Komodo native image-check inventory correction — 2026-10-30

Failure and evidence

Update 6ae46aa09a29a6ea1a94c948 failed in the check-image-updates Action: 13 of 14 stacks accounted, 32 services, Rexit reporting invalid_or_incomplete_native_response. No deployment was requested.

Read-only API inspection found Rexit's latest inventory includes exporter and studio, while deployed inventory and ListStackServices contain only studio. The Compose exporter is profile-gated. Its absence from deployed inventory alone cannot establish effective profile activation; an ordinary pending source addition would have the same flattened metadata shape.

Upstream Komodo v2.3.4 selects deployed inventory when available, otherwise latest inventory, for native check results. The Action instead required their union. See native service extraction and native checking.

Source correction

Native results must exactly cover the selected native service inventory. Safe native image representations are preserved; Docker status may normalize an untagged reference or return an image ID rather than the source tag. Missing deployed services still fail. Source-only services receive an explicit not_deployed_not_checked record and null update status, not a fabricated successful check. They count toward reported service accounting, not checked coverage. Null/absent deployed inventory falls back to latest; empty or malformed deployed inventory fails closed. Duplicate/unsafe inventory entries and before/after inventory changes fail, while harmless inventory ordering changes are accepted.

The fixed target list, no-argument policy, bounded requests, redacted errors, skip_auto_update=true and no-pull/no-deployment boundaries remain unchanged. The development renderer embeds the reviewed Action source in ResourceSync TOML.

Validation and rollout boundary

Offline Node VM regression tests exercise the real Action body, including realistic Rexit inventories, pending ordinary services, missing native services, fallback selection, native image normalization and concurrent inventory changes. Exact validation commands and results are recorded in the task PR.

Direct check-only CheckStackForUpdate via the existing deployment API identity was refused for lack of Stack Execute permission. No grants were widened and no replacement credentials were created. Browser access requires owner SSO.

First scoped qualification after owner approval

PR #551 merged as 1f387842 after all 27 current-head checks passed. The first Python CI attempt failed only the unchanged Stirling test's file-access-time comparison; one failed-job retry passed. Existing authenticated browser access applied only the Action body, verified against merged source SHA-256 d10926a7458bd0e49ebd5dc4dab82f4cd382c49074977bb251153cf27b2d2797. Other Action configuration was unchanged; no broad Sync or deployment was used.

Exact Update 6ae52b4f9a29a6ea1a94ef87 completed unsuccessfully: Rexit now accounts for studio and explicitly reports exporter as not checked, but the incident adapter failed the newly strict source-image validation. Live metadata has empty latest-image fields for its three local-build services, with valid named deployed images and safe native status. Its containers are stopped; this work does not start them. Komodo's minimal source parser can omit build-only or YAML merge-derived image references, unlike resolved deployment metadata.

The follow-up permits exactly the empty source-image string only when the same service has a valid deployed image. Empty deployed/fallback images, source-only empty images, unsafe nonempty strings and inventory changes still fail. Native result image validation and explicit unsupported-local-build reporting remain. This is a source correction pending its own CI/merge and scoped requalification, not successful fleet acceptance.

Remaining acceptance

The initial source-only checkpoint required owner review/merge, reviewed synchronization of this Action alone, and a fresh non-deploying Action run must precede production acceptance. Inspect any ResourceSync preview before applying: do not use a broad Sync if it includes unrelated pending changes. Acceptance requires 14 accounted stacks, zero failures, explicit Rexit exporter non-check reporting and no workload deployment. Preserve the original failed Update as historical evidence. No application image, pull policy, exporter activation, database, secret, access control or workload runtime was changed. Rollback is the prior reviewed Action body; it restores the reporting failure, not application state.