feat(ansible): Play 0 pre-flight should display code_source staleness metrics before and after sync

[mrveiss]

Summary

provision-fleet-roles.yml Play 0 syncs code_source from GitHub before running any role. However, it doesn't report how stale the local copy was before the sync, or confirm what changed. When the sync silently succeeds, the operator has no visibility into whether they were running from day-old code or 3-month-old code.

Evidence from Recent Incident

code_source was at commit cfed8b301 (~300 commits behind Dev_new_gui). The ai-stack role was missing Python 3.12/stale-venv fix (PR #3536). Provisioning ran silently from stale code, caused Phase 5a failure.

The current Play 0 output only shows:

[PRE-FLIGHT] Display deployed commit: Deploying from commit: 593bc3c69 feat(chat-workflow)...

It shows the final commit but not the starting commit or how many commits were skipped.

Fix

In Play 0 (provision-fleet-roles.yml), before the git pull:

- name: "[PRE-FLIGHT] Get code_source commit before sync"
  ansible.builtin.command: git -C {{ git_repo_root }} log -1 --format='%h %s (%cr)'
  register: pre_sync_commit
  changed_when: false

# ... existing git pull task ...

- name: "[PRE-FLIGHT] Get commits advanced during sync"
  ansible.builtin.command: >-
    git -C {{ git_repo_root }} log --oneline {{ pre_sync_commit.stdout.split()[0] }}..HEAD
  register: sync_delta
  changed_when: false
  when: github_sync is not failed

- name: "[PRE-FLIGHT] Display sync delta"
  ansible.builtin.debug:
    msg:
      - "Was at: {{ pre_sync_commit.stdout }}"
      - "Now at: {{ deploy_info.stdout }}"
      - "Commits advanced: {{ sync_delta.stdout_lines | length }}"
  when: github_sync is not failed

If the delta is >50 commits, emit a warning that role behavior may have changed significantly.

Acceptance Criteria

• Pre-flight shows the commit code_source was at before sync
• Pre-flight shows how many commits were advanced during sync
• If >50 commits behind, a visible WARNING is emitted
• If sync was skipped (GitHub unreachable), show staleness age: git log -1 --format='%cr'
• If already up to date, show "code_source up to date (no sync needed)"

[mrveiss]

✅ Fixed in PR #3595 (merged 2026-04-06).