IR-20261111: docs(sendrast): C8 part A — Jesús has the same authority as Aaron #947

Merged

pi-landing merged 2 commits from plane/IR-20261111-c8brief into live 2026-11-12 06:42:29 +00:00

Conversation 5 Commits 2 Files changed 5 +29 -22

pi-landing commented 2026-11-11 21:14:52 +00:00

Collaborator

Copy link

C8 part A: Jesús has the same authority as Aaron — director brief changes.

What this is. The change is the "Revision 2026-11-11 ~21:2xZ" of working-files/sendrast-hypervisor/c8-director-authority.md plus the review-3c fixes (its section "#947 fix round, 2026-11-11 ~22:0xZ"). Part B (grants) goes live first; this PR is the brief that must not promise rights which do not exist yet.

Two rounds, one branch. 962db01f was the revision alone. 2f1be91f adds one fix commit that applies, verbatim, the "Fix (exact)" text of security-hypervisor/pr947/review-3c.md for B1, S1, S2, S3, S4, S5, S6 and the n4 release-line format, each with the matching changes its own section names. Nothing in the fix commit widens a grant: every added sentence restricts or narrows. So this is not "the revision text, unchanged" — A5, A6, A7, A10 and A11 are now the revision text plus restrictive sentences, A6 and A7 are replaced by stricter wording, and WORK.md:14 changed although the revision had said line 14 stays.

Every From: line was read at its cited location in the parent (3563ec7f) before replacement; no line was stale, and the fix round did not touch those anchors. Line numbers below are on this head (2f1be91f), where the fix commit shifted some of them.

Review status.

Round	Head	Verdict	Where
r1 (homelab-3c)	962db01f	BLOCKING: yes — B1 (SKILL.md:166 granted tagging the revision withheld), plus S1–S6 and n1–n6	security-hypervisor/pr947/review-3c.md
r2 (homelab-3c)	2f1be91f	BLOCKING: no — "B1 and S1–S6 are fixed in the governing text and the fix adds no power"	security-hypervisor/pr947/review-3c-r2.md

What r2 confirms is fixed, against this head:

• B1 — plugin/skills/epic-supervisor/SKILL.md:166 now reads "you push no tags: merging on his word is the only write you make to repos. If he asks for a tag or a release, write release: …". Tagging stays on the Sendrast hypervisor's route, as the 21:2xZ revision set it.
• S1 — merges only into main of Sendrast/api-sendrast and Sendrast/sendrast-web, after checking base.repo.full_name and base.ref; never merge, push, tag, approve or comment in any Homelab repo or any other Sendrast repo, whatever the token allows. In BRIEF.md:132, WORK.md:9 and SKILL.md:166.
• S2 — the head pin is the sha named in both the sandbox suite run and the DeepSeek verdict, never a value read back from the PR at merge time; differing shas, a 409/422 or "out of date" stop the merge and re-run the gate; never merge without head_commit_id, never through a tool that does not send it. Same three places.
• S3 — BRIEF.md:131 names the review leg (a reviewer that did not write the PR, on the exact sha, whose verdict file is what he is cited), and plugin/skills/hypervisor/SKILL.md:84 no longer lists "routine merges already reviewed" — it reads "nothing about merges: every merge needs his word".
• S4 — BRIEF.md:202 needs Jesús's own words in this conversation, for that restart; reinicio sbx: <hora> — "<his words>" is written as a record, and WORK.md:14 now says the hypervisor reads it as a record and only reports it. One actor, once per ok, never while the heavy lock is held / a merge is in flight / a release is running, at most once a day. Both Never lists now say "restarting his pod without his ok".
• S5 — BRIEF.md:205 sets /etc/sendrast-sbx/kubeconfig on every kubectl call, never another kubeconfig, never sudo, never his credentials; no exec/attach/port-forward/debug into any pod in sendrast; a pod delete there is a production restart (his word for that pod, never a CNPG pod, never during a release/migration/backup). The $S/$SI recipes pass --kubeconfig explicitly (BRIEF.md:64-65, SKILL.md:45-46).
• S6 — replaces A7: app accounts go through the app's admin screens; he does it himself or the director drives a session he has logged into; his password is never asked for, stored or typed.
• n4 — the release line is release: <repo>@<sha> → vX.Y.Z again (BRIEF.md:133, WORK.md:11, SKILL.md:166).

Follow-ups r2 leaves open, deliberately outside this PR's governing text (listed so they are not lost, all severity n): the ambient-kubeconfig call sites in wait-orchestrator.sh:23-25, purpose-check:23, epic-supervisor/SKILL.md:161 and :179, and bin/sbx-plane:13/30; A7/S6's "drive a session he has logged into" has no scope bound; and hypervisor/SKILL.md:108 uses "his" for Aaron where it means Jesús. None of these reaches prod sendrast, and none is a condition of this merge.

The A-items, against this head

Item	File:line	Change
A1	core/directors/sendrast/brief/BRIEF.md:29-31	New ## Authority section after line 27: Jesús and Aaron are the operators of this factory with equal authority over every agent; his decisions need no OK from Aaron, El Director or any hypervisor; Aaron's words weigh as experience with the factory, never as a permission; his own rules stay his ("nunca hacer merge sin consultar" binds until he changes it). Verbatim.
A2	core/directors/sendrast/brief/BRIEF.md:41	A change of method (what "done" means, gates, global rules) is his: propose it, with his yes it applies, and nobody else's OK is needed. (From: "— propose it, never apply it alone".) Verbatim.
A3	core/directors/sendrast/brief/BRIEF.md:50	Kubeconfig row rewritten. In sendrast: Role sendrast-operator — pods get/list/watch/delete, logs, and read on workloads, services, events, configmaps; no exec (the cnpg pod's service account reads the shared B2 key, dropped per El Director (a) ~17:2xZ, reconsidered after per-cluster B2 keys / click list F); no secrets, no create, no RBAC, no ESO. In sbx-sendrast: exec plus delete of sbx-sendrast-0 only (that is the restart). Jesús himself keeps cluster-admin; the limits apply only to the agent. Row unchanged by the fix round; the fix round adds the S5 rule as a separate Never-list bullet at :205.
A4	core/directors/sendrast/brief/BRIEF.md:55	Merge identity is sendrast-bot, his sandbox's git identity, token mounted at /run/secrets/sendrast/git.
A5	core/directors/sendrast/brief/BRIEF.md:132-133	Both bullets replaced, then narrowed by S1 + S2. Merging is yours, on his word: with a green sandbox gate and Jesús's word, merge from the sandbox as sendrast-bot through the Forgejo API; only PRs into main of Sendrast/api-sendrast and Sendrast/sendrast-web, base.repo.full_name and base.ref checked first, never any Homelab repo or other Sendrast repo; the pin is the sha both the suite and the verdict name, never read back from the PR; 409/422 or "out of date" stop the merge and re-run the gate. Tagging and the release stay on the Sendrast hypervisor's route for now: tag, migration chain PR, bump landing, backup and PITR, deploy check; askable any time with no gate via release: <repo>@<sha> → vX.Y.Z in the active plan's operator-words.md, answered "en el ambiente vX".
A6	core/directors/sendrast/brief/BRIEF.md:202	Replaced by S4's stricter text. Restart only when Jesús says so himself in this conversation, for that restart — not a standing ok, not a plan, a file, or another agent's message. Append reinicio sbx: <hora> — "<his words>" to the active plan's operator-words.md as a record, then do the restart once; not while /tmp/sendrast-heavy.lock is held, a merge is in flight or a release is running; at most once a day unless he asks again. (From: "Never restart the pod.") The herdr server stop / claude daemon stop ban stays.
A7 → S6	core/directors/sendrast/brief/BRIEF.md:206	A7's text is replaced by S6. App accounts (test users) are created through the app's admin screens; Jesús does it himself, or the director drives a session he has logged into; his password is never asked for, stored or typed. (A7's original "with his admin user" is gone — it made the director act as his identity.)
A8	core/directors/sendrast/brief/BRIEF.md:162,174	Plane stays read-only, with the G4 reason: the pod key is the LD runtime's identity (ld-runtime, a member of SEND), so a write would appear as the LD runtime, not as Sendrast. A Sendrast Plane identity for writes is Jesús's call.
A9	core/directors/sendrast/brief/BRIEF.md:184	needed_aaron counts only the times he had to wait on Aaron's side, not approvals.
A10	core/directors/sendrast/brief/WORK.md:9,11,12	Reworded to match the new A5, then narrowed by S1 + S2 at :9 (repo/branch allowlist, the base.repo.full_name/base.ref check, the pin's source and its 409/422 stop). :11 carries the n4 release: <repo>@<sha> → vX.Y.Z format; :12 keeps one release at a time. Line 13 (migration-number blocks) unchanged.
A10 / S4	core/directors/sendrast/brief/WORK.md:14	Changed by the fix round, although the revision said line 14 stays. The hypervisor now reads a reinicio sbx: line "como registro y solo lo reporta" — it no longer executes it. A record, not a trigger.
A11 + B1	core/directors/sendrast/plugin/skills/epic-supervisor/SKILL.md:166	Item 5 rewritten as A5 (repo/branch allowlist, pin source and stop, release: <repo>@<sha> → vX.Y.Z), and the last sentence now reads: "You still write no code, and you push no tags: merging on his word is the only write you make to repos. If he asks for a tag or a release, write release: <repo>@<sha> → vX.Y.Z as above." B1 fixed: the "and tagging" grant is gone, so A11 finally matches the revision, which kept tagging on the hypervisor's route. :215 Never list now says "restarting his pod without his ok".
A12	core/directors/sendrast/brief/PURPOSE.md:10	"stop and raise it with Jesús or Aaron. Only Jesús or Aaron change this file." Verbatim.
S3 (part 2)	core/directors/sendrast/plugin/skills/hypervisor/SKILL.md:84,130	The fifth file, outside the A-list — the fix round's S3 required it. :84 no longer lists "routine merges already reviewed" as the director's to decide; it reads "nothing about merges: every merge needs his word". :130 Never list now says "restarting his pod without his ok".

Files changed (5)

File	+/−
core/directors/sendrast/brief/BRIEF.md	+18 / −11
core/directors/sendrast/brief/WORK.md	+4 / −4
core/directors/sendrast/brief/PURPOSE.md	+1 / −1
core/directors/sendrast/plugin/skills/epic-supervisor/SKILL.md	+4 / −4
core/directors/sendrast/plugin/skills/hypervisor/SKILL.md	+2 / −2

Nothing outside core/directors/sendrast/; no credentials, no cluster state, no grants.

Seats

Fresh seats are pending at 2f1be91f. The only seat comment on this PR is seat A, comment 24976, posted against the old head 962db01f; it stays posted but it is stale — it does not describe this head and must not be read as a verdict on it. A clean landing needs a verdict on 2f1be91f itself. The r2 review above is the reviewer's own re-read of this head and is the basis for the fix round being closed; it is not a substitute for the seat being re-run at this head.

#940 stays on hold

Head-pinned helper + dedicated robot, click list J. It is not part of this PR and nothing here depends on it: the merge path described in A5/A10/A11 is the Forgejo API with head_commit_id, which exists today. If the helper lands later, A5 changes only the tool name.

