fix(ci): verify canonical resource projection #84

Open

L0GYKAL wants to merge 3 commits from fix/canonical-simulation-resource-projection into main

pull from: fix/canonical-simulation-resource-projection

merge into: L0GYKAL:main

L0GYKAL:main

L0GYKAL:docs/k3s-debug-golden-additive

L0GYKAL:fix/pr119-preserve-descriptor-v2

L0GYKAL:feat/minecraft-public-layer4

L0GYKAL:docs/k3s-sim-golden-contract

L0GYKAL:docs/remove-premature-thornhill-rule

L0GYKAL:fix/local-rpm-package-closures

L0GYKAL:fix/vm-heavy-runner-admission

L0GYKAL:feat/minecraft-l4-contract

L0GYKAL:feat/k3s-spoke-ci-profile

L0GYKAL:fix/readonly-credential-idmap

L0GYKAL:fix/native-parity-timeout-120

L0GYKAL:fix/allow-auxiliary-published-images

L0GYKAL:fix/template-source-feed-contract

L0GYKAL:fix/simulation-network-grant-contract

L0GYKAL:fix/generic-spoke-workflow-contract

L0GYKAL:audit/merged-strict-contract

L0GYKAL:fix/canonical-spoke-debug-cache-contract

L0GYKAL:fix/debug-only-spoke-pr-gate

L0GYKAL:fix/retire-published-candidate

L0GYKAL:fix/blade-readback-space-compat

L0GYKAL:fix/post-publish-readback-space

L0GYKAL:fix/restore-release-auth-after-cache

L0GYKAL:fix/image-assembly-timeout

L0GYKAL:fix/nonroot-systemd-credential-bind

L0GYKAL:fix/strict-image-cache-registry

L0GYKAL:fix/restore-release-contract

L0GYKAL:fix/nested-index-readback

L0GYKAL:fix/nested-index-publication

L0GYKAL:fix/operator-local-cache-transport

L0GYKAL:fix/preserve-publication-digests

L0GYKAL:fix/preserve-registry-readback

L0GYKAL:fix/signed-tag-release

L0GYKAL:fix/publication-measurement-evidence

L0GYKAL:fix/verify-canonical-resource-copy

L0GYKAL:fix/staged-resource-projection

L0GYKAL:ci/nexus-k3s-selinux

L0GYKAL:fix/publication-template-binding

L0GYKAL:fix/publication-template-rust-env

L0GYKAL:fix/bounded-registry-readback

L0GYKAL:fix/oci-layout-root-selection

L0GYKAL:fix/digest-only-registry-readback

L0GYKAL:fix/http-registry-readback

L0GYKAL:fix/remove-publisher-broker

L0GYKAL:fix/release-report-emitted-image-set

L0GYKAL:ci/stable-release-gate

L0GYKAL:fix/config-only-runtime-enumerator

L0GYKAL:fix/config-only-empty-runtime

L0GYKAL:fix/nexus-rust-env

L0GYKAL:fix/ephemeral-vm-cleanup-contract

L0GYKAL:feat/admission-scheduler-readiness

L0GYKAL:feat/standardize-ci-contracts

L0GYKAL:docs/template-debug-contract

L0GYKAL:docs/adr-0033-task-scoped-publisher

L0GYKAL:docs/adr-0032-spoke-dependencies

L0GYKAL:ci/rust-producer-rules-checkout

L0GYKAL:docs/adr-0031-reserved-metadata

L0GYKAL:ci/writable-nexus-cargo-cache

L0GYKAL:ci/split-conformance-runners

L0GYKAL:ci/standardized-spoke-image-workflow

L0GYKAL:ci/0031-simulation-admission

L0GYKAL:fix/vendored-template-validator

L0GYKAL:docs/adr-template-ci

L0GYKAL:docs/adr0030-bib-materializer

L0GYKAL:ci/0030-prebuilt-golden-artifacts

L0GYKAL:ci/label-pulse-cold-start

L0GYKAL:ci/0027-authoritative-sim-plan

L0GYKAL:ci/optional-debug-images

L0GYKAL:ci/local-registry-publication

L0GYKAL:ci/0026-adaptive-nexus-memory

L0GYKAL:ci/0026-native-nexus-builds

L0GYKAL:ci/0025-resource-aware-bursts

L0GYKAL:ci/off-crucible

L0GYKAL:ci/0025-crucible-image-tiers

L0GYKAL:feat/spoke-conformance-and-oci-verification

L0GYKAL:ci/container-template-crucible-hostmode

L0GYKAL:docs/ci-0023-oci-spoke-config-bundle

L0GYKAL:docs/adr-0023-oci-spoke-config-distribution

L0GYKAL:docs/adr-0029-release-signing-flow

L0GYKAL:ci/howto-trigger-heavy-ci

L0GYKAL:ci/quadlet-only-host-mode

L0GYKAL:docs/adr-0025-rumdl

L0GYKAL:ci/lint-rumdl

L0GYKAL:docs/0028-distributed-worker-plane

L0GYKAL:ci/lint-runs-on-crucible-light

L0GYKAL:ci/lint-runs-on-crucible

