Files
awoooi/scripts/reboot-recovery/post-start-quick-check.sh

653 lines
24 KiB
Bash
Executable File

#!/usr/bin/env bash
set -uo pipefail
# One-entry read-only post-reboot check. This wrapper intentionally delegates
# deep checks to the existing recovery scripts and does not restart, patch,
# delete, import, reload, or write runtime state.
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
SSH_CONNECT_TIMEOUT="${SSH_CONNECT_TIMEOUT:-6}"
ROUTE_RETRY_ATTEMPTS="${ROUTE_RETRY_ATTEMPTS:-3}"
ROUTE_RETRY_DELAY_SECONDS="${ROUTE_RETRY_DELAY_SECONDS:-2}"
STOCK_FRESHNESS_RETRY_ATTEMPTS="${STOCK_FRESHNESS_RETRY_ATTEMPTS:-6}"
STOCK_FRESHNESS_RETRY_DELAY_SECONDS="${STOCK_FRESHNESS_RETRY_DELAY_SECONDS:-5}"
RUN_COLD_START=1
RUN_MOMO=1
RUN_STOCK=1
RUN_BACKUP=1
RUN_ROUTES=1
RUN_CPU=1
NO_COLOR_FLAG=0
COLD_START_PENDING_BLOCKERS=0
COLD_START_BLOCKED_SUMMARY=""
COLD_START_BLOCKED_LINES=""
ROUTE_SMOKE_BLOCKED=0
AWOOOI_API_ROUTE_OK=0
STOCK_EOD_WINDOW_PENDING=0
STOCK_EOD_CLASSIFICATION="not_evaluated"
STOCK_EOD_NEXT_ACTION="not_evaluated"
STOCK_EOD_FIRST_FULL_WINDOW_END_LOCAL="19:15"
PASS_COUNT=0
WARN_COUNT=0
BLOCKED_COUNT=0
SERVICE_WARN_COUNT=0
BOUNDARY_WARN_COUNT=0
EVIDENCE_WARN_COUNT=0
HOSTS=(
"192.168.0.110"
"192.168.0.120"
"192.168.0.121"
"192.168.0.188"
)
ROUTES=(
"https://awoooi.wooo.work/"
"https://awoooi.wooo.work/api/v1/health"
"https://awoooi.wooo.work/zh-TW/iwooos"
"https://vibework.wooo.work/"
"https://awooogo.wooo.work/"
"https://2026fifa.wooo.work/"
"https://agent.wooo.work/"
"https://mo.wooo.work/"
"https://mo.wooo.work/health"
"https://stock.wooo.work/"
"https://stock.wooo.work/healthz"
"https://stock.wooo.work/api/healthz"
"https://bitan.wooo.work/"
"https://tsenyang.com/"
"https://www.tsenyang.com/"
"https://vtuber.wooo.work/"
"https://gitea.wooo.work/"
"https://harbor.wooo.work/"
"https://registry.wooo.work/"
"https://sentry.wooo.work/"
"https://signoz.wooo.work/"
"https://langfuse.wooo.work/"
"https://aiops.wooo.work/"
)
usage() {
cat <<'USAGE'
Usage: post-start-quick-check.sh [options]
Read-only post-reboot quick check for 110 / 120 / 121 / 188.
Options:
--skip-cold-start Do not run full-stack-cold-start-check.sh.
--skip-momo Do not run momo-drive-token-source-recovery-preflight.sh.
--skip-stock Do not query StockPlatform data freshness.
--skip-backup Do not run /backup/scripts/backup-status.sh on 110.
--skip-routes Do not curl public route smoke targets.
--skip-cpu Do not read 110 CPU / process summary.
--no-color Disable ANSI color.
-h, --help Show this help.
Environment:
ROUTE_RETRY_ATTEMPTS Public route attempts before blocking. Default: 3.
ROUTE_RETRY_DELAY_SECONDS Delay between failed public route attempts. Default: 2.
STOCK_FRESHNESS_RETRY_ATTEMPTS Stock freshness attempts before blocking. Default: 6.
STOCK_FRESHNESS_RETRY_DELAY_SECONDS Delay between failed Stock freshness attempts. Default: 5.
