Repository navigation
[G01] Prove Scale Set delivery, acquisition and drain contracts #1
Description
Goal
Select and pin one supported Scale Set integration path and produce a reusable evidence packet for recovery at message acknowledgement, acquisition and JIT boundaries, rerunning only changed-boundary checks while keeping unchanged evidence and live gaps explicit.
Create one active Codex goal from the statement above when this issue is dispatched. The Project Goal field is a work specification; it does not start an agent. Do not invent a token budget.
Execution contract
| Field | Value |
|---|---|
| Goal key | G01 |
| Stage | M0 - Evidence gates |
| Initial status | Ready |
| Primary route | gpt-luna-max (gpt-5.6-luna / max) |
| Priority / risk | P0 / High |
| Test profiles | offline, trusted-live-github |
Use one issue branch/worktree and one focused PR. Independent gpt-luna-max review is required for authentication, protocol, concurrency, resource ownership, cleanup or service identity boundaries; other changes need independent contract review. Model fields are routing instructions, not GitHub user assignments. New work uses gpt-luna-max by default or an explicit grok-high override; Astra is historical-only.
Dependencies
None. This issue is initially Ready.
Dependencies must be Done before implementation begins. A new issue is not blocked simply because its future evidence has not been collected.
Scope
Isolated protocol spike and ADR; compare release v0.4.0 with audited commit cb0405b2d874500e75ae34eff8d582ab75956b45. Do not implement production providers or copy the demo shutdown policy.
TDD and failure evidence
- Red: fake session server reproduces ACK-before-callback crash and missing lifecycle callback.
- Cover pre/post ACK, acquisition, >50 events, repeated/stale statistics, 202, 401/403/429, callback failure and session replacement with deterministic barriers.
- Test idle-assignment races while drain withdraws capacity; mocks alone cannot prove server deregistration/acquisition behavior. Run an explicitly authorized disposable private live canary before closing the gate.
Capture a meaningful failing case before the implementation, then green evidence and relevant refactor checks. During iteration, keep intermediate commits local, batch one stable candidate push, and rerun full validation only when the head or relevant risk boundary changes. Reuse unchanged evidence by immutable SHA. Tooling/prose-only work uses appropriate negative checks without artificial application tests. Live/runtime profiles require reviewed commits, a dedicated trusted test environment and explicit authorization for the concrete experiment. Public PR CI uses hosted environments without credentials. Planned or skipped tests never count as passed.
Acceptance criteria
- Record exact module/runner versions and supported JIT bootstrap transports, including any secret exposure.
- Choose high-level listener plus independent reconciliation OR a lower-level supported message loop; do not simply reverse ordering without evidence.
- Document recoverable state versus quarantine for lost callback/request IDs; no exactly-once claim.
- Publish sanitized live contract evidence or keep the gate unresolved; obtain independent gpt-luna-max protocol review.
- Record exact validation commands, actual results, skipped/live-test gaps and applicable rollback notes in the PR.
- Use one change-impact ledger and one stable candidate CI/review cycle; reuse unchanged evidence by immutable SHA and rerun only changed-boundary checks.
- Independent review is resolved and the focused PR is merged under the repository execution policy.
- Update issue/Project accurately; mark the active goal complete only after all required evidence and work are complete.
Safety invariants
Preserve existing manual runners; no global Docker prune/context switching, broad process kill, implicit App enrollment, busy-job cancellation during ordinary scale-down or transparent workflow replay. Use only verifiably owned resources. Keep management credentials and raw secret-bearing SDK errors out of worker environments, logs, fixtures and commits; per-worker JIT transport follows G01. Native pools remain trusted-only.
Activity
jjangg96 commentedon Sep 7, 2026
Offline SDK contract evidence merged in #22 (
1396e20) after independent Astra xhigh review. Actual SDK v0.4.0 and the audited comparison commit passed the fault-contract race tests and static checks. The record separates recoverable aggregate demand from quarantined acquisition/JIT uncertainty.This issue remains in progress: authorized private live evidence is still required. A separately opt-in canary driver is now being prepared for independent review before any live resource creation. No existing manual runners or credentials were changed, and dependent production integration stays gated.
jjangg96 commentedon Sep 7, 2026
Review audit #30 is complete. PR37 integrates the six reproduced PR25/28 fixes plus independently discovered work-evidence and ownership-proof guards. Final reviewed head a9fb8de passed full checks, independent Astra xhigh verification, hosted CI and exact-head Codex clean review before merge2fd5844. Original threads carry individual red/fix evidence and are resolved. Final main make check passed. Evidence: docs/evidence/g01-audit-corrections.md.
