Repository navigation
CI-humming: model the oomd membership conjunct - sessions parented into slice AND non-empty AND not-100-percent-legacy - and DEFINE the membership-signal contract the guard consumes, fail-closed; extends gunbc.oomd_install grounding, model-first off critical path - #5726
Merged
Merged
Conversation
…uard
Adds `SliceMembershipSignal { sessions_in_slice, sessions_legacy_flat }` as
the typed contract the OomdEnforced grounding guard consumes. The three
membership properties (parented-into-slice / non-empty / not-100%-legacy)
all reduce to `sessions_in_slice > 0` — making them three separate
grounding checks would be a §3/§5 violation (unreachable failure arms).
`membership_grounding_check` is one check with a nested discriminator that
produces distinct failure messages for the 100%-legacy vs empty-host cases.
`OomdEffectiveRead` gains the `membership` field; `grounding_checks` is now
9 elements. Witness test updated with 7 new discriminating witnesses (pass,
partial-migration, fail-all-legacy, fail-empty-host, and end-to-end reads).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove oomd_membership_conjunct_doc data node (§6 parallel-ledger-doc
violation: unconsumed String value storing design rationale that belongs
in the PR, not the substrate)
- SliceMembershipSignal fields Int -> Nat (session cgroup child counts are
cardinal; Nat prevents negative values from being writable, §5 construction
over validation; Nat supports > / < directly, > 0 guard is unchanged)
- Add import std.nat { Nat }
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Int was added when SliceMembershipSignal fields were Int; the Nat switch in ba636f2 left it unreferenced. Remove the stale import. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Jun 24, 2026
… (regime-2 Doc-IR) Closes the e2e charter gap B (the fabric OPERATION was off-fabric hand-run shell, no repo artifact): model the host-converge policy as uniform ConvergeKnob rows and project .github/fleet-converge.sh, the regime-2 (emit-only) apply-script that converges each fleet host and emits converge-receipt lines for fierce-carp-462's ctrl reconciler. - gunbc.host_converge: ConvergeKnob rows fold cpu_weight + build_tokens beside the memory caps (one concept, every knob a row); ConvergeTarget is the per-knob apply/read realization (slice set-property / per-slot drop-in+set-property / runner-width drain-stop / jobserver env+restart / verify-only). All desired values pulled from the single authorities (no new literals). converge_verdict is the single verdict authority. - gunbc.fleet_converge_emit: std.layout Doc/render projection (same path as the manifest, not a bash-AST sidecar). Fail-closed: an unsound plan projects exit-1 (committed today, since the runner plan is RunnerSlotUnenforced). Grounded mechanisms signed by fierce-carp from the retiring deploy-runner-fleet-width.sh; per_session is verify-only. - Receipt grammar FROZEN v1 with fierce-carp: per-knob + summary + sessions-membership (stern-dove #5726 OomdEnforced conjunct). verdict converged=>Converged, drifted/absent=>NotConverged. - Registered FleetConvergeArtifact under the generate/commit/drift gate. - Witness fleet_converge_emit_holds: emits + discriminating drift-red (perturbed effective flips Converged->Drifted; empty=>Absent) + structural coverage, green-by-exec. - Regenerated .github/fleet-runner-deploy.manifest (stale PR2 reason-string drift). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Jun 24, 2026
… shell (§2 handler by emission) Re-apply the post-operator apply-transport redirect into the migrated .dag authority (dsl/gunbc/plans/ci_humming.dag, post #5727) + regenerate the docs/plans/ci-humming.md projection: - T5 reframed: host apply via gunbc-emitted .github/fleet-converge.sh (the §2 regime-2 Doc-IR projection handler that inhabits the §6 carrier by emission), thin ctrl consume/run; supersedes the closed JS reconciler #1803. - C1: reconcile -> reconcile_grounded (the flat-namespace collision PR2 #5720 surfaced when grounding newly executed the fn in a closure holding two other reconcile fns). - New "Re-sequence 2026-06-24" section: A (converge emit #5725) / B (thin consume/run #1805) / G (membership conjunct #5726) + the fail-closed grounding order. Supersedes the closed #5723 (which edited the .md directly, pre-migration). Verified green-by-execution: plan-lens (dissolution-trigger + titled) PASS, read-side generated-artifact drift gate ExitSuccess (disk == projection), regen idempotent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Jun 24, 2026