Exit codes:
0 = no service blockers. Boundary / evidence warnings may still be present.
1 = service warnings only.
2 = service blockers observed.
This script never reads token content and never writes runtime state.
USAGE
}
while [[ $# -gt 0 ]]; do
case "$1" in
--skip-cold-start)
RUN_COLD_START=0
;;
--skip-momo)
RUN_MOMO=0
;;
--skip-stock)
RUN_STOCK=0
;;
--skip-backup)
RUN_BACKUP=0
;;
--skip-routes)
RUN_ROUTES=0
;;
--skip-cpu)
RUN_CPU=0
;;
--no-color)
NO_COLOR_FLAG=1
;;
-h|--help)
usage
exit 0
;;
*)
printf 'Unknown argument: %s\n' "$1" >&2
usage >&2
exit 2
;;
esac
shift
done
if [[ -n "${NO_COLOR:-}" || "$NO_COLOR_FLAG" -eq 1 ]]; then
RED=""
GREEN=""
YELLOW=""
BLUE=""
NC=""
else
RED=$'\033[0;31m'
GREEN=$'\033[0;32m'
YELLOW=$'\033[1;33m'
BLUE=$'\033[0;34m'
NC=$'\033[0m'
fi
section() {
printf '\n%s=== %s ===%s\n' "$BLUE" "$1" "$NC"
}
ok() {
PASS_COUNT=$((PASS_COUNT + 1))
printf '%sOK%s %s\n' "$GREEN" "$NC" "$*"
}
warn() {
WARN_COUNT=$((WARN_COUNT + 1))
printf '%sWARN%s %s\n' "$YELLOW" "$NC" "$*"
}
service_warn() {
SERVICE_WARN_COUNT=$((SERVICE_WARN_COUNT + 1))
warn "$@"
}
boundary_warn() {
BOUNDARY_WARN_COUNT=$((BOUNDARY_WARN_COUNT + 1))
warn "$@"
}
evidence_warn() {
EVIDENCE_WARN_COUNT=$((EVIDENCE_WARN_COUNT + 1))
warn "$@"
}
blocked() {
BLOCKED_COUNT=$((BLOCKED_COUNT + 1))
printf '%sBLOCKED%s %s\n' "$RED" "$NC" "$*"
}
ssh_read() {
local user_host="$1"
local command="$2"
ssh -o BatchMode=yes -o ConnectTimeout="$SSH_CONNECT_TIMEOUT" "$user_host" "$command"
}
run_and_capture() {
local label="$1"
shift
local tmp
tmp="$(mktemp -t post-start-quick-check.XXXXXX)"
if "$@" >"$tmp" 2>&1; then
ok "$label"
cat "$tmp"
rm -f "$tmp"
return 0
fi
local rc=$?
cat "$tmp"
rm -f "$tmp"
return "$rc"
}
section "主機 / SSH"
for host in "${HOSTS[@]}"; do
if ping -c 1 -W 1 "$host" >/dev/null 2>&1; then
ok "PING_OK $host"
else
blocked "PING_FAIL $host"
fi
if nc -z -w 2 "$host" 22 >/dev/null 2>&1; then
ok "SSH_PORT_OK $host"
else
blocked "SSH_PORT_FAIL $host"
fi
done
if [[ "$RUN_COLD_START" -eq 1 ]]; then
section "Cold-start scorecard"
cold_tmp="$(mktemp -t post-start-cold-start.XXXXXX)"
cold_rc=0
if bash "$ROOT_DIR/scripts/reboot-recovery/full-stack-cold-start-check.sh" --monitor-read-only --no-color --watch --interval 1 --max-attempts 1 >"$cold_tmp" 2>&1; then
cold_rc=0
else
cold_rc=$?
