serve: hold verdict drains without automatic restart

triform-admin commented

2026-09-11 22:19:39 +00:00

Owner

Ordinary /admin/quiesce exits after draining, allowing an orchestrator to restart admission before an operator removes a verdict daemon from its pool. Add authenticated POST /admin/quiesce-hold to preserve accepted verdict work and stay paused when idle. Ordinary quiesce retains its drain-and-exit behavior and releases a hold into a clean restart.

Unsupported adapters and separate build lanes return 501. The operator runbook requires external replacement fencing, stable pod/container identities, authenticated zero activity across all seven counters, and verified routing removal before scale-down. This change does not scale workloads or provide image-builder leases.

Validation: Forgejo build, full tests, fmt, Clippy and lane mutation checks passed. The dedicated builder passed all seven default/integration checks for 4a46c2af68. An isolated ready debug daemon rejected unauthorized hold with 401, stayed alive across five idle held samples, and exited with code 0 after ordinary quiesce. That process check does not qualify a production image, verdict accuracy, or cluster routing. New tests cover accepted-work preservation, rejection of later pushes, idempotence, safe release, POST/auth dispatch and unsupported adapters.

Ordinary /admin/quiesce exits after draining, allowing an orchestrator to restart admission before an operator removes a verdict daemon from its pool. Add authenticated POST /admin/quiesce-hold to preserve accepted verdict work and stay paused when idle. Ordinary quiesce retains its drain-and-exit behavior and releases a hold into a clean restart. Unsupported adapters and separate build lanes return 501. The operator runbook requires external replacement fencing, stable pod/container identities, authenticated zero activity across all seven counters, and verified routing removal before scale-down. This change does not scale workloads or provide image-builder leases. Validation: Forgejo build, full tests, fmt, Clippy and lane mutation checks passed. The dedicated builder passed all seven default/integration checks for 4a46c2af68ce466dfbc4d0d1c7ebbd471a228927. An isolated ready debug daemon rejected unauthorized hold with 401, stayed alive across five idle held samples, and exited with code 0 after ordinary quiesce. That process check does not qualify a production image, verdict accuracy, or cluster routing. New tests cover accepted-work preservation, rejection of later pushes, idempotence, safe release, POST/auth dispatch and unsupported adapters.

triform-admin added 1 commit

2026-09-11 22:19:39 +00:00