manta-node 0.6b5.dev768__py3-none-any.whl → 0.6b5.dev773__py3-none-any.whl

manta_node/cli/_version_generated.py

@@ -4,7 +4,7 @@ This file is auto-generated at build time by scripts/generate_version.py.
 Do not edit manually.
 """
 
-__version__ = "2026.10.07.bfaeeedd"
-__build_date__ = "2026.10.07"
-__commit_id__ = "bfaeeedd"
+__version__ = "2026.10.08.22eaa34f"
+__build_date__ = "2026.10.08"
+__commit_id__ = "22eaa34f"
 __package_version__ = "0.6b5"  # release-series base, moved by scripts/bump_version.py

manta_node/infrastructure/mqtt/command_handler.py

@@ -42,7 +42,7 @@ from ...seam import (
 )
 from ...task_manager import LOG_FLUSH_INTERVAL, LogStream, TaskManager
 from ...tasks import TaskProgression
-from ...update_path import is_host_owned
+from ...update_path import is_platform, refusal_reason
 from ..filesystem.dataset_manager import DatasetManager
 from ..grpc.client import NodeClient
 from ..metrics.collector import Collector
@@ -755,20 +755,22 @@ class CommandHandler(Collector, MqttBase):
         equality and staleness. With no supervisor the relay is inert, and the
         node reports that rather than applying anything itself.
 
-        A host-owned node refuses the command before relaying (ADR-0042 D5) and
-        reports the refusal, so the platform's one-path rule holds even if a
-        command reaches it.
+        A node whose own update path is not ``platform`` refuses the command
+        before relaying (ADR-0042 D5) and reports the refusal, so the platform's
+        one-path rule holds even if a command reaches a host- or fleet-updated
+        node, or one whose path is unknown.
         """
         request = self._parse_update(payload)
-        # One update path per node (ADR-0042 D5). The platform never sends to a
-        # host-owned node (it fails closed on the reported path); if one arrives
-        # anyway, refuse it here and report the refusal rather than applying it.
-        if is_host_owned():
+        # One update path per node (ADR-0042 D5). Only a platform-path node takes
+        # a platform command; the platform fails closed on every other path, and
+        # if one arrives anyway, refuse it here and report the refusal rather
+        # than applying it.
+        if not is_platform():
             await self.publish_update_status(
                 SwitchOutcome(
                     request_id=request.request_id,
                     state=SeamState.REFUSED,
-                    reason="this node is host-updated; the platform does not update it",
+                    reason=refusal_reason(),
                 )
             )
             return

manta_node/supervisor/lifecycle.py

@@ -17,6 +17,7 @@ supervisor.
 
 from __future__ import annotations
 
+import sys
 import time
 from collections.abc import Callable
 from dataclasses import dataclass
@@ -128,15 +129,17 @@ def run_switch(
         nonlocal candidate_python
         candidate_python = fetch(request.target)
 
-    if not _within(bounds.fetch, do_fetch):
-        return _outcome(
-            request, SeamState.FAILED, "fetch exceeded its bound (no switch)"
+    cause = _within(bounds.fetch, do_fetch)
+    if cause is not None:
+        return _step_failed(
+            request, "fetch", "fetch exceeded its bound (no switch)", cause
         )
 
     # VERIFY — the candidate must be usable in its OWN environment (NF-2): the
     # fetcher named the interpreter the candidate will run from.
-    if not _within(bounds.verify, lambda: verify(candidate_dir, candidate_python)):
-        return _outcome(request, SeamState.FAILED, "verification failed (no switch)")
+    cause = _within(bounds.verify, lambda: verify(candidate_dir, candidate_python))
+    if cause is not None:
+        return _step_failed(request, "verify", "verification failed (no switch)", cause)
 
     # FREE SPACE — refuse before staging when there is no room for a full version
     # dir (NF-12, §6.2). Refusing here, before any write, is what stops a
@@ -156,8 +159,11 @@ def run_switch(
             candidate_dir, candidate_python
         )
 
-    if not _within(bounds.stage, do_stage):
-        return _outcome(request, SeamState.FAILED, "stage exceeded its bound or failed")
+    cause = _within(bounds.stage, do_stage)
+    if cause is not None:
+        return _step_failed(
+            request, "stage", "stage exceeded its bound or failed", cause
+        )
     target = staged["target"]
 
     record = InFlight(
@@ -169,25 +175,26 @@ def run_switch(
     write_inflight(record)
 
