#872 - HOMELAB-2682: chore(sbx-gits): pin-bump — deploy the declaration-anchored proof tool - Homelab/infra-core

pi-landing commented

2026-11-06 08:24:38 +00:00

Collaborator

What this is

A pin move, and nothing else. #870 turned the sbx-gits-tools ConfigMap into an explicit literals: block so that editing tools/ reaches the FILE and not the running pod. Two merges landed in tools/ after that pin was cut, so sbx-gits-0 still runs the old bytes:

key	what changed it	pinned before	pinned now
`gits-sbx-emu-proof.sh`	#871 — declaration-anchored proof check (`gits-proof-suite`)	`ac29a440…` 64339 B	`211be2b5…` 125320 B
`gits-sbx-android-install.sh`	#868 — the daemon idle settings E0R applied by hand are now generated	`6ff3f0b9…` 46573 B	`b4edd0b6…` 47738 B

The other four keys are byte-identical to what they already were; no tool file, no statefulset.yaml, no smoke is touched. git diff --stat is one file.

GATE — this PR does NOT merge until homelab-33 confirms

homelab-33's condition, quoted: "When homelab-33 confirms GITS's dev branch carries gits-proof-suite, this PR updates the literal block to #871's tool bytes, deploying the new tool."

Both halves are required before merge:

homelab-33/forger confirms that the GITS dev branch carries a gits-proof-suite declaration — the file #871's tool reads at the root of the repo it checks. Without it the new tool has nothing to anchor to and would fail loud on its first run in the pod.
one mechanical seat (this PR's review, per the landing pipeline); then it WAITS for the confirmation above before the operator merges.

There is no override here and none is wanted: the pin is the only thing standing between a tools/ edit and a running pod, so moving it is a reviewed act, not a side effect.

Six-key verification table

kubectl kustomize core/manifests/apps/sbx-gits → rc 0, 18 objects. Every rendered key hashed against the current tools/ file bytes:

key	rendered value sha256	`tools/` file sha256	match
`gits-sbx-android-install.sh`	`b4edd0b6d563dd05eb21ecd9bada0aaa6339cdbc9da09e61ead518db7e1c9328`	`b4edd0b6d563dd05eb21ecd9bada0aaa6339cdbc9da09e61ead518db7e1c9328`	MATCH (993 lines, 47738 B)
`gits-sbx-emu-smoke.sh`	`a7b8be878109b8f22cd4b730fa7ad85ef7d6bf4478b70daec5fc35f133b61e0a`	`a7b8be878109b8f22cd4b730fa7ad85ef7d6bf4478b70daec5fc35f133b61e0a`	MATCH (1990 lines, 108119 B)
`gits-sbx-emu-lock.sh`	`47356e3162ac3effd22013790712c0e8a2013c0bc75b9c57732a0c9924398909`	`47356e3162ac3effd22013790712c0e8a2013c0bc75b9c57732a0c9924398909`	MATCH (396 lines, 16981 B)
`gits-sbx-emu-queue.sh`	`062d2bb742815afa853fe807266aba0250e78ad2fbecb1acdec4ce4ef905e3ba`	`062d2bb742815afa853fe807266aba0250e78ad2fbecb1acdec4ce4ef905e3ba`	MATCH (825 lines, 38908 B)
`gits-sbx-emu-proof.sh`	`211be2b5f0e1884ef893fb9b3fd302e93b622609ed73ad9e8aefdc138194ff13`	`211be2b5f0e1884ef893fb9b3fd302e93b622609ed73ad9e8aefdc138194ff13`	MATCH (1957 lines, 125320 B) — re-cut
`sbx-ci-log.sh`	`e6c31421d0d14d0e9f9bf5b17e205eb700e28b60a4c55f96e9525958aa727dc7`	`e6c31421d0d14d0e9f9bf5b17e205eb700e28b60a4c55f96e9525958aa727dc7`	MATCH (193 lines, 9753 B)

Render vs `origin/live`

(kind, name) object set: identical.
Non-sbx-gits-tools objects differing: none.
Changed keys inside sbx-gits-tools: exactly gits-sbx-emu-proof.sh and gits-sbx-android-install.sh. The other four are unchanged in the render too.

Render-proof — the pin still holds

Simulated edit of the tools files without moving the pin (a copy of apps/, two lines appended to tools/gits-sbx-emu-proof.sh and tools/gits-sbx-android-install.sh, files then hashing 3c19e511… and 7653d00b…):

kubectl kustomize <edited copy>/sbx-gits  ->  rc 0
diff <render before> <render after>       ->  EMPTY (byte-identical)

So a tools/ edit still produces zero render change and ArgoCD has nothing to sync. Only this PR — an edit to the literal block itself — moves what the pod runs.

Harness (`scripts/gits-sbx-epic-test.sh`, SOLO)

Reds on this head vs live's baseline:

live (origin/live): 7 reds of 646 checks.
this head: 8 reds of 673 checks — the same 7, plus one new family: T7[diff] and 17[R159] (d) (the same condition, reported twice) — "sbx-gits changed vs origin/live outside {M tools/gits-sbx-emu-proof.sh, M README.md}", with cambios: M kustomization.yaml.

That set is pinned for the tool branch and its own pass message says so: "La PIN DE ENTREGA de #870 sostiene el ConfigMap, asi que editar la herramienta NO cambia kustomization.yaml … el pin-bump es otro PR". A pin-bump branch changes exactly kustomization.yaml, so this red is the documented T7-family pin red and is left as documented (the harness is not touched by this PR — no scripts/ change). Unchanged: manifest[2], manifest[3], manifest[3b], 20[phase1] mutaciones, T7 emulador dentro del pod, T7+R99[10b] scripts por manifiesto, probe uses an EMPTY pre-existing --dir.

After merge — mount read-back plan

Nothing here restarts anything by itself: items: in statefulset.yaml fixes the file set and updateStrategy: OnDelete never rolls on its own, so the ConfigMap change lands on the next deliberate pod recreation. The read-back, once that recreation happens:

kubectl -n sbx-gits get cm sbx-gits-tools -o jsonpath='{.data.gits-sbx-emu-proof\.sh}' | sha256sum → expect 211be2b5f0e1884ef893fb9b3fd302e93b622609ed73ad9e8aefdc138194ff13.
kubectl -n sbx-gits exec sbx-gits-0 -c sandbox -- sha256sum /run/sbx-tools/gits-sbx-emu-proof.sh → the same hash (this is the line that proves the mount, not just the object).
Same two commands for gits-sbx-android-install.sh → expect b4edd0b6d563dd05eb21ecd9bada0aaa6339cdbc9da09e61ead518db7e1c9328.
kubectl -n sbx-gits exec sbx-gits-0 -c sandbox -- bash /run/sbx-tools/gits-sbx-emu-proof.sh --help → must document gits-proof-suite (the post-#871 surface) and the suite resolution order.
ArgoCD: sbx-gits Synced, and the diff for the app shows no sbx-gits-tools delta.

If a hash mismatches at any step, the pin did not reach the pod: stop, do not run the new tool, and report which of the five steps disagreed.

## What this is A **pin move, and nothing else.** #870 turned the `sbx-gits-tools` ConfigMap into an explicit `literals:` block so that editing `tools/` reaches the FILE and not the running pod. Two merges landed in `tools/` after that pin was cut, so `sbx-gits-0` still runs the **old** bytes: | key | what changed it | pinned before | pinned now | |---|---|---|---| | `gits-sbx-emu-proof.sh` | **#871** — declaration-anchored proof check (`gits-proof-suite`) | `ac29a440…` 64339 B | `211be2b5…` 125320 B | | `gits-sbx-android-install.sh` | **#868** — the daemon idle settings E0R applied by hand are now generated | `6ff3f0b9…` 46573 B | `b4edd0b6…` 47738 B | The other four keys are **byte-identical** to what they already were; no tool file, no `statefulset.yaml`, no smoke is touched. `git diff --stat` is one file. --- ## GATE — this PR does NOT merge until homelab-33 confirms > **homelab-33's condition, quoted:** *"When homelab-33 confirms GITS's dev branch carries `gits-proof-suite`, this PR updates the literal block to #871's tool bytes, deploying the new tool."* Both halves are required before merge: 1. **homelab-33/forger confirms** that the GITS **dev branch** carries a `gits-proof-suite` declaration — the file #871's tool reads at the root of the repo it checks. Without it the new tool has nothing to anchor to and would fail loud on its first run in the pod. 2. **one mechanical seat** (this PR's review, per the landing pipeline); then it WAITS for the confirmation above before the operator merges. There is no override here and none is wanted: the pin is the only thing standing between a `tools/` edit and a running pod, so moving it is a reviewed act, not a side effect. --- ## Six-key verification table `kubectl kustomize core/manifests/apps/sbx-gits` → **rc 0**, 18 objects. Every rendered key hashed against the current `tools/` file bytes: | key | rendered value sha256 | `tools/` file sha256 | match | |---|---|---|---| | `gits-sbx-android-install.sh` | `b4edd0b6d563dd05eb21ecd9bada0aaa6339cdbc9da09e61ead518db7e1c9328` | `b4edd0b6d563dd05eb21ecd9bada0aaa6339cdbc9da09e61ead518db7e1c9328` | MATCH (993 lines, 47738 B) | | `gits-sbx-emu-smoke.sh` | `a7b8be878109b8f22cd4b730fa7ad85ef7d6bf4478b70daec5fc35f133b61e0a` | `a7b8be878109b8f22cd4b730fa7ad85ef7d6bf4478b70daec5fc35f133b61e0a` | MATCH (1990 lines, 108119 B) | | `gits-sbx-emu-lock.sh` | `47356e3162ac3effd22013790712c0e8a2013c0bc75b9c57732a0c9924398909` | `47356e3162ac3effd22013790712c0e8a2013c0bc75b9c57732a0c9924398909` | MATCH (396 lines, 16981 B) | | `gits-sbx-emu-queue.sh` | `062d2bb742815afa853fe807266aba0250e78ad2fbecb1acdec4ce4ef905e3ba` | `062d2bb742815afa853fe807266aba0250e78ad2fbecb1acdec4ce4ef905e3ba` | MATCH (825 lines, 38908 B) | | `gits-sbx-emu-proof.sh` | `211be2b5f0e1884ef893fb9b3fd302e93b622609ed73ad9e8aefdc138194ff13` | `211be2b5f0e1884ef893fb9b3fd302e93b622609ed73ad9e8aefdc138194ff13` | MATCH (1957 lines, 125320 B) — **re-cut** | | `sbx-ci-log.sh` | `e6c31421d0d14d0e9f9bf5b17e205eb700e28b60a4c55f96e9525958aa727dc7` | `e6c31421d0d14d0e9f9bf5b17e205eb700e28b60a4c55f96e9525958aa727dc7` | MATCH (193 lines, 9753 B) | ### Render vs `origin/live` * (kind, name) object set: **identical**. * Non-`sbx-gits-tools` objects differing: **none**. * Changed keys inside `sbx-gits-tools`: exactly `gits-sbx-emu-proof.sh` and `gits-sbx-android-install.sh`. The other four are unchanged in the render too. --- ## Render-proof — the pin still holds Simulated edit of the tools files **without** moving the pin (a copy of `apps/`, two lines appended to `tools/gits-sbx-emu-proof.sh` and `tools/gits-sbx-android-install.sh`, files then hashing `3c19e511…` and `7653d00b…`): ``` kubectl kustomize <edited copy>/sbx-gits -> rc 0 diff <render before> <render after> -> EMPTY (byte-identical) ``` So a `tools/` edit still produces **zero** render change and ArgoCD has nothing to sync. Only this PR — an edit to the literal block itself — moves what the pod runs. --- ## Harness (`scripts/gits-sbx-epic-test.sh`, SOLO) Reds on this head vs live's baseline: * **live (origin/live): 7 reds** of 646 checks. * **this head: 8 reds** of 673 checks — the same 7, plus **one** new family: `T7[diff]` and `17[R159] (d)` (the same condition, reported twice) — *"sbx-gits changed vs origin/live outside `{M tools/gits-sbx-emu-proof.sh, M README.md}`"*, with `cambios: M kustomization.yaml`. That set is pinned for the **tool** branch and its own pass message says so: *"La PIN DE ENTREGA de #870 sostiene el ConfigMap, asi que editar la herramienta NO cambia `kustomization.yaml` … el pin-bump es otro PR"*. A pin-bump branch changes exactly `kustomization.yaml`, so this red is the **documented T7-family pin red** and is left as documented (the harness is not touched by this PR — no `scripts/` change). Unchanged: `manifest[2]`, `manifest[3]`, `manifest[3b]`, `20[phase1] mutaciones`, `T7 emulador dentro del pod`, `T7+R99[10b] scripts por manifiesto`, `probe uses an EMPTY pre-existing --dir`. --- ## After merge — mount read-back plan Nothing here restarts anything by itself: `items:` in `statefulset.yaml` fixes the file set and `updateStrategy: OnDelete` never rolls on its own, so the ConfigMap change lands on the next **deliberate** pod recreation. The read-back, once that recreation happens: 1. `kubectl -n sbx-gits get cm sbx-gits-tools -o jsonpath='{.data.gits-sbx-emu-proof\.sh}' | sha256sum` → expect `211be2b5f0e1884ef893fb9b3fd302e93b622609ed73ad9e8aefdc138194ff13`. 2. `kubectl -n sbx-gits exec sbx-gits-0 -c sandbox -- sha256sum /run/sbx-tools/gits-sbx-emu-proof.sh` → the **same** hash (this is the line that proves the mount, not just the object). 3. Same two commands for `gits-sbx-android-install.sh` → expect `b4edd0b6d563dd05eb21ecd9bada0aaa6339cdbc9da09e61ead518db7e1c9328`. 4. `kubectl -n sbx-gits exec sbx-gits-0 -c sandbox -- bash /run/sbx-tools/gits-sbx-emu-proof.sh --help` → must document `gits-proof-suite` (the post-#871 surface) and the suite resolution order. 5. ArgoCD: `sbx-gits` Synced, and the diff for the app shows no `sbx-gits-tools` delta. If a hash mismatches at any step, the pin did not reach the pod: stop, do not run the new tool, and report which of the five steps disagreed.

pi-landing added 1 commit

2026-11-06 08:24:38 +00:00

HOMELAB-2682: chore(sbx-gits): pin-bump tools ConfigMap to the declaration-anchored tool

CI Review / runner-manifest-test (pull_request) Successful in 6s

Details

CI Review / receiver-test (pull_request) Successful in 7s

Details

CI Review / helm-validate (pull_request) Successful in 11s

Details

CI Review / alert-receiver-test (pull_request) Successful in 21s

Details

Lint & Validate / yaml-lint (pull_request) Successful in 24s

Details

Lint & Validate / shellcheck (pull_request) Successful in 11s

Details

CI Review / record-sql-test (pull_request) Successful in 57s

Details

CI Review / cockpit-test (pull_request) Successful in 2m50s

Details

Lint & Validate / terraform-validate (pull_request) Successful in 2m33s

Details

CI Review / cockpit-e2e (pull_request) Successful in 3m47s

Details

CI Review / dispatcher-test (pull_request) Successful in 4m26s

Details

e31448e7c1

The delivery pin (#870) made the `sbx-gits-tools` ConfigMap an EXPLICIT
`literals:` block precisely so that editing `tools/` reaches the FILE and not
the running pod. Two merges landed in `tools/` after the pin was cut, so the
pod still runs the old bytes:

  * gits-sbx-android-install.sh — #868 (the daemon idle settings the E0R wrote
    by hand are now GENERATED by the installer);
  * gits-sbx-emu-proof.sh — #871 (the proof check is declaration-anchored: it
    reads `gits-proof-suite` at the root of the checked repo, anchors on the
    blob of the declared path and reports the class of the change).

This commit is the pin MOVE: the two literals are re-cut from `tools/` at
origin/live and the header sha256 table follows. Nothing else moves — the
other four keys are byte-identical to what they were, and no tool file,
statefulset or smoke is touched.

Verified:
  * `kubectl kustomize core/manifests/apps/sbx-gits` rc 0;
  * all SIX rendered keys hash to the current `tools/` file bytes:
      gits-sbx-android-install.sh  b4edd0b6d563dd05eb21ecd9bada0aaa6339cdbc9da09e61ead518db7e1c9328
      gits-sbx-emu-smoke.sh        a7b8be878109b8f22cd4b730fa7ad85ef7d6bf4478b70daec5fc35f133b61e0a
      gits-sbx-emu-lock.sh         47356e3162ac3effd22013790712c0e8a2013c0bc75b9c57732a0c9924398909
      gits-sbx-emu-queue.sh        062d2bb742815afa853fe807266aba0250e78ad2fbecb1acdec4ce4ef905e3ba
      gits-sbx-emu-proof.sh        211be2b5f0e1884ef893fb9b3fd302e93b622609ed73ad9e8aefdc138194ff13
      sbx-ci-log.sh                e6c31421d0d14d0e9f9bf5b17e205eb700e28b60a4c55f96e9525958aa727dc7
  * render-proof: editing `tools/gits-sbx-emu-proof.sh` and
    `tools/gits-sbx-android-install.sh` WITHOUT moving the pin yields a
    byte-identical render (diff empty) — the pin still holds;
  * render vs origin/live: the object set is identical and the ONLY delta is
    those two ConfigMap keys.

Harness (scripts/gits-sbx-epic-test.sh, SOLO): 8 reds vs live's 7; the one new
family is T7[diff] / 17[R159](d) — "sbx-gits changed vs origin/live outside
{M tools/gits-sbx-emu-proof.sh, M README.md}", a set pinned for the TOOL branch.
A pin-bump branch changes exactly `kustomization.yaml`, which is the documented
pin red (README §10.5, kustomization header) and is left as documented.