diff --git a/quest/m0/host-land/README.md b/quest/m0/host-land/README.md index e8a1f648..1687a5ac 100644 --- a/quest/m0/host-land/README.md +++ b/quest/m0/host-land/README.md @@ -111,4 +111,3 @@ can hand off instead. - [Gate host](/quest/m0/host-land/host.md) - kixelated/nixos runs the daemon as its own user, checks in nspawn containers, and retires the Actions runner - [Fixer proxy access](/quest/m0/host-land/fixer.md) - connect the nixos fixer container to CLIProxyAPI with the gate client key and maintainer login - [Fixer TLS](/quest/m0/host-land/fixer-tls.md) - the fixer's container trusts public certificates, so workerd and the Worker tests run there -- [Pushed heads get a check](/quest/m0/host-land/pushed-head-ci.md) - the gate dispatches or reports the required checks on heads it or its fixer pushed diff --git a/quest/m0/host-land/pushed-head-ci.md b/quest/m0/host-land/pushed-head-ci.md deleted file mode 100644 index 3b1f25ad..00000000 --- a/quest/m0/host-land/pushed-head-ci.md +++ /dev/null @@ -1,32 +0,0 @@ -# [S] The gate gets a check on heads it pushes - -## Goal - -When the host gate (`quest land serve`) or its fixer pushes a new head to a -queued PR's branch, the base's required checks run on that head, and a head -whose required check never starts is reported instead of held silently. - -## Plan - -Decided 2026-11-02 (maintainer, /quest-plan of the follow-ups from the -2026-11-02 `/quest-complete` session): ✅ plan it, m0. - -Seen 2026-11-02 on moq-dev/quest: -[#342](https://github.com/moq-dev/quest/pull/342)'s head `aa87d974` -("quest land: merge tested base", pushed by moq-bot) and -[#338](https://github.com/moq-dev/quest/pull/338)'s `2f7aa77f` (a land fixer -merge) got no workflow run at all, so the required `check` never reported -and the gate held both for 13 hours with a "required check is still pending" -comment. Dispatching `check.yml` on their branches fixed it. - -- First find why those pushes started no `pull_request` run. An App - installation token's push normally triggers workflows, so check how the gate - and the fixer push (credential, remote, `--no-verify`-like options) and - whether GitHub recorded a skipped or approval-required run. -- Then make the gate get a check on any head it pushed: dispatch the base's - required workflows that support `workflow_dispatch` on the head branch after - the push, or, where none can be dispatched, report the stall once with what - to run, rather than waiting forever. -- This is a fix the gate needs while moq-dev/quest, moq.pro, rust2 and rind - still land through it, within the [queue watcher](/quest/m0/queue-watcher/README.md) - epic's freeze on gate improvements. diff --git a/quest/m0/kix/sandbox/README.md b/quest/m0/kix/sandbox/README.md index 07fa398f..712d87b1 100644 --- a/quest/m0/kix/sandbox/README.md +++ b/quest/m0/kix/sandbox/README.md @@ -78,3 +78,4 @@ Shipped in [moq-dev/quest#212](https://github.com/moq-dev/quest/pull/212) ## Required - [Head approval](/quest/m0/kix/sandbox/head-approval.md) - a maintainer approves an exact head, such as one kix pushed, for host runners +- [Boundary test in CI](/quest/m0/kix/sandbox/live-test.md) - the opencode sandbox's hostile-repository test runs on Linux CI with a scripted model diff --git a/quest/m0/kix/sandbox/live-test.md b/quest/m0/kix/sandbox/live-test.md new file mode 100644 index 00000000..4db1e813 --- /dev/null +++ b/quest/m0/kix/sandbox/live-test.md @@ -0,0 +1,33 @@ +# [S] The opencode sandbox's boundary test runs in CI + +## Goal + +The opencode sandbox's hostile-repository boundary test is checked in as +`test/live/runner-sandbox.test.ts`, drives opencode and srt with a scripted +model, and runs on Linux in this repository's checks, on `main` and in the +merge group. An srt or opencode bump that weakens the boundary fails CI +before it lands. + +## Plan + +Decided 2026-11-02 (user, /quest-plan of +[moq-dev/quest#338](https://github.com/moq-dev/quest/pull/338)'s suggested +follow-ups): + +- How it runs: + - ✅ CI on Linux: a scripted model needs no login and spends no usage + - A manual recipe, like `just review-sandbox` +- Milestone: ✅ m0 · m1 + +#338 ran the test by hand against srt 0.0.79. Merging main moved srt to +0.0.81, which the maintainer accepted from the release notes and a direct +srt run, without rerunning the full test. The checked-in test covers what +that run did: a checkout that tries to read a denied file, write outside the +checkout and attempt directory, create `.opencode/plugin`, `opencode.json` or +`opencode.jsonc`, and reach the network. Each attempt is refused, and nothing +is left behind in the checkout. Follow `test/live/review-sandbox.test.ts` +for the layout. Since this test needs no login, it runs without +`QUEST_LIVE`, skipping only where srt can't run (macOS and Windows). + +[opencode 2.x](/quest/m0/opencode-sdk.md) reruns the boundary test on 2.x; +with this quest done, that rerun is this test. diff --git a/quest/m0/merge-driver-upkeep.md b/quest/m0/merge-driver-upkeep.md index 9453e6da..75bc58c1 100644 --- a/quest/m0/merge-driver-upkeep.md +++ b/quest/m0/merge-driver-upkeep.md @@ -32,3 +32,11 @@ Decided 2026-11-01 (user, /quest-plan of the follow-ups from the added the `quest-pinned` input, which only a manual `nix flake update quest-pinned` bumps. Pick how it stays current, such as Dependabot's nix updates, a step in the release checklist, or a recurring quest, and do it. +- Bump `quest-pinned` now (decided 2026-11-02, user, /quest-plan of the + follow-ups from that day's `/quest-complete` session): the dev shell's + `quest` still reads a leftover `quest:merge` label as a hold, which current + `quest` no longer does. In that session it reported 25-hour-old holds on + [moq-dev/quest#342](https://github.com/moq-dev/quest/pull/342), + [#338](https://github.com/moq-dev/quest/pull/338) and + [#324](https://github.com/moq-dev/quest/pull/324) that the checkout's + `quest iterate` ignored. diff --git a/quest/m0/opencode-sdk.md b/quest/m0/opencode-sdk.md index efa4b34d..955b199e 100644 --- a/quest/m0/opencode-sdk.md +++ b/quest/m0/opencode-sdk.md @@ -57,3 +57,7 @@ What the change does: - Run the runner's live opencode checks that the [Kix decision UI](/quest/m0/kix/README.md) rehearsal lists, if a runner is available. + +## Required + +- [Boundary test in CI](/quest/m0/kix/sandbox/live-test.md) - the boundary test this quest reruns on 2.x is checked in and runs in CI diff --git a/quest/m0/queue-watcher/README.md b/quest/m0/queue-watcher/README.md index e9788c01..4293c5b7 100644 --- a/quest/m0/queue-watcher/README.md +++ b/quest/m0/queue-watcher/README.md @@ -134,6 +134,7 @@ Shared shape, for the children to follow: - [Flaky failures](/quest/m0/queue-watcher/flaky.md) - a flaky failure is re-enqueued unchanged, and a test seen flaking twice is disabled in a separate PR with a follow-up quest - [Watcher on the host](/quest/m0/queue-watcher/host.md) - kixelated/nixos runs the watcher for moq-dev/moq beside its fixer container - [The other repositories follow](/quest/m0/queue-watcher/follow.md) - condition: moq's queue is proven; then moq-dev/quest switches and the others plan theirs +- [Harden the queue runners](/quest/m0/queue-watcher/runners.md) - each queue runner runs only its repository's queue workflow, and every outside fork PR needs approval - [Retire the batching gate](/quest/m0/queue-watcher/retire.md) - once no repository lands through `quest land serve`, its batching code and host units go ## Related diff --git a/quest/m0/queue-watcher/follow.md b/quest/m0/queue-watcher/follow.md index fd5f0702..8faa4350 100644 --- a/quest/m0/queue-watcher/follow.md +++ b/quest/m0/queue-watcher/follow.md @@ -20,6 +20,14 @@ those workflows land: - Keep the existing picks and their head SHAs; do not pick previously unqueued PRs or a head that moved after approval. +- Remove the leftover `quest:merge` labels from the old gate first, such as + those on [moq-dev/quest#324](https://github.com/moq-dev/quest/pull/324) and + [moq-dev/rust2#446](https://github.com/moq-dev/rust2/pull/446), + [#442](https://github.com/moq-dev/rust2/pull/442) and + [#437](https://github.com/moq-dev/rust2/pull/437), none of which has + auto-merge armed. An older pinned `quest` still reads them as holds + (decided 2026-11-02, user, /quest-plan; the pin itself is + [Merge driver upkeep](/quest/m0/merge-driver-upkeep.md)'s). - Require `Queue` and a serialized squash merge queue in each `main` ruleset, replacing `quest land` and the old PR-side checks. Keep the administrator emergency bypass; remove the fixer's direct-merge bypass. diff --git a/quest/m0/queue-watcher/runners.md b/quest/m0/queue-watcher/runners.md new file mode 100644 index 00000000..1b19950f --- /dev/null +++ b/quest/m0/queue-watcher/runners.md @@ -0,0 +1,41 @@ +# [S] Harden the merge-queue runners + +## Goal + +The self-hosted `quest-queue`, `rind-queue` and `rust2-queue` runners that +[kixelated/nixos#19](https://github.com/kixelated/nixos/pull/19) adds run only +their own repository's merge-queue workflow, and nothing else on the host +reaches them: + +- kixelated/nixos's quest-land module creates no check launcher, users, + networks, kvm access or storage tagging for a repository in watch mode. +- Each runner group admits only its repository's + `.github/workflows/queue.yml`. +- moq-dev/quest, moq-dev/rind and moq-dev/rust2 require approval before + running workflows from any outside contributor's fork PR, not only a + first-time contributor's (moq-dev/quest was `first_time_contributors` on + 2026-11-02). + +## Plan + +Decided 2026-11-02 (user, /quest-plan of the follow-ups from Claude's review +of kixelated/nixos#19 in that day's `/quest-complete` session): ✅ all three +items, m0, ranked right after the [cutover](/quest/m0/queue-watcher/follow.md). + +- Watch-mode cleanup: the review found the base branch + ([kixelated/nixos#16](https://github.com/kixelated/nixos/pull/16)) already + creates check sockets and users for moq in watch mode, which only that + repository's daemon user can reach. Gate them on `quest land serve` mode. +- Runner groups: #19 puts each runner in its own group, limited to its one + repository. Limit each group to its repository's `queue.yml` too, through + the org's runner group settings (`restricted_to_workflows`). +- Fork approval: a returning contributor's fork PR runs its own copy of the + workflows, which can name a self-hosted label. Set each repository's + `fork-pr-contributor-approval` policy to all outside contributors. Do this + no later than the cutover registers the runners, if it's still open then. +- Verify by checking that a fork PR's workflow waits for approval, and by + listing each group's allowed workflows. + +## Related + +- [Watcher on the host](/quest/m0/queue-watcher/host.md) - the host module these runners and daemons share