dirtydishes/islandflow
1
0
Fork 0
Code Issues 2 Pull requests 4 Projects Releases Packages Wiki Activity Actions 1

chore(deploy): preflight docker workspace snapshot sync

Browse source
This commit is contained in:
dirtydishes 2026-05-15 19:04:15 -04:00
parent 0db40562ee
commit 803740190c
5 changed files with 166 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

1
.beads/issues.jsonl
View file

@ -1,3 +1,4 @@
{"_type":"issue","id":"islandflow-k4f","title":"Gate deploy script on docker workspace snapshot sync","description":"Prevent frozen-lockfile build failures during deploy by adding a local preflight in scripts/deploy.ts that runs bun run check:docker-workspace and aborts with a clear sync+commit remediation message when stale.","status":"closed","priority":1,"issue_type":"task","assignee":"dirtydishes","owner":"dishes@dpdrm.com","created_at":"2026-05-15T23:01:44Z","created_by":"dirtydishes","updated_at":"2026-05-15T23:04:11Z","started_at":"2026-05-15T23:01:48Z","closed_at":"2026-05-15T23:04:11Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"islandflow-xll","title":"Fix bun.lock drift causing frozen-lockfile Docker build failures","description":"Docker image builds fail in multiple targets (candles, web, ingest services) because bun install --frozen-lockfile detects lockfile changes. Update workspace lockfile to match manifests and verify frozen install succeeds.","status":"closed","priority":1,"issue_type":"bug","assignee":"dirtydishes","owner":"dishes@dpdrm.com","created_at":"2026-05-15T22:52:38Z","created_by":"dirtydishes","updated_at":"2026-05-15T22:55:23Z","started_at":"2026-05-15T22:52:40Z","closed_at":"2026-05-15T22:55:23Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"islandflow-xll","title":"Fix bun.lock drift causing frozen-lockfile Docker build failures","description":"Docker image builds fail in multiple targets (candles, web, ingest services) because bun install --frozen-lockfile detects lockfile changes. Update workspace lockfile to match manifests and verify frozen install succeeds.","status":"closed","priority":1,"issue_type":"bug","assignee":"dirtydishes","owner":"dishes@dpdrm.com","created_at":"2026-05-15T22:52:38Z","created_by":"dirtydishes","updated_at":"2026-05-15T22:55:23Z","started_at":"2026-05-15T22:52:40Z","closed_at":"2026-05-15T22:55:23Z","close_reason":"Closed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"islandflow-9nd","title":"Hosted synthetic tape redesign with internal control surface","description":"Implement hosted synthetic market redesign with shared deterministic regime engine, internal JetStream KV control plane, ingest coupling across options and equities, and an internal bottom-right synthetic-control drawer with Next proxy routes. Preserve the six public smart-money categories while adding hidden subtype families, soft coverage accounting, and backend-only admin endpoints.\n","status":"closed","priority":1,"issue_type":"feature","assignee":"dirtydishes","owner":"dishes@dpdrm.com","created_at":"2026-05-14T01:25:02Z","created_by":"dirtydishes","updated_at":"2026-05-14T02:10:03Z","started_at":"2026-05-14T01:25:09Z","closed_at":"2026-05-14T02:10:03Z","close_reason":"Completed","dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"islandflow-9nd","title":"Hosted synthetic tape redesign with internal control surface","description":"Implement hosted synthetic market redesign with shared deterministic regime engine, internal JetStream KV control plane, ingest coupling across options and equities, and an internal bottom-right synthetic-control drawer with Next proxy routes. Preserve the six public smart-money categories while adding hidden subtype families, soft coverage accounting, and backend-only admin endpoints.\n","status":"closed","priority":1,"issue_type":"feature","assignee":"dirtydishes","owner":"dishes@dpdrm.com","created_at":"2026-05-14T01:25:02Z","created_by":"dirtydishes","updated_at":"2026-05-14T02:10:03Z","started_at":"2026-05-14T01:25:09Z","closed_at":"2026-05-14T02:10:03Z","close_reason":"Completed","dependency_count":0,"dependent_count":0,"comment_count":0}
{"_type":"issue","id":"islandflow-9dz","title":"Tune synthetic smart-money scenario coverage","description":"Redesign synthetic smart-money option prints so the emitted scenarios trigger each classifier category more consistently while staying directionally plausible. Focus on scenario mix, DTE/moneyness, price placement, and event/structure context so the Electron demo reliably shows institutional directional, retail whale, event-driven, vol seller, arbitrage, and hedge reactive hits.\n","status":"in_progress","priority":1,"issue_type":"task","assignee":"dirtydishes","owner":"dishes@dpdrm.com","created_at":"2026-05-13T21:36:37Z","created_by":"dirtydishes","updated_at":"2026-05-13T21:36:41Z","started_at":"2026-05-13T21:36:41Z","dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"islandflow-9dz","title":"Tune synthetic smart-money scenario coverage","description":"Redesign synthetic smart-money option prints so the emitted scenarios trigger each classifier category more consistently while staying directionally plausible. Focus on scenario mix, DTE/moneyness, price placement, and event/structure context so the Electron demo reliably shows institutional directional, retail whale, event-driven, vol seller, arbitrage, and hedge reactive hits.\n","status":"in_progress","priority":1,"issue_type":"task","assignee":"dirtydishes","owner":"dishes@dpdrm.com","created_at":"2026-05-13T21:36:37Z","created_by":"dirtydishes","updated_at":"2026-05-13T21:36:41Z","started_at":"2026-05-13T21:36:41Z","dependency_count":0,"dependent_count":0,"comment_count":0}

