feat(seatpost): post-only seat-verdict endpoint in ld-runtime (LR-20261111-025) #939
No reviewers
Labels
No labels
operator-review
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Homelab/infra-core!939
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "lr-20261111-025/seatpost"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Spec 025 (part 1 of 3): the post-only seat-verdict endpoint in ld-runtime
Seats anchor when they can read a PR's comments before posting their verdict
(seat B4 on #934 listed the comments and read seat A's verdict). This PR is the
post-only half of the fix: a seat gets the diff/tests/guard as a prepared local
bundle (part 3) and posts through this endpoint, which has no list/read verb
for comments or reviews — closing homelab-88's N5 (
verdict-cliprintedother comments' open findings) by construction, not by prompt.
Head shape: three stacked commits (brief rule 5) — the endpoint
(
955ab6b3), the AMENDMENT-2 rework answering homelab-88's review(
ef493ca1), and two review-round fix commits (2fac01a2,ac105cd0). Seatsreview the full base..head diff.
What is here (final shape)
lab-director/dispatcher/seatpost/: ONE exact write route/v1/seat-post,PUT= register,POST= post. Every other method → 405 (audited);every other path → 404.
crypto/rand, injectable in tests). Register pins{sid, repo, pr, head};the 200 returns the minted id, which the seat-bundle tooling (part 3)
carries to the seat's folder.
leading run of non-blank lines — exactly what the census reads) must declare
the pinned sid (
SESSION:line or relaysid=) and a head that equals thepin. The first DECLARING line decides (bold statement with a stance word —
AGREE/APPROVE/REQUEST_CHANGES/HOLD/…, the
## Verdict — <sha>heading form,or the relay
LD-VERDICTline); a decoy above the real statement refusesinstead of passing. A body the census cannot attribute is not transported.
claimedrow (its ownpartial unique index) BEFORE calling Forgejo and refuses on ANY insert
error without posting. A failed post burns the bundle — the claim blocks
every later post, is logged for a human, and re-registering a fresh bundle
is the recovery. A posted-row insert failure still answers 200 (the comment
exists; lying would invite a duplicate) and the claim keeps the one-post
guarantee.
refused; no response to an unauthenticated caller echoes shas.
one — is audited to the insert-only
seat_poststable (refused registerrows can never be read back as the pin: the read filters
result='registered').posts with a named 503 while the migration is absent.
host (
:8098,0.0.0.0,::,[::]) resolves the pod IP via HOSTNAME;failure refuses the listener. Never a wildcard bind.
LD_FORGEJO_TOKEN— the pi-landing copyheld only in ld-fleet. No new identity. The token is never logged;
refusals are fixed one-line sentences, upstream error text goes to the pod
log only.
B1 — provenance, mounted on 8097 only
seat_postsrecords the seat'ssidand the Forgejocomment_idof thepost. The census counts a gated-repo verdict by provenance, not author:
GET /v1/seat-post/provenance?repo=&pr=&comment_id=→{head, sid, result}or 404 — strict params, no list verb, mounted only on the 8097
landing-only listener. The seat-facing 8098 handler 404s it (tested), and
it has its own rate allowance so census sweeps can't 429 a real verdict.
When 8097 is off, one named boot line says the read is absent and gated-repo
landings fail closed.
Done-when flows (fixed at hand-over)
seat-bundle <repo> <pr> <head>— not this PR (part 3: the sandboxtooling + seat template).
seat-postposts one verdict on the bundle's pinned PR/head — PROVEN(endpoint half):
TestPostTransportsTheVerdictVerbatim,TestSecondPostIsAConflict,TestClaimConflictRefusesWithoutPosting,TestStaleClaimBurnsTheBundle,TestPostedInsertFailureAfterPostKeeps200AndBlocksASecond; the clientscript lands with the bundle in part 3.
PROVEN: the seat's only Forgejo route is this route and the runtime
holds the only copy of the posting token (
TestNilPosterRefusesPerCall,wiring tests in
cmd/ld-runtime/seat_post_test.go). The env-scrubbingwrapper lands with the template (part 3).
TestNoReadVerbAtTheHTTPSurface(405s on the route; 404s on
/comments,/reviews, every other path);TestSecondPostIsAConflict,TestClaimConflictRefusesWithoutPosting, andTestConcurrentPostsCannotBothReachForgejo(exactly one Forgejo writeunder racing posts);
TestPostRefusalssubtests incl.head-mismatch;Posterseam has no comment/reviewread method — no code path can print another seat's findings.
TestBodyPinBinding(decoy-first-block refused, both fleetgrammars, backtick forms, first-declaration-wins);
TestRegisterMintsTheBundleID,TestRegisterRefusesACallerChosenBundle;TestRegisterInsertFailureRefuses,TestNoShaInAnyRefusalBody;TestSchemaAbsentRefusesPosts,TestSeatPostSchemaMissingRefusesPosts;TestProvenanceHandler,TestProvenanceIsMountedOnTheLookupListener,TestProvenanceIsNotOnThePostHandler,TestProvenanceHasItsOwnAllowance;TestRegistrationReadCarriesTheSid,TestSeatPostWiringCarriesTheSid.Deferred per El Director (follow-up, named here as ruled)
owner/repopi-landing can comment onis accepted at register).
listener).
Honest scope (per AMENDMENT 1)
This endpoint buys no comment/review read path (anchoring closed by
construction) and a target pinned by the implementer's registration.
It does not stop anything in sbx-lab from posting a fake verdict through
it, because a seat and an implementer are the same Unix user. The gateway
sid check (relay and census) is what makes a fake verdict worthless — and
B1's provenance read is what lets the census count only verdicts that
actually travelled this route. Full isolation (single-use pods) is queued
separately and deliberately not built here.
Proof
go vet ./...— clean.go test -race -count=1 ./seatpost/ ./record/ ./cmd/ld-runtime/— ok(seatpost 29 tests / 100+ subtests incl. the concurrency test at
-race -count=25; record 33; ld-runtime 57).go test -race -count=1 ./run/— ok except 7 pre-existing sandbox-onlyfailures (
TempDir RemoveAll cleanup: … gomodcache … permission denied),reproduced identically on a clean
origin/livecheckout here; zeroassertion failures. Includes
TestPostIssueCommentPostsTheBodyVerbatim.scripts/gits-sbx-epic-test.sh, full run, same runner): live FAILlist = 20, head FAIL list = 20, NEW FAILURES: 0 (identical modulo
per-run tmp-path text). The guard predates the stacked commits; the
dispatcher is not a guard surface.
Roll-out order (per the lead)
8098 Service port + a CNP scoped to sbx-lab by namespace and app label,
and the
seat_postsmigration (sid column, both partial unique indexes)via the 023 auto-sync. Provenance rides 017's 8097 exposure.
seat-bundle/seat-postsandbox tooling.Gate-adjacent: this changes the seat/verdict tooling — homelab-88's
independent file review (BLOCKED the first head; AMENDMENT-2 answered B1/B2
and took N1/N3/N4/N7/N8) plus two fresh seats per head, before El Director's
go.
no independent walk: implementer-run checks only
Lab-Run: LR-20261111-025
REQUEST_CHANGES — ld-reviewer — head
955ab6b334SESSION: LR-20261111-025-seatA-20261111T1534Z
MODEL: omniroute/deepseek-flash
VERDICT: HOLD
MODEL: omniroute/deepseek-flash · SESSION: LR-20261111-025-seatA-20261111T1534Z
HEAD:
955ab6b334FINDINGS:
PR body "Done when" flow 2 cites
TestPostPostsVerbatimBody: no function of that name exists at this head (grep -rn "func TestPostPostsVerbatimBody(" lab-director/dispatcher-> no match); the behaviour is proven asTestPostTransportsTheVerdictVerbatim(lab-director/dispatcher/seatpost/post_test.go:429).PR body "Done when" flow 3 cites
TestNilPosterRefusesNamingTheVariable: no function of that name exists (grep -rn "func TestNilPosterRefusesNamingTheVariable(" lab-director/dispatcher-> no match); the behaviour is proven asTestNilPosterRefusesPerCall(seatpost/post_test.go:816).PR body "Done when" flow 4 cites
TestNoReadVerb: no function of that exact name exists (grep -rn "func TestNoReadVerb(" lab-director/dispatcher-> no match; only the prefix ofTestNoReadVerbAtTheHTTPSurface, seatpost/post_test.go:702).PR body "Done when" flow 4 cites
TestPostRefusesWhenLiveHeadMoved: no function of that name exists (grep -rn "func TestPostRefusesWhenLiveHeadMoved(" lab-director/dispatcher-> no match); the wire-level head-mismatch case is the subtestTestPostRefusals/head-mismatch(seatpost/post_test.go:620).Consequence (checkable): 4 of the 9 test names carried by the "Done when" proof block do not resolve at this head, so "PROVEN (test name)" cannot be verified by name as written. The fix is the PR body (cite the real test names, or mark the flows endpoint-half proven), not the code.
No code defect found against step-5 claims: one exact route with PUT/POST only and 405+Allow otherwise (seatpost/post.go:373-393); Poster seam is only PostIssueComment+PullHead with no comment/review list or fetch (post.go:167-173); repo/pr/head come only from the registration (post.go:549, body struct in post() has bundle+body only); verdict body forwarded unmodified (post.go:528, 612); token never logged (cmd/ld-runtime/seat_post.go:111-135, and LD_FORGEJO_TOKEN is absent from configNames in cmd/ld-runtime/main.go, so it is not in runtimeConfig); every call on the path audited, refusals included, one row per call (post.go:738-790).
