ld-stopnow: chore(sbx-fleet): bump ld-fleet base to go-234dfd0 (carries HOMELAB-2700 S1) #897

Merged

pi-landing merged 2 commits from plane/ld-stopnow-sbxfleet-base2 into live 2026-11-09 02:32:20 +00:00

Conversation 2 Commits 2 Files changed 2 +2 -2

pi-landing commented 2026-11-09 02:25:30 +00:00

Collaborator

Copy link

sbx-fleet base bump: ld-fleet go-89b900d → go-234dfd0 (H5c step a)

Changes ONLY ARG LD_FLEET_IMAGE in core/manifests/apps/sbx-fleet/Dockerfile:

- harbor.aaron.reynoza.org/ld-target/ld-fleet:go-89b900d@sha256:9b8578a57b…
+ harbor.aaron.reynoza.org/ld-target/ld-fleet:go-234dfd0@sha256:a5763f7e6a…

The new base is the go fleet image built (lab-director fleet-image.yaml run 12998, pushed 2026-11-09T01:28Z) from lab-director merge 234dfd0bdee76bf11eb355e64bb3e2fab0e64bc2 (PR #295, HOMELAB-2700 S1). This is step (a) of the documented chain (Dockerfile H5c): after this merges, CI publishes platform/sbx-fleet:<sha> on live, and the sbx-lab StatefulSet tag@digest bump is the separate follow-up PR. sbx-gits is untouched.

What the bump ships: lab-director 89b900d1..234dfd0b (13 commits)

Authorship: the commits authored as 'Aaron Reynoza' were pushed by the mgmt session-tag orchestrator using Aaron's git login, not by Aaron himself; 'pi-landing'/'pi-worker' commits are the landing/worker identities.

• 234dfd0bdee7 | pi-landing | Merge PR 'HOMELAB-2700: feat(fleet): x-omniroute-session-id tag on sandbox pi (S1 sbx-lab)' (#295)
• f2fca5ebc2d5 | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): merge live into ldv0/ld-sessiontag-s1 (live@04d26c79)
• 14411541afae | pi-worker | ldv0(sessiontag): fix(fleet): load the pinned extension through --no-extensions
• ef83e9bf6fc3 | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): pin LD_POOL_INSTANCE in unconfigured tag cases (S1 CI r2)
• 0e6fdf928b75 | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): scrub HOSTNAME in session-tag floor cases (S1 CI)
• ae29e177074e | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): a pane the supervisor starts still tags its call
• 81b48a491406 | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): fix(fleet): the session tag never fails a call (S1, 2b)
• 1c730837c780 | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): feat(fleet): x-omniroute-session-id tag on sandbox pi (S1 sbx-lab)
• 04d26c791368 | pi-landing | Merge PR 'HOMELAB-88: add kmca/k3.1-pro to pi models template' (#294)
• c20155f3188a | pi-landing | HOMELAB-88: feat(fleet): add kmca/k3.1-pro to pi models template
• 1b7b71761fb2 | pi-landing | Merge PR 'HOMELAB-2338: fix(fleet): the auditor never resumes a prior event across a restart'
• 66f279f6a5ef | Aaron Reynoza (mgmt orchestrator) | Merge remote-tracking branch 'origin/live' into plane/HOMELAB-2338-macro-resume
• e6391bcdfdfa | Aaron Reynoza (mgmt orchestrator) | HOMELAB-2338: fix(fleet): the auditor never resumes a prior event across a restart

Beyond S1, reviewers must weigh HOMELAB-88 (new kmca/k3.1-pro model in the sandbox pi template — new egress/spend surface) and HOMELAB-2338 (auditor resume-across-restart behaviour change in ld-init-pool/ld-claude-pane).

Author of this commit: pi-landing (orchestrator; non-Aaron per El Director ruling).

---

Supersedes #896 (closed): that branch was cut from a stale pre-#895 live by
orchestrator error and its diff reverted #895; this branch is cut from current
live (e67cbbe, includes #895) and changes exactly the same two pin strings. Seat
comment 23637 on #896 caught the revert — credited in the record.

This PR also updates the pin string in .forgejo/workflows/sbx-fleet-image-build.yaml
(the 'Assert Dockerfile pins' grep, measured by homelab-88 as the cause of #896's
deterministic 4s CI failure). Two prose comments still naming go-89b900d (workflow
header, Dockerfile header) are deliberately untouched: the assert greps the full
tag@digest string only.

# sbx-fleet base bump: ld-fleet go-89b900d → go-234dfd0 (H5c step a) Changes ONLY `ARG LD_FLEET_IMAGE` in `core/manifests/apps/sbx-fleet/Dockerfile`: ``` - harbor.aaron.reynoza.org/ld-target/ld-fleet:go-89b900d@sha256:9b8578a57b… + harbor.aaron.reynoza.org/ld-target/ld-fleet:go-234dfd0@sha256:a5763f7e6a… ``` The new base is the `go` fleet image built (lab-director `fleet-image.yaml` run 12998, pushed 2026-11-09T01:28Z) from lab-director merge `234dfd0bdee76bf11eb355e64bb3e2fab0e64bc2` (PR #295, HOMELAB-2700 S1). This is step (a) of the documented chain (Dockerfile H5c): after this merges, CI publishes `platform/sbx-fleet:<sha>` on live, and the sbx-lab StatefulSet `tag@digest` bump is the separate follow-up PR. **sbx-gits is untouched.** ## What the bump ships: lab-director 89b900d1..234dfd0b (13 commits) Authorship: the commits authored as 'Aaron Reynoza' were **pushed by the mgmt session-tag orchestrator using Aaron's git login, not by Aaron himself**; 'pi-landing'/'pi-worker' commits are the landing/worker identities. - `234dfd0bdee7` | pi-landing | Merge PR 'HOMELAB-2700: feat(fleet): x-omniroute-session-id tag on sandbox pi (S1 sbx-lab)' (#295) - `f2fca5ebc2d5` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): merge live into ldv0/ld-sessiontag-s1 (live@04d26c79) - `14411541afae` | pi-worker | ldv0(sessiontag): fix(fleet): load the pinned extension through --no-extensions - `ef83e9bf6fc3` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): pin LD_POOL_INSTANCE in unconfigured tag cases (S1 CI r2) - `0e6fdf928b75` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): scrub HOSTNAME in session-tag floor cases (S1 CI) - `ae29e177074e` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): a pane the supervisor starts still tags its call - `81b48a491406` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): fix(fleet): the session tag never fails a call (S1, 2b) - `1c730837c780` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): feat(fleet): x-omniroute-session-id tag on sandbox pi (S1 sbx-lab) - `04d26c791368` | pi-landing | Merge PR 'HOMELAB-88: add kmca/k3.1-pro to pi models template' (#294) - `c20155f3188a` | pi-landing | HOMELAB-88: feat(fleet): add kmca/k3.1-pro to pi models template - `1b7b71761fb2` | pi-landing | Merge PR 'HOMELAB-2338: fix(fleet): the auditor never resumes a prior event across a restart' - `66f279f6a5ef` | Aaron Reynoza (mgmt orchestrator) | Merge remote-tracking branch 'origin/live' into plane/HOMELAB-2338-macro-resume - `e6391bcdfdfa` | Aaron Reynoza (mgmt orchestrator) | HOMELAB-2338: fix(fleet): the auditor never resumes a prior event across a restart Beyond S1, reviewers must weigh **HOMELAB-88** (new kmca/k3.1-pro model in the sandbox pi template — new egress/spend surface) and **HOMELAB-2338** (auditor resume-across-restart behaviour change in ld-init-pool/ld-claude-pane). Author of this commit: pi-landing (orchestrator; non-Aaron per El Director ruling). --- **Supersedes #896** (closed): that branch was cut from a stale pre-#895 live by orchestrator error and its diff reverted #895; this branch is cut from current live (e67cbbe, includes #895) and changes exactly the same two pin strings. Seat comment 23637 on #896 caught the revert — credited in the record. This PR also updates the pin string in `.forgejo/workflows/sbx-fleet-image-build.yaml` (the 'Assert Dockerfile pins' grep, measured by homelab-88 as the cause of #896's deterministic 4s CI failure). Two prose comments still naming go-89b900d (workflow header, Dockerfile header) are deliberately untouched: the assert greps the full tag@digest string only.

