From 360721cc910b91b83bf39aa46cd130bf64266c1a Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Sat, 3 Oct 2026 01:44:42 +0100 Subject: [PATCH] Bind demo cohost observation to the real Relay health route Current operational source exposes healthz and takes the shared deployment lock. Pin that route and make the disposable service return 404 for unknown paths so native acceptance cannot manufacture a healthy cohost observation. Change-source: pulse-maintainer --- .github/scripts/demo-runtime-transaction.py | 2 +- .github/scripts/tests/demo_runtime_native.py | 9 ++++++--- .github/scripts/tests/test_demo_runtime_transaction.py | 3 +++ .../v6/internal/subsystems/deployment-installability.md | 3 +++ 4 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.github/scripts/demo-runtime-transaction.py b/.github/scripts/demo-runtime-transaction.py index 436e74b46d..6f12dfebf2 100644 --- a/.github/scripts/demo-runtime-transaction.py +++ b/.github/scripts/demo-runtime-transaction.py @@ -27,7 +27,7 @@ PATHS = {"binary": Path("/opt/pulse/bin/pulse"), "unit": Path("/etc/systemd/system/pulse.service"), "dropins": Path("/etc/systemd/system/pulse.service.d"), "data": Path("/etc/pulse")} -RELAY_HEALTH = "https://relay.pulserelay.pro/health" +RELAY_HEALTH = "https://relay.pulserelay.pro/healthz" COUNT_KEYS = ("nodes", "vms_per_node", "lxcs_per_node", "docker_hosts", "docker_containers", "generic_hosts", "k8s_clusters", "k8s_nodes", "k8s_pods", "k8s_deployments") diff --git a/.github/scripts/tests/demo_runtime_native.py b/.github/scripts/tests/demo_runtime_native.py index b004b1cf05..0b7fc6a73b 100644 --- a/.github/scripts/tests/demo_runtime_native.py +++ b/.github/scripts/tests/demo_runtime_native.py @@ -38,11 +38,14 @@ def fail(): if %r: threading.Thread(target=fail,daemon=True).start() class Handler(http.server.BaseHTTPRequestHandler): def do_GET(self): + expected = {'/healthz'} if %r == 17656 else {'/api/health','/api/version'} + if self.path not in expected: + self.send_response(404); self.end_headers(); return body=json.dumps({'version':VERSION} if self.path=='/api/version' else {'status':'healthy'}).encode() self.send_response(200); self.end_headers(); self.wfile.write(body) def log_message(self,*args): pass http.server.HTTPServer(('127.0.0.1',%r),Handler).serve_forever() -''' % (version, fail_after, fail_after, port)).encode() +''' % (version, fail_after, fail_after, port, port)).encode() def unit(executable, user="pulse"): @@ -128,9 +131,9 @@ def main(): original = (SCRIPTS / "demo-runtime-transaction.py").read_bytes() # Only the cohost endpoint is rebound. Transaction, paths, locking, # systemd, HTTP/TLS, estate, clocks and watches remain real and unchanged. - endpoint = b'https://relay.pulserelay.pro/health' + endpoint = b'https://relay.pulserelay.pro/healthz' assert original.count(endpoint) == 1 - source = original.replace(endpoint, b'https://127.0.0.1:18444/health') + source = original.replace(endpoint, b'https://127.0.0.1:18444/healthz') result["original_engine_sha256"] = hashlib.sha256(original).hexdigest() result["fixture_engine_sha256"] = hashlib.sha256(source).hexdigest() result["bootstrap_sha256"] = hashlib.sha256(dispatcher.BOOTSTRAP.encode()).hexdigest() diff --git a/.github/scripts/tests/test_demo_runtime_transaction.py b/.github/scripts/tests/test_demo_runtime_transaction.py index c2fab87420..86bc90e60c 100644 --- a/.github/scripts/tests/test_demo_runtime_transaction.py +++ b/.github/scripts/tests/test_demo_runtime_transaction.py @@ -347,6 +347,9 @@ class TransactionTest(unittest.TestCase): class InputAndCommandTest(unittest.TestCase): + def test_cohost_check_uses_the_existing_relay_health_route(self): + self.assertEqual(engine.RELAY_HEALTH, "https://relay.pulserelay.pro/healthz") + def test_valid_current_envelope(self): engine.validate(request()) engine.validate(request("update")) diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index f53a0ffd5d..c24547706f 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -24,6 +24,9 @@ The mutating paths now share the Relay host's existing Every successful path, including a healthy no-op, needs a complete 300-second local/public/Relay health, version, service PID/restart and new-journal-crash window. Readiness is separate. Missing observations fail closed. +The fixed Relay observation is its existing `/healthz` endpoint, not a guessed +new route; disposable acceptance also rejects an unknown route rather than +responding healthy to every URL. Before installation or runtime-profile mutation, stop only Pulse and durably capture its executable, unit/drop-ins and entire persistent data estate. Refuse