copy_grafana_provisioning copied exactly one dashboard by name (llm-fleet.json). A board added to shared/grafana/provisioning/dashboards/ silently never reached /opt/grafana/provisioning — and no gate saw it: the deployer only reports the copy it performed, the bats seam only grepped that the copier exists, and the vault said the boards were "working".
Measured 2026-10-21: the containers board — merged, seam-tested, documented live since 2026-10-20 — had never been provisioned. Its panel fixes (PR #67) were undeployable. The other four boards existed on disk only because they were hand-copied once; host-system.json there had gone stale against the repo (differs pre-fix, proven by cmp).
The fix
Copier globs dashboards/*.json; GRAFANA_PROV_ROOT is the test seam.
New bats case executes the copier for real into a sandbox (stubbed run_privileged) and asserts every repo JSON + provider + datasource lands. Red against the old hand-listed body (proven on a patched copy), green ×3 against the glob; full suite green on this branch off origin/main.
Vault: copier law + the incident on Observability Provisioning (one owner), corrected dashboards claim on Observability, Grafana-13 verify method (no local admin; the proven surface is the e2e SSO browser path — /api/health, /api/org, /login all 404 unauthenticated on 13.2.2).
After merge: deploy.sh dankclaw --service grafana puts containers.json live and refreshes the stale host-system.json; the browser session then renders all five boards.
One trap recorded in the commit message: a mktemp -d sandbox + trap RETURN races bats' trap machinery (dir vanishes mid-function); BATS_TEST_TMPDIR is the safe idiom.
## The gap
`copy_grafana_provisioning` copied exactly one dashboard by name (`llm-fleet.json`). A board added to `shared/grafana/provisioning/dashboards/` silently never reached `/opt/grafana/provisioning` — and no gate saw it: the deployer only reports the copy it performed, the bats seam only grepped that the copier exists, and the vault said the boards were "working".
**Measured 2026-10-21:** the `containers` board — merged, seam-tested, documented live since 2026-10-20 — had **never been provisioned**. Its panel fixes (PR #67) were undeployable. The other four boards existed on disk only because they were hand-copied once; `host-system.json` there had gone stale against the repo (differs pre-fix, proven by `cmp`).
## The fix
- Copier globs `dashboards/*.json`; `GRAFANA_PROV_ROOT` is the test seam.
- New bats case **executes the copier for real** into a sandbox (stubbed `run_privileged`) and asserts every repo JSON + provider + datasource lands. Red against the old hand-listed body (proven on a patched copy), green ×3 against the glob; full suite green on this branch off `origin/main`.
- Vault: copier law + the incident on *Observability Provisioning* (one owner), corrected dashboards claim on *Observability*, Grafana-13 verify method (no local admin; the proven surface is the e2e SSO browser path — `/api/health`, `/api/org`, `/login` all 404 unauthenticated on 13.2.2).
After merge: `deploy.sh dankclaw --service grafana` puts `containers.json` live and refreshes the stale `host-system.json`; the browser session then renders all five boards.
One trap recorded in the commit message: a `mktemp -d` sandbox + `trap RETURN` races bats' trap machinery (dir vanishes mid-function); `BATS_TEST_TMPDIR` is the safe idiom.
---
cwd: /home/blank/.omp/wt/wt-grafana-copier · session: wt-20261020-125416-6d1fc1f
copy_grafana_provisioning named llm-fleet.json alone, so a new board in
shared/grafana/provisioning/dashboards/ silently never reached
/opt/grafana/provisioning. Measured 2026-10-21: the containers board was
merged, seam-tested, and documented as working since 2026-10-20, yet was
NEVER provisioned — its panel fixes were undeployable; the other four
boards existed on disk only because someone hand-copied them once (and
host-system.json there had gone stale against the repo). The copier now
globs the directory, and GRAFANA_PROV_ROOT lets the new bats case run
the copier for real into a sandbox (red against the old hand-listed
body, green against the glob). Vault: the copier law + the containers
incident on Observability Provisioning, the corrected dashboards claim
on Observability.
Note: a mktemp sandbox + trap RETURN races bats' trap machinery (the
dir vanishes mid-function); BATS_TEST_TMPDIR is the safe idiom.
dank
merged commit 425994515a into main2026-10-21 09:49:15 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The gap
copy_grafana_provisioningcopied exactly one dashboard by name (llm-fleet.json). A board added toshared/grafana/provisioning/dashboards/silently never reached/opt/grafana/provisioning— and no gate saw it: the deployer only reports the copy it performed, the bats seam only grepped that the copier exists, and the vault said the boards were "working".Measured 2026-10-21: the
containersboard — merged, seam-tested, documented live since 2026-10-20 — had never been provisioned. Its panel fixes (PR #67) were undeployable. The other four boards existed on disk only because they were hand-copied once;host-system.jsonthere had gone stale against the repo (differs pre-fix, proven bycmp).The fix
dashboards/*.json;GRAFANA_PROV_ROOTis the test seam.run_privileged) and asserts every repo JSON + provider + datasource lands. Red against the old hand-listed body (proven on a patched copy), green ×3 against the glob; full suite green on this branch offorigin/main./api/health,/api/org,/loginall 404 unauthenticated on 13.2.2).After merge:
deploy.sh dankclaw --service grafanaputscontainers.jsonlive and refreshes the stalehost-system.json; the browser session then renders all five boards.One trap recorded in the commit message: a
mktemp -dsandbox +trap RETURNraces bats' trap machinery (dir vanishes mid-function);BATS_TEST_TMPDIRis the safe idiom.cwd: /home/blank/.omp/wt/wt-grafana-copier · session: wt-20261020-125416-6d1fc1f