ci: stage reviewed AMD64 recipe for candidate validation

[ktechmidas]

Assistant-authored CI work: infraclaw opened this PR through the protected Gateway GitHub write route explicitly authorized for the overnight CI goal. The account attribution is the credential transport, not a personal review, approval, or statement by that account owner. Independent owner/bot review and the capacity merge hold below remain required.

Summary

Stage the already reviewed and merged AMD64 runner recipe from dashpay/dash-selfhosted-image#9 for real Platform candidate validation. This PR changes only .github/runner-requirements.json's recipe_revision to 1be03edb7f4f18548d525b17dfac6ee31db17c99. All tool versions, signed snapshot/package pins, architecture, Android requirements and the ARM64 manifest are unchanged.

This is infraclaw's scoped CI-infrastructure work under latte's active overnight reliability request. The source commit was reviewed and passed AMD64 confinement, disposable release isolation, KVM/emulator, OCI transport, native ARM64 and controller tests before its normal merge. It adds bounded signed-snapshot download retries; it does not make dependency failures successful.

Candidate validation and trust boundary

This reviewed one-file change is proposed on a new same-repository branch so existing candidate admission can validate real Rust/Kotlin/NPM jobs. No fork is newly trusted; no runner label, policy, allocator, registration, cleanup guard, permission or application test is changed. The permanent allocator owns any eligible assignments and cleanup. No second allocator or old PR5151 worker is involved.

The live target currently pins the previous trusted controller 7d901150; this PR does not replace that orchestration from PR data. Controller adoption is separate in #5171. A candidate still must pass the exact-manifest, confinement, KVM, OCI and trusted publication gates before any job can use its immutable digest. Nothing here is a claim of live reuse or completed JIT execution.

Verification and explicit merge hold

• The locked requirements exactly match the merged image source; the only manifest difference is the immutable recipe revision.
• Local focused runner/release-boundary tests, manifest validation and diff checks passed. Required hosted checks and actual candidate jobs remain to be observed.
• This PR must not merge until normal required owner/bot review and CI gates pass AND compatible ordinary AMD64 capacity is staged and verified. Changing the base recipe prematurely would fail exact-contract verification on existing ordinary runners. No ordinary runner has been changed by opening this PR.
• Keep this branch current only through reviewed, narrowly scoped changes. Do not bypass protected merge gates or turn application failures green.

Live ordinary-capacity audit (2026-09-29 04:51 UTC)

All three existing AMD64 containers (both ordinary Linux runners plus the separate NPM validation runner) accepted the current exact manifest and rejected this staged recipe with Runner image mismatch: recipe_revision. Their images/labels/registrations were left unchanged. A new image must not share generic labels with old branches. The separately scoped selector/coexistence repair is #5174; it preserves old pools and routes new ordinary AMD64 contracts by full manifest fingerprint. Its full focused suite passes with both manifest defaults, but it is not merged or live capacity proof. This recipe merge hold remains: normally adopt safe routing and verify separate compatible ordinary capacity before merging.

Checklist

• I have performed a self-review of my own code
• I have added or updated relevant unit/integration/functional/e2e tests (existing contract suite validates the one-field recipe update; real candidate CI is required)
• I have made corresponding changes to the documentation if needed (staging and merge hold documented here)
• Actual candidate Rust/Kotlin/NPM execution and terminal/cleanup evidence recorded
• Compatible ordinary AMD64 capacity staged before merging
• Required independent owner/bot reviews and ordinary protected merge gates complete

PR Hygiene · 2c25cdf

• Bots — coderabbitai ✓ · thepastaclaw ✓
• Self-review — post /self-reviewed
• Build green
• Approvals — you own every area touched; none needed

When every merge requirement is met, the PR Hygiene check passes. Reviewer limits do not block merging; other required GitHub checks and protections still apply.

Summary by CodeRabbit

• Chores
  • Updated the revision used by the project’s automated build and validation environment. Other environment requirements are unchanged.
  • No changes to product features, functionality, or user-facing content are included in this update.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: dashpay/platform/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 79c1be38-412e-43f9-9562-8ae6a2be6569

📥 Commits

Reviewing files that changed from the base of the PR and between c5128f0 and 2c25cdf.

📒 Files selected for processing (1)

• .github/runner-requirements.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The runner requirements file now pins recipe revision 1be03edb7f4f18548d525b17dfac6ee31db17c99. All other runner requirements remain unchanged.