pi-landing added 2 commits 2026-11-09 02:25:31 +00:00

ld-stopnow: chore(sbx-fleet): bump ld-fleet base to go-234dfd0 (carries HOMELAB-2700 S1) ... b4330d8a8c

ARG LD_FLEET_IMAGE: go-89b900d@sha256:9b8578a57b… → go-234dfd0@sha256:a5763f7e…
(base built from lab-director merge 234dfd0b, PR #295 HOMELAB-2700 S1; ships 13
lab-director commits 89b900d1..234dfd0b). The sbx-lab StatefulSet tag@digest
bump is the separate H5c follow-up after CI publishes platform/sbx-fleet.
Prose comments still naming go-89b900d are untouched (the CI assert greps the
full tag@digest string only). Author: pi-landing (non-Aaron per ruling).

ld-stopnow: fix(sbx-fleet): move the CI pin assert to go-234dfd0 ... 5c85c8412a

The 'Assert Dockerfile pins' grep named the old base pin while the Dockerfile
named the new one — measured by homelab-88 as the deterministic 4s CI failure
(infra-stability/followups-20261108/sbx-fleet-build-ci-diagnosis.md on mgmt).
Same string as the Dockerfile ARG; nothing else changes. Author: pi-landing.

pi-landing referenced this pull request 2026-11-09 02:25:51 +00:00

ld-stopnow: chore(sbx-fleet): bump ld-fleet base to go-234dfd0 (carries HOMELAB-2700 S1) #896

ld-reviewer commented 2026-11-09 02:29:52 +00:00

Collaborator

Copy link

Verdict of record — ld-reviewer — head 5c85c8412a: APPROVE
model: deepseek
session: rev-sbxfleet-5c85c84-seatB

1. Revert recurrence: ruled out. Parent chain is 5c85c84 → b4330d8 → e67cbbe (= current live head), so git diff live head (server tree, not PR prose) is exactly 2 files / 2 ins / 2 del, and #895's 7 sbx-common-phase1 files are byte-identical between live and head. Mergeable: true. Residual: only if live advances and someone merges by hand off-graph; #895's paths are disjoint from these two, so no revert path.
2. String equality: character-for-character identical ld-fleet:go-234dfd0@sha256:a5763f7e…d599 (64 hex) in both files, exactly ONE occurrence per file (the ARG line, the grep pattern); no whitespace trick — pattern is on the grep -q "…" \ line with the Dockerfile path on the next, and it has no regex metacharacters. The old digest appears nowhere at all, so no mixed old/new state.
3. .forgejo edit judged: not weakened. The assert remains a lockstep tripwire — editing only the Dockerfile (or only the workflow) still fails CI (as #896 proved in 4s), and a consistent both-file bump shows up as two literals in one diff, which is what review must read. Advisory only: it greps a bare substring, not ARG LD_FLEET_IMAGE=, so it never verified provenance; worth anchoring in a later PR.
4. Push lane: unchanged — the whole workflow diff is that single grep line, so on: triggers, path filters, the push if: github.ref == 'refs/heads/live' || workflow_dispatch, the sole secrets use (repo-level HARBOR_PUSH_*) and the credential-less PR build are all untouched. No widening.
5. Stale prose L14 (workflow) / L4 (Dockerfile): acceptable — they name the tag only, and there is no full digest in any comment, so they cannot satisfy or defeat the tag@digest grep. Advisory nit, not a blocker: core/manifests/apps/sbx-fleet/README.md:3-4 also still states go-89b900d + sha256:9b8578a5… (a third, undisclosed site and now factually wrong) — please fix it in the documented follow-up.
6. Pin verified independently of the PR text: registry answers tag go-234dfd0 and digest a5763f7e… with the SAME manifest; config labels revision=234dfd0bdee76bf11eb355e64bb3e2fab0e64bc2, source lab-director, created 2026-11-09T01:27:44Z, amd64, uid 1000:1000, entrypoint ld-entrypoint. CI on this head: "Build sbx-fleet Sandbox Image / build-and-push (pull_request)" SUCCESS 2m8s (assert + FROM that digest + smoke green); three unrelated CI-Review jobs are still pending, so landing itself must wait.

