GeezerVison

api: preserve parent links and reject orphan node submissions

Signed-off-by: Denys Fedoryshchenko <[email protected]>

api: reject state/result changes to done nodes

A lab can report a job more than once. The later report silently
replaced the first result of a node that was already done (e.g. pass,
then fail 15 minutes later), while the KCIDB bridge had already sent the
first result to the dashboard, leaving Maestro and the dashboard out of
sync with nobody noticing.

Make the first final result win: PUT/PATCH /node and PUT /nodes now
return 409 Conflict when they would change the state or result of a done
node. The hierarchy is checked as a whole before anything is written.
Resubmitting the same result is still allowed, and so is the late result
for a node closed without one (incomplete, e.g. by node_timeout), which
the LAVA callback relies on. Admins can override with force=true.

Every rejected or forced change is counted in the metrics and published
on the node-integrity channel, so it can be monitored through
/events?channel=node-integrity.

Signed-off-by: Denys Fedoryshchenko <[email protected]>

api: reject state/result changes to done nodes

A lab can report a job more than once. The later report silently
replaced the first result of a node that was already done (e.g. pass,
then fail 15 minutes later), while the KCIDB bridge had already sent the
first result to the dashboard, leaving Maestro and the dashboard out of
sync with nobody noticing.

Make the first final result win: PUT/PATCH /node and PUT /nodes now
return 409 Conflict when they would change the state or result of a done
node. The hierarchy is checked as a whole before anything is written.
Resubmitting the same result is still allowed, and so is the late result
for a node closed without one (incomplete, e.g. by node_timeout), which
the LAVA callback relies on. Admins can override with force=true.

Every rejected or forced change is counted in the metrics and published
on the node-integrity channel, so it can be monitored through
/events?channel=node-integrity.

Signed-off-by: Denys Fedoryshchenko <[email protected]>

pubsub: stop leaking Redis connections from abandoned subscriptions

Every pub/sub subscription pins one dedicated Redis connection in the
API process.  redis-py 8 lowered the default asyncio pool size to 100,
and once 100 subscriptions are held every other Redis command (INCR on
subscribe, PUBLISH on node updates) fails with MaxConnectionsError,
which surfaced as HTTP 500 for all writes and took the whole pipeline
down.

The subscriptions piled up because a client that subscribes and dies
before its first listen() leaves last_poll unset, and
cleanup_stale_subscriptions() only ever looked at last_poll, so such
entries were never removed.  A crash-looping external client exhausted
the pool in about an hour.

Fixes:

- cleanup_stale_subscriptions() ages never-polled subscriptions from
  their creation time.
- On every subscribe, evict that user's never-polled subscriptions
  older than abandoned_subscription_seconds (60s) and then enforce a cap
  of max_subscriptions_per_user (20) active subscriptions, returning
  HTTP 429 when exceeded.
- Pass an explicit redis_max_connections (1000) to the Redis pool.
- Close the previous PubSub when rebuilding after a connection error,
  and close the half-initialised PubSub if SUBSCRIBE fails, so neither
  path leaks a pooled connection.
- Keep the keep-alive loop alive across transient Redis errors.
- Map Redis MaxConnectionsError / ConnectionError to a 503 with
  Retry-After instead of a generic 500.

All new settings are overridable through the environment via
PubSubSettings.  Unit tests cover the cleanup, eviction, limit, rebuild
and keep-alive paths.

Signed-off-by: Denys Fedoryshchenko <[email protected]>

docker: ssh: move base image to debian:trixie-slim

Debian 11 (bullseye) LTS ended on 2026-08-31 and its security
updates are no longer available from deb.debian.org, so building the
ssh image fails with 404 errors on apt install and breaks CI.

Move to trixie, the current Debian stable. The existing sshd_config
is valid with OpenSSH 10.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Denys Fedoryshchenko <[email protected]>

docker: ssh: move base image to debian:trixie-slim

Debian 11 (bullseye) LTS ended on 2026-08-31 and its security
updates are no longer available from deb.debian.org, so building the
ssh image fails with 404 errors on apt install and breaks CI.

Move to trixie, the current Debian stable. The existing sshd_config
is valid with OpenSSH 10.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Denys Fedoryshchenko <[email protected]>

docker: ssh: move base image to debian:trixie-slim

Debian 11 (bullseye) LTS ended on 2026-08-31 and its security
updates are no longer available from deb.debian.org, so building the
ssh image fails with 404 errors on apt install and breaks CI.

Move to trixie, the current Debian stable. The existing sshd_config
is valid with OpenSSH 10.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Denys Fedoryshchenko <[email protected]>

docker: ssh: move base image to debian:trixie-slim

Debian 11 (bullseye) LTS ended on 2026-08-31 and its security
updates are no longer available from deb.debian.org, so building the
ssh image fails with 404 errors on apt install and breaks CI.

Move to trixie, the current Debian stable. The existing sshd_config
is valid with OpenSSH 10.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Denys Fedoryshchenko <[email protected]>

docker: ssh: move base image to debian:trixie-slim

Debian 11 (bullseye) LTS ended on 2026-08-31 and its security
updates are no longer available from deb.debian.org, so building the
ssh image fails with 404 errors on apt install and breaks CI.

Move to trixie, the current Debian stable. The existing sshd_config
is valid with OpenSSH 10.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Denys Fedoryshchenko <[email protected]>

docker: ssh: move base image to debian:trixie-slim

Debian 11 (bullseye) LTS ended on 2026-08-31 and its security
updates are no longer available from deb.debian.org, so building the
ssh image fails with 404 errors on apt install and breaks CI.

Move to trixie, the current Debian stable. The existing sshd_config
is valid with OpenSSH 10.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Denys Fedoryshchenko <[email protected]>