2026-08-05 19:48:04 +00:00
|
|
|
### Added
|
|
|
|
|
|
|
|
|
|
- `docs/RUNNER-PROBES.md` documents the standing runner-probe venue,
|
|
|
|
|
`heavy-duty/ceremony-runner-probe` — the place runner-only facts are measured
|
|
|
|
|
on demand, ruled as option A by the operator (#202).
|
|
|
|
|
|
|
|
|
|
- `drills/README.md` cross-links it beside the disposal rule, so the exception
|
|
|
|
|
is visible where the dangerous habit lives (#202).
|
|
|
|
|
|
|
|
|
|
- The runbook states that the drill disposal rule does **not** apply to it.
|
|
|
|
|
Archiving it defeats its purpose, and that is exactly how the three existing
|
|
|
|
|
drill repos each became unavailable (#202).
|
|
|
|
|
|
|
|
|
|
- It records that a probe must run as an Actions job under the workflow token:
|
|
|
|
|
the same call answers 500 there and 204 under a PAT, so a probe run any other
|
|
|
|
|
way produces a confident wrong answer (#202).
|
|
|
|
|
|
|
|
|
|
- Creating the repo is recorded as the operator's step, measured rather than
|
|
|
|
|
assumed: a fleet identity gets 403 on org repo creation and 201 in its own
|
|
|
|
|
namespace (#202).
|
|
|
|
|
|
|
|
|
|
- It carries an executable two-layer arming procedure: an immutable candidate
|
|
|
|
|
code SHA and an armed workflow commit on top of it. A single layer is
|
|
|
|
|
self-referential — rewriting a workflow makes a new commit, and a commit
|
|
|
|
|
cannot contain its own object ID (#202).
|
|
|
|
|
|
|
|
|
|
- Callers are pinned by layer: composite actions to the candidate code SHA,
|
|
|
|
|
reusable workflows to the armed SHA, which is the only revision whose inner
|
|
|
|
|
checkout points at the fork (#202).
|
|
|
|
|
|
|
|
|
|
- The arming gate asserts what each carrier IS, not only that the old literal
|
|
|
|
|
is gone: every `repository:` equals the fork, every `CEREMONY_SELF_REF` value
|
|
|
|
|
equal the candidate code SHA, and callers match the layer they belong to
|
|
|
|
|
(#202).
|
|
|
|
|
|
|
|
|
|
- It enumerates the carriers from the tree rather than encoding a count, and
|
|
|
|
|
distinguishes ceremony's internal self-checkouts from the consumer checkouts
|
|
|
|
|
that must stay `${{ github.repository }}` (#202).
|
|
|
|
|
|
|
|
|
|
- Both published snippets are ShellCheck-clean when extracted and linted
|
|
|
|
|
directly, not merely as part of the repository sweep (#202).
|
|
|
|
|
|
|
|
|
|
- The checker validates the MANIFEST against the target it was given, so a
|
|
|
|
|
manifest that describes a wrong arming consistently — wrong fork, or the
|
|
|
|
|
armed SHA where the candidate belongs — refuses instead of matching a tree
|
|
|
|
|
rewritten to the same wrong value (#202).
|
|
|
|
|
|
|
|
|
|
- The manifest is generated from the PRE-arming tree, which is the only order
|
|
|
|
|
that enumerates the carriers that must change (#202).
|
|
|
|
|
|
|
|
|
|
- Both published snippets were driven against a constructed candidate/probe
|
|
|
|
|
pair: deletion, both role swaps, wrong owner, wrong
|
|
|
|
|
SHA, wrong path, a deleted caller class and an extra carrier all refuse, and
|
|
|
|
|
the armed control passes (#202).
|
|
|
|
|
|
|
|
|
|
- The manifest records complete caller coordinates, so a path swapped under the
|
|
|
|
|
right owner and SHA is caught (#202).
|
|
|
|
|
|
|
|
|
|
- Generator and checker share one domain — ceremony callers — so a third-party
|
|
|
|
|
`actions/checkout` is neither manifested nor reported as unrecognised (#202).
|
|
|
|
|
|
|
|
|
|
- Probe results are written to an issue in the probe repo and carried to the
|
|
|
|
|
ceremony issue by a human, so the probe holds no path that can write to the
|
|
|
|
|
live board (#202).
|
|
|
|
|
|
2026-08-05 19:40:56 +00:00
|
|
|
### Changed
|
docs(drills): the standing runner-probe venue, and why it is not a drill (#202)
@andres ruled option A (#5631): one standing never-archived repo. This is the
runbook half.