fi
cat "$cold_tmp"
cold_summary="$(grep -E 'PASS=[0-9]+ WARN=[0-9]+ BLOCKED=[0-9]+' "$cold_tmp" | tail -n 1 || true)"
if [[ -n "$cold_summary" ]]; then
ok "cold-start summary: $cold_summary"
cold_warn=0
cold_blocked=0
if [[ "$cold_summary" =~ WARN=([0-9]+) ]]; then
cold_warn="${BASH_REMATCH[1]}"
fi
if [[ "$cold_summary" =~ BLOCKED=([0-9]+) ]]; then
cold_blocked="${BASH_REMATCH[1]}"
fi
if [[ "$cold_blocked" -gt 0 ]]; then
COLD_START_PENDING_BLOCKERS="$cold_blocked"
COLD_START_BLOCKED_SUMMARY="$cold_summary"
COLD_START_BLOCKED_LINES="$(grep -E '^BLOCKED ' "$cold_tmp" || true)"
evidence_warn "cold-start blockers pending wrapper retry classification: $cold_summary"
elif [[ "$cold_warn" -gt 0 ]]; then
service_warn "cold-start is warning-only, not blocked: $cold_summary"
elif [[ "$cold_rc" -eq 0 ]]; then
ok "cold-start command exited 0"
else
evidence_warn "cold-start exited $cold_rc but summary has no blockers: $cold_summary"
fi
else
if [[ "$cold_rc" -eq 0 ]]; then
service_warn "cold-start summary not found"
else
blocked "cold-start command returned $cold_rc without summary"
fi
fi
rm -f "$cold_tmp"
fi
if [[ "$RUN_MOMO" -eq 1 ]]; then
section "MOMO freshness"
momo_tmp="$(mktemp -t post-start-momo.XXXXXX)"
bash "$ROOT_DIR/scripts/reboot-recovery/momo-drive-token-source-recovery-preflight.sh" >"$momo_tmp" 2>&1
momo_rc=$?
cat "$momo_tmp"
momo_summary="$(grep -E 'MOMO_DRIVE_TOKEN_SOURCE_PREFLIGHT PASS=[0-9]+ WARN=[0-9]+ BLOCKED=[0-9]+' "$momo_tmp" | tail -n 1 || true)"
case "$momo_rc" in
0)
ok "MOMO preflight clean"
;;
1)
if [[ "$momo_summary" =~ BLOCKED=0 ]]; then
evidence_warn "MOMO preflight has non-service warnings"
else
service_warn "MOMO preflight has warnings and no clean summary"
fi
;;
*)
blocked "MOMO preflight has blockers"
;;
esac
grep -E 'MOMO_DRIVE_TOKEN_SOURCE_PREFLIGHT|MOMO_HEALTH_VERSION|DB_MONTHLY_SYNC|DB_DAILY_FRESHNESS|DB_LATEST_DAILY_IMPORT_JOB' "$momo_tmp" || true
source_gate_output="$("$ROOT_DIR/scripts/reboot-recovery/momo-source-arrival-gate.py" --preflight-log "$momo_tmp" 2>&1)"
source_gate_rc=$?
printf '%s\n' "$source_gate_output"
if grep -q 'status=blocked_source_absent_fail_closed' <<<"$source_gate_output"; then
evidence_warn "MOMO source-arrival gate confirms source absent fail-closed"
elif grep -q 'status=source_arrived_ready_for_safe_import_preflight' <<<"$source_gate_output"; then
boundary_warn "MOMO source arrived; safe import preflight only, DB/Drive/runtime writes remain unauthorized"
elif grep -q 'status=freshness_already_green_recheck_cold_start' <<<"$source_gate_output"; then
ok "MOMO source-arrival gate reports freshness green; rerun post-reboot summary before updating declaration"
elif [[ "$source_gate_rc" -ne 0 ]]; then
service_warn "MOMO source-arrival gate did not produce a known state rc=$source_gate_rc"
else
evidence_warn "MOMO source-arrival gate produced a non-terminal state"
fi
rm -f "$momo_tmp"
fi
if [[ "$RUN_STOCK" -eq 1 ]]; then
section "StockPlatform freshness"
stock_tmp="$(mktemp -t post-start-stock.XXXXXX)"
stock_code=""
stock_attempt=1
while [[ "$stock_attempt" -le "$STOCK_FRESHNESS_RETRY_ATTEMPTS" ]]; do
stock_code="$(curl -k -sS -o "$stock_tmp" -w '%{http_code}' --max-time 12 "https://stock.wooo.work/api/v1/system/freshness" 2>/dev/null || true)"
