Skip to content

CI-humming PR2: ground oomd evidence from the gunbc.oomd_install seam + de-conflate spec from realization-evidence - #5720

Merged
briansrls merged 5 commits into
mainfrom
session/sharp-heron-321-pr2-oomd-ground
Jun 24, 2026
Merged

CI-humming PR2: ground oomd evidence from the gunbc.oomd_install seam + de-conflate spec from realization-evidence#5720
briansrls merged 5 commits into
mainfrom
session/sharp-heron-321-pr2-oomd-ground

Conversation

@gunbai-bot

@gunbai-bot gunbai-bot Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What

Wires the single grounded oomd authority that turns REGIME-2 capacity SOUND once systemd-oomd is verified live — with no further gunbc edit at flip time. Built on the now-merged gunbc.oomd_install seam (#5677).

The "1-line flip" was unsound — why this is a de-conflation

The plan framed PR2 as a literal OomdUnverified -> OomdEnforced flip. But there were two independent oomd gates, and the one resolve_session_slice reads (the Regime2 mode's oomd_enforcement field) can never be grounded in place: gunbc.oomd_install imports ci_floor_measurement, so a cycle forbids the mode reading the verify seam. Hand-flipping that field to OomdEnforced would be the DESIGN §5 anti-pattern — editing a declaration to green a gate the realization does not back.

Fix (DESIGN §4 de-conflation): the Regime2 mode is pure operating-point spec (ceiling + concurrency + aggregate); oomd enforcement is realization evidence, threaded from the single grounded authority fleet_host_budget.gunbc_fleet_oomd_evidence, which binds the seam over the committed show-effective read. Stays OomdUnverified (fail-closed) until a real ReadObserved grounds the full conjunction; when it does, both gates (session-slice resolution + host plan) open at once.

Changes

  • ci_floor_measurement: drop oomd_enforcement from Regime2AggregateOomd; rewrite the keystone marker to the verify-not-validate structure.
  • fleet_host_budget: import the seam + mode types; ground gunbc_fleet_oomd_evidence via gunbc_fleet_oomd_evidence_for(mode).
  • ci_runner_placement: resolve_session_slice takes oomd as a threaded param; gates on the single authority at all call sites.
  • runner_deploy_emit: PSI dissolve-repoint (interim local Int 60 → percent_count of the gunbc_oomd_sessions_policy single authority — Model systemd-oomd as a dependency (pure .dag, no live execution): extdeps/systemd unit-management interface plus oomd config surface, apt install-as-effect, and a gunbc install Realization that grounds OomdEnforced from a verify/show-effective read #5677 was the dissolve trigger); drop the removed field from the match; drop now-unused Int import.
  • std.realization_reconcile: rename reconcile → reconcile_grounded. Latent bug surfaced by execution: grounding the evidence newly runs the reconcile path inside fleet_host_budget's closure, which also holds std.realization.reconcile(steps) and budget_tree.reconcile — three reconcile fns in one flat namespace. The bare call mis-dispatched (undefined variable steps) until disambiguated. The literal had masked the collision; grounding surfaced it (DESIGN §5). The flat fn namespace itself is the substrate root (operator-steered).

Verified by execution (DESIGN §5)

claim_batch green: runner_placement_holds, oomd_install_grounding_holds, runner_slot_enforcement_grounding_holds, reconcile_share_collapse_witnesses. Posture stays fail-closed (committed read is ReadAbsent → OomdUnverified → live plan UNSOUND); the discriminating witnesses (oomd-unverified → unresolved, enforced+measured → resolved) pass on the threaded param.

🤖 Generated with Claude Code

briansrls and others added 3 commits June 24, 2026 13:30
@briansrls
WIP: CI-humming MANAGER (ROADMAP §4): own the CI-humming plan as sing…
4cd131e 
…le autho
@briansrls
WIP: CI-humming MANAGER (ROADMAP §4): own the CI-humming plan as sing…
ad61fff 
…le autho
@briansrls @claude
CI-humming PR2: ground oomd evidence from the merged gunbc.oomd_insta…
a67e2a5 
…ll seam + de-conflate spec from realization-evidence

The capacity unlock was scoped as a "1-line flip OomdUnverified -> OomdEnforced".
That framing was unsound: there were TWO independent oomd gates, and the one
resolve_session_slice read (the Regime2 mode's oomd_enforcement FIELD) could
never be grounded in place -- gunbc.oomd_install imports ci_floor_measurement,
so a cycle forbids the mode reading the verify seam. Hand-flipping that field to
OomdEnforced would be the DESIGN section 5 anti-pattern (editing a declaration to
green a gate the realization does not back).

De-conflation (DESIGN section 4): the Regime2 mode is pure operating-point SPEC
(ceiling + concurrency + aggregate); oomd enforcement is realization EVIDENCE,
threaded from the SINGLE grounded authority fleet_host_budget.gunbc_fleet_oomd_evidence.
That authority now binds the gunbc.oomd_install seam (gunbc_oomd_fleet_evidence)
over the committed show-effective read, assembling the REGIME-2 thresholds and the
PSI single authority (gunbc_oomd_sessions_policy). It stays OomdUnverified
(fail-closed) until a real ReadObserved grounds the full conjunction; when it does,
BOTH gates (session-slice resolution + host plan) open with no further gunbc edit.

- ci_floor_measurement: drop oomd_enforcement from Regime2AggregateOomd; rewrite
  the keystone marker to the verify-not-validate structure.
- fleet_host_budget: import the oomd_install seam + mode types; ground
  gunbc_fleet_oomd_evidence via gunbc_fleet_oomd_evidence_for(mode).
- ci_runner_placement: resolve_session_slice takes oomd as a threaded param,
  gates on the single authority at all call sites.
- runner_deploy_emit: PSI dissolve-repoint (interim Int 60 -> percent_count of the
  gunbc_oomd_sessions_policy single authority; #5677 was the dissolve trigger);
  drop the removed field from the match; drop now-unused Int import.
- std.realization_reconcile: rename reconcile -> reconcile_grounded. Grounding the
  evidence newly EXECUTES the reconcile path inside fleet_host_budget's closure,
  which also holds std.realization.reconcile(steps) and budget_tree.reconcile --
  three reconcile fns in one flat namespace; the bare call mis-dispatched
  (undefined variable steps) until disambiguated. The literal had MASKED this latent
  collision; grounding surfaced it (DESIGN section 5). Flat fn namespace is the
  substrate root (operator-steered).

Verified by EXECUTION: runner_placement_holds, oomd_install_grounding_holds,
runner_slot_enforcement_grounding_holds, reconcile_share_collapse_witnesses all
PASS via claim_batch. Posture stays fail-closed (committed read is ReadAbsent).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@gunbai-bot gunbai-bot Bot changed the title CI-humming MANAGER (ROADMAP §4): own the CI-humming plan as single authority + PRIORITY-1 safely increase runner capacity on srv1+srv2 ASAP via minimal .dag change (fix build-pool/runner-slice double-count so the model derives sane slots+per-slot-caps, apply verified-effective on both hosts, safe-by CI-humming PR2: ground oomd evidence from the gunbc.oomd_install seam + de-conflate spec from realization-evidence Jun 24, 2026
@gunbai-bot
gunbai-bot Bot marked this pull request as ready for review June 24, 2026 13:46
@gunbai-bot gunbai-bot Bot mentioned this pull request Jun 24, 2026
Closed
briansrls and others added 2 commits June 24, 2026 14:06
@briansrls
WIP: CI-humming MANAGER (ROADMAP §4): own the CI-humming plan as sing…
c88227c 
…le autho
@briansrls @claude
PR2 fix: thread oomd into the missed ci_budget_tree resolve_session_s…
11743da 
…lice call site + regenerate the drifted manifest