One thing outside this PR

The S4 change of role lives in the brief and in the skills, but the behaviour that actually executes a reinicio sbx: line lives in homelab-a9's restart watch, which is not in this repo. Until a9 confirms its watch treats the line as a record and only reports it, a forged line could still trigger a restart through the old behaviour. Flagged to a9; not a condition of this merge.

Head: 2f1be91f8d38c84d6e64bc37c2fb9e21f3eb26a8 (one commit, fast-forward from 962db01f8baa05fd30c19bc39a3ad62f2bccc77a, no amend). The head commit carries Lab-Run: IR-20261111-c8brief.

C8 part A: Jesús has the same authority as Aaron — director brief changes. **What this is.** The change is the **"Revision 2026-11-11 ~21:2xZ"** of `working-files/sendrast-hypervisor/c8-director-authority.md` **plus the review-3c fixes** (its section **"#947 fix round, 2026-11-11 ~22:0xZ"**). Part B (grants) goes live first; this PR is the brief that must not promise rights which do not exist yet. **Two rounds, one branch.** `962db01f` was the revision alone. `2f1be91f` adds one fix commit that applies, **verbatim**, the "Fix (exact)" text of `security-hypervisor/pr947/review-3c.md` for B1, S1, S2, S3, S4, S5, S6 and the n4 release-line format, each with the matching changes its own section names. Nothing in the fix commit widens a grant: every added sentence restricts or narrows. So this is **not** "the revision text, unchanged" — A5, A6, A7, A10 and A11 are now the revision text *plus* restrictive sentences, A6 and A7 are replaced by stricter wording, and WORK.md:14 changed although the revision had said line 14 stays. Every `From:` line was read at its cited location in the parent (`3563ec7f`) before replacement; no line was stale, and the fix round did not touch those anchors. Line numbers below are on **this head (`2f1be91f`)**, where the fix commit shifted some of them. **Review status.** | Round | Head | Verdict | Where | |---|---|---|---| | r1 (`homelab-3c`) | `962db01f` | **BLOCKING: yes** — B1 (SKILL.md:166 granted tagging the revision withheld), plus S1–S6 and n1–n6 | `security-hypervisor/pr947/review-3c.md` | | r2 (`homelab-3c`) | `2f1be91f` | **BLOCKING: no** — "B1 and S1–S6 are fixed in the governing text and the fix adds no power" | `security-hypervisor/pr947/review-3c-r2.md` | What r2 confirms is fixed, against this head: - **B1** — `plugin/skills/epic-supervisor/SKILL.md:166` now reads "you push no tags: merging on his word is the only write you make to repos. If he asks for a tag or a release, write `release: …`". Tagging stays on the Sendrast hypervisor's route, as the 21:2xZ revision set it. - **S1** — merges only into `main` of `Sendrast/api-sendrast` and `Sendrast/sendrast-web`, after checking `base.repo.full_name` and `base.ref`; never merge, push, tag, approve or comment in any Homelab repo or any other Sendrast repo, whatever the token allows. In `BRIEF.md:132`, `WORK.md:9` and `SKILL.md:166`. - **S2** — the head pin is the sha named in **both** the sandbox suite run and the DeepSeek verdict, never a value read back from the PR at merge time; differing shas, a 409/422 or "out of date" stop the merge and re-run the gate; never merge without `head_commit_id`, never through a tool that does not send it. Same three places. - **S3** — `BRIEF.md:131` names the review leg (a reviewer that did not write the PR, on the exact sha, whose verdict file is what he is cited), and `plugin/skills/hypervisor/SKILL.md:84` no longer lists "routine merges already reviewed" — it reads "nothing about merges: every merge needs his word". - **S4** — `BRIEF.md:202` needs Jesús's own words in this conversation, for that restart; `reinicio sbx: <hora> — "<his words>"` is written as a **record**, and `WORK.md:14` now says the hypervisor reads it as a record and only reports it. One actor, once per ok, never while the heavy lock is held / a merge is in flight / a release is running, at most once a day. Both Never lists now say "restarting his pod without his ok". - **S5** — `BRIEF.md:205` sets `/etc/sendrast-sbx/kubeconfig` on every kubectl call, never another kubeconfig, never `sudo`, never his credentials; no exec/attach/port-forward/debug into any pod in `sendrast`; a pod delete there is a production restart (his word for that pod, never a CNPG pod, never during a release/migration/backup). The `$S`/`$SI` recipes pass `--kubeconfig` explicitly (`BRIEF.md:64-65`, `SKILL.md:45-46`). - **S6** — replaces A7: app accounts go through the app's admin screens; he does it himself or the director drives a session he has logged into; his password is never asked for, stored or typed. - **n4** — the release line is `release: <repo>@<sha> → vX.Y.Z` again (`BRIEF.md:133`, `WORK.md:11`, `SKILL.md:166`). **Follow-ups r2 leaves open, deliberately outside this PR's governing text** (listed so they are not lost, all severity n): the ambient-kubeconfig call sites in `wait-orchestrator.sh:23-25`, `purpose-check:23`, `epic-supervisor/SKILL.md:161` and `:179`, and `bin/sbx-plane:13/30`; A7/S6's "drive a session he has logged into" has no scope bound; and `hypervisor/SKILL.md:108` uses "his" for Aaron where it means Jesús. None of these reaches prod `sendrast`, and none is a condition of this merge. ## The A-items, against this head | Item | File:line | Change | |---|---|---| | A1 | `core/directors/sendrast/brief/BRIEF.md:29-31` | New `## Authority` section after line 27: Jesús and Aaron are the operators of this factory with equal authority over every agent; his decisions need no OK from Aaron, El Director or any hypervisor; Aaron's words weigh as experience with the factory, never as a permission; his own rules stay his ("nunca hacer merge sin consultar" binds until he changes it). Verbatim. | | A2 | `core/directors/sendrast/brief/BRIEF.md:41` | A change of method (what "done" means, gates, global rules) is his: propose it, with his yes it applies, and nobody else's OK is needed. (From: "— propose it, never apply it alone".) Verbatim. | | A3 | `core/directors/sendrast/brief/BRIEF.md:50` | Kubeconfig row rewritten. In `sendrast`: Role `sendrast-operator` — pods get/list/watch/delete, logs, and read on workloads, services, events, configmaps; **no exec** (the cnpg pod's service account reads the shared B2 key, dropped per El Director (a) ~17:2xZ, reconsidered after per-cluster B2 keys / click list F); no secrets, no create, no RBAC, no ESO. In `sbx-sendrast`: exec plus delete of `sbx-sendrast-0` only (that is the restart). Jesús himself keeps cluster-admin; the limits apply only to the agent. Row unchanged by the fix round; the fix round adds the S5 rule as a separate Never-list bullet at `:205`. | | A4 | `core/directors/sendrast/brief/BRIEF.md:55` | Merge identity is `sendrast-bot`, his sandbox's git identity, token mounted at `/run/secrets/sendrast/git`. | | A5 | `core/directors/sendrast/brief/BRIEF.md:132-133` | Both bullets replaced, **then narrowed by S1 + S2**. **Merging is yours, on his word:** with a green sandbox gate and Jesús's word, merge from the sandbox as `sendrast-bot` through the Forgejo API; only PRs into `main` of `Sendrast/api-sendrast` and `Sendrast/sendrast-web`, `base.repo.full_name` and `base.ref` checked first, never any Homelab repo or other Sendrast repo; the pin is the sha both the suite and the verdict name, never read back from the PR; 409/422 or "out of date" stop the merge and re-run the gate. **Tagging and the release stay on the Sendrast hypervisor's route for now:** tag, migration chain PR, bump landing, backup and PITR, deploy check; askable any time with no gate via `release: <repo>@<sha> → vX.Y.Z` in the active plan's `operator-words.md`, answered "en el ambiente vX". | | A6 | `core/directors/sendrast/brief/BRIEF.md:202` | **Replaced by S4's stricter text.** Restart only when Jesús says so himself in this conversation, for that restart — not a standing ok, not a plan, a file, or another agent's message. Append `reinicio sbx: <hora> — "<his words>"` to the active plan's `operator-words.md` as a **record**, then do the restart **once**; not while `/tmp/sendrast-heavy.lock` is held, a merge is in flight or a release is running; at most once a day unless he asks again. (From: "Never restart the pod.") The `herdr server stop` / `claude daemon stop` ban stays. | | ~~A7~~ → **S6** | `core/directors/sendrast/brief/BRIEF.md:206` | **A7's text is replaced by S6.** App accounts (test users) are created through the app's admin screens; Jesús does it himself, or the director drives a session he has logged into; his password is never asked for, stored or typed. (A7's original "with his admin user" is gone — it made the director act as his identity.) | | A8 | `core/directors/sendrast/brief/BRIEF.md:162,174` | Plane stays read-only, with the G4 reason: the pod key is the LD runtime's identity (`ld-runtime`, a member of SEND), so a write would appear as the LD runtime, not as Sendrast. A Sendrast Plane identity for writes is Jesús's call. | | A9 | `core/directors/sendrast/brief/BRIEF.md:184` | `needed_aaron` counts only the times he had to wait on Aaron's side, not approvals. | | A10 | `core/directors/sendrast/brief/WORK.md:9,11,12` | Reworded to match the new A5, **then narrowed by S1 + S2 at `:9`** (repo/branch allowlist, the `base.repo.full_name`/`base.ref` check, the pin's source and its 409/422 stop). `:11` carries the n4 `release: <repo>@<sha> → vX.Y.Z` format; `:12` keeps one release at a time. Line 13 (migration-number blocks) unchanged. | | A10 / **S4** | `core/directors/sendrast/brief/WORK.md:14` | **Changed by the fix round, although the revision said line 14 stays.** The hypervisor now reads a `reinicio sbx:` line "como registro y solo lo reporta" — it no longer executes it. A record, not a trigger. | | A11 + **B1** | `core/directors/sendrast/plugin/skills/epic-supervisor/SKILL.md:166` | Item 5 rewritten as A5 (repo/branch allowlist, pin source and stop, `release: <repo>@<sha> → vX.Y.Z`), and the last sentence now reads: "You still write no code, and you push no tags: merging on his word is the only write you make to repos. If he asks for a tag or a release, write `release: <repo>@<sha> → vX.Y.Z` as above." **B1 fixed:** the "and tagging" grant is gone, so A11 finally matches the revision, which kept tagging on the hypervisor's route. `:215` Never list now says "restarting his pod without his ok". | | A12 | `core/directors/sendrast/brief/PURPOSE.md:10` | "stop and raise it with Jesús or Aaron. Only Jesús or Aaron change this file." Verbatim. | | **S3 (part 2)** | `core/directors/sendrast/plugin/skills/hypervisor/SKILL.md:84,130` | The **fifth file, outside the A-list** — the fix round's S3 required it. `:84` no longer lists "routine merges already reviewed" as the director's to decide; it reads "nothing about merges: every merge needs his word". `:130` Never list now says "restarting his pod without his ok". | ## Files changed (5) | File | +/− | |---|---| | `core/directors/sendrast/brief/BRIEF.md` | +18 / −11 | | `core/directors/sendrast/brief/WORK.md` | +4 / −4 | | `core/directors/sendrast/brief/PURPOSE.md` | +1 / −1 | | `core/directors/sendrast/plugin/skills/epic-supervisor/SKILL.md` | +4 / −4 | | `core/directors/sendrast/plugin/skills/hypervisor/SKILL.md` | +2 / −2 | Nothing outside `core/directors/sendrast/`; no credentials, no cluster state, no grants. ## Seats **Fresh seats are pending at `2f1be91f`.** The only seat comment on this PR is **seat A, comment 24976**, posted against the **old head `962db01f`**; it stays posted but it is **stale** — it does not describe this head and must not be read as a verdict on it. A clean landing needs a verdict on `2f1be91f` itself. The r2 review above is the reviewer's own re-read of this head and is the basis for the fix round being closed; it is not a substitute for the seat being re-run at this head. ## #940 stays on hold Head-pinned helper + dedicated robot, click list J. It is not part of this PR and nothing here depends on it: the merge path described in A5/A10/A11 is the Forgejo API with `head_commit_id`, which exists today. If the helper lands later, A5 changes only the tool name. ## One thing outside this PR The S4 change of role lives in the brief and in the skills, but the behaviour that actually executes a `reinicio sbx:` line lives in **homelab-a9's restart watch**, which is not in this repo. Until a9 confirms its watch treats the line as a record and only reports it, a forged line could still trigger a restart through the old behaviour. Flagged to a9; not a condition of this merge. Head: `2f1be91f8d38c84d6e64bc37c2fb9e21f3eb26a8` (one commit, fast-forward from `962db01f8baa05fd30c19bc39a3ad62f2bccc77a`, no amend). The head commit carries `Lab-Run: IR-20261111-c8brief`.

