Repository navigation
disposition queue #844/#840/#728 is fully staged and approval-blocked — two cross-identity reviews unblock the train #854
Description
State (all staged, nothing left to prepare)
| PR | head | what it is | closes on merge | gate |
|---|---|---|---|---|
| #844 | 77064b3 |
global-ARG hoist in Dockerfile.client + fragment — re-lights every cloud-lab lane (client/killer images are unbuildable from scratch without it) |
#724 | 1 approving review |
| #840 | 08c015f |
both #834 audit halves (NUT-07 value-correlation + journal dir-fsync) + ported shortfall test | #834 | 1 approving review |
| #728 | 0a8079d |
FROM-ARG scope fence, guard-only (hardened: refuses vacuous passes) | — | review after #844 + a one-line rebase |
#843 was the duplicate sibling — closed with the disposition record; its unique test lives in #840 now. Auto-merge (squash) is queued on #844 and #840 — each fires the moment its review lands.
The blocker, exactly
Branch protection on main requires ≥1 approving review from an identity with write access other than the PR author. The author identity (Amperstrand) is the only credential on the review lane's machine; GitHub forbids authors approving their own PRs, and both gh pr merge and gh pr merge --admin are refused with "At least 1 approving review is required by reviewers with write access." Cross-identity approval is this repo's documented governance (the @felixfelix-bot requests on #840/#728/#844).
There is no other blocker. Fragments, tests, dispositions, merge ordering and the auto-merge queue are all done; the post-merge tree is pre-verified (below).
What resolves it — exact steps, in order
- Approve fix(cloud-lab): Dockerfile.client's GO_VERSION must be a global ARG — the client image cannot build from scratch #844 → queued squash fires → main gets the fix + fragment, cloud-lab Dockerfile.client: mid-file ARG invisible to FROM — client and killer images unbuildable on docker/buildkit 29 (golang:-bookworm) #724 closes itself, the rig's cloud-lab lanes can build from scratch again.
- Approve fix(wallet,merchant): correlate NUT-07 answers by value; fsync journal directories after rename (#834) #840 → squash fires → audit hardening: NUT-07 checkstate should correlate returned Ys by value; journal renames should fsync the directory #834 closes itself.
- test(contract): FROM-ARG scope fence for cloud-lab Dockerfiles #728 finishes: one-line rebase onto the new main (the fence flips red→green — pre-proven on the simulated tree), then its own approving review.
Post-merge tree — pre-verified while waiting
Simulated full landing (sim-all = main c7dbd74b + all three heads, merged):
- Zero merge conflicts across all three PRs.
- Fence red→green: guard fails on current main (names the exact
Dockerfile.clientline), passes on the merged tree. - tollwallet full suite,
-race -tags testenv: ok 45.4s. - merchant FULL suite: ok 373.8s — the first fully-clean run possible, since it needs both the overnight flake fixes (test(merchant): late-receive outcome selection raced the owed-grant ERROR line — the #681 "regression" was a racy assertion #718/test(merchant): duplicate-guard harness needs an ndsctl on PATH — install the renewal fake #835/test(merchant): FiredOnce pinned the opposite of the wired contract — assert fire-exactly-once deterministically #836/fix(wireless_gateway_manager): recognize single-'!'-decorated SSIDs — #706's reader half #839/test(merchant): closeGateCleanup clears an abandoned close streak — the streak outlived the test that spent it #842) and this queue.
changelog-assemble.py check: 17 fragments, no findings;fold --dry-runclean;check-toolchain-parity.pygreen.
Rig runs still outstanding (handoff: /tmp/opencode/release-week/rig-handoff-wave3.md, quoted here for durability)
- Run A —
docker compose build --no-cache client killeron post-fix(cloud-lab): Dockerfile.client's GO_VERSION must be a global ARG — the client image cannot build from scratch #844 main; PASS = both images export, go-builder resolvesgolang:1.26.8-bookworm. Capture the parse-error control on pre-fix(cloud-lab): Dockerfile.client's GO_VERSION must be a global ARG — the client image cannot build from scratch #844 main once for the record. - Run B —
tests/cloud-lab/run-crash-injection.shto completion on post-fix(wallet,merchant): correlate NUT-07 answers by value; fsync journal directories after rename (#834) #840 main; PASS = the rel-793 acceptance (pending swap recovered + post-recovery payment 200). Exercises the dir-fsync journal paths across kill windows. - Caveat: ai-legion's docker-bridge DNS may need
network: host(lane-local, not part of any fix). - Deliberately not attempted: true power-cut durability of
fsync(dir)(kill ≠ power loss) — needs a power-controlled labgrid place or VM snapshot rollback.
Operational notes
- /tmp user quota breaks go builds under lane contention —
TMPDIR=$HOME/gotmp go test …works around it. - Upstream gonuts-tollgate v0.12.1 has zero fsync/Sync calls in non-test code (bbolt-only persistence): fix(wallet,merchant): correlate NUT-07 answers by value; fsync journal directories after rename (#834) #840's dir-fsync error-return semantics are this repo's own contract, recorded on the fix(wallet,merchant): correlate NUT-07 answers by value; fsync journal directories after rename (#834) #840 decision log (issuecomment-6101702010).