This does not close G01: actual server/worker recovery, integrated/global worker admission and sanitized authorized live evidence remain open. PR29 remains draft for its six known defects. No live resources or existing manual runners were changed.
jjangg96 commentedon Sep 7, 2026
PR38 is integrated as c1c0b6a. Red495d078 proved the per-directory worker cap could admit two containers; the fixed native-account claim now limits the finite G01 worker experiment across state directories and retains its slot across close, cleanup and unknown outcomes. Independent Astra review verified separate-process crash/competition/copy/tamper and unsupported-build guards, and full make check/hosted CI passed. Codex's timestamped summary names final head e3fcc32 and marks review Completed at14:22:30 UTC, before merge14:33:02 UTC; both finding sources and all threads were empty. Evidence: docs/evidence/g01-worker-admission.md.
This closes the finite controller-account worker admission preparation gap. Paired controller/worker binding, baseline execution/terminal reconciliation, finite successor experiments, actual platform/live evidence and production fleet admission remain open. No real worker or account admission directory was created.
76 remaining items
jjangg96 commentedon Oct 22, 2026
Maintainer resumed push/PR/review/merge on 2026-10-22. Offline pin/evidence candidate is PR #105 at 4ba3a1b; exact-head independent and GitHub Codex reviews are pending. The complete canonical G01 offline checker passed (nine race partitions and three vets); prior failures remain documented. Canary preparation found an existing private target, but workflow/runtime alignment, runner-group policy verification (403), resource headroom, broker provenance/trust roots and conditional cleanup are not qualified. Actual live execution still requires separate concrete approval. G01 stays OPEN / In progress; no dependent production work is authorized.
jjangg96 commentedon Oct 22, 2026
Read-only canary preparation checkpoint (2026-10-22): PR105 merged as 3255cf3 and full main Public CI39756836061 passed. No canary/live execution has been authorized or performed. Registry metadata confirms the historical pinned runner2.337.0 Linux/ARM64 image reference remains available; official release metadata now reports runner2.338.0 (published2026-10-06) as latest. A local private approval draft records a preferred2.338.0 qualification candidate with immutable image/archive metadata, but no source/admission pin was changed, no layers/archive downloaded and no container/JIT/workflow operation ran. Reconcile/review the2.337.0 evidence baseline before selecting that runtime. Runner-group metadata access is still403, and dedicated identity/provenance/cleanup and disk-headroom gates remain unresolved. Metadata availability is not runtime/security qualification. G01 remains open/In progress; production dependents remain gated.
jjangg96 commentedon Oct 22, 2026
Read-only canary preparation update: the maintainer supplied an existing App identity and installation ID. Public App metadata and organization installation metadata now confirm the matching active organization installation and advertised runner-write permission; selected repository membership and runner-group policy remain unverified with current authentication. A separate existing user identity can read the private target's Actions workflow listing, but a least-privilege verifier/provenance binding has not been provisioned. Exact private identifiers stay only in the local approval draft. No auth refresh, permission change, credential export, installation-token issuance, repository/workflow mutation, JIT, runner registration, image/container preparation or dispatch was performed. The live entrypoint remains quarantined; execution still needs resolved code/security/environment gates and separate maintainer approval.
jjangg96 commentedon Oct 22, 2026
Correction and readiness update after the maintainer explicitly requested authenticated browser inspection: the existing organization-only runner-management App intentionally requires no repository access. My earlier selected-repository membership question was unnecessary for that role; do not add repository permissions on that basis. Repository eligibility belongs to the runner-group policy. Read-only UI inspection confirmed an existing nondefault dedicated group selecting exactly the private target, public repositories disabled, and zero configured runners. Its workflow policy is currently All workflows, so exact approved workflow-ref policy still needs review before execution. No App/group settings were changed; the repository picker was cancelled, and the browser inspection was finished. The local draft now proposes this existing group instead of creating another. Actual execution-principal/provenance qualification, the quarantined broker input boundary, runtime qualification and separate live approval remain open; no runner/JIT/dispatch/container operation occurred.
jjangg96 commentedon Oct 25, 2026
G01 writer progress checkpoint — 2026-10-25; keep OPEN / In progress.