1
bun.lock
View file

@ -39,6 +39,7 @@
"packages/bus": { "packages/bus": {
"name": "@islandflow/bus", "name": "@islandflow/bus",
"dependencies": { "dependencies": {
"@islandflow/types": "workspace:*",
"nats": "^2.24.0", "nats": "^2.24.0",
}, },
}, },

1
deployment/docker/workspace-root/bun.lock
View file

@ -39,6 +39,7 @@
"packages/bus": { "packages/bus": {
"name": "@islandflow/bus", "name": "@islandflow/bus",
"dependencies": { "dependencies": {
"@islandflow/types": "workspace:*",
"nats": "^2.24.0", "nats": "^2.24.0",
}, },
}, },

83
docs/turns/2026-05-15-deploy-preflight-docker-workspace-check.html Normal file
View file

@ -0,0 +1,83 @@
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Turn Report - 2026-05-15 - Deploy preflight docker workspace check</title>
<style>
body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; line-height: 1.5; margin: 2rem auto; max-width: 920px; padding: 0 1rem; }
h1, h2 { line-height: 1.25; }
code, pre { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace; }
pre { background: #f6f8fa; border-radius: 8px; padding: 0.75rem; overflow-x: auto; }
.summary { background: #eef6ff; border: 1px solid #cfe3ff; border-radius: 8px; padding: 0.85rem 1rem; }
</style>
</head>
<body>
<h1>Turn Report: Deploy script preflight guard for Docker workspace snapshot</h1>
<p><strong>Date/Time:</strong> 2026-05-15 19:03:09 EDT</p>
<h2>Summary</h2>
<div class="summary">
Updated <code>scripts/deploy.ts</code> so <code>./deploy</code> now fails fast when
<code>deployment/docker/workspace-root</code> is stale. The script now runs
<code>bun run check:docker-workspace</code> during local prechecks and prints a clear remediation
message to run sync + commit before deployment.
</div>
<h2>Changes Made</h2>
<ul>
<li>Created <code>localWorkspaceSnapshotPrecheck()</code> in <code>scripts/deploy.ts</code>.</li>
<li>Added preflight invocation to both deployment modes:
<ul>
<li><code>localMainPrecheck()</code></li>
<li><code>localBranchPrecheck()</code></li>
</ul>
</li>
<li>On failure, deploy now exits with an explicit message:</li>
</ul>
<pre>Refusing deploy: deployment/docker/workspace-root is out of sync.
Run bun run sync:docker-workspace, commit updated snapshot files, then retry deploy.</pre>
<ul>
<li>Refreshed lock state to keep checks green:
<ul>
<li><code>bun.lock</code></li>
<li><code>deployment/docker/workspace-root/bun.lock</code></li>
</ul>
</li>
</ul>
<h2>Context</h2>
<p>
The deployment compose stack builds from a snapshot under
<code>deployment/docker/workspace-root</code>. If that snapshot drifts from the active
workspace graph, Docker build-time <code>bun install --frozen-lockfile</code> fails remotely.
This change catches drift locally before any remote rollout starts.
</p>
<h2>Important Implementation Details</h2>
<ul>
<li>Preflight uses <code>spawnSync("bun", ["run", "check:docker-workspace"])</code> with inherited stdio for transparent output.</li>
<li>Failure exits with the same non-zero status, preserving script CI/shell behavior.</li>
<li>Guard applies to both <code>./deploy main</code> and <code>./deploy current-branch</code> flows.</li>
</ul>
<h2>Validation</h2>
<ul>
<li>Passed: <code>bun run scripts/deploy.ts --help</code></li>
<li>Passed: <code>bun run check:docker-workspace</code> (after lock sync)</li>
</ul>
<h2>Issues, Limitations, and Mitigations</h2>
<ul>
<li><strong>Limitation:</strong> Did not execute a full remote deploy during this turn.</li>
<li><strong>Mitigation:</strong> The guard is in the local precheck path, so next real deploy run will enforce the new check automatically.</li>
</ul>
<h2>Follow-up Work</h2>
<ul>
<li>Optional defense-in-depth: run <code>bun run check:docker-workspace</code> on the server in remote rollout before <code>docker compose up -d --build</code>.</li>
<li>Optional CI gate: add <code>bun run check:docker-workspace</code> to PR checks to prevent stale snapshots reaching <code>main</code>.</li>
<li>Beads issue: <code>islandflow-k4f</code>.</li>
</ul>
</body>
</html>