- The recent remote branch deletions were the contract: nothing refuses a direct CHANGELOG.md edit from a PR — the fragment convention is guidance without a fence #851 conflict remediation, not hygiene drift — re-push heals.
Review trail: #843/#844 wave3 reviews, #843 close record, #840 merge-record, approval asks (issuecomments 6092350810, 6092351042, 6106661992, 6106665143, 6106786703).
Activity
Amperstrand commentedon Oct 11, 2026
Fork-retirement delta (#758 migration, 2026-10-11 ~09:45): the queue was migrated to new PR numbers — #840 → #876, #728 → #861; #844 unchanged. The migration pushed stale heads over both staged branches: #876 opened at
ff0bc28(dropping the reviewed test-port commit), #861 at52c2f9a(the broad original its rewritten guard-only body explicitly disclaims). Both branches restored (08c015f1fast-forward,0a8079d1force) and verified; #876's auto-merge re-queued (squash, fires on review); #861 stays manual behind #844 per merge order. Continuation comments posted on both new threads. The blocker and resolution steps are unchanged — just with #876 in place of #840 in steps 2. Migration is active (batch through #878) — if heads move again, check for the same stale-push pattern before assuming intent.Amperstrand commentedon Oct 11, 2026
Update (11:0x): still zero approving reviews; all three branches verified intact through the ongoing migration (no re-clobber; #879 is the latest batch member). Two additions to the record:
Dockerfile.tollgate, manifest version match, fragment correct — land, no findings.Reminder for outreach: the policy needs one approving review from any write-access identity other than the author — felixfelix-bot or c03rad0r both satisfy it. Steps unchanged: approve #844 (fires queued squash, closes #724, unblocks #818's repro) → approve #876 (closes #834) → #861's one-line rebase + review.
Amperstrand commentedon Oct 11, 2026
wave3 addendum: completed a delta re-review of #846 (the last open merchant test PR) — both prior blockers resolved, verdict land (#846 (comment)). In the process, found and filed #882: a third stray-AUTH leak vessel with a deterministic 4-second repro (victim +
TestReceiveIntentIsDurableBeforeTheMoneyMoves), pre-existing on main and not covered by #846's drains — worth whoever owns the #733 soak ledger knowing the 1-in-8 has a third contributor. Queue PRs (#844/#876/#861) unchanged: zero reviews, branches intact.Amperstrand commentedon Oct 11, 2026
#876 MERGED (11:19,
6804ad7) — #834 CLOSED. The audit fix is on main with everything the disposition staged: value-correlation, symmetric dir-fsync error semantics (journal_durability.go), the ported shortfall test, and the conforming fragment (changelog.d/840-audit-hardening.fixed.md). Verified on main directly:TestCheckTokenSpent*green,changelog-assemble.py checkgreen (15 fragments). Wave3 verified this exact content pre-merge (full tollwallet-race45.4s; merchant full suite 373.8s on the simulated tree, now real).Queue status: 1 of 3 landed. Remaining:
Also filed since last update: #882 (third stray-AUTH vessel, deterministic repro, found during #846's re-review — #846 itself is verdict-land pending its review).
Amperstrand commentedon Oct 11, 2026
#844 MERGED (
bd2d7d4, 11:52Z) — #724 CLOSED. The cloud-lab lanes can build from scratch again and the #818 stop-ship repro is unblocked. (Merge mechanics: the auto-merge churn had desynced the PR head from the branch ref; cured with a re-sync commit — pattern documented on #861.)#861 rebased onto post-#844 main (
aa72d851) and the fence's planted-drift verdict is complete: red on the branch while main carried the bug → green immediately afterbd2d7d4— the fence demonstrably bites the class it fences. Closing evidence: #861 (comment)Queue status: 2 of 3 landed. Remaining: ONE approving review on #861 (guard-only, 15-file-free — a single Python contract check + fragment) and the wave3 disposition is fully retired.
Amperstrand commentedon Oct 12, 2026
Post-rc3 refresh (2026-10-12 evening): rc2 (#903) and rc3 (#907) shipped with the queue's three test/docs PRs still awaiting reviews — correct, none were release-blocking. All three are now refreshed onto the rc3 base and re-verified: #861 fence
944def8e(guard green), #846 drain6f14ae6b(battery green), #891 renamed8c3f8cd(now five drifted fragments — #907 added one; the credential series rewrote two bodies, preserved verbatim). #855 closes via #891. Everything remains one-click review-ready for the next session.Amperstrand commentedon Oct 23, 2026
Closing — the disposition queue DELIVERED its purpose: #844 merged; #840/#728 closed with their content migrated to the refreshed upstream PRs (#876/#861 per the retirement map); rc2 (#903) and rc3 (#907) shipped through the unblocked train. The refreshed test/docs PRs live in the standing owner queue (tracker #965).