadlines and reserve a separate, finite recovery window."""
+
+REQUEST_SECONDS = 10
+
+
+def stop_seconds(config):
+    value = config.get('StopTimeout')
+    value = 10 if value is None else value
+    if type(value) is not int or not 0 <= value <= 35:
+        raise ValueError('stop_timeout_unsupported')
+    return value
+
+
+def probe_seconds(config):
+    value = (config.get('Healthcheck') or {}).get('Timeout') or 30000000000
+    if type(value) is not int or not 0 < value <= 10000000000:
+        raise ValueError('health_startup_unsupported')
+    return value / 1000000000
+
+
+class Timing:
+    def __init__(self, config):
+        self.stop_seconds = stop_seconds(config)
+        self.probe_seconds = probe_seconds(config)
+        self.stop_transport = self.stop_seconds + REQUEST_SECONDS
+        self.health_seconds = 35 + self.probe_seconds
+        # Preflight: three reads and the bounded 15s consumer inventory. Control
+        # allowances include positive state readback after a lost mutation reply.
+        self.forward_seconds = (45 + 11 * REQUEST_SECONDS + self.stop_transport
+                                + self.health_seconds + self.probe_seconds)
+        # Recovery can settle one outstanding stop, remove the marked candidate,
+        # restore/start the original, then confirm Docker and original-probe health.
+        self.rollback_seconds = (10 * REQUEST_SECONDS + self.stop_transport
+                                 + self.health_seconds + self.probe_seconds)

package/backend-action/install_runtime.py

@@ -21,6 +21,7 @@ REQUIRED = (
     'runtime_projection.py',
     'identity_diagnostics.py',
     'health_rollout.py', 'health_rollout_engine.py', 'health_rollout_spec.py', 'health_rollout_credit.py',
+    'health_rollout_timing.py',
     'memory_agent.py',
     'runtime_env.py', 'runtime_env_parse.py', 'edge_inputs.py', 'edge_vhost.py', 'edge_health.py',
     'configure_vhost.py', 'vhost_diagnostics.py', 'remote_deploy.sh', 'deploy_evidence.sh',

package/docs/BACKEND_HEALTHCHECKS.md

@@ -66,10 +66,15 @@ recognized bounded-tmpfs health probe qualify. Writable root filesystems, anonym
 workers/datastores/one-off containers, auto-remove, host/shared namespaces, namespace/volume/link consumers,
 static IP assignments, dynamic published ports and custom shells refuse. Existing health timing must
 have at least a 30-second startup grace, startup checks at most five seconds apart and a timeout at most
-five seconds. Stop timeout must be at most ten seconds. These preserve health cadence while permitting
+ten seconds. Stop timeout must be finite and at most 35 seconds. The configured values are preserved,
+including an explicit zero-second stop grace; an omitted stop timeout uses Docker's ten-second default.
+These preserve health cadence while permitting
 bounded adoption and rollback. Unsupported configurations keep their existing runtime unchanged.
 
-The helper holds the same host start lock as ordinary deployment for a 90-second transaction budget.
+The helper holds the same host start lock as ordinary deployment for a bounded transaction. Its timing
+policy derives separate forward and recovery windows from the selected container's configured deadlines;
+the forward phase cannot consume recovery's allowance. The maximum total window is 455 seconds (35-second
+stop grace and ten-second probe). Successful operations return immediately, without waiting out that window.
 It rechecks exact container/image/configuration and retains the original container under a deterministic
 `.gowalk-health-<old-id-prefix>` name. The replacement uses the existing image ID and copies private env,
 command, entrypoint, user, limits, mounts, published ports and actual network aliases; only its health
@@ -86,10 +91,14 @@ by identity/state readback. `rollback_unconfirmed` means recovery needs another
 retained containers and records stay available, and unrelated containers are never removed to clear a name.
 
 Docker may report the default `OomKillDisable` as either null or false; these alone compare equivalently,
-while an enabled OOM-kill override must match exactly. Stop requests retain their ten-second grace with
-a twenty-second transport allowance inside the transaction budget. An uncertain stop must settle on
+while an enabled OOM-kill override must match exactly. Each stop request uses the configured grace with
+an additional ten-second transport allowance. An uncertain stop must settle on
 that exact container before rollback can restart it or certify its health. Original-probe verification
-waits for the exec's confirmed exit status, for at most five seconds within the remaining transaction.
+waits for the exec's confirmed exit status within the configured probe timeout, including exec-start time.
+Docker-health polling has a separate window of 35 seconds plus that probe timeout. Each ordinary Docker
+request is limited to ten seconds and the remaining phase/health/probe budget. The forward allowance
+includes 45 seconds for preflight and eleven control requests; recovery reserves ten control requests,
+another stop, Docker-health polling and an original probe. Recovery never extends its original deadline.
 
 Replay with the same original ID resumes an interrupted retained-container transaction. After successful
 cleanup it finds the marker-bound healthy replacement and returns `already_applied`. It refuses absent,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.200",
+  "version": "1.0.201",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {