Add guarded Forgejo storage measurement to AOSguard #939

New issue

Closed

opened 2026-08-06 06:01:24 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-08-06 06:01:24 +00:00

Owner

Acceptance criteria:

Mount the command as a sibling exec transport beside the existing Forgejo API group.
Fix the namespace, application workload, database workload, filesystem paths, shell programs, and SQL statements in tracked code.
Accept no caller-controlled pod, path, shell, or SQL arguments.
Report PVC and pod ownership, Forgejo root and managed-data usage, package and repository splits, Git packfiles, PostgreSQL size, package blob references, package ownership, package version ages, and cleanup rules.
Bound every section independently, continue after a section failure, and return nonzero when any section is incomplete.
Package the bridge in dev-base and native AOSguard releases.
Test the sealed command boundary, fixed kubectl argv, timeout behavior, incomplete-result status, release embedding, and generated command surface.
Document why application-aware exec stays outside the generic kubectl and node-stats surfaces.

After this lands, update infrastructure's attended wrapper and disk-pressure skill to delegate to the guarded command instead of requiring a human-run raw exec path.

Disk-pressure diagnosis can classify host and PVC pressure through node-stats, but application-aware Forgejo measurement currently stops at a human handoff because the generic kubectl surface intentionally denies exec. Add a sealed `aosguard ops forgejo-storage measure` command backed by a packaged read-only bridge. Acceptance criteria: * Mount the command as a sibling exec transport beside the existing Forgejo API group. * Fix the namespace, application workload, database workload, filesystem paths, shell programs, and SQL statements in tracked code. * Accept no caller-controlled pod, path, shell, or SQL arguments. * Report PVC and pod ownership, Forgejo root and managed-data usage, package and repository splits, Git packfiles, PostgreSQL size, package blob references, package ownership, package version ages, and cleanup rules. * Bound every section independently, continue after a section failure, and return nonzero when any section is incomplete. * Package the bridge in dev-base and native AOSguard releases. * Test the sealed command boundary, fixed kubectl argv, timeout behavior, incomplete-result status, release embedding, and generated command surface. * Document why application-aware exec stays outside the generic kubectl and node-stats surfaces. After this lands, update infrastructure's attended wrapper and disk-pressure skill to delegate to the guarded command instead of requiring a human-run raw exec path.

coilyco-ops commented

2026-08-06 06:11:00 +00:00

Author

Owner

Implementation note: specgen mounts separate transport members as sibling command groups. A second member at ops forgejo storage duplicated and shadowed the API-backed Forgejo group in tests. The implemented public shape is now aosguard ops forgejo-storage measure, matching the existing sibling exec-area precedent while keeping the command sealed and Forgejo-specific. Existing Forgejo API tests and the new storage tests pass with this shape.

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-08-06 06:12:13 +00:00

Delegate Forgejo storage measurement to AOSguard #762

coilyco-ops referenced this issue from a commit

2026-08-06 06:12:59 +00:00

feat: add guarded Forgejo storage measurement

coilyco-ops referenced this issue from a pull request that will close it,

2026-08-06 06:13:17 +00:00

feat: add guarded Forgejo storage measurement #940

coilyco-ops referenced this issue from a commit

2026-08-06 06:57:11 +00:00

refactor: embed Forgejo storage measurement in aosguard