103
scripts/deploy.ts
View file

@ -11,16 +11,32 @@ const REMOTE_HOST = "delta@152.53.80.229";
const REMOTE_REPO = "/home/delta/islandflow"; const REMOTE_REPO = "/home/delta/islandflow";
const REMOTE_DEPLOYMENT = "/home/delta/islandflow/deployment/docker"; const REMOTE_DEPLOYMENT = "/home/delta/islandflow/deployment/docker";
const SSH_KEY = path.join(process.env.HOME ?? "", ".ssh", "delta_ed25519"); const SSH_KEY = path.join(process.env.HOME ?? "", ".ssh", "delta_ed25519");
const SSH_OPTIONS = ["-i", SSH_KEY, "-o", "IdentitiesOnly=yes", "-o", "BatchMode=yes"]; const SSH_OPTIONS = [
"-i",
SSH_KEY,
"-o",
"IdentitiesOnly=yes",
"-o",
"BatchMode=yes",
];
const ALLOWED_REMOTE_UNTRACKED = new Set([ const ALLOWED_REMOTE_UNTRACKED = new Set([
"deployment/docker/signal-cli-0.14.3-Linux-native.tar.gz", "deployment/docker/signal-cli-0.14.3-Linux-native.tar.gz",
"deployment/npm/" "deployment/npm/",
]); ]);
const API_CONTAINER = "islandflow-vps-api-1"; const API_CONTAINER = "islandflow-vps-api-1";
const WEB_CONTAINER = "islandflow-vps-web-1"; const WEB_CONTAINER = "islandflow-vps-web-1";
const PUBLIC_APP_URL = process.env.DEPLOY_PUBLIC_APP_URL?.trim() || "https://flow.deltaisland.io"; const PUBLIC_APP_URL =
const PUBLIC_API_HEALTH_URL = process.env.DEPLOY_PUBLIC_API_HEALTH_URL?.trim() || null; process.env.DEPLOY_PUBLIC_APP_URL?.trim() || "https://flow.deltaisland.io";
const LOG_SERVICES = ["api", "web", "compute", "candles", "ingest-options", "ingest-equities"]; const PUBLIC_API_HEALTH_URL =
process.env.DEPLOY_PUBLIC_API_HEALTH_URL?.trim() || null;
const LOG_SERVICES = [
"api",
"web",
"compute",
"candles",
"ingest-options",
"ingest-equities",
];
const scriptPath = fileURLToPath(import.meta.url); const scriptPath = fileURLToPath(import.meta.url);
const repoRoot = path.resolve(path.dirname(scriptPath), ".."); const repoRoot = path.resolve(path.dirname(scriptPath), "..");
@ -55,12 +71,16 @@ function formatCommand(command: string, args: string[]): string {
.join(" "); .join(" ");
} }
function runChecked(command: string, args: string[], options: SpawnSyncOptions = {}): void { function runChecked(
command: string,
args: string[],
options: SpawnSyncOptions = {},
): void {
console.log(`$ ${formatCommand(command, args)}`); console.log(`$ ${formatCommand(command, args)}`);
const result = spawnSync(command, args, { const result = spawnSync(command, args, {
cwd: repoRoot, cwd: repoRoot,
stdio: "inherit", stdio: "inherit",
...options ...options,
}); });
if (result.status !== 0) { if (result.status !== 0) {
@ -68,12 +88,16 @@ function runChecked(command: string, args: string[], options: SpawnSyncOptions =
} }
} }
function captureChecked(command: string, args: string[], options: SpawnSyncOptions = {}): string { function captureChecked(
command: string,
args: string[],
options: SpawnSyncOptions = {},
): string {
const result = spawnSync(command, args, { const result = spawnSync(command, args, {
cwd: repoRoot, cwd: repoRoot,
encoding: "utf8", encoding: "utf8",
stdio: ["inherit", "pipe", "pipe"], stdio: ["inherit", "pipe", "pipe"],
...options ...options,
}); });
if (result.status !== 0) { if (result.status !== 0) {