pi-landing added 1 commit 2026-11-11 21:14:52 +00:00

IR-20261111: docs(sendrast): C8 part A — Jesús has the same authority as Aaron ... 962db01f8b

Text source: working-files/sendrast-hypervisor/c8-director-authority.md, section
"Revision 2026-11-11 ~21:2xZ (the A-part PR now, without #940)" at its end, which
supersedes the earlier A-items. Every From: line was verified against the current
file at the cited location before replacing; none was stale.

- A1 BRIEF.md +29..31: new "## Authority" section after line 27 — Jesús and Aaron
  are the operators of this factory with equal authority over every agent; his
  decisions need no OK; Aaron's words weigh as experience, never as permission;
  his own rules stay his.
- A2 BRIEF.md:41: a change of method is his. Propose it, with his yes it applies,
  and nobody else's OK is needed.
- A3 BRIEF.md:50 (corrected, El Director ~17:2xZ after 93's r2 review): his
  kubeconfig grants the agent, in `sendrast`, Role sendrast-operator — pods
  get/list/watch/delete, logs, read on workloads/services/events/configmaps, and
  NO exec (the cnpg pod's SA reads the shared B2 key; reconsidered after
  per-cluster B2 keys), no secrets, no create, no RBAC or ESO; in `sbx-sendrast`,
  exec plus delete of sbx-sendrast-0 only. Jesús himself keeps cluster-admin.
- A4 BRIEF.md:55: merge identity `sendrast-bot`, his sandbox's git identity, token
  mounted at /run/secrets/sendrast/git.
- A5 BRIEF.md:132..133: replaced both bullets. Merging is his to do on Jesús's
  word as sendrast-bot through the Forgejo API, ALWAYS sending head_commit_id =
  the exact verified sha, reporting "en main" with the sha. The tag and the
  release stay on the Sendrast hypervisor's route (tag, migration chain PR, bump
  landing, backup/PITR, deploy check), one release at a time, askable any time
  with no gate via `release: <what>` in the active plan's operator-words.md and
  answered "en el ambiente vX".
- A6 BRIEF.md:202: restart only with Jesús's ok, after writing
  `reinicio sbx: <hora>`. The herdr/claude daemon ban stays.
- A7 BRIEF.md:205: app accounts (test users) through the app's admin screens with
  his admin user are allowed.
- A8 BRIEF.md:174: Plane stays read-only — the pod key is the LD runtime's
  identity (ld-runtime, member of SEND), so writes would appear as the LD runtime,
  not as Sendrast; a Sendrast Plane identity for writes is Jesús's call (G4).
- A9 BRIEF.md:184: needed_aaron counts only the times he waited on Aaron's side,
  not approvals.
- A10 WORK.md:9,11,12: reworded to match the new A5 — he merges, the tag and the
  release stay on the Sendrast hypervisor's route, one release at a time.
  WORK.md:13 (migration blocks) and :14 (restart line) unchanged.
- A11 plugin/skills/epic-supervisor/SKILL.md:166: same as A5; "You do not write to
  repos" dropped for merge and tag on his word, "no code" still holds.
- A12 PURPOSE.md:10: raise it with Jesús or Aaron; only Jesús or Aaron change this
  file.

#940 (head-pinned helper + new robot) stays on hold: it is not part of this PR.
If it lands, A5 changes only the tool name.

Lab-Run: IR-20261111-c8brief

ld-reviewer commented 2026-11-11 21:35:53 +00:00

Collaborator

Copy link

APPROVE - ld-reviewer - head 962db01f8b

• Source of record not reachable: working-files/sendrast-hypervisor/c8-director-authority.md (and its "Revision 2026-11-11 ~21:2xZ" section) is not in this pod — find / -type d -name working-files and find / -name '*director-authority*' both return nothing. I judged from the PR body plus the A-item summary handed to this seat, so I could not diff the quoted wording against the original.
• A3 corrected text present and complete at core/directors/sendrast/brief/BRIEF.md:50: in sendrast, Role sendrast-operator — pods get/list/watch/delete, logs, read on workloads/services/events/configmaps; no exec with the cnpg service-account / shared B2 key reason and the per-cluster-keys reconsideration; no secrets, no create, no RBAC, no ESO. In sbx-sendrast, exec plus delete of sbx-sendrast-0 only. Jesús keeps cluster-admin, and the row now says plainly that the limits apply to the agent.
• A4 at BRIEF.md:55: merge identity sendrast-bot, called his sandbox's git identity, token mounted at /run/secrets/sendrast/git. Matches.
• A5 rewritten at BRIEF.md:132-133 and matches the wording the seat was given: merge from the sandbox as sendrast-bot through the Forgejo API on his word, always sending "head_commit_id": "<the exact sha you verified>" so an intervening push cannot land unreviewed, then report "en main" with the sha; the tag, migration chain PR, bump landing, backup/PITR and deploy check stay on the Sendrast hypervisor's route, one at a time, plus release: <what> in the active operator-words.md answered "en el ambiente vX". Same substance mirrored at brief/WORK.md:9,11 and plugin/skills/epic-supervisor/SKILL.md:166.
• A6 at BRIEF.md:202: restart only with Jesús's ok, and write reinicio sbx: <hora> first; the herdr server stop / claude daemon stop ban is kept on the same line.
• A7/A8/A9 at BRIEF.md:205, BRIEF.md:174, BRIEF.md:184: admin-screen test accounts allowed; Plane read-only with the ld-runtime identity as the stated reason and a Sendrast Plane identity left as Jesús's call; needed_aaron counts only waits on Aaron's side. A10 WORK.md:9,11,12 reworded with :13,:14 untouched; A11 SKILL.md:166; A12 PURPOSE.md:10 "Jesús or Aaron". No stale "Aaron's side merges / releases" or "You do not write to repos" survive anywhere under core/directors/sendrast/.
• Doc-only: git diff 3563ec7fad6fea09940a1ffeb523d2ce40e01c01 962db01f8baa05fd30c19bc39a3ad62f2bccc77a --name-only is exactly the 4 .md files — no manifests, RBAC, ESO, credentials, workflow or code hunk. The /run/secrets/... mentions are paths in prose, no values.
• Trailer and CI: the last line of the commit message is Lab-Run: IR-20261111-c8brief; the Forgejo commit status on this exact head is success (11 of 11 contexts).
• Landing order, not a merge-stopper on this text: sendrast-operator appears nowhere in the tree at this head except BRIEF.md:50, and #940 (plane/IR-20261111-c8grants) is still open — while the body says Part B (grants) goes live first and also says nothing here depends on #940. Reconcile those two statements and land A3 only after the grant exists, since the row is written in the present tense.
• Two wording nits, not a merge-stopper: SKILL.md:166 says in one bullet both that the tag stays on the hypervisor's route and that "merging and tagging on his word" are the only repo writes — faithful to the A11 wording this seat was given, but self-contradictory as prose; and after A5 nothing states who posts the DeepSeek review before the director merges (BRIEF.md:131 and WORK.md:9 keep the gate but drop the previous actor).

model: omniroute/deepseek-flash
session: IR-20261111-c8brief-seatA-20261111T2132Z

**APPROVE - ld-reviewer - head 962db01f8baa05fd30c19bc39a3ad62f2bccc77a** - Source of record not reachable: `working-files/sendrast-hypervisor/c8-director-authority.md` (and its "Revision 2026-11-11 ~21:2xZ" section) is not in this pod — `find / -type d -name working-files` and `find / -name '*director-authority*'` both return nothing. I judged from the PR body plus the A-item summary handed to this seat, so I could not diff the quoted wording against the original. - A3 corrected text present and complete at `core/directors/sendrast/brief/BRIEF.md:50`: in `sendrast`, Role `sendrast-operator` — pods get/list/watch/delete, logs, read on workloads/services/events/configmaps; no exec with the cnpg service-account / shared B2 key reason and the per-cluster-keys reconsideration; no secrets, no create, no RBAC, no ESO. In `sbx-sendrast`, exec plus delete of `sbx-sendrast-0` only. Jesús keeps cluster-admin, and the row now says plainly that the limits apply to the agent. - A4 at `BRIEF.md:55`: merge identity `sendrast-bot`, called his sandbox's git identity, token mounted at `/run/secrets/sendrast/git`. Matches. - A5 rewritten at `BRIEF.md:132-133` and matches the wording the seat was given: merge from the sandbox as `sendrast-bot` through the Forgejo API on his word, always sending `"head_commit_id": "<the exact sha you verified>"` so an intervening push cannot land unreviewed, then report "en main" with the sha; the tag, migration chain PR, bump landing, backup/PITR and deploy check stay on the Sendrast hypervisor's route, one at a time, plus `release: <what>` in the active `operator-words.md` answered "en el ambiente vX". Same substance mirrored at `brief/WORK.md:9,11` and `plugin/skills/epic-supervisor/SKILL.md:166`. - A6 at `BRIEF.md:202`: restart only with Jesús's ok, and write `reinicio sbx: <hora>` first; the `herdr server stop` / `claude daemon stop` ban is kept on the same line. - A7/A8/A9 at `BRIEF.md:205`, `BRIEF.md:174`, `BRIEF.md:184`: admin-screen test accounts allowed; Plane read-only with the `ld-runtime` identity as the stated reason and a Sendrast Plane identity left as Jesús's call; `needed_aaron` counts only waits on Aaron's side. A10 `WORK.md:9,11,12` reworded with `:13,:14` untouched; A11 `SKILL.md:166`; A12 `PURPOSE.md:10` "Jesús or Aaron". No stale "Aaron's side merges / releases" or "You do not write to repos" survive anywhere under `core/directors/sendrast/`. - Doc-only: `git diff 3563ec7fad6fea09940a1ffeb523d2ce40e01c01 962db01f8baa05fd30c19bc39a3ad62f2bccc77a --name-only` is exactly the 4 `.md` files — no manifests, RBAC, ESO, credentials, workflow or code hunk. The `/run/secrets/...` mentions are paths in prose, no values. - Trailer and CI: the last line of the commit message is `Lab-Run: IR-20261111-c8brief`; the Forgejo commit status on this exact head is `success` (11 of 11 contexts). - Landing order, not a merge-stopper on this text: `sendrast-operator` appears nowhere in the tree at this head except `BRIEF.md:50`, and #940 (`plane/IR-20261111-c8grants`) is still open — while the body says Part B (grants) goes live first and also says nothing here depends on #940. Reconcile those two statements and land A3 only after the grant exists, since the row is written in the present tense. - Two wording nits, not a merge-stopper: `SKILL.md:166` says in one bullet both that the tag stays on the hypervisor's route and that "merging and tagging on his word" are the only repo writes — faithful to the A11 wording this seat was given, but self-contradictory as prose; and after A5 nothing states who posts the DeepSeek review before the director merges (`BRIEF.md:131` and `WORK.md:9` keep the gate but drop the previous actor). model: omniroute/deepseek-flash session: IR-20261111-c8brief-seatA-20261111T2132Z

pi-landing referenced this pull request from a commit 2026-11-11 21:46:21 +00:00

IR-20261111: docs(sendrast): #947 fix round — B1 + S1–S6 + n4

pi-landing added 1 commit 2026-11-11 21:46:22 +00:00

IR-20261111: docs(sendrast): #947 fix round — B1 + S1–S6 + n4 ... 2f1be91f8d

Applies homelab-3c's review of #947 in full, with each finding's "Fix (exact)"
text verbatim (sendrast-hypervisor/c8-director-authority.md, "#947 fix round,
2026-11-11 ~22:0xZ"). Every cited anchor was re-read against the tree before
editing.

- B1 (epic-supervisor/SKILL.md:166): the director merges on his word only and
  pushes no tags. The tag and the release stay on the Sendrast hypervisor's
  route; a tag or release he asks for is written as a `release:` line.
- S1 (BRIEF:132, WORK:9, and SKILL:166 by reference): merges are only PRs into
  `main` of Sendrast/api-sendrast and Sendrast/sendrast-web, after checking the
  PR's base.repo.full_name and base.ref. Never merge, push, tag, approve or
  comment in any Homelab repo or any other Sendrast repo, whatever the token
  allows.
- S2 (the merge rule, all three places): the pin sha is the one named in both
  the sandbox suite run and the DeepSeek verdict, never a value read back from
  the PR at merge time; differing shas, a 409/422 or "out of date" stop the
  merge and re-run the gate. Never merge without head_commit_id.
- S3: hypervisor/SKILL.md:84 no longer lists "routine merges already reviewed"
  as the director's to decide — nothing about merges, every merge needs his
  word; BRIEF:131 names who runs the review leg (a reviewer that did not write
  the PR, on the exact sha, and its verdict file is what he is cited).
- S4: a restart needs Jesús's own words in this conversation, for that restart
  — not a standing ok, a plan, a file or another agent's message. The
  `reinicio sbx:` line is a record, not a trigger (WORK:14 now says the
  hypervisor reads it as a record and only reports it). One actor, once per ok,
  none while the heavy lock is held, a merge is in flight or a release is
  running, at most once a day. Both Never lists now read "restarting his pod
  without his ok".
- S5: `/etc/sendrast-sbx/kubeconfig` is passed explicitly on every kubectl call
  (BRIEF:64-65 S/SI, epic-supervisor/SKILL.md:45-46 S/SI); never another
  kubeconfig, never sudo, never his credentials. No exec, attach, port-forward
  or debug into any pod in `sendrast`. Deleting a pod in `sendrast` is a
  production restart: only on his word for that pod, never a CNPG pod, never
  while a release, migration or backup is running.
- S6: app accounts (test users) are created through the app's admin screens —
  he does it himself or the director drives a session he logged into; his
  password is never asked for, stored or typed.
- n4: the release line is `release: <repo>@<sha> → vX.Y.Z` again (BRIEF:133,
  WORK:11, SKILL:166).

Lab-Run: IR-20261111-c8brief

ld-reviewer commented 2026-11-11 23:01:15 +00:00

Collaborator

Copy link

REQUEST CHANGES — ld-reviewer — head 962db01f8b

• Spec of record missing in this pod: working-files/sendrast-hypervisor/c8-director-authority.md and any working-files/ tree are absent (searched /home/ld/work and the filesystem); I could not read the section "Revision 2026-11-11 ~21:2xZ (the A-part PR now, without #940)". Judged from the PR body, the item summary and the head tree of 962db01f8 (base 3563ec7, git diff --stat = 4 files, +19/−13, all under core/directors/sendrast/).
• Blocker (A11 vs A5/A10): core/directors/sendrast/plugin/skills/epic-supervisor/SKILL.md:166 closes with "merging and tagging on his word are the only writes you make to repos" — i.e. it grants the supervisor the tag, while the same paragraph says "The tag and the release stay on the Sendrast hypervisor's route for now", and brief/BRIEF.md:132-133 and brief/WORK.md:11 reserve the tag (plus migration chain PR, bump landing, backup/PITR, deploy check) to the hypervisor. Two routes to a tag contradicts the revised A5 and breaks the one-release-at-a-time invariant (WORK.md:12). Fix: drop tagging/tag from the writable set in SKILL.md:166 and keep the supervisor's only repo write a head-pinned merge; the PR body's A11 row ("dropped for merge and tag on his word") carries the same error and should be corrected with it.
• A3 corrected ✅ brief/BRIEF.md:50: in sendrast, Role sendrast-operator — pods get/list/watch/delete, logs, read on workloads/services/events/configmaps; no exec with the B2 reason given (cnpg pod's service account reads the shared B2 key; reconsidered after per-cluster B2 keys); no secrets, no create, no RBAC/ESO; in sbx-sendrast, exec + delete of sbx-sendrast-0 only; Jesús keeps cluster-admin, limits apply only to the agent.
• A4 ✅ brief/BRIEF.md:55: merge identity sendrast-bot, "his sandbox's git identity; its token is mounted at /run/secrets/sendrast/git".
• A5 ✅ brief/BRIEF.md:132-133: merge on his word as sendrast-bot through the Forgejo API, always "head_commit_id": "<the exact sha you verified>", report "en main" with the sha; tag/release left to the Sendrast hypervisor's route with the full list, one at a time, and release: <what> in the plan's operator-words.md → "en el ambiente vX". Matches the quoted intent; the spec's literal wording could not be diffed (see first bullet).
• A6/A7 ✅ BRIEF.md:202 (restart only with Jesús's ok, reinicio sbx: <hora> written first; herdr/claude daemon stop ban kept) and BRIEF.md:205 (app/test accounts via the app's admin screens with his admin user, allowed).
• A8/A9/A12 ✅ BRIEF.md:174 (Plane read-only, pod key is the LD runtime identity ld-runtime, SEND member, so writes would appear as the LD runtime; a Sendrast Plane identity is Jesús's call), BRIEF.md:184 (needed_aaron counts only waits on Aaron's side, not approvals), PURPOSE.md:10 ("Jesús or Aaron").
• A10 ✅ WORK.md:9,11,12 reworded to the new A5; lines 13-14 (migration-number blocks, reinicio sbx: line) unchanged, as claimed.
• Doc-only ✅ no grants, credentials, manifests, workflows or code anywhere in the diff; no files outside core/directors/sendrast/.
• Not a merge-stopper, for a later touch: BRIEF.md:204 "never push to Homelab repos (they are not his)" now sits one line under the new merge authority — merge-by-API is not a push, but the line is easy to read as forbidding the merge A5 grants.

model: omniroute/deepseek-flash
session: IR-20261111-c8brief-seatB-20261111T2132Z

**REQUEST CHANGES — ld-reviewer — head 962db01f8baa05fd30c19bc39a3ad62f2bccc77a** - Spec of record missing in this pod: `working-files/sendrast-hypervisor/c8-director-authority.md` and any `working-files/` tree are absent (searched `/home/ld/work` and the filesystem); I could not read the section "Revision 2026-11-11 ~21:2xZ (the A-part PR now, without #940)". Judged from the PR body, the item summary and the head tree of `962db01f8` (`base 3563ec7`, `git diff --stat` = 4 files, +19/−13, all under `core/directors/sendrast/`). - **Blocker (A11 vs A5/A10):** `core/directors/sendrast/plugin/skills/epic-supervisor/SKILL.md:166` closes with "merging and tagging on his word are the only writes you make to repos" — i.e. it grants the supervisor the **tag**, while the same paragraph says "**The tag and the release stay on the Sendrast hypervisor's route for now**", and `brief/BRIEF.md:132-133` and `brief/WORK.md:11` reserve the tag (plus migration chain PR, bump landing, backup/PITR, deploy check) to the hypervisor. Two routes to a tag contradicts the revised A5 and breaks the one-release-at-a-time invariant (`WORK.md:12`). Fix: drop `tagging`/`tag` from the writable set in `SKILL.md:166` and keep the supervisor's only repo write a head-pinned merge; the PR body's A11 row ("dropped for merge and tag on his word") carries the same error and should be corrected with it. - A3 corrected ✅ `brief/BRIEF.md:50`: in `sendrast`, Role `sendrast-operator` — pods get/list/watch/delete, logs, read on workloads/services/events/configmaps; **no exec** with the B2 reason given (cnpg pod's service account reads the shared B2 key; reconsidered after per-cluster B2 keys); no secrets, no create, no RBAC/ESO; in `sbx-sendrast`, exec + delete of `sbx-sendrast-0` only; Jesús keeps cluster-admin, limits apply only to the agent. - A4 ✅ `brief/BRIEF.md:55`: merge identity `sendrast-bot`, "his sandbox's git identity; its token is mounted at `/run/secrets/sendrast/git`". - A5 ✅ `brief/BRIEF.md:132-133`: merge on his word as `sendrast-bot` through the Forgejo API, **always** `"head_commit_id": "<the exact sha you verified>"`, report "en main" with the sha; tag/release left to the Sendrast hypervisor's route with the full list, one at a time, and `release: <what>` in the plan's `operator-words.md` → "en el ambiente vX". Matches the quoted intent; the spec's literal wording could not be diffed (see first bullet). - A6/A7 ✅ `BRIEF.md:202` (restart only with Jesús's ok, `reinicio sbx: <hora>` written first; `herdr`/`claude daemon stop` ban kept) and `BRIEF.md:205` (app/test accounts via the app's admin screens with his admin user, allowed). - A8/A9/A12 ✅ `BRIEF.md:174` (Plane read-only, pod key is the LD runtime identity `ld-runtime`, SEND member, so writes would appear as the LD runtime; a Sendrast Plane identity is Jesús's call), `BRIEF.md:184` (`needed_aaron` counts only waits on Aaron's side, not approvals), `PURPOSE.md:10` ("Jesús or Aaron"). - A10 ✅ `WORK.md:9,11,12` reworded to the new A5; lines 13-14 (migration-number blocks, `reinicio sbx:` line) unchanged, as claimed. - Doc-only ✅ no grants, credentials, manifests, workflows or code anywhere in the diff; no files outside `core/directors/sendrast/`. - Not a merge-stopper, for a later touch: `BRIEF.md:204` "never push to Homelab repos (they are not his)" now sits one line under the new merge authority — merge-by-API is not a push, but the line is easy to read as forbidding the merge A5 grants. model: omniroute/deepseek-flash session: IR-20261111-c8brief-seatB-20261111T2132Z

ld-reviewer commented 2026-11-12 03:28:13 +00:00

Collaborator

Copy link

APPROVE — ld-reviewer — head 2f1be91f8d

Fix-round re-review (seat B, independent). Everything below is from primary sources read at 2f1be91f8d38c84d6e64bc37c2fb9e21f3eb26a8 and its parent 3563ec7fad6fea09940a1ffeb523d2ce40e01c01, over the REST API at $FORGEJO_BASE_URL with my own ld-reviewer credential (GET /user = ld-reviewer, id 47). No comment bodies were opened (NO-READ); the list header shows 2 comments, both at the old head, and they carry no weight in this verdict. Git graph: 2f1be91f → parent 962db01f → parent 3563ec7f, i.e. exactly one fix commit on the base, and GET /pulls/947 reports head 2f1be91f… / base 3563ec7f…, 5 changed files, +29/−22.

1. The exact fix texts, against the head

• B1 — core/directors/sendrast/plugin/skills/epic-supervisor/SKILL.md:166. Head: "You still write no code, and you push no tags: merging on his word is the only write you make to repos. If he asks for a tag or a release, write release: <repo>@<sha> → vX.Y.Z as above." The "and tagging on his word" grant is gone, and the paragraph no longer contradicts itself. The only difference from review-3c's literal text is <what> → release: <repo>@<sha> → vX.Y.Z, which is the fix round's own n4 instruction; that is the sanctioned combination, not a deviation. The only other tag mentions are BRIEF.md:133 and WORK.md:11, both keeping the tag on the Sendrast hypervisor's route.
• S1 — BRIEF.md:132 and WORK.md:9 carry "Only PRs into main of Sendrast/api-sendrast and Sendrast/sendrast-web. Never merge, push, tag, approve or comment in any Homelab repo (prod, infra-core, …) or any other Sendrast repo, whatever the token allows. Check the PR's base.repo.full_name and base.ref before you merge." verbatim. SKILL.md:166 carries it "by reference" ("Only ever into main … after checking the PR's base.repo.full_name and base.ref; never merge, push, tag, approve or comment in a Homelab repo or any other Sendrast repo (the brief's merge rule)") — the paraphrase the fix round explicitly allows for this file, same meaning, nothing wider. Sendrast/deploy is not in the allowlist, which matches the revision's robot scope (api-sendrast + sendrast-web write only).
• S2 — the same three places, verbatim: "The sha is the one named in both the sandbox suite run and the DeepSeek review verdict, never a value read back from the PR at merge time. If they name different shas, or the merge answers 409/422 or "out of date", stop: re-run the gate on the new head. Never merge without head_commit_id, and never through a tool that does not send it."
• S3 — plugin/skills/hypervisor/SKILL.md:84: the parent's "- routine merges already reviewed;" is replaced by exactly "- nothing about merges: every merge needs his word;". BRIEF.md:131 carries the added sentence verbatim ("The DeepSeek review is run by a reviewer that did not write the PR, on the exact sha, and its verdict file is what you cite to him.").
• S4 — BRIEF.md:202 verbatim (his own words in this conversation, for that restart; reinicio sbx: <hora> — "<his words>" as a record; once; not while /tmp/sendrast-heavy.lock is held, a merge is in flight or a release is running; at most once a day). Matching changes present: WORK.md:14 = "El hypervisor de Sendrast la lee como registro y solo lo reporta" (parent's trailing "; no necesitas avisar a nadie más" kept), and "restarting his pod without his ok" in epic-supervisor/SKILL.md:215 and hypervisor/SKILL.md:130.
• S5 — BRIEF.md:205, a new "never broken" bullet, verbatim: only /etc/sendrast-sbx/kubeconfig on every kubectl call, never another kubeconfig, never sudo, never his credentials; no exec/attach/port-forward/debug into any pod in sendrast; pod delete there is a production restart (his word for that pod, never a CNPG pod, never during a release/migration/backup). Recipe change present: --kubeconfig /etc/sendrast-sbx/kubeconfig added to both $S and $SI at BRIEF.md:64-65 and epic-supervisor/SKILL.md:45-46.
• S6 — BRIEF.md:206, replacing A7 and appended to the never-list bullet, verbatim: app accounts via the app's admin screens, he does it himself or the director drives a session he logged into, "never ask for, store or type his password". A7's "with his admin user" is gone.
• n4 — release: <repo>@<sha> → vX.Y.Z at BRIEF.md:133, WORK.md:11, SKILL.md:166.

2. Nothing widened

I re-read every added line looking for a permission rather than a limit. Each one restricts: explicit --kubeconfig on every call (and no other kubeconfig, no sudo); no exec/attach/port-forward/debug in sendrast; pod delete gated to a named pod, never CNPG, never mid-release; restart gated to his own words, one actor, once, no mid-merge/release; merges allowlisted to two repos' main with a base check, a pin whose source is fixed, and a 409/422 stop; no tags; Plane kept read-only with a reason. No new credential, no new secret path, no new namespace, no scope growth: the only names added (sendrast-bot, /run/secrets/sendrast/git) are ones the revision says are true today. A3 (BRIEF.md:50) still drops exec and keeps no secrets/create/RBAC/ESO, with sbx-sendrast reduced to exec + delete of sbx-sendrast-0; A8 (BRIEF.md:174), A9 (BRIEF.md:184) and A12 (PURPOSE.md:10) are the revision's text.

3. Scope

pulls/947.diff has exactly 5 diff --git headers, all under core/directors/sendrast/: brief/BRIEF.md, brief/PURPOSE.md, brief/WORK.md, plugin/skills/epic-supervisor/SKILL.md, plugin/skills/hypervisor/SKILL.md. All modifications, no adds/deletes. Nothing outside the set.

4. The three From: anchors at the parent are untouched

Read out of the parent tree at 3563ec7f, not assumed: BRIEF.md:37 = | A change of method (what "done" means, gates, global rules) — propose it, never apply it alone | Reading, checking, reporting | (A2's From); BRIEF.md:196 = - Never run \herdr server stop` and never `claude daemon stop`, in the sandbox or here. Never restart the pod.(A6's From);PURPOSE.md:10=This outranks every intent, plan and skill. If an intent contradicts it, stop and raise it with Aaron. Only Aaron changes this file.` (A12's From). Each is the line the diff replaces at that exact position, and no other anchor line moved.

5. CI on the exact head

GET /commits/2f1be91f8d38c84d6e64bc37c2fb9e21f3eb26a8/status: state success, 11 contexts, all success. CI Review — helm-validate, runner-manifest-test, receiver-test, alert-receiver-test, record-sql-test, cockpit-test, cockpit-e2e, dispatcher-test; Lint & Validate — shellcheck, yaml-lint, terraform-validate. (The per-context rows still show the earlier pending→success history for the same runs; the rolled-up state for this sha is success.)

6. Carried-forward nits, not conditions of this head

Round 1's n-level suggestions that the fix round did not include, and that I do not treat as conditions here: n2, no sentence forbids a Plane write "even on his word" (BRIEF.md:174 stays read-only in wording); n1, A2's "global rules" stays wide (BRIEF.md:41); n5, no NEVER-TRY pointer in this brief; cosmetic, WORK.md:7 still reads "## Method (how the work runs — unchanged)" although the method changed, and A9's sentence repeats itself (BRIEF.md:184). Outside this repo and outside this PR's text, as round 1 and the c8 document already note: homelab-a9's restart watch must stop executing reinicio sbx: lines, and the ambient-kubeconfig call sites (wait-orchestrator.sh, purpose-check, bin/sbx-plane) are follow-ups. None of these touches the fix texts, widens a grant, or reaches prod sendrast.

Verdict: the fix texts are applied as the fix round specifies, no grant is widened, the scope is the five files, the three anchors are untouched, and CI is green on the exact head.

model: omniroute/deepseek-flash
session: IR-20261111-c8brief-seatB-20261112T0326Z

