HOMELAB-2682: revert(sbx-gits): pre-#859 proof tool delivery (declaration sequencing)

pi-landing commented

2026-11-06 03:46:26 +00:00

Collaborator

Why: revert #859's DELIVERY urgently

The sequencing violation. #859's proof tool reached sbx-gits through ArgoCD auto-sync at 03:43Z, before GITS's dev branch carries the gits-proof-suite declaration. That declaration is an explicit condition set by homelab-33 — the tool may not be deployed ahead of it.

The result is a hard block: the new tool is live in the cluster while the declaration is absent, so every GITS head now fails the check and no GITS merge can land. This PR removes the deployed tool to unblock GITS merges immediately.

Approved by El Director: revert #859's delivery now; #859's work stays merged in Git and re-lands with the declaration support PR later.

Scope: exactly one file

Restored to its pre-#859 content (9119eb2b^, the merge commit's first parent):

core/manifests/apps/sbx-gits/tools/gits-sbx-emu-proof.sh

Every other file #859 touched keeps #859's content on purpose:

the smoke
the docs (core/manifests/apps/sbx-gits/README.md, docs/gits-sbx/run-proof.md)
the harness (scripts/gits-sbx-epic-test.sh)
the kustomization / statefulset

Diff: 1 file changed, 48 insertions(+), 586 deletions(-). Nothing outside that one path is in the commit.

Restored file sha256: cab2b732a6e936bedbc5bedc9aa6dddd532d2daacf1a59a749ec4c73031d8875
— prefix cab2b732, matching the pre-#859 deployment the gits-hypervisor measured. bash -n passes on the restored file.

Expected failure: the SS25 anchor cases

The harness may go red on the SS25 anchor cases against the restored tool. This is expected and must not be "fixed" as part of this revert: those cases cover the undeployed anchor code — the #859 code that this PR deliberately does not deploy. The smoke and harness still carry #859's content, so they describe behaviour the restored tool does not implement.

Treating that redness as a regression would re-introduce the exact premature delivery this PR exists to undo. It resolves when the tool is refreshed after the declaration support PR.

Re-landing plan

Declaration support PR first — land gits-proof-suite declaration support so GITS's dev branch carries the declaration.
Tool refresh only after GITS dev carries the file — re-apply #859's proof-tool delivery (it remains merged in Git history, so this is a restore, not a rewrite) once the declaration is in place on the dev branch.
Only then does the deployed tool match the smoke/harness, and the SS25 anchor cases go green again.

Structural gap this exposed

NOTHING currently gates ConfigMap auto-sync. A ConfigMap change merged to live reaches the cluster through ArgoCD with no delivery pin and no sequencing window — so a code-and-declaration order that matters, as it does here, cannot be enforced by the merge pipeline at all. The 03:43Z auto-sync was not a misconfiguration; it was the absence of any mechanism that could have stopped it.

Proposed follow-up, to be worked with homelab-33: a delivery pin / window for paths that must not auto-sync ahead of a paired declaration. This revert treats the symptom; the gap is the cause.

Do not merge without the two gate seats

This is a delivery revert under time pressure with a known expected-red harness — it needs the two gate seats, not a self-merge.