if [[ "$stock_code" == 2* ]]; then
if [[ "$stock_attempt" -gt 1 ]]; then
evidence_warn "StockPlatform freshness recovered after attempt=$stock_attempt"
fi
break
fi
if [[ "$stock_attempt" -lt "$STOCK_FRESHNESS_RETRY_ATTEMPTS" ]]; then
sleep "$STOCK_FRESHNESS_RETRY_DELAY_SECONDS"
fi
stock_attempt=$((stock_attempt + 1))
done
if [[ "$stock_code" != 2* ]]; then
blocked "StockPlatform freshness endpoint returned ${stock_code:-curl_failed} attempts=$STOCK_FRESHNESS_RETRY_ATTEMPTS"
cat "$stock_tmp" || true
else
python3 - "$stock_tmp" <<'PY'
import json
import sys
path = sys.argv[1]
with open(path, "r", encoding="utf-8") as fh:
payload = json.load(fh)
print(f"STOCK_FRESHNESS_STATUS {payload.get('status')}")
print(f"STOCK_LATEST_TRADING_DATE {payload.get('latest_trading_date')}")
print("STOCK_BLOCKERS " + ",".join(payload.get("blockers") or []))
for source in payload.get("sources") or []:
print(
"STOCK_SOURCE "
f"{source.get('source')}|{source.get('status')}|"
f"{source.get('latest_date')}|{source.get('row_count')}"
)
PY
stock_status="$(python3 - "$stock_tmp" <<'PY'
import json
import sys
with open(sys.argv[1], "r", encoding="utf-8") as fh:
print(json.load(fh).get("status") or "")
PY
)"
if [[ "$stock_status" == "ok" ]]; then
printf 'STOCK_EOD_WINDOW_PENDING 0\n'
printf 'STOCK_EOD_CLASSIFICATION ok\n'
printf 'STOCK_EOD_NEXT_ACTION none\n'
ok "StockPlatform freshness is ok"
else
stock_blockers="$(python3 - "$stock_tmp" <<'PY'
import json
import sys
with open(sys.argv[1], "r", encoding="utf-8") as fh:
print(",".join(json.load(fh).get("blockers") or []))
PY
)"
stock_eod_context="$(python3 - "$stock_tmp" <<'PY'
import json
import sys
from datetime import datetime, time, timezone, timedelta
try:
from zoneinfo import ZoneInfo
except Exception: # pragma: no cover - old Python fallback
ZoneInfo = None
with open(sys.argv[1], "r", encoding="utf-8") as fh:
payload = json.load(fh)
tz = ZoneInfo("Asia/Taipei") if ZoneInfo else timezone(timedelta(hours=8))
now = datetime.now(tz)
today = now.date().isoformat()
latest = payload.get("latest_trading_date") or ""
status = payload.get("status") or "unknown"
blockers = payload.get("blockers") or []
first_full_window_end = time(19, 15)
final_retry_window_end = time(23, 35)
pending = 0
classification = "blocked_unknown"
next_action = "investigate_stockplatform_freshness"
if status == "ok":
classification = "ok"
next_action = "none"
elif latest == today and blockers and now.time() < first_full_window_end:
pending = 1
classification = "pending_first_eod_window"
next_action = "wait_for_18_20_19_10_cron_then_recheck"
elif latest == today and blockers and now.time() < final_retry_window_end:
classification = "after_first_eod_window_blocked"
next_action = "inspect_ingestion_logs_and_wait_retry_windows"
elif latest == today and blockers:
classification = "after_final_eod_window_blocked"
next_action = "open_stockplatform_data_recovery_gate"
elif blockers:
classification = "blocked_non_current_trading_day"
next_action = "inspect_trading_calendar_and_ingestion_logs"
print(f"STOCK_EOD_WINDOW_PENDING {pending}")
print(f"STOCK_EOD_CLASSIFICATION {classification}")
print(f"STOCK_EOD_NEXT_ACTION {next_action}")
print(f"STOCK_EOD_FIRST_FULL_WINDOW_END_LOCAL {first_full_window_end.strftime('%H:%M')}")
print(f"STOCK_EOD_FINAL_RETRY_WINDOW_END_LOCAL {final_retry_window_end.strftime('%H:%M')}")
print(f"STOCK_EOD_OBSERVED_AT_LOCAL {now.isoformat(timespec='seconds')}")
PY
)"
printf '%s\n' "$stock_eod_context"
STOCK_EOD_WINDOW_PENDING="$(awk '$1 == "STOCK_EOD_WINDOW_PENDING" {print $2}' <<<"$stock_eod_context" | tail -n 1)"
STOCK_EOD_CLASSIFICATION="$(awk '$1 == "STOCK_EOD_CLASSIFICATION" {print $2}' <<<"$stock_eod_context" | tail -n 1)"
STOCK_EOD_NEXT_ACTION="$(awk '$1 == "STOCK_EOD_NEXT_ACTION" {print $2}' <<<"$stock_eod_context" | tail -n 1)"
if [[ "$STOCK_EOD_WINDOW_PENDING" == "1" ]]; then
evidence_warn "StockPlatform freshness pending scheduled EOD window: ${STOCK_EOD_CLASSIFICATION:-unknown}; next=${STOCK_EOD_NEXT_ACTION:-unknown}; blockers=${stock_blockers:-no_blocker_list}"
else
blocked "StockPlatform freshness is ${stock_status:-unknown}: ${stock_blockers:-no_blocker_list}; classification=${STOCK_EOD_CLASSIFICATION:-unknown}"
fi
fi
fi
rm -f "$stock_tmp"
fi
if [[ "$RUN_BACKUP" -eq 1 ]]; then
section "Backup / offsite / escrow"
backup_tmp="$(mktemp -t post-start-backup.XXXXXX)"
if ssh_read "wooo@192.168.0.110" '/backup/scripts/backup-status.sh --no-notify --no-refresh' >"$backup_tmp" 2>&1; then
ok "backup-status readback succeeded"
else
blocked "backup-status readback failed"
fi
cat "$backup_tmp"
if grep -Eq 'core_blockers=0|CORE_BLOCKERS[ =]0' "$backup_tmp"; then
ok "backup core blockers are 0"
elif grep -Eq 'core_blockers=[1-9]|CORE_BLOCKERS[ =][1-9]' "$backup_tmp"; then
blocked "backup core blockers are non-zero"
else
service_warn "backup core blocker summary not confirmed"
fi
if grep -Eq 'escrow_missing=0|ESCROW_MISSING_COUNT[ =]0' "$backup_tmp"; then
ok "credential escrow missing is 0"
elif grep -Eq 'escrow_missing=[1-9]|ESCROW_MISSING_COUNT[ =][1-9]' "$backup_tmp"; then
boundary_warn "credential escrow still missing; DR_COMPLETE is forbidden"
escrow_status_tmp="$(mktemp -t post-start-escrow-status.XXXXXX)"
if ssh_read "wooo@192.168.0.110" '/backup/scripts/mark-credential-escrow-verified.sh --status' >"$escrow_status_tmp" 2>&1; then
evidence_warn "credential escrow missing items follow"
else
evidence_warn "credential escrow missing item readback failed"
fi
cat "$escrow_status_tmp"
rm -f "$escrow_status_tmp"
else
evidence_warn "credential escrow count not found"
fi
rm -f "$backup_tmp"
fi
if [[ "$RUN_ROUTES" -eq 1 ]]; then
section "Public routes"
for url in "${ROUTES[@]}"; do
code=""
attempt=1
while [[ "$attempt" -le "$ROUTE_RETRY_ATTEMPTS" ]]; do
code="$(curl -k -sS -o /dev/null -w '%{http_code}' --max-time 12 "$url" 2>/dev/null || true)"
case "$code" in
2*|3*)
break
;;
esac
if [[ "$attempt" -lt "$ROUTE_RETRY_ATTEMPTS" ]]; then
sleep "$ROUTE_RETRY_DELAY_SECONDS"
fi
attempt=$((attempt + 1))
done
case "$code" in
2*|3*)
if [[ "$url" == "https://awoooi.wooo.work/api/v1/health" && "$code" == 2* ]]; then
AWOOOI_API_ROUTE_OK=1
fi
if [[ "$attempt" -gt 1 ]]; then
evidence_warn "$code $url recovered_after_attempt=$attempt"
else
ok "$code $url"
fi
;;
*)