TEST: cd lab-director/dispatcher && go vet ./... && go test -race -count=1 ./seatpost/ ./record/ ./cmd/ld-runtime/ -> 0
APPROVE — ld-reviewer — head
955ab6b334SESSION: LR-20261111-025-seatB-20261111T1534Z
MODEL: omniroute/deepseek-flash
VERDICT: APPROVE
MODEL: omniroute/deepseek-flash · SESSION: LR-20261111-025-seatB-20261111T1534Z
HEAD:
955ab6b334FINDINGS (none blocking; each checkable):
TestPostPostsVerbatimBody(actual: seatpost/post_test.go:429 TestPostTransportsTheVerdictVerbatim),TestNoReadVerb(actual: :702 TestNoReadVerbAtTheHTTPSurface),TestNilPosterRefusesNamingTheVariable(actual: :816 TestNilPosterRefusesPerCall, and it is in seatpost/, not cmd/ld-runtime/),TestPostRefusesWhenLiveHeadMoved(actual: subtest "head-mismatch" of :612 TestPostRefusals). Substance is proven; only the citations are stale.CLAIMS CHECKED (all hold at this head):
"body":"<verdict>"and the returned id.TEST: cd lab-director/dispatcher && go vet ./... -> 0
TEST: cd lab-director/dispatcher && go test -race -count=1 ./seatpost/ ./record/ ./cmd/ld-runtime/ -> 0 (all three packages ok)
NOTE: ./run/ not in the required command; its 7 pre-existing sandbox TempDir/gomodcache cleanup failures are untouched by this diff, and the added run/forgejo_test.go TestPostIssueCommentPostsTheBodyVerbatim asserts no cleanup.
Method: fresh clone, checked out
955ab6b3(rev-parse confirms it, head did not move), diffed against base35a336157d. No PR comments or reviews read; verdict-cli not run.APPROVE — ld-reviewer — head
955ab6b334SESSION: LR-20261111-025-seatA-20261111T1534Z
MODEL: omniroute/deepseek-flash
resolved TestPostPostsVerbatimBody — citation fixed and verified resolving: PR body "Done when" flow 2 now cites
TestPostTransportsTheVerdictVerbatim, which resolves at head955ab6b3in lab-director/dispatcher/seatpost/post_test.go:429.resolved TestNilPosterRefusesNamingTheVariable — citation fixed and verified resolving: flow 3 now cites
TestNilPosterRefusesPerCall, resolving at seatpost/post_test.go:816.resolved TestNoReadVerb — citation fixed and verified resolving: flow 4 now cites
TestNoReadVerbAtTheHTTPSurface, resolving at seatpost/post_test.go:702.resolved TestPostRefusesWhenLiveHeadMoved — citation fixed and verified resolving: flow 4 now names the
TestPostRefusalssubtests includinghead-mismatch, resolving at seatpost/post_test.go:612 and :620.VERDICT: APPROVE
HEAD:
955ab6b334TEST: cd lab-director/dispatcher && go vet ./... && go test -race -count=1 ./seatpost/ ./record/ ./cmd/ld-runtime/ -> 0 (unchanged since the prior verdict; the head sha is identical, only the PR body changed)
APPROVE — ld-reviewer — head
ac105cd092SESSION: LR-20261111-025-seatA-20261111T1646Z
MODEL: omniroute/deepseek-flash
VERDICT: APPROVE
MODEL: omniroute/deepseek-flash
SESSION: LR-20261111-025-seatA-20261111T1646Z
HEAD:
ac105cd092(verified: clone + fetch origin live + rev-parse HEAD; base35a336157d, 4 commits ef493ca1+955ab6b3+2fac01a2+ac105cd0, 10 files, +4287/-9)FINDINGS: none blocking. AMENDMENT-2 shape verified against the code at this head, item by item:
Gate.Handler()(seatpost/post.go) serves/v1/seat-postonly — every other path 404 — and only PUT/POST;seatpost.Posterhas exactly two methods,PostIssueCommentandPullHead, so no code path can fetch a comment or a review.seatPostServer.ServewiresHandler: s.gate.Handler()(cmd/ld-runtime/seat_post.go), which never mounts the provenance handler.serve()callslookup.mountProvenance(seatPostGate.ProvenanceHandler())in thelookup != nilbranch only (cmd/ld-runtime/main.go), andseatLookupServer.handler()routes exactlyseatpost.ProvenancePathto it;ProvenanceHandleritself 404s any other path. Test: TestProvenanceIsMountedOnTheLookupListener (asserts 8097 routes it andgate.Handler()404s it), TestProvenanceIsNotOnThePostHandler.claimedrow viag.record(...)beforePoster.PostIssueComment;ErrConflict→ 409, any other insert error → 500ReasonClaimFailed, both without calling Forgejo (TestClaimConflictRefusesWithoutPosting, TestClaimInsertErrorRefuses500WithoutPosting, both assertposter.posts()==0).Store.Claimedis read before the body/post and refuses 409ReasonAlreadyPosted, the claim stays on Forgejo failure, and the durable side is theseat_posts_one_claimpartial unique index (record/seat_posts.go DDL contract + boot assertion). Tests: TestStaleClaimBurnsTheBundle (burn + one Forgejo write + "stale claim" log line), TestPostedInsertFailureAfterPostKeeps200AndBlocksASecond.decodeuses DisallowUnknownFields (a caller-chosen bundle isReasonUnknownField),MintBundleID= crypto/rand 16 bytes hex, mint failure → 500ReasonMintFailed. Tests: TestRegisterMintsTheBundleID, TestRegisterRefusesACallerChosenBundle.declaredPintakesfirstVerdictBlock(leading non-blank run, ends at first blank line — the stricter reading of the census's own rule), strips backticks, then walks LINES IN ORDER and stops at the first declaring line (relayLD-VERDICT, stance-anchored bold**AGREE|APPROVE|HOLD|… head <40hex>**,## … Verdict — <40hex>heading) — so a heading decoy on line 1 beats a later matching bold statement (refused), and a bold line that merely mentions a head cannot supply the pin.post()refuses 400ReasonBodyPinMismatchunless first-block sid == pin.Sid and head equal-folds pin.Head. Tests: TestDeclaredPin (20 cases incl. the decoy, half declarations, block-boundary), TestBodyPinBinding (11 refusing cases + 7 accepting incl. backticked/uppercase/mention-bold-first).short8is deleted with a comment saying why; the post 200 carries only{posted, comment_id}; upstream error text goes to the pod log (one line) only. Test: TestNoShaInAnyRefusalBody, TestPostRefusals/head-mismatch + head-read-failed, TestPostTransportsTheVerdictVerbatim (asserts the answer echoes no repo/pr/head/sid).newSeatPostGate→seatPostSchemaOK→SeatPostsIndexes(ctx)(pg_indexesfor seat_posts_one_claim AND seat_posts_one_post, missing table = both absent), andSchemaOK’s zero value is FALSE so a wiring that forgot the check is fail-closed; posts get a named 503 while register still answers. Tests: TestSeatPostSchemaMissingRefusesPosts (both-absent / one-absent / check-failed), TestSeatPostSchemaPresentOpensPosts, TestSchemaAbsentRefusesPosts, TestNewAppliesTheDefaults.bindAddr()resolves an empty host AND every explicit wildcard spelling (0.0.0.0,::,[::]) to the pod's first non-loopback IPv4 from HOSTNAME, and a resolution failure REFUSES the listener rather than opening a wildcard. Test: TestSeatPostBindAddr.PR-body check: all five "Done when" flows are marked — 2, 3 and 4 PROVEN with a test name each, 1 and 5 explicitly "not this PR (part 3)". All 23 cited test names exist at this head (grep
func <name>(= 1 hit each) and the cited subtesthead-mismatchexists at seatpost/post_test.go:1085. The required line "no independent walk: implementer-run checks only" is present.Non-blocking notes (checkable, no behaviour change):
N1 (nit)
seatpost.ReasonAlreadyRegistered(post.go:177) andResultRegistrationWrite(post.go:214) are declared and never referenced; the ReasonAlreadyRegistered comment describes "a re-register that differs is a 409", a path that cannot occur because register mints a fresh bundle on every call and the register body has no bundle field — dead doc, dead constant.N2 (body nit) The "Head shape" paragraph says "three stacked commits" and then lists four (
955ab6b3,ef493ca1,2fac01a2,ac105cd0); the diff has four. Code is right, the sentence isn’t.N3 (accepted by design, noted)
ProvenanceHandlerdoes answerheadandsidto an unauthenticated caller — that is B1's purpose — and sincecomment_idis enumerable per (repo, pr) on 8097 it exposes (head, sid) of every seat post, never a body or a finding. Mounted only on the landing-only 8097 listener with its own bucket (TestProvenanceHasItsOwnAllowance); matches AMENDMENT-2 as ruled.N4 (test-style) TestSeatPostWiringCarriesTheSid and part of TestSeatPostListenerLines assert on source text via os.ReadFile; acceptable without a database, but such an assertion would also pass on a comment line.
TEST:
cd lab-director/dispatcher && go vet ./...→ exit 0.TEST:
go test -race -count=1 ./seatpost/ ./record/ ./cmd/ld-runtime/→ exit 0 (ok seatpost 1.141s, ok record 1.029s, ok cmd/ld-runtime 1.120s).TEST:
go test -race -count=1 -run TestPostIssueCommentPostsTheBodyVerbatim -v ./run/→ exit 0 (PASS; the 7 sandbox-only TempDir/gomodcache cleanup failures in ./run/ were not re-run in full, per the brief).Judged from the diff, files at head, vet/tests only — no PR comments or reviews were read, verdict-cli was not run.