Changes

Runner requirements

Layer / File(s)	Summary
Update recipe revision pin .github/runner-requirements.json	The pinned recipe_revision value changes to 1be03edb7f4f18548d525b17dfac6ee31db17c99.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: quantumexplorer

Merge Risk: ⚪ Minimal · up to 2c25c

No actionable merge-blocking risk is established. Complete the required CI and candidate validation checks before merging.

Architecture Summary

Architecture risk: 🔵 Low · up to 2c25c

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/runner-requirements.json: Updated the pinned recipe_revision value from e49e8bc9977f5f961a76ba1d1f7673c72173679f to 1be03edb7f4f18548d525b17dfac6ee31db17c99.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes staging the reviewed AMD64 recipe for candidate validation, which matches the change to recipe_revision.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

✅ Final review complete — no blockers (commit 2c25cdf) · triage: low

[thepastaclaw]

Final validation — Phase 1 + Phase 2

At head 2c25cdf, the complete diff changes only the AMD64 recipe revision; manifest validation, all 33 local runner-image/release-boundary tests, and the diff whitespace check pass. The unchanged selector requires exact-manifest matching and trusted candidate publication, while controller selection remains independently pinned; no in-scope defect was confirmed. This approval does not establish upstream review or recipe correctness, successful live candidate execution, or ordinary AMD64 capacity readiness, and does not lift the PR's explicit pre-merge holds.

Review provenance

Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: general); reviewer 2: glm-5.3-flash (agent: phase1-reviewer, role: architecture-layering); reviewer 3: glm-5.3-flash (agent: phase1-reviewer, role: security-auditor); reviewer 4: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 5: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); reviewer 6: gpt-6-astra (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: low by gpt-6-astra (effort low) — The diff changes only one immutable AMD64 runner recipe revision, a small and contained CI update with potential runner compatibility effects but no changes to application logic or critical surfaces.
• Phase 1 reviewers: glm-5.3-flash — general (completed, effort high); agent phase1-reviewer, glm-5.3-flash — architecture-layering (completed, effort high); agent phase1-reviewer, glm-5.3-flash — security-auditor (completed, effort high); agent phase1-reviewer
• Phase 1 model: glm-5.3-flash — zai quota: 5h 89% left, weekly 91% left; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 13% left, 5h 100% left)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort medium); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort medium); agent phase2-reviewer, gpt-6-astra — security-auditor (completed, effort medium); agent phase2-reviewer

[github-actions]

Bots are done — your move: post /self-reviewed.
Full checklist in the description.

[infraclaw-dash]

Exact candidate host preflight — not a CI pass or merge clearance

Independent validation of this exact head 2c25cdf6c30ac2fc256390a6faef55e5464241f5 and published candidate sha256:866b47cf95f2ec1bf6ba5781567560c4f1ce5ae9e2fae0ca6cc28dcd2a337900 finished on both physical Linux hosts at 06:23 UTC:

• The deployed host's image/provenance and argument gates accept all three Rust/Kotlin/NPM work orders.
• Real credential-free, network-isolated containers pass the exact manifest contract, nonroot confinement, fresh named-storage ownership, KVM VM creation and Android API35 emulator boot. Missing-JIT startup intentionally refuses with exit1.
• Every uniquely owned probe container and volume is removed. The immutable image cache is retained. No runner was registered, no JIT was issued, and no application job or ordinary registered capacity was proved.

The actual Rust job109269719154, NPM job109269798258 and Kotlin job109269806677 are still queued, attempt1. The allocator installation is missing its reviewed support data file client-codegen/lock.json, so its manifest validation fails before admission. An exact-file, fail-closed repair is prepared and independently tested, but safe application requires pausing/restoring the existing allocator in the authorized administrator context. No running script was patched and no second allocator was started.

A separate local-only integration check on current v4.2 base e159f382b5f5b9d6c438f82a0051a8471b26a6b2 applies the existing CI-only diffs from #5165, #5168, #5171, #5174 and this PR without conflicts: 47 tests pass with both legacy and staged manifests, plus YAML/Python syntax and diff checks. This is not an upstream merge, new review coverage, target adoption or a combined merge proposal.

All existing merge holds remain: normal independent reviews/owner gates, safe selector adoption, compatible registered ordinary capacity, and real candidate job outcomes plus cleanup. No GitHub check or review state has been changed by these probes.