ROUTE_SMOKE_BLOCKED=$((ROUTE_SMOKE_BLOCKED + 1))
blocked "${code:-curl_failed} $url attempts=$ROUTE_RETRY_ATTEMPTS"
;;
esac
done
fi
if [[ "$COLD_START_PENDING_BLOCKERS" -gt 0 ]]; then
non_route_cold_blockers="$(printf '%s\n' "$COLD_START_BLOCKED_LINES" | grep -Ev '^BLOCKED public route ' || true)"
if [[ "$RUN_ROUTES" -eq 1 && "$ROUTE_SMOKE_BLOCKED" -eq 0 && "$AWOOOI_API_ROUTE_OK" -eq 1 ]]; then
non_route_cold_blockers="$(
printf '%s\n' "$non_route_cold_blockers" | grep -Ev '^BLOCKED AWOOOI API not reachable$|^BLOCKED AWOOI API not reachable$' || true
)"
fi
if [[ "$RUN_ROUTES" -eq 1 && "$ROUTE_SMOKE_BLOCKED" -eq 0 && -z "$non_route_cold_blockers" ]]; then
evidence_warn "cold-start route/API warmup blockers recovered under wrapper route retry: $COLD_START_BLOCKED_SUMMARY"
printf '%s\n' "$COLD_START_BLOCKED_LINES"
else
blocked "cold-start has blockers: $COLD_START_BLOCKED_SUMMARY"
printf '%s\n' "$COLD_START_BLOCKED_LINES"
fi
fi
if [[ "$RUN_CPU" -eq 1 ]]; then
section "110 CPU / process attribution"
cpu_tmp="$(mktemp -t post-start-cpu.XXXXXX)"
if ssh_read "wooo@192.168.0.110" 'uptime; vmstat 1 5; ps -eo pid,ppid,pgid,stat,pcpu,pmem,comm,args --sort=-pcpu | head -25' >"$cpu_tmp" 2>&1; then
ok "110 CPU/process readback succeeded"
else
evidence_warn "110 CPU/process readback failed"
fi
cat "$cpu_tmp"
if grep -Eiq 'chrome|chromium|playwright' "$cpu_tmp"; then
evidence_warn "browser/smoke process is visible; classify orphan vs active parent before action"
fi
if grep -Eiq 'gitea|actions|runner|npm|pnpm|pytest|pip-audit' "$cpu_tmp"; then
ok "active CI/build/test load is visible"
fi
rm -f "$cpu_tmp"
fi
section "110 runner fail-closed guard"
runner_tmp="$(mktemp -t post-start-runner.XXXXXX)"
if ssh_read "wooo@192.168.0.110" '
for u in awoooi-cd-lane.service awoooi-cd-lane-drain.service awoooi-direct-runner-open.service awoooi-direct-runner.service gitea-act-runner-host.service gitea-act-runner-awoooi-controlled.service gitea-awoooi-controlled-runner.service gitea-act-runner-awoooi-open.service; do
load=$(systemctl show "$u" -p LoadState --value 2>/dev/null || true)
unitfile=$(systemctl show "$u" -p UnitFileState --value 2>/dev/null || true)
active=$(systemctl show "$u" -p ActiveState --value 2>/dev/null || true)
mainpid=$(systemctl show "$u" -p MainPID --value 2>/dev/null || true)
unit_ok=0
unit_stub=0
if [ "$load" = "masked" ] && [ "$unitfile" = "masked" ] && [ "$active" = "inactive" ] && [ "${mainpid:-0}" = "0" ]; then
unit_ok=1
elif [ "$active" = "inactive" ] && [ "${mainpid:-0}" = "0" ] \
&& systemctl cat "$u" 2>/dev/null | grep -q "ConditionPathExists=/run/awoooi-runner-migrated-or-hard-limited"; then
unit_stub=1
unit_ok=1
fi
echo "RUNNER_FAILCLOSED_UNIT $u load=$load unitfile=$unitfile active=$active mainpid=$mainpid stub=$unit_stub ok=$unit_ok"
done
enforcer_timer_active=$(systemctl is-active awoooi-runner-failclosed-enforcer.timer 2>/dev/null || true)
enforcer_timer_enabled=$(systemctl is-enabled awoooi-runner-failclosed-enforcer.timer 2>/dev/null || true)
enforcer_service_result=$(systemctl show awoooi-runner-failclosed-enforcer.service -p Result --value 2>/dev/null || true)
