ld-stopnow: chore(sbx-gits): pin sandbox image to fc933fb (S2) + README pin prose #903

Merged

pi-landing merged 4 commits from plane/ld-stopnow-gits-pin into live 2026-11-09 08:56:35 +00:00

Conversation 2 Commits 4 Files changed 3 +39 -15

pi-landing commented 2026-11-09 07:52:11 +00:00

Collaborator

Copy link

sbx-gits pin bump: platform/sbx-fleet 6fa150a → fc933fb (S2, stop-now)

Cut from live at the post-#900 merge ce80bdda. Three files:

1. core/manifests/apps/sbx-gits/statefulset.yaml — the 4 sandbox image lines

- harbor.aaron.reynoza.org/platform/sbx-fleet:6fa150a@sha256:0ee5e97e9c24f81a3a65a712054dba7e3ffb0e300f5840315d5152ffa60ea53c
+ harbor.aaron.reynoza.org/platform/sbx-fleet:fc933fb@sha256:be81ce63119fdb6c2da08356a8cfe63f7d976dcb72b5f3a2c0eaaa2766562066

Lines 232, 330, 748, 1120 — the four containers on the sbx-fleet image
(prepare-work, seed-pi-agent, sandbox, emu-health). The emulator image line
(android-emulator:230756a@sha256:66430940…) is NOT touched — it is a
different image and stays.

fc933fb is the image the live push build of #897 published (merge fc933fb3,
pushed 2026-11-09T02:34Z), built on the new ld-fleet base go-234dfd0 from
lab-director merge 234dfd0b. sbx-lab already carries it (#898).

2. README §5, §8, §9 pin prose (this directory's README.md)

• §5: the extensions.pinned parenthetical ([]) is stale — the image now
  pins exactly one entry, the vendored pi-session-tag (pi-extensions
  a79a77a3, the S1 session-tag fail-safe). Prose names it. The §5 bootstrap
  example's image line moves to fc933fb too.
• §8: the digest grep asserting the old pin in statefulset.yaml is
  updated to the new tag@digest (otherwise the README's own check fails after
  the bump), and "a settings.json with packages was seeded" becomes "whose
  packages disagree with extensions.pinned" (the init's actual 78 reason).
• §9: the stale 6fa150a mention → fc933fb, and "the first Harbor push"
  → "the current Harbor push" of that derived build.

3. scripts/gits-sbx-epic-test.sh — the harness re-pin the bump requires (ruled IN scope)

A pin bump wave must re-pin the harness in the same change (precedent: #860,
HOMELAB-2682). Three edits, all in this one script (which lives OUTSIDE the
sbx-gits directory, so none enters the T7[diff] set):

1. H8[8] sandbox: imagen mutation row: sed-matched the literal 6fa150a;
   after the bump the mutation would not apply and the row would go RED. The
   match is made tag-agnostic (sbx-fleet:[0-9a-f]*@sha256:[0-9a-f]*); the
   replacement value is unchanged (only the change matters, the reason stays
   spine-distinto). The row is verified still biting on this head (ROJO por
   spine-distinto).
2. SBX_GITS_DIFF_SET re-measured against the current live tip
   (ce80bdda): M statefulset.yaml -> M README.md + M statefulset.yaml,
   because this wave also moves the README pin prose. The set is re-measured
   against the tip, never dragged along (the #860 set is already absorbed by
   live). T7[diff] and 17R159 read this one literal; both their pass
   messages now describe the S2 set.
3. H8[8] declared image pin (d_img): the live-side template comparison
   (p1_lab_sts_bad) requires spine/census equality with live except what the
   wave declares. The wave declares the new pin
   (fc933fb@sha256:be81ce63119fdb6c2da08356a8cfe63f7d976dcb72b5f3a2c0eaaa2766562066,
   the 64-hex Harbor digest — copied programmatically from the Harbor API, not
   retyped): the live render's sbx-fleet image lines are normalized to it, so a
   head carrying exactly the declared pin is GREEN and any other value —
   including the mutation row's deadbeef — stays RED. Same division of work
   as #860's d_extra_rp: the value is pinned by this script, not by the diff.
   The android-emulator line never matches the pattern and is untouched.

Local verification (this head, c55cf5b1): full suite fails with the
identical 19 pre-existing environmental failures as live (origin/live
baseline on this runner) — zero new. manifest[3]'s detail string names the
new pin instead of the old one: that check reads the LIVE POD's current image
against the manifest, so it stays red until the pod is recreated — expected
for any pin bump under OnDelete, not a regression. H8[8] render, the image
mutation, T7[diff] and 17R159 all pass.

What the new image ships (lab-director 89b900d1..234dfd0b, 13 commits)

Same payload as #898 (already reviewed and landed there): the S1 session-tag
work (HOMELAB-2700, 8 commits), HOMELAB-88's kmca/k3.1-pro model entry (2), and
HOMELAB-2338 turning the herdr resume-on-restore ON for the build pool (3).
Authorship note as in #898: commits authored as 'Aaron Reynoza' were pushed by
the mgmt session-tag orchestrator using Aaron's git login, not by Aaron
himself; 'pi-landing'/'pi-worker' are the landing/worker identities.

#860's follow-up note applies to this bump too: sbx-gits's four sbx-fleet
containers inherit the image ENV TMPDIR=/home/ld/work/tmp +
JAVA_TOOL_OPTIONS at this digest, and this manifest's prepare-work creates
/home/ld/work/tmp (#860 added the install -d for exactly this) — so the
ENV layer always names a real path here.

Mechanics

• The StatefulSet is OnDelete: merging this changes nothing until the pod is
  recreated, and that recreate is the hypervisor's, agreed separately. State
  after merge: pinned, not yet running.
• All four lines carry tag@sha256; the digest is what the kubelet pulls, so a
  retag cannot move the pin.
• Landing: not prod — two fresh review-seat verdicts on the exact head + green
  CI, then the landing tool. No pod recreate is done or triggered by this PR.
• Harness parity verified locally: full suite on this head fails with the
  identical 19 pre-existing environmental failures as live (zero new).

Author: pi-landing (orchestrator; non-Aaron per El Director ruling).

# sbx-gits pin bump: platform/sbx-fleet 6fa150a → fc933fb (S2, stop-now) Cut from live at the post-#900 merge `ce80bdda`. Three files: ## 1. `core/manifests/apps/sbx-gits/statefulset.yaml` — the 4 sandbox image lines ``` - harbor.aaron.reynoza.org/platform/sbx-fleet:6fa150a@sha256:0ee5e97e9c24f81a3a65a712054dba7e3ffb0e300f5840315d5152ffa60ea53c + harbor.aaron.reynoza.org/platform/sbx-fleet:fc933fb@sha256:be81ce63119fdb6c2da08356a8cfe63f7d976dcb72b5f3a2c0eaaa2766562066 ``` Lines 232, 330, 748, 1120 — the four containers on the sbx-fleet image (prepare-work, seed-pi-agent, sandbox, emu-health). **The emulator image line (`android-emulator:230756a@sha256:66430940…`) is NOT touched** — it is a different image and stays. `fc933fb` is the image the live push build of #897 published (merge `fc933fb3`, pushed 2026-11-09T02:34Z), built on the new ld-fleet base `go-234dfd0` from lab-director merge `234dfd0b`. sbx-lab already carries it (#898). ## 2. README §5, §8, §9 pin prose (this directory's README.md) - **§5**: the `extensions.pinned` parenthetical `([])` is stale — the image now pins exactly one entry, the vendored `pi-session-tag` (pi-extensions `a79a77a3`, the S1 session-tag fail-safe). Prose names it. The §5 bootstrap example's image line moves to fc933fb too. - **§8**: the digest grep asserting the old pin in `statefulset.yaml` is updated to the new tag@digest (otherwise the README's own check fails after the bump), and "a `settings.json` with packages was seeded" becomes "whose packages disagree with `extensions.pinned`" (the init's actual 78 reason). - **§9**: the stale `6fa150a` mention → `fc933fb`, and "the first Harbor push" → "the current Harbor push" of that derived build. ## 3. `scripts/gits-sbx-epic-test.sh` — the harness re-pin the bump requires (ruled IN scope) A pin bump wave must re-pin the harness in the same change (precedent: #860, HOMELAB-2682). Three edits, all in this one script (which lives OUTSIDE the sbx-gits directory, so none enters the T7[diff] set): 1. **H8[8] `sandbox: imagen` mutation row**: sed-matched the literal `6fa150a`; after the bump the mutation would not apply and the row would go RED. The match is made tag-agnostic (`sbx-fleet:[0-9a-f]*@sha256:[0-9a-f]*`); the replacement value is unchanged (only the change matters, the reason stays `spine-distinto`). The row is verified still biting on this head (ROJO por spine-distinto). 2. **`SBX_GITS_DIFF_SET` re-measured** against the current live tip (`ce80bdda`): `M statefulset.yaml` -> `M README.md` + `M statefulset.yaml`, because this wave also moves the README pin prose. The set is re-measured against the tip, never dragged along (the #860 set is already absorbed by live). T7[diff] and 17[R159](d) read this one literal; both their pass messages now describe the S2 set. 3. **H8[8] declared image pin (`d_img`)**: the live-side template comparison (`p1_lab_sts_bad`) requires spine/census equality with live except what the wave declares. The wave declares the new pin (`fc933fb@sha256:be81ce63119fdb6c2da08356a8cfe63f7d976dcb72b5f3a2c0eaaa2766562066`, the 64-hex Harbor digest — copied programmatically from the Harbor API, not retyped): the live render's sbx-fleet image lines are normalized to it, so a head carrying exactly the declared pin is GREEN and any other value — including the mutation row's `deadbeef` — stays RED. Same division of work as #860's `d_extra_rp`: the value is pinned by this script, not by the diff. The `android-emulator` line never matches the pattern and is untouched. **Local verification (this head, `c55cf5b1`)**: full suite fails with the identical 19 pre-existing environmental failures as live (`origin/live` baseline on this runner) — zero new. `manifest[3]`'s detail string names the new pin instead of the old one: that check reads the LIVE POD's current image against the manifest, so it stays red until the pod is recreated — expected for any pin bump under `OnDelete`, not a regression. H8[8] render, the image mutation, T7[diff] and 17[R159](d) all pass. ## What the new image ships (lab-director 89b900d1..234dfd0b, 13 commits) Same payload as #898 (already reviewed and landed there): the S1 session-tag work (HOMELAB-2700, 8 commits), HOMELAB-88's kmca/k3.1-pro model entry (2), and HOMELAB-2338 turning the herdr resume-on-restore ON for the build pool (3). Authorship note as in #898: commits authored as 'Aaron Reynoza' were pushed by the mgmt session-tag orchestrator using Aaron's git login, not by Aaron himself; 'pi-landing'/'pi-worker' are the landing/worker identities. #860's follow-up note applies to this bump too: sbx-gits's four sbx-fleet containers inherit the image `ENV TMPDIR=/home/ld/work/tmp` + `JAVA_TOOL_OPTIONS` at this digest, and this manifest's `prepare-work` creates `/home/ld/work/tmp` (#860 added the `install -d` for exactly this) — so the ENV layer always names a real path here. ## Mechanics - The StatefulSet is `OnDelete`: merging this changes nothing until the pod is recreated, and that recreate is the hypervisor's, agreed separately. State after merge: *pinned, not yet running.* - All four lines carry `tag@sha256`; the digest is what the kubelet pulls, so a retag cannot move the pin. - Landing: not prod — two fresh review-seat verdicts on the exact head + green CI, then the landing tool. No pod recreate is done or triggered by this PR. - Harness parity verified locally: full suite on this head fails with the identical 19 pre-existing environmental failures as live (zero new). Author: pi-landing (orchestrator; non-Aaron per El Director ruling).

pi-landing added 3 commits 2026-11-09 07:52:12 +00:00

ld-stopnow: chore(sbx-gits): pin sandbox image to fc933fb (S2) + README pin prose fcc5463244

ld-stopnow: chore(sbx-gits): pin sandbox image to fc933fb (S2) + README pin prose 69d7680830

ld-stopnow: chore(sbx-gits): pin sandbox image to fc933fb (S2) + README pin prose 57ec0c6f0e

pi-landing added 1 commit 2026-11-09 08:40:44 +00:00

ld-stopnow: harness re-pin for the S2 wave (diff set + declared image pin; d_img digest corrected to the Harbor 64-hex value) c55cf5b14a

ld-reviewer commented 2026-11-09 08:52:04 +00:00

Collaborator

Copy link

Verdict of record — ld-reviewer — head c55cf5b14a: APPROVE
model: omniroute/deepseek-flash
session: rev-s2-c55cf5b-seatA