The distinction the document exists to make: a drill is disposable by design
and ends with the builder archiving it. This venue is the opposite — it exists
so that runner-only facts can be measured on demand, and archiving it defeats
the purpose. That is not hypothetical: all three drill repos were archived
correctly, by the rule, and each then had to be un-archived or replaced. The
request came three times in two days across #192 and #198 and never became
anything.
What the runbook pins, all of it measured rather than asserted:
* a probe MUST run as an Actions job under ${{ github.token }} — the same
DELETE answers 500 there and 204 under a PAT, so a probe run any other way
produces a confident wrong answer;
* probe results are written into the forge, not left in a job log, because
logs age out and #192's run 701 survived only because it wrote into an
issue;
* no probe touches ceremony's own board — the venue exists so the live board
is not the fixture;
* the three probes it already owes (#192's live label lift, #205's dispatch
measurement, a 0.6.0 consumer exercise after #198).
STANDING THE REPO UP IS THE OPERATOR'S STEP, and this is the part I could not
do rather than the part I chose not to. Measured today with this identity:
POST /api/v1/orgs/heavy-duty/repos -> 403 not allowed in organization
POST /api/v1/user/repos -> 201 personal namespace only
Same shape as the drill delete: a deliberate boundary, not a misconfiguration.
The runbook says so, says not to retry it, and says not to work around it by
using a personal namespace where the org's runner and secrets do not reach.
test/run.sh 22/22, shellcheck 0.10.0, actionlint, self-ref all clean.
Refs #202
2026-08-05 13:16:20 +00:00
|
|
|
|
2026-08-05 19:48:04 +00:00
|
|
|
- `docs/RUNNER-PROBES.md` records the venue's first delivered drills — the
|
2026-08-05 19:40:56 +00:00
|
|
|
#192 asymmetry re-observed on demand under the workflow token, the dispatch
|
|
|
|
|
route's 204 under both identities, and #215's boundary finding — each with
|
|
|
|
|
the probe-issue URL it is recorded in (#202).
|
docs(drills): the standing runner-probe venue, and why it is not a drill (#202)
@andres ruled option A (#5631): one standing never-archived repo. This is the
runbook half.
The distinction the document exists to make: a drill is disposable by design
and ends with the builder archiving it. This venue is the opposite — it exists
so that runner-only facts can be measured on demand, and archiving it defeats
the purpose. That is not hypothetical: all three drill repos were archived
correctly, by the rule, and each then had to be un-archived or replaced. The
request came three times in two days across #192 and #198 and never became
anything.
What the runbook pins, all of it measured rather than asserted:
* a probe MUST run as an Actions job under ${{ github.token }} — the same
DELETE answers 500 there and 204 under a PAT, so a probe run any other way
produces a confident wrong answer;
* probe results are written into the forge, not left in a job log, because
logs age out and #192's run 701 survived only because it wrote into an
issue;
* no probe touches ceremony's own board — the venue exists so the live board
is not the fixture;
* the three probes it already owes (#192's live label lift, #205's dispatch
measurement, a 0.6.0 consumer exercise after #198).
STANDING THE REPO UP IS THE OPERATOR'S STEP, and this is the part I could not
do rather than the part I chose not to. Measured today with this identity:
POST /api/v1/orgs/heavy-duty/repos -> 403 not allowed in organization
POST /api/v1/user/repos -> 201 personal namespace only
Same shape as the drill delete: a deliberate boundary, not a misconfiguration.
The runbook says so, says not to retry it, and says not to work around it by
using a personal namespace where the org's runner and secrets do not reach.
test/run.sh 22/22, shellcheck 0.10.0, actionlint, self-ref all clean.
Refs #202
2026-08-05 13:16:20 +00:00
|
|
|
|
2026-08-05 19:40:56 +00:00
|
|
|
- Two venue lessons join the runbook where the next probe author will look:
|
|
|
|
|
findings must be written to issues because the venue's log route 404s for
|
2026-08-05 19:48:04 +00:00
|
|
|
non-admin reads, and report content sent to the forge must never contain a
|
|
|
|
|
credential expression or value (#202).
|
