Experiment: real TrueNAS and Proxmox system RDTE on public GHA KVM

.github/workflows/garm-vm-pre-b4-static.yml

@@ -0,0 +1,71 @@
+name: GARM VM pre-B4 static consumer
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/garm-vm-pre-b4-static.yml
+      - scripts/truenas_garm_vm_pre_b4_fixture.py
+      - tests/test_truenas_garm_vm_pre_b4.py
+      - scripts/truenas_garm_vm_template_preflight.py
+      - tests/test_truenas_garm_vm_template_preflight.py
+
+permissions:
+  contents: read
+
+jobs:
+  vm-fixture-static:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 12
+    steps:
+      - name: Checkout Agent Dispatch consumer
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - name: Compile and adversarial source tests
+        run: |
+          set -euo pipefail
+          python3 -m py_compile scripts/truenas_garm_vm_pre_b4_fixture.py tests/test_truenas_garm_vm_pre_b4.py scripts/truenas_garm_vm_template_preflight.py tests/test_truenas_garm_vm_template_preflight.py
+          python3 -m unittest -v tests/test_truenas_garm_vm_pre_b4.py tests/test_truenas_garm_vm_template_preflight.py
+      - name: Export exact public GARM VM source fixture
+        env:
+          PROVIDER_REF: 5944d1dc62b4da2a247dda9754cfe674caedf5cf
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/garm-vm-provider" "$RUNNER_TEMP/garm-vm-evidence"
+          git -C "$RUNNER_TEMP/garm-vm-provider" init -q
+          git -C "$RUNNER_TEMP/garm-vm-provider" fetch -q --depth=1 \
+            https://github.com/SemperSupra/garm-provider-truenas.git "$PROVIDER_REF"
+          git -C "$RUNNER_TEMP/garm-vm-provider" checkout -q --detach FETCH_HEAD
+          test "$(git -C "$RUNNER_TEMP/garm-vm-provider" rev-parse HEAD)" = "$PROVIDER_REF"
+          (
+            cd "$RUNNER_TEMP/garm-vm-provider"
+            GARM_VM_FIXTURE_OUT="$RUNNER_TEMP/garm-vm-evidence/garm-provider-vm-pre-b4-fixture.json" \
+            GARM_VM_FIXTURE_SOURCE="$PROVIDER_REF" \
+            go test ./internal/vmbackend -run '^TestExportNestedVMPreB4Fixture$' -count=1
+          )
+      - name: Independently validate exact exported fixture without runtime mutation
+        run: |
+          set -euo pipefail
+          python3 scripts/truenas_garm_vm_pre_b4_fixture.py \
+            --fixture "$RUNNER_TEMP/garm-vm-evidence/garm-provider-vm-pre-b4-fixture.json" \
+            --producer-commit 5944d1dc62b4da2a247dda9754cfe674caedf5cf \
+            --out "$RUNNER_TEMP/garm-vm-evidence/consumer-static-receipt.json"
+          python3 - "$RUNNER_TEMP/garm-vm-evidence/consumer-static-receipt.json" <<'PY'
+          import json, sys
+          r = json.load(open(sys.argv[1]))
+          assert r["classification"] == "STATIC_CONTRACT_PASS"
+          assert r["source_only"] is True
+          assert r["vm_runtime_admitted"] is False
+          assert r["guest_boot_observed"] is False
+          assert r["bootstrap_consumption_observed"] is False
+          assert r["github_jit_exercised"] is False
+          assert r["zero_residue_runtime_proven"] is False
+          PY
+      - name: Retain only sanitized static consumer receipt
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: garm-vm-pre-b4-static-receipt
+          path: ${{ runner.temp }}/garm-vm-evidence/consumer-static-receipt.json
+          if-no-files-found: warn
+          retention-days: 7

.github/workflows/minecraft-t6-static.yml

@@ -0,0 +1,44 @@
+name: Minecraft T6 consumer cheap qualification
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/minecraft-t6-static.yml"
+      - "scripts/truenas_middleware_minecraft_t6_probe.py"
+      - "tests/test_truenas_t6_minecraft_control.py"
+      - "scripts/gha_kvm_truenas_rdte.sh"
+      - ".github/workflows/gha-kvm-system-rdte.yml"
+      - "config/truenas-capsule-providers.json"
+      - "config/truenas-session-minecraft-paper-25-04-1.json"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  cheap:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Checkout exact feature revision
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Compile product and middleware consumer
+        run: |
+          python3 -m py_compile scripts/truenas_middleware_minecraft_t6_probe.py
+          python3 -m py_compile scripts/truenas_middleware_ddp_probe.py
+          bash -n scripts/gha_kvm_truenas_rdte.sh
+      - name: Execute source and fail-closed negatives
+        run: |
+          python3 -m unittest -v tests/test_truenas_t6_minecraft_control.py
+          python3 -m unittest -v tests/test_truenas_existing_probe_capsule_executor.py
+          python3 -m unittest -v tests/test_truenas_session_manifest.py
+      - name: Verify session manifest exact contract
+        run: |
+          python3 scripts/truenas_session_manifest.py \
+            --manifest config/truenas-session-minecraft-paper-25-04-1.json \
+            --targets config/truenas-rdte-targets.json \
+            --providers config/truenas-capsule-providers.json
+          python3 scripts/truenas_single_capsule_adapter.py \
+            --manifest config/truenas-session-minecraft-paper-25-04-1.json \
+            --targets config/truenas-rdte-targets.json \
+            --providers config/truenas-capsule-providers.json