Verified at the exact head, fresh worktree of origin/plane/ld-stopnow-gits-pin (HEAD == c55cf5b14a):

• git diff origin/live .. = exactly 3 files (README.md 15±, statefulset.yaml 8±, scripts/gits-sbx-epic-test.sh 31±); the statefulset diff is exactly 4 image: lines 6fa150a@0ee5e97e -> fc933fb@be81ce63, no 6fa150a left, and the android-emulator:230756a line is untouched.
• Digest truth from Harbor (projects/platform/repositories/sbx-fleet/artifacts): tag fc933fb -> sha256:be81ce63119fdb6c2da08356a8cfe63f7d976dcb72b5f3a2c0eaaa2766562066 (64 hex). All 7 fc933fb digests in the changed files (statefulset 4x, README 2x, harness d_img 1x) are byte-identical to it — no truncated/extra chars.
• Harness run (bash scripts/gits-sbx-epic-test.sh, tee'd): H8[8][sbx-gits] render PASS; H8[8][sbx-gits][mut] sandbox: imagen PASS -> ROJO por 'spine-distinto' (tag-agnostic row bites); T7[diff] PASS (+ both red mutations of the new M README.md / M statefulset.yaml set); 17[R159] (d) PASS (+ both red mutations). RESULT: FAIL (19 of 718 checks failed, 2 skipped, 0 pending).
• The 19 failures are the live baseline set; the only pin-related deviation is manifest[3] naming sbx-fleet:fc933fb@be81ce63 (it reads the live pod's still-old image; resolves at recreate), exactly as declared. No other divergence attributable to this bump.

**Verdict of record — ld-reviewer — head c55cf5b14a10fe6dc989304f763df73fcf863dea: APPROVE** model: omniroute/deepseek-flash session: rev-s2-c55cf5b-seatA Verified at the exact head, fresh worktree of `origin/plane/ld-stopnow-gits-pin` (HEAD == c55cf5b14a10fe6dc989304f763df73fcf863dea): - `git diff origin/live ..` = exactly 3 files (README.md 15±, statefulset.yaml 8±, scripts/gits-sbx-epic-test.sh 31±); the statefulset diff is exactly 4 `image:` lines 6fa150a@0ee5e97e -> fc933fb@be81ce63, no 6fa150a left, and the android-emulator:230756a line is untouched. - Digest truth from Harbor (`projects/platform/repositories/sbx-fleet/artifacts`): tag fc933fb -> sha256:be81ce63119fdb6c2da08356a8cfe63f7d976dcb72b5f3a2c0eaaa2766562066 (64 hex). All 7 fc933fb digests in the changed files (statefulset 4x, README 2x, harness d_img 1x) are byte-identical to it — no truncated/extra chars. - Harness run (`bash scripts/gits-sbx-epic-test.sh`, tee'd): H8[8][sbx-gits] render PASS; H8[8][sbx-gits][mut] `sandbox: imagen` PASS -> ROJO por 'spine-distinto' (tag-agnostic row bites); T7[diff] PASS (+ both red mutations of the new M README.md / M statefulset.yaml set); 17[R159] (d) PASS (+ both red mutations). RESULT: FAIL (19 of 718 checks failed, 2 skipped, 0 pending). - The 19 failures are the live baseline set; the only pin-related deviation is `manifest[3]` naming sbx-fleet:fc933fb@be81ce63 (it reads the live pod's still-old image; resolves at recreate), exactly as declared. No other divergence attributable to this bump.

ld-reviewer commented 2026-11-09 08:56:02 +00:00

Collaborator

Copy link

Verdict of record — ld-reviewer — head c55cf5b14a: APPROVE
model: omniroute/deepseek-flash
session: rev-s2-c55cf5b-seatB

Verified on a fresh worktree at the exact head:

• Scope: git diff origin/live origin/plane/... --stat = exactly 3 files (README.md, statefulset.yaml, scripts/gits-sbx-epic-test.sh). Statefulset: 4 image: lines 6fa150a@0ee5e97e -> fc933fb@be81ce63; android-emulator:230756a untouched. README: only §5 (extensions.pinned now names the vendored pi-session-tag a79a77a3 instead of ([])), §8 (digest grep + "packages disagree with extensions.pinned") and §9 (fc933fb + "current Harbor push") — nothing else.
• Guard integrity: mutation row is tag-agnostic s#sbx-fleet:[0-9a-f]*@sha256:[0-9a-f]*#sbx-fleet:6fa150a@sha256:deadbeef00# with the deadbeef replacement preserved; SBX_GITS_DIFF_SET has exactly M README.md + M statefulset.yaml; d_img = fc933fb@sha256:be81ce63119fdb6c2da08356a8cfe63f7d976dcb72b5f3a2c0eaaa2766562066 (64 hex, byte-identical to the manifest pin).
• Mutation-proof: patching the manifest digest to sha256:0000…0000 makes H8[8][sbx-gits] render vs origin/live FAIL (spine-distinto, contenedores-distintos) — the guard still bites on any OTHER image value, and the deadbeef row stays RED.
• Harness parity on the UNMUTATED tree: RESULT: FAIL (19 of 718 checks failed, 2 skipped, 0 pending); zero FAILs among T7[diff], 17[R159] (d) and H8[8][sbx-gits] render (all PASS, including the two red-mutation self-checks of the diff set).
  Judged minimal and honest: the harness re-pin is the same three edits the bump requires, the declared pin lives in the script (not the diff), and the guard's bite is demonstrated rather than asserted.

**Verdict of record — ld-reviewer — head c55cf5b14a10fe6dc989304f763df73fcf863dea: APPROVE** model: omniroute/deepseek-flash session: rev-s2-c55cf5b-seatB Verified on a fresh worktree at the exact head: - Scope: `git diff origin/live origin/plane/... --stat` = exactly 3 files (README.md, statefulset.yaml, scripts/gits-sbx-epic-test.sh). Statefulset: 4 `image:` lines 6fa150a@0ee5e97e -> fc933fb@be81ce63; android-emulator:230756a untouched. README: only §5 (`extensions.pinned` now names the vendored pi-session-tag a79a77a3 instead of `([])`), §8 (digest grep + "packages disagree with extensions.pinned") and §9 (`fc933fb` + "current Harbor push") — nothing else. - Guard integrity: mutation row is tag-agnostic `s#sbx-fleet:[0-9a-f]*@sha256:[0-9a-f]*#sbx-fleet:6fa150a@sha256:deadbeef00#` with the deadbeef replacement preserved; SBX_GITS_DIFF_SET has exactly `M README.md` + `M statefulset.yaml`; `d_img` = fc933fb@sha256:be81ce63119fdb6c2da08356a8cfe63f7d976dcb72b5f3a2c0eaaa2766562066 (64 hex, byte-identical to the manifest pin). - Mutation-proof: patching the manifest digest to sha256:0000…0000 makes `H8[8][sbx-gits] render vs origin/live` FAIL (spine-distinto, contenedores-distintos) — the guard still bites on any OTHER image value, and the deadbeef row stays RED. - Harness parity on the UNMUTATED tree: `RESULT: FAIL (19 of 718 checks failed, 2 skipped, 0 pending)`; zero FAILs among T7[diff], 17[R159] (d) and H8[8][sbx-gits] render (all PASS, including the two red-mutation self-checks of the diff set). Judged minimal and honest: the harness re-pin is the same three edits the bump requires, the declared pin lives in the script (not the diff), and the guard's bite is demonstrated rather than asserted.

pi-landing merged commit cf8ad320ea into live 2026-11-09 08:56:35 +00:00

pi-landing referenced this pull request from a commit 2026-11-09 08:56:37 +00:00

Merge pull request 'ld-stopnow: chore(sbx-gits): pin sandbox image to fc933fb (S2) + README pin prose' (#903) from plane/ld-stopnow-gits-pin into live

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

operator-review

Requires human operator review before merge — dangerous class (RBAC, secrets, network policy, Terraform) or explicitly gated. Never auto-merge.

No labels

operator-review

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Homelab/infra-core!903

No description provided.