     # SWITCH — the commit point (NF-1), bounded.
-    try:
-        if not _within(bounds.switch, lambda: version_tree.commit(target)):
-            clear_inflight()
-            _reclaim_candidate(bounds, target, last_good_dir)
-            return _outcome(
-                request, SeamState.FAILED, "switch exceeded its bound (repoint failed)"
-            )
-    except VersionTreeError as exc:
+    cause = _within(bounds.switch, lambda: version_tree.commit(target))
+    if cause is not None:
         clear_inflight()
         _reclaim_candidate(bounds, target, last_good_dir)
-        return _outcome(request, SeamState.FAILED, f"switch failed: {exc}")
+        return _step_failed(request, "switch", "switch failed (repoint failed)", cause)
 
     # RESTART onto the committed version, then wait for the return window. A
     # restart that raises is a failed switch, not a crash: surface DOWN and clear
     # the record rather than letting the exception escape.
-    if not _within(bounds.switch, restart):
+    cause = _within(bounds.switch, restart)
+    if cause is not None:
         clear_inflight()
         _reclaim_candidate(bounds, target, last_good_dir)
-        return _outcome(request, SeamState.DOWN, "restart failed after the switch")
+        return _step_failed(
+            request,
+            "restart",
+            "restart failed after the switch",
+            cause,
+            state=SeamState.DOWN,
+        )
 
     if is_back(record.deadline_epoch):
         clear_inflight()
@@ -215,12 +222,19 @@ def run_switch(
         )
     try:
         version_tree.commit(version_tree.versions_dir() / last_good)
-        if not _within(bounds.switch, restart):
-            raise LifecycleError("restart after revert failed")
+        cause = _within(bounds.switch, restart)
+        if cause is not None:
+            raise LifecycleError(f"restart after revert failed: {cause}")
     except (VersionTreeError, LifecycleError) as exc:
         clear_inflight()
         _reclaim_candidate(bounds, target, last_good_dir)
-        return _outcome(request, SeamState.DOWN, f"revert failed: {exc}")
+        return _step_failed(
+            request,
+            "revert",
+            f"revert failed: {exc}",
+            str(exc),
+            state=SeamState.DOWN,
+        )
     clear_inflight()
     # The candidate was superseded the moment the switch did not land: it is
     # reclaimed even though the switch failed, so repeated failing switches do
@@ -257,17 +271,43 @@ def _reclaim_candidate(
     version_tree.reclaim(bounds.retention_dirs, protect)
 
 
-def _within(bound: float, step: Callable[[], None]) -> bool:
-    """Run ``step``; True if it completed, False if it raised or exceeded ``bound``.
+def _within(bound: float, step: Callable[[], None]) -> str | None:
+    """Run ``step``; return None if it completed within ``bound``, else the cause.
 
     A step that raises is a failure of that state, not a crash: before the switch
-    it leaves the node on its current version (NF-3). The time bound is enforced
-    by the step itself (a subprocess timeout / an HTTP timeout); this records the
-    comparison so the caller does not have to.
+    it leaves the node on its current version (NF-3). The return names the
+    failure — the exception, or the bound it exceeded — so the caller can record
+    the stage and its cause. The time bound is enforced by the step itself (a
+    subprocess timeout / an HTTP timeout); this records the comparison so the
+    caller does not have to.
     """
     start = time.monotonic()
     try:
         step()
-    except Exception:
-        return False
-    return (time.monotonic() - start) <= bound
+    except Exception as exc:
+        return f"{type(exc).__name__}: {exc}"
+    elapsed = time.monotonic() - start
+    if elapsed > bound:
+        return f"exceeded its {bound}s bound ({elapsed:.1f}s)"
+    return None
+
+
+def _step_failed(
+    request: UpdateRequest,
+    stage: str,
+    reason: str,
+    cause: str,
+    *,
+    state: SeamState = SeamState.FAILED,
+) -> SwitchOutcome:
+    """Build a failure outcome naming the stage and cause, and log it.
+
+    ``detail`` always carries ``stage`` and ``cause`` together, and the failed
+    stage always logs a line to stderr (the supervisor's journal) before
+    returning, so the outcome and the journal name the same failure.
+    """
+    print(
+        f"supervisor: {stage} failed for request {request.request_id}: {cause}",
+        file=sys.stderr,
+    )
+    return _outcome(request, state, reason, stage=stage, cause=cause)

