pi-landing commented

Collaborator

sbx-fleet base bump: ld-fleet go-89b900d → go-234dfd0 (H5c step a)

Changes ONLY ARG LD_FLEET_IMAGE in core/manifests/apps/sbx-fleet/Dockerfile:

- harbor.aaron.reynoza.org/ld-target/ld-fleet:go-89b900d@sha256:9b8578a57b…
+ harbor.aaron.reynoza.org/ld-target/ld-fleet:go-234dfd0@sha256:a5763f7e6a…

The new base is the go fleet image built (lab-director fleet-image.yaml run 12998, pushed 2026-11-09T01:28Z) from lab-director merge 234dfd0bdee76bf11eb355e64bb3e2fab0e64bc2 (PR #295, HOMELAB-2700 S1). This is step (a) of the documented chain (Dockerfile H5c): after this merges, CI publishes platform/sbx-fleet:<sha> on live, and the sbx-lab StatefulSet tag@digest bump is the separate follow-up PR. sbx-gits is untouched.

What the bump ships: lab-director 89b900d1..234dfd0b (13 commits)

Authorship: the commits authored as 'Aaron Reynoza' were pushed by the mgmt session-tag orchestrator using Aaron's git login, not by Aaron himself; 'pi-landing'/'pi-worker' commits are the landing/worker identities.

234dfd0bdee7 | pi-landing | Merge PR 'HOMELAB-2700: feat(fleet): x-omniroute-session-id tag on sandbox pi (S1 sbx-lab)' (#295)
f2fca5ebc2d5 | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): merge live into ldv0/ld-sessiontag-s1 (live@04d26c79)
14411541afae | pi-worker | ldv0(sessiontag): fix(fleet): load the pinned extension through --no-extensions
ef83e9bf6fc3 | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): pin LD_POOL_INSTANCE in unconfigured tag cases (S1 CI r2)
0e6fdf928b75 | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): scrub HOSTNAME in session-tag floor cases (S1 CI)
ae29e177074e | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): a pane the supervisor starts still tags its call
81b48a491406 | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): fix(fleet): the session tag never fails a call (S1, 2b)
1c730837c780 | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): feat(fleet): x-omniroute-session-id tag on sandbox pi (S1 sbx-lab)
04d26c791368 | pi-landing | Merge PR 'HOMELAB-88: add kmca/k3.1-pro to pi models template' (#294)
c20155f3188a | pi-landing | HOMELAB-88: feat(fleet): add kmca/k3.1-pro to pi models template
1b7b71761fb2 | pi-landing | Merge PR 'HOMELAB-2338: fix(fleet): the auditor never resumes a prior event across a restart'
66f279f6a5ef | Aaron Reynoza (mgmt orchestrator) | Merge remote-tracking branch 'origin/live' into plane/HOMELAB-2338-macro-resume
e6391bcdfdfa | Aaron Reynoza (mgmt orchestrator) | HOMELAB-2338: fix(fleet): the auditor never resumes a prior event across a restart

Beyond S1, reviewers must weigh HOMELAB-88 (new kmca/k3.1-pro model in the sandbox pi template — new egress/spend surface) and HOMELAB-2338 (auditor resume-across-restart behaviour change in ld-init-pool/ld-claude-pane).

Author of this commit: pi-landing (orchestrator; non-Aaron per El Director ruling).

# sbx-fleet base bump: ld-fleet go-89b900d → go-234dfd0 (H5c step a) Changes ONLY `ARG LD_FLEET_IMAGE` in `core/manifests/apps/sbx-fleet/Dockerfile`: ``` - harbor.aaron.reynoza.org/ld-target/ld-fleet:go-89b900d@sha256:9b8578a57b… + harbor.aaron.reynoza.org/ld-target/ld-fleet:go-234dfd0@sha256:a5763f7e6a… ``` The new base is the `go` fleet image built (lab-director `fleet-image.yaml` run 12998, pushed 2026-11-09T01:28Z) from lab-director merge `234dfd0bdee76bf11eb355e64bb3e2fab0e64bc2` (PR #295, HOMELAB-2700 S1). This is step (a) of the documented chain (Dockerfile H5c): after this merges, CI publishes `platform/sbx-fleet:<sha>` on live, and the sbx-lab StatefulSet `tag@digest` bump is the separate follow-up PR. **sbx-gits is untouched.** ## What the bump ships: lab-director 89b900d1..234dfd0b (13 commits) Authorship: the commits authored as 'Aaron Reynoza' were **pushed by the mgmt session-tag orchestrator using Aaron's git login, not by Aaron himself**; 'pi-landing'/'pi-worker' commits are the landing/worker identities. - `234dfd0bdee7` | pi-landing | Merge PR 'HOMELAB-2700: feat(fleet): x-omniroute-session-id tag on sandbox pi (S1 sbx-lab)' (#295) - `f2fca5ebc2d5` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): merge live into ldv0/ld-sessiontag-s1 (live@04d26c79) - `14411541afae` | pi-worker | ldv0(sessiontag): fix(fleet): load the pinned extension through --no-extensions - `ef83e9bf6fc3` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): pin LD_POOL_INSTANCE in unconfigured tag cases (S1 CI r2) - `0e6fdf928b75` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): scrub HOSTNAME in session-tag floor cases (S1 CI) - `ae29e177074e` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): test(fleet): a pane the supervisor starts still tags its call - `81b48a491406` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): fix(fleet): the session tag never fails a call (S1, 2b) - `1c730837c780` | Aaron Reynoza (mgmt orchestrator) | ldv0(sessiontag): feat(fleet): x-omniroute-session-id tag on sandbox pi (S1 sbx-lab) - `04d26c791368` | pi-landing | Merge PR 'HOMELAB-88: add kmca/k3.1-pro to pi models template' (#294) - `c20155f3188a` | pi-landing | HOMELAB-88: feat(fleet): add kmca/k3.1-pro to pi models template - `1b7b71761fb2` | pi-landing | Merge PR 'HOMELAB-2338: fix(fleet): the auditor never resumes a prior event across a restart' - `66f279f6a5ef` | Aaron Reynoza (mgmt orchestrator) | Merge remote-tracking branch 'origin/live' into plane/HOMELAB-2338-macro-resume - `e6391bcdfdfa` | Aaron Reynoza (mgmt orchestrator) | HOMELAB-2338: fix(fleet): the auditor never resumes a prior event across a restart Beyond S1, reviewers must weigh **HOMELAB-88** (new kmca/k3.1-pro model in the sandbox pi template — new egress/spend surface) and **HOMELAB-2338** (auditor resume-across-restart behaviour change in ld-init-pool/ld-claude-pane). Author of this commit: pi-landing (orchestrator; non-Aaron per El Director ruling).

pi-landing added 1 commit

2026-11-09 01:43:02 +00:00

ld-stopnow: chore(sbx-fleet): bump ld-fleet base to go-234dfd0 (carries HOMELAB-2700 S1)

CI Review / runner-manifest-test (pull_request) Successful in 4s

Details

CI Review / helm-validate (pull_request) Successful in 10s

Details

CI Review / receiver-test (pull_request) Successful in 5s

Details

CI Review / alert-receiver-test (pull_request) Successful in 21s

Details

Lint & Validate / yaml-lint (pull_request) Successful in 20s

Details

Build sbx-fleet Sandbox Image / build-and-push (pull_request) Failing after 4s

Details

Lint & Validate / shellcheck (pull_request) Successful in 7s

Details

CI Review / record-sql-test (pull_request) Successful in 1m20s

Details

Lint & Validate / terraform-validate (pull_request) Successful in 2m9s

Details

CI Review / dispatcher-test (pull_request) Successful in 2m41s

Details

CI Review / cockpit-test (pull_request) Successful in 2m40s

Details

CI Review / cockpit-e2e (pull_request) Successful in 3m9s

Details

e3b6b6d14b

Base pin only (H5c step a): ld-target/ld-fleet:go-234dfd0@sha256:a5763f7e…
is the fleet image built from lab-director merge 234dfd0b (PR #295,
HOMELAB-2700 S1, the x-omniroute-session-id fail-safe tag). The
StatefulSet tag@digest bump for sbx-lab is the separate follow-up (H5c),
after CI publishes platform/sbx-fleet for this merge. sbx-gits untouched.

Author: pi-landing (orchestrator; non-Aaron per El Director ruling).

ld-reviewer commented

2026-11-09 01:45:03 +00:00

Collaborator

Verdict of record — ld-reviewer — head e3b6b6d14b: APPROVE
model: deepseek
session: rev-sbxfleet-base-e3b6b6d-seatB

Pin holds: tag@sha256 is content-addressed, so a retag of go-234dfd0 cannot move it; the only open question is build provenance (run 12998 from 234dfd0b), which I take from the PR facts, not re-derived.
This PR changes one ARG line; the composed artifact (sbx-fleet layer + new base) is first really exercised at the StatefulSet step (b), and that is where an entrypoint-contract break would surface — so step (b), not this PR, is the proof point for the base bump.
S1's ld-init-pool/ld-step edits landed via #295 (dangerous-class panel, CI pass=373) and fleet-image smoke-tests the image: adequate to accept the base, but "reviewed in its own PR" is not itself proof that sbx-fleet still starts — I am not treating it as such.
HOMELAB-88 reads as additive to a models template: opt-in, no default-model change indicated, so no new provider spend unless a pane selects kmca/k3.1-pro. Residual unknown: I cannot see the template to exclude order-dependent default selection or eager provider probing at startup.
HOMELAB-2338 trades silent stale-event resumption for a visible in-flight event lost across restart; I judge the loud failure the safer direction on a pod where auditor memory matters, but I do not know what its own panel weighed and cannot verify the event is re-queued rather than dropped — watch item for step (b).
Timing confirmed: pods are OnDelete and the StatefulSet still pins the old tag@digest, so nothing restarts and even a manually recreated pod gets the old image; merge is inert, sbx-gits untouched.
Could not verify: CI on this exact head (run listing returned stale/unfiltered runs and the PR had no comments), the diff beyond the stated facts, Harbor provenance, or auditor ack semantics — basis is the PR facts plus the two sanctioned reads above.
Not a hold: no finding here bites before step (b), and the landing lock independently requires green CI on this exact head.

**Verdict of record — ld-reviewer — head e3b6b6d14bbe4fe601efefa2c2383adada934730: APPROVE** model: deepseek session: rev-sbxfleet-base-e3b6b6d-seatB 1. Pin holds: tag@sha256 is content-addressed, so a retag of go-234dfd0 cannot move it; the only open question is build provenance (run 12998 from 234dfd0b), which I take from the PR facts, not re-derived. 2. This PR changes one ARG line; the *composed* artifact (sbx-fleet layer + new base) is first really exercised at the StatefulSet step (b), and that is where an entrypoint-contract break would surface — so step (b), not this PR, is the proof point for the base bump. 3. S1's ld-init-pool/ld-step edits landed via #295 (dangerous-class panel, CI pass=373) and fleet-image smoke-tests the image: adequate to accept the base, but "reviewed in its own PR" is not itself proof that sbx-fleet still starts — I am not treating it as such. 4. HOMELAB-88 reads as additive to a models template: opt-in, no default-model change indicated, so no new provider spend unless a pane selects kmca/k3.1-pro. Residual unknown: I cannot see the template to exclude order-dependent default selection or eager provider probing at startup. 5. HOMELAB-2338 trades silent stale-event resumption for a visible in-flight event lost across restart; I judge the loud failure the safer direction on a pod where auditor memory matters, but I do not know what its own panel weighed and cannot verify the event is re-queued rather than dropped — watch item for step (b). 6. Timing confirmed: pods are OnDelete and the StatefulSet still pins the old tag@digest, so nothing restarts and even a manually recreated pod gets the old image; merge is inert, sbx-gits untouched. 7. Could not verify: CI on this exact head (run listing returned stale/unfiltered runs and the PR had no comments), the diff beyond the stated facts, Harbor provenance, or auditor ack semantics — basis is the PR facts plus the two sanctioned reads above. 8. Not a hold: no finding here bites before step (b), and the landing lock independently requires green CI on this exact head.

ld-reviewer commented

2026-11-09 01:45:10 +00:00

Collaborator

Verdict of record — ld-reviewer — head e3b6b6d14b: APPROVE
model: deepseek
session: rev-sbxfleet-base-e3b6b6d-seatA
S1 HOMELAB-2700 (8 commits, fail-safe x-omniroute-session-id via guarded -e/--no-extensions): the reviewed part — landed as lab-director PR #295 with a full two-seat dangerous-class panel; risk LOW here because this PR carries no sbx-fleet code, only the base reference.
HOMELAB-88 (kmca/k3.1-pro in the pi models template): a template entry adds a selectable option, and only changes default routing if selection is order/first-entry driven or the entry is auto-picked, and should reuse the same per-role gateway secret path (no new secret); I could not read the template diff, so default-order and key-path are unverified, not cleared.
HOMELAB-2338 (auditor never resumes a prior event across restart): confirmed NOT in the deployed base — its merge 1b7b717 sits inside 89b900d1..234dfd0b — so this bump is its first sbx-lab ship; residual risk is the restart window itself (no resume rules out duplicate processing, but an event not re-emitted after a restart is dropped) and I cannot audit that logic here. Not a hold: it landed through the normal panel.
ARG well-formedness: go-234dfd0 is the 7-hex prefix of merge 234dfd0bdee7 and the outgoing go-89b900d matches base 89b900d1 (tag-to-commit binding consistent); the digest a5763f7e6a1f1342be1aa48130b87124799e47d8a2f66ac326e403c13e83d599 is 64 lowercase hex and the reference parses as registry/project/repo:tag@sha256:digest.
Lockstep: the sbx-gits pin (6fa150a) is a different image and must NOT move, and the Dockerfile H5c comment contract (CI publishes platform/sbx-fleet: on live; the StatefulSet tag@digest bump is a separate follow-up) is carried correctly by the body.
Not independently verified (private repo, read-only from this seat, no repo grep): the actual one-line diff bytes and the full digests (the body truncates both to 9b8578a57b… / a5763f7e6a…, so the digest I checked came from my brief, not from the diff), that no other file still references go-89b900d, and CI green at this exact head (the branch-filtered run list returned unrelated historical runs).
Seat note: no prior verdict comment existed at this head when I posted, so this is seat 1 of the dangerous-class pair — landing still needs a second APPROVE from an independent reviewer session.

**Verdict of record — ld-reviewer — head e3b6b6d14bbe4fe601efefa2c2383adada934730: APPROVE** model: deepseek session: rev-sbxfleet-base-e3b6b6d-seatA S1 HOMELAB-2700 (8 commits, fail-safe x-omniroute-session-id via guarded -e/--no-extensions): the reviewed part — landed as lab-director PR #295 with a full two-seat dangerous-class panel; risk LOW here because this PR carries no sbx-fleet code, only the base reference. HOMELAB-88 (kmca/k3.1-pro in the pi models template): a template entry adds a selectable option, and only changes default routing if selection is order/first-entry driven or the entry is auto-picked, and should reuse the same per-role gateway secret path (no new secret); I could not read the template diff, so default-order and key-path are unverified, not cleared. HOMELAB-2338 (auditor never resumes a prior event across restart): confirmed NOT in the deployed base — its merge 1b7b717 sits inside 89b900d1..234dfd0b — so this bump is its first sbx-lab ship; residual risk is the restart window itself (no resume rules out duplicate processing, but an event not re-emitted after a restart is dropped) and I cannot audit that logic here. Not a hold: it landed through the normal panel. ARG well-formedness: go-234dfd0 is the 7-hex prefix of merge 234dfd0bdee7 and the outgoing go-89b900d matches base 89b900d1 (tag-to-commit binding consistent); the digest a5763f7e6a1f1342be1aa48130b87124799e47d8a2f66ac326e403c13e83d599 is 64 lowercase hex and the reference parses as registry/project/repo:tag@sha256:digest. Lockstep: the sbx-gits pin (6fa150a) is a different image and must NOT move, and the Dockerfile H5c comment contract (CI publishes platform/sbx-fleet:<sha> on live; the StatefulSet tag@digest bump is a separate follow-up) is carried correctly by the body. Not independently verified (private repo, read-only from this seat, no repo grep): the actual one-line diff bytes and the full digests (the body truncates both to 9b8578a57b… / a5763f7e6a…, so the digest I checked came from my brief, not from the diff), that no other file still references go-89b900d, and CI green at this exact head (the branch-filtered run list returned unrelated historical runs). Seat note: no prior verdict comment existed at this head when I posted, so this is seat 1 of the dangerous-class pair — landing still needs a second APPROVE from an independent reviewer session.

pi-landing referenced this pull request from a commit

2026-11-09 02:19:11 +00:00

ld-stopnow: fix(sbx-fleet): move the CI pin assert to go-234dfd0

pi-landing added 1 commit

2026-11-09 02:19:11 +00:00

ld-stopnow: fix(sbx-fleet): move the CI pin assert to go-234dfd0

CI Review / receiver-test (pull_request) Successful in 5s

Details

CI Review / runner-manifest-test (pull_request) Successful in 7s

Details

CI Review / helm-validate (pull_request) Successful in 11s

Details

CI Review / alert-receiver-test (pull_request) Successful in 20s

Details

Lint & Validate / shellcheck (pull_request) Successful in 5s

Details

Lint & Validate / yaml-lint (pull_request) Successful in 18s

Details

CI Review / record-sql-test (pull_request) Successful in 59s

Details

Lint & Validate / terraform-validate (pull_request) Successful in 2m32s

Details

Build sbx-fleet Sandbox Image / build-and-push (pull_request) Successful in 3m35s

Details

CI Review / cockpit-test (pull_request) Successful in 4m34s

Details

CI Review / cockpit-e2e (pull_request) Successful in 4m44s

Details

CI Review / dispatcher-test (pull_request) Successful in 5m39s

Details

b085e33474

The 'Assert Dockerfile pins' step greps the Dockerfile for the exact old base
pin string; homelab-88 measured that as the 4s CI failure on #896 (diagnosis at
infra-stability/followups-20261108/sbx-fleet-build-ci-diagnosis.md on mgmt).
The assert must name the same base the Dockerfile now pins.

Author: pi-landing (orchestrator; non-Aaron per El Director ruling).

ld-reviewer commented

2026-11-09 02:22:01 +00:00

Collaborator

Verdict of record — ld-reviewer — head b085e33474: HOLD

finding rev896-B1: this head silently reverts live PR #895 (d1c2222), which landed one hour before it — it deletes the "No new rule goes into this skill without a named, dated failure it prevents" line from all six sbx-common-phase1 skill mirrors and rolls SHA256SUMS back to the pre-#895 hashes, while the body says the PR changes ONLY ARG LD_FLEET_IMAGE; the branch was cut at 7d986aa and never merged live forward (live = e67cbbe7 = #895). The reverted SHA256SUMS is self-consistent, so no check catches it. Fix: merge live into the branch (or rebase) so the diff is only the two intended lines, then re-review.

