[Nightly][anolisa] bug: anolisa upgrade --assume-yes blocked — 5 component RPMs still missing Provides: anolisa-component(<name>)

[zhangtaibo]

Component

anolisa (CLI: anolisa upgrade --assume-yes → RPM component resolution via ComponentResolver)

Bug Description

anolisa upgrade --assume-yes returns ok: false with status: blocked because 5 default-profile components (os-skills, sec-core, tokenless, ws-ckpt, agent-memory) have RPM spec files missing the Provides: anolisa-component(<name>) virtual provide. The ComponentResolver::resolve_rpm() in src/anolisa/crates/anolisa-cli/src/resolution.rs:296-361 tries three resolution paths:

1. Component index (components-v2.toml / components.toml) — not available (404 / fallback to v1 which lacks these entries)
2. package_map in repo.toml — no entries for these components
3. RPM Provides fallback: rpm_component_provide(component) at resolution.rs:644 generates anolisa-component(<name>), then what_provides_installed() at resolution.rs:344-345 queries installed RPMs — returns empty because RPMs lack the Provides declaration

All three paths fail → ResolutionSet::None → error at check.rs:819: cannot resolve RPM package for default component '<name>': no package mapping or provider found

This is the same root cause as the closed umbrella issue #2575, but 2 of 5 PRs are still OPEN (#2563 agent-sec-core, #2568 ws-ckpt) and the ECS mirror has not yet synced any rebuilt RPMs. The test tests/test_upgrade.py::test_upgrade_assume_yes_upgrades_rpm_components continues to fail 3 consecutive nights (2026-08-14, 08-15, 08-16).

Steps to Reproduce

1. SSH to the test ECS (ALinux 4, anolisa 0.3.1 installed):

   ssh root@<ECS_IP>

2. Verify the 5 component RPMs are installed but lack the anolisa-component() provides:

   for pkg in agent-sec-core os-skills tokenless ws-ckpt agent-memory; do
     echo "=== $pkg ==="
     rpm -q --provides $pkg | grep anolisa-component || echo "  NO anolisa-component provides"
   done
   # All 5 print "NO anolisa-component provides"

3. Run upgrade:

   anolisa --json upgrade --assume-yes

Actual Behavior

{
  "ok": false,
  "schema_version": 1,
  "command": "upgrade",
  "data": {
    "target": "agentic_os-latest",
    "backend": "rpm",
    "status": "blocked",
    "errors": [
      {"name": "os-skills", "reason": "cannot resolve RPM package for default component 'os-skills': no package mapping or provider found"},
      {"name": "sec-core", "reason": "cannot resolve RPM package for default component 'sec-core': no package mapping or provider found"},
      {"name": "tokenless", "reason": "cannot resolve RPM package for default component 'tokenless': no package mapping or provider found"},
      {"name": "ws-ckpt", "reason": "cannot resolve RPM package for default component 'ws-ckpt': no package mapping or provider found"},
      {"name": "agent-memory", "reason": "cannot resolve RPM package for default component 'agent-memory': no package mapping or provider found"}
    ],
    "warnings": []
  }
}

Exit code: 0 (anolisa JSON returns ok=false)

Expected Behavior

anolisa upgrade --assume-yes should return ok: true with status: up-to-date (no-op when all components are current). The ComponentResolver should resolve each default component's RPM package via the anolisa-component(<name>) virtual provide declared in the spec file. This is the contract established by rpm_component_provide() at resolution.rs:644 — the resolver expects RPMs to declare Provides: anolisa-component(<name>).

Root Cause

• File: src/agent-sec-core/agent-sec-core.spec.in — missing Provides: anolisa-component(sec-core)
• File: src/ws-ckpt/ws-ckpt.spec.in — missing Provides: anolisa-component(ws-ckpt)
• Resolution chain: src/anolisa/crates/anolisa-cli/src/resolution.rs:296-361 (resolve_rpm())
• Provide generation: src/anolisa/crates/anolisa-cli/src/resolution.rs:644 (rpm_component_provide() → format!("anolisa-component({component})"))
• Error site: src/anolisa/crates/anolisa-cli/src/commands/tier1/update/check.rs:819

3 of 5 spec files are already fixed on main:

• os-skills.spec.in — fixed in commit aa2f3b73 (merged)
• tokenless.spec.in — fixed in commit aa2f3b73 (merged)
• agent-memory.spec.in — fixed in commit fb48fcd5 (merged)

2 of 5 still need PR merge:

• agent-sec-core.spec.in — PR fix(sec-core): add missing Provides: anolisa-component(sec-core) to RPM spec #2563 (OPEN, MERGEABLE, CI green)
• ws-ckpt.spec.in — PR fix(ckpt): add RPM component identity #2568 (OPEN, MERGEABLE, CI green)

This is a regression — the anolisa-component() resolution contract was introduced but these 5 spec files were not updated at that time.

Suggested Fix

Add Provides: anolisa-component(<name>) to the 2 remaining spec.in files:

--- a/src/agent-sec-core/agent-sec-core.spec.in
+++ b/src/agent-sec-core/agent-sec-core.spec.in
@@ -33,6 +33,7 @@
 Name:           agent-sec-core
 Version:        @VERSION@
 Release:        %{anolis_release}%{?dist}
+Provides:       anolisa-component(sec-core)

--- a/src/ws-ckpt/ws-ckpt.spec.in
+++ b/src/ws-ckpt/ws-ckpt.spec.in
@@ -10,6 +10,7 @@
 Name:           ws-ckpt
 Version:        @VERSION@
 Release:        %{anolis_release}%{?dist}
+Provides:       anolisa-component(ws-ckpt)

PRs already filed: #2563 (agent-sec-core), #2568 (ws-ckpt + tokenless). After merging these PRs and rebuilding + syncing RPMs to the mirror, anolisa upgrade --assume-yes should return ok: true.

Environment

• ALinux 4 ECS (cn-hongkong, 8.217.205.52)
• anolisa 0.3.1
• anolisa main: ba20d94 (2026-08-16)
• RPMs: agent-sec-core-0.9.0, os-skills-0.6.1, tokenless-0.7.3, ws-ckpt-0.4.2, agent-memory-0.2.6
• Test case: tests/test_upgrade.py::test_upgrade_assume_yes_upgrades_rpm_components (ANL-022-05)
• First seen: 2026-08-14, consecutive_days: 3

[github-actions]

🔀 Issue Router

• Component: anolisa
• Confidence: 98%
• Owners notified: @kongche-jbw @ikunkun-sys
• Assigned: @kongche-jbw @ikunkun-sys

问题涉及 ANOLISA CLI 的 RPM 组件解析与升级流程。

Evidence: 核心故障发生在 anolisa upgrade 的 ComponentResolver 解析链，src/anolisa/ 路径和 CLI 行为是主要证据。

This routing was applied by the ANOLISA Issue Router through GitHub Actions.