APPROVE — ld-reviewer — head
ac105cd092SESSION: LR-20261111-025-seatB-20261111T1702Z
MODEL: omniroute/deepseek-flash
VERDICT: APPROVE
MODEL: omniroute/deepseek-flash
SESSION: LR-20261111-025-seatB-20261111T1702Z
HEAD:
ac105cd092FINDINGS (none blocking):
seatpost/post.go:173-177still definesReasonAlreadyRegisteredand its "a re-register that differs is a 409" comment, andrecord/seat_posts.go(selectSeatPostRegistrationSQL header) still says "the endpoint refuses a differing re-register, so there should never be two". After the server-minted bundle id there is no re-register path at all: register never readsRegistration, mints a fresh 128-bit bundle every call, andReasonAlreadyRegisteredis referenced nowhere else in the tree (grep: only its own declaration + comment). Theorder by occurred_at asc limit 1in the registration read is therefore unreachable-in-practice, though harmless.TestRegistrationReadCarriesTheSid(record) andTestSeatPostWiringCarriesTheSid(cmd/ld-runtime) — assert on source text (Scan(&p.Bundle, &p.Repo, &p.Head, &p.Sid)and the literalseatpost.Registration{... Sid: row.Sid}mapping) rather than on behaviour. They do pin exactly the drift they name (an empty pin sid would 400 every honest post in a real pod), so the PR's "F1 sid wiring" claim holds; a behavioural wiring test would be stronger.AMENDMENT-2 SHAPE, checked against this head (file:line):
seatpost.Gate.Handler()(post.go:493-524) routes only exactPathand 404s everything else; thePosterseam has exactly two methods,PostIssueCommentandPullHead(post.go:244-252), andrun/forgejo.go:454-475adds onlyPostIssueComment; noListComments/ListReviewsis reachable from the Gate.main.go:1206-1211mountsseatPostGate.ProvenanceHandler()vialookup.mountProvenance(...);seat_lookup.go:150-172switches onseatpost.ProvenancePathinside the 8097 mux only;bindAddr/Serveof the seat-post server (seat_post.go:299-360) can never serve it, andGate.Handler()404s it (asserted byTestProvenanceIsMountedOnTheLookupListenerANDTestProvenanceIsNotOnThePostHandler).ResultClaimedinsert precedesPostIssueComment,ErrConflict→409, any other error→500claim_failed, both return before the poster; the live-head read (post.go:973) happens before it and is a read, not a post.Claimed()is read (post.go:938-960) andposted||claimed→409 with the "stale claim / claim without post ... a human must look" log line; the claim path inserts a claim row, so a failed Forgejo call leaves the row that the one_claim index keeps burned (TestStaleClaimBurnsTheBundleasserts 1 Forgejo write then 409 on the second attempt, at the same bundle, with no re-post).bundlefield andDisallowUnknownFieldsmakes a caller-chosen id a 400 (TestRegisterRefusesACallerChosenBundle); the id is not echoed by the post answer (postBody is{posted, comment_id}only).declaredPin/firstVerdictBlock(post.go:606-700): block = leading non-blank run, terminated at the first blank line; one line-order pass withbreakonce a head is declared; a later stance line cannot override an earlier heading decoy; refusal comparessid == reg.SidandEqualFold(head, reg.Head)and is a fixed sentence carrying no values.ReasonHeadMismatch,ReasonBodyPinMismatch,ReasonProvenanceUnknownand the register-write refusal are value-free constants;short8was deleted from the package (post.go:1240-1245);TestNoShaInAnyRefusalBodyasserts both 8-char prefixes are absent from every refusal body, andTestPostTransportsTheVerdictVerbatimasserts the success answer contains neither head, repo, pr nor sid.seatPostSchemaOK/SeatPostsIndexes(seat_post.go:242-273, record/seat_posts.go:281-311) querypg_indexesforseat_posts_one_claimANDseat_posts_one_post; a missing table is (false,false,nil) and a read error is fail-closed;Gate.SchemaOKzero value is false and the post route returns the named 503 before touching the store (TestSeatPostSchemaMissingRefusesPostscovers both-absent, one-absent and check-failed; register still answers 200).bindAddr/isUnspecifiedHost/podIP(seat_post.go:276-337) resolve HOSTNAME→first non-loopback IPv4 for empty host,0.0.0.0,::and[::], and refuse the listener when resolution fails; every non-wildcard host is used verbatim;TestSeatPostBindAddrasserts the resolved pod IP and the refusal.PR-BODY CLAIMS: every Done-when flow is marked. Flow 1 and flow 5 are explicitly "not this PR" (part 3) — correct, no code for them here. Flows 2, 3, 4 are marked PROVEN with the endpoint half named. The "no independent walk: implementer-run checks only" line is present at the end of the body.
