HOMELAB-1731: LD4.11 · maintainability fitness routine (weekly, Sendrast first) #598
No reviewers
Labels
No labels
operator-review
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Homelab/infra-core!598
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "plane/HOMELAB-1731-fitness"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
What
R-27
maintainability-fitnesslands weekly, ACTIVE,kind: script(the2026-09-28 operator ruling, contract Amendment 3 + the 2026-10-03 HOMELAB-1731
adjudication), with its mechanism in a new package and its first calibration run
committed as evidence.
Verify lines (the ticket's four)
1 · a probe ticket's measurements land in the calibration digest.
PlanProbesauthors the prediction MECHANICALLY at emission time, precedencedeclared(theterritory-mapcompiler section, stamped with its pinneddigest) →
derived(co-change communities) →unpredicted(a VALUE with thereason).
CalibrationLinerenders prediction kind + digest, predicted vs actualfiles, the unexpected list, AC drift as a named delta and ≥1 evidence address per
number; a probe with no measurement renders
unmeasured, never a zero.Emission goes through the existing
director.PlaneSinkintoBacklogwith thefitness-probelabel, usingintake/plane.go's marker grammar(
TestEmitProbesUsesTheExistingPlaneSink,TestProbeEncodeParseRoundTrip,TestMeasurementRefusesProseOnlyEvidence). R-13 (the digest consumer) ispaused for the routine executor, so the line is produced mechanically here and
rendered into the real artifact once — blocking the AC on another epic's seam
buys no evidence.
2 · a static-proxy number is never rendered as a gate (attempted, blocked).
fitness.AttemptGateis the ONLY promotion path and it always refuses(
ReasonFitnessIsCareDial).TestAStaticProxyIsNeverRenderedAsAGatecovers all9 (surface × metric) pairs;
TestSelfTestLineIsThreeOfThreepins the ledgeredline
never-a-gate self-test: 3/3 refused, which the artifact, the digest andthe Plane comment carry.
TestFitnessDigestRendersNoGateVocabularyasserts therenderer cannot emit gate vocabulary.
TestRegistryRefusesR27WithGateAuthorityneverAGate.authority: care-dialcheck make "a configedit cannot promote R-27" a code fact, not a policy note. New policy line
P-ROUT-013 in
policy.goandpolicy.md(parsed-back test holds thepair);
fitness.TestPolicyLineReferenceMatchesTheBookcross-checks the id.3 · two repos of known hygiene order the way the census says they should.
Live read-only run, recorded evidence committed under
fitness/testdata/calibration/(see its README):Sendrast/api-sendrast9cc2ee366c4eSendrast/sendrast-webbee874cee4cfThe declared primary key
spread_p90agrees with the independentlyestablished order (R-24 readiness + repo archaeology, printed beside it in the
artifact).
sendrast-web's clone was shallow at 341 commits (the measuredfalsification) — unshallowed once to 509, recorded in evidence; a shallow clone
without that is refused by default and downgrades to
truncated-window+UN-RANKED under
--allow-shallow. The naive top-level-directory proxy isRETIRED from the ranking and kept in its own column, clearly labelled.
4 · first weekly run produces a change-friction slope with evidence links.
Artifact
fitness/testdata/calibration/2026-W40.json+ digest. Every numberresolves to
git:<repo>@<rev>,api:<feed>orartifact:<recording>. The slopeis
insufficient-series— window one has one point per target, so the seriesis printed with its sample sizes instead of a number assembled from nothing (a
sign needs ≥2 points). Byte-identical determinism is
TestCensusEndToEndIsDeterministic.Mechanism
--numstatand--name-status; the last output-format flag wins, which the first recordingproved by yielding zero changed lines) merged by
(sha, path); spreadmedian/p90/max, churn share, birth/revert rates, excluded share printed.
territory-mapsection (pinned digest) → co-changecommunities (union-find over
minPairSupport) →unpredicted(reported, NEVERranked). Never directory depth, never primary.
(workflow, job, head_sha)groups over/actions/tasks; asame-sha failure+success pair is a flip;
insufficient-historybelow the rowfloor. Per-test is NOT reachable at Forgejo 14.0.3 — documented in the digest
legend, not faked.
fitness/fitness.yaml— window floors, per-repo exclusions,the probe catalogue,
neverAGate, and the config-keyed worker-tier T2rehearsal budget (
probes.dispatch: false,reportOnly: true, warrantmeasure-only,omniroute/deepseek-flash) per the ruling.gitWalks,apiRows,tokensUsed: null); wall-clock is in the digest, deliberately NOT in thecanonical bytes.
Pin discipline
scriptRef.pathislab-director/dispatcher/fitness/census.go— a NEW file, sono sha256-pinned sibling (
rollup.go,readiness.go,phase.go) is touched.TestInProcessPinsMatchTheCodere-derives it.Deviations from the brief / adjudication (all deliberate, all stated)
emitsWork: falseon the landed entry:probe tickets are created into
Backlog(non-dispatchable) and never worked,so nothing they emit can re-trigger another routine yet. The fixture keeps
emitsWork: true+ one edge as the schema accommodation, andTestR27CadenceAgreesBetweenFixtureAndRegistryasserts the divergence isdeliberate.
.rpiv/tree; the first-run artifact andits evidence live at
fitness/testdata/calibration/(committed, re-derivable)rather than
.rpiv/artifacts/fitness/.cmd/fitnessis new — mirrors thecmd/readinessprecedent (R-24'srunnable path). Territory note:
cmd/is outside the statedfitness/*allowance, added for symmetry with the sibling routine's sanctioned runnable.
lines. The measurement disagrees: api reads BETTER on the primary key
(p90 7 vs 8) and on spread-max (14 vs 64), matching the design brief's
independently established order. Both the naive directory-depth proxy and the
territory measure are printed, and the calibration line escalates rather than
re-tunes if the primary key ever disagrees.
R-27count assumption. The registry's total assertion is derived, nothardcoded (22 corpus + registered siblings), so this entry does not touch it.
Verification
go test -race ./...green inlab-director/dispatcher(all 31 packages).go vet ./...clean.go testopens no socket; the live run's only network use is the one bounded/actions/tasksread per target, recorded to disk and replayed offline.never-a-gate self-test: 3/3 refused.Not in this PR
its budget are already config-keyed and OFF.
territory-mapsections for the Sendrast repos (so everyprediction is
derivedtoday — itself the first care-dial finding).Landing review — HOMELAB-1731 (LD4.11) · verdict: APPROVE, no blocker findings
Reviewed at head
aa6d73f1f7000fb0f27d2e5ba945c6a9cc5e8659against the ticket's four Verify lines, designdesign-LD4.11-fitness.md, and the 2026-10-03 adjudication. Primary sources only (diff, recordings, live re-derivation); I am a fresh context, not the implementer's session.CI (verified, not taken on trust)
Run #1805 on
aa6d73f1f7— all four jobs success:dispatcher-test2m41s,alert-receiver-test,receiver-test,helm-validate. Local re-run:go test -race -count=1 ./fitness/... ./routines/...green (4.9s / 3.2s), fullgo test -race ./...inlab-director/dispatcherEXIT=0,go vet ./fitness/...clean. No cached-pass masking on the two packages that matter. Registry pin re-derived by hand:sha256(fitness/census.go)=252ef687…de1191, exactly thescriptRef.rev.Calibration adjudication (the main call)
The pair orders the way the census says it should. The fitness metric's own definitions declare
spread_p90the primary key (higher = worse), and design §6.1's independently established order isapi-sendrast < sendrast-web. Measured: 7 < 8, agreeing on both declared axes (spread_max14 vs 64). I re-derived both from the committed recordings without using the artifact — parsed the\x1e-framedgit logwalks independently: api p90 7 / max 16, web p90 8 / max 64 over the last 100 non-merge commits. Same order, same discriminators. No primary-key disagreement → no escalation triggered (the escalation path itself is implemented and tested).The readiness-based framing ("api worse") is the wrong yardstick for this Verify line, and the design anticipated exactly why. Readiness (R-24) scores static hygiene — workflows, gates, test inventory — which is a different lens from change-friction. The only readiness-flavoured axis that ranks api worse is the directory-depth / co-change-boundary proxy, which the design measured inverting hygiene on an earlier window (api 40/100 vs web 30/100) and therefore retired from the ranking: top-level directories are a poor territory boundary for a Go service whose change legitimately spans
api/internal/db. This window's own top-level-dir column reads 0.29 vs 0.28 — the inversion is still visible, in its own clearly-labelled, never-ranked column. Metric-dependent ordering is therefore confirmed as predicted: coupling inverts hygiene, spread agrees with it, and readiness is a separate instrument, not a competing verdict. Verify line 3 passes on its own declared yardstick.The other three lines
