Skip to content

9/19 - #11877

Closed
briansrls wants to merge 19 commits into
mainfrom
sharp-ant-merge
Closed

9/19#11877
briansrls wants to merge 19 commits into
mainfrom
sharp-ant-merge

Conversation

@briansrls

@briansrls briansrls commented Sep 20, 2026

Copy link
Copy Markdown
Contributor

Auto-opened by session-dashboard for session still-owl-744.
Pushing to sharp-ant-merge advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

  • Title describes the change (not the session id or branch).
  • PR body summarises what and why (replace the TODO below).
  • Tests run: name the command (e.g. npm test, cargo test) and the result.
  • If this closes a work item, the body contains a Closes #N directive.
  • No commits on this branch are surprises (no fork/cherry-pick I did not make).
  • No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

  • TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

gunbc-ci-auto-heal and others added 19 commits September 19, 2026 15:17
gunbc-ci-auto-heal @claude
Converge R2 entitlement + bucket existence for every allocated origin…
e9d480c 
… purpose

gunbc.cloudflare.r2_bucket_ensure observes, per allocated BucketPurpose, the bucket
through cloudflare.R2Buckets.Get (extdeps.cloudflare.r2), classifies with
std.upsert_decision, creates an established-absent default-jurisdiction bucket and
reads it back with a second Get. An unentitled account (403/10042) refuses with the
dashboard checkout step: Cloudflare publishes no API route to an R2 subscription
(cited readings). Wired as fleet-converge mode r2_bucket_ensure; witness
test.claim.cloudflare_r2_bucket_ensure.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Bucket ensure signs with a minted bucket-admin token; label spellings…
f820b55 
… on std.upsert_decision

Operator ruling (option B): the bootstrap token is not widened. A third mint profile,
R2AccountBucketAdmin, mints an account-scoped token holding only the observed
Workers R2 Storage Write group into its own custody container
(cloudflare-r2-bucket-admin-token, three IAM cells in r2_mint_secret_access);
r2_bucket_ensure signs with it and refuses naming run_bucket_admin until it is pinned.
The R2 buckets service moves to extdeps.cloudflare.r2_buckets so its cloudflare.*
service namespace no longer shadows the vendor value in modules importing r2.

Review 68490: upsert_decision_label is generic over the plan and ObservationVerdict
gains its one wire spelling on the sum; the roster witness drops the transcribed count.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/sharp-ant-20
0f44d5c
gunbc-ci-auto-heal @claude
Regenerate fleet-converge.yml: r2_bucket_admin_mint mode
328374f 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Mint flow ensures its custody container; pin the executed bucket-admi…
c463ee8 
…n mint

observe_r2_mint_custody_container now creates an absent container (automatic
replication) as the running identity before any Cloudflare effect; an identity
without the project-level secretmanager.secrets.create (the fleet SA) refuses naming
that permission, and an ambiguous create is not retried (operator direction).

Executed live 2026-09-19: run_bucket_admin created cloudflare-r2-bucket-admin-token,
minted token 6f287fde…, stored v1 (verified); pinned in r2_origin. ensure then
nooped the durable origin and created the absent boot-origin bucket with converged
readback; a second run nooped both. Frontier rows for admit_r2_bucket_admin_api_mint
and r2_account_resource_name retire on that execution.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Name the container step for what it does: ensure, not observe (review…
b91d374 
… 68550)

observe_r2_mint_custody_container -> ensure_r2_mint_custody_container,
ObserveCustodyContainer -> EnsureCustodyContainer, R2MintCustodyContainerUnobserved ->
R2MintCustodyContainerNotEnsured, and the refusal texts with them: the step now creates
an absent container, so the observation names were a meaning fork (DESIGN 3).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Cite cloudflare.R2Buckets in its new module (review 68571)
0bb92b1 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Import the REST outcome constructors r2_bucket_ensure matches on (rev…
c3b1c62 
…iew 68589)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/sharp-ant-20
0e089c5 
# Conflicts:
#	.github/workflows/fleet-converge.yml
#	dag/gunbc/fleet/fleet_converge_workflow.dag
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/sharp-ant-20
36d19e1 
# Conflicts:
#	.github/workflows/fleet-converge.yml
#	dag/gunbc/fleet/fleet_converge_workflow.dag
gunbc-ci-auto-heal @claude
The two R2 modes declare no host SSH demand (fixes the post-merge com…
854e773 
…pile)