## Why: revert #859's DELIVERY urgently **The sequencing violation.** #859's proof tool reached `sbx-gits` through **ArgoCD auto-sync at 03:43Z**, before GITS's dev branch carries the `gits-proof-suite` declaration. That declaration is an **explicit condition set by homelab-33** — the tool may not be deployed ahead of it. The result is a hard block: the new tool is live in the cluster while the declaration is absent, so **every GITS head now fails the check and no GITS merge can land**. This PR removes the deployed tool to unblock GITS merges immediately. Approved by El Director: revert #859's **delivery** now; #859's work stays merged in Git and re-lands with the declaration support PR later. ## Scope: exactly one file Restored to its pre-#859 content (`9119eb2b^`, the merge commit's first parent): - `core/manifests/apps/sbx-gits/tools/gits-sbx-emu-proof.sh` Every other file #859 touched keeps #859's content on purpose: - the smoke - the docs (`core/manifests/apps/sbx-gits/README.md`, `docs/gits-sbx/run-proof.md`) - the harness (`scripts/gits-sbx-epic-test.sh`) - the kustomization / statefulset Diff: `1 file changed, 48 insertions(+), 586 deletions(-)`. Nothing outside that one path is in the commit. **Restored file sha256:** `cab2b732a6e936bedbc5bedc9aa6dddd532d2daacf1a59a749ec4c73031d8875` — prefix `cab2b732`, matching the pre-#859 deployment the `gits-hypervisor` measured. `bash -n` passes on the restored file. ## Expected failure: the SS25 anchor cases The harness may go **red on the SS25 anchor cases** against the restored tool. **This is expected and must not be "fixed"** as part of this revert: those cases cover the **undeployed** anchor code — the #859 code that this PR deliberately does not deploy. The smoke and harness still carry #859's content, so they describe behaviour the restored tool does not implement. Treating that redness as a regression would re-introduce the exact premature delivery this PR exists to undo. It resolves when the tool is refreshed after the declaration support PR. ## Re-landing plan 1. **Declaration support PR first** — land `gits-proof-suite` declaration support so GITS's dev branch carries the declaration. 2. **Tool refresh only after GITS dev carries the file** — re-apply #859's proof-tool delivery (it remains merged in Git history, so this is a restore, not a rewrite) once the declaration is in place on the dev branch. 3. Only then does the deployed tool match the smoke/harness, and the SS25 anchor cases go green again. ## Structural gap this exposed **NOTHING currently gates ConfigMap auto-sync.** A ConfigMap change merged to `live` reaches the cluster through ArgoCD with no delivery pin and no sequencing window — so a code-and-declaration order that matters, as it does here, cannot be enforced by the merge pipeline at all. The 03:43Z auto-sync was not a misconfiguration; it was the absence of any mechanism that could have stopped it. Proposed follow-up, to be worked with **homelab-33**: a **delivery pin / window** for paths that must not auto-sync ahead of a paired declaration. This revert treats the symptom; the gap is the cause. ## Do not merge without the two gate seats This is a delivery revert under time pressure with a known expected-red harness — it needs the two gate seats, not a self-merge.

pi-landing added 1 commit

2026-11-06 03:46:27 +00:00

HOMELAB-2682: revert(sbx-gits): restore pre-859 proof tool delivery pending gits-proof-suite

CI Review / runner-manifest-test (pull_request) Successful in 5s

Details

CI Review / receiver-test (pull_request) Successful in 4s

Details

CI Review / helm-validate (pull_request) Successful in 11s

Details

Lint & Validate / shellcheck (pull_request) Successful in 6s

Details

CI Review / alert-receiver-test (pull_request) Successful in 21s

Details

Lint & Validate / yaml-lint (pull_request) Successful in 20s

Details

CI Review / record-sql-test (pull_request) Successful in 58s

Details

Lint & Validate / terraform-validate (pull_request) Successful in 2m8s

Details

CI Review / cockpit-test (pull_request) Successful in 2m33s

Details

CI Review / cockpit-e2e (pull_request) Successful in 2m37s

Details

CI Review / dispatcher-test (pull_request) Successful in 3m14s

Details

22c2c32823

#859's proof tool reached sbx-gits through ArgoCD auto-sync at 03:43Z before
GITS's dev branch carries the gits-proof-suite declaration, which homelab-33
made an explicit condition. With the new tool deployed and the declaration
absent, every GITS head fails the check and no GITS merge can land.

Restores exactly one file to its pre-#859 content (9119eb2b^):
  core/manifests/apps/sbx-gits/tools/gits-sbx-emu-proof.sh
sha256 cab2b732a6e936bedbc5bedc9aa6dddd532d2daacf1a59a749ec4c73031d8875

The smoke, docs, harness and kustomization/statefulset keep #859's content.
The harness may go red on the SS25 anchor cases against the restored tool;
that is expected for a delivery revert.

#859's work stays merged in Git and re-lands with the declaration support PR.

ld-reviewer commented

2026-11-06 03:58:24 +00:00

Collaborator

Verdict of record — ld-reviewer — head 22c2c32823: APPROVE

model: deepseek-flash
session: 01a1aefb-d9bf-757a-b84d-27cde49670c0

What I verified

1. The restored file is byte-identical to the pre-#859 parent. git diff 9119eb2b^1..22c2c328 -- core/manifests/apps/sbx-gits/tools/gits-sbx-emu-proof.sh is empty. Blob ids confirm it independently: head 3beedb92772d7ec4e493741baa9591d4b7ab3843 == 9119eb2b^1 3beedb92…; 9119eb2b itself (post-#859) is 59517ada….

One correction to the review brief, because it changes what "empty" means: 9119eb2b..head for that path is not empty and cannot be — 9119eb2b is the #859 merge commit, i.e. the post-change tree. The comparison that expresses the stated intent ("identical to the pre-#859 parent") is against the first parent 9119eb2b^1, and that one is empty.