.github/workflows/official-minecraft-catalog-preflight.yml

@@ -0,0 +1,43 @@
+name: Read-only official Minecraft native catalog preflight
+on:
+  pull_request:
+    paths:
+      - 'scripts/check_collage_catalog_preflight.py'
+      - 'tests/test_collage_catalog_preflight.py'
+      - '.github/workflows/official-minecraft-catalog-preflight.yml'
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  actual-official-catalog:
+    if: github.event.repository.private == false
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - name: Cheap catalog guard and 404 regression tests
+        run: |
+          set -euo pipefail
+          python3 -m py_compile scripts/check_collage_catalog_preflight.py
+          python3 -m unittest -v tests.test_collage_catalog_preflight
+      - name: Verify actual upstream 1.15.31 native source availability; no Paper 1.15.30 runtime claim
+        run: |
+          set -euo pipefail
+          python3 scripts/check_collage_catalog_preflight.py --expected 1.15.31 \
+            > "$RUNNER_TEMP/official-catalog-result.json"
+          python3 - "$RUNNER_TEMP/official-catalog-result.json" <<'PY'
+          import json,sys
+          v=json.load(open(sys.argv[1]))
+          assert v["classification"] == "PRE_KVM_CATALOG_VERSION_AVAILABLE"
+          assert v["expected_version"] == "1.15.31"
+          assert "1.15.31" in v["visible_versions"]
+          assert "1.15.30" not in v["visible_versions"]
+          assert v["guest_catalog_observed"] is False
+          assert v["live_minecraft_qualified"] is False
+          assert v["world_mutated"] is False
+          PY
+      - name: Report exact read-only external preflight boundary
+        if: always()
+        run: echo 'Only current native vanilla 1.15.31 source catalog availability, not retired Paper 1.15.30; no KVM, native TrueNAS App, game-world mutation or physical APPLY.' >> "$GITHUB_STEP_SUMMARY"

