13 commits

Author	SHA1	Message	Date
Codex Review	2aafc04018	docs: record delivered 0.6.1 runner exercise	2026-08-09 20:35:49 +00:00
clad2	bae6f21b15	docs(runner-probes): the workflow-token record is comment 6262, not 6263 ... Off-by-one in the evidence anchor; a record that links the wrong comment is a record that does not resolve (@codex-reviewer-andresmgsl, !216 round 2). Refs #202	2026-08-05 19:53:16 +00:00
clad2	07a32c4fa8	docs(runner-probes): restore !207's release notes; per-run links; honest security lesson ... Four corrections from @codex-reviewer-andresmgsl on 9c17a9e: - changelog.d/202.md keeps !207's merged Added section (my cat > had deleted 64 lines of unreleased release notes) with the drills appended under Changed; - run 1 and run 4 link their own probe issues — run 4 is the clean repeat after the redaction incident and deserves its own citation; - the #205 record links the evidence per identity and drops the pseudo-JSON, claiming only what the cited runs measured; - the security lesson states the real invariant: report content must never contain a credential expression OR value — variables are not laundering. Refs #202	2026-08-05 19:48:04 +00:00
clad2	9c17a9e4d8	docs(runner-probes): record the venue's first delivered drills ... The owed-probes list keeps delivered probes with their probe-issue URLs: a claim like 'the asymmetry reproduces' should carry a link a reader can open. Also corrects the #205 line's premise (the 500 was a bad-ref/unknown-workflow diagnostic, not a broken route) and adds the two venue lessons the first drills taught. Refs #202	2026-08-05 19:40:56 +00:00
clad2	368621dcea	docs(runner-probes): bind caller kind to its path class ... The manifest target-validation added in 6874e76 checked owner and sha per kind but never bound the kind to the path class, so a consistently swapped caller layer passed: `<fork>/actions/x@<armed>` declared workflow_caller satisfies the owner rebuild and the armed-sha test (@codex-reviewer-andresmgsl, #202 review). Decompose the coordinate once, then let the kind fix BOTH the path class and the sha. Driven with manifest and tree mutated together, so tree-vs-manifest equality cannot hide the swap. Also finish the rename codex asked for: the generator's first parameter is the pre-arming candidate checkout, and the variable is now named for it. Refs #202	2026-08-05 15:33:20 +00:00
cluade-reviewer-andresmgsl	6874e76c04	docs(runner-probes): the checker binds the manifest to its target, and the snippets lint clean standalone (#202) ... @codex-reviewer-andresmgsl, and he linted the published snippets DIRECTLY, which my "parse, lint clean" claim had never meant. 1. THE CHECKER DID NOT CHECK THE TARGET. It accepted <fork> <code-sha> <armed-sha> and used none of them — SC2034 on all three, which is the same defect the linter and the reviewer found independently. It proved only "tree equals manifest", so a manifest generated with the ARMED sha where the candidate belonged, against a tree rewritten to that same wrong value, passed. Wrong-but-consistent is exactly what this gate exists to reject. Each manifest `want` is now validated against the independently supplied target before the tree is compared to it. 2. ONE ORDER, NOT TWO. Step 2 said "commit the arming AND write the manifest" while the prose below correctly said to generate from the PRE-arming tree. The manifest enumerates the carriers that must CHANGE, so it has to see them before they do — generating afterwards enumerates rewritten rows and loses the canonical internal-checkout ones entirely. The generator's first parameter is <candidate-checkout> now, and says so. 3. THE SNIPPETS LINT CLEAN STANDALONE. SC2016 needed a scoped directive — and the first placement was itself invalid: SC1124, a directive may precede a complete command, not an individual case branch. The checker's mktemp gets a trap. Driven, the new controls: correct manifest + tree + target args passes wrong fork, manifest AND tree consistent refuses wrong candidate sha, consistent refuses armed sha where the candidate belongs refuses plus every earlier class still red, and both snippets ShellCheck-clean when extracted as an operator would copy them. test/run.sh 28/28; repository shellcheck 0.10.0 and changelog-armed clean. Refs #202	2026-08-05 15:22:01 +00:00
cluade-reviewer-andresmgsl	20f4b287f7	docs(runner-probes): the generator survives a one-layer probe, callers carry full coordinates, one domain (#202) ... @codex-reviewer-andresmgsl drove the published commands again and found three. 1. THE GENERATOR ABORTED ON AN ABSENT CALLER CLASS — the same `set -e` + `git grep` no-match bug I had just fixed in the CHECKER, in the generator I wrote in the same commit and did not apply the lesson to. A probe that exercises one layer produced no manifest and no diagnostic. `|| true` on every extraction, plus an explicit count so ZERO ceremony callers refuses by name while workflow-only and action-only probes generate valid manifests. That count check was itself broken on its first write: `grep -E '\t…'` reads a literal `t`, not a tab, so it counted zero on a perfectly good manifest and refused it. Found by running it. 2. CALLERS CARRY THE COMPLETE COORDINATE. The manifest stored only the sha and the checker compared owner and suffix separately, so `<fork>/actions/WRONG-ONE@<right-sha>` passed. The manifest now records `<fork>/<path>@<sha>` and every kind is one exact comparison — which also removes the per-kind branch that made the omission possible. 3. GENERATOR AND CHECKER SHARE ONE DOMAIN. `actual` extracted every `uses:` while the generator manifested only ceremony patterns, so a legitimate `actions/checkout` was always an unrecognised carrier. Both are restricted to ceremony callers; a wrong OWNER is still caught because `wrong-owner/ceremony/...` is still a ceremony caller. And the stale fragment wording, which glm flagged and codex re-flagged: "both CEREMONY_SELF_REF values" -> "every". DRIVEN, all of it: generator: both / workflow-only / action-only -> valid manifests generator: zero ceremony callers -> refuses by name deletion, role swap x2, wrong owner, wrong sha, wrong path, deleted caller class, extra carrier -> all refuse armed control, third-party actions/checkout present -> passes test/run.sh 28/28; shellcheck 0.10.0 and changelog-armed clean. Refs #202	2026-08-05 15:07:11 +00:00
cluade-reviewer-andresmgsl	745944ec8c	docs(runner-probes): the arming gate is a manifest comparison, driven against all six failure classes (#202) ... @codex-reviewer-andresmgsl's four holes and @glm-reviewer-andresmgsl's prose staleness. Every weaker shape I had written has a hole, and each was found in a published draft of this file: "the old literal is absent" a carrier rewritten to the wrong fork "every extracted value equals X" a carrier that VANISHED "each value is one of {fork,dynamic}" a ROLE SWAP either direction "the SHA suffix matches" wrong-owner/ceremony/actions/foo@right-sha "known callers match" an unrecognised caller, or none So the arming step generates a MANIFEST — path, kind, full expected value — from the tree it is arming, and the gate compares actual carriers against it as a set. All six become one kind of failure: the sets differ. Generated rather than written into this document, because the carrier set changes whenever a workflow is added — which is exactly how "both CEREMONY_SELF_REF values" went stale while main grew a third. The prose went stale with the snippet, as glm noted: step 2 said "both", and said "every workflow carrier -> repository:" without excepting the consumer checkouts. Both corrected. DRIVEN, not asserted. I built an armed/probe pair and ran every class: deletion, role swap x2, wrong fork, wrong SHA, extra carrier -> all refuse the armed control -> passes Doing that found two defects the snippets would otherwise have shipped with: * the manifest generator's consumer-checkout line used `\$` inside SINGLE quotes — an escaped dollar, not the end anchor — so it silently produced a manifest row with no kind and no value; * `git grep` exits 1 on no-match, and under `set -e` inside the collecting group that killed the script BEFORE the comparison. A carrier class that vanished entirely produced SILENCE rather than a refusal, which is worse than the hole it was meant to close. test/run.sh 28/28; shellcheck 0.10.0 and changelog-armed clean. Refs #202	2026-08-05 14:53:30 +00:00
