ld-spec-008 (a): chore(sbx-fleet): bump ld-fleet base to go-65e18fe (carries spec-001 run-record writer)

pi-landing commented

2026-11-10 02:28:33 +00:00

Collaborator

Spec 008, PR (a) of the 2-merge chain (same shape as #897 → #898 on 11-09). Run LR-20261110-008.

Change

core/manifests/apps/sbx-fleet/Dockerfile: ARG LD_FLEET_IMAGE → harbor.aaron.reynoza.org/ld-target/ld-fleet:go-65e18fe@sha256:dd11eda4add1d6a36c053c99c7b3e24734a9f3a1c516d31ce8b0f0d762a0e9ef (newest ld-fleet image in Harbor; built from lab-director live commit 65e18fe7afc92582712bfda61d3eeead9392cc0b = the merge of spec 001, the run-record writer).
.forgejo/workflows/sbx-fleet-image-build.yaml: the pin-assert grep updated in the same PR (the #896 lesson: the workflow greps the base pin, so both must move together).
PR (b) (separate, after this lands): re-pin the sbx-lab StatefulSet to the new platform/sbx-fleet:<sha> this PR's live build publishes. No pod action here (H5c).

Flows (spec "Done when"), marked

Base bump + pin-assert in one PR — proven. Dockerfile line + workflow grep, +2/-2 in 2 files. Proof: git diff live...HEAD --stat; the workflow's own "Assert Dockerfile pins match the workflow pins" step passes at this head (kubectl pins untouched; base-pin grep matches the Dockerfile exactly).
Containment of 65e18fe7 — proven. git merge-base --is-ancestor 65e18fe7 65e18fe7afc92582712bfda61d3eeead9392cc0b exit 0 (the image's build commit IS spec 001's merge; also an ancestor of lab-director live head 521cd0c). Harbor cross-check (anonymous): tag go-65e18fe → digest sha256:dd11eda4…a0e9ef, exact match with the pin.
CI green incl. sbx-fleet image build, read from commit status at the exact head — pending at open; reported in a comment once observed (/commits/<head>/status).
Two seats in distinct sessions, then the landing tool — pending.

Walk: no independent walk: implementer-run checks only.

One exact commit, author ld-implementer <ld-implementer@noreply>, trailer Lab-Run: LR-20261110-008.

Spec 008, PR (a) of the 2-merge chain (same shape as #897 → #898 on 11-09). Run LR-20261110-008. ## Change - `core/manifests/apps/sbx-fleet/Dockerfile`: `ARG LD_FLEET_IMAGE` → `harbor.aaron.reynoza.org/ld-target/ld-fleet:go-65e18fe@sha256:dd11eda4add1d6a36c053c99c7b3e24734a9f3a1c516d31ce8b0f0d762a0e9ef` (newest ld-fleet image in Harbor; built from lab-director live commit 65e18fe7afc92582712bfda61d3eeead9392cc0b = the merge of spec 001, the run-record writer). - `.forgejo/workflows/sbx-fleet-image-build.yaml`: the pin-assert grep updated in the same PR (the #896 lesson: the workflow greps the base pin, so both must move together). - PR (b) (separate, after this lands): re-pin the sbx-lab StatefulSet to the new `platform/sbx-fleet:<sha>` this PR's live build publishes. No pod action here (H5c). ## Flows (spec "Done when"), marked 1. **Base bump + pin-assert in one PR — proven.** Dockerfile line + workflow grep, +2/-2 in 2 files. Proof: `git diff live...HEAD --stat`; the workflow's own "Assert Dockerfile pins match the workflow pins" step passes at this head (kubectl pins untouched; base-pin grep matches the Dockerfile exactly). 2. **Containment of 65e18fe7 — proven.** `git merge-base --is-ancestor 65e18fe7 65e18fe7afc92582712bfda61d3eeead9392cc0b` exit 0 (the image's build commit IS spec 001's merge; also an ancestor of lab-director live head 521cd0c). Harbor cross-check (anonymous): tag `go-65e18fe` → digest `sha256:dd11eda4…a0e9ef`, exact match with the pin. 3. **CI green incl. sbx-fleet image build, read from commit status at the exact head — pending at open; reported in a comment once observed** (`/commits/<head>/status`). 4. Two seats in distinct sessions, then the landing tool — pending. **Walk:** no independent walk: implementer-run checks only. One exact commit, author `ld-implementer <ld-implementer@noreply>`, trailer `Lab-Run: LR-20261110-008`.

pi-landing added 1 commit

2026-11-10 02:28:34 +00:00

ld-spec-008: chore(sbx-fleet): bump ld-fleet base to go-65e18fe (carries spec-001 run-record writer)

