Feat/ci check baton - #31
Conversation
…ss the mesh The first CI-check Baton: an estate CI check that runs on owned compute (zero GitHub Actions minutes), is routed only to a node with the required capability, and whose verdict is frozen + HMAC-attested into a portable envelope that other nodes verify without re-execution. This is the bag-of-actions answer to the Actions billing wall — the check GitHub would refuse to start runs anyway. Wired across all three layers (per the "always wire first" rule): - Idris (source of truth): add Zig/Rust/Cargo/Deno toolchain capabilities to Protocol.capToTag and mirror them in the Estate manifest. Fix three pre-existing build breaks so `idris2 --build bag.ipkg` is green again (List.find -> import Data.List; with-clause shorthand; non-linear patterns in handoffPreservesLinearity) — mechanical, no change to what the proofs assert. - Zig host: CheckBaton with freeze/thaw + HMAC-SHA256 attestation; check / thaw / nodes subcommands; fail-safe match (an unknown/unprovable capability never matches). - Elixir: Bag.CiBaton, Executor.run_check/thaw_check/list_nodes, Bag.Mesh .submit_check (routes through the orchestrator to a capability-matched node, reading the node list from the single mirrored manifest), Bag.CiSweep batch emitter (the entry point hypatia/ci-health will call). Tests: 6 Zig (incl. tamper-detection) + 11 Elixir (incl. mesh routing + sweep), all green; Idris package builds. Demo: scripts/ci-baton-demo.sh. Design doc: docs/ci-check-baton.adoc. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
… local half) Wire Bag.CiSweep into a real, invocable tool — `mix bag.sweep [manifest.exs]` — so the emitter has an actual entry point (not just a library function). It runs estate CI checks as Batons on owned compute (zero GitHub Actions minutes) and: - emits ci-health-compatible TSV on stdout: check_id<TAB>BATON-<VERDICT><TAB>node - prints a human summary on stderr - exits 0 if every check passed, 1 otherwise (a CI gate) ci-checks.exs is the dogfood manifest: bag-of-actions runs its OWN checks (zig fmt, zig build test) as Batons — proven green by ci_sweep_manifest_test. This is the bag-of-actions end of the hypatia/ci-health bridge. The hypatia-side caller (a script that invokes this tool and folds Baton verdicts into the estate report) is a separate, push-gated change. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
… clean) Integration with the ci-health baton-bridge surfaced that Bag.Mesh.submit_check logged routing/verdict lines to stdout, polluting the machine-readable TSV that mix bag.sweep emits. Operational logs now go to stderr; stdout stays a clean contract. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
…tion gate, residue Adopt the on-point subset of the typed-orchestration design frame (the rest is split out to hypatia + a budget-planner via dev-notes/prompts). Keeps bag-of-actions focused on compute routing rather than becoming a generic orchestrator. - Node carries a tropical (min-plus) money `cost` grade, mirrored across the three layers: Estate.idr (source of truth) + estate.zig + the `nodes` output (`name<TAB>cost`), read by Executor.node_costs/0. Idris adds `cheapestCapable` as the formal routing objective the Elixir planner mirrors. - Bag.Budget: typed, NON-FUNGIBLE budgets (money/mutation/human_review/repair) — exhausting one dimension is a context change that removes a route. - Bag.Planner: among capable nodes the budget can afford, pick the cheapest (tropical min); reserve the paid route for work whose capability only it has; gate mutating/irreversible work on a verifier. - Bag.ActionResult: structured residue (echo) — a relegated pass still owes the GitHub required-status-check; a dirty partial yields a repair obligation. - Bag.Mesh.submit_planned wires Planner -> execute -> residue end to end. Tests: Idris builds; 6 Zig; 19 Elixir + 1 doctest — all green. Covers "paid budget too low -> work needing it suspends, cheap route remains", "cheapest-capable relegation", "mutation rejected without verifier", "non-fungible dimensions", and "dirty partial -> repair obligation". Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ Approved 3 resolved / 3 findingsIntroduces a capability-routed CI-check Baton system with HMAC attestation and mesh integration, but attestation silently falls back to a hardcoded public key when the environment variable is unset. ✅ 3 resolved✅ Security: Attestation silently falls back to a hardcoded public key
✅ Edge Case: Fail-path tests depend on src/estate.zig being permanently misformatted
✅ Quality: Freeze path derived only from check_id risks concurrent overwrites
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
Signed-off-by: Jonathan D.A. Jewell <[email protected]>
1 participant
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers
Summary by Gitar
CheckBatoninsrc/main.zigwith HMAC-SHA256 attestation, freeze, and thaw supportBag.CiBaton,Bag.CiSweep, and mesh integration inbag/lib/bag/mesh.ex.zig,.rust,.cargo,.deno) and tropical costs across Zig and Idris proofsscripts/ci-baton-demo.sh,ci-checks.exs, comprehensive AsciiDoc documentation, and a newJustfileThis will update automatically on new commits.