manta_node/supervisor/switch.py

@@ -156,15 +156,19 @@ def read_manifest(version_dir: Path) -> Version | None:
 def materialise_version(version: str, python: str) -> Path:
     """Create an immutable version dir for ``version``; return its path.
 
-    Idempotent: an existing dir for the same manta-node version is returned
-    unchanged (its manifest is not rewritten).
+    Idempotent: an existing dir is returned unchanged when its identity matches
+    ``version`` — the manifest's node version, or the legacy pair id it was
+    materialised under. The fleet path still names a candidate by its pair
+    (`manta-node@X+manta-common-core@Y`) and pre-materialises that dir, so
+    matching the pair too is what keeps its apply from being rejected as "not a
+    valid version dir" (#520).
     """
     if not is_safe_version_name(version):
         raise VersionTreeError(f"refusing an unsafe version dir name: {version!r}")
     target = versions_dir() / version
     if target.exists():
         existing = read_manifest(target)
-        if existing and existing.version == version:
+        if existing is not None and version in (existing.version, existing.pair):
             return target
         raise VersionTreeError(
             f"{target} exists but is not a valid version dir for {version!r}"

manta_node/update_path.py

@@ -1,14 +1,16 @@
-"""Which mechanism updates this node — platform or host (mechanism §6.5, #113 Q4.4).
+"""Which mechanism updates this node — platform, host, or fleet (§6.5, #113 Q4.4).
 
 A node is updated by exactly one path (ADR-0042 D5). The path is **set at
 install** by provisioning (manta-deploy#1220) as the environment variable
 ``MANTA_NODE_UPDATE_PATH``; the node reports it at registration so the platform
-can apply the one-path rule, and refuses a platform command when its host owns
-the update.
-
-Unknown — unset, empty, or an unrecognised value — is UNSPECIFIED: the platform
-fails closed and never sends an update, so an older or CI-path node is never
-updated from the platform.
+can apply the one-path rule, and refuses a platform command unless its own path
+is ``platform``.
+
+- ``platform`` — boundary B: the Manager updates it.
+- ``host`` — boundary D: the host owns the code.
+- ``fleet`` — the ADR-0035 fleet path (CI over SSH); retires with it.
+- unknown (unset, empty, or unrecognised) — UNSPECIFIED. The platform fails
+  closed and never sends an update, and the node refuses one that arrives.
 """
 
 from __future__ import annotations
@@ -19,14 +21,24 @@ UPDATE_PATH_ENV = "MANTA_NODE_UPDATE_PATH"
 
 PLATFORM = "platform"
 HOST = "host"
+FLEET = "fleet"
 
 
 def update_path() -> str:
-    """The node's update path: ``"platform"``, ``"host"``, or ``""`` if unknown."""
+    """The node's update path, or ``""`` when it is unknown."""
     value = os.environ.get(UPDATE_PATH_ENV, "").strip().lower()
-    return value if value in (PLATFORM, HOST) else ""
+    return value if value in (PLATFORM, HOST, FLEET) else ""
+
+
+def is_platform() -> bool:
+    """True when the platform updates this node — the only path that accepts a
+    platform command (mechanism §6.5 answer 4a)."""
+    return update_path() == PLATFORM
 
 
-def is_host_owned() -> bool:
-    """True when the host, not the platform, updates this node."""
-    return update_path() == HOST
+def refusal_reason() -> str:
+    """Why the platform must not update this node, given its path."""
+    label = {HOST: "host-updated", FLEET: "fleet-updated"}.get(update_path())
+    if label is not None:
+        return f"this node is {label}; the platform does not update it"
+    return "this node's update path is unknown; the platform does not update it"

{manta_node-0.6b5.dev768.dist-info → manta_node-0.6b5.dev773.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: manta_node
-Version: 0.6b5.dev768
+Version: 0.6b5.dev773
 Summary: Node side software of the Manta platform. It is responsible for the communication with the Manta Core and the execution of the tasks.
 Author-email: Hugo Miralles <hugo.miralles@manta-tech.io>, Matthew Thompson <matthew.thompson@manta-tech.io>
 License-Expression: AGPL-3.0-or-later
@@ -28,7 +28,7 @@ Requires-Dist: pyyaml
 Requires-Dist: psutil
 Requires-Dist: msgpack
 Requires-Dist: aiomqtt<3.0,>=2.5.1
-Requires-Dist: manta-common-core==0.6b5.dev764
+Requires-Dist: manta-common-core==0.6b5.dev769
 Requires-Dist: toml
 Requires-Dist: tomli; python_version < "3.11"
 Requires-Dist: tomli-w

{manta_node-0.6b5.dev768.dist-info → manta_node-0.6b5.dev773.dist-info}/RECORD

@@ -4,10 +4,10 @@ manta_node/node_orchestrator.py,sha256=HHwVYQq6gtHd-Cr1Kl_DZEiYQOtgmLwJfh6psYujm
 manta_node/seam.py,sha256=nGLjNVlSrnRJPdrp7L8piyJai1bQveiqT5JDBWeFeGI,6501
 manta_node/task_manager.py,sha256=xRE-yKdUW0FFR8vtX1jDwl1AxTbqVD_JS7QVR62GA00,38002
 manta_node/tasks.py,sha256=o837Hi-KFVJg9LF5iOtE8oD6UuTOfrEPWR-JOdhRGeY,6983
-manta_node/update_path.py,sha256=S-J1CN4wlbsk3BCy6Z82OiTIxSSuE0H9Zy9Pi_wJ7HQ,1090
+manta_node/update_path.py,sha256=6N_bN9z8MqnyWWfGTe1-aJFijf2tSy_IvO6VHvNSQVU,1667
 manta_node/utils.py,sha256=Hw4Iw2jYQYsfVLVJuBMt-_rMFBeml3nCDE2jiiXc8YM,1155
 manta_node/cli/__init__.py,sha256=arzO3mXDJ-E2yeeytbZfN7mCswwxdQ43_QjyeL2E5yE,134
-manta_node/cli/_version_generated.py,sha256=PaEDZ-l8gZ8HcKKNJDo-YH9QE57nWUe4bedshlnlJq0,332
+manta_node/cli/_version_generated.py,sha256=u15js_niq-wLlcE1Hitgt0MvKozxGxx0dZjNV-EhUfc,332
 manta_node/cli/config_manager.py,sha256=BCju9zqzraviL3KrzRnB-vZQUY__Q5kuEqb7EdB8YdI,4409
 manta_node/cli/main.py,sha256=dZa6zrypWBvpN8hd4qpxevvlyNFhxKINCg1537NJ36w,4318
 manta_node/cli/version.py,sha256=L4lNTz-Uw_ejumy1tXJcJhcjhb-5FRcRQ6ogZM5N1Xo,5136
@@ -42,7 +42,7 @@ manta_node/infrastructure/metrics/__init__.py,sha256=ODGAj9s63F5jba2c3dQRMfNK6I4
 manta_node/infrastructure/metrics/collector.py,sha256=9ESw__Pc2tV6ldG5yhos2IS7T5Td59KxTIwDRZc_G4w,3067
 manta_node/infrastructure/metrics/metrics_collector.py,sha256=osIYrNzU3g9WCAxVQ14isM9YEQ3eJ7F3QgKBbpgeMJs,13077
 manta_node/infrastructure/mqtt/__init__.py,sha256=riXo1sXgO4YV6DHCmWRqK61BAmuGLdHiVdQFunAJadA,140
-manta_node/infrastructure/mqtt/command_handler.py,sha256=50-3ZClmt1kk3PXWFtZ1M0NWPkXmHO_EwhIrBLQcH0w,35767
+manta_node/infrastructure/mqtt/command_handler.py,sha256=GDKlQGq9IL7HKkQTWCML7K2i75W5b7wdo5pEDYUYuzQ,35862