CI Review / runner-manifest-test (pull_request) Successful in 5s

Details

CI Review / receiver-test (pull_request) Successful in 6s

Details

CI Review / helm-validate (pull_request) Successful in 9s

Details

CI Review / alert-receiver-test (pull_request) Successful in 21s

Details

CI Review / record-sql-test (pull_request) Successful in 2m7s

Details

Lint & Validate / shellcheck (pull_request) Successful in 8s

Details

Lint & Validate / yaml-lint (pull_request) Successful in 23s

Details

Lint & Validate / terraform-validate (pull_request) Successful in 2m22s

Details

CI Review / cockpit-test (pull_request) Successful in 3m12s

Details

CI Review / cockpit-e2e (pull_request) Successful in 3m41s

Details

Build sbx-fleet Sandbox Image / build-and-push (pull_request) Successful in 1m38s

Details

CI Review / dispatcher-test (pull_request) Successful in 4m20s

Details

7022e328fc

Base bump only: the sbx-fleet derived image now builds on
ld-fleet:go-65e18fe@sha256:dd11eda4add1d6a36c053c99c7b3e24734a9f3a1c516d31ce8b0f0d762a0e9ef,
built from lab-director live commit 65e18fe7afc92582712bfda61d3eeead9392cc0b
(merge of spec 001, the run-record writer), so the pool sandboxes inherit the
run-record writer instead of the previous base go-234dfd0.

Containment proven with `git merge-base --is-ancestor 65e18fe7 65e18fe7`
(exit 0): the pinned base is exactly that commit, not merely a descendant.

The workflow pin-assert in .forgejo/workflows/sbx-fleet-image-build.yaml is
updated in the same commit/PR: the old grep would have failed the build with
the new Dockerfile pin (the #896 lesson: the assert and the pin move together).
KUBECTL_VERSION/KUBECTL_SHA256 are untouched.

The sbx-lab pin is a separate later PR (H5c); this PR moves only sbx-fleet.

Lab-Run: LR-20261110-008

ld-reviewer commented

2026-11-10 02:36:39 +00:00

Collaborator

Verdict of record — ld-reviewer — head 7022e328fc: APPROVE

model: deepseek
session: rev-spec008a-7022e328-seatA

Head and parent verified by me. git log -1 origin/spec-008-a-sbxfleet-base-bump = 7022e328fcedc86547e6f96e1d629e0ce0da41f5, parent 3fdce6f1 = exactly origin/live; fast-forward, no merge commit.
Smuggle check clean. 2 files, +2/-2, only M, modes 100644 unchanged; hunks are exactly the ARG LD_FLEET_IMAGE pin in the Dockerfile and the pin-assert grep -q in the workflow. No ENTRYPOINT/CMD, no KUBECTL_* change.
Commit hygiene. One commit; author ld-implementer <ld-implementer@noreply>; trailer Lab-Run: LR-20261110-008.
Registry confirmed (anonymous): Harbor ld-target/ld-fleet artifact dd11eda4…a0e9ef carries tag go-65e18fe; the tag@digest in both files is byte-identical to the registry, assert and pin move together (the #896 lesson).
Containment. git merge-base --is-ancestor 65e18fe7 65e18fe7afc92582712bfda61d3eeead9392cc0b exit 0; that commit is the merge of spec 001 ("every sandbox step writes its own run record", #296) — the run-record writer, as claimed.
CI at exact head: overall success; all contexts green including Build sbx-fleet Sandbox Image / build-and-push (run 3449).
Risk. Inert merge: image publishes only on the live push after merge; OnDelete restarts nothing. Revert is a one-line re-pin to go-234dfd0@a5763f7e…. sbx-lab re-pin is the deliberate follow-up PR (b), not smuggled here.

Residuals: none material. Cosmetic only: pre-existing Dockerfile comment at line 4 still mentions go-89b900d (unchanged, out of scope).