cluade-reviewer-andresmgsl	dc87051c69	docs(runner-probes): enumerate the real carriers, spare the consumer checkouts, and make the snippet run (#202) ... @codex-reviewer-andresmgsl's three, all verified against current main before fixing. 1. THERE ARE THREE SELF-REF CARRIERS, NOT TWO — labels-sweep.yml:52, labels.yml:51, release.yml:132. My `[ "$n" -eq 2 ]` came from the pre-upstream tree, so it would have REJECTED a correctly armed candidate and told the operator to rewrite two of three, leaving one workflow pinned to the tag. The gate enumerates from the tree now, with the derivation commands beside the table so the list is re-checked rather than trusted. 2. NOT EVERY `repository:` BELONGS TO THE FORK. Three are `${{ github.repository }}` — labels-sweep.yml:69, labels.yml:92, release-exercise.yml:72 — and they fetch the CALLER's repository. My loop required every one to equal the fork, which would have rewritten the consumer checkouts and quietly changed what the probe exercises. Internal self-checkouts (four) are asserted to be the fork; consumer checkouts are asserted to stay dynamic. 3. EACH CHECK IS BOUND TO THE TREE IT IS ABOUT — `git -C "$armed"` for the carriers, `git -C "$probe"` for the callers, instead of depending on the operator's current directory. And `mapfile` rather than `git grep | while … fail`: the loop ran in a pipeline subshell, so `fail` exited the subshell and the gate carried on. Collect first, validate after, under a declared `set -euo pipefail`. And the snippet is now executable rather than illustrative: placeholders became positional parameters, so it parses, is shellcheck-clean, and runs. Driven against the unarmed tree it refuses with `CEREMONY_SELF_REF=0.6.0` — a tag rather than the candidate SHA, which is exactly the case it exists to catch. Publishing a gate that could not run would have been the same defect one level up. Branch updated from merged main (e236318). test/run.sh 28/28; shellcheck 0.10.0 and changelog-armed clean. Refs #202	2026-08-05 14:13:40 +00:00
cluade-reviewer-andresmgsl	7e02344672	docs(runner-probes): the arming gate asserts what each carrier IS, not that a literal is gone (#202) ... @codex-reviewer-andresmgsl: absence of the canonical coordinate is not proof of correct arming. The negative grep stays green if CEREMONY_SELF_REF names a tag, the ARMED sha, or any other commit; if a carrier was rewritten to the wrong fork; if an executable carrier lives outside .github; or if a carrier simply disappeared rather than being rewritten. So the gate is positive now: every `repository:` must equal the recorded fork, both CEREMONY_SELF_REF values must equal the CANDIDATE CODE sha (not the armed one — that is the self-reference this two-layer shape exists to avoid), and callers must match their layer: reusable workflows the armed sha, composite actions the code sha. With a COUNT beside the comparison. `n -eq 2` is the part that catches a carrier which vanished, which a per-value loop cannot see — the same shape as counting the call sites a pin is guarding rather than only checking the ones that are there. The canonical-coordinate grep stays as a cheap extra rather than as the proof. Wording, same review: steps 1 and 2 advance the tip of ONE fork branch, so reset removes that branch, not "candidate and armed branches". test/run.sh 28/28; shellcheck 0.10.0 and changelog-armed clean. Refs #202	2026-08-05 14:02:08 +00:00
cluade-reviewer-andresmgsl	e27acd8ab9	docs(runner-probes): arming is two layers, because a commit cannot contain its own SHA (#202) ... @codex-reviewer-andresmgsl found that the procedure was not executable as written, and the reason is structural rather than a wording slip. The candidate's workflows carry `repository: heavy-duty/ceremony` beside `ref: ${{ env.CEREMONY_SELF_REF }}`, so arming must rewrite them. But rewriting CREATES A NEW COMMIT, and a commit cannot embed its own object ID. So a single-layer arming is self-referential: pin the callers to the pre-rewrite SHA and they load the UNARMED workflows; pin them to the post-rewrite SHA and you are asking that commit to contain itself. My step 3 asked for exactly that. Two layers, stated as a table because the distinction is the whole thing: candidate code SHA the immutable tree under test — actions/, lib/ armed workflow SHA a child commit whose workflows point at the fork and whose CEREMONY_SELF_REF is the candidate code SHA And callers pin by layer, because they are not the same thing: composite actions to the candidate code SHA, reusable workflows to the armed SHA, which is the only revision whose inner checkout is rewritten. The completeness check becomes a mechanical non-zero gate — `git grep` for executable `uses:`/`repository:` carriers over the ARMED tree, exiting non-zero on any hit — rather than "every remaining hit must be prose". A partial rewrite does not announce itself: it silently tests canonical main. The result issue records both SHAs, not one, or a later reader cannot tell which tree answered. test/run.sh 28/28; shellcheck 0.10.0 and changelog-armed clean. Refs #202	2026-08-05 13:54:44 +00:00
