fix(docs): restore the runbook — my regex in #268 deleted 2203 lines #269

Sammanfogat

supernaut sammanfogade 1 incheckning från fix/restore-runbook in i main

2026-07-30 21:40:59 +00:00

supernaut kommenterad

2026-07-30 21:35:30 +00:00

Ägare

#268 deleted almost the entire runbook and it is live on main. It was meant to make two small
edits to docs/runbook.md. Its diffstat was +10 / −2203, leaving 60 of 2253 lines.

Cause

A "tolerant" regex, written to survive prettier reflowing a wrapped command:

re.compile(r'^3\. `kanidm group set-entry-manager .*?\n.*?--name idm_admin`\n4\. Then apply.*$',
           re.M | re.S)

With re.S the trailing .*$ matches across newlines, and $ under re.M matches at any line end —
so the greedy .* ran to the end of the document and backtracked to the last line ending, not the
nearest. Everything from 4. Then apply to EOF fell inside m.end() and was replaced.

The uncomfortable part: the previous, non-regex version of this same edit failed on an exact-string
mismatch (prettier had stripped a continuation indent). That failure was loud and harmless. Reaching for
a regex to make it "robust" converted a visible failure into a silent destructive one — and the
commit's own diffstat said -2203 in plain sight.

The fix

Restores docs/runbook.md from 30ca733~1 and re-applies only the intended edits using
line-indexed operations with asserted anchors and no pattern spanning newlines:

the entry_managed_by row in the not-declaratively-managed table flips to "Yes, since
2026-07-30" and points at the carried patch (the column header becomes "Why / how", since one row is
now a yes)
the rebuild sequence's manual set-entry-manager step becomes "then apply", with the command kept
below as documented break-glass

Diff against the pre-damage file is now +31 / −7 — the four table lines (prettier realigns the block
because the new row is wider) and the three lines of the old steps. Nothing else. markdownlint clean.

Also: upstream issue #32, which is what this turn was for

kanidm-provision builds preexisting_entity_names once and never refreshes it
(src/main.rs:393-403), then passes that snapshot to all three sync phases. So deleting an entity and
creating a same-named entity of a different type in one run fails the create with
… name is already in use by another entity! even though the delete happened. (The issue text doesn't
name this mechanism — verified from source.)

bitborg is not exposed. Checked by rendering the state template:

present is hardcoded true in both emitting sites — no code path yields present: false, so the
delete branch is unreachable
systems.oauth2 renders {} — no cross-type create to collide with
--no-auto-remove stops the orphan phase deleting anything

A "rename" here adds the new group and leaves the old one as an undeclared orphan; nothing is deleted.
So the earlier framing of #32 as "a live risk while renaming tier groups" was too pessimistic.

It goes live only if a retire a tier group procedure starts using present: false, so the runbook now
records: retire and re-create across two separate applies, never one.

Documented rather than patched — a second carried patch is real maintenance on every future ref bump,
guarding a path the template cannot currently express. Offered upstream alongside the entryManagedBy
patch. Full analysis appended to
bitborg-internal/copilot/2026-07-30-kanidm-provision-upstream-review.md.