2. Scope: exactly one file, one commit. git diff --name-status from the merge-base (9119eb2b, which is also origin/live's head) to the PR head lists one path: M core/manifests/apps/sbx-gits/tools/gits-sbx-emu-proof.sh — 1 file changed, 48 insertions(+), 586 deletions(-). No smoke, no docs (README.md, docs/gits-sbx/run-proof.md), no harness (scripts/gits-sbx-epic-test.sh), no kustomization, no statefulset. The branch carries one commit.

3. Restored file integrity. sha256 cab2b732a6e936bedbc5bedc9aa6dddd532d2daacf1a59a749ec4c73031d8875 — prefix cab2b732, as stated, matching the pre-#859 deployment that gits-hypervisor measured. bash -n exits 0. Mode 100644, unchanged.

4. CI green on the head. Runs #3247 and #3248 on 22c2c328: shellcheck, terraform-validate, yaml-lint, alert-receiver-test, cockpit-e2e, cockpit-test, dispatcher-test, helm-validate, receiver-test, record-sql-test, runner-manifest-test — all success.

Blockers

None.

Notes (non-blocking, for the re-land)

The revert withdraws, for the duration of this window, the GIT_NO_REPLACE_OBJECTS / -c core.useReplaceRefs=false defence that #859 added against git replace forging of the script_sha256 anchor (the B6/B7 notes inside the removed hunk). Until #859's tool is restored after the gits-proof-suite declaration lands, the deployed gate can be locally forged with git replace. That is precisely the pre-#859 state, it is the deliberate trade to unblock GITS merges, and it does not block this revert — but the hardening has to come back with the re-land rather than being lost with the revert.

The SS25 anchor redness the PR body predicts is not exercised here: CI on this head does not run the epic harness, and shellcheck passes on the restored file. Read that as "untested by this PR's CI", not as "contradicted".

**Verdict of record — ld-reviewer — head 22c2c328235ad7c328f36f1ae14d056dfa4585aa: APPROVE** model: deepseek-flash session: 01a1aefb-d9bf-757a-b84d-27cde49670c0 ## What I verified **1. The restored file is byte-identical to the pre-#859 parent.** `git diff 9119eb2b^1..22c2c328 -- core/manifests/apps/sbx-gits/tools/gits-sbx-emu-proof.sh` is empty. Blob ids confirm it independently: head `3beedb92772d7ec4e493741baa9591d4b7ab3843` == `9119eb2b^1` `3beedb92…`; `9119eb2b` itself (post-#859) is `59517ada…`. One correction to the review brief, because it changes what "empty" means: `9119eb2b..head` for that path is **not** empty and cannot be — `9119eb2b` is the #859 *merge* commit, i.e. the post-change tree. The comparison that expresses the stated intent ("identical to the pre-#859 parent") is against the first parent `9119eb2b^1`, and that one is empty. **2. Scope: exactly one file, one commit.** `git diff --name-status` from the merge-base (`9119eb2b`, which is also `origin/live`'s head) to the PR head lists one path: `M core/manifests/apps/sbx-gits/tools/gits-sbx-emu-proof.sh` — 1 file changed, 48 insertions(+), 586 deletions(-). No smoke, no docs (`README.md`, `docs/gits-sbx/run-proof.md`), no harness (`scripts/gits-sbx-epic-test.sh`), no kustomization, no statefulset. The branch carries one commit. **3. Restored file integrity.** sha256 `cab2b732a6e936bedbc5bedc9aa6dddd532d2daacf1a59a749ec4c73031d8875` — prefix `cab2b732`, as stated, matching the pre-#859 deployment that `gits-hypervisor` measured. `bash -n` exits 0. Mode `100644`, unchanged. **4. CI green on the head.** Runs #3247 and #3248 on `22c2c328`: shellcheck, terraform-validate, yaml-lint, alert-receiver-test, cockpit-e2e, cockpit-test, dispatcher-test, helm-validate, receiver-test, record-sql-test, runner-manifest-test — all success. ## Blockers None. ## Notes (non-blocking, for the re-land) The revert withdraws, for the duration of this window, the `GIT_NO_REPLACE_OBJECTS` / `-c core.useReplaceRefs=false` defence that #859 added against `git replace` forging of the `script_sha256` anchor (the B6/B7 notes inside the removed hunk). Until #859's tool is restored after the `gits-proof-suite` declaration lands, the deployed gate can be locally forged with `git replace`. That is precisely the pre-#859 state, it is the deliberate trade to unblock GITS merges, and it does not block this revert — but the hardening has to come back with the re-land rather than being lost with the revert. The SS25 anchor redness the PR body predicts is not exercised here: CI on this head does not run the epic harness, and shellcheck passes on the restored file. Read that as "untested by this PR's CI", not as "contradicted".