Floor caught two consequences of the de-conflation that my local witness subset missed:
- ci_budget_tree.dag:46 (session_pool_bytes_live) is a THIRD resolve_session_slice
  call site, outside ci_runner_placement — it lost the now-required oomd param
  (runtime: undefined variable oomd). Threads gunbc_fleet_oomd_evidence (imported
  from fleet_host_budget; no cycle — fleet_host_budget does not import ci_budget_tree).
  Same fail-closed fallback to host_allocatable_bytes while OomdUnverified.
- The resolve_session_slice UNSOUND reason string changed (oomd_enforcement ->
  gunbc_fleet_oomd_evidence), which flows into the emitted session-reservation
  UNSOUND manifest line. Regenerated .github/fleet-runner-deploy.manifest via
  main_wet (the single authority; no hand-edit).

Verified by execution: ci_budget_tree_holds, runner_placement_holds,
generated_artifact_drift_gate_passes all PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@gunbai-bot gunbai-bot Bot mentioned this pull request Jun 24, 2026
Merged
@briansrls
briansrls merged commit 97a4053 into main Jun 24, 2026
2 checks passed
@briansrls
briansrls deleted the session/sharp-heron-321-pr2-oomd-ground branch June 24, 2026 14:49
briansrls added a commit that referenced this pull request Jun 24, 2026
@briansrls @claude
CI-humming plan re-sequence: apply transport = gunbc-emitted converge…
d528509 
… shell (§2 handler by emission)

Re-apply the post-operator apply-transport redirect into the migrated .dag
authority (dsl/gunbc/plans/ci_humming.dag, post #5727) + regenerate the
docs/plans/ci-humming.md projection:
- T5 reframed: host apply via gunbc-emitted .github/fleet-converge.sh (the §2
  regime-2 Doc-IR projection handler that inhabits the §6 carrier by emission),
  thin ctrl consume/run; supersedes the closed JS reconciler #1803.
- C1: reconcile -> reconcile_grounded (the flat-namespace collision PR2 #5720
  surfaced when grounding newly executed the fn in a closure holding two other
  reconcile fns).
- New "Re-sequence 2026-06-24" section: A (converge emit #5725) / B (thin
  consume/run #1805) / G (membership conjunct #5726) + the fail-closed
  grounding order.

Supersedes the closed #5723 (which edited the .md directly, pre-migration).
Verified green-by-execution: plan-lens (dissolution-trigger + titled) PASS,
read-side generated-artifact drift gate ExitSuccess (disk == projection),
regen idempotent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@briansrls briansrls mentioned this pull request Jun 24, 2026
Merged
briansrls added a commit that referenced this pull request Jun 24, 2026
@gunbai-bot @briansrls @claude
CI-humming plan re-sequence: apply transport = gunbc-emitted converge…
62c746b 
… shell (§2 handler by emission) (#5728)

Re-apply the post-operator apply-transport redirect into the migrated .dag
authority (dsl/gunbc/plans/ci_humming.dag, post #5727) + regenerate the
docs/plans/ci-humming.md projection:
- T5 reframed: host apply via gunbc-emitted .github/fleet-converge.sh (the §2
  regime-2 Doc-IR projection handler that inhabits the §6 carrier by emission),
  thin ctrl consume/run; supersedes the closed JS reconciler #1803.
- C1: reconcile -> reconcile_grounded (the flat-namespace collision PR2 #5720
  surfaced when grounding newly executed the fn in a closure holding two other
  reconcile fns).
- New "Re-sequence 2026-06-24" section: A (converge emit #5725) / B (thin
  consume/run #1805) / G (membership conjunct #5726) + the fail-closed
  grounding order.

Supersedes the closed #5723 (which edited the .md directly, pre-migration).
Verified green-by-execution: plan-lens (dissolution-trigger + titled) PASS,
read-side generated-artifact drift gate ExitSuccess (disk == projection),
regen idempotent.

Co-authored-by: Brian Searls <briansrls@gunb.ai>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@briansrls