2026-09-16 Komodo procedure webhooks

TL;DR

Komodo GitHub listeners still return HTTP 200 after HMAC only. deploy-infra and ResourceSync do run as the git webhook user. The 2026-09-05 deploy-oneuptime “queue” miss was a failed pre_deploy: Komodo periphery has no python3. Mutation stays off.

Phase status

Item	Status
Broker mutation	Off
Verifier URLs	Owner gate
Komodo webhook queue	Not a queue bug; executions are async
deploy-oneuptime pre_deploy	Fix on feature/komodo-oneuptime-predeploy-python

What shipped

• Diagnosis against live Mongo Updates and komodo-core logs.
• services/oneuptime/scripts/komodo-pre-deploy.sh plus resources.toml pre_deploy change.

Known gaps / drift

• Desired-state plan still waits on the provisioner API key.
• Broker deny-all until verifier origins or an explicit keep-deny decision.

What remains

1. Owner: merge the pre_deploy PR, then verifier URLs or keep deny-all.
2. Owner: only then BROKER_ENABLE_MUTATION=true for the 24h canary.
3. Agent: after merge, confirm deploy-oneuptime pre_deploy can run the gate from periphery (same-major PASS; do not start a major upgrade).

sequenceDiagram
  participant Relay
  participant Core as komodo-core
  participant Periphery
  participant HostPy as host python3
  Relay->>Core: POST listener HMAC
  Core-->>Relay: HTTP 200 auth only
  Core->>Core: RunProcedure git webhook user
  Core->>Periphery: pre_deploy
  Periphery->>HostPy: nsenter pid 1
  HostPy-->>Periphery: major-upgrade-gate