ci: isolate new ordinary AMD64 image contracts from legacy pools

[infraclaw-dash]

Summary

Prevent a recipe rollout from mixing incompatible ordinary AMD64 runner images across active Platform branches. This is a CI-only prerequisite for the staged recipe in #5172, not a runner rollout or application change.

Read-only live checks on both Linux hosts and the separate NPM validation container prove that all three accept the current d272d01b… contract and reject the staged recipe with Runner image mismatch: recipe_revision. Merely adding the new image under existing rust-ci / kotlin-ci / npm-pr labels would let old and new branches land on incompatible images.

• Preserve generic labels only for the exact already-provisioned AMD64 fingerprint d272d01bcf3dfa620bbab1e9f31c3e1987862d33ec876bbad83c80f29de41a58.
• Route any different ordinary AMD64 contract to Linux/X64 and a full canonical-manifest fingerprint + kind label. New capacity must not carry the legacy generic labels. The key includes recipe, requirements and architecture, not just a similar tool version.
• Preserve current-head candidate selection, publisher provenance/digest checks, runtime verification, explicit ARM64 validation, fork policy and all application commands. New ordinary AMD64 contracts intentionally require X64 capacity; current legacy Rust retains the Mac-backed ARM64 pool.
• Document the separate-capacity rollout/rollback order. This PR does not create registrations, labels, images, volumes or credentials, or modify the permanent allocator/cleanup guards.

Validation

• Eight routing regression tests reproduce the premature generic routing on the old source, then pass with the repair; coverage includes all three kinds, unchanged application PRs on a new base, changed tool requirements with the old recipe, ARM64-change fallback, and explicit architecture routing.
• The full focused suite passes with both the current manifest and the staged PR5172 manifest as branch default. Historical publisher tests now load an explicit frozen legacy manifest fixture, rather than accidentally depending on a future branch default.
• Python syntax and git diff --check pass. Required hosted CI and independent owner/bot review remain required; local tests are not live execution proof.
• Current manifest and all workflow/application files are unchanged. Existing review heads in the other repair PRs are preserved.

Rollout boundary

Merge this scoped source repair only through normal protected review/CI gates. Before merging PR5172, first verify exact new immutable-image provenance and actual candidate Rust/Kotlin/NPM execution, stage separate compatible ordinary capacity with the new labels and unchanged isolation/repository scope, and verify the selector adoption. Keep old registrations/images available for older branches and heads. Missing compatible capacity should queue rather than silently use a different recipe.

Checklist

• I have performed a self-review of my own code
• I have added or updated relevant unit/integration/functional/e2e tests
• I have made corresponding changes to the documentation if needed
• Required independent owner/bot reviews and protected CI gates complete

PR Hygiene · 44384d7

• Bots — coderabbitai ✓ · thepastaclaw ✓
• Self-review — not asked of a bot author
• Within your 5 open PRs
• Build green
• Approvals
  • files with no dedicated owner (.github/ORDINARY_RUNNER_IMAGES.md, .github/scripts/runner-image.py, .github/scripts/tests/fixtures/legacy-runner-requirements.json and 2 more) — QuantumExplorer or shumkov

When every box is checked the PR Hygiene check passes and this can merge.

Summary by CodeRabbit

• New Features
  • Ordinary Linux/AMD64 jobs can use image pools matched to the runner image and job kind when the image differs from the legacy manifest.
  • Jobs continue to use existing generic labels for the legacy AMD64 image and ARM64. Work queues when no compatible capacity is available, rather than being assigned an incompatible image.
• Documentation
  • Added guidance for provisioning and validating separate runner capacity, preserving legacy capacity, and rolling back without assigning incompatible images. Runtime verification and pull request trust requirements are also documented.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: dashpay/platform/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 073fe73c-8e95-48a5-9bea-f617db349931

📥 Commits

Reviewing files that changed from the base of the PR and between 5915ac4 and 44384d7.