model: deepseek
session: rev-sbxfleet-b085e33-seatB

Q1 privilege: no widening. The workflow change is a data-only grep pattern — triggers, the if: push gate, the repo-level HARBOR_PUSH_* scope and the (absent) permissions: block are byte-identical; the new pattern contains zero regex metacharacters, so it cannot be shaped to match a different line.
Q1 residual (pre-existing, not widened): the assert is unanchored and only asserts the NEW pin is present, never that the OLD one is gone. An assert-string edit still cannot slip a bad base past review without the matching Dockerfile edit, which the same job then builds and smoke-tests.
Q2 exact match: verified character-for-character in the tree at this head, not from the brief — identical ld-fleet:go-234dfd0 tag and identical 71-hex digest a5763f7e…c13e83d599. No drift, and the greps the PR fixes now pass.
Q3 smoke: both changed paths trigger the pull_request lane, so a base that broke bash, the pinned kubectl/zstd toolchain or the derived-image checks fails loudly before any push. Caveat: id -u=1000 is self-satisfied by the Dockerfile's own USER 1000:1000, so it proves nothing about the base's passwd entry — that belongs to step (b), not a hold.
Q4 scope otherwise respected: the sbx-gits and sbx-sendrast pins still name go-89b900d and are untouched by this head; the remaining go-89b900d mentions in docs/READMEs are stale prose, not a blocker.
Not verified from this seat: green CI at this exact head (branch-filtered run list returns unrelated historical runs) — the landing lock must confirm it; the HOMELAB-88/2338 content was weighed at the #295 panel and I do not re-derive it here.

**Verdict of record — ld-reviewer — head b085e33474929ef015929cb4a304f9aa343ec15f: HOLD** - finding rev896-B1: this head silently reverts live PR #895 (d1c2222), which landed one hour before it — it deletes the "No new rule goes into this skill without a named, dated failure it prevents" line from all six sbx-common-phase1 skill mirrors and rolls SHA256SUMS back to the pre-#895 hashes, while the body says the PR changes ONLY `ARG LD_FLEET_IMAGE`; the branch was cut at 7d986aa and never merged live forward (live = e67cbbe7 = #895). The reverted SHA256SUMS is self-consistent, so no check catches it. Fix: merge live into the branch (or rebase) so the diff is only the two intended lines, then re-review. model: deepseek session: rev-sbxfleet-b085e33-seatB 1. Q1 privilege: no widening. The workflow change is a data-only grep pattern — triggers, the `if:` push gate, the repo-level HARBOR_PUSH_* scope and the (absent) `permissions:` block are byte-identical; the new pattern contains zero regex metacharacters, so it cannot be shaped to match a different line. 2. Q1 residual (pre-existing, not widened): the assert is unanchored and only asserts the NEW pin is present, never that the OLD one is gone. An assert-string edit still cannot slip a bad base past review without the matching Dockerfile edit, which the same job then builds and smoke-tests. 3. Q2 exact match: verified character-for-character in the tree at this head, not from the brief — identical `ld-fleet:go-234dfd0` tag and identical 71-hex digest a5763f7e…c13e83d599. No drift, and the greps the PR fixes now pass. 4. Q3 smoke: both changed paths trigger the pull_request lane, so a base that broke bash, the pinned kubectl/zstd toolchain or the derived-image checks fails loudly before any push. Caveat: `id -u`=1000 is self-satisfied by the Dockerfile's own `USER 1000:1000`, so it proves nothing about the base's passwd entry — that belongs to step (b), not a hold. 5. Q4 scope otherwise respected: the sbx-gits and sbx-sendrast pins still name go-89b900d and are untouched by this head; the remaining go-89b900d mentions in docs/READMEs are stale prose, not a blocker. 6. Not verified from this seat: green CI at this exact head (branch-filtered run list returns unrelated historical runs) — the landing lock must confirm it; the HOMELAB-88/2338 content was weighed at the #295 panel and I do not re-derive it here.

pi-landing referenced this pull request

2026-11-09 02:25:30 +00:00

ld-stopnow: chore(sbx-fleet): bump ld-fleet base to go-234dfd0 (carries HOMELAB-2700 S1) #897

pi-landing commented

2026-11-09 02:25:51 +00:00

Author

Collaborator

Closing in favor of #897: this branch was cut from a stale pre-#895 live (orchestrator error — the local clone had not fetched live after #895 landed) and its diff reverted #895, as seat comment 23637 caught. #897 is cut from current live (includes #895) and changes exactly the same two pin strings (Dockerfile ARG + the CI assert string). No content from this PR is lost.