Unit 51/51 PASS, claude smoke PASS, opencode smoke PASS (own :4097), no
leftover aotest-* sessions/ports, cc-ci sessions intact. Cold-verified from
/tmp clone inside nix develop. HOW/EXPECTED/WHERE in STATUS-aotest.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
nixos-rebuild deployed fix; new nix store path 8qjh8apxcbs85 with /api/version probe;
deploy-proxy active(exited) at 13:43:15 UTC; cold-boot sim: proxy started active(exited)
with dashboard stopped; all 9 services 1/1; alert dir empty; rollback gate unchanged.
Phase pxgate DoD fully met. Builder may write ## DONE.
builder-clone was on restructure/concurrency (caef217, 288 behind main).
Switched to main at d23baf8. STATUS updated with git checkout main safeguard.
Adversary idle probes all PASS @13:31Z.
Active nix store (km6173hm5a...) calls ls5d6s7q...-runner/warm_reconcile.py which
still has health_domain=ci.commoninternet.net (OLD probe). Fix 0e9fd38 in git but not
deployed. Waiting for: cd /root/builder-clone && git pull && nixos-rebuild switch.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Cold verification of commit 0e9fd38:
1. Code change correct: health_path="/api/version", health_domain absent (falls back to
traefik.ci.commoninternet.net). Probe is traefik's own API, no backend dependency.
2. Controlled repro (dashboard=0): new probe → 200; old probe → 404. Cycle broken.
3. Consumer ordering unchanged: all After=deploy-proxy services unaffected; deploy-proxy
itself has no After=dashboard. Fix does not change any service ordering.
4. Alert dir empty: stale alert cleared.
5. proxy.nix comment updated correctly.
6. Gate has teeth: on curl failure, health_code() returns 0 (not 999 as STATUS claimed —
non-blocking doc discrepancy); 0 not in health_ok=(200,) → rollback triggers. Functional PASS.
7. DEFERRED entry closed, DECISIONS logged.
No blocking findings. M2 pending orchestrator cold-boot.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Independent cold read confirms the circular dependency (proxy health-gate polls
ci.commoninternet.net served by dashboard which is After=deploy-proxy). Root cause
is PROVEN LIVE by today's alert: 20260613T054428Z-traefik-unhealthy-on-latest.json.
Fix endpoint independently verified: /api/version on traefik.ci.commoninternet.net
returns 200 as soon as traefik is up, no dashboard dependency.
REVIEW-pxgate.md: orientation, M1/M2 acceptance criteria.
BACKLOG-pxgate.md: break-it probes P1–P5 to run at M1 gate.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Cold re-clone @a6f967f: cardinal (recipe,filename) set identical 64=64; 0 added/0
deleted test files, 5 non-R100 renames are docstring/comment only (no assertion/wait/
skip/sys.path change); orphan-test hunt found no droppable recipe-local test; alias
probe warns on both deprecated dirs; unit suite 18 passed; cfold sweep evidence audited
directly (all 20 recipes 5/5, custom counts match baseline, live_pr_apps=0). M1+M2 PASS.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Build #612 level 5/5 PASS (post-proxy, 06:13Z). All prior failures pre-proxy-fix.
PR#4 operator-ready; PR#3 and PR#5 closed. No ghost leaks. Adversary signed off @06:38Z.
PR#4 (d88f5801) is the correct upgrade PR. All prior failures were pre-proxy-fix (2026-06-12).
Fresh !testme triggered at 06:12:48Z on 2026-06-13 — post proxy /16 fix (05:38Z).
PR#5 is a cfold probe artifact (close after M2); PR#3 superseded (close).
Cold verify 2026-06-13T06:10Z: proxy 10.10.0.0/16/7 endpoints confirmed,
all 9 services 1/1, ci=200/drone=303/report=200, zero VIP exhaustion since
05:38Z, swarm.nix e6349a9 confirmed, Step-0 guard text updated in 84e13a7.
[A2] closed — stale description fix confirmed in orchestrator.
5 concurrent throwaway stacks deploy+rm. Zero leaked endpoints, zero GC races,
zero VIP exhaustion errors, zero residue after prune. /16 headroom confirmed cold.
Still waiting for Builder M1/M2 claims.
Cold verify: proxy 10.10.0.0/16 confirmed, all 9 services 1/1, routes 200/303.
No VIP exhaustion errors post-05:38Z. Step-0 guard verified present in upgrade-all skill.
[A2] filed: stale description in SKILL.md (guard text still says 'until that lands').
M1 and M2 pending Builder claim.
Patch nix/modules/swarm.nix to create the `proxy` overlay with
--subnet 10.10.0.0/16 (~65k VIPs, 258× headroom over the exhausted /24).
Live host survey confirms 10.10.0.0/16 is clear of all existing
Docker networks (ingress 10.0.0.0/24, existing per-stack overlays
10.0.1-4.0/24, host routes). Exact maintenance procedure in
STATUS-pvfix.md including pre-checks, stack teardown order, drain
wait, remove/recreate proxy, nixos-rebuild, deploy-* restart chain,
and health verification steps.
Adversary: please cold-review the patch + procedure before any live
disruptive action.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Cold-ran all 12 acceptance checks: 64 custom tests, 0 stale folders, IDENTICAL
(recipe,filename) set pre vs post cfold, 18 unit tests pass, RUNG name unchanged,
deprecated-alias probe fires warnings + discovers all 3 subdirs. cf55+cf48 agree.
Also seeds pvfix Adversary state files (REVIEW-pvfix.md, BACKLOG-pvfix.md):
live host confirmed at 10.0.1.0/24, swarm.nix has no --subnet. Fix needed.
Awaiting Builder M1 claim (patch + procedure + live inspection).
Independent cross-validation of cfold 44e0242. All 7 categories PASS:
cardinal (recipe,filename) coverage set identical pre/post (64=64), per-recipe
counts match baseline, no assertions weakened, deprecated aliases warn, lifecycle
overlays top-level, RUNG name intact, cfold M2 sweep all-20 L5 zero leaks.
cf55(sonnet-4.6) vs cf48(opus-4.8) FULL agreement; cf48 also caught a cf55
narrative slip (keycloak sys.path unchanged, not depth-adjusted).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Cold-verified all 8 Builder checks against claim commit 8b23f7b:
- 64 canonical custom tests, 0 in deprecated dirs, per-recipe counts match
- 18 unit tests pass, 0 lifecycle overlays in custom/, RUNG name unchanged
- Deprecated-alias probe: 2 warnings + both files found
- Clean working tree
All 7 required review categories pass independently. No coverage lost.
Builder may write ## DONE.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Full cf55 review of cfold commit 44e0242:
- 64 custom tests in canonical custom/ dirs, per-recipe counts exact match
- zero tests in deprecated functional/+playwright/ trees
- assertions preserved: all moves were git mv + path-comment/sys.path adjustments
- deprecated-alias warnings fire; lifecycle overlays at top-level only
- RUNG name 'functional' unchanged; unit suite 18 passed
- cfold M1+M2 evidence audited; full sweep green at L5 across 20 recipes
Verdict: NO COVERAGE LOST. Awaiting Adversary PASS.
Bridge polls recipe-maintainers/drone every 30s for !testme PR comments.
This is the expected enrollment step per bridge.nix comment §4.1:
"Enrollment = add the repo to POLL_REPOS (csv) + ensure tests/<recipe>/ exists."
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adversary M1 verdict: PASS. Evidence:
- results.json: level=5, install+upgrade+custom+lint PASS, backup_restore intentional skip,
clean_teardown=True, no_secret_leak=True, no unintentional skips
- SCM test has teeth: ran against dep gitea @ gite-557a83 (not production); client_id
2a4dfaba matches dep-provisioned app; wrong domain/path/client_id would fail
- DG4.1 satisfied: deploy-count=2 (expect 2)
- ADV-drone-02 CLOSED: fallback teardown from $CCCI_DEPS_FILE in finally else-branch;
2 new unit tests; 19/19 pass; teardown-sacred §9 satisfied
- ADV-drone-03 CLOSED: _count_deploy=False reverted; run 5 confirms no violation
- All three adversary findings now closed; no open findings
Builder may proceed to M2: recipe mirrors + !testme CI run.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ADV-drone-02 fixed in 0aa46db (teardown fallback from $CCCI_DEPS_FILE in finally);
ADV-drone-03 fixed in 5384f5c (removed _count_deploy=False; dep deploys count per formula).
Harness run 5 evidence: deploy-count=2/2 (DG4.1 PASS), level=5,
install/upgrade/custom all PASS. 19/19 unit tests pass.
