From 67e503a571cbce0f7eaaf3e13630b172f16c91d1 Mon Sep 17 00:00:00 2001
From: ogt <ogt@awoooi.local>
Date: Sat, 11 Jul 2026 14:22:02 +0800
Subject: [PATCH] fix(cd): wait for boundary readback rollout

---
 .gitea/workflows/cd.yaml                      | 31 ++++++++++++++++---
 ..._signal_worker_ansible_executor_binding.py |  4 +++
 2 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index b59d38e4e..74178d3a7 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -3319,15 +3319,23 @@ jobs:
           SOURCE_REVISION="$SOURCE_REVISION" python3 - <<'PY'
           import json
           import os
+          import sys
           import time
           import urllib.request
 
           expected = os.environ["SOURCE_REVISION"].strip().lower()
-          url = "https://awoooi.wooo.work/api/v1/agents/agent-autonomous-runtime-control"
+          base_url = "https://awoooi.wooo.work/api/v1/agents/agent-autonomous-runtime-control"
+          attempts = int(
+              os.environ.get("EXECUTOR_BOUNDARY_READBACK_ATTEMPTS", "60")
+          )
           last_status = "unavailable"
-          for _attempt in range(1, 8):
+          for attempt in range(1, attempts + 1):
+              url = (
+                  f"{base_url}?expected_source_sha={expected}"
+                  f"&readback_attempt={attempt}"
+              )
               try:
-                  with urllib.request.urlopen(url, timeout=20) as response:
+                  with urllib.request.urlopen(url, timeout=10) as response:
                       payload = json.load(response)
               except Exception as exc:
                   last_status = f"fetch_failed:{type(exc).__name__}"
@@ -3352,7 +3360,13 @@ jobs:
                       boundary.get("canonical_learning_source_boundary")
                       or {}
                   )
-                  last_status = str(boundary.get("status") or "missing")
+                  last_status = (
+                      f"status={boundary.get('status') or 'missing'};"
+                      "verified_source_sha="
+                      f"{str(boundary.get('verified_source_sha') or '')[:10]};"
+                      "deployed_source_sha="
+                      f"{str(boundary.get('deployed_source_sha') or '')[:10]}"
+                  )
                   if (
                       boundary.get("production_boundary_verified") is True
                       and boundary.get("full_workload_boundary_verified") is True
@@ -3372,7 +3386,14 @@ jobs:
                   ):
                       print("executor_boundary_public_readback=verified_ready")
                       break
-              time.sleep(5)
+              if attempt == 1 or attempt % 6 == 0:
+                  print(
+                      "executor_boundary_public_readback_waiting="
+                      f"{attempt}/{attempts};{last_status}",
+                      file=sys.stderr,
+                  )
+              if attempt < attempts:
+                  time.sleep(5)
           else:
               raise SystemExit(
                   "executor boundary public readback failed: " + last_status
diff --git a/apps/api/tests/test_signal_worker_ansible_executor_binding.py b/apps/api/tests/test_signal_worker_ansible_executor_binding.py
index 3e43ca083..37b6a5620 100644
--- a/apps/api/tests/test_signal_worker_ansible_executor_binding.py
+++ b/apps/api/tests/test_signal_worker_ansible_executor_binding.py
@@ -198,6 +198,10 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None:
         in workflow
     )
     assert "executor_boundary_public_readback=verified_ready" in workflow
+    assert "EXECUTOR_BOUNDARY_READBACK_ATTEMPTS" in workflow
+    assert "range(1, attempts + 1)" in workflow
+    assert "readback_attempt={attempt}" in workflow
+    assert "executor_boundary_public_readback_waiting=" in workflow
     assert 'boundary.get("full_workload_boundary_verified") is True' in workflow
     assert 'database_boundary.get("db_identity_isolated") is True' in workflow
     assert "autonomous_single_writer_source_boundary" in workflow