TEST NAMES CITED, all present at this head (grep for
func <name>(): TestPostTransportsTheVerdictVerbatim, TestSecondPostIsAConflict, TestClaimConflictRefusesWithoutPosting, TestStaleClaimBurnsTheBundle, TestPostedInsertFailureAfterPostKeeps200AndBlocksASecond, TestNilPosterRefusesPerCall, TestNoReadVerbAtTheHTTPSurface, TestConcurrentPostsCannotBothReachForgejo, TestPostRefusals (witht.Run("head-mismatch")at post_test.go:1085), TestBodyPinBinding, TestRegisterMintsTheBundleID, TestRegisterRefusesACallerChosenBundle, TestRegisterInsertFailureRefuses, TestNoShaInAnyRefusalBody, TestSchemaAbsentRefusesPosts, TestSeatPostSchemaMissingRefusesPosts, TestProvenanceHandler, TestProvenanceIsMountedOnTheLookupListener, TestProvenanceIsNotOnThePostHandler, TestProvenanceHasItsOwnAllowance, TestRegistrationReadCarriesTheSid, TestSeatPostWiringCarriesTheSid, TestPostIssueCommentPostsTheBodyVerbatim. Zero missing. The claim "the seat-facing handler 404s the provenance path" is tested, not merely asserted.TEST:
cd lab-director/dispatcher && go vet ./...→ EXIT 0 (covers all packages including ./run/).go test -race -count=1 ./seatpost/ ./record/ ./cmd/ld-runtime/→ EXIT 0:ok seatpost 1.294s,ok record 1.068s,ok cmd/ld-runtime 1.125s.t.Skipin seatpost/record/cmd-ld-runtime/run-forgejo test files other than pre-existing skips in other run/ files (LD_TEST_RECORD_DSN, git, sh) — none gates a cited test../run/(the 7 pre-existing TempDir/gomodcache cleanup failures) was not re-run per the seat instructions;go vetcompiled it andTestPostIssueCommentPostsTheBodyVerbatimis present at this head.APPROVE — ld-reviewer — head
867f7d1cd0SESSION: LR-20261111-025-seatB-20261111T1709Z
MODEL: omniroute/deepseek-flash
VERDICT: APPROVE
MODEL: omniroute/deepseek-flash
SESSION: LR-20261111-025-seatB-20261111T1709Z
HEAD:
867f7d1cd0Checked out at that exact head (
git rev-parse HEAD= 867f7d1c…), reviewed the wholeorigin/live...HEADdiff (10 files, +4280/-9) and every touched file, ran the spec's commands, and judged the code against its own claims — no fix applied by me.AMENDMENT-2 SHAPE (each one verified in the code, not the comments)
seatpost.Posterhas exactlyPostIssueCommentandPullHead;grep -rn 'ListComments|ListReviews|Comments(' seatpost/ cmd/ld-runtime/seat_post.go(non-test) = 0 hits, andseatPostServer.Serveservesgate.Handler()only.ProvenanceHandleris mounted exactly once (main.go:1210 →lookup.mountProvenance),seatLookupServer.handler()routes it by exact path, andGate.Handler()404s any path but/v1/seat-post(TestProvenanceIsNotOnThePostHandler asserts 404 for GET and POST).g.record(…Result: ResultClaimed)beforePoster.PostIssueComment;ErrConflict→ 409ReasonAlreadyPosted, anything else → 500ReasonClaimFailedwithrespond, never a post (TestClaimConflictRefusesWithoutPosting, TestClaimInsertErrorRefuses500WithoutPosting).Claimed()is read alongsidePosted()and refuses 409 before any Forgejo call; the posted-row insert failure keeps 200 (the comment exists) and the claim still blocks a retry (TestStaleClaimBurnsTheBundle asserts Poster calls = 1 over two posts; TestPostedInsertFailureAfterPostKeeps200AndBlocksASecond).bundlefield,decodeuses DisallowUnknownFields, id comes fromcrypto/rand16 bytes hex (TestRegisterRefusesACallerChosenBundle → 400 unknown_field).firstVerdictBlock= leading non-blank run;declaredPinwalks it ONCE in line order, stance-anchored bold (AGREE|APPROVE|REQUEST_CHANGES|HOLD|CONCERN|BLOCK…), heading, or relayLD-VERDICT, and stops at the first decliner;SESSION:/sid=is the other half; caller refuses on!okor any disagreement. The round-3/round-4 repros are in the tests (decoy heading at another head refused,**note: see head <sha>**supplies nothing).ReasonHeadMismatch,ReasonBodyPinMismatch,ReasonAlreadyPosted,ReasonBundleUnknowncarry no values; TestNoShaInAnyRefusalBody checks every refusal body (incl. the provenance 404 and the store-failure 500) for both the pinned and the live 8-hex prefix.seatPostSchemaOKrequiresclaim && post; any error or a missing index logs the named line and setsSchemaOK=false, and post() answers 503ReasonSchemaAbsent(TestSeatPostSchemaMissingRefusesPosts covers both-absent / one-absent / check-failed; register keeps answering).bindAddrresolves empty host AND0.0.0.0/::/[::]through HOSTNAME→first non-loopback IPv4 and REFUSES the listener when it cannot (TestSeatPostBindAddr),Servelistens on that resolved address.Also verified: goroutine count is exactly 5 in every branch of serve(), so no deadlock on the disabled paths; post answers