L0GYKAL:feat/sim-test-tiers-allowlist

L0GYKAL:docs/adr-0026-api-error-envelope

L0GYKAL:ci/0025-runner-orchestrator

L0GYKAL:feat/spoke-ci-image-publish-template

L0GYKAL:adr/0024-watcher-local-spoke-image-builds

L0GYKAL:docs/adr-0011-s2-ci-pr-only-trigger

L0GYKAL:docs/adr-0023-spoke-runner-native-ci

L0GYKAL:ci/signed-tag-release-policy

L0GYKAL:docs/ci-log-howto-2026-06-11

L0GYKAL:docs/ci-log-access-guide

L0GYKAL:docs/adr-0011-s8-github-token-amendment

L0GYKAL:fix/spoke-ci-audit-clone-and-container-checks

L0GYKAL:docs/add-ci-log-access-to-index

L0GYKAL:feat/spoke-scaffolder

L0GYKAL:docs/adr-0011-amend-vfs-and-tag-gate-2026-06-12

L0GYKAL:fix/ci-0011-amendments-s4-s8-2026-06-10

L0GYKAL:feat/templates-and-stamper-in-the-rules-2026-06-10

L0GYKAL:fix/ci-0020-spoke-ci-test-mode-unit-2026-06-10

L0GYKAL:feat/adr-spoke-permissions-grant-2026-06-10

L0GYKAL:feat/index-and-subfolders-2026-06-10

L0GYKAL:feat/ci-0020-test-spoke-discriminator-2026-06-10

L0GYKAL:feat/adr-0022-amendments-per-operator-review-2026-06-10

L0GYKAL:feat/rule-21-declarative-reproducibility-2026-06-10

L0GYKAL:docs/adr-0012-amendment-band-0b-reality-2026-06-08

L0GYKAL:ci/lint-formatting-2026-06-08

L0GYKAL:docs/adr-0012-capacity-managed-ephemeral-runners-2026-06-08

Conversation 0 Commits 3 Files changed 5 +61 -8

L0GYKAL commented 2026-09-01 17:13:55 +02:00

Owner

Copy link

Require the canonical root simulation-resources.json in spoke OCI bundles, prove it is byte-identical to the checked-out source manifest, and continue rejecting every unrelated extra file. This aligns the shared verifier with the existing publication contract and adds behavioral regressions for valid, conflicting, and extraneous projections.

Require the canonical root simulation-resources.json in spoke OCI bundles, prove it is byte-identical to the checked-out source manifest, and continue rejecting every unrelated extra file. This aligns the shared verifier with the existing publication contract and adds behavioral regressions for valid, conflicting, and extraneous projections.

L0GYKAL added 1 commit 2026-09-01 17:13:56 +02:00

fix(ci): verify canonical resource projection 11e60b815a

L0GYKAL added 1 commit 2026-09-01 17:17:39 +02:00

test(ci): build canonical resource fixture adc4441f69

L0GYKAL added 1 commit 2026-09-01 17:27:55 +02:00

Merge remote-tracking branch 'origin/main' into fix/canonical-simulation-resource-projection ... 6aa8f03cb4

# Conflicts:
#	scripts/verify-oci-layout.py

All checks were successful

Hide all checks

lint / lint (pull_request) Successful in 41s

Details

lint / release-gate (pull_request) Successful in 0s

Required

Details

This pull request has changes conflicting with the target branch.

• scripts/assemble-quadlet-bundle.py
• scripts/tests/assemble-quadlet-bundle.test.py

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title Merge pull request 'fix(ci): verify canonical resource projection' (#84) from fix/canonical-simulation-resource-projection into main

Merge commit body Reviewed-on: https://forge.tala.family/L0GYKAL/the-rules/pulls/84

Merge pull request 'fix(ci): verify canonical resource projection' (#84) from fix/canonical-simulation-resource-projection into main Reviewed-on: https://forge.tala.family/L0GYKAL/the-rules/pulls/84 Copy merge commit message

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/canonical-simulation-resource-projection:fix/canonical-simulation-resource-projection

git switch fix/canonical-simulation-resource-projection

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

L0GYKAL/the-rules!84

No description provided.