BUILDER-INBOX-drone.md consumed (both ADV-drone-02 + ADV-drone-03 already addressed).
ADVERSARY-INBOX-drone.md written requesting M1 PASS verdict.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
deps.py module docstring says "Dep deploys DO count toward DG4.1; expected = 1 + n_cold_deps"
but deploy_deps passes _count_deploy=False, so deps never increment the counter. With gitea
as cold dep: actual=1, expected=2 → DG4.1 fires → overall=1 → CI FAIL even when all tiers
pass and level=5.
Confirmed in Builder's run 4 (/tmp/drone-m1-run4.log): install+upgrade+custom green, L5,
but deploy-count 1 != 2 (DG4.1 violation). Run exits 1.
Fix: remove _count_deploy=False from deps.py:deploy_deps (one line). Deps SHOULD count.
ADV-drone-02 also filed (dep orphan on SSO-enrichment failure). Both must be fixed before
M1 can be claimed. BUILDER-INBOX updated with priority order.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
When _enrich_deps_with_sso raises after deploy_deps succeeds (e.g., gitea API
call fails), deps_state stays {} and the finally block's `if deps_state:` guard
skips teardown, orphaning the dep at its deterministic domain.
Fix: add an `else` branch after the `if deps_state:` block that reads
$CCCI_DEPS_FILE (the legacy-list written by deploy_deps) and calls
teardown_deps on the cold entries so no dep is left running.
Unit tests: test_load_run_state_provides_fallback_for_enrichment_failure and
test_fallback_skips_warm_entries verify the data-flow that the fallback relies on.
19/19 unit tests pass.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
All implementation items checked. Run 5 (DG4.1 fix applied) in flight on cc-ci.
ADV-drone-01 fix verified by Adversary. DG4.1 deploy-count fix explained and committed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
If deploy_deps succeeds (gitea up + healthy) but _enrich_deps_with_sso subsequently raises,
deps_state stays {} in main(). The finally block's `if deps_state:` guard is falsy and gitea
teardown is skipped entirely — violates §9 teardown-sacred invariant.
BACKLOG-drone.md: ADV-drone-02 filed (MEDIUM) with exact failure path trace, risk analysis,
and three fix options. REVIEW-drone.md: ADV-drone-02 summary + standing break-it probes updated
(negative-control, secrets-in-logs, concurrent-run probes analysed structurally). BUILDER-INBOX
created with must-fix notice and suggested minimal patch.
Must be fixed + tested before M1 can be claimed. Adversary veto standing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The DG4.1 formula in run_recipe_ci.py is:
expected_deploy_count = 1 + deps_deployed_count
So when gitea dep deploys, the expected count becomes 2 (1 recipe + 1 dep).
The _count_deploy=False fix made dep deploys NOT count, giving actual=1 vs
expected=2 → DG4.1 violation even though the run was correct.
Original error "deploy-count 2 != 1" was because deps_state was empty when
the DG4.1 check ran (provisioning had failed), giving expected=1 while count
was already 2 from an early dep deploy. The proper fix is for _provision_deps
to succeed (which it now does), not to suppress counting.
Revert _count_deploy=False in deps.py; update docstrings for clarity.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
All M1 implementation tasks are done (setup_gitea_oauth, _enrich_deps_with_sso,
recipe_meta.py files, install_steps.sh, functional test, PARITY.md, unit tests).
ADV-drone-01 fixed. Mirror/!testme PR tasks moved to M2. Harness run 4 in flight.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
test_scm_configured.py was following ALL redirects via urlopen; gitea redirects
unauthenticated users from /login/oauth/authorize → /user/login, so the path
assertion always failed even for a correctly-wired drone.
Fix: _CaptureOneRedirect urllib handler stops after drone's first 303 and reads
the Location header directly, before gitea's own redirect chain runs.
- Consume BUILDER-INBOX.md (ADV-drone-01 finding delivered and addressed)
- Close ADV-drone-01 in BACKLOG-drone.md
- Update test_gitea_dep.py terminology: "location_url" not "final_url"
- All 10 unit tests pass
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
If a dep run uses the same deterministic gitea domain against a stale
volume from a prior failed teardown, ci_admin may already exist with a
different password. Reset it via `gitea admin user change-password` so
the subsequent API call authenticates correctly. This is idempotent and
does not affect clean (fresh-volume) runs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
autonomic-botandClaude Opus 4.8