docs(ci): close out the hardening; correct a claim that shipped wrong #9

2026-09-29T07:30:30Z

gitea-admin commented

2026-09-29 07:30:30 +00:00

The branch-protection + PR-gate + sidecar sequence is complete and verified. This records
the finished state and fixes what the sequence itself proved wrong.

Corrects a claim I shipped in #7

PR #7 said the sidecar conversion would remove the one-per-start dockerd line
http: TLS handshake error from 127.0.0.1: EOF. It does not. Exactly one still appears,
immediately after API listen on [::]:2376 — it is now the startupProbe's first attempt,
landing microseconds after dockerd begins listening and cut off by timeoutSeconds: 1. The
next poll succeeds.

Cosmetic, and deliberately not chased: raising the timeout to hide one benign startup line
would slow every subsequent poll. The manifest comment now states this instead of the wrong
prediction.

Lands the rollout scripts

infra/gitea/require-gate.sh and verify-then-enforce.sh drove this from a session temp dir.
verify-then-enforce.sh merges nothing — merging is a human's reviewed act — but forces the
reconcile and aborts unless the pod is healthy, a runner is online, and a real workflow goes
green on it, before enabling enforcement and probing the push. Re-run it after any future
act-runner change.

Documentation

CLAUDE.md's enforcement table flips from "weaker than this rule" to machine-enforced, all four
rows marked verified, with the push rejection noted as provoked rather than assumed. It now
also states what a green PR does not prove: CLUSTER_AVAILABLE is unset, so L2/L3 never runs
in CI — only the L0/L1 offline subset is covered.

claim-ship.sh's feat/ rationale is trimmed; #6 deleted the per-branch push triggers, so no
prefix produces a duplicate run any more.

The root cause that remains

infra/gitea/README.md now names it plainly: Gitea repo settings live in its own database,
invisible to Flux and unreadable by the conformance gate, so nothing detects drift from what
that directory declares. These scripts assert desired state; they are not a detector. A check
that reads the live API and fails on divergence is the highest-value work left — and it's the
difference between this being fixed and this being unable to recur.

Gate: PASS, rc 0, 78s.

Co-Authored-By: Claude Opus 5 (1M context) [email protected]

🤖 Generated with Claude Code

The branch-protection + PR-gate + sidecar sequence is complete and verified. This records the finished state and fixes what the sequence itself proved wrong. ### Corrects a claim I shipped in #7 PR #7 said the sidecar conversion would remove the one-per-start dockerd line `http: TLS handshake error from 127.0.0.1: EOF`. **It does not.** Exactly one still appears, immediately after `API listen on [::]:2376` — it is now the startupProbe's *first* attempt, landing microseconds after dockerd begins listening and cut off by `timeoutSeconds: 1`. The next poll succeeds. Cosmetic, and **deliberately not chased**: raising the timeout to hide one benign startup line would slow every subsequent poll. The manifest comment now states this instead of the wrong prediction. ### Lands the rollout scripts `infra/gitea/require-gate.sh` and `verify-then-enforce.sh` drove this from a session temp dir. `verify-then-enforce.sh` **merges nothing** — merging is a human's reviewed act — but forces the reconcile and **aborts** unless the pod is healthy, a runner is online, and a real workflow goes green on it, before enabling enforcement and probing the push. Re-run it after any future act-runner change. ### Documentation `CLAUDE.md`'s enforcement table flips from "weaker than this rule" to machine-enforced, all four rows marked verified, with the push rejection noted as **provoked** rather than assumed. It now also states what a green PR does *not* prove: `CLUSTER_AVAILABLE` is unset, so **L2/L3 never runs in CI** — only the L0/L1 offline subset is covered. `claim-ship.sh`'s `feat/` rationale is trimmed; #6 deleted the per-branch push triggers, so no prefix produces a duplicate run any more. ### The root cause that remains `infra/gitea/README.md` now names it plainly: Gitea repo settings live in its own database, invisible to Flux and unreadable by the conformance gate, so **nothing detects drift** from what that directory declares. These scripts assert desired state; they are not a detector. A check that reads the live API and fails on divergence is the highest-value work left — and it's the difference between this being *fixed* and this being *unable to recur*. Gate: **PASS, rc 0, 78s**. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-admin added 1 commit 2026-09-29 07:30:30 +00:00

docs(ci): close out the hardening -- land the scripts, correct a claim that shipped wrong

gate / gate (pull_request) Successful in 2m2s

Details

gate / conformance (pull_request) Has been skipped

Details

b2d9883958

The branch-protection + PR-gate + sidecar sequence is complete and verified. This records
the finished state and fixes what the sequence itself proved wrong.

CORRECTS A FALSE CLAIM I SHIPPED. PR #7 said the sidecar conversion would remove the
one-per-start dockerd line "http: TLS handshake error from 127.0.0.1: EOF". It does NOT.
Exactly one still appears, immediately after "API listen on [::]:2376" -- it is now the
startupProbe's FIRST attempt, landing microseconds after dockerd begins listening and cut
off by timeoutSeconds: 1; the next poll succeeds. Cosmetic, and deliberately not chased:
raising the timeout to hide one benign startup line would slow every subsequent poll. The
manifest comment now states this instead of the wrong prediction.

Lands infra/gitea/require-gate.sh and verify-then-enforce.sh, which drove the rollout from
a session temp dir. verify-then-enforce.sh merges nothing -- merging is a human's reviewed
act -- but forces the reconcile and ABORTS unless the pod is healthy, a runner is online,
and a real workflow goes green on it, before enabling enforcement and probing the push.
Re-run it after any future act-runner change.

Trims the now-obsolete feat/ rationale from claim-ship.sh: per-branch push triggers were
deleted, so no prefix produces a duplicate run any more.

CLAUDE.md's enforcement table flips from "weaker than this rule" to machine-enforced, with
all four rows marked verified and the push rejection noted as PROVOKED rather than assumed.
It also now states what a green PR does NOT prove: CLUSTER_AVAILABLE is unset, so L2/L3
never runs in CI and only the L0/L1 offline subset is covered.

infra/gitea/README.md marks the sequence done and names the root cause that remains
unfixed: Gitea repo settings live in its own database, invisible to Flux and unreadable by
the conformance gate, so NOTHING detects drift from what this directory declares. These
scripts assert desired state; they are not a detector. The check that reads the live API
and fails on divergence is the highest-value work left, and it is the difference between
this being fixed and this being unable to recur.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

jakman85 merged commit b9e8a4f9e8 into main

2026-09-29 07:32:52 +00:00

jakman85 referenced this issue from a commit

2026-09-29 07:32:53 +00:00

Merge pull request 'docs(ci): close out the hardening; correct a claim that shipped wrong' (#9) from docs/close-out-ci-hardening into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s-impl#9