.github/workflows/prep-foliorelay-t6-consumer.yml

@@ -0,0 +1,141 @@
+name: FolioRelay T6 consumer prep
+
+on:
+  pull_request:
+    branches:
+      - experiment/gha-kvm-system-rdte
+    paths:
+      - ".github/workflows/prep-foliorelay-t6-consumer.yml"
+      - ".github/workflows/gha-kvm-system-rdte.yml"
+      - "scripts/gha_kvm_truenas_rdte.sh"
+      - "scripts/truenas_middleware_foliorelay_t6_probe.py"
+      - "tests/test_truenas_t6_foliorelay_control.py"
+      - "tools/foliorelay-observer/**"
+  push:
+    branches:
+      - "prep/truenas-t6-foliorelay-v1"
+    paths:
+      - ".github/workflows/prep-foliorelay-t6-consumer.yml"
+      - ".github/workflows/gha-kvm-system-rdte.yml"
+      - "scripts/gha_kvm_truenas_rdte.sh"
+      - "scripts/truenas_middleware_foliorelay_t6_probe.py"
+      - "tests/test_truenas_t6_foliorelay_control.py"
+      - "tools/foliorelay-observer/**"
+
+permissions:
+  contents: read
+
+jobs:
+  foundry-control:
+    uses: SemperSupra/truenas-app-foundry/.github/workflows/export-foliorelay-t6-control.yml@81deb97185760975fd8d3162df42056c77b3c0fd
+    with:
+      foundry_ref: 81deb97185760975fd8d3162df42056c77b3c0fd
+      target_version: 25.10.7
+    permissions:
+      contents: read
+
+  consumer-contract:
+    needs: foundry-control
+    runs-on: ubuntu-26.04
+    timeout-minutes: 8
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - name: Ensure fixture compiler dependencies
+        run: |
+          set -euo pipefail
+          sudo apt-get update -qq
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+            cups-ipp-utils libcups2-dev build-essential
+      - name: Download exact Foundry FolioRelay control
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: foliorelay-t6-control
+          path: ${{ runner.temp }}/foliorelay-control
+      - name: Smoke minimal static independent DNS-SD observer
+        shell: bash
+        run: |
+          set -euo pipefail
+          carrier='docker.io/library/hello-world@sha256:5e23090353324d887c48ad5e5c56d294eab81588df9605b07d1afe895f9cc8f8'
+          work="$RUNNER_TEMP/foliorelay-observer-smoke"
+          rm -rf "$work"
+          mkdir -p "$work"
+          command -v go >/dev/null
+          GO111MODULE=off go test ./tools/foliorelay-observer
+          GO111MODULE=off CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+            go build -trimpath -ldflags='-s -w -buildid=' \
+            -o "$work/foliorelay-observer" ./tools/foliorelay-observer
+          test -s "$work/foliorelay-observer"
+          test "$(stat -c%s "$work/foliorelay-observer")" -le 6291456
+          readelf -l "$work/foliorelay-observer" >"$RUNNER_TEMP/foliorelay-observer-elf.txt"
+          if grep -q 'INTERP' "$RUNNER_TEMP/foliorelay-observer-elf.txt"; then
+            echo "observer binary unexpectedly has a dynamic interpreter" >&2
+            exit 1
+          fi
+          port="$(python3 - <<'PY'
+          import socket
+          s=socket.socket(); s.bind(("127.0.0.1",0)); print(s.getsockname()[1]); s.close()
+          PY
+          )"
+          docker pull "$carrier" >/dev/null
+          test "$(docker image inspect "$carrier" --format '{{.Size}}')" -le 1048576
+          docker rm -f foliorelay-observer-smoke >/dev/null 2>&1 || true
+          trap 'docker rm -f foliorelay-observer-smoke >/dev/null 2>&1 || true' EXIT
+          docker run -d --name foliorelay-observer-smoke \
+            --network host \
+            --read-only \
+            --user 65534:65534 \
+            --cap-drop ALL \
+            --security-opt no-new-privileges:true \
+            --mount "type=bind,src=$work/foliorelay-observer,dst=/observer/foliorelay-observer,readonly" \
+            --entrypoint /observer/foliorelay-observer \
+            "$carrier" \
+            --uuid urn:uuid:01234567-89ab-4def-8123-456789abcdef \
+            --txt-uuid 01234567-89ab-4def-8123-456789abcdef \
+            --expected-host intentionally-absent.local \
+            --expected-ipp-port 8634 \
+            --port "$port" \
+            --seconds 1 >/dev/null
+          python3 - "$port" <<'PY'
+          import json, sys, time, urllib.request
+          url=f"http://127.0.0.1:{sys.argv[1]}/"
+          deadline=time.monotonic()+15
+          last=None
+          while time.monotonic()<deadline:
+              try:
+                  with urllib.request.urlopen(url,timeout=2) as r:
+                      last=json.load(r)
+                  if last.get("status")=="error":
+                      break
+              except Exception:
+                  pass
+              time.sleep(.5)
+          if not isinstance(last,dict) or last.get("status")!="error":
+              raise SystemExit(f"observer did not expose bounded error result: {last!r}")
+          if "no qualifying _universal FolioRelay mDNS response" not in last.get("error",""):
+              raise SystemExit(f"unexpected observer error: {last!r}")
+          PY
+          test "$(docker inspect -f '{{.State.Running}}' foliorelay-observer-smoke)" = true
+      - name: Verify producer-consumer binding
+        shell: bash
+        run: |
+          set -euo pipefail
+          root="$RUNNER_TEMP/foliorelay-control"
+          test -s "$root/control.json"
+          test -s "$root/compose.json"
+          jq -e '
+            .schema == "semper-supra.foliorelay-truenas-t6-control/1" and
+            .foundry_ref == "81deb97185760975fd8d3162df42056c77b3c0fd" and
+            .candidate.truenas_version == "25.10.7" and
+            .candidate.control_image == "ghcr.io/sempersupra/foliorelay-control@sha256:d0ba6d1efbed0d9f84b20d374eeb44ee28ab0874a683396e628850f159193cf5" and
+            .candidate.cups_image == "ghcr.io/sempersupra/foliorelay-cups@sha256:0997ad2054ca5e57f34291372aed55f549eee9ff201f171b430436b0655c0814" and
+            .secrets_captured == false
+          ' "$root/control.json" >/dev/null
+          jq -e '
+            (.services | keys | sort) == ["control","cups","discovery"] and
+            .services.discovery.network_mode == "host"
+          ' "$root/compose.json" >/dev/null
+          python3 -m unittest -v tests/test_truenas_t6_foliorelay_control.py
+          bash -n scripts/gha_kvm_truenas_rdte.sh
+          python3 -m py_compile scripts/truenas_middleware_foliorelay_t6_probe.py