…a regime-2 Doc-IR projection, fold cpu_weight and build_tokens as rows, byte-lock receipt grammar with fierce-carp (#5725) * WIP: CI-humming MANAGER (ROADMAP §4): own the CI-humming plan as single autho * WIP: CI-humming MANAGER (ROADMAP §4): own the CI-humming plan as single autho * CI-humming PR2: ground oomd evidence from the merged gunbc.oomd_install seam + de-conflate spec from realization-evidence The capacity unlock was scoped as a "1-line flip OomdUnverified -> OomdEnforced". That framing was unsound: there were TWO independent oomd gates, and the one resolve_session_slice read (the Regime2 mode's oomd_enforcement FIELD) could never be grounded in place -- gunbc.oomd_install imports ci_floor_measurement, so a cycle forbids the mode reading the verify seam. Hand-flipping that field to OomdEnforced would be the DESIGN section 5 anti-pattern (editing a declaration to green a gate the realization does not back). De-conflation (DESIGN section 4): the Regime2 mode is pure operating-point SPEC (ceiling + concurrency + aggregate); oomd enforcement is realization EVIDENCE, threaded from the SINGLE grounded authority fleet_host_budget.gunbc_fleet_oomd_evidence. That authority now binds the gunbc.oomd_install seam (gunbc_oomd_fleet_evidence) over the committed show-effective read, assembling the REGIME-2 thresholds and the PSI single authority (gunbc_oomd_sessions_policy). It stays OomdUnverified (fail-closed) until a real ReadObserved grounds the full conjunction; when it does, BOTH gates (session-slice resolution + host plan) open with no further gunbc edit. - ci_floor_measurement: drop oomd_enforcement from Regime2AggregateOomd; rewrite the keystone marker to the verify-not-validate structure. - fleet_host_budget: import the oomd_install seam + mode types; ground gunbc_fleet_oomd_evidence via gunbc_fleet_oomd_evidence_for(mode). - ci_runner_placement: resolve_session_slice takes oomd as a threaded param, gates on the single authority at all call sites. - runner_deploy_emit: PSI dissolve-repoint (interim Int 60 -> percent_count of the gunbc_oomd_sessions_policy single authority; #5677 was the dissolve trigger); drop the removed field from the match; drop now-unused Int import. - std.realization_reconcile: rename reconcile -> reconcile_grounded. Grounding the evidence newly EXECUTES the reconcile path inside fleet_host_budget's closure, which also holds std.realization.reconcile(steps) and budget_tree.reconcile -- three reconcile fns in one flat namespace; the bare call mis-dispatched (undefined variable steps) until disambiguated. The literal had MASKED this latent collision; grounding surfaced it (DESIGN section 5). Flat fn namespace is the substrate root (operator-steered). Verified by EXECUTION: runner_placement_holds, oomd_install_grounding_holds, runner_slot_enforcement_grounding_holds, reconcile_share_collapse_witnesses all PASS via claim_batch. Posture stays fail-closed (committed read is ReadAbsent). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: CI-humming: model host-converge policy and emit fleet-converge.sh as a r * WIP: CI-humming: model host-converge policy and emit fleet-converge.sh as a r * CI-humming gap-B: model host-converge policy + emit fleet-converge.sh (regime-2 Doc-IR) Closes the e2e charter gap B (the fabric OPERATION was off-fabric hand-run shell, no repo artifact): model the host-converge policy as uniform ConvergeKnob rows and project .github/fleet-converge.sh, the regime-2 (emit-only) apply-script that converges each fleet host and emits converge-receipt lines for fierce-carp-462's ctrl reconciler. - gunbc.host_converge: ConvergeKnob rows fold cpu_weight + build_tokens beside the memory caps (one concept, every knob a row); ConvergeTarget is the per-knob apply/read realization (slice set-property / per-slot drop-in+set-property / runner-width drain-stop / jobserver env+restart / verify-only). All desired values pulled from the single authorities (no new literals). converge_verdict is the single verdict authority. - gunbc.fleet_converge_emit: std.layout Doc/render projection (same path as the manifest, not a bash-AST sidecar). Fail-closed: an unsound plan projects exit-1 (committed today, since the runner plan is RunnerSlotUnenforced). Grounded mechanisms signed by fierce-carp from the retiring deploy-runner-fleet-width.sh; per_session is verify-only. - Receipt grammar FROZEN v1 with fierce-carp: per-knob + summary + sessions-membership (stern-dove #5726 OomdEnforced conjunct). verdict converged=>Converged, drifted/absent=>NotConverged. - Registered FleetConvergeArtifact under the generate/commit/drift gate. - Witness fleet_converge_emit_holds: emits + discriminating drift-red (perturbed effective flips Converged->Drifted; empty=>Absent) + structural coverage, green-by-exec. - Regenerated .github/fleet-runner-deploy.manifest (stale PR2 reason-string drift). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * host_converge: record runner/sessions coupling DECISION (accept v1, split=grammar-v2 follow-up) fierce-carp-462 verified the real emit (22/22 green-by-exec) and surfaced the coupling: runner + sessions knobs + membership fold into one HostConverge/host_summary, so pre-#1804 membership=absent HOLDs the whole host (incl. runner-width) and re-runs idempotently until the slice populates. Accepted for v1 (idempotent, width still applies each pass, the window doesn't exist yet); the independent-settle SPLIT is a named follow-up gated on a receipt-grammar v2. Marker only; emitted artifact unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * host_converge: refine coupling marker to sharp-heron's 3-way grounding-target split (T1 caps / T2 membership / T3 runner-plan) Manager input: the §4 end-state split is by grounding-condition, not just runner-vs-sessions: sessions-CAPS settle independently of sessions-MEMBERSHIP (#1804-gated) and runner-plan. v1-coupled stays the shipped choice (decoupling membership WITHOUT a fingerprint split would be fail-open: host fingerprints converged while sessions.slice has no members for oomd to evict). Marker only; artifact byte-identical. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: CI-humming: model host-converge policy and emit fleet-converge.sh as a r --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Jun 24, 2026
… shell (§2 handler by emission) (#5728) Re-apply the post-operator apply-transport redirect into the migrated .dag authority (dsl/gunbc/plans/ci_humming.dag, post #5727) + regenerate the docs/plans/ci-humming.md projection: - T5 reframed: host apply via gunbc-emitted .github/fleet-converge.sh (the §2 regime-2 Doc-IR projection handler that inhabits the §6 carrier by emission), thin ctrl consume/run; supersedes the closed JS reconciler #1803. - C1: reconcile -> reconcile_grounded (the flat-namespace collision PR2 #5720 surfaced when grounding newly executed the fn in a closure holding two other reconcile fns). - New "Re-sequence 2026-06-24" section: A (converge emit #5725) / B (thin consume/run #1805) / G (membership conjunct #5726) + the fail-closed grounding order. Supersedes the closed #5723 (which edited the .md directly, pre-migration). Verified green-by-execution: plan-lens (dissolution-trigger + titled) PASS, read-side generated-artifact drift gate ExitSuccess (disk == projection), regen idempotent. Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-opened by session-dashboard for session
stern-dove-499.Pushing to
session/stern-dove-499advances this PR.Worker attestation
Before flipping this PR to ready for review, confirm each item:
npm test,cargo test) and the result.Closes #Ndirective.Summary
TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.
Test plan