**#268 deleted almost the entire runbook and it is live on `main`.** It was meant to make two small edits to `docs/runbook.md`. Its diffstat was **+10 / −2203**, leaving **60 of 2253 lines**. ## Cause A "tolerant" regex, written to survive prettier reflowing a wrapped command: ```python re.compile(r'^3\. `kanidm group set-entry-manager .*?\n.*?--name idm_admin`\n4\. Then apply.*$', re.M | re.S) ``` With `re.S` the trailing `.*$` matches across newlines, and `$` under `re.M` matches at *any* line end — so the greedy `.*` ran to the end of the document and backtracked to the **last** line ending, not the nearest. Everything from `4. Then apply` to EOF fell inside `m.end()` and was replaced. The uncomfortable part: the **previous, non-regex version of this same edit failed** on an exact-string mismatch (prettier had stripped a continuation indent). That failure was loud and harmless. Reaching for a regex to make it "robust" converted a visible failure into a silent destructive one — and the commit's own diffstat said `-2203` in plain sight. ## The fix Restores `docs/runbook.md` from `30ca733~1` and re-applies **only** the intended edits using line-indexed operations with asserted anchors and no pattern spanning newlines: - the `entry_managed_by` row in the not-declaratively-managed table flips to **"Yes, since 2026-07-30"** and points at the carried patch (the column header becomes "Why / how", since one row is now a yes) - the rebuild sequence's manual `set-entry-manager` step becomes "then apply", with the command kept below as documented **break-glass** Diff against the pre-damage file is now **+31 / −7** — the four table lines (prettier realigns the block because the new row is wider) and the three lines of the old steps. Nothing else. `markdownlint` clean. ## Also: upstream issue #32, which is what this turn was for kanidm-provision builds `preexisting_entity_names` **once** and never refreshes it (`src/main.rs:393-403`), then passes that snapshot to all three sync phases. So deleting an entity and creating a **same-named entity of a different type** in one run fails the create with `… name is already in use by another entity!` even though the delete happened. (The issue text doesn't name this mechanism — verified from source.) **bitborg is not exposed.** Checked by rendering the state template: - `present` is hardcoded `true` in both emitting sites — no code path yields `present: false`, so the delete branch is unreachable - `systems.oauth2` renders `{}` — no cross-type create to collide with - `--no-auto-remove` stops the orphan phase deleting anything A "rename" here adds the new group and leaves the old one as an undeclared orphan; nothing is deleted. So the earlier framing of #32 as "a live risk while renaming tier groups" was too pessimistic. It goes live only if a *retire a tier group* procedure starts using `present: false`, so the runbook now records: **retire and re-create across two separate applies, never one.** Documented rather than patched — a second carried patch is real maintenance on every future ref bump, guarding a path the template cannot currently express. Offered upstream alongside the `entryManagedBy` patch. Full analysis appended to `bitborg-internal/copilot/2026-07-30-kanidm-provision-upstream-review.md`.

supernaut lade till 1 incheckning

2026-07-30 21:35:30 +00:00

fix(docs): restore the runbook — my regex in #268 deleted 2203 lines

ci / ci (pull_request) Successful in 17s

Detaljer

2bf8eec59f

#268 was supposed to make two small edits to docs/runbook.md. It deleted almost the
whole file: 2203 lines removed, 10 added, leaving 60 of 2253 lines. Merged and live
on main until now.

Cause: a "tolerant" regex written to survive prettier's reflowing of a wrapped
command —

  re.compile(r'^3\. `kanidm group set-entry-manager .*?\n.*?--name idm_admin`\n4\. Then apply.*$',
             re.M | re.S)

With re.S the trailing `.*$` matches across newlines, and `$` under re.M matches at
any line end — so the greedy `.*` ran to the end of the document and backtracked to
the LAST line ending, not the nearest. Everything from "4. Then apply" to EOF was
inside m.end() and got replaced.

The earlier non-regex version of this edit failed on an exact-string mismatch, which
was loud and harmless. Reaching for a regex to make it "robust" converted a visible
failure into a silent destructive one — and the commit's own diffstat (+10 -2203)
said so plainly.

This restores docs/runbook.md from 30ca733~1 and re-applies only the intended edits,
using line-indexed operations with asserted anchors and no pattern spanning newlines:

- the entry_managed_by row in the not-declaratively-managed table flips to "Yes,
  since 2026-07-30" and points at the carried patch ("Why not" becomes "Why / how",
  since one row is now a yes)
- the rebuild sequence's manual set-entry-manager step becomes "then apply", with the
  command retained below as documented break-glass

Diff against the pre-damage file is now +31/-7: the four table lines (prettier
realigns the block because the new row is wider) and the three lines of the old
steps. Nothing else.

Also adds what this turn was actually for — upstream issue #32. kanidm-provision
builds preexisting_entity_names once and never refreshes it (src/main.rs:393-403), so
deleting an entity and creating a same-named entity of a DIFFERENT TYPE in one run
fails the create. gitborg is NOT exposed: `present` is hardcoded true everywhere the
template emits it, systems.oauth2 renders empty, and --no-auto-remove stops orphan
deletion — a "rename" here just leaves the old group as an undeclared orphan. It goes
live only if a retire-a-group procedure starts using present:false, so the runbook now
says to retire and re-create across two separate applies. Documented rather than
patched: a second carried patch is maintenance on every ref bump for a path the
template cannot express. Offered upstream alongside the entryManagedBy patch.

supernaut lade till etiketten

type

docs

2026-07-30 21:35:31 +00:00

supernaut sammanfogade incheckning 4ba4c7734d till main

2026-07-30 21:40:59 +00:00

supernaut tog bort grenen fix/restore-runbook

2026-07-30 21:41:00 +00:00

supernaut refererade denna ändringsförfrågan från en incheckning

2026-07-30 21:41:00 +00:00

fix(docs): restore the runbook — my regex in #268 deleted 2203 lines (#269)

supernaut refererade denna ändringsförfrågan från en incheckning