[shipmill-romamo]

Summary

restart, rollback and health now run a component's type: command health check instead of refusing it. health_gate.yml, which all three already end on, includes deploy's own command_health_check.yml, so the check runs with the same transient unit cloudfall-health-<component>, user, working directory, EnvironmentFile=- line, RuntimeMaxSec=, attempts, relative-path resolution and no_log redaction as on deploy (S-009-2/3/7/8/9). The three "Refuse a command health check this engine does not run yet" tasks are gone.

• health reports unhealthy (exit 1) when the check exits non-zero or times out; its detail carries the role's failure line (command, exit code or timeout, attempts, the journalctl hint), never the command's output. Output schema unchanged
• None of the three writes a receipt: release_receipt.yml is reached only from the deploy's main.yml
• A failed check fails restart or rollback without restoring anything, as the spec's Behaviour says ("A rollback still does not restore anything when its gate fails") and as an http check does today
• The include applies become: true: systemd-run --uid needs root, and health.yml's play is become: false (its http and none probes don't need it). restart and rollback plays already become root, so nothing changes there
• http and none components run the same tasks as before in all three commands (S-009-12)
• No change to lifecycle.py or the rollback plan, so open Pause migrate for a release approval and let rollback run without one (S-008-13, S-008-14) #182 rebases cleanly
• The unreleased changelog.d/161-command-health-check-schema.md and changelog.d/164-command-health-gate.md drop only their note that restart, rollback and health refuse a command check, so the three fragments read consistently in one release

This is S-009's last build issue: the spec is set to status: built with a Verification line per criterion.

Plan

• Serves: G-3
• Files: engine/ansible/roles/cloudfall_deploy/tasks/health_gate.yml, restart.yml, rollback.yml, health.yml; engine/tests/test_command_health_gate.py, engine/tests/test_deploy_role.py; engine/README.md, sdk/README.md, docs/ci-deploy-guide.md; docs/specs/009-command-health-check.md; changelog.d/166-command-check-restart-rollback-health.md, and the refusal notes in changelog.d/161-command-health-check-schema.md and changelog.d/164-command-health-gate.md
• Order: the spec's Behaviour, "Restart, rollback and health": failing tests first (the role's health tasks run the command check for real and fail on a non-zero exit, health reports unhealthy, restart and rollback reach the same check, no entry point writes a receipt); then health_gate.yml includes command_health_check.yml for a command check outside check mode, and the three refusals go; then the docs, the spec's Verification and status: built
• Proof: test_s009_10_* in engine/tests/test_command_health_gate.py and engine/tests/test_deploy_role.py (S-009-10); test_s009_12_restart_rollback_and_health_keep_their_http_and_none_gates with the existing S-009-12 tests; specs.py coverage --spec 009 lists every criterion

Test notes

• New test_s009_10_* tests run the role's health and health_gate task files for real under ansible-playbook on the controller with the existing systemd-run stand-in (which, unlike the real one, passes output on, so a leaked marker would show): pass, exit 3 over 2 attempts, timeout; the argv matches deploy's; no receipt directory appears; the marker stays out of the output. Two more run cloudfall.lifecycle.health with its playbook step running those tasks and check status: unhealthy / ok. Before the change the real-run and health tests fail (the refusal fires, or health_gate runs no check)
• The old test_the_engine_refuses_a_command_check_it_does_not_run_yet is replaced by test_s009_10_no_entry_point_refuses_a_command_check
• Ran locally: uv run ruff check ., uv run mypy, ANSIBLE_CONFIG=engine/ansible/ansible.cfg uv run ansible-lint engine/ansible (as CI sets it), uv run pytest engine/tests sdk/tests/test_lifecycle.py sdk/tests/test_command_health_check.py (395 passed, 1 skipped), specs.py check and specs.py coverage --spec 009. The full suite is left to CI
• Not exercised: a live Debian host (real systemd-run, become on the health play)

Fixes #166

🤖 Generated with Claude Code