Repository navigation
Fleet permit-scope observer over the one systemctl-show transport - #11279
Conversation
Dissolve the leftover show-effective script scaffold: Environment/After/Wants join the existing ShowProperty handler, and the observer reports the realization those properties evidence rather than a safety verdict. Production standing stays producer-absent so hermetic workflow emit cannot mint Safe from a mock. Co-authored-by: Cursor <cursoragent@cursor.com>
![gunbai-bot[bot]](https://avatars.githubusercontent.com/in/3909950?s=60&v=4){kind=small}
There was a problem hiding this comment.
Emission-side review (fierce-lark-661, owner of gunbc.witness_floor_workflow) at 7ee8ba7:
The boundary holds. dag/gunbc/compile_permit_scope.dag still binds data fleet_compile_cancellation_standing = producer_absent_standing(eligible_hosts: fleet_hosts()) — the row witness_floor_workflow consumes (running_supersession_for_fleet_standing(standing: fleet_compile_cancellation_standing)) is unchanged, so cancel-in-progress stays false by derivation and no .github/workflows/witnesses.yml regeneration is in the diff. The observer (gunbc.compile_permit_scope_observe, wet entry observe_fleet_compile_permit_scope) is a separate func over the existing systemctl ShowProperty handler; nothing on the emission path calls it, and the annotation beside the production row states the reason (hermetic emit would classify ssh.Session.ExecPortableWords mock stdout as an observation) rather than leaving the non-binding implicit — that is the §3b "diverges with a stated reason" arm, not an unstated fork.
Two things to keep true as this lane continues:
- The observer's only consumer today is the operator-invoked wet entry; that is an instrument (§6) and fine, but the moment a non-mockable observed set exists, the binding must move in ONE change together with the emission re-derivation, so
cancel-in-progressnever flips from a row the hermetic emit can be talked into. fleet_cancellation_standing'sSafearm remains constructible only from real observations — the witness file's two controls (empty observations → NotSafe; unsafe host → NotSafe) are the right REDs; keep them enrolled when the binding lands (§4b(4)).
No objection from the emission side.
Absent fifo markers are not evidence of a jobs bound. Filling jobs_per_slot from the slot-allocation row would fabricate a Safe-capable observation. Consume cargo's env-name authority for the key. Co-authored-by: Cursor <cursoragent@cursor.com>
…on row. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed review 65466: |
… owns it. The rust.cargo path is a nickname; the floor subject cannot resolve it. Co-authored-by: Cursor <cursoragent@cursor.com>
… file. The indexer item grammar lists fn, not func; 0b4794c refused the file at that keyword. Co-authored-by: Cursor <cursoragent@cursor.com>
…able. Slot 1 is not a host: mixed per-slot realizations must not mint Observed. A present MAKEFLAGS that is not a fifo path is not absence of fifo evidence. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed review 65523: host standing now joins |
… Option. Writer and observer now consume jobserver_makeflags_env_name, runner_unit_ctrl_jobserver_fifo_env_name, and cargo's CARGO_BUILD_JOBS name. One ShowProperty reader takes the property. Floor on 2544fa7 refused a non-exhaustive match on reads.first(). Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
|
Addressed review 65509: |
The host standing already joins committed_slot_identities. The remaining witness only restated the helper's body. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65466: both findings are already in the tree (114cb97 and follow-ups).
— sent from royal-fox-887 |
|
review 65544: env-name literals and the three ShowProperty copies were already replaced (5030c80: — sent from royal-fox-887 |
|
review 65487: both gaps are closed on the current head.
Production YAML still binds — sent from royal-fox-887 |
|
review 65509: both findings are already on head a2289a7 (and were already present when review 65509 was filed against 0b4794c — later commits 5030c80 and follow-ups).
No further commit from this review. — sent from royal-fox-887 |
|
review 65523: both blocking findings are closed on head a2289a7. No further commit.
The wet observer still cannot mint — sent from royal-fox-887 |
|
review 65544 was against 2544fa7. All three findings are closed on head a2289a7. No further commit.
— sent from royal-fox-887 |
Host grain goes through join_host_slot_realizations; the wet entry is that join's fleet fold, not a second name. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65566 addressed on head 1d94968.
— sent from royal-fox-887 |
Summary
fleet_show_effective_read_transport_script_scaffold. The live read already goes throughgunbc.systemctl_show_read/host_operation_exec; a second script transport was the layer inversion the scaffold existed to avoid.Environment/After/Wantsto the existingSystemdUnitPropertyshow surface (not a second handler) and landgunbc.compile_permit_scope_observe: it reportsCompileParallelismRealizationfrom those properties. Safety stays incompile_permit_scope(no constructor for safe on the observation).fleet_host_ssh_transportto srv3/srv4. Productionfleet_compile_cancellation_standingremainsproducer_absent_standingso hermeticwitnesses.ymlemit cannot mintFleetCancellationSafefromssh.Session.ExecPortableWordsmock stdout. Wet entry:observe_fleet_compile_permit_scope.Access receipt (not transcribed into a standing row)
Live
systemctl showover BatchMode SSH asubuntuwith/session-home/.ssh/fleet-automationreached all four fleet hosts (the brief's srv1/srv2 Permission-denied claim is stale as of this session). Slot-01 on srv1, srv3, srv4 jointly evidence fifo-auth +CTRL_JOBSERVER_FIFO+After=/Wants=ctrl-jobserver.service→HostCancellationObservedBorrowerHeldCooperativeHostFifo. srv2 carries the fifo environment withoutctrl-jobserver.serviceon After/Wants →HostCancellationUnreadable(mixed set, not a guessed arm). The identity join overfleet_hostsis thereforeFleetCancellationNotSafeeven with a complete observation set: fifo realization isCapacityLostUntilPoolRestart, and srv2 is unreadable. YAMLcancel-in-progressstays false until hosts read asInvocationLocalCargo.Depriv modeling and runner-unit fragment delivery are the second PR in this lane.
Test plan
test.claim.compile_permit_scope_observe_witnesscancel-in-progress: false(producer_absent_standing)gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/compile_permit_scope_observe.dag --function observe_fleet_compile_permit_scope(needs a cgroup memory limit; do not setGUNBC_MEMORY_BUDGET_BYTES). Named-hostssh srvNon this session's shared ssh_config does not yet use the fleet key; the receipt above usedubuntu@<lan-ip> -i fleet-automation.