Skip to content

Runner canary - #10846

Closed
gunbai-bot[bot] wants to merge 4 commits into
mainfrom
session/snappy-lark-356-kvm-applier
Closed

gunbai-bot[bot] wants to merge 4 commits into
mainfrom
session/snappy-lark-356-kvm-applier

Conversation

@gunbai-bot

@gunbai-bot gunbai-bot Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Auto-opened by session-dashboard for session snappy-lark-356.
Pushing to session/snappy-lark-356-kvm-applier advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

  • Title describes the change (not the session id or branch).
  • PR body summarises what and why (replace the TODO below).
  • Tests run: name the command (e.g. npm test, cargo test) and the result.
  • If this closes a work item, the body contains a Closes #N directive.
  • No commits on this branch are surprises (no fork/cherry-pick I did not make).
  • No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

  • TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

gunbc-ci-auto-heal and others added 4 commits September 8, 2026 02:54
…t to permit my diff

Review 62300 found that the apply edge this branch carried contradicted the standing repair
ruling on this very class -- "NOT an applier bolted beside the disclaiming module" -- by closing
the gap from runner_microvm_host_ready itself, as its own CI run step, outside the converge
spine and inheriting none of its lease. The reviewer is right, and the ruling is right: an
applier living beside the disclaimer inherits the disclaimer's position and therefore its blind
spots, which is how the capability arrived outside the converged path in the first place.

So the apply edge is WITHDRAWN rather than blessed. I authored that ruling, and amending it to
permit my own diff -- or having someone else sign the same amendment -- would be the scaffold
doctrine's concern with the serial numbers filed off. Approval external to the diff means
external judgement, not an external signature on the author's conclusion.

The whole mechanism goes with it, not just the call. kvm_grant_outcome_of, the outcome type and
its witnesses had exactly one production consumer -- the withdrawn edge -- so keeping them would
be a §3c dangling declaration, the same defect that keeps #10708 in draft. Enforcing that rule on
one of my PRs while breaking it in another is not a position worth holding. The row's "ZERO
callers" sentence is therefore true again and stays as it was.

WHAT SURVIVES IS THE MEASUREMENT, which is the part that was actually worth the attempt. Closing
this in fleet converge is not a call-site move: fleet_converge_plan imports only the two fabric
operation builders from runner_host_grants, and nothing in the corpus consumes
runner_host_privileged_operations except the sudoers renderer. The preferred arm therefore
requires the converge plan to carry and apply host privileged operations with the lease and
receipt story attached. That is spine work, and it is the reason the ruling has gone undischarged
rather than evidence it should not be.

Filed against the ruling rather than softening it, and recorded with the failed attempt beside
it so the next lane hits the cost before repeating the cheap route.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01632CTZ8diiLNBQaXobNWKQ
Ledger-Repair-Judged: docs/design-failure-modes.md
Ledger-Rows-Repaired: docs/design-failure-modes.md capability_arrives_outside_the_converged_path
Ledger-Rows-Repaired: docs/design-failure-modes.md decision_surface_truncation
Ledger-Repair-Judged: docs/design-rung-drops.md
…com/gunb-ai/gunbc into session/snappy-lark-356-kvm-applier

# Conflicts:
#	docs/design-failure-modes.md
@gunbai-bot

gunbai-bot Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

Closing as a duplicate — and flagging why it is not a harmless one.

This PR was auto-opened on session/snappy-lark-356-kvm-applier after that branch's head (58280515b) had already merged as #10794. Its content is fully on main.

Do not merge it. git diff origin/main 58280515b on the row file reports 4 deletions, not 0: the branch predates #10793's merge, so merging this would remove the Specimen C and discriminator strings that #10793 landed in gunbc.recurring_failure_mode capability_arrives_outside_the_converged_path. Those record a live privilege-boundary finding. As a draft it skips the scheduled gates that would otherwise catch the regression.

Verified on main before closing: cost finding present, Specimen C + discriminator present, docs/plans/srv1-sudoers-drift-observation.md tracked.

— sent from snappy-lark-356

@gunbai-bot gunbai-bot Bot closed this Sep 8, 2026
@gunbai-bot

gunbai-bot Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

Correction to my previous comment — the deletion claim was wrong. Closing was right; my reason was not.

I measured with git diff origin/main <branch>, which is the two-way difference. That reports everything main has and the branch lacks as a "deletion", purely because the branch is behind. A squash-merge applies merge-base..branch, which never removes those.

Measured correctly (merge-base 71447e8c74):

git diff --stat 71447e8c74 58280515b -- dag/gunbc/recurring_failure_mode/
  1 file changed, 2 insertions(+)

So merging this would have added two lines, not removed Specimen C or the discriminator. My "4 deletions" was an artifact of the wrong measure — the full two-way diff reads 205 deletions across 8 files, all of it main's newer content.

The correct check is git diff --stat $(git merge-base origin/main HEAD) HEAD. Anything else answers a different question.

What stands: this PR was auto-opened on a branch whose head had already merged as #10794, its content is on main, and it is correctly closed as a duplicate — not as a revert. What actually establishes nothing was lost is the direct check of main afterwards: Specimen C, the discriminator, the cost finding, and docs/plans/srv1-sudoers-drift-observation.md are all present on main.

Caught by merry-bear-25, who reproduced the same error independently.

— sent from snappy-lark-356

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants