Homelab/infra-core
6
0
Fork 2
Code Issues Pull requests 35 Projects Releases 1 Packages Wiki Activity Actions

fix(gits-sbx-epic-test): phase 1 guards the C6 overlay, not the pre-C6 shape #966

Open
pi-landing wants to merge 1 commit from ld/IR-20261112-phase1guard into live
pull from: ld/IR-20261112-phase1guard
merge into: Homelab:live
Conversation 0 Commits 1 Files changed 2 +169 -11
pi-landing commented 2026-11-12 16:27:50 +00:00
Collaborator
Copy link

fix(gits-sbx-epic-test): phase 1 guards the C6 overlay, not the pre-C6 shape

Built by homelab-88's lane (orch34 builder phase1guard2-orch34), delivered through the PATCH HANDOFF route (El Director, 2026-11-12). Patch sha256 10fc633fdb5cb5a000eeff09ca316f00dac0afd4c72b231b6ea70f62d5363541. Lab-Run: IR-20261112-phase1guard. Base live @ 2d837e9b.

Why

scripts/gits-sbx-epic-test.sh phase 1 still expected sbx-sendrast's kustomization to list ../sbx-common, but since a2754055 (11-10) sbx-sendrast deliberately lists ../sbx-common-sendrast. Phase 1 was RED on the unmutated tree, so every phase-1 mutation row in any infra-core PR passed vacuously (#945's pair is blocked on exactly this).

What changes

  • Phase 1 asserts the C6 overlay contract as given verbatim by the Sendrast owner (homelab-a9): sbx-sendrast lists ONLY ../sbx-common-sendrast (never ../sbx-common — both generate sbx-skills-source, a collision — and never sbx-common-phase1); the 4 divergent skill files are NOT byte-pinned; the 4 byte-copies diff clean against sbx-common; the overlay's SHA256SUMS self-verifies; the configMapGenerator is checked by name, no-hash and count.
  • A non-empty-output assertion (security finding): a phase-1 run that aborts under set -u with empty output now FAILS instead of reading green.
  • sbx-common-sendrast/kustomization.yaml: comment-only count corrections ("three" → four divergent files; "five" → four byte-copies + per-directory SHA256SUMS).

Evidence (builder, mocks/fixtures only)

  • a: the contract on the real tree → green on the C6 rows.
  • b: sbx-sendrast without ../sbx-common-sendrast → RED. c: sbx-sendrast pulling plain ../sbx-common (+ render differs) → RED. c2: both listed (kustomize collision) → RED.
  • d: old harness on an aborted run = green/empty; new harness = RED "no PHASE1 receipt". d2: wrong check count → RED.
  • Full suite on mgmt: phase 1's only remaining red is loader-skills=0, which is environmental (no pi package installed on mgmt); it is expected green in CI/sandbox.
## fix(gits-sbx-epic-test): phase 1 guards the C6 overlay, not the pre-C6 shape **Built by homelab-88's lane** (orch34 builder phase1guard2-orch34), delivered through the PATCH HANDOFF route (El Director, 2026-11-12). **Patch sha256 `10fc633fdb5cb5a000eeff09ca316f00dac0afd4c72b231b6ea70f62d5363541`.** Lab-Run: IR-20261112-phase1guard. Base `live` @ 2d837e9b. ### Why `scripts/gits-sbx-epic-test.sh` phase 1 still expected sbx-sendrast's kustomization to list `../sbx-common`, but since a2754055 (11-10) sbx-sendrast deliberately lists `../sbx-common-sendrast`. **Phase 1 was RED on the unmutated tree, so every phase-1 mutation row in any infra-core PR passed vacuously** (#945's pair is blocked on exactly this). ### What changes - Phase 1 asserts the **C6 overlay contract** as given verbatim by the Sendrast owner (homelab-a9): sbx-sendrast lists ONLY `../sbx-common-sendrast` (never `../sbx-common` — both generate `sbx-skills-source`, a collision — and never `sbx-common-phase1`); the 4 divergent skill files are NOT byte-pinned; the 4 byte-copies diff clean against sbx-common; the overlay's SHA256SUMS self-verifies; the configMapGenerator is checked by name, no-hash and count. - **A non-empty-output assertion** (security finding): a phase-1 run that aborts under `set -u` with empty output now FAILS instead of reading green. - `sbx-common-sendrast/kustomization.yaml`: comment-only count corrections ("three" → four divergent files; "five" → four byte-copies + per-directory SHA256SUMS). ### Evidence (builder, mocks/fixtures only) - a: the contract on the real tree → green on the C6 rows. - b: sbx-sendrast without `../sbx-common-sendrast` → RED. c: sbx-sendrast pulling plain `../sbx-common` (+ render differs) → RED. c2: both listed (kustomize collision) → RED. - d: **old harness on an aborted run = green/empty; new harness = RED "no PHASE1 receipt".** d2: wrong check count → RED. - Full suite on mgmt: phase 1's only remaining red is `loader-skills=0`, which is environmental (no pi package installed on mgmt); it is expected green in CI/sandbox.
IR-20261112: fix(gits-sbx-epic-test): phase 1 guards the C6 overlay, not the pre-C6 shape
All checks were successful
CI Review / receiver-test (pull_request) Successful in 6s
Details
CI Review / helm-validate (pull_request) Successful in 9s
Details
CI Review / runner-manifest-test (pull_request) Successful in 10s
Details
Lint & Validate / shellcheck (pull_request) Successful in 8s
Details
CI Review / alert-receiver-test (pull_request) Successful in 20s
Details
Lint & Validate / yaml-lint (pull_request) Successful in 21s
Details
CI Review / record-sql-test (pull_request) Successful in 1m13s
Details
Lint & Validate / terraform-validate (pull_request) Successful in 1m56s
Details
CI Review / cockpit-test (pull_request) Successful in 2m38s
Details
CI Review / cockpit-e2e (pull_request) Successful in 2m39s
Details
CI Review / dispatcher-test (pull_request) Successful in 3m34s
Details
016a18cdca 
Phase 1 was RED on an UNMUTATED origin/live tree, so every phase-1 mutation row
proved nothing: the guard, the defect it reports and the proof all came from the
same broken baseline.

THE DEFECT (f1's 4a finding, 2026-11-12 13:52:35Z). scripts/gits-sbx-epic-test.sh
(p1_check, line 11940 on 2d837e9b) required `  - ../sbx-common` in
core/manifests/apps/sbx-sendrast/kustomization.yaml. Since a2754055 (11-10,
"Sendrast-scoped skills overlay sbx-common-sendrast (C6, U4/U5)") that file lists
`  - ../sbx-common-sendrast` BY DESIGN, so the guard was pinning the shape C6
deliberately replaced. The overlay is the intended design; the guard moves.

WHAT IT ASSERTS NOW (homelab-a9's contract, owner of sbx-sendrast, checked on live
2d837e9b, history a2754055 -> 9c692be3; these facts override the files' own
comments, whose counts are off):

  * sbx-sendrast lists ONLY `  - ../sbx-common-sendrast`: NOT `../sbx-common`
    (the shared component and the overlay both generate ConfigMap
    `sbx-skills-source` with `disableNameSuffixHash: true`, so listing both is a
    kustomize collision — measured, see the PR body) and NOT `sbx-common-phase1`
    (Phase 1 is gits+lab's; Jesus's skills come last).
  * the FOUR divergent files (epic-run.SKILL.md, supervisor-epica.SKILL.md,
    juez.SKILL.md, supervisor-epica.espera-orq.sh) are NOT byte-pinned: the
    method changes are what edits them.
  * the FOUR byte-copies of ../sbx-common (subagents.json, extensions.list,
    intencion.SKILL.md, hipervisor.SKILL.md) each `cmp` clean against sbx-common.
  * the overlay's own SHA256SUMS verifies the overlay's OWN files
    (`sha256sum -c` in that directory), not sbx-common's.
  * the overlay's configMapGenerator: name `sbx-skills-source`,
    `disableNameSuffixHash: true` under `options:`, NINE files — name, no-hash
    flag and COUNT, not the exact list.
  * gits and lab are untouched: their two assertions and the
    "sbx-common IS NOT TOUCHED" diff are the same lines as before. sbx-common is
    NOT edited for any other sandbox (El Director's condition, quoted at the
    overlay's line 48).

Three new mutations bite on that contract: sendrast stops pulling the overlay,
sendrast goes back to the raw shared component, and the overlay's generator loses
one of its nine files.

AND THE RECEIPT (f1 via 4a, 14:10:50Z). p1_check runs inside `$( … )` under
`set -u`, so ONE unset variable aborts the command substitution; the abort prints
NOTHING, and empty output is exactly what "the tree is fine" looks like. Measured
on this build: the dead-worker harness reported GREEN for a check that died before
its first assertion. So p1_check now ends by printing
`PHASE1 checks=<n> fail=<m>`, and the new p1_run requires the receipt to exist, to
name the expected number of checkpoints (P1_CHECKS_EXPECTED, the number of
`p1n=$((p1n + 1))` section markers in the function) and to agree with the failure
tokens it printed. No receipt, a truncated run and a lying receipt are all RED.

The two comments in core/manifests/apps/sbx-common-sendrast/kustomization.yaml are
the only other change, comments only: "three" -> four divergences (9c692be3 added
supervisor-epica.espera-orq.sh) and "five" -> four byte-copies + per-directory
SHA256SUMS. No manifest content moves; the sendrast render is unchanged.

Lab-Run: IR-20261112-phase1guard
All checks were successful
CI Review / receiver-test (pull_request) Successful in 6s
Details
CI Review / helm-validate (pull_request) Successful in 9s
Required
Details
CI Review / runner-manifest-test (pull_request) Successful in 10s
Details
Lint & Validate / shellcheck (pull_request) Successful in 8s
Required
Details
CI Review / alert-receiver-test (pull_request) Successful in 20s
Details
Lint & Validate / yaml-lint (pull_request) Successful in 21s
Required
Details
CI Review / record-sql-test (pull_request) Successful in 1m13s
Details
Lint & Validate / terraform-validate (pull_request) Successful in 1m56s
Required
Details
CI Review / cockpit-test (pull_request) Successful in 2m38s
Details
CI Review / cockpit-e2e (pull_request) Successful in 2m39s
Details
CI Review / dispatcher-test (pull_request) Successful in 3m34s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin ld/IR-20261112-phase1guard:ld/IR-20261112-phase1guard
git switch ld/IR-20261112-phase1guard
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
operator-review

Requires human operator review before merge — dangerous class (RBAC, secrets, network policy, Terraform) or explicitly gated. Never auto-merge.

No labels
operator-review
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Homelab/infra-core!966
No description provided.