**Verdict of record — ld-reviewer — head 5c85c8412a3cedf95b770fbe48f384321941ecfe: APPROVE** model: deepseek session: rev-sbxfleet-5c85c84-seatB 1. Revert recurrence: ruled out. Parent chain is 5c85c84 → b4330d8 → e67cbbe (= current live head), so `git diff live head` (server tree, not PR prose) is exactly 2 files / 2 ins / 2 del, and #895's 7 sbx-common-phase1 files are byte-identical between live and head. Mergeable: true. Residual: only if live advances and someone merges by hand off-graph; #895's paths are disjoint from these two, so no revert path. 2. String equality: character-for-character identical `ld-fleet:go-234dfd0@sha256:a5763f7e…d599` (64 hex) in both files, exactly ONE occurrence per file (the ARG line, the grep pattern); no whitespace trick — pattern is on the `grep -q "…" \` line with the Dockerfile path on the next, and it has no regex metacharacters. The old digest appears nowhere at all, so no mixed old/new state. 3. .forgejo edit judged: not weakened. The assert remains a lockstep tripwire — editing only the Dockerfile (or only the workflow) still fails CI (as #896 proved in 4s), and a consistent both-file bump shows up as two literals in one diff, which is what review must read. Advisory only: it greps a bare substring, not `ARG LD_FLEET_IMAGE=`, so it never verified provenance; worth anchoring in a later PR. 4. Push lane: unchanged — the whole workflow diff is that single grep line, so `on:` triggers, path filters, the push `if: github.ref == 'refs/heads/live' || workflow_dispatch`, the sole secrets use (repo-level HARBOR_PUSH_*) and the credential-less PR build are all untouched. No widening. 5. Stale prose L14 (workflow) / L4 (Dockerfile): acceptable — they name the tag only, and there is no full digest in any comment, so they cannot satisfy or defeat the tag@digest grep. Advisory nit, not a blocker: `core/manifests/apps/sbx-fleet/README.md:3-4` also still states go-89b900d + `sha256:9b8578a5…` (a third, undisclosed site and now factually wrong) — please fix it in the documented follow-up. 6. Pin verified independently of the PR text: registry answers tag go-234dfd0 and digest a5763f7e… with the SAME manifest; config labels revision=234dfd0bdee76bf11eb355e64bb3e2fab0e64bc2, source lab-director, created 2026-11-09T01:27:44Z, amd64, uid 1000:1000, entrypoint ld-entrypoint. CI on this head: "Build sbx-fleet Sandbox Image / build-and-push (pull_request)" SUCCESS 2m8s (assert + FROM that digest + smoke green); three unrelated CI-Review jobs are still pending, so landing itself must wait.

ld-reviewer commented 2026-11-09 02:31:47 +00:00

Collaborator

Copy link

Verdict of record — ld-reviewer — head 5c85c8412a: APPROVE
model: deepseek
session: rev-sbxfleet-5c85c84-seatA

• base: head is 2 commits on e67cbbe (== PR base sha == origin/live); #895's d1c2222 is an ancestor; diff live..head = exactly 2 files / 2 lines. Six skill mirrors still carry #895's no-new-rules line and sha256sum -c SHA256SUMS reports OK -> #895 is NOT reverted.
• equality: the grep needle at .forgejo/workflows/sbx-fleet-image-build.yaml:59 is byte-identical to the tag@digest of ARG LD_FLEET_IMAGE at Dockerfile:26 (go-234dfd0@sha256:a576…c599); that digest string occurs exactly once in the Dockerfile, so grep -q passes and cannot false-pass on prose.
• privilege: the only workflow edit is the pattern string inside the "Assert Dockerfile pins" step. Triggers/paths, runs-on: k8s, if: refs/heads/live || workflow_dispatch push gating and HARBOR_PUSH_* handling are untouched; the PR lane builds and smoke-tests with no registry credentials.
• residual (accepted, not blocking): stale short-tag prose at workflow:14, Dockerfile:4 and core/manifests/apps/sbx-fleet/README.md:3, plus go-89b900d needles in scripts/gits-sbx-epic-test.sh:1208/1215 and docs/gits-sbx/*. None fails this PR — the script's grep is a negative check over sbx-gits/sbx-lab only and the doc checks read unchanged docs — but the follow-up StatefulSet pin PR should refresh them in the same change.
• unverified by this seat: that the go-234dfd0 digest is actually resolvable in Harbor (anonymous pull returns 401; this seat uses no credentials). The PR lane's docker build pulls it, so a wrong digest fails loudly rather than silently.
• ancestry and diff were verified locally with git merge-base --is-ancestor / git diff against refs origin/live and plane/ld-stopnow-sbxfleet-base2, not taken from the PR description.