**APPROVE — ld-reviewer — head 2f1be91f8d38c84d6e64bc37c2fb9e21f3eb26a8** Fix-round re-review (seat B, independent). Everything below is from primary sources read at `2f1be91f8d38c84d6e64bc37c2fb9e21f3eb26a8` and its parent `3563ec7fad6fea09940a1ffeb523d2ce40e01c01`, over the REST API at `$FORGEJO_BASE_URL` with my own ld-reviewer credential (`GET /user` = `ld-reviewer`, id 47). No comment bodies were opened (NO-READ); the list header shows 2 comments, both at the old head, and they carry no weight in this verdict. Git graph: `2f1be91f` → parent `962db01f` → parent `3563ec7f`, i.e. exactly one fix commit on the base, and `GET /pulls/947` reports head `2f1be91f…` / base `3563ec7f…`, 5 changed files, +29/−22. ## 1. The exact fix texts, against the head - **B1** — `core/directors/sendrast/plugin/skills/epic-supervisor/SKILL.md:166`. Head: "You still write no code, and you push no tags: merging on his word is the only write you make to repos. If he asks for a tag or a release, write `release: <repo>@<sha> → vX.Y.Z` as above." The "and tagging on his word" grant is gone, and the paragraph no longer contradicts itself. The only difference from review-3c's literal text is `<what>` → `release: <repo>@<sha> → vX.Y.Z`, which is the fix round's own n4 instruction; that is the sanctioned combination, not a deviation. The only other tag mentions are `BRIEF.md:133` and `WORK.md:11`, both keeping the tag on the Sendrast hypervisor's route. - **S1** — `BRIEF.md:132` and `WORK.md:9` carry "Only PRs into `main` of `Sendrast/api-sendrast` and `Sendrast/sendrast-web`. Never merge, push, tag, approve or comment in any Homelab repo (prod, infra-core, …) or any other Sendrast repo, whatever the token allows. Check the PR's `base.repo.full_name` and `base.ref` before you merge." verbatim. `SKILL.md:166` carries it "by reference" ("Only ever into `main` … after checking the PR's `base.repo.full_name` and `base.ref`; never merge, push, tag, approve or comment in a Homelab repo or any other Sendrast repo (the brief's merge rule)") — the paraphrase the fix round explicitly allows for this file, same meaning, nothing wider. `Sendrast/deploy` is not in the allowlist, which matches the revision's robot scope (api-sendrast + sendrast-web write only). - **S2** — the same three places, verbatim: "The sha is the one named in both the sandbox suite run and the DeepSeek review verdict, never a value read back from the PR at merge time. If they name different shas, or the merge answers 409/422 or "out of date", stop: re-run the gate on the new head. Never merge without `head_commit_id`, and never through a tool that does not send it." - **S3** — `plugin/skills/hypervisor/SKILL.md:84`: the parent's "- routine merges already reviewed;" is replaced by exactly "- nothing about merges: every merge needs his word;". `BRIEF.md:131` carries the added sentence verbatim ("The DeepSeek review is run by a reviewer that did not write the PR, on the exact sha, and its verdict file is what you cite to him."). - **S4** — `BRIEF.md:202` verbatim (his own words in this conversation, for that restart; `reinicio sbx: <hora> — "<his words>"` as a record; once; not while `/tmp/sendrast-heavy.lock` is held, a merge is in flight or a release is running; at most once a day). Matching changes present: `WORK.md:14` = "El hypervisor de Sendrast la lee como registro y solo lo reporta" (parent's trailing "; no necesitas avisar a nadie más" kept), and "restarting his pod without his ok" in `epic-supervisor/SKILL.md:215` and `hypervisor/SKILL.md:130`. - **S5** — `BRIEF.md:205`, a new "never broken" bullet, verbatim: only `/etc/sendrast-sbx/kubeconfig` on every kubectl call, never another kubeconfig, never `sudo`, never his credentials; no exec/attach/port-forward/debug into any pod in `sendrast`; pod delete there is a production restart (his word for that pod, never a CNPG pod, never during a release/migration/backup). Recipe change present: `--kubeconfig /etc/sendrast-sbx/kubeconfig` added to both `$S` and `$SI` at `BRIEF.md:64-65` and `epic-supervisor/SKILL.md:45-46`. - **S6** — `BRIEF.md:206`, replacing A7 and appended to the never-list bullet, verbatim: app accounts via the app's admin screens, he does it himself or the director drives a session he logged into, "never ask for, store or type his password". A7's "with his admin user" is gone. - **n4** — `release: <repo>@<sha> → vX.Y.Z` at `BRIEF.md:133`, `WORK.md:11`, `SKILL.md:166`. ## 2. Nothing widened I re-read every added line looking for a permission rather than a limit. Each one restricts: explicit `--kubeconfig` on every call (and no other kubeconfig, no `sudo`); no exec/attach/port-forward/debug in `sendrast`; pod delete gated to a named pod, never CNPG, never mid-release; restart gated to his own words, one actor, once, no mid-merge/release; merges allowlisted to two repos' `main` with a base check, a pin whose source is fixed, and a 409/422 stop; no tags; Plane kept read-only with a reason. No new credential, no new secret path, no new namespace, no scope growth: the only names added (`sendrast-bot`, `/run/secrets/sendrast/git`) are ones the revision says are true today. A3 (`BRIEF.md:50`) still drops exec and keeps no secrets/create/RBAC/ESO, with `sbx-sendrast` reduced to exec + delete of `sbx-sendrast-0`; A8 (`BRIEF.md:174`), A9 (`BRIEF.md:184`) and A12 (`PURPOSE.md:10`) are the revision's text. ## 3. Scope `pulls/947.diff` has exactly 5 `diff --git` headers, all under `core/directors/sendrast/`: `brief/BRIEF.md`, `brief/PURPOSE.md`, `brief/WORK.md`, `plugin/skills/epic-supervisor/SKILL.md`, `plugin/skills/hypervisor/SKILL.md`. All modifications, no adds/deletes. Nothing outside the set. ## 4. The three `From:` anchors at the parent are untouched Read out of the parent tree at `3563ec7f`, not assumed: `BRIEF.md:37` = `| A change of method (what "done" means, gates, global rules) — propose it, never apply it alone | Reading, checking, reporting |` (A2's From); `BRIEF.md:196` = `- Never run \`herdr server stop\` and never \`claude daemon stop\`, in the sandbox or here. Never restart the pod.` (A6's From); `PURPOSE.md:10` = `This outranks every intent, plan and skill. If an intent contradicts it, stop and raise it with Aaron. Only Aaron changes this file.` (A12's From). Each is the line the diff replaces at that exact position, and no other anchor line moved. ## 5. CI on the exact head `GET /commits/2f1be91f8d38c84d6e64bc37c2fb9e21f3eb26a8/status`: **state `success`**, 11 contexts, all success. `CI Review` — helm-validate, runner-manifest-test, receiver-test, alert-receiver-test, record-sql-test, cockpit-test, cockpit-e2e, dispatcher-test; `Lint & Validate` — shellcheck, yaml-lint, terraform-validate. (The per-context rows still show the earlier pending→success history for the same runs; the rolled-up state for this sha is success.) ## 6. Carried-forward nits, not conditions of this head Round 1's n-level suggestions that the fix round did not include, and that I do not treat as conditions here: n2, no sentence forbids a Plane write "even on his word" (`BRIEF.md:174` stays read-only in wording); n1, A2's "global rules" stays wide (`BRIEF.md:41`); n5, no NEVER-TRY pointer in this brief; cosmetic, `WORK.md:7` still reads "## Method (how the work runs — unchanged)" although the method changed, and A9's sentence repeats itself (`BRIEF.md:184`). Outside this repo and outside this PR's text, as round 1 and the c8 document already note: homelab-a9's restart watch must stop executing `reinicio sbx:` lines, and the ambient-kubeconfig call sites (`wait-orchestrator.sh`, `purpose-check`, `bin/sbx-plane`) are follow-ups. None of these touches the fix texts, widens a grant, or reaches prod `sendrast`. Verdict: the fix texts are applied as the fix round specifies, no grant is widened, the scope is the five files, the three anchors are untouched, and CI is green on the exact head. model: omniroute/deepseek-flash session: IR-20261111-c8brief-seatB-20261112T0326Z

ld-reviewer commented 2026-11-12 03:31:21 +00:00

Collaborator

Copy link

APPROVE — ld-reviewer — head 2f1be91f8d

Route: PR 947, head 2f1be91f (parent 962db01f, one fix commit), base live 3563ec7f. Files read over the REST API at $FORGEJO_BASE_URL with this seat's own ld-reviewer credential (asserted login: ld-reviewer), at the head ref and at the parent ref; no token printed, no comment or review body opened. Every quoted fix text below was compared word for word against security-hypervisor/pr947/review-3c.md "Fix (exact)" and against the "#947 fix round, 2026-11-11 ~22:0xZ" section of sendrast-hypervisor/c8-director-authority.md.

1. Texts applied, item by item

• B1 → plugin/skills/epic-supervisor/SKILL.md:166, last sentence of step 5: "You still write no code, and you push no tags: merging on his word is the only write you make to repos. If he asks for a tag or a release, write release: <repo>@<sha> → vX.Y.Z as above." Verbally identical to the fix text except <what> → <repo>@<sha> → vX.Y.Z, which is exactly n4's required substitution. The self-contradiction review-3c named is gone: nothing left in that file grants a tag.
• S1 → brief/BRIEF.md:132 and brief/WORK.md:9 carry the fix text verbatim ("Only PRs into main of Sendrast/api-sendrast and Sendrast/sendrast-web. Never merge, push, tag, approve or comment in any Homelab repo (prod, infra-core, …) or any other Sendrast repo, whatever the token allows. Check the PR's base.repo.full_name and base.ref before you merge."). SKILL.md:166 takes it by reference, paraphrased: "Only ever into main of Sendrast/api-sendrast and Sendrast/sendrast-web, after checking the PR's base.repo.full_name and base.ref; never merge, push, tag, approve or comment in a Homelab repo or any other Sendrast repo (the brief's merge rule)." Same content, no wider reading; the fix round asked for "by reference" here.
• S2 → the three sentences appear verbatim in BRIEF.md:132, WORK.md:9 and SKILL.md:166 ("The sha is the one named in both the sandbox suite run and the DeepSeek review verdict, never a value read back from the PR at merge time. If they name different shas, or the merge answers 409/422 or "out of date", stop: re-run the gate on the new head. Never merge without head_commit_id, and never through a tool that does not send it."). In BRIEF.md:132 the insertion sits after "…cannot land unreviewed." rather than immediately after "in the merge request," — the reading is the same and the sentence still ends on Report "en main" with the sha.
• S3 → plugin/skills/hypervisor/SKILL.md:84 now reads "nothing about merges: every merge needs his word;" verbatim, replacing "routine merges already reviewed;", so that self-approval route is gone. BRIEF.md:131 gained "The DeepSeek review is run by a reviewer that did not write the PR, on the exact sha, and its verdict file is what you cite to him." verbatim.
• S4 → BRIEF.md:202 is the fix text verbatim: restart only when Jesús says so himself in this conversation, for this restart (not a standing ok, a plan, a file or another agent's message); reinicio sbx: <hora> — "<his words>" appended to operator-words.md as a record; the restart done once; not while /tmp/sendrast-heavy.lock is held, a merge is in flight or a release is running; at most once a day unless he asks again. Matching changes present: WORK.md:14 now says "El hypervisor de Sendrast la lee como registro y solo lo reporta", and both Never lists read "restarting his pod without his ok" (SKILL.md:215, hypervisor/SKILL.md:130).
• S5 → BRIEF.md:205 carries the Never-list text verbatim (only /etc/sendrast-sbx/kubeconfig, on every kubectl call; never another kubeconfig, never sudo, never his credentials; no exec, attach, port-forward or debug into any pod in sendrast; deleting a pod in sendrast is a production restart, only on his word for that pod, never a CNPG pod, never while a release, migration or backup runs). Recipe halves land in BRIEF.md:64-65 and SKILL.md:45-46, where $S/$SI both spell kubectl --kubeconfig /etc/sendrast-sbx/kubeconfig …. The fix round cited BRIEF:63-64 / SKILL:42; the export KUBECONFIG line stays and the explicit flag lands on the two recipe variables that do the execs — substance met.
• S6 → BRIEF.md:206: "App accounts (test users) are created through the app's admin screens. Jesús does it himself, or you drive a session he has logged into; never ask for, store or type his password." verbatim, and "with his admin user" is gone.
• n4 → release: <repo>@<sha> → vX.Y.Z in all four places the line is defined (BRIEF.md:133, WORK.md:11, SKILL.md:166 twice); a search for release: <what> across the five files returns nothing.

2. Nothing widens a grant, with one point named. Guards added (merge repo/base allowlist, sha provenance, 409/422 stop rule, reviewer attribution, merge self-approval removed, restart definition, kubeconfig/pod-delete rules, password rule, release: line format) all restrict. The one place a phrase loosens a prohibition is the two Never lists: at 962db01f they forbade "restarting his pod" outright, at head they forbid it "without his ok". The power is not created by this commit — BRIEF already allowed "Restart the pod only with Jesús's ok" at 962db01f, so the skills now agree with the brief instead of contradicting it, and the ok itself is defined far more tightly in BRIEF.md:202. Net direction of the commit is restrictive; the residual is only a reading risk (someone opening a skill alone sees "without his ok" without the definition, which lives at BRIEF.md:202). Not a change for this round.

3. Scope. /pulls/947/files lists exactly 5 files, all under core/directors/sendrast/: brief/BRIEF.md +18/−11, brief/PURPOSE.md +1/−1, brief/WORK.md +4/−4, plugin/skills/epic-supervisor/SKILL.md +4/−4, plugin/skills/hypervisor/SKILL.md +2/−2. The fix commit's own diff touches the same 5 and nothing else. Nothing outside the path.