📒 Files selected for processing (1)

• .github/scripts/tests/test_runner_image.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The selector now uses fingerprinted, kind-specific ordinary labels for non-legacy AMD64 manifests. Legacy AMD64 and ARM64 retain generic labels. Tests cover routing cases and shared toolchain comparisons. Documentation describes the rollout sequence and source-change boundaries.

Changes

Ordinary Image Routing

Layer / File(s)	Summary
Ordinary label selection .github/scripts/runner-image.py, .github/ORDINARY_RUNNER_IMAGES.md	The selector uses generic labels for the pinned legacy AMD64 manifest and ARM64. Other manifests require linux/amd64 and receive labels keyed by manifest fingerprint and job kind. The selector uses these labels for fallback and the X64 Rust PR path. The documentation describes label requirements, rollout steps, rollback constraints, and source-change boundaries.
Routing regression coverage .github/scripts/tests/fixtures/legacy-runner-requirements.json, .github/scripts/tests/test_ordinary_image_routing.py	A pinned legacy requirements fixture supports tests for legacy and revised manifests, PR file changes, explicit architecture selection, and stable routing when manifest key order changes.
Shared toolchain comparison .github/scripts/tests/test_runner_image.py	Tests compare current AMD64 and ARM64 requirements and verify that a Java version change in AMD64 alone fails the shared-toolchain comparison.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 44384

Non-legacy AMD64 jobs require a compatible fingerprinted pool and queue if that capacity is unavailable, rather than using an incompatible image. No additional concrete merge risk is established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 44384

The new routing separates incompatible runner images rather than relaxing image checks. Its main remaining risk is operational: compatible new capacity must be provisioned and verified before the new contract becomes the branch default, or jobs will queue.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The scheduling change reaches ordinary Rust, Kotlin, and NPM jobs on branches and PRs using an AMD64 manifest, across any capacity assigned the matching labels. It does not itself expand runner registration scope or grant credentials.

Trust Boundaries and Controls

• observed — A PR changing AMD64 requirements does not acquire ordinary versioned labels merely by supplying a manifest: candidate selection checks PR-head agreement and trusted publication evidence. Matching a label alone does not replace runtime verification.

Resilience and Maintainability Implications

• inferred — Keeping the old and new pools distinct prevents an unavailable new image from silently routing work onto the old contract. Whether the separately provisioned pool and workflow verification meet the documented controls remains outside this source change.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 21 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: isolating new ordinary AMD64 image contracts from legacy runner pools.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

✅ Final review complete — no blockers (commit 44384d7) · triage: low

[thepastaclaw]

Final validation — Phase 1 + Phase 2

The ordinary AMD64 routing change preserves the existing candidate provenance checks and isolates non-legacy contracts as intended. All 41 focused Python tests and the range-level whitespace check pass, but the fixture conversion introduces one confirmed, non-blocking regression in the cross-architecture consistency test. Actual runner provisioning and execution were not validated locally.

🟡 1 suggestion(s)

1 finding(s) not shown inline (the lines are not part of this PR's diff)

🟡 Suggestion: Keep the cross-architecture consistency test on live manifests
.github/scripts/tests/test_runner_image.py:315-316

The setUp change makes self.manifest a frozen legacy fixture, so this test now compares historical AMD64 requirements against the live ARM64 requirements instead of comparing the two current contracts. I reproduced both consequences by mocking manifest reads: setting java_major to 21 in both live manifests fails with '17 != 21', while changing only the live AMD64 manifest incorrectly passes. The frozen fixture is appropriate for historical publisher and routing tests, but this consistency test must load the live AMD64 manifest directly. This is a non-blocking test-coverage regression under the review severity policy; it does not change runtime routing or consensus behavior.

        amd = runner.read_manifest(ROOT / runner.MANIFEST)["requirements"]
        arm = runner.read_manifest(ROOT / runner.ARM64_MANIFEST)["requirements"]

_{source: glm-5.3-flash (phase1-reviewer: general, architecture-layering, security-auditor); gpt-6-astra (phase2-reviewer: general)}

