fix(installer): honor TRACEBLOC_CLIENT_ADOPTED — reconcile a connected client in place (RFC-0001 §7.2 / #838)

[saadqbal]

Closes#297. Draft — pending the same dev e2e as #295 (the adopt-path run), and a small merge coordination with #295 (below).

Problem

Re-running the installer on an already-connected client doesn't behave per RFC-0001 §7.2. provision_client (Step 3) correctly adopts the existing client and writes TRACEBLOC_CLIENT_ADOPTED=1 + the UUID + namespace — but install-client-helm.sh has no adopt handling. Its non-interactive path needs ID and password both set; adopt issues no password, so Step 5 falls through to the manual Client ID: prompt, defaulting to the stale clientId in the old values.yaml (a numeric dashboard id on any cluster first installed during the cli#125 window) → verify_credentials rejects it → the loop seen on dev.

RFC-0001 §7.2

create is get-or-create keyed on the cluster … Owned by this account → adopt, reconcile/upgrade. No mint. … Adopt keeps the existing namespace.

A re-run on a connected client must be a silent, idempotent reconcile — no new client, no new credential, no prompt.

Fix

Step 5 adopt branch: on TRACEBLOC_CLIENT_ADOPTED=1, discover the live client release and helm upgrade it in place, reusing its stored credential (no prompt, no verify, no duplicate) and healing the stored clientId to the adopted UUID so a cli#125-era install self-corrects. Prefers --reset-then-reuse-values (Helm ≥ 3.14), falls back to --reuse-values. Falls through to the normal connect flow only when no live release exists. The "previous settings?" prompt is skipped on adopt.

Also extracted _resolve_chart_ref (shared by the fresh-install and adopt paths).

Tests

3 new bats (reconcile-in-place + clientId heal; older-Helm --reuse-values fallback; no-live-release fallback). Full install-client-helm.bats green (47).

Merge coordination with #295

Both PRs touch install-client-helm.sh (different hunks — auto-merge) and regenerate scripts/manifest.sha256 (same line — conflicts). Merge #295 first, then rebase this + bash scripts/gen-manifest.sh. No Chart.yaml bump here — ships with #295 as v1.8.4.

Refs: RFC-0001 §7.2, backend#830, #838. Fossil source: tracebloc/cli#125.

---

Note

Medium Risk
Changes installer credential and Helm upgrade behavior on re-runs; mistakes could break reconnects or leave wrong clientId, but scope is bounded to the adopt path with tests and fallback to manual connect.

Overview
Re-running the installer on an already-registered cluster now follows RFC-0001 §7.2: silent in-place reconcile instead of credential prompts and failed verification on stale values.yaml.

When TRACEBLOC_CLIENT_ADOPTED=1, Step 5 discovers the live client Helm release and runs helm upgrade with --reset-then-reuse-values (or --reuse-values on older Helm), reusing the release’s stored password. Optionally --set clientId=<adopted UUID> heals cli#125-era installs that stored a numeric dashboard id. No verify, no duplicate --install. If no release exists, it warns and falls through to the normal connect flow.

provision.sh now exportsTRACEBLOC_CLIENT_ID, TB_NAMESPACE, and the adopt marker (only clears password) so Helm can heal clientId. The “use previous settings?” prompt is skipped on adopt.

_resolve_chart_ref is shared between fresh install and adopt paths. manifest.sha256 and bats cover reconcile, UUID heal, Helm fallback, and no-release fallback.

^{Reviewed by Cursor Bugbot for commit dcbc23f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[saadqbal]

Restacked: rebased onto #295's branch and retargeted the base there, so this PR now shows only the adopt-reconcile diff (the #295 canary-restore conflict — bats + manifest — is already resolved in the stack). Regenerated manifest.sha256 against the combined install-client-helm.sh; bats green on CI.

Release path: merge #295 → develop first; GitHub auto-retargets this to develop; then merge this → cut v1.8.4 with both.

[LukasWodka]

👋 Heads-up — Code review queue is at 35 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#143 — chore(release): promote develop → staging (week of 2026-07-06) · author: @aptracebloc · no reviewer assigned
• averaging-service#145 — feat(averaging): NearestCentroid / LDA / QDA merges (Cat 1 extras, requests-proxy deployment hardcodes resources instead of reading from values #140) · author: @divyasinghds · no reviewer assigned
• averaging-service#146 — feat(averaging): extract aggregation-strategy seam (FedAvg, docs(migration-tools): tenant migration runbook for eks-1.0.x → client-1.x #74 M2 step) · author: @divyasinghds · no reviewer assigned
• averaging-service#147 — feat(perf): pytest-benchmark harness for averaging hot path (feat(client): scale requests-proxy horizontally #97 Phase 1) · author: @divyasinghds · no reviewer assigned
• averaging-service#149 — test(acceptance): does-it-learn gate + reusable harness (fix: nil-guard ingestionAuthz access for --reuse-values upgrade path #124) · author: @divyasinghds · no reviewer assigned
• backend#900 — RFC-GlobalMeta-PerRow-Storage · author: @saqlainsyed007 · no reviewer assigned
• backend#926 — chore(release): promote develop → staging (week of 2026-07-06) · author: @aptracebloc · reviewer: @saadqbal
• backend#927 — feat(validators): schema check for tabular/text/token classification (#924 G2) · author: @divyasinghds · no reviewer assigned
• backend#931 — feat(validators): generic all-category checks + validation matrix (#924 Phase 0/G12) · author: @divyasinghds · no reviewer assigned
• backend#932 — docs(rfc): RFC 0001 — layered pre-merge review pipeline (stop the Bugbot trickle) · author: @saadqbal · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[saadqbal]

Fixed in e6be65d — good catch. _reconcile_adopted_client no longer depends on TRACEBLOC_CLIENT_ID (which provision_client clears on a real adopt); it reconciles the discovered live release with --reset-then-reuse-values, reusing the stored credential. Dropped the --set clientId heal (it couldn't work with the id cleared, and fought provision's "reconcile from the existing values" design). Tests now export only TRACEBLOC_CLIENT_ADOPTED=1, matching what provision actually leaves.

[saadqbal]

Both findings fixed in dcbc23f — they were in tension, so resolved together:

• High (bail on empty id):_reconcile_adopted_client no longer requires TRACEBLOC_CLIENT_ID. provision_client now keeps + exports the adopted client id (UUID) on the adopt path (dropping only the absent password), and reconcile falls back to --reuse-values-only (no bail, no prompt) when it's absent (rebuilt host / R7).
• Medium (heal skipped): with the UUID handed through, reconcile heals the stored clientId via --set clientId=<uuid> (reused values keep the correct stored password) — so a cli#125-era numeric clientId self-corrects on re-run.

Tests: heal-with-UUID + no-id-reconcile-fallback (Step 5); provision adopt test asserts the id is kept. Retargeted to develop now that #295 is merged, so the full installer CI runs.

[saadqbal]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit dcbc23f. Configure here.}