[aitrawog]

Summary

Advances this repo's layer-nvidia pin off v2026.271.1817 and onto the merge commit of
opencharly/layer-nvidia#12 (054aa7702ebe79e8be444764f91a03933ba45eec) — the change that moved the
nvidia-container-toolkit gpgcheck assertion into the command so the Arch arm can skip honestly instead of
failing. One line in the root charly.yml; no other pin moves.

The stale pin is real and was re-measured against the API rather than recalled: main pinned v2026.271.1817
while the fix merged around CalVer day 289. It is visible from the consumer side — opencharly/layer-strata's
check-strata-gpu-pod builds a tree whose transitive layer-nvidia is that old pin, so the bed runs the
pre-#12 probe and fails on nvidia-container-toolkit-gpgcheck-enforced.

A merged SHA is used rather than the tag, deliberately: it is an immutable ref, and charly box reconcile
already reports this tree as aligned ("every repo's pins are at one version").

How tested

• charly box validate — the class pre-flight for a manifest change: OK, 0 warnings, 0 errors.
• charly box reconcile --dry-run in this tree: "already reconciled — every repo's pins are at one version."
• check-strata-gpu-pod (the consumer's real-engine GPU bed) — named, with its measured result: a full run
  today built the cachyos+CUDA+engine image (PASS after 17m56s, strata-engine-binary, strata-engine-stamp,
  strata-venv and the whole CUDA chain all PASS) and then failed the container phase on exactly one step:
  nvidia-container-toolkit-gpgcheck-enforced — the pre-The Arch stitch never links the STATIC CUDA archives, so every CUDA link fails (cannot find -lcudart_static) #12 probe. Its 12 runtime steps (including the completion
  round-trip) were skipped behind that failure. This pin advance is the fix for that step; the bed re-run
  follows this merge and will be reported here.

So: the gate that this repo's change class requires has run and passed; the behavioural proof that depends on the
advance cannot run until it is merged, and that is stated rather than implied.

Rulebook compliance

• R0 — /charly-build:reconcile, /charly-internals:layer, /charly-core:deploy and
  /charly-internals:git-workflow loaded before any edit or git action.
• R1 — the anomaly has an RCA: the stale transitive pin, whose missed control was recorded in #14/#15
  (an invalid control: 32 stale layer-nvidia ref views in ~/.cache/charly/repos/ made a "still fails" reading
  look like disproof). That cache has since been cleared on the bed host, so the next resolution is fresh.
• R2/R3/R5 — one pin, one place, no workaround; the old tag is gone with no shim.
• R6 — git status clean before and after; PR-only; no force-push; the branch is this session's own slug's.
• R9/R10 — the gate ran on the committed tree; the behavioural bed is run on the consumer after merge.

Change classification

Pinning / Policy B (Part II #3): a pin advance to a merged ref, landed PR-only. Not a behaviour change in this
repo's own contents — the behaviour change is the producer's, already merged and tagged in layer-nvidia.

Filed issues

• opencharly/layer-cuda#14 — closes: this is the fix that issue asks for ("stale pin, ~18 days behind").
• opencharly/layer-nvidia#11 — the producer-side defect this pin carries the fix for; its probe now passes on
  main and the issue can be closed once this consumer resolves the new ref.
• Predecessor: opencharly/layer-cuda#15 was closed on an invalid control (see R1 above). This PR is its
  successor per Part II The cuda candy pins cuda-cccl-devel, which the NVIDIA Fedora 43 repo does not provide — every GPU image fails to build #7; #15 is superseded, not silently replaced.

Assisted-by: DeepSeek Harness deepseek-v4.1-flash (analysed on a live system)

[github-actions]

Review — PASS

Head SHA: ec9d710c1fee4e928f460bbeba7629ef50d5e206 (branch: fix/advance-the-nvidia-pin)

Security screen: PASS — one pin line to the org's own opencharly/layer-nvidia at a merged fix commit; no secrets, no weakened guardrails, no injection, no unexpected ref target.
Checklist: All applicable rules PASS or NA. The single-line diff matches the body's accounting exactly; the tier (analysed on a live system) is not inflated; the Assisted-by: footer, ## Filed issues, and predecessor naming are present. The deferred consumer bed is the rule-3 "proof that cannot exist before the pin resolves post-merge" case, stated explicitly rather than implied — not a blockable obligation.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run