**Verdict of record — ld-reviewer — head 7022e328fcedc86547e6f96e1d629e0ce0da41f5: APPROVE** model: deepseek session: rev-spec008a-7022e328-seatA 1. **Head and parent verified by me.** `git log -1 origin/spec-008-a-sbxfleet-base-bump` = `7022e328fcedc86547e6f96e1d629e0ce0da41f5`, parent `3fdce6f1` = exactly `origin/live`; fast-forward, no merge commit. 2. **Smuggle check clean.** 2 files, +2/-2, only `M`, modes 100644 unchanged; hunks are exactly the `ARG LD_FLEET_IMAGE` pin in the Dockerfile and the pin-assert `grep -q` in the workflow. No ENTRYPOINT/CMD, no KUBECTL_* change. 3. **Commit hygiene.** One commit; author ld-implementer <ld-implementer@noreply>; trailer `Lab-Run: LR-20261110-008`. 4. **Registry confirmed** (anonymous): Harbor `ld-target/ld-fleet` artifact `dd11eda4…a0e9ef` carries tag `go-65e18fe`; the tag@digest in both files is byte-identical to the registry, assert and pin move together (the #896 lesson). 5. **Containment.** `git merge-base --is-ancestor 65e18fe7 65e18fe7afc92582712bfda61d3eeead9392cc0b` exit 0; that commit is the merge of spec 001 ("every sandbox step writes its own run record", #296) — the run-record writer, as claimed. 6. **CI at exact head:** overall `success`; all contexts green including `Build sbx-fleet Sandbox Image / build-and-push` (run 3449). 7. **Risk.** Inert merge: image publishes only on the live push after merge; OnDelete restarts nothing. Revert is a one-line re-pin to `go-234dfd0@a5763f7e…`. sbx-lab re-pin is the deliberate follow-up PR (b), not smuggled here. Residuals: none material. Cosmetic only: pre-existing Dockerfile comment at line 4 still mentions `go-89b900d` (unchanged, out of scope).

ld-reviewer commented

2026-11-10 02:37:00 +00:00

Collaborator

Verdict of record — ld-reviewer — head 7022e328fc: APPROVE

model: deepseek
session: rev-spec008a-7022e328-seatB

Head/parent/diff: head = 7022e328…, parent = 3fdce6f1… = origin/live; diff exactly 2 files, +2/-2 (Dockerfile ARG LD_FLEET_IMAGE line + workflow base-pin grep); KUBECTL pins untouched; no ENTRYPOINT/CMD; one commit, ld-implementer, Lab-Run: LR-20261110-008.
Pin consistency: identical ld-fleet:go-65e18fe@sha256:dd11eda4…a0e9ef once per file; digest 64 lowercase hex; I re-ran the assert greps against the checked-out head — both hit.
Registry: go-65e18fe → sha256:dd11eda4add1d6a36c053c99c7b3e24734a9f3a1c516d31ce8b0f0d762a0e9ef, push_time 2026-11-09T04:48:35Z — newer than go-234dfd0 (01:28:11Z); newest go-* base tag (macro-65e18fe is the macro variant of the same build). Anonymous, no credentials.
Purpose fit: 65e18fe7 is the spec-001 merge ("every sandbox step writes its own run record", #296); merge-base --is-ancestor 65e18fe7 65e18fe7afc92582712bfda61d3eeead9392cc0b exit 0 — the base IS that commit.
CI at exact head: overall success (12 contexts) including Build sbx-fleet Sandbox Image / build-and-push (run 3449).
Risk: inert until the live push publishes platform/sbx-fleet:<sha>; recovery = revert this one-line bump; sbx-lab re-pin is deliberately PR (b); the recreate belongs to the hypervisor.

Residuals: layer contents of go-65e18fe not inspected (digest-level trust only).

**Verdict of record — ld-reviewer — head 7022e328fcedc86547e6f96e1d629e0ce0da41f5: APPROVE** model: deepseek session: rev-spec008a-7022e328-seatB 1. **Head/parent/diff**: head = `7022e328…`, parent = `3fdce6f1…` = `origin/live`; diff exactly 2 files, +2/-2 (Dockerfile `ARG LD_FLEET_IMAGE` line + workflow base-pin grep); KUBECTL pins untouched; no ENTRYPOINT/CMD; one commit, ld-implementer, `Lab-Run: LR-20261110-008`. 2. **Pin consistency**: identical `ld-fleet:go-65e18fe@sha256:dd11eda4…a0e9ef` once per file; digest 64 lowercase hex; I re-ran the assert greps against the checked-out head — both hit. 3. **Registry**: `go-65e18fe` → `sha256:dd11eda4add1d6a36c053c99c7b3e24734a9f3a1c516d31ce8b0f0d762a0e9ef`, push_time 2026-11-09T04:48:35Z — newer than `go-234dfd0` (01:28:11Z); newest `go-*` base tag (`macro-65e18fe` is the macro variant of the same build). Anonymous, no credentials. 4. **Purpose fit**: `65e18fe7` is the spec-001 merge ("every sandbox step writes its own run record", #296); `merge-base --is-ancestor 65e18fe7 65e18fe7afc92582712bfda61d3eeead9392cc0b` exit 0 — the base IS that commit. 5. **CI at exact head**: overall `success` (12 contexts) including `Build sbx-fleet Sandbox Image / build-and-push` (run 3449). 6. **Risk**: inert until the live push publishes `platform/sbx-fleet:<sha>`; recovery = revert this one-line bump; sbx-lab re-pin is deliberately PR (b); the recreate belongs to the hypervisor. Residuals: layer contents of `go-65e18fe` not inspected (digest-level trust only).