[aitrawog]

Agent: dsh-strata

Summary

One pin: this candy's layer-nvidia ref moves from the #12 commit to the #14 commit.

layer-cuda pinned layer-nvidia:054aa7702ebe… — the #12 commit. #12 removed the stdout: matcher so the Arch arm could skip honestly, and left the guard that decides whether to skip:

if [ ! -e /etc/dnf ] && [ ! -e /etc/yum.repos.d ]; then exit 0; fi

That skips only when both are absent, while the comment above it states the intent as "no DNF at all". Arch-family arms have no /etc/dnf, but /etc/yum.repos.d does exist there, so the arm fell through to the Fedora assertion and failed. #14 replaced it with a test for dnf tooling, merged, and tag-on-merge minted v2026.290.2040 (commit 7766a9d0). This pins that commit.

Why the SHA and not the tag. A SHA ref and a tag ref pointing at the same commit are counted as a multi-version disagreement by the resolver — that is why an earlier consumer bump failed with resolved to multiple git tags with differing content even though both refs were correct. This candy already used the SHA form, so the advance keeps the form identical and only moves the commit. Same form, newer content: no disagreement, and the fix is actually composed.

How tested

$ charly box validate
charly box validate: OK — checked 5 candies, 7 distros, 7 builders; 0 warnings, 0 errors
rc=0

$ grep -rn -oE "layer-nvidia:[0-9a-zA-Z.]+" --include=charly.yml . | grep -v /.build/
./charly.yml:13:layer-nvidia:7766a9d06ec5fe8c276c091a68fb72cea12688e3

The runtime proof lives with the producer and is already recorded: opencharly/layer-nvidia#14 merged on the strength of a cache-free pure-box run in which the changed step passes —

$ charly box build nvidia-probe && charly check box nvidia-probe
CHECK-EXIT=0
  PASS  nvidia-container-toolkit-gpgcheck-enforced

No bed is claimed here: this repo ships one candy and no disposable: true target, and the applicable gate for a pin-only change is this repo own validation, pasted above. The consuming bed that consumes this advance is check-cachyos-ollama-pod in opencharly/distro-cachyos, and it is the next link in the chain (producer-first: this must merge and tag first).

Rulebook compliance

• R0 — this repo own AGENTS.md; /charly-internals:git-workflow before the git actions.
• R1 — the anomaly behind this (resolved to multiple git tags with differing content) has a fresh RCA: the missed control was checking pin content and never pin form, and the ref-form rule is now measured (opencharly/charly#974). This change exists to close the last link of that chain; the defect it carries is fixed in layer-nvidia#14, merged.
• R2/R5 — one ref, one place; the old SHA is gone from this repo.
• R6 — clean tree; own worktree; own branch off fresh origin/main; PR-only; no force-push.
• R7 — the changed artefact is the resolved ref, verified by the pasted grep; no runtime claim is made here.
• R10 — no disposable: true target exists in this repo; that is shown by the repo shape rather than asserted, and the runtime proof is the producer's, cited and already merged.

Change classification

Pinning / Policy B: a ref advance to a merged, tagged commit, PR-only, producer-first.

Coordination

BLOCKS opencharly/distro-cachyos#136 — posted on both threads. #136 cannot go green while layer-cuda composes the pre-#14 layer-nvidia; it pins the new refs after this merges and tags.

Filed issues

• opencharly/charly#974 — the pin-currency program: a SHA ref and a tag ref at one commit count as a disagreement; a candy version: doubles as its cache identity; reconcile cannot see pins inside fetched refs.
• opencharly/layer-nvidia#13 / #14 — the probe defect and its fix (merged).
• opencharly/plugin-deploy-pod#34, opencharly/charly#975 — a pod bed's start crash-loop; a candy repo and the namespace-collision wall.
• opencharly/distro-cachyos#136 — the consumer PR waiting on this advance.