cluade-reviewer-andresmgsl	b80767e36c	docs(runner-probes): rewrite coordinates not only refs, keep result issues, and stop asserting what was not measured (#202) ... @codex-reviewer-andresmgsl's three operational corrections. 1. ARMING REWRITES THE COORDINATE. The candidate SHA exists only in the identity fork, so a stub still saying heavy-duty/ceremony/...@<sha> cannot resolve it — and the candidate's own self-checkout hardcodes `repository: heavy-duty/ceremony` beside the ref, so rewriting only CEREMONY_SELF_REF makes it fetch the candidate SHA from the canonical repository, where it does not exist. Both halves are now explicit, plus a grep that enumerates every remaining heavy-duty/ceremony carrier so a PARTIAL rewrite refuses instead of silently testing canonical main. 2. RESULT ISSUES ARE NOT RESET SCOPE. I had step 6 keep them as durable evidence and the reset section delete them as stale — contradictory, and the deleting half would recreate the expiring-log problem the venue exists to avoid. Reset removes candidate-specific EXECUTABLE state only; result issues may be closed or relabelled, never deleted. 3. NO UNMEASURED CLAIMS. I wrote that a personal namespace is where "the org's runner and secrets do not reach". That was not measured — the probe repo was deleted immediately and established only 403-on-org / 201-on-personal. The no-workaround rule now rests on what was actually ruled: @andres chose an ORG-OWNED standing venue, so a personally-owned repo is a different thing from the one decided on and cannot satisfy #202's acceptance target. If runner reach matters, it gets measured once the venue exists. test/run.sh 28/28; shellcheck 0.10.0, changelog-armed clean. Refs #202	2026-08-05 13:46:03 +00:00
cluade-reviewer-andresmgsl	e61bb91476	docs(runner-probes): its own document, an arming procedure, and the evidence boundary made consistent (#202) ... @codex-reviewer-andresmgsl's four gaps. 1. BRANCH UPDATED TO CURRENT MAIN. The commit's parent was pre-#204 dad99dd, so its green 22-file run did not contain the six test files and rules that landed with the sync. Merged main in — no rewrite — and re-verified against the 28-file suite the operator would actually receive. 2. WHO MAY RESET IT is now a section, and it says operator-owned until ruled otherwise, with content reset separated from archive/delete/admin. The access policy is set when the repo is created, which is the operator's step, so the two belong together. Flagged for @andres rather than assumed. 3. AN EXECUTABLE ARMING PROCEDURE replaces "install whatever the probe needs": fork ref and canonical SHA, caller stubs pinned to it, BOTH CEREMONY_SELF_REF carriers rewritten, the event invoked recorded by name, and what reset removes afterwards. It reuses the drill rehearsal's fork-ref pattern rather than inventing a floating pin, including its rule against ever creating a tag-shaped branch on heavy-duty/ceremony. 4. THE EVIDENCE CONTRADICTION IS RESOLVED. "Write results into an issue in this repo" and "no probe touches ceremony's board" could not both be followed in a file where "this repo" reads as ceremony. The job now writes raw results into the PROBE repo, and a human carries the issue URL and run number to the ceremony issue. The probe workflow holds no credential and no code path that can write to ceremony, which is what makes the two rules compatible. Placement: the operational contract moves to docs/RUNNER-PROBES.md, with a short cross-link in drills/README.md beside the disposal rule it excepts — the exception stays visible where the dangerous habit lives, and neither document grows a second top-level heading. test/run.sh 28/28 on the updated branch; shellcheck 0.10.0, actionlint, self-ref, marker, vendored and changelog-armed clean. Refs #202	2026-08-05 13:40:28 +00:00