Repository navigation
Converge the mtcollins1 unit-hold store root on srv1 (boot blocker) - #12341
Merged
Merged
Conversation
…nsureOwnedDirectory gunbc.machine_intake_mtcollins1_maintenance_hold unit_hold_store_root was never provisioned, so mtcollins1_boot refused 'unit hold store unavailable'. runner_host_grants now adds a job-user-owned EnsureOwnedDirectory for it to runner_host_wide_refused_operations on mtcollins1_unit_hold_store_host only, so it enters both srv1's rendered sudoers and the full-host plan's apply script. Witness asserts the converge command is in srv1's host-wide apply lines and absent from srv3's. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mtcollins1 boot run 36233836765 refused: unit hold store unavailable — /var/lib/gunbc/unit-holds was never provisioned.
gunbc.runner_host_grants unit_hold_store_operations: one EnsureOwnedDirectory (owner/group = host job user, mode = executor_managed_directory_mode 755; the hold store publishes DefaultAccessCreateOnly, so no confidentiality requirement) appended torunner_host_wide_refused_operations, only when the spec's host ismtcollins1_unit_hold_store_host. That list already feeds both the rendered sudoers andfleet_converge_plan host_wide_grant_apply_lines, so grant and executed argv are one value.provisioning/srv1/gunbc-ghrunner.sudoers: regenerated line (hand-applied to match rendering; the generated-artifact drift gate is the check).test.claim.unit_hold_store_provision_witness: srv1's apply lines contain the exact converge command; srv3's do not.Apply route: fleet-converge
mode=plan host=srv1(FullHostPlan), thenmode=applyof that plan. The srv1 sudoers file must be installed first (bootstrap principal) or the sudo line refuses.The authorization-claims sibling was provisioned by an ssh
install -din approval_keyring_converge (not a converged grant); this follows the host-wide-grant route instead, per the brief.🤖 Generated with Claude Code