main #11736 made fleet_converge_mode_fleet_ssh_key_demand exhaustive over the mode
sum; the merge that added R2BucketEnsure and R2BucketAdminMint left them without an
arm, so the corpus did not resolve and no regeneration of fleet-converge.yml could
succeed -- which is why heal-generated-artifacts failed rather than repairing it.
Both reach api.cloudflare.com and secretmanager.googleapis.com over HTTPS as the
run's own federated identity and open no host session, so neither consumes the key.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Restore main's two SSH-demand arms the merge dropped
1cfe38c 
The merge kept our side of the hunk carrying fleet_converge_mode_fleet_ssh_key_demand,
which lost main's ApprovalKeyringConverge and MtCollins1Boot arms, so the match stayed
non-exhaustive after 854e773 fixed the other half. Both are restored with main's own
classification (FleetSshKeyConsumed). Swept every mode in the sum against main's copy:
per-mode occurrence counts now agree, and each of the four R2 modes appears in the same
six constructs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@briansrls @claude
Regenerate fleet-converge.yml from the merged mode roster
0ac0900 
The main merge took the ours side of this generated file, dropping the
r2_bucket_ensure and r2_bucket_admin_mint modes the model at this head declares.
Regenerated through gunbc.instruments.generated_artifact_gate main_wet_one on a
host with the admitted memory budget (session containers and BuildBuddy runners
both refuse it), not hand-edited.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/sharp-ant-20
e219d8a 
# Conflicts:
#	dag/gunbc/fleet/fleet_converge_workflow.dag
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/session/sharp-ant-20' into sessi…
ab841c6 
…on/sharp-ant-20

# Conflicts:
#	.github/workflows/fleet-converge.yml
gunbc-ci-auto-heal @claude
Derive the jurisdiction parse from the wire table (review 69065)
eb24535 
parse_r2_jurisdiction re-spelled the five wire tokens r2_jurisdiction_wire already
owns, so a corrected spelling in one would have left the other silently
unrecognising. It now folds over r2_jurisdictions() and compares through
r2_jurisdiction_wire -- one grammar read backward (DESIGN 4) -- and lives beside the
table it inverts in extdeps.cloudflare.r2 rather than in the operation module.
No declared-fork row is needed because the fork is gone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/sharp-ant-20
c716d5f 
# Conflicts:
#	.github/workflows/fleet-converge.yml
#	dag/gunbc/fleet/fleet_converge_workflow.dag
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/sharp-ant-20
bad2114 
# Conflicts:
#	.github/workflows/fleet-converge.yml
#	dag/gunbc/fleet/fleet_converge_workflow.dag
Brian Searls
Merge remote-tracking branch 'origin/main' into sharp-ant-merge
8255add 
# Conflicts:
#	.github/workflows/fleet-converge.yml
#	dag/gunbc/fleet/fleet_converge_workflow.dag
@gunbai-bot

gunbai-bot Bot commented Sep 20, 2026

Copy link
Copy Markdown
Contributor

Duplicate: this branch is my local working copy of session/sharp-ant-20 (auto-pushed by the session). Its commits -- the main merge keeping all three new converge modes, and the regenerated fleet-converge.yml -- are on #11721. Closing to keep one PR for that work. — sent from still-owl-744

@gunbai-bot gunbai-bot Bot closed this Sep 20, 2026
@gunbai-bot
gunbai-bot Bot deleted the sharp-ant-merge branch September 20, 2026 16:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@briansrls