{posted, comment_id}only, so a bundle-id guesser learns no target; the registration read filtersresult='registered', so a refused register row can never become the pin.PR BODY vs HEAD
grep -rn 'func <name>(' --include=*.go= 1 each) and all pass, including subtestsTestPostRefusals/head-mismatch,TestDeclaredPin/decoy-then-real-verdict,TestDeclaredPin/real-verdict-below-a-blank-line.TestPostIssueCommentPostsTheBodyVerbatimpasses at this head.FINDINGS (non-blocking, each checkable)
OBS-1: The body's "Head shape" paragraph says "three stacked commits" and then names four (
955ab6b3,ef493ca1,2fac01a2,ac105cd0);git log --oneline origin/live...HEADshows FIVE, the fifth being867f7d1c("drop the dead re-register refusal"). Documentation only — I reviewed the full five-commit base..head diff — but the paragraph is now stale.OBS-2: The 200 answer of the 8097 provenance route does echo
{head, sid, result}to an unauthenticated caller. That is the AMENDMENT-2/B1 design itself, and the "no sha" rule holds on every refusal body and on both seat-facing routes; the residual exposure is closed by the CNP keeping 8097 off the seat's reach, which is roll-out step 2 (the prod PR) and explicitly not this diff.OBS-3:
newSeatPostGateis now built unconditionally in serve() and returns an error when the record store is nil, so a storeless ld-runtime would fail to boot even with LD_SEAT_POST_ADDR and LD_SEAT_LOOKUP_ADDR both unset — that one "off unless asked for" guarantee is enforced by a nil-store check rather than by the address. No live path changes today (build()already fails onrecord.OpenSQL), and the same unconditional call makes one 5 s-timeout index probe at every boot even when the endpoint is off; worth a follow-up, not a blocker.TESTS RUN (exit codes, this sandbox, this head)
go vet ./...→ exit 0 (clean).go test -race -count=1 ./seatpost/ ./record/ ./cmd/ld-runtime/→ exit 0;ok seatpost 1.129s,ok record 1.051s,ok cmd/ld-runtime 1.131s.go test -race -count=1 -run '<the 17 seatpost tests cited above>' ./seatpost/→ exit 0 (18 PASS lines incl. parent; 0 FAIL).go test -race -count=1 -run 'TestSeatPostSchemaMissingRefusesPosts|TestProvenanceIsMountedOnTheLookupListener|TestProvenanceIsNotOnThePostHandler|TestRegistrationReadCarriesTheSid|TestSeatPostWiringCarriesTheSid' ./cmd/ld-runtime/→ exit 0.go test -race -count=1 -run TestPostIssueCommentPostsTheBodyVerbatim ./run/→ exit 0.go test -race -count=5 -run TestConcurrentPostsCannotBothReachForgejo ./seatpost/→ exit 0 (race detector clean over 5 runs).gofmt -lon the changed files → no output;t.Skipin the three new test files → none; seatpost has 29 top-level tests as the body states.scripts/gits-sbx-epic-test.shnames lab-director/dispatcher only in comments aboutrelay/relay.goandrelay/seat.go; grep finds no seatpost surface, so no guard command covers this change and the body's "NEW FAILURES: 0" baseline claim is unaffected by it (the ./run/ TempDir/gomodcache failures are pre-existing and this diff's run/ test passes).Nothing in the diff beats its own claims; APPROVE.
APPROVE — ld-reviewer — head
867f7d1cd0SESSION: LR-20261111-025-seatA-20261111T1709Z
MODEL: omniroute/deepseek-flash
VERDICT: APPROVE
MODEL: omniroute/deepseek-flash
SESSION: LR-20261111-025-seatA-20261111T1709Z
HEAD:
867f7d1cd0(verified:git rev-parse HEADat this clone = the same 40 hex; base origin/live35a336157d; 5 stacked commits, full three-dot diff read)FINDINGS (none blocking):
record/seat_posts.goline ~165 still says "registration retries are LEGAL rows (an identical retry is an explicit 200 path, and a differing one is refused by the read ... not by an index)" — that path no longer exists at this head: commit867f7d1cremoved the re-register refusal and a server-minted bundle id can never be retried. The conclusion (no unique index on register rows) is still right; the exemplar is stale. Check: grep -n "identical retry" record/seat_posts.go seatpost/post.go.seatpost/post.goline ~591 "registrationBody is the 200 answer to a register (and to an identical retry)" — same stale "identical retry", same commit. Check: same grep.firstVerdictBlockis honest (this endpoint stops at the first blank line; the census continues past a blank after a heading/opening statement), but the PR body says "exactly what the census reads" — it is the STRICTER reading, so the failure direction is a refused honest verdict, never a mis-attributed one. No action required.AMENDMENT-2 SHAPE, each checkable at this head:
Gate.Handler()serves only exactPathand 404s everything else;seatPost.PosterisPostIssueComment+PullHeadonly; no ListComments/ListReviews call exists in seatpost/ or cmd/ld-runtime/seat_post.go (grep is empty over non-test files). TestNoReadVerbAtTheHTTPSurface PASS.lookup.mountProvenance(seatPostGate.ProvenanceHandler())in cmd/ld-runtime/main.go; the 8098 handler is bares.gate.Handler(). TestProvenanceIsMountedOnTheLookupListener asserts 8097 routesseatpost.ProvenancePathto the provenance handler AND that the 8098 handler 404s it. PASS.post()logs aclaimedrow viag.record(...)beforePostIssueComment, and on error answers 409 on ErrConflict / 500 on anything else, returning before the Forgejo call. record/seat_posts.go's DDL contract carriesseat_posts_one_claim. TestClaimConflictRefusesWithoutPosting PASS.posted || claimed→ 409 with a named stale-claim log line; the claim is never deleted (no UPDATE/DELETE by grant, one INSERT statement in the file, no ON CONFLICT). TestStaleClaimBurnsTheBundle PASS.MintBundleID= crypto/rand 16 bytes hex. TestRegisterMintsTheBundleID, TestRegisterRefusesACallerChosenBundle PASS.declaredPinreadsfirstVerdictBlockonly, strips backticks, takes the FIRST declaring line (relay / stance-anchored bold / heading) and breaks, then requires a SESSION line; caller refuses unless sid==pin.Sid and head equals reg.Head. 20 subtests incl. decoy-first-block, heading-beats-later-bold, backticked, relay. TestBodyPinBinding PASS.short8is gone from the package. TestNoShaInAnyRefusalBody PASS. (The register 200 echoes the head the caller itself supplied; post 200 is{posted, comment_id}only.)newSeatPostGate→seatPostSchemaOKrequires claim && post, fail-closed on read error, logged either way;SchemaOKfalse refuses every post with a named 503 while register keeps answering. TestSeatPostSchemaMissingRefusesPosts / TestSeatPostSchemaPresentOpensPosts PASS.bindAddrresolves every spelling of "no interface" (":8098", "0.0.0.0", "::", "[::]", "[0.0.0.0]") via HOSTNAME→first non-loopback IPv4 and REFUSES when it cannot resolve; a named host is used as-is. TestSeatPostBindAddr PASS.PR BODY vs THIS HEAD:
func <name>(): TestPostTransportsTheVerdictVerbatim, TestSecondPostIsAConflict, TestClaimConflictRefusesWithoutPosting, TestStaleClaimBurnsTheBundle, TestPostedInsertFailureAfterPostKeeps200AndBlocksASecond, TestNilPosterRefusesPerCall, TestNoReadVerbAtTheHTTPSurface, TestConcurrentPostsCannotBothReachForgejo, TestPostRefusals (incl. head-mismatch), TestBodyPinBinding, TestRegisterMintsTheBundleID, TestRegisterRefusesACallerChosenBundle, TestRegisterInsertFailureRefuses, TestNoShaInAnyRefusalBody, TestSchemaAbsentRefusesPosts, TestSeatPostSchemaMissingRefusesPosts, TestProvenanceHandler, TestProvenanceIsMountedOnTheLookupListener, TestProvenanceIsNotOnThePostHandler, TestProvenanceHasItsOwnAllowance, TestRegistrationReadCarriesTheSid, TestSeatPostWiringCarriesTheSid, TestPostIssueCommentPostsTheBodyVerbatim.TEST (each exit code):
cd lab-director/dispatcher && go vet ./...→ exit 0 (clean).go build ./...→ exit 0.go test -race -count=1 ./seatpost/ ./record/ ./cmd/ld-runtime/→ exit 0 (ok seatpost 1.2s, ok record 1.1s, ok cmd/ld-runtime 1.2s).go test -race -count=1 ./run/→ exit 1, 7 failures, and the FAIL list is IDENTICAL to a clean worktree at base35a336157d(git worktree add /tmp/base025 35a3361), all "TempDir RemoveAll cleanup: ... gomodcache ... permission denied" — zero assertion failures. Reproduced twice more at head: 7 each time. One extra flake (TestCloseScheduleIsJournalled) appeared once under parallel load in my session and did NOT recur in two further -race runs, and passes alone; not attributable to this diff. Targeted run of the touch points (-run 'TestPostIssueComment|TestPullHead|SeatPost|Forgejo' ./run/) → ok, so PostIssueComment/PullHead assertions pass.scripts/gits-sbx-epic-test.sh, "live 20 / head 20, NEW FAILURES: 0"): script present at this head; not re-run by me — the dispatcher is not a guard surface and the change is dispatcher-only.Scope notes accepted as disclosed, not defects: N2 (repo allowlist) and N5 (per-caller limiting / expiry) deferred by El Director; the endpoint buys no read path but does not stop a fake verdict posted by the same Unix user (gateway sid check is the defence); the
seat_postsmigration and the 8098 Service/CNP ride the prod PR, and until then posts fail closed with a named 503.