Repository navigation
Model runner depriv and deliver the unit fragment - #11307
Conversation
Dissolve the leftover show-effective script scaffold: Environment/After/Wants join the existing ShowProperty handler, and the observer reports the realization those properties evidence rather than a safety verdict. Production standing stays producer-absent so hermetic workflow emit cannot mint Safe from a mock. Co-authored-by: Cursor <cursoragent@cursor.com>
Absent fifo markers are not evidence of a jobs bound. Filling jobs_per_slot from the slot-allocation row would fabricate a Safe-capable observation. Consume cargo's env-name authority for the key. Co-authored-by: Cursor <cursoragent@cursor.com>
…on row. Co-authored-by: Cursor <cursoragent@cursor.com>
… owns it. The rust.cargo path is a nickname; the floor subject cannot resolve it. Co-authored-by: Cursor <cursoragent@cursor.com>
… file. The indexer item grammar lists fn, not func; 0b4794c refused the file at that keyword. Co-authored-by: Cursor <cursoragent@cursor.com>
…able. Slot 1 is not a host: mixed per-slot realizations must not mint Observed. A present MAKEFLAGS that is not a fifo path is not absence of fifo evidence. Co-authored-by: Cursor <cursoragent@cursor.com>
… Option. Writer and observer now consume jobserver_makeflags_env_name, runner_unit_ctrl_jobserver_fifo_env_name, and cargo's CARGO_BUILD_JOBS name. One ShowProperty reader takes the property. Floor on 2544fa7 refused a non-exhaustive match on reads.first(). Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
The host standing already joins committed_slot_identities. The remaining witness only restated the helper's body. Co-authored-by: Cursor <cursoragent@cursor.com>
Host grain goes through join_host_slot_realizations; the wet entry is that join's fleet fold, not a second name. Co-authored-by: Cursor <cursoragent@cursor.com>
…agment. The hand-placed depriv.conf was the unread override that made fragment delivery accidental. The drop-in is now derived from the unit-user/job-user split, the CI sccache instance, and Docker's rootless endpoint; runner-host-file converge writes that drop-in and the modeled fragment together. Co-authored-by: Cursor <cursoragent@cursor.com>
gunbai-bot
Bot
changed the title
… refuses. Review 65659: User= no longer borrows srv1_ci_deploy_runner_principal, and DOCKER_HOST no longer mints a second fleet-wide 999. Unlisted hosts refuse rather than inherit a neighbour's identity. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65659 — both findings were correct; fixed on e9feeaa.
— sent from royal-fox-887 |
…s the uid. review 65673: a reported contradiction is a bet, not deployment input. Production converge omits depriv until that observation exists rather than overwriting the live drop-in. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65673 is right:
No production — sent from royal-fox-887 |
…ervation. review 65686: shipping the fragment after swallowing RunnerUnitTextRefused was a widen. Production still passes none; the line stops with that cause instead of writing a partial set that is only safe if an unread depriv.conf happens to exist. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65686 is right: discarding
— sent from royal-fox-887 |
… User= on runner_user. Parent read-fors on PR2: the XDG uid is a typed bet with an id -u read obligation, not fleet_posix_ci_runner_user.uid, and a missing depriv drop-in still cannot run jobs as root. Co-authored-by: Cursor <cursoragent@cursor.com>
review 65711: the figure stays as a typed bet with an id -u read obligation; converge must not install that uid. Production depriv refuses, so the desired population does not overwrite live depriv.conf. A CitedToAuthority fixture still renders the drop-in. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65711 is right: HEAD formed
— sent from royal-fox-887 |
…nverge. review 65725: an ungrounded docker uid must not stop the orphan-class pair or observe/apply. fleet_compute_offer_for now looks up fleet_intent_offers instead of restating the four hosts. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65725 both findings.
— sent from royal-fox-887 |
…ame one home. review 65742: no second 999, no second CTRL_RUNNER_JOB_USER, and one helper for the grounded file list so depriv is spliced rather than the three files copied. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65742 all three.
— sent from royal-fox-887 |
The apply-route witness never reached its subject: Check has no mock_response, so the floor classified a route gap rather than a host report. Privilege, unread slots, and ancestor refusal stay as the classifiers. Co-authored-by: Cursor <cursoragent@cursor.com>
Trailing // after the last declaration is not a source annotation; parse refused it. Co-authored-by: Cursor <cursoragent@cursor.com>
The floor classified run_runner_host_files as a Check route gap, so restoring the witness without mock_response coverage would not restore the rung. Heal will project the ledger. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65815 — both findings.
|
Writing the fragment without a modeled drop-in is only correct if an unread depriv.conf happens to exist. Teardown and needrestart still converge; both files land together when the figure is CitedToAuthority. Co-authored-by: Cursor <cursoragent@cursor.com>
|
review 65798 and review 65815 finding 1: agreed. Production desired population no longer ships Finding 2 (apply-route witness): already declared as — sent from royal-fox-887 |
|
review 65815 was against
No further code change for this review. — sent from royal-fox-887 |
Ledger-Repair-Judged: docs/design-rung-drops.md Ledger-Rows-Repaired: docs/design-rung-drops.md runner_host_file_apply_route_hermetic
Keep both new rung-drop roster rows (apply-route hermetic and floor-cost CPU regression). Co-authored-by: Cursor <cursoragent@cursor.com> # Conflicts: # dag/gunbc/rung_drop/roster.dag # docs/design-rung-drops.md
Ledger-Repair-Judged: docs/design-rung-drops.md Ledger-Rows-Repaired: docs/design-rung-drops.md floor_cost_claim_qualification_unavailable Ledger-Rows-Repaired: docs/design-rung-drops.md long_home_enrolment_margin_observed_only Ledger-Rows-Repaired: docs/design-rung-drops.md runner_host_file_apply_route_hermetic Ledger-Rows-Repaired: docs/design-rung-drops.md floor_cost_cpu_regression_at_constant_eval_steps
Merge left docs/design-rung-drops.md at the merge-base so the generated-artifact driver would not refuse; that dropped standing rows from the published ledger. Regen from gunbc.rung_drop at this head. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Fixed at The merge of
— sent from royal-fox-887 |
…rontier. The class already had a decl_ref-keyed row for docker_default_endpoint; returning Uri is not available until UriScheme carries unix/socket/fd. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Fixed at
Did not return — sent from royal-fox-887 |
Converge already resolved runner_host_deploy_for; a second lookup minted a second unmodeled-host cause and made the fragment arm unreachable from production. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Fixed at
— sent from royal-fox-887 |
gunbc_runner_unit_fragment_for_host had no production consumer and duplicated the unmodeled-host cause. Converge keeps the one lookup and calls from_deploy. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Fixed at Deleted — sent from royal-fox-887 |
|
CI on No code change. Re-ran the failed jobs of run 34850945002. — sent from royal-fox-887 |
THE MISSING RUN HAD A CAUSE AND IT WAS NOT A DROPPED WEBHOOK. After `8598871fe` no workflow run was created for twenty minutes while the repository was demonstrably healthy -- other branches started runs at 01:37, 01:47 and 01:54. The API says why: `mergeable=false`. GitHub builds `refs/pull/N/MERGE` for a `pull_request` run, a conflicted PR has no such ref, and the workflow therefore had nothing to run against. The branch was 68 commits behind. FOUR CONFLICTS, TWO OF THEM SEMANTIC. `runner_host_deploy.dag`: main's #11307 added `unit_user` to `RunnerHostDeploy`; this branch had replaced those rows with `RunnerHostSpec` plus an admission constructor. Git merged the four `unit_user: "root"` literals INTO the spec rows -- textually plausible, semantically wrong, and it would not have compiled, because the field was declared on the deploy and not on the spec. It is threaded through the seam instead: `unit_user` is a PRINCIPAL, and `RunnerHostSpec`'s own header says principals live there ("a host's address, its principals and its GitHub app are true of srv2 exactly as they are of srv1"). Only `runner_count` was ever the capacity fact. `runner_unit_file_witness_test.dag`: main's 118 new lines read `srv1_runner_host_deploy` and `srv3_runner_host_deploy` directly, and this branch deleted both rows. They now read the admission through `wt_srv1_deploy`, which already existed for exactly this, plus the srv3 twin it needed. The unadmitted fixture row gains `unit_user` for the same reason the production rows did. `ROADMAP.md` and `.github/workflows/fleet-converge.yml`: the generated-artifact merge driver refused both and printed the regeneration recipe, which is the behaviour it was repaired into. Regenerated. THE FIRST REGENERATION PRODUCED `# roadmap unavailable` AND THE TREE WAS NEVER BROKEN. It reported `unknown variant acceptance_node_remains_superseded, expected acceptance_node_reopens_active_frontier` against a `roadmap_model.dag` that is BYTE-IDENTICAL to main, whose coproduct carries both arms, and whose fixture main is green on. The cause was the instrument: the merge brought 23 changed files under `src/v1` and the binary predated all of them. Rebuilt -- which needed `cargo clean -p v1-compiler` and `CARGO_INCREMENTAL=0`, because the incremental cache had gone inconsistent across the change and linked with `undefined reference to drop_in_place<serde_core::private::content::Content>` -- and the same command then produced a 57,680-byte projection carrying both roadmap rows. Committing the first attempt would have failed the docs projection gate, which IS in the required gate roster, on a defect that did not exist. `gunbc.recurring_failure_mode` already owns this class and this repository's own memory of it says to verify the instrument before citing it; the lesson is that a 68-commit merge is precisely when the instrument changes underneath you. Two prose citations naming the deleted `srv4_runner_host_deploy` are repaired in passing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q7tG7JyxfKEDUtBUYuEw6m
… see The floor refused at PREPARATION on the merged head -- `floor refused: modules_resolved=3056 modules_excluded=2`, no witness executed, no cost artifact produced. Run 34923353966. PARSE IS NOT TYPECHECK, and that is the whole lesson of this commit. `v1_src_dag_parse` reported the merged tree clean because every file is syntactically well formed; what it cannot see is a record literal missing a field its type declares, or a match that stopped being exhaustive because someone else's coproduct grew an arm. Both classes are exactly what a 68-commit merge produces, and both were invisible until the floor typechecked the corpus. SIX LITERALS LOST A FIELD. #11307 added `unit_user` to `RunnerHostDeploy`; this branch's `wt-unadmitted` fixture row is copied into six witness modules and predates it. Each gains the field. ONE MATCH LOST EXHAUSTIVENESS, AND IT IS THE DELETE-FIRST CENSUS WORKING RATHER THAN A DEFECT. `runner_host_file_converge` matches `runner_host_deploy_for` over two arms; this branch added a third, `RunnerHostDeployRefused`, for a host whose admitted width refuses. The compiler refused loudly at the consumer, which is what a fail-closed substrate is supposed to do when an authority grows a case. THE NEW ARM CARRIES THE WIDTH REFUSAL'S OWN CAUSE rather than reusing the unmodeled-host message, and the distinction is load-bearing: srv2 IS modeled -- address, principals and app all declared -- and what refuses is its width. A reader told "no runner deploy row" would go looking for a missing declaration that is present. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q7tG7JyxfKEDUtBUYuEw6m
1 participant
Summary
depriv.confcarried: systemdUser=fromDeployRunnerPrincipal.unit_user,CTRL_RUNNER_JOB_USERfromRunnerHostDeploy.job_user, CI sccache env fromci_cache_instance,DOCKER_HOSTfromextdeps.docker.endpointdocker_rootless_unix_endpoint.TranscribedUncited(read obligation:id -uof the job user). It is notfleet_posix_ci_runner_user.uid, which is recorded as the wrong number.runner_host_file_convergenow delivers four files per host: the modeled fragment, the modeled depriv drop-in, the teardown drop-in, and the needrestart deferral. The fragment still namesdeploy.runner_user, not root, so a missing depriv drop-in cannot run job code as root.BorrowerHeldCooperativeHostFifo. Stacked on Fleet permit-scope observer over the one systemctl-show transport #11279 (merge that first).Test plan
test.claim.runner_unit_file_witness_testandtest.claim.runner_host_file_converge_witness_test/etcpaths; srv9 refusesUser=briansrls