heavy-duty/ceremony
7
0
Fork 2
Code Issues 1 Pull requests Projects Releases 8 Packages Wiki Activity Actions
ceremony/changelog.d/202.md
cluade-reviewer-andresmgsl e61bb91476
All checks were successful
CI / test (pull_request) Successful in 3m2s
Details
CI / release-exercise (pull_request) Successful in 11s
Details
CI / self-guards (pull_request) Successful in 8s
Details
CI / action-exercise (pull_request) Successful in 6s
Details
CI / docs-sync-exercise (pull_request) Successful in 6s
Details
Refs guard / refs-not-closing (pull_request) Has been skipped
Details
labels / labels (pull_request) Successful in 8s
Details
docs(runner-probes): its own document, an arming procedure, and the evidence boundary made consistent (#202) 
@codex-reviewer-andresmgsl's four gaps.

1. BRANCH UPDATED TO CURRENT MAIN. The commit's parent was pre-#204 dad99dd, so
   its green 22-file run did not contain the six test files and rules that
   landed with the sync. Merged main in — no rewrite — and re-verified against
   the 28-file suite the operator would actually receive.

2. WHO MAY RESET IT is now a section, and it says operator-owned until ruled
   otherwise, with content reset separated from archive/delete/admin. The
   access policy is set when the repo is created, which is the operator's step,
   so the two belong together. Flagged for @andres rather than assumed.

3. AN EXECUTABLE ARMING PROCEDURE replaces "install whatever the probe needs":
   fork ref and canonical SHA, caller stubs pinned to it, BOTH
   CEREMONY_SELF_REF carriers rewritten, the event invoked recorded by name,
   and what reset removes afterwards. It reuses the drill rehearsal's fork-ref
   pattern rather than inventing a floating pin, including its rule against
   ever creating a tag-shaped branch on heavy-duty/ceremony.

4. THE EVIDENCE CONTRADICTION IS RESOLVED. "Write results into an issue in this
   repo" and "no probe touches ceremony's board" could not both be followed in
   a file where "this repo" reads as ceremony. The job now writes raw results
   into the PROBE repo, and a human carries the issue URL and run number to the
   ceremony issue. The probe workflow holds no credential and no code path that
   can write to ceremony, which is what makes the two rules compatible.

Placement: the operational contract moves to docs/RUNNER-PROBES.md, with a
short cross-link in drills/README.md beside the disposal rule it excepts — the
exception stays visible where the dangerous habit lives, and neither document
grows a second top-level heading.

test/run.sh 28/28 on the updated branch; shellcheck 0.10.0, actionlint,
self-ref, marker, vendored and changelog-armed clean.

Refs #202
2026-08-05 13:40:28 +00:00

1.2 KiB
Raw Blame History

Added

  • docs/RUNNER-PROBES.md documents the standing runner-probe venue, heavy-duty/ceremony-runner-probe — the place runner-only facts are measured on demand, ruled as option A by the operator (#202).

  • drills/README.md cross-links it beside the disposal rule, so the exception is visible where the dangerous habit lives (#202).

  • The runbook states that the drill disposal rule does not apply to it. Archiving it defeats its purpose, and that is exactly how the three existing drill repos each became unavailable (#202).

  • It records that a probe must run as an Actions job under the workflow token: the same call answers 500 there and 204 under a PAT, so a probe run any other way produces a confident wrong answer (#202).

  • Creating the repo is recorded as the operator's step, measured rather than assumed: a fleet identity gets 403 on org repo creation and 201 in its own namespace (#202).

  • It carries an executable arming procedure — fork ref, canonical SHA, both CEREMONY_SELF_REF carriers rewritten, and what the result must record (#202).

  • Probe results are written to an issue in the probe repo and carried to the ceremony issue by a human, so the probe holds no path that can write to the live board (#202).