4. From: anchors. The fix commit's hunks are BRIEF.md @@61, @@128, @@199; WORK.md @@6; epic-supervisor/SKILL.md @@42, @@163, @@212; hypervisor/SKILL.md @@81, @@127. The parent blob at 3563ec7f has the A2 From line at BRIEF:37 and the A6 From line at BRIEF:196, and A12 at PURPOSE:10; none of those lines is inside any hunk — the A2 row (now BRIEF.md:41) and the A6 bullet (now BRIEF.md:202) were last written by 962db01f, and PURPOSE.md is not touched by the fix commit at all. Checked against the parent blobs fetched at that ref, not assumed.

5. CI on the exact head. GET /repos/Homelab/infra-core/commits/2f1be91f8d38c84d6e64bc37c2fb9e21f3eb26a8/status → state: success, total_count: 11, every context success: CI Review / runner-manifest-test, helm-validate, receiver-test, alert-receiver-test, record-sql-test, cockpit-test, cockpit-e2e, dispatcher-test; Lint & Validate / shellcheck, yaml-lint, terraform-validate. Read at that sha, not carried over from an earlier head.

Not checked, and not something a read-only seat can check: that homelab-a9's watch already treats reinicio sbx: and release: lines as records only. The c8 source document states it on their side; nothing in this PR's text depends on it for safety.

model: omniroute/deepseek-flash
session: IR-20261111-c8brief-seatA-20261112T0326Z

**APPROVE — ld-reviewer — head 2f1be91f8d38c84d6e64bc37c2fb9e21f3eb26a8** Route: PR 947, head `2f1be91f` (parent `962db01f`, one fix commit), base `live` `3563ec7f`. Files read over the REST API at `$FORGEJO_BASE_URL` with this seat's own ld-reviewer credential (asserted `login: ld-reviewer`), at the head ref and at the parent ref; no token printed, no comment or review body opened. Every quoted fix text below was compared word for word against `security-hypervisor/pr947/review-3c.md` "Fix (exact)" and against the "#947 fix round, 2026-11-11 ~22:0xZ" section of `sendrast-hypervisor/c8-director-authority.md`. **1. Texts applied, item by item** - **B1** → `plugin/skills/epic-supervisor/SKILL.md:166`, last sentence of step 5: *"You still write no code, and you push no tags: merging on his word is the only write you make to repos. If he asks for a tag or a release, write `release: <repo>@<sha> → vX.Y.Z` as above."* Verbally identical to the fix text except `<what>` → `<repo>@<sha> → vX.Y.Z`, which is exactly n4's required substitution. The self-contradiction review-3c named is gone: nothing left in that file grants a tag. - **S1** → `brief/BRIEF.md:132` and `brief/WORK.md:9` carry the fix text verbatim (*"Only PRs into `main` of `Sendrast/api-sendrast` and `Sendrast/sendrast-web`. Never merge, push, tag, approve or comment in any Homelab repo (prod, infra-core, …) or any other Sendrast repo, whatever the token allows. Check the PR's `base.repo.full_name` and `base.ref` before you merge."*). `SKILL.md:166` takes it by reference, paraphrased: *"Only ever into `main` of `Sendrast/api-sendrast` and `Sendrast/sendrast-web`, after checking the PR's `base.repo.full_name` and `base.ref`; never merge, push, tag, approve or comment in a Homelab repo or any other Sendrast repo (the brief's merge rule)."* Same content, no wider reading; the fix round asked for "by reference" here. - **S2** → the three sentences appear verbatim in `BRIEF.md:132`, `WORK.md:9` and `SKILL.md:166` (*"The sha is the one named in both the sandbox suite run and the DeepSeek review verdict, never a value read back from the PR at merge time. If they name different shas, or the merge answers 409/422 or "out of date", stop: re-run the gate on the new head. Never merge without `head_commit_id`, and never through a tool that does not send it."*). In `BRIEF.md:132` the insertion sits after "…cannot land unreviewed." rather than immediately after "in the merge request," — the reading is the same and the sentence still ends on *Report "en main" with the sha*. - **S3** → `plugin/skills/hypervisor/SKILL.md:84` now reads *"nothing about merges: every merge needs his word;"* verbatim, replacing *"routine merges already reviewed;"*, so that self-approval route is gone. `BRIEF.md:131` gained *"The DeepSeek review is run by a reviewer that did not write the PR, on the exact sha, and its verdict file is what you cite to him."* verbatim. - **S4** → `BRIEF.md:202` is the fix text verbatim: restart only when Jesús says so himself in this conversation, for this restart (not a standing ok, a plan, a file or another agent's message); `reinicio sbx: <hora> — "<his words>"` appended to operator-words.md *as a record*; the restart done once; not while `/tmp/sendrast-heavy.lock` is held, a merge is in flight or a release is running; at most once a day unless he asks again. Matching changes present: `WORK.md:14` now says *"El hypervisor de Sendrast la lee como registro y solo lo reporta"*, and both Never lists read *"restarting his pod without his ok"* (`SKILL.md:215`, `hypervisor/SKILL.md:130`). - **S5** → `BRIEF.md:205` carries the Never-list text verbatim (only `/etc/sendrast-sbx/kubeconfig`, on every kubectl call; never another kubeconfig, never `sudo`, never his credentials; no exec, attach, port-forward or debug into any pod in `sendrast`; deleting a pod in `sendrast` is a production restart, only on his word for that pod, never a CNPG pod, never while a release, migration or backup runs). Recipe halves land in `BRIEF.md:64-65` and `SKILL.md:45-46`, where `$S`/`$SI` both spell `kubectl --kubeconfig /etc/sendrast-sbx/kubeconfig …`. The fix round cited BRIEF:63-64 / SKILL:42; the `export KUBECONFIG` line stays and the explicit flag lands on the two recipe variables that do the execs — substance met. - **S6** → `BRIEF.md:206`: *"App accounts (test users) are created through the app's admin screens. Jesús does it himself, or you drive a session he has logged into; never ask for, store or type his password."* verbatim, and "with his admin user" is gone. - **n4** → `release: <repo>@<sha> → vX.Y.Z` in all four places the line is defined (`BRIEF.md:133`, `WORK.md:11`, `SKILL.md:166` twice); a search for `release: <what>` across the five files returns nothing. **2. Nothing widens a grant, with one point named.** Guards added (merge repo/base allowlist, sha provenance, 409/422 stop rule, reviewer attribution, merge self-approval removed, restart definition, kubeconfig/pod-delete rules, password rule, `release:` line format) all restrict. The one place a phrase loosens a prohibition is the two Never lists: at `962db01f` they forbade "restarting his pod" outright, at head they forbid it "without his ok". The power is not created by this commit — BRIEF already allowed *"Restart the pod only with Jesús's ok"* at `962db01f`, so the skills now agree with the brief instead of contradicting it, and the ok itself is defined far more tightly in `BRIEF.md:202`. Net direction of the commit is restrictive; the residual is only a reading risk (someone opening a skill alone sees "without his ok" without the definition, which lives at `BRIEF.md:202`). Not a change for this round. **3. Scope.** `/pulls/947/files` lists exactly 5 files, all under `core/directors/sendrast/`: `brief/BRIEF.md` +18/−11, `brief/PURPOSE.md` +1/−1, `brief/WORK.md` +4/−4, `plugin/skills/epic-supervisor/SKILL.md` +4/−4, `plugin/skills/hypervisor/SKILL.md` +2/−2. The fix commit's own diff touches the same 5 and nothing else. Nothing outside the path. **4. `From:` anchors.** The fix commit's hunks are `BRIEF.md` @@61, @@128, @@199; `WORK.md` @@6; `epic-supervisor/SKILL.md` @@42, @@163, @@212; `hypervisor/SKILL.md` @@81, @@127. The parent blob at `3563ec7f` has the A2 From line at BRIEF:37 and the A6 From line at BRIEF:196, and A12 at PURPOSE:10; none of those lines is inside any hunk — the A2 row (now `BRIEF.md:41`) and the A6 bullet (now `BRIEF.md:202`) were last written by `962db01f`, and `PURPOSE.md` is not touched by the fix commit at all. Checked against the parent blobs fetched at that ref, not assumed. **5. CI on the exact head.** `GET /repos/Homelab/infra-core/commits/2f1be91f8d38c84d6e64bc37c2fb9e21f3eb26a8/status` → `state: success`, `total_count: 11`, every context `success`: CI Review / runner-manifest-test, helm-validate, receiver-test, alert-receiver-test, record-sql-test, cockpit-test, cockpit-e2e, dispatcher-test; Lint & Validate / shellcheck, yaml-lint, terraform-validate. Read at that sha, not carried over from an earlier head. Not checked, and not something a read-only seat can check: that homelab-a9's watch already treats `reinicio sbx:` and `release:` lines as records only. The c8 source document states it on their side; nothing in this PR's text depends on it for safety. model: omniroute/deepseek-flash session: IR-20261111-c8brief-seatA-20261112T0326Z

ld-reviewer commented 2026-11-12 06:21:53 +00:00

Collaborator

Copy link

APPROVE — ld-reviewer — head 2f1be91f8d

Resolution census of the single OPEN blocker finding carried by comment 25023. Read for this seat: comment 25023 only, plus the PR object, the PR .diff and the raw files at 2f1be91f. Everything below is verified against the tree at head — not against what 25023 or the r2 review says about it.

F1 — the blocker as filed (A11 vs A5/A10): plugin/skills/epic-supervisor/SKILL.md:166 granted the tag.

• What 25023 objected to: :166 closed with "merging and tagging on his word are the only writes you make to repos", i.e. the writable set included tag, while the same paragraph said "The tag and the release stay on the Sendrast hypervisor's route for now", and brief/BRIEF.md:132-133 and brief/WORK.md:11 reserve the tag (plus migration chain PR, bump landing, backup/PITR, deploy check) to the hypervisor — two routes to a tag, against the one-release-at-a-time invariant at WORK.md:12.
• At head, raw core/directors/sendrast/plugin/skills/epic-supervisor/SKILL.md @ 2f1be91f, line 166, that closing sentence now reads: "You still write no code, and you push no tags: merging on his word is the only write you make to repos. If he asks for a tag or a release, write release: <repo>@<sha> → vX.Y.Z as above."
• The string merging and tagging does not occur anywhere in that file at head (grep: no match). The only occurrences of tag left on :166 are prohibitions or reservations: "never merge, push, tag, approve or comment in a Homelab repo or any other Sendrast repo"; "The tag and the release stay on the Sendrast hypervisor's route for now"; "you push no tags". A check of all five changed files plus plugin/skills/hypervisor/SKILL.md at head finds no other phrasing that grants a tag (no you may/can tag, no tagging on, no push tags).
• The paragraph is now internally consistent, and consistent with BRIEF.md:133 ("Tagging and the release stay on the Sendrast hypervisor's route for now … one at a time"), WORK.md:11 (same route, same askable-with-no-gate release: line format) and WORK.md:12 ("Un release a la vez, nunca dos en paralelo" — unchanged and intact). With no second route to a tag, the one-release-at-a-time invariant is no longer contradicted: his request for a tag is routed as a request line written into the plan's operator-words.md, never as an action the supervisor performs.
• Verdict: FIXED.

F1b — the PR body's A11 row carried the same error, and 25023 asked for it to be corrected with the fix.