 manta_node/infrastructure/network/__init__.py,sha256=On3XLgycFQoc-fBCa5hFuFDfEJjmFy7Wl2CK3D2LkdI,478
 manta_node/infrastructure/network/event_registry.py,sha256=iWEfUJRzDnWjOrDinpYqVyIUpGKJjp7RZkjMDPfpplM,1661
 manta_node/infrastructure/network/factory.py,sha256=-LvHbBp5nBpQ7fyQT1T0pvK3aczZqWc9QNDW37brBeU,3897
@@ -57,15 +57,15 @@ manta_node/supervisor/__init__.py,sha256=kgdoNce1tM4e7jvdxkdmnNJV1L92-NI2cRfYSdm
 manta_node/supervisor/bounds.py,sha256=MlUfj0tYY-US348JsxYA-Ph5pSpgoOPlRdVTwmrPtZA,3181
 manta_node/supervisor/executor.py,sha256=HwER4Q9uFI4cYTBEn5BFtRhU69Wdj9fj8-RQZ6u8T8o,8171
 manta_node/supervisor/inflight.py,sha256=GhngTFmFKi0P3yqu5P5XeRP5G-H8vG-uQcAzdjATdm0,4515
-manta_node/supervisor/lifecycle.py,sha256=0NJb8JlMJXXiyVgEBCoyRsDOlVLIETrgKX7uVs21NT0,10924
+manta_node/supervisor/lifecycle.py,sha256=_-Tzb3Ipu_RERC5T8DeHyy7BS5RypIc8rIz2GvKRG2s,12000
 manta_node/supervisor/process.py,sha256=frbbgvhLsveXMzwmRkNmB3FEKKgqiEdG6UhffRrE_Bw,20741
 manta_node/supervisor/records.py,sha256=fUlL1SfmWpGnCbJ9956cuy0H3a7-aEF-B-naqbJiYoU,6405
 manta_node/supervisor/seam.py,sha256=4kczRku5Ctn4xRvXS-pyzaDFau7LnX5bYOn6IRNKRyE,9665
 manta_node/supervisor/sequence.py,sha256=eYu7rrk1ecc4Y2jQhhJ7CopPz3m0lOsFLJj5lT2PwBw,1685
-manta_node/supervisor/switch.py,sha256=Mxr2XcZVOMN6g-M4lUBRlE7d8Z8JEtt6k7nEaS3zHpE,21958
-manta_node-0.6b5.dev768.dist-info/licenses/LICENSE,sha256=9mBgLhiB9goQPQjg9XQJ6FjgVxYw9Q8lyOZYkPGwF_c,34484
-manta_node-0.6b5.dev768.dist-info/METADATA,sha256=gbEWIcxpeWZe2FJE0dsPBSihhlX2V5ppwttaMXwLEi8,4937
-manta_node-0.6b5.dev768.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-manta_node-0.6b5.dev768.dist-info/entry_points.txt,sha256=uCwggRApalLEsYs1YxwTBN0-e9oMJAkMoBp01HaSdoY,110
-manta_node-0.6b5.dev768.dist-info/top_level.txt,sha256=nbT5J5WETuXM9UPoQckl29uUOq8wMYdRb9QDx5kAFeo,11
-manta_node-0.6b5.dev768.dist-info/RECORD,,
+manta_node/supervisor/switch.py,sha256=ansCCmxru9bmmLggq8b68gmnyqbPgXF_u2Z6fo_xSMo,22283
+manta_node-0.6b5.dev773.dist-info/licenses/LICENSE,sha256=9mBgLhiB9goQPQjg9XQJ6FjgVxYw9Q8lyOZYkPGwF_c,34484
+manta_node-0.6b5.dev773.dist-info/METADATA,sha256=soD8Yq0AvgXQSmpobHn-TAuOENMsdutClUYPOKjZXk4,4937
+manta_node-0.6b5.dev773.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+manta_node-0.6b5.dev773.dist-info/entry_points.txt,sha256=uCwggRApalLEsYs1YxwTBN0-e9oMJAkMoBp01HaSdoY,110
+manta_node-0.6b5.dev773.dist-info/top_level.txt,sha256=nbT5J5WETuXM9UPoQckl29uUOq8wMYdRb9QDx5kAFeo,11
+manta_node-0.6b5.dev773.dist-info/RECORD,,