From 882d46c6db3e6c2603540708dee390adf08dc011 Mon Sep 17 00:00:00 2001 From: lex00 <121451605+lex00@users.noreply.github.com> Date: Sat, 12 Sep 2026 02:09:37 -0600 Subject: [PATCH 1/2] break-glass sweep: branch from the base, and never swallow a push failure The sweep reused whatever local branch of the same name it found. A sweep branch holds one edit against what main declares, so a leftover from an earlier run makes a pull request whose diff is the inverse of its title, where the base has moved on and the stale branch reads as adding back the very grant the sweep means to retire. It succeeds and it lies, which is worse than the same bug in reconcile, where it at least failed. It now starts from the base every time, forces the push under the desk prefix guard for the reason reconcile does, and says so when a push fails instead of sending the next command off to fail for an unrelated reason. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013JoNB9iUGjsiwRAJvyZPrt --- access/scripts/break-glass | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/access/scripts/break-glass b/access/scripts/break-glass index dd44f6c..a4b16c5 100755 --- a/access/scripts/break-glass +++ b/access/scripts/break-glass @@ -300,7 +300,18 @@ EOT if [ "$do_open" = true ] && [ "$gh_ready" = true ]; then ( cd "$repo_root" || exit 1 - git switch -c "$branch" >/dev/null 2>&1 || git switch "$branch" >/dev/null 2>&1 + # Start the branch from the base every time. A sweep branch + # holds one edit against what main declares, and reusing a + # local branch left over from a previous sweep makes a pull + # request whose diff is the inverse of its title: the base has + # moved on and the stale branch reads as adding back the very + # grant this is meant to retire. It succeeds and it lies, which + # is worse than failing. + git fetch -q origin main >/dev/null 2>&1 || true + git branch -q -D "$branch" >/dev/null 2>&1 || true + git switch -q -c "$branch" FETCH_HEAD >/dev/null 2>&1 || + git switch -q -c "$branch" origin/main >/dev/null 2>&1 || + git switch -q -c "$branch" >/dev/null 2>&1 local id for id in $expired_ids; do if blocks | awk -F'\t' -v id="$id" -v f="$f" '$1 == id && $2 == f { found = 1 } END { exit !found }'; then @@ -311,7 +322,15 @@ EOT git commit -q -m "break-glass: sweep expired grants from $principal" \ -m "The cloud already ended these at their expiry. This removes the artifact." \ -m "" - git push -q -u origin "$branch" + # Forced, guarded by the prefix, for the same reason reconcile + # forces its own: the branch is this file's one current + # proposal rather than a history. + if ! push_err="$(git push -u --force origin "$branch" 2>&1)"; then + say " FAIL could not push $branch" + printf ' %s\n' "$push_err" | head -3 + git switch - >/dev/null 2>&1 + exit 1 + fi gh pr create --title "break-glass: sweep expired grants from $principal" \ --body "The cloud already ended these grants at their expiry (layer 1). This PR removes the artifacts (layer 2), and the drift watch stops reporting them once it merges (layer 3). From 8401be40b7e7b74893781bb61007412d3fc89fed Mon Sep 17 00:00:00 2001 From: lex00 <121451605+lex00@users.noreply.github.com> Date: Sat, 12 Sep 2026 02:09:56 -0600 Subject: [PATCH 2/2] break-glass sweep: drop a stale branch rather than check one out --- access/scripts/break-glass | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/access/scripts/break-glass b/access/scripts/break-glass index a4b16c5..3ea3c4e 100755 --- a/access/scripts/break-glass +++ b/access/scripts/break-glass @@ -300,18 +300,19 @@ EOT if [ "$do_open" = true ] && [ "$gh_ready" = true ]; then ( cd "$repo_root" || exit 1 - # Start the branch from the base every time. A sweep branch - # holds one edit against what main declares, and reusing a - # local branch left over from a previous sweep makes a pull - # request whose diff is the inverse of its title: the base has - # moved on and the stale branch reads as adding back the very - # grant this is meant to retire. It succeeds and it lies, which - # is worse than failing. - git fetch -q origin main >/dev/null 2>&1 || true + # Drop any branch of this name left over from an earlier sweep, + # then branch from where we are. Reusing a stale one makes a + # pull request whose diff is the inverse of its title, because + # the base has moved on and the old branch reads as adding back + # the very grant this is retiring. It succeeds and it lies. + # + # Deleted rather than checked out from origin/main on purpose. + # A switch with a start point rewrites every file in the tree, + # including this script while bash is still reading it, and the + # edit below then runs against a file nobody chose. git branch -q -D "$branch" >/dev/null 2>&1 || true - git switch -q -c "$branch" FETCH_HEAD >/dev/null 2>&1 || - git switch -q -c "$branch" origin/main >/dev/null 2>&1 || - git switch -q -c "$branch" >/dev/null 2>&1 + git switch -q -c "$branch" >/dev/null 2>&1 || + git switch -q "$branch" >/dev/null 2>&1 local id for id in $expired_ids; do if blocks | awk -F'\t' -v id="$id" -v f="$f" '$1 == id && $2 == f { found = 1 } END { exit !found }'; then