Review provenance

Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: general); reviewer 2: glm-5.3-flash (agent: phase1-reviewer, role: architecture-layering); reviewer 3: glm-5.3-flash (agent: phase1-reviewer, role: security-auditor); reviewer 4: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 5: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); reviewer 6: gpt-6-astra (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: low by gpt-6-astra (effort low) — The diff makes a small, contained CI routing change to select fingerprint-specific AMD64 runner labels while preserving legacy and ARM64 paths, with focused regression tests and no changes to critical application surfaces.
• Phase 1 reviewers: glm-5.3-flash — general (completed, effort high); agent phase1-reviewer, glm-5.3-flash — architecture-layering (completed, effort high); agent phase1-reviewer, glm-5.3-flash — security-auditor (completed, effort high); agent phase1-reviewer
• Phase 1 model: glm-5.3-flash — zai quota: 5h 87% left, weekly 91% left; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 13% left, 5h 100% left)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort medium); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort medium); agent phase2-reviewer, gpt-6-astra — security-auditor (completed, effort medium); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `.github/scripts/tests/test_runner_image.py`:
- [SUGGESTION] .github/scripts/tests/test_runner_image.py:315-316: Keep the cross-architecture consistency test on live manifests
  The setUp change makes self.manifest a frozen legacy fixture, so this test now compares historical AMD64 requirements against the live ARM64 requirements instead of comparing the two current contracts. I reproduced both consequences by mocking manifest reads: setting java_major to 21 in both live manifests fails with '17 != 21', while changing only the live AMD64 manifest incorrectly passes. The frozen fixture is appropriate for historical publisher and routing tests, but this consistency test must load the live AMD64 manifest directly. This is a non-blocking test-coverage regression under the review severity policy; it does not change runtime routing or consensus behavior.

Out-of-scope follow-up suggestions (1)

These are valid observations, but they are outside this PR's scope and should be handled in separate issues or author/maintainer-requested PRs rather than blocking this review.

• ARM64 ordinary pool still routes via generic labels — Outside scope and intentionally unchanged: the PR explicitly preserves ARM64 provisioning and validation behavior. Extending fingerprinted ordinary pools to a future ARM64 rollout is an adjacent design task, not a current regression or an exceptional follow-up requiring review output.
  • Follow-up: Consider creating a separate issue or author/maintainer-requested PR for this.

[infraclaw-dash]

Fixed the live-manifest consistency regression in 44384d7136b1b9bd5328476300d2903152aa06a6. Independently reproduced both reported outcomes before the correction: one-sided current AMD64 drift was missed, while matching current AMD64/ARM64 changes failed against the historical fixture. The consistency check now explicitly loads BOTH current manifests; frozen publisher fixtures remain in the historical routing tests.

Two committed regression tests fail before the fix and pass afterward. All 43 focused CI-script tests pass with both the current manifest and staged PR5172 recipe, plus Python syntax and diff checks. The incremental diff is one CI test file only; no application test, runtime selector, manifest, workflow permission, runner registration or trust boundary changed.

This is an ordinary fast-forward of the existing repair branch. Prior-head reviews are not counted as current-head coverage. Fresh hosted CI/independent review, owner approval, real candidate execution and compatible ordinary capacity remain required; PR5172 merge holds remain intact.

[thepastaclaw]

Re-review — Final validation — Phase 1 + Phase 2

The selector correctly preserves legacy generic labels only for the exact provisioned AMD64 manifest and routes other ordinary AMD64 jobs to full-manifest, kind-specific Linux/X64 labels while preserving candidate and ARM64 paths. The focused 43-test suite, Python syntax checks, and diff validation pass at the exact reviewed head; no in-scope defects remain.

🔴 0 blocking | 🟡 0 suggestion(s) | 💬 0 nitpick(s)

Review provenance

Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: general); reviewer 2: glm-5.3-flash (agent: phase1-reviewer, role: architecture-layering); reviewer 3: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 4: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); reviewer 5: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 6: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: low by gpt-6-astra (effort low) — The behavioral change is a small, contained CI runner-selection update keyed by an exact manifest fingerprint, with focused regression tests and no changes to application logic or critical surfaces.
• Phase 1 reviewers: glm-5.3-flash — general (completed, effort high); