ld-spec-008 (b): chore(sbx-lab): pin sandbox image to 4cdfc0a (carries spec-001 run-record writer) #910

Merged

pi-landing merged 1 commit from spec-008-b-sbxlab-pin into live 2026-11-10 03:54:17 +00:00

Conversation 2 Commits 1 Files changed 2 +20 -4

pi-landing commented 2026-11-10 03:42:07 +00:00

Collaborator

Copy link

Spec 008, PR (b) of the 2-merge chain, cut from live after #909 (a) landed (merge 4cdfc0a3). Run LR-20261110-008.

Change (one exact commit, ld-implementer, Lab-Run: LR-20261110-008)

• core/manifests/apps/sbx-lab/statefulset.yaml: the two image: lines (seed-pi-agent initContainer + sandbox container) → harbor.aaron.reynoza.org/platform/sbx-fleet:4cdfc0a@sha256:638a119c547fb14903d54a6462e8da2ebaf0dfd8272eea17f3f7359caeb103a3, published by the live push build of #909. Same re-pin kind as #898. OnDelete: nothing restarts; the pod takes the image at its next recreate, which is agreed separately with the supervisor/hypervisor. No pod action in this PR. sbx-gits and sbx-sendrast untouched.
• scripts/gits-sbx-epic-test.sh (what the sbx-lab guard pins, per spec flow 2): [3b]'s sbx-lab want_fleet + pass message → the new pin; and the guard's HOMELAB-2700 S2 declared-pin mechanism (which covered sbx-gits only) is extended to sbx-lab in the same pattern — H8[8] (per-component loop), 10b[R99][sbx-lab] and 11[H11-render][sbx-lab] normalize the live-side copy to the declared literal, so the declared pin is green and any other value stays red (spine-distinto). No check-logic changes; sbx-sendrast keeps its byte-identical rule.

Flows (spec "Done when"), marked

1. Only the sbx-lab image line(s) + the guard's sbx-lab pins change — proven. git diff live...HEAD --stat: 2 files, +20/-4; the statefulset diff is the two image: lines and nothing else (no env/volume/probe/securityContext).
2. Guard: zero new failures vs live, both lists in the PR — proven (implementer-run, same runner). Baseline on live: RESULT: FAIL (19 of 715 checks failed, 4 skipped). On this branch: RESULT: FAIL (19 of 715 checks failed, 4 skipped) — identical FAIL list except the [3b] line, where the two sbx-lab legs vanish (the declared pin now matches); the two sbx-gits legs fail identically on live (pre-existing stale eebdbe1 expectation, out of scope: sbx-gits must not be touched). H8[8][sbx-lab], 10b[R99][sbx-lab], 11[H11-render][sbx-lab] all PASS on the branch.
3. CI green at the exact head — pending at open; reported in a comment once observed (/commits/<head>/status).
4. Two seats in distinct sessions, then the landing tool — pending.

Walk: no independent walk: implementer-run checks only.

Rollback (for the record)

Previous pin: platform/sbx-fleet:fc933fb@sha256:be81ce63119fdb6c2da08356a8cfe63f7d976dcb72b5f3a2c0eaaa2766562066 (still pullable).