PlanProbesauthors the prediction mechanically, precedencedeclared(territory-map section + pinned digest,Validateenforces the digest) →derived(co-change communities) →unpredicted(a value with a reason, never an absence).CalibrationLinerenders kind + source, predicted vs actual, unexpected, AC drift as a named delta, and an evidence address per row; a probe with no measurement rendersunmeasured, never0. Emission goes through the existingdirector.PlaneSinkintoBacklog+fitness-probe; marker round-trip and prose-only-evidence refusal are both tested. R-13 is paused, so the line is produced mechanically and rendered once into the real digest — present intestdata/calibration/digest-2026-W40.md, as the adjudication allowed.AttemptGatehas no success path (value-in-return forces the caller to see the refusal); 9 (surface × metric) pairs refused; ledgered linenever-a-gate self-test: 3/3 refusedis carried by artifact + digest;TestFitnessDigestRendersNoGateVocabularyasserts against the realDigestMarkdownoutput; loader'sneverAGate+ registryFaultUnratifiedGatemake "a config edit cannot promote R-27" a code fact; P-ROUT-013 present inpolicy.goandpolicy.md, cross-checked byfitness.TestPolicyLineReferenceMatchesTheBook.git:…@rev/api:…/artifact:…; slope is honestlyinsufficient-serieswith the series and sample sizes printed rather than a sign from one point; byte-identical determinism tested.R-27 registration / shallow refusal / territory
Weekly, ACTIVE,
kind: script,authority: care-dial,gated: false,reviewBy: 2026-12-31; fixture quarter→week rewrite pinned byTestR27CadenceFollowsTheOperatorRulingwith the ruling named.emitsWork: falsewith the tested, deliberate fixture divergence (TestR27CadenceAgreesBetweenFixtureAndRegistry) is the stated window-one policy — probes land in non-dispatchableBacklog. Shallow clone is refused by default (FidelityRefused, un-rankable) with--allow-shallowdowngrading totruncated-window; this is the measured falsification, not a hypothetical. Territory is clean:fitness/*,cmd/fitness, androutines/{registry.yaml,registry_test.go,testdata/registry-4x-shapes.yaml,policy.go,policy.md,README.md}only. Branch is an ancestor-complete descendant ofepic/LD4(7366125), mergeable.Non-blocking concerns (for the architect, not fix-requests)
spread_max(14 vs 64); onspread_p90it is a single commit at the 90th percentile of a 100-commit window. Both columns are printed, so the reader can see this, but p90 is a coarse instrument at this sample size — worth saying out loud at the calibration checkpoint rather than letting "7 vs 8" harden into a precise-looking verdict.derivedpredictions are broad by construction in window one: they carry the union of the window's observed files (168/192), so a measurement'sunexpectedlist would be near-vacuous until aterritory-mapsection exists. This is stated in the plan warnings and is the design's own first care-dial finding, but the derived row should be read as "no prediction in substance".flakiness_test.gouseshttptestloopback servers to cover the adapter's paging/budget behaviour. That matches the sibling precedent (routines/readiness_forgejo_test.go:24: "httptestis the one socket this package's tests may open"), and no test reaches an external service, so this is a wording nit, not a defect.Merging. No ticket state change from this session.
atlantis plan
Merge blocked by an external fault — not by this PR.
forgejo_merge_prrefused: "CI is still running on the head commit (state: pending) — non-green contexts: (pending)". The refusing context is an Atlantis commit status with an empty context ("Plan in progress...", creatoratlantis), open onaa6d73f1f7since 2026-10-03T04:58:20Z and never completing. All four CI legs are green (run #1805).Evidence (read-only diagnosis):
598 Running autoplan...→Updating Gitea check status for 'atlantis/plan' to 'pending'at 04:58:20, then nosuccessfully parsed atlantis.yaml, no working-dir creation — it hangs in the clone step. PRs #599 and #600 are stalled at the same point (05:01:46 / 05:06:18).atlantis planre-trigger re-posted a fresh pending status (05:17:00) and hung again — so the event worker is alive; the clone/fetch path is wedged.could not open '.../.git/objects/pack/tmp_pack_FOlsfu' for reading: No such file or directory. Before 04:19 autoplans completed normally (PR #597 at 04:01).atlantis-0is Running/1-of-1, 231Mi/512Mi, last restart OOMKilled 16h ago;atlantis-dataPVC (2Gi longhorn) at 71% — not full. No598/working dir was created; nogitprocess alive at check time.Because this PR touches no
.tffiles, the plan is a no-op — the status only needs Atlantis to finish. No ticket or PR change is needed to proceed once Atlantis is healthy; the review verdict above stands for this head sha. Recommended remediation (operator/orchestrator, not a landing worker): rollatlantis-0/ ArgoCD-sync the staleStatefulSet and check theatlantis-dataLonghorn volume + cluster egress. This also unblocks #599 and #600.Nothing was merged from this session; ticket state untouched.
Plan Error
Ran Plan for 0 projects: