CLI deployment recovery hardening

[mkultraWasHere]

The deployment workflow now fails earlier and resumes more precisely after interrupted runs.

Added

• dreadgoad up --from provision --from-playbook <playbook> resumes provisioning at the playbook that failed.
• Terragrunt state-lock failures include a safely quoted force-unlock recovery command.

Changed

• CLI documentation now covers precise provisioning resumes and explicit zero-retry behavior.

Breaking

• --max-retries 0 now runs once without retrying; omit the flag to retain configured retry defaults.
• Variant generation now requires an absent target, and provisioning rejects unmarked targets; move or remove an existing target before regenerating.
• Malformed or orphaned lab-config overlays now stop infrastructure materialization; fix or remove the overlay before retrying.

Fixed

• dreadgoad up resume hints preserve the failed playbook suffix, host limit, infra selectors, and explicit retry overrides.
• Variant generation no longer certifies targets after file-write or validation failures, or mixes stale files from an earlier randomized run.
• Lab-config materialization creates missing destination directories and reports actionable errors.

Notes

• AWS-only preflight and reconnect behavior, inventory permissions, Proxmox secret transport, and full cancellation threading remain follow-up audit items.

[Copilot]

Pull request overview

Hardens CLI deployment recovery and failure handling.

Changes:

• Adds playbook-specific provisioning resume hints and explicit zero-retry semantics.
• Validates variant completion and lab-config materialization.
• Adds safely quoted Terragrunt state-lock recovery guidance.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
docs/mkdocs/docs/provisioning.md	Documents zero retries.
docs/mkdocs/docs/cli-reference.md	Documents resume and retry flags.
docs/cli.md	Documents variant markers.
cli/internal/variant/generator.go	Adds completion certification and write failures.
cli/internal/variant/generator_test.go	Tests marker behavior.
cli/internal/terragrunt/runner.go	Adds lock recovery hints.
cli/internal/terragrunt/runner_test.go	Tests lock parsing and quoting.
cli/internal/config/config.go	Classifies missing and orphaned configs.
cli/internal/config/config_test.go	Tests missing-config classification.
cli/internal/ansible/retry.go	Distinguishes explicit retry overrides.
cli/internal/ansible/retry_test.go	Tests zero-retry execution.
cli/cmd/up.go	Adds playbook-level resume support.
cli/cmd/up_test.go	Tests resume and flag forwarding.
cli/cmd/provision.go	Adds structured failures and marker checks.
cli/cmd/provision_test.go	Tests retries, failures, and variants.
cli/cmd/lab_reset.go	Applies new retry semantics.
cli/cmd/infra_cmd.go	Hardens config materialization.
cli/cmd/infra_cmd_test.go	Tests materialization failures.
cli/cmd/extension.go	Applies retry overrides to extensions.
ad/GOAD-variant-1/.dreadgoad-variant-complete	Certifies the existing variant.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

cli/internal/variant/generator.go:280

• Removing only the marker does not make an existing target safe to certify. variant generate can run against an existing directory, and each run creates new random mappings; when a transformed filename changes, the old generated file is never removed by copyAndTransform. The run can then validate the new files and write a completion marker over a directory containing stale outputs from the previous variant. Generate into a fresh staging directory and replace the target only after validation, or reject/clean an existing target before removing its marker.

	markerPath := filepath.Join(g.TargetPath, CompletionMarkerName)
	if err := os.Remove(markerPath); err != nil && !errors.Is(err, os.ErrNotExist) {
		return fmt.Errorf("remove stale completion marker: %w", err)
	}

[mkultraWasHere]

Fixed in 8e56060 — variant generation now exclusively creates a fresh target and rejects any existing target without modifying it, preventing stale randomized outputs from being mixed and recertified.