@ -84,7 +108,11 @@ function captureChecked(command: string, args: string[], options: SpawnSyncOptio
return result.stdout ?? ""; return result.stdout ?? "";
} }
function runRemoteScript(title: string, script: string, args: string[] = []): void { function runRemoteScript(
title: string,
script: string,
args: string[] = [],
): void {
section(title); section(title);
const sshArgs = [...SSH_OPTIONS, REMOTE_HOST, "bash", "-s", "--", ...args]; const sshArgs = [...SSH_OPTIONS, REMOTE_HOST, "bash", "-s", "--", ...args];
console.log(`$ ${formatCommand("ssh", sshArgs)}`); console.log(`$ ${formatCommand("ssh", sshArgs)}`);
@ -92,7 +120,7 @@ function runRemoteScript(title: string, script: string, args: string[] = []): vo
cwd: repoRoot, cwd: repoRoot,
input: script, input: script,
encoding: "utf8", encoding: "utf8",
stdio: ["pipe", "inherit", "inherit"] stdio: ["pipe", "inherit", "inherit"],
}); });
if (result.status !== 0) { if (result.status !== 0) {
@ -100,7 +128,10 @@ function runRemoteScript(title: string, script: string, args: string[] = []): vo
} }
} }
function parseArgs(rawArgs: string[]): { mode: DeployMode; forceRecreate: boolean } { function parseArgs(rawArgs: string[]): {
mode: DeployMode;
forceRecreate: boolean;
} {
if (rawArgs.includes("--help") || rawArgs.includes("-h")) { if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
usage(0); usage(0);
} }
@ -114,7 +145,9 @@ function parseArgs(rawArgs: string[]): { mode: DeployMode; forceRecreate: boolea
if ( if (
(positional.length === 1 && positional[0] === "current-branch") || (positional.length === 1 && positional[0] === "current-branch") ||
(positional.length === 2 && positional[0] === "current" && positional[1] === "branch") (positional.length === 2 &&
positional[0] === "current" &&
positional[1] === "branch")
) { ) {
return { mode: "current-branch", forceRecreate }; return { mode: "current-branch", forceRecreate };
} }
@ -129,12 +162,28 @@ function assertSshKeyExists(): void {
} }
} }
function localWorkspaceSnapshotPrecheck(): void {
console.log("$ bun run check:docker-workspace");
const result = spawnSync("bun", ["run", "check:docker-workspace"], {
cwd: repoRoot,
stdio: "inherit",
});
if (result.status !== 0) {
console.error(
"Refusing deploy: deployment/docker/workspace-root is out of sync. Run `bun run sync:docker-workspace`, commit updated snapshot files, then retry deploy.",
);
process.exit(result.status ?? 1);
}
}
function localMainPrecheck(): void { function localMainPrecheck(): void {
section("Local Precheck"); section("Local Precheck");
runChecked("git", ["fetch", "origin"]); runChecked("git", ["fetch", "origin"]);
runChecked("git", ["status", "--short", "--branch"]); runChecked("git", ["status", "--short", "--branch"]);
runChecked("git", ["rev-parse", "--verify", "HEAD"]); runChecked("git", ["rev-parse", "--verify", "HEAD"]);
runChecked("git", ["rev-parse", "origin/main"]); runChecked("git", ["rev-parse", "origin/main"]);
localWorkspaceSnapshotPrecheck();
} }
function currentBranchName(): string { function currentBranchName(): string {
@ -155,10 +204,12 @@ function localBranchPrecheck(branch: string): void {