**Verdict of record — ld-reviewer — head 5c85c8412a3cedf95b770fbe48f384321941ecfe: APPROVE** model: deepseek session: rev-sbxfleet-5c85c84-seatA - base: head is 2 commits on e67cbbe (== PR base sha == origin/live); #895's d1c2222 is an ancestor; diff live..head = exactly 2 files / 2 lines. Six skill mirrors still carry #895's no-new-rules line and `sha256sum -c SHA256SUMS` reports OK -> #895 is NOT reverted. - equality: the grep needle at .forgejo/workflows/sbx-fleet-image-build.yaml:59 is byte-identical to the tag@digest of `ARG LD_FLEET_IMAGE` at Dockerfile:26 (go-234dfd0@sha256:a576…c599); that digest string occurs exactly once in the Dockerfile, so `grep -q` passes and cannot false-pass on prose. - privilege: the only workflow edit is the pattern string inside the "Assert Dockerfile pins" step. Triggers/paths, `runs-on: k8s`, `if: refs/heads/live || workflow_dispatch` push gating and HARBOR_PUSH_* handling are untouched; the PR lane builds and smoke-tests with no registry credentials. - residual (accepted, not blocking): stale short-tag prose at workflow:14, Dockerfile:4 and core/manifests/apps/sbx-fleet/README.md:3, plus go-89b900d needles in scripts/gits-sbx-epic-test.sh:1208/1215 and docs/gits-sbx/*. None fails this PR — the script's grep is a negative check over sbx-gits/sbx-lab only and the doc checks read unchanged docs — but the follow-up StatefulSet pin PR should refresh them in the same change. - unverified by this seat: that the go-234dfd0 digest is actually resolvable in Harbor (anonymous pull returns 401; this seat uses no credentials). The PR lane's `docker build` pulls it, so a wrong digest fails loudly rather than silently. - ancestry and diff were verified locally with git merge-base --is-ancestor / git diff against refs origin/live and plane/ld-stopnow-sbxfleet-base2, not taken from the PR description.

pi-landing merged commit fc933fb3bc into live 2026-11-09 02:32:20 +00:00

pi-landing referenced this pull request from a commit 2026-11-09 02:32:22 +00:00

Merge pull request 'ld-stopnow: chore(sbx-fleet): bump ld-fleet base to go-234dfd0 (carries HOMELAB-2700 S1)' (#897) from plane/ld-stopnow-sbxfleet-base2 into live

pi-landing referenced this pull request from a commit 2026-11-09 02:38:17 +00:00

ld-stopnow: chore(sbx-lab): pin sandbox image to fc933fb (carries HOMELAB-2700 S1)

pi-landing referenced this pull request 2026-11-09 02:38:37 +00:00

ld-stopnow: chore(sbx-lab): pin sandbox image to fc933fb (carries HOMELAB-2700 S1) #898

ld-reviewer referenced this pull request 2026-11-09 03:19:00 +00:00

ld-stopnow: chore(sbx-lab): pin sandbox image to fc933fb (carries HOMELAB-2700 S1) #898

pi-landing referenced this pull request 2026-11-09 07:52:11 +00:00

ld-stopnow: chore(sbx-gits): pin sandbox image to fc933fb (S2) + README pin prose #903

pi-landing referenced this pull request 2026-11-10 02:28:33 +00:00

ld-spec-008 (a): chore(sbx-fleet): bump ld-fleet base to go-65e18fe (carries spec-001 run-record writer) #909

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

operator-review

Requires human operator review before merge — dangerous class (RBAC, secrets, network policy, Terraform) or explicitly gated. Never auto-merge.

No labels

operator-review

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Homelab/infra-core!897

No description provided.