Repository navigation
Unfuse collect_fleet_convergence (a READ) from the push-only writes - #8100
Merged
Merged
Conversation
collect_fleet_convergence collects host receipts and folds a verdict — it is a READ. In the consolidated fleet job it inherited the push-only guard that correctly protects the WRITES (deploy dashboard, advance refs/fleet/desired), so it could only run on a main push whose ci floor went green. Two consecutive main pushes hit the cold whole-corpus floor over-budget (fail-closed at ~55min, entry 852/1062, swap 14.5 GiB on srv1), so the fleet job skipped on every one and the collector had zero executions — items 3 (per-host receipts) and 5 (the fold) never ran. Repair: admit the collector on workflow_dispatch as well as push (ci_fleet_collect_read_if). Deploy and advance are UNCHANGED — they stay push-only (ci_fleet_convergence_write_if), so a censored/red floor can never let a write run. This is not a weakening of the gate; it unfuses observing fleet state from changing it. A dispatch-collected fold describes state relative to the CURRENT refs/fleet/desired (not the dispatched head), so it never advances anything and never stands in for a green-floor acceptance. Discriminating control: witness_collector_read_unfused_from_writes reds if the collector reverts to push-only OR if either write leaks onto dispatch. Green by execution (PASS locally). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168R31q15ZsPJyik18Roz3y
1 of 2 tasks
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 10, 2026
The revert's one conflict was .github/workflows/ci.yml, a GENERATED artifact. Resolving it by taking the revert side of the hunk silently reverted one line of #8100 as well: collect_fleet_convergence (a READ) lost its `|| github.event_name == 'workflow_dispatch'` arm, re-fusing the read to the push-only writes that #8100 had just unfused. A content spot-check did not catch it. I checked that #8095's floor-phase-journal additions survived and that #8055's interpreter-parity step was gone, and both were true — but verifying the markers you think of is not verifying the file. For a derived artifact the generator is the authority and regeneration IS the resolution; a spot-check only samples it. Regenerated from the reverted sources: one line, restoring #8100's arm. The tree now equals generator output, so the drift gate has nothing to say. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Aug 10, 2026
main gained three commits while this PR sat, one of which (#8099, the P3 ClassificationCostStanding A/B harness) exists solely to measure #8055's mechanism AND depends on its code: LiveReadSelectionContext at six sites, the classification invocation/production counters, and a new p3_cohort_probe bin. So reverting #8055 alone leaves main not compiling. Three readings and only one is coherent: keep #8099, drop the revert -> main stays red revert #8055 only -> main does not compile revert both -> the harness loses its subject with it Took the third. It is forced, not chosen: no resolution keeps #8099 and removes #8055. Resolution discipline, from this PR's own earlier ci.yml lesson: - resolved HUNK BY HUNK, not `checkout --ours`. #8102 also touched cli_run.rs and merged cleanly outside the conflict regions; a whole-file take would have silently dropped its 84 lines, which is exactly how #8100 was lost earlier today. - the p3_cohort_probe bin arrived with NO conflict, so nothing flagged it. Found by grepping for dangling references to the removed symbols after resolving. A clean merge is not evidence. - #8099's selection_control_incident_subject_roster sits outside the conflict regions and SURVIVES: it is a shared authority extraction, not #8055 machinery. Oracle: cargo build --release -p v1-compiler --bins, exit 0, 3m30s. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
briansrls
pushed a commit
that referenced
this pull request
Aug 10, 2026
…tions, redding main (#8104) * Revert "Consume the G2 live-read manifest at every selection decision; land group_by and execute the interpreter-parity controls CI only compiled (#8055)" This reverts commit 7f7da93. * Regenerate ci.yml: the hand-picked conflict side had dropped #8100 The revert's one conflict was .github/workflows/ci.yml, a GENERATED artifact. Resolving it by taking the revert side of the hunk silently reverted one line of #8100 as well: collect_fleet_convergence (a READ) lost its `|| github.event_name == 'workflow_dispatch'` arm, re-fusing the read to the push-only writes that #8100 had just unfused. A content spot-check did not catch it. I checked that #8095's floor-phase-journal additions survived and that #8055's interpreter-parity step was gone, and both were true — but verifying the markers you think of is not verifying the file. For a derived artifact the generator is the authority and regeneration IS the resolution; a spot-check only samples it. Regenerated from the reverted sources: one line, restoring #8100's arm. The tree now equals generator output, so the drift gate has nothing to say. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Restore two stale citations the blanket revert reintroduced Reverting #8055 wholesale brought back text #8055 had independently corrected, in two authority carriers: - gunbc.ci_layer_roots falsifier_rehomed_bin_wet_rows: the floor_skip_discovery row's reason claimed the row duplicates the ci job's per-PR 'Affected-set selection control' step. #7446 demoted that step to the falsifier cadence, so the per-PR coverage it cites stopped existing. Restored origin/main's corrected reason verbatim. The 289s measured wall carries the rehome on its own. - v2.test.lens_enforcement.gate_test live_tree_disposition_note cited LIVE_READ_CARRIER_HOME_MODULES_V0, a name that resolves nowhere; the live symbol live_read_carrier_homes_v0 survived the revert. Found by deriving the check set (mixed +/- hunks vs origin/main) rather than stopping at the reported instance. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Small, one-guard repair on the consolidated
fleetjob. Deploy and advance are unchanged — this does NOT touch them, and it is not a weakening of the gate.What and why
collect_fleet_convergenceis a READ: it collects host receipts over the typed SSH seam and folds the fleet verdict. In the consolidated fleet job (#8083) it carried the push-only guard that correctly protects the WRITES —deploy dashboardandadvance refs/fleet/desired. So the collector could only run on a main push whosecifloor went green.Two consecutive main pushes (
32708d28,f9508df2) hit the cold whole-corpus floor over-budget — a fail-closed refusal at the 55-minute ordinary budget, entry 852/1062 in discovery, memory 7.8 GiB + swap 14.5 GiB on srv1. No witness REDed; it was structural over-budget under memory pressure (the known floor-cost / five-minute-CI-gate lane). Becausecifailed, the fleet job skipped correctly via itsneeds.ci.result == 'success'guard — so the collector had zero executions, and the CONVERGE receipt items 3 (per-host receipts) and 5 (the fold) never ran.The change
Admit the collector on
workflow_dispatchas well aspush(ci_fleet_collect_read_if). Deploy and advance keepci_fleet_convergence_write_if=github.event_name == 'push'— unchanged. A censored/red floor can never let a write run.This unfuses observing fleet state from changing it. It does not let CONVERGE proceed on a censored floor: a dispatch-collected fold describes state relative to the current
refs/fleet/desired, not the dispatched head, so it advances nothing and never stands in for a green-floor acceptance.Evidence
witness_collector_read_unfused_from_writes(inci_deploy_witness_test.dag) is two-directional: it reds if the collector reverts to push-only (re-fusing read to write gate) OR if either write leaks ontoworkflow_dispatch. Green by execution — PASS locally.ci.ymlregenerated: Deployif: push, Collectif: push || workflow_dispatch, Advanceif: push.