Repository navigation
release: 0.8.0 — the quickstart points at images whose judge takes a ceiling, both sides of the action door carry its secret, and the demo fails when the loop does not close - #21
Merged
Conversation
…ceiling, and both sides of the action door carry its secret
The six image lines move from 0.7.1 to 0.8.0, pinned by the OCI index digests GHCR serves for the tags, read anonymously after the release run for the tag finished green on every job; :latest carries the same four.
0.8.0's investigator answers an unsigned approve with 503, and the pipe's baked config signs the press it forwards to the action door with HOOKPROBE_ACTION_SECRET. The from-source compose got the variable on both sides on 10-26; the quickstart did not, and the test pinning the pair read only docker-compose.yml. Pinned as it stood, the demo drew the approve button and the investigator refused both presses (checked: two 503s, the procedure stayed proposed). Both services now carry ${HOOKPROBE_ACTION_SECRET:-demo-card-secret}, and a new test parses both demo compose files service by service and requires the pipe's signing value to equal the investigator's; it fails with either side removed from the quickstart.
Run the way a stranger does, from an empty directory: pulled by digest, boards up, the demo's nine steps with the press executed, down -v. The judge loads its in-flight cap at 8 and its budget off.
With the action door unsigned on one side, 0.8.0's investigator refused both presses with a 503, the procedure stayed proposed, and demo.sh still ended 0 — a release check reading the exit code would have passed a quickstart whose approve never ran. When a press was accepted and the procedure is not executed, the demo says so with the log line to read and exits 1 after step 9, so the audit record still prints. Nothing approved, as on a second run inside the cooldown, stays a normal ending. Proven both ways on the 0.8.0 images: exit 0 with the secret, exit 1 without.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The quickstart's six image lines move from 0.7.1 to 0.8.0, pinned by digest as
docs/releasing.mdsays. The digests are the OCI index digests GHCR serves for the0.8.0tags, read anonymously after the release run for the tag finished green on every job;:latestcarries the same four.The quickstart needed one more change to keep its demo working on 0.8.0. 0.8.0's investigator answers an unsigned approve with 503, and the pipe's baked config signs the press it forwards to the action door with
HOOKPROBE_ACTION_SECRET. The from-source compose got that variable on both sides on 10-26 (84e5653, 63e285c); the quickstart did not, and the test that pins the pair read onlydocker-compose.yml. Pinned as it stood, the demo would have drawn the approve button and stopped at the press. Both services now carry${HOOKPROBE_ACTION_SECRET:-demo-card-secret}, and a new test parses both demo compose files service by service and requires the pipe's signing value to equal the investigator's. It was proven red with either side removed from the quickstart.The file's own comment says why it cannot point at an older tag: 0.8.0 is the first whose judge takes the in-flight cap and the opt-in dollar ceiling the file already sets, and whose investigator refuses an unsigned approve.
The demo now fails when the loop does not close. Checked with the secret removed from both sides, 0.8.0's investigator answered both forwarded presses with 503 and the procedure stayed
proposed, yetdemo.shended 0, so a release check that read the exit code would have passed a quickstart whose approve never ran. When a press was accepted but the procedure is notexecuted, the demo now says so with the log line to read and exits 1 after step 9, so the audit record still prints. Nothing approved, as on a second run inside the cooldown, is not a failure. Proven both ways on the 0.8.0 images: exit 0 with the secret and the procedure executed, exit 1 without it.Run the way a stranger does before this was opened, from an empty directory holding only the compose file and
scripts/demo.sh: the compose pulled all four images by digest, the three boards answered200within seconds, and the demo ran all nine steps. The judge still routes the demo's recovery as a recovery (ai 2, reuse 1, recovery 1) under 0.8.0's stricter recovery words, the card press executed both observations, and the recovery verified the work.demo exit=0;down -vremoved the containers, the volumes and the network.Read back from the running images: the judge loads its in-flight cap at 8 and its budget off with a 24-hour window, both services hold the action secret, the pipe and the judge carry certifi 2026.10.19, opentelemetry-api 1.45.1 and fastapi 0.161.1, and no image carries filelock.
Gate: STACK GATE GREEN locally; CI read back before merging.