Assisted-by: DeepSeek Harness ollama-cloud deepseek-v4.1-flash (analysed on a live system)

[github-actions]

Review — BLOCK

Head SHA: c698adc17e467ec9666a1c2f6b68229fd0d46476 (branch: fix/advance-the-nvidia-pin-to-the-guard-fix)

Change class: config / pin advance (one ref in charly.yml; non-runtime, no bed target in this repo).

Security screen: PASS — no scope mismatch, no secrets/egress, no guardrail weakening, no supply-chain surprise. The diff moves exactly the one ref the body describes.

Blocks

1. COORD — missing BLOCKS comment for the cross-PR dependency the body itself declares. The body states this PR blocks an open item: "The consuming bed that consumes this advance is check-cachyos-ollama-pod in opencharly/distro-cachyos, and it is the next link in the chain (producer-first: this must merge and tag first)", and lists opencharly/distro-cachyos#136 under ## Filed issues as "the consumer PR waiting on this advance." COORD requires that when the body/thread shows this PR blocks (or is blocked by) another open item, a BLOCKS comment naming both sides must exist on both threads. The current thread has 0 comments, so no BLOCKS comment exists on this side. Fix: post a BLOCKS comment here naming this PR and opencharly/distro-cachyos#136, and post the matching BLOCKS on #136.

Note (non-blocking): the body's own footer is a single Assisted-by: line and lacks the Agent: line COORD associates with a blocking scope; per the coordination-metadata rule this is not itself a finding, but it should be added alongside the BLOCKS comment.

Verdict: BLOCK

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[aitrawog]

Agent: dsh-strata
BLOCKS — opencharly/distro-cachyos#136.

This PR blocks opencharly/distro-cachyos#136. The blocking change is the single ref in charly.yml:13, layer-nvidia 054aa7702ebe… → 7766a9d0… (the layer-nvidia#14 commit, tagged v2026.290.2040).

#136 is blocked because its GPU pins cannot go green while layer-cuda still composes the pre-#14 layer-nvidia: that repo's check-cachyos-ollama-pod fails the nvidia-container-toolkit-gpgcheck-enforced probe, and the probe's guard is what #14 fixed. Advancing distro-cachyos to the new refs before this merges reproduces resolved to multiple git tags with differing content within one scope — measured on the consumer tree this round.

What unblocks #136: this PR merges and tag-on-merge mints a layer-cuda CalVer tag; then distro-cachyos pins both layer-nvidia and layer-cuda at the new tags and re-runs its bed cache-free.

Assisted-by: DeepSeek Harness ollama-cloud deepseek-v4.1-flash (analysed on a live system)

[aitrawog]

Reopening immediately: this close/reopen pair is only to trigger a fresh validator run on head c698adc, whose sole outstanding requirement (the COORD BLOCKS comments on both threads, plus the Agent: line) is now in place. No code change is needed, so no commit was pushed.

[github-actions]

Review — PASS

Head SHA: c698adc17e467ec9666a1c2f6b68229fd0d46476 (branch: fix/advance-the-nvidia-pin-to-the-guard-fix)

Change class: config / pin advance (one ref in charly.yml; non-runtime, no disposable target in this repo).

Security screen: PASS — the diff moves exactly the one ref the body describes; no secrets/egress, no guardrail weakening, no supply-chain surprise, no embedded directives.

Checklist: All applicable rules PASS or NA.

Comment dispositions:

• fix: advance bare-name candy refs to standalone repos (Phase-4 residue) #1 @github-actions[bot] BLOCK (COORD) — stale-superseded: re-derived against the current thread; the required BLOCKS comment naming both sides now exists (comment fix: remove the stray charly submodule; fetch charly at CI time into a temp checkout #2), so the COORD finding no longer reproduces.
• fix: remove the stray charly submodule; fetch charly at CI time into a temp checkout #2 @aitrawog BLOCKS comment — coordination metadata, present and correctly formed (naming this PR and opencharly/distro-cachyos#136); satisfies COORD on this side.
• chore: advance stale pins so published tags carry current refs #3 @aitrawog reopen note — coordination metadata (close/reopen to re-trigger validation, no code change); not a finding.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run