Evidence committed/pushed as 2d3f8dd: 2d3f8dd . Three documentation files only; no protocol, SDK/Go/runner pin, module checksum, script or live-operation change. This checkpoint is NOT a new independent/Codex approval or merged G01 result.
Actual missing offline comparison is now supplied: the existing inspected compare-sdk.sh ran unchanged under allowlisted Go1.26.9/Darwin-ARM64/cgo with GOMAXPROCS2 and GOFLAGS=-p=2. Both v0.4.0 and audited v0.4.1-0.20260721134647-cb0405b2d874 passed the copied root loopback contract suite with -race/-count=1/-timeout=45s and go vet; package times1.406s/1.377s, whole script exit0. Nested worker/controller packages and the full matrix were NOT rerun. G01 module tree da98e542ea2a8066a3af664a4b5d3f7bdf655ebb and comparison-script blob23856ea76205190817183280bdcc15bd8a417da6 were unchanged before/after. The inert current-packet profile checker also passed4 tests/0.007s. Markdown links/fragments and added-line path/key/token checks passed.
New material upstream fact: official SDK v0.5.0 was released2026-10-23 at af394d86c0d5024225238b0209043c70193bcfe6. Its listener now calls Scale(ctx,message) before ACK and delegates acquisition/lifecycle/nil-message handling to the caller; this is SOURCE evidence, not measured server redelivery or exactly-once behavior. It requires Go1.27.3. A fixed-Go1.26.9 module-admission probe outside the repo exited1 on that minimum requirement; no v0.5.0 application/test binary or Go1.27.3 toolchain was executed by this batch. Official runner v2.338.1 metadata was also observed; archive bytes, runtime and tenant availability were not qualified. Existing experimental pins remain unchanged, not declared latest or permanently preferable.
Next safe offline work is a separately pinned v0.5.0 / Go1.27.3 candidate qualification: port causal handler/ACK, partial-side-effect/acquisition/JIT, 202/statistics, cancellation/deadline/retry and session-fencing controls to the actual released API. Do not silently upgrade shared pins or infer runtime success from source inspection. The PR103-only internal-review replacement does not waive this new work review gates. New candidate evaluation, recipe execution, required reviews/merge, authorized tenant/archive/runtime qualification and real recovery/drain canary evidence remain open. No Scale Set/runner/JIT/workflow/credential/host-service operation occurred; G01 and dependent production gates remain unresolved.
jjangg96 commentedon Oct 25, 2026
2026-10-25 G01 checkpoint: PR #106 merged as 193c53d; local main fast-forwarded cleanly. Isolated SDKv0.5.0/Go1.27.3 candidate: 17 top-level race tests PASS, vet/tidy/module integrity PASS, test-inclusive govulncheckv1.7.0 no findings. Unsafe ACK-before-handler temporary mutation yielded the expected compiling assertion RED before canonical green.
Independent Codex Sol-medium protocol/security review and exact-head GitHub Codex review approved 10d7421; hosted PR quick passed. No inline or issue-comment findings remained. Final ledger: #106 (comment) . Commands, source identities and limits: https://github.com/1XP-AI/gh-runnerd/blob/193c53d8e5b8a10951eabfa2ab1d3fb2184814ba/docs/evidence/g01-sdk-v05-candidate.md .
Postmerge Public CI IN PROGRESS, not yet claimed passed: https://github.com/1XP-AI/gh-runnerd/actions/runs/40162663518 . Shared active Go1.26.9/SDKv0.4.0 pins and driver/broker admission unchanged; successor adoption requires its own reviewed change. G01/Project remain OPEN/In progress, active goal retained. No live canary/runner/JIT/credential/service operation performed.
jjangg96 commentedon Oct 25, 2026
G01 adoption checkpoint — PR #107 merged at
0b376359ec60754e9ef074343fb8cf409727da78.92be46478389222b47e15e9451ae009d5be56c0b: independent Sol-medium protocol/security approval, Q1 zero-message fix resolved, GitHub Codex review completed with no findings, same-head PR quick PASS 43s. Final premerge audit consumed all inline/issue/stale-thread scope before the SHA-constrained merge.G01 remains OPEN and Project In progress; the active goal is not complete. Synthetic CI does not prove live recovery/reoffer/expiry, server drain races or actual runner execution. Broker-only provenance/conditional cleanup remain quarantined; private target/group plus reviewed runtime/archive inputs and concrete live authorization still require their own qualification. No live Scale Set/runner/JIT/credential/Docker/service operation or dependent production implementation occurred. Full G02 is not completed by its passing offline CI.
jjangg96 commentedon Oct 25, 2026
G01 checkpoint: runner archive/image byte gap closed; live gates remain
PR #108 is merged as
edd5d8fb651476c03d906434712130e1163a998cafter independent Codex Sol/medium protocol/security review, exact-head GitHub Codex review and passing PR quick. The independent review caught a broker/worker pin mismatch; it was reproduced, fixed and re-reviewed before merge.G01 stays OPEN / Project In progress; its goal is not complete. Static byte agreement is not a signature, image vulnerability audit, runtime/JIT-isolation result or live recovery evidence. Remaining gates are authenticated controller/broker provenance and reviewed trust-root provisioning, provider-supported conditional cleanup, exact workflow/group/runtime/controller identities, and separate concrete live-canary authorization. The controller remains quarantined. Approval alone cannot substitute for missing technical capabilities, and full G02/dependent production work remains gated. No existing runner, Docker daemon, container, live workflow, Scale Set, JIT or credential configuration was operated or changed by this checkpoint.
jjangg96 commentedon Oct 25, 2026
G01 checkpoint: reviewed changes merged; main integration passed
PR #109 merged as
98e950394d2d2075dee969361fb5337fba67a71e. Its organization-only App management support received independent protocol/security review, GitHub Codex review and the PR quick check. The original main integration run still failed in the combined G01 storage process at 120 seconds while the other five jobs passed; that failure remains recorded and was not retried.PR #110 addresses that recurring process-budget boundary without changing assertions, race mode, the storage union or either 120-second cap. Candidate
cda82ee320a16ac4f20996187ef80136315db22breceived independent Codex Sol/medium approval, the passing 32-second PR quick check and completed GitHub Codex review with no findings. The fresh comment request followed the user's explicit instruction. All issue, submitted and inline/outdated review records were audited in the premerge record. It merged on 2026-10-26 asab4adaa366a57e3b89339c00af7c2681ec40643b; the merge and reviewed candidate have identical source trees, and both local project checkouts are synchronized and clean.Public CI 40277851087, attempt 1 completed successfully for that exact merge SHA. All seven jobs passed: vulnerability (34s), root/tooling (7m54s), root race (7m57s), G02 offline (1m58s), R1 offline (49s), G01 offline (8m49s), and aggregate Go checks (3s). The G01 storage timeout did not recur with the split processes and existing race mode/120-second caps. The current integration failure is resolved by this reviewed correction and actual main result; the original failed attempt remains recorded. No retry or new local full suite was substituted for this integration result.
The private canary workflow preparation PR also received independent approval and completed GitHub Codex review without findings, then merged using its reviewed candidate. The merge and candidate trees are identical. Private target, SHA and review URLs remain in the private readiness record. That repository has only a manual workflow and no automatic PR check result; static actionlint/YAML/Bash validation is not relabeled hosted CI. Its merge has no Actions runs. No canary was dispatched, no runner-group/App policy changed and no credential/runtime/service operation occurred.
Read-only environment preparation on 2026-10-25 observed the existing dedicated nondefault group selecting only the private target, public repository access disabled and zero configured runners. Workflow policy still needed restriction to the approved ref. Existing Docker metadata reported Linux ARM64, compatible API 1.45, 14 CPUs, 25,159,036,928 bytes memory and advertised resource-limit support, while inspection of the selected image reported it absent. These are dated metadata observations, not free-headroom, enforcement or live qualification. Disposable downloaded verification inputs and old fixture binaries were later cleaned at the user's request; immutable identities, source, evidence and review reports were preserved.
G01 remains OPEN / Project In progress. The review/merge/integration blockers have cleared; remaining work is actual image/runtime/workflow-policy/execution-principal qualification, authenticated broker provenance with operator-pinned trust-root provisioning, supported conditional cleanup and separate concrete canary execution approval. The controller entry remains quarantined, the normal broker has no production provenance adapter/root, and the selected official SDK deletion method remains unconditional. Source inspection and negative searches do not establish undocumented provider behavior. Full G01/G02 and dependent production gates are not closed. The native goal's recorded blocked state now concerns these remaining live-readiness conditions, not a pending GitHub review.