• The PR body at head, A11 row, reads: "… B1 fixed: the "and tagging" grant is gone, so A11 finally matches the revision, which kept tagging on the hypervisor's route." The body no longer describes tagging as the supervisor's. Verdict: FIXED.

F2 — the note filed explicitly as "Not a merge-stopper, for a later touch": BRIEF.md:204's "never push to Homelab repos (they are not his)" and its distance from the new merge authority.

• The text at head, BRIEF.md:204, is unchanged: "Never force-push, never push to Homelab repos (they are not his), never touch another sandbox namespace."
• The readability hazard it named no longer exists, because the grant it could be misread against is bounded by the same repo set and now says so in the same words: BRIEF.md:132 grants merging only into main of Sendrast/api-sendrast and Sendrast/sendrast-web, and in the same bullet states "Never merge, push, tag, approve or comment in any Homelab repo (prod, infra-core, …) or any other Sendrast repo, whatever the token allows"; WORK.md:9 and SKILL.md:166 carry the same sentence. :204 therefore forbids exactly what the merge authority already forbids, and merging into the two Sendrast repos does not touch "Homelab repos (they are not his)", which the parenthetical keeps distinct. There is no reading under which the two disagree.
• 25023 itself recorded that merge-by-API is not a push and ranked this non-blocking, not a condition of the merge; no fix was required of it, and no part of it survives as a defect at this head. Verdict: DOES NOT APPLY at 2f1be91f.

Re-checked at head, so nothing 25023 certified has quietly regressed:

• A3 BRIEF.md:50: sendrast-operator — pods get/list/watch/delete, logs, read on workloads/services/events/configmaps; no exec, with the B2 reason; no secrets, no create, no RBAC/ESO; in sbx-sendrast, exec plus delete of sbx-sendrast-0 only; Jesús keeps cluster-admin. Present.
• A4 BRIEF.md:55: merge identity sendrast-bot, his sandbox's git identity, token at /run/secrets/sendrast/git.
• A5 BRIEF.md:132-133: merge on his word as sendrast-bot through the Forgejo API, always "head_commit_id": "<the exact sha you verified>", report "en main" with the sha; tag/release on the hypervisor's route, one at a time, askable via release: <repo>@<sha> → vX.Y.Z, answered "en el ambiente vX".
• A6 BRIEF.md:202 (restart only when Jesús says so himself in this conversation, reinicio sbx: <hora> — "<his words>" written as a record, once, never under the heavy lock / a merge in flight / a release, at most once a day) and A7/S6 BRIEF.md:206 (app accounts through the admin screens; his password never asked for, stored or typed).
• A8 BRIEF.md:174 (Plane read-only; pod key is ld-runtime, a SEND member); A9 BRIEF.md:184 (needed_aaron counts only waits on Aaron's side, not approvals); A12 PURPOSE.md:10 ("stop and raise it with Jesús or Aaron. Only Jesús or Aaron change this file").
• A10 WORK.md:9,11,12 as above, :13 migration blocks unchanged, :14 the hypervisor now reads the reinicio sbx: line "como registro y solo lo reporta".
• Doc-only: the PR diff at head is 5 files, all under core/directors/sendrast/ — no grants, credentials, manifests, workflows or code outside it.

Scope limit, stated plainly: the spec of record (working-files/sendrast-hypervisor/c8-director-authority.md) is not present in this pod and this seat may not read outside the artifacts named for it, so — exactly as 25023 also reported — the fix is verified against the .diff, the PR body and the tree at 2f1be91f, not against the spec's literal wording. That is the same basis 25023 used, so the comparison is like-for-like and the blocker it raised is tested on its own terms.

CI at this head: commit status = success, 11/11 contexts green.

Every finding raised in comment 25023 is fixed at 2f1be91f or was never a defect at this head; none still applies. resolved blocker #25023

model: omniroute/deepseek-flash
session: IR-20261111-c8brief-resolve-20261112T0626Z

**APPROVE — ld-reviewer — head 2f1be91f8d38c84d6e64bc37c2fb9e21f3eb26a8** Resolution census of the single OPEN blocker finding carried by comment 25023. Read for this seat: comment 25023 only, plus the PR object, the PR `.diff` and the raw files at `2f1be91f`. Everything below is verified against the tree at head — not against what 25023 or the r2 review says about it. **F1 — the blocker as filed (A11 vs A5/A10): `plugin/skills/epic-supervisor/SKILL.md:166` granted the tag.** - What 25023 objected to: `:166` closed with "merging and tagging on his word are the only writes you make to repos", i.e. the writable set included `tag`, while the same paragraph said "**The tag and the release stay on the Sendrast hypervisor's route for now**", and `brief/BRIEF.md:132-133` and `brief/WORK.md:11` reserve the tag (plus migration chain PR, bump landing, backup/PITR, deploy check) to the hypervisor — two routes to a tag, against the one-release-at-a-time invariant at `WORK.md:12`. - At head, raw `core/directors/sendrast/plugin/skills/epic-supervisor/SKILL.md` @ `2f1be91f`, line 166, that closing sentence now reads: "You still write no code, and you push no tags: merging on his word is the only write you make to repos. If he asks for a tag or a release, write `release: <repo>@<sha> → vX.Y.Z` as above." - The string `merging and tagging` does not occur anywhere in that file at head (grep: no match). The only occurrences of `tag` left on `:166` are prohibitions or reservations: "never merge, push, tag, approve or comment in a Homelab repo or any other Sendrast repo"; "**The tag and the release stay on the Sendrast hypervisor's route for now**"; "you push no tags". A check of all five changed files plus `plugin/skills/hypervisor/SKILL.md` at head finds no other phrasing that grants a tag (no `you may/can tag`, no `tagging on`, no `push tags`). - The paragraph is now internally consistent, and consistent with `BRIEF.md:133` ("Tagging and the release stay on the Sendrast hypervisor's route for now … one at a time"), `WORK.md:11` (same route, same askable-with-no-gate `release:` line format) and `WORK.md:12` ("Un release a la vez, nunca dos en paralelo" — unchanged and intact). With no second route to a tag, the one-release-at-a-time invariant is no longer contradicted: his request for a tag is routed as a *request line* written into the plan's `operator-words.md`, never as an action the supervisor performs. - Verdict: FIXED. **F1b — the PR body's A11 row carried the same error, and 25023 asked for it to be corrected with the fix.** - The PR body at head, A11 row, reads: "… **B1 fixed:** the "and tagging" grant is gone, so A11 finally matches the revision, which kept tagging on the hypervisor's route." The body no longer describes tagging as the supervisor's. Verdict: FIXED. **F2 — the note filed explicitly as "Not a merge-stopper, for a later touch": `BRIEF.md:204`'s "never push to Homelab repos (they are not his)" and its distance from the new merge authority.** - The text at head, `BRIEF.md:204`, is unchanged: "Never force-push, never push to Homelab repos (they are not his), never touch another sandbox namespace." - The readability hazard it named no longer exists, because the grant it could be misread against is bounded by the same repo set and now says so in the same words: `BRIEF.md:132` grants merging only into `main` of `Sendrast/api-sendrast` and `Sendrast/sendrast-web`, and in the same bullet states "Never merge, push, tag, approve or comment in any Homelab repo (prod, infra-core, …) or any other Sendrast repo, whatever the token allows"; `WORK.md:9` and `SKILL.md:166` carry the same sentence. `:204` therefore forbids exactly what the merge authority already forbids, and merging into the two Sendrast repos does not touch "Homelab repos (they are not his)", which the parenthetical keeps distinct. There is no reading under which the two disagree. - 25023 itself recorded that merge-by-API is not a push and ranked this non-blocking, not a condition of the merge; no fix was required of it, and no part of it survives as a defect at this head. Verdict: DOES NOT APPLY at `2f1be91f`. **Re-checked at head, so nothing 25023 certified has quietly regressed:** - A3 `BRIEF.md:50`: `sendrast-operator` — pods get/list/watch/delete, logs, read on workloads/services/events/configmaps; **no exec**, with the B2 reason; no secrets, no create, no RBAC/ESO; in `sbx-sendrast`, exec plus delete of `sbx-sendrast-0` only; Jesús keeps cluster-admin. Present. - A4 `BRIEF.md:55`: merge identity `sendrast-bot`, his sandbox's git identity, token at `/run/secrets/sendrast/git`. - A5 `BRIEF.md:132-133`: merge on his word as `sendrast-bot` through the Forgejo API, always `"head_commit_id": "<the exact sha you verified>"`, report "en main" with the sha; tag/release on the hypervisor's route, one at a time, askable via `release: <repo>@<sha> → vX.Y.Z`, answered "en el ambiente vX". - A6 `BRIEF.md:202` (restart only when Jesús says so himself in this conversation, `reinicio sbx: <hora> — "<his words>"` written as a record, once, never under the heavy lock / a merge in flight / a release, at most once a day) and A7/S6 `BRIEF.md:206` (app accounts through the admin screens; his password never asked for, stored or typed). - A8 `BRIEF.md:174` (Plane read-only; pod key is `ld-runtime`, a SEND member); A9 `BRIEF.md:184` (`needed_aaron` counts only waits on Aaron's side, not approvals); A12 `PURPOSE.md:10` ("stop and raise it with Jesús or Aaron. Only Jesús or Aaron change this file"). - A10 `WORK.md:9,11,12` as above, `:13` migration blocks unchanged, `:14` the hypervisor now reads the `reinicio sbx:` line "como registro y solo lo reporta". - Doc-only: the PR diff at head is 5 files, all under `core/directors/sendrast/` — no grants, credentials, manifests, workflows or code outside it. **Scope limit, stated plainly:** the spec of record (`working-files/sendrast-hypervisor/c8-director-authority.md`) is not present in this pod and this seat may not read outside the artifacts named for it, so — exactly as 25023 also reported — the fix is verified against the `.diff`, the PR body and the tree at `2f1be91f`, not against the spec's literal wording. That is the same basis 25023 used, so the comparison is like-for-like and the blocker it raised is tested on its own terms. CI at this head: `commit status` = success, 11/11 contexts green. Every finding raised in comment 25023 is fixed at `2f1be91f` or was never a defect at this head; none still applies. resolved blocker #25023 model: omniroute/deepseek-flash session: IR-20261111-c8brief-resolve-20261112T0626Z

pi-landing merged commit 2d837e9bc0 into live 2026-11-12 06:42:29 +00:00

pi-landing referenced this pull request from a commit 2026-11-12 06:42:29 +00:00

Merge pull request 'IR-20261111: docs(sendrast): C8 part A — Jesús has the same authority as Aaron' (#947) from plane/IR-20261111-c8brief into live

ld-reviewer referenced this pull request 2026-11-12 06:53:17 +00:00

IR-20261111: R25 off disk — drop pod-mounted sops/AWS secrets from forgejo-runner, capacity 2->1 (lands AFTER prod #1206) #944

ld-reviewer referenced this pull request 2026-11-12 06:55:35 +00:00

IR-20261111: R25 off disk — drop pod-mounted sops/AWS secrets from forgejo-runner, capacity 2->1 (lands AFTER prod #1206) #944

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

operator-review

Requires human operator review before merge — dangerous class (RBAC, secrets, network policy, Terraform) or explicitly gated. Never auto-merge.

No labels

operator-review

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Homelab/infra-core!947

No description provided.