const porcelain = captureChecked("git", ["status", "--porcelain=v1"]).trim(); const porcelain = captureChecked("git", ["status", "--porcelain=v1"]).trim();
if (porcelain) { if (porcelain) {
console.error( console.error(
`Refusing to deploy ${branch} with uncommitted local changes. Commit the intended state first.` `Refusing to deploy ${branch} with uncommitted local changes. Commit the intended state first.`,
); );
process.exit(1); process.exit(1);
} }
localWorkspaceSnapshotPrecheck();
} }
function publishCurrentBranch(branch: string): void { function publishCurrentBranch(branch: string): void {
@ -169,8 +220,8 @@ function publishCurrentBranch(branch: string): void {
{ {
cwd: repoRoot, cwd: repoRoot,
encoding: "utf8", encoding: "utf8",
stdio: ["inherit", "pipe", "pipe"] stdio: ["inherit", "pipe", "pipe"],
} },
); );
if (upstreamResult.status === 0) { if (upstreamResult.status === 0) {
@ -218,12 +269,18 @@ while IFS= read -r line; do
;; ;;
esac esac
done <<< "$status" done <<< "$status"
` `,
); );
} }
function remoteRollout(mode: DeployMode, branch: string | null, forceRecreate: boolean): void { function remoteRollout(
const composeArgs = forceRecreate ? "up -d --build --force-recreate" : "up -d --build"; mode: DeployMode,
branch: string | null,
forceRecreate: boolean,
): void {
const composeArgs = forceRecreate
? "up -d --build --force-recreate"
: "up -d --build";
const switchCommand = const switchCommand =
mode === "main" mode === "main"
? `git switch main ? `git switch main
@ -242,7 +299,7 @@ ${switchCommand}
cd "${REMOTE_DEPLOYMENT}" cd "${REMOTE_DEPLOYMENT}"
docker compose ${composeArgs} docker compose ${composeArgs}
` `,
); );
} }
@ -257,7 +314,7 @@ docker compose ps
docker compose logs --tail=100 ${LOG_SERVICES.join(" ")} docker compose logs --tail=100 ${LOG_SERVICES.join(" ")}
docker exec ${API_CONTAINER} bun -e 'const r = await fetch("http://127.0.0.1:4000/health"); console.log(await r.text())' docker exec ${API_CONTAINER} bun -e 'const r = await fetch("http://127.0.0.1:4000/health"); console.log(await r.text())'
docker exec ${WEB_CONTAINER} bun -e 'const r = await fetch("http://127.0.0.1:3000/"); console.log(r.status)' docker exec ${WEB_CONTAINER} bun -e 'const r = await fetch("http://127.0.0.1:3000/"); console.log(r.status)'
` `,
); );
} }
@ -271,7 +328,7 @@ function publicVerification(): void {
} }
console.log( console.log(
"Skipping separate public API health check; same-origin mode relies on the public app check plus container-local API verification." "Skipping separate public API health check; same-origin mode relies on the public app check plus container-local API verification.",
); );
} }
@ -293,7 +350,7 @@ function main(): void {
console.log( console.log(
mode === "main" mode === "main"
? "Deploying origin/main to the existing Islandflow VPS checkout." ? "Deploying origin/main to the existing Islandflow VPS checkout."
: "Deploying the current local branch to the existing Islandflow VPS checkout." : "Deploying the current local branch to the existing Islandflow VPS checkout.",
); );
if (mode === "main") { if (mode === "main") {