deploy.sh <host> --service gpu-exporter (and cadvisor) dies at the client with Service 'X' is not deployed on <target> — so the GPU stats that merged yesterday can never get deployed through the sanctioned path.
Root cause
The door has two gates: deploy.sh's valid_service (client) and deploy-remote.sh's service_is_allowed (remote). New services were added ONLY to the remote gate — cadvisor (both hosts, 2026-10-20 PR), gpu-exporter (both hosts, #61), dankserver:prowlarr (planner can emit it for dankserver). The client gate rejected first, every time; only a fleet-wide drain could sneak the handler through.
Fix
Client gate gains the 4 missing pairs + dankserver:prowlarr; lists now agree at 53 entries.
New deployment_flow test extracts both functions' lists and diffs them per target — drift is now a red test, not a broken deploy. dankclaw:searxng-network stays the one sanctioned client-only exception (documented inline).
Evidence
./tests/run.sh — 489/489 pass (incl. the new drift test, which is red against the pre-fix deploy.sh).
## Symptom
`deploy.sh <host> --service gpu-exporter` (and cadvisor) dies at the client with `Service 'X' is not deployed on <target>` — so the GPU stats that merged yesterday can never get deployed through the sanctioned path.
## Root cause
The door has two gates: `deploy.sh`'s `valid_service` (client) and `deploy-remote.sh`'s `service_is_allowed` (remote). New services were added ONLY to the remote gate — `cadvisor` (both hosts, 2026-10-20 PR), `gpu-exporter` (both hosts, #61), `dankserver:prowlarr` (planner can emit it for dankserver). The client gate rejected first, every time; only a fleet-wide drain could sneak the handler through.
## Fix
- Client gate gains the 4 missing pairs + `dankserver:prowlarr`; lists now agree at 53 entries.
- New `deployment_flow` test extracts both functions' lists and diffs them per target — drift is now a red test, not a broken deploy. `dankclaw:searxng-network` stays the one sanctioned client-only exception (documented inline).
## Evidence
- `./tests/run.sh` — 489/489 pass (incl. the new drift test, which is red against the pre-fix `deploy.sh`).
---
cwd: /home/blank/.omp/wt/wt-20261020-125416-6d1fc1f · session: 01a15b5c-ede9-7063-b05b-1ef94188b7c3
(build worktree: /tmp/wt-allowfix)
deploy.sh's valid_service and deploy-remote.sh's service_is_allowed are
two gates for the same door, and they drifted: the remote gate gained
cadvisor (2026-10-20) and gpu-exporter (2026-10-21) while the client gate
never did, so `--service cadvisor|gpu-exporter` died with "is not deployed
on <target>" at the client — the first-ever deploy of a new service is
exactly the case that needs the client gate to know it. dankserver:prowlarr
(planner can emit it for dankserver) was remote-only too.
Adds the four missing pairs to the client gate and a deployment_flow
contract test that diffs the two extracted lists per target — the test the
cadvisor PR should have carried. searxng-network stays the one sanctioned
client-only exception (network unit, no remote handler), documented inline.
dank
merged commit b62a05837f into main2026-10-21 00:15:45 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Symptom
deploy.sh <host> --service gpu-exporter(and cadvisor) dies at the client withService 'X' is not deployed on <target>— so the GPU stats that merged yesterday can never get deployed through the sanctioned path.Root cause
The door has two gates:
deploy.sh'svalid_service(client) anddeploy-remote.sh'sservice_is_allowed(remote). New services were added ONLY to the remote gate —cadvisor(both hosts, 2026-10-20 PR),gpu-exporter(both hosts, #61),dankserver:prowlarr(planner can emit it for dankserver). The client gate rejected first, every time; only a fleet-wide drain could sneak the handler through.Fix
dankserver:prowlarr; lists now agree at 53 entries.deployment_flowtest extracts both functions' lists and diffs them per target — drift is now a red test, not a broken deploy.dankclaw:searxng-networkstays the one sanctioned client-only exception (documented inline).Evidence
./tests/run.sh— 489/489 pass (incl. the new drift test, which is red against the pre-fixdeploy.sh).cwd: /home/blank/.omp/wt/wt-20261020-125416-6d1fc1f · session: 01a15b5c-ede9-7063-b05b-1ef94188b7c3
(build worktree: /tmp/wt-allowfix)