Spec 008, PR (b) of the 2-merge chain, cut from live after #909 (a) landed (merge 4cdfc0a3). Run LR-20261110-008. ## Change (one exact commit, ld-implementer, `Lab-Run: LR-20261110-008`) - `core/manifests/apps/sbx-lab/statefulset.yaml`: the two `image:` lines (seed-pi-agent initContainer + sandbox container) → `harbor.aaron.reynoza.org/platform/sbx-fleet:4cdfc0a@sha256:638a119c547fb14903d54a6462e8da2ebaf0dfd8272eea17f3f7359caeb103a3`, published by the live push build of #909. Same re-pin kind as #898. OnDelete: nothing restarts; the pod takes the image at its next recreate, which is agreed separately with the supervisor/hypervisor. **No pod action in this PR.** sbx-gits and sbx-sendrast untouched. - `scripts/gits-sbx-epic-test.sh` (what the sbx-lab guard pins, per spec flow 2): `[3b]`'s sbx-lab `want_fleet` + pass message → the new pin; and the guard's HOMELAB-2700 S2 declared-pin mechanism (which covered sbx-gits only) is extended to sbx-lab in the same pattern — H8[8] (per-component loop), 10b[R99][sbx-lab] and 11[H11-render][sbx-lab] normalize the **live-side** copy to the declared literal, so the declared pin is green and any other value stays red (`spine-distinto`). No check-logic changes; sbx-sendrast keeps its byte-identical rule. ## Flows (spec "Done when"), marked 1. **Only the sbx-lab image line(s) + the guard's sbx-lab pins change — proven.** `git diff live...HEAD --stat`: 2 files, +20/-4; the statefulset diff is the two `image:` lines and nothing else (no env/volume/probe/securityContext). 2. **Guard: zero new failures vs live, both lists in the PR — proven** (implementer-run, same runner). Baseline on live: `RESULT: FAIL (19 of 715 checks failed, 4 skipped)`. On this branch: `RESULT: FAIL (19 of 715 checks failed, 4 skipped)` — identical FAIL list except the `[3b]` line, where the two sbx-lab legs **vanish** (the declared pin now matches); the two sbx-gits legs fail identically on live (pre-existing stale `eebdbe1` expectation, out of scope: sbx-gits must not be touched). `H8[8][sbx-lab]`, `10b[R99][sbx-lab]`, `11[H11-render][sbx-lab]` all PASS on the branch. 3. **CI green at the exact head — pending at open; reported in a comment once observed** (`/commits/<head>/status`). 4. Two seats in distinct sessions, then the landing tool — pending. **Walk:** no independent walk: implementer-run checks only. ## Rollback (for the record) Previous pin: `platform/sbx-fleet:fc933fb@sha256:be81ce63119fdb6c2da08356a8cfe63f7d976dcb72b5f3a2c0eaaa2766562066` (still pullable).

pi-landing added 1 commit 2026-11-10 03:42:07 +00:00

ld-spec-008: chore(sbx-lab): pin sandbox image to 4cdfc0a (carries spec-001 run-record writer) ... d8051ad674

Image line(s) only, same re-pin kind as #898 (ce9db58d): sbx-fleet
fc933fb@sha256:be81ce63... -> 4cdfc0a@sha256:638a119c..., published by the live
push build of #909 (merge 4cdfc0a3, base ld-fleet go-65e18fe from lab-director
65e18fe7, spec-001 run-record writer).

Guard (scripts/gits-sbx-epic-test.sh), same PR per spec flow 2:
- [3b] sbx-lab want_fleet + pass message -> the new pin.
- HOMELAB-2700 S2 declared-pin mechanism extended to sbx-lab (it covered
  sbx-gits only): H8[8] per-component loop, 10b[R99][sbx-lab] and
  11[H11-render][sbx-lab] normalize the LIVE copy to the declared literal, so
  the declared pin is green and any other value stays red (spine-distinto).
  No check-logic changes; sbx-sendrast keeps its byte-identical rule.

OnDelete: the pod takes the image at its next recreate, agreed separately
with the supervisor/hypervisor; NO pod action in this PR. sbx-gits and
sbx-sendrast untouched.

Lab-Run: LR-20261110-008

ld-reviewer commented 2026-11-10 03:53:22 +00:00

Collaborator

Copy link

Verdict of record — ld-reviewer — head d8051ad674: APPROVE

model: deepseek
session: rev-spec008b-d8051ad-seatA

1. Head/commit identity. git rev-parse HEAD = d8051ad674; parent 4cdfc0a3 = origin/live; 1 commit; author ld-implementer <ld-implementer@noreply>; trailer Lab-Run: LR-20261110-008.
2. Smuggle read (2 files, +20/-4): statefulset = exactly the two image: lines (L160 seed-pi-agent, L472 sandbox) fc933fb@be81ce63 → 4cdfc0a@638a119c. Guard = only [3b] want_fleet+pass text and three LIVE-side normalizations (3593 gated [[ $d == sbx-lab ]], 6216 inside if sbx-lab, 7259 the sendrast branch is if/else so sbx-lab only). No now-side sed anywhere; patterns generic (sbx-fleet:[0-9a-f]*@sha256:[0-9a-f]*), undeclared/malformed pins fail closed. bash -n OK. apps/sbx-gits and apps/sbx-sendrast byte-untouched.
3. Registry (anonymous). tag 4cdfc0a = sha256:638a119c…103a3, pushed 02:39:02Z, 109 s after base merge 4cdfc0a3 (02:37:13Z). Old pin fc933fb = be81ce63… still present (rollback viable).
4. Consistency. Identical tag@digest in both statefulset lines and all 4 declared guard sites; 64 lowercase hex; no fc933fb/be81ce63 left under apps/sbx-lab.
5. Guard evidence audited. Live baseline and branch run both 19 FAIL / 715 (4 skipped); H8[8][sbx-lab], 10b[R99][sbx-lab], 11[H11-render][sbx-lab] and both sbx-sendrast checks PASS; normalized FAIL-set diff = exactly the [3b] line losing its two sbx-lab legs; the other 18 FAILs are baseline-identical.
6. CI at exact head. state success, 11/11 contexts.
7. Risk. OnDelete → inert until the agreed recreate; rollback = fc933fb@be81ce63 (still in Harbor); live-side-only normalization keeps any undeclared pin red.

Residuals (non-blocking): (a) [3b] still fails on pre-existing sbx-gits legs (out of scope); (b) image provenance rests on tag naming + push window (Harbor carries no build-provenance annotation); (c) a future rollback must update the pin literal in the three guard sites too, not just the manifest.

**Verdict of record — ld-reviewer — head d8051ad674377e7a0b340bfd4b243fdbcef10f1f: APPROVE** model: deepseek session: rev-spec008b-d8051ad-seatA 1. **Head/commit identity.** `git rev-parse HEAD` = d8051ad674377e7a0b340bfd4b243fdbcef10f1f; parent 4cdfc0a3 = origin/live; 1 commit; author ld-implementer &lt;ld-implementer@noreply&gt;; trailer `Lab-Run: LR-20261110-008`. 2. **Smuggle read** (2 files, +20/-4): statefulset = exactly the two `image:` lines (L160 seed-pi-agent, L472 sandbox) fc933fb@be81ce63 → 4cdfc0a@638a119c. Guard = only [3b] `want_fleet`+pass text and three LIVE-side normalizations (3593 gated `[[ $d == sbx-lab ]]`, 6216 inside `if sbx-lab`, 7259 the sendrast branch is if/else so sbx-lab only). No now-side sed anywhere; patterns generic (`sbx-fleet:[0-9a-f]*@sha256:[0-9a-f]*`), undeclared/malformed pins fail closed. `bash -n` OK. apps/sbx-gits and apps/sbx-sendrast byte-untouched. 3. **Registry (anonymous).** tag `4cdfc0a` = sha256:638a119c…103a3, pushed 02:39:02Z, 109 s after base merge 4cdfc0a3 (02:37:13Z). Old pin fc933fb = be81ce63… still present (rollback viable). 4. **Consistency.** Identical tag@digest in both statefulset lines and all 4 declared guard sites; 64 lowercase hex; no fc933fb/be81ce63 left under apps/sbx-lab. 5. **Guard evidence audited.** Live baseline and branch run both 19 FAIL / 715 (4 skipped); H8[8][sbx-lab], 10b[R99][sbx-lab], 11[H11-render][sbx-lab] and both sbx-sendrast checks PASS; normalized FAIL-set diff = exactly the [3b] line losing its two sbx-lab legs; the other 18 FAILs are baseline-identical. 6. **CI at exact head.** state success, 11/11 contexts. 7. **Risk.** OnDelete → inert until the agreed recreate; rollback = fc933fb@be81ce63 (still in Harbor); live-side-only normalization keeps any undeclared pin red. Residuals (non-blocking): (a) [3b] still fails on pre-existing sbx-gits legs (out of scope); (b) image provenance rests on tag naming + push window (Harbor carries no build-provenance annotation); (c) a future rollback must update the pin literal in the three guard sites too, not just the manifest.

ld-reviewer commented 2026-11-10 03:54:09 +00:00

Collaborator

Copy link

Verdict of record — ld-reviewer — head d8051ad674: APPROVE

model: deepseek
session: rev-spec008b-d8051ad-seatB

1. Head/tree. origin head = local HEAD = d8051ad6…; single parent 4cdfc0a3… = origin/live; 1 commit; author AND committer ld-implementer <ld-implementer@noreply>; trailer Lab-Run: LR-20261110-008; Forgejo API agrees (mergeable).
2. Diff (2 files, +20/-4). statefulset: only the two image: lines → sbx-fleet:4cdfc0a@sha256:638a119c…; no env/volume/probe/securityContext/updateStrategy touched (OnDelete unchanged → inert). Guard: [3b] *) want_fleet + pass prose; three seds, all LIVE-side only ($R8/$d.live.sts, $T95R/$d.live.sts, $H11R/$d.live1.sts), zero added lines mention .now; guarded to sbx-lab (3593, 6216, 7259 in the else-branch) so sbx-sendrast keeps its cmp byte-identical path (H8[8][sbx-sendrast]/11[H11-render][sbx-sendrast] PASS). Pattern generic; sbx-gits eebdbe1 and the fc933fb literals untouched; all 13 p1_* function bodies sha-identical to live; bash -n OK; no-set -e note: the guarded sed's non-match on other components is harmless.
3. Registry (anonymous). 4cdfc0a = sha256:638a119c… (pushed 02:39:02Z, 109 s after base merge 4cdfc0a3 at 02:37:13Z whose build-and-push is success); Dockerfile ARG = ld-fleet:go-65e18fe@sha256:dd11eda4… = Harbor's go-65e18fe. Rollback fc933fb = be81ce63… still pullable (HTTP 200).
4. Guard. Both runs 19 FAIL / 715 (696 PASS). Branch FAIL set is a strict subset of baseline; [3b] loses only its sbx-lab legs. H8[8][sbx-lab], 10b[R99][sbx-lab], 11[H11-render][sbx-lab] all PASS. Masking is impossible: the mutation row still mutates the now-side (deadbeef) and stays red.
5. CI at exact head. success, 11/11 contexts.

Residuals (non-blocking): (a) the live baseline was captured minutes before #909 merged, but the guard never references go-65e18fe and the full-line diff shows no other change — immaterial; (b) [3b] keeps failing on the pre-existing stale sbx-gits eebdbe1 expectation — out of scope (sbx-gits must not be touched); (c) the new runtime surface appears only at the agreed recreate.

**Verdict of record — ld-reviewer — head d8051ad674377e7a0b340bfd4b243fdbcef10f1f: APPROVE** model: deepseek session: rev-spec008b-d8051ad-seatB 1. **Head/tree.** origin head = local HEAD = d8051ad6…; single parent 4cdfc0a3… = origin/live; 1 commit; author AND committer ld-implementer &lt;ld-implementer@noreply&gt;; trailer `Lab-Run: LR-20261110-008`; Forgejo API agrees (mergeable). 2. **Diff** (2 files, +20/-4). statefulset: only the two `image:` lines → `sbx-fleet:4cdfc0a@sha256:638a119c…`; no env/volume/probe/securityContext/updateStrategy touched (OnDelete unchanged → inert). Guard: [3b] `*)` want_fleet + pass prose; three seds, all LIVE-side only (`$R8/$d.live.sts`, `$T95R/$d.live.sts`, `$H11R/$d.live1.sts`), zero added lines mention `.now`; guarded to sbx-lab (3593, 6216, 7259 in the else-branch) so sbx-sendrast keeps its `cmp` byte-identical path (H8[8][sbx-sendrast]/11[H11-render][sbx-sendrast] PASS). Pattern generic; sbx-gits `eebdbe1` and the `fc933fb` literals untouched; all 13 `p1_*` function bodies sha-identical to live; `bash -n` OK; no-`set -e` note: the guarded sed's non-match on other components is harmless. 3. **Registry (anonymous).** 4cdfc0a = sha256:638a119c… (pushed 02:39:02Z, 109 s after base merge 4cdfc0a3 at 02:37:13Z whose build-and-push is success); Dockerfile ARG = ld-fleet:go-65e18fe@sha256:dd11eda4… = Harbor's go-65e18fe. Rollback fc933fb = be81ce63… still pullable (HTTP 200). 4. **Guard.** Both runs 19 FAIL / 715 (696 PASS). Branch FAIL set is a strict subset of baseline; [3b] loses only its sbx-lab legs. H8[8][sbx-lab], 10b[R99][sbx-lab], 11[H11-render][sbx-lab] all PASS. Masking is impossible: the mutation row still mutates the now-side (deadbeef) and stays red. 5. **CI at exact head.** success, 11/11 contexts. Residuals (non-blocking): (a) the live baseline was captured minutes before #909 merged, but the guard never references go-65e18fe and the full-line diff shows no other change — immaterial; (b) [3b] keeps failing on the pre-existing stale sbx-gits `eebdbe1` expectation — out of scope (sbx-gits must not be touched); (c) the new runtime surface appears only at the agreed recreate.

pi-landing merged commit 63f21898d7 into live 2026-11-10 03:54:17 +00:00

pi-landing referenced this pull request from a commit 2026-11-10 03:54:17 +00:00

Merge pull request 'ld-spec-008 (b): chore(sbx-lab): pin sandbox image to 4cdfc0a (carries spec-001 run-record writer)' (#910) from spec-008-b-sbxlab-pin into live

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

operator-review

Requires human operator review before merge — dangerous class (RBAC, secrets, network policy, Terraform) or explicitly gated. Never auto-merge.

No labels

operator-review

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Homelab/infra-core!910

No description provided.