echo "RUNNER_FAILCLOSED_ENFORCER timer_active=$enforcer_timer_active timer_enabled=$enforcer_timer_enabled service_result=$enforcer_service_result"
authority_timer_active=$(systemctl is-active awoooi-runner-failclosed-authority.timer 2>/dev/null || true)
authority_timer_enabled=$(systemctl is-enabled awoooi-runner-failclosed-authority.timer 2>/dev/null || true)
authority_service_result=$(systemctl show awoooi-runner-failclosed-authority.service -p Result --value 2>/dev/null || true)
echo "RUNNER_FAILCLOSED_AUTHORITY timer_active=$authority_timer_active timer_enabled=$authority_timer_enabled service_result=$authority_service_result"
cd_lane_process_count=$(pgrep -f "^/home/wooo/awoooi-cd-lane/awoooi_cd_lane|^/home/wooo/awoooi-cd-lane-drain/awoooi_cd_lane_controlled" 2>/dev/null | wc -l | tr -d " ")
echo "CD_LANE_PROCESS_COUNT $cd_lane_process_count"
cd_lane_root_restore_left=unknown
if sudo -n true >/dev/null 2>&1; then
cd_lane_root_restore_left=$(sudo -n find /root -maxdepth 1 -type d \( -name "awoooi-runner-restore-sources-disabled*" -o -name "awoooi-cd-lane-disabled*" -o -name "awoooi-cd-lane-drain-disabled*" \) -print 2>/dev/null | wc -l | tr -d " ")
fi
echo "CD_LANE_ROOT_RESTORE_SOURCES left=$cd_lane_root_restore_left"
sentinel_left=0
for s in /run/awoooi-runner-host-enabled /run/awoooi-start-controlled-cd-lane /run/awoooi-start-controlled-cd-lane-drain /run/awoooi-start-cd-lane-allowed /run/awoooi-cd-lane-drain-ok /run/awoooi-cd-lane-ok /run/awoooi-cd-lane-enabled /run/awoooi-cd-lane-controlled-open; do
[ -e "$s" ] && sentinel_left=$((sentinel_left + 1))
done
echo "RUNNER_SENTINELS_LEFT $sentinel_left"
active_job_containers=$(docker ps --format "{{.Names}}" 2>/dev/null | grep -Ec "^(GITEA-ACTIONS-|awoooi-cd-)" || true)
echo "ACTIVE_JOB_CONTAINERS $active_job_containers"
cd_lane_guard_ok=0
if [ "$enforcer_timer_active" = "active" ] \
&& [ "$enforcer_timer_enabled" = "enabled" ] \
&& [ "$enforcer_service_result" = "success" ] \
&& [ "$authority_timer_active" = "active" ] \
&& [ "$authority_timer_enabled" = "enabled" ] \
&& [ "$authority_service_result" = "success" ] \
&& [ "$cd_lane_process_count" = "0" ] \
&& [ "$cd_lane_root_restore_left" = "0" ] \
&& [ "$sentinel_left" = "0" ] \
&& [ "$active_job_containers" = "0" ]; then
cd_lane_guard_ok=1
fi
echo "CD_LANE_GUARDRAILS_OK $cd_lane_guard_ok"
direct_runner_count=$(pgrep -f "^/home/wooo/act-runner/act_runner|^/home/wooo/act-runner-controlled/act_runner|^/home/wooo/awoooi-controlled-runner/awoooi_controlled_runner" 2>/dev/null | wc -l | tr -d " ")
echo "RUNNER_DIRECT_PROCESS_COUNT $direct_runner_count"
for p in /home/wooo/awoooi-cd-lane/awoooi_cd_lane /home/wooo/awoooi-cd-lane-drain/awoooi_cd_lane_controlled /home/wooo/act-runner/act_runner /home/wooo/act-runner/act_runner.real-20260628-runner-pressure-guard /home/wooo/act-runner-controlled/act_runner /home/wooo/awoooi-controlled-runner/awoooi_controlled_runner; do
kind=$(file -b "$p" 2>/dev/null || echo missing)
echo "RUNNER_FAILCLOSED_BINARY $p kind=$kind"
echo "$kind" | grep -qi "ELF" && echo "RUNNER_FAILCLOSED_BINARY_ELF $p"
done
HOST_WEB_BUILD_PRESSURE_ATTEMPTS=1 HOST_WEB_BUILD_PRESSURE_SLEEP_SECONDS=0 /usr/local/bin/awoooi-wait-host-web-build-pressure.sh
echo "RUNNER_PRESSURE_GATE_RC $?"
' >"$runner_tmp" 2>&1; then
ok "110 controlled runner readback succeeded"
else
blocked "110 controlled runner readback failed"
fi
cat "$runner_tmp"
if awk '$1 == "RUNNER_FAILCLOSED_UNIT" && $NF != "ok=1" {bad=1} END {exit bad}' "$runner_tmp"; then
ok "110 runner/CD lane units are fail-closed"
else
blocked "110 runner/CD lane units are not fail-closed"
fi
grep -q "RUNNER_FAILCLOSED_ENFORCER timer_active=active timer_enabled=enabled service_result=success" "$runner_tmp" && ok "110 fail-closed enforcer timer active and successful" || blocked "110 fail-closed enforcer timer not healthy"
grep -q "RUNNER_FAILCLOSED_AUTHORITY timer_active=active timer_enabled=enabled service_result=success" "$runner_tmp" && ok "110 fail-closed authority timer active and successful" || blocked "110 fail-closed authority timer not healthy"
grep -q "CD_LANE_GUARDRAILS_OK 1" "$runner_tmp" && ok "110 cd-lane/drain lane are fail-closed with enforcer" || blocked "110 cd-lane/drain lane fail-closed guardrails incomplete"
grep -q "RUNNER_DIRECT_PROCESS_COUNT 0" "$runner_tmp" && ok "110 legacy direct runner process count is zero" || blocked "110 legacy direct runner process detected"
grep -q "ACTIVE_JOB_CONTAINERS 0" "$runner_tmp" && ok "110 Gitea/CD job container count is zero" || blocked "110 Gitea/CD job container still active"
grep -q "RUNNER_FAILCLOSED_BINARY_ELF" "$runner_tmp" && blocked "110 runner fail-closed binary path restored to ELF" || ok "110 runner binary paths are fail-closed stubs or missing"
grep -q "RUNNER_PRESSURE_GATE_RC 0" "$runner_tmp" && ok "110 host pressure gate returned 0" || blocked "110 host pressure gate is blocking"
rm -f "$runner_tmp"
section "總結"
printf 'POST_START_QUICK_CHECK PASS=%s WARN=%s BLOCKED=%s\n' "$PASS_COUNT" "$WARN_COUNT" "$BLOCKED_COUNT"
printf 'POST_START_QUICK_CHECK_WARNINGS SERVICE=%s BOUNDARY=%s EVIDENCE=%s\n' "$SERVICE_WARN_COUNT" "$BOUNDARY_WARN_COUNT" "$EVIDENCE_WARN_COUNT"
if [[ "$BLOCKED_COUNT" -gt 0 ]]; then
printf 'RESULT=BLOCKED\n'
exit 2
fi
if [[ "$SERVICE_WARN_COUNT" -gt 0 ]]; then
printf 'RESULT=DEGRADED\n'
exit 1
fi
if [[ "$STOCK_EOD_WINDOW_PENDING" == "1" ]]; then
printf 'RESULT=PRODUCT_DATA_PENDING_EOD_WINDOW\n'
exit 0
fi
if [[ "$BOUNDARY_WARN_COUNT" -gt 0 ]]; then
printf 'RESULT=FULL_STACK_GREEN_DR_ESCROW_BLOCKED\n'
exit 0
fi
if [[ "$EVIDENCE_WARN_COUNT" -gt 0 ]]; then
printf 'RESULT=GREEN_WITH_EVIDENCE_WARNINGS\n'
exit 0
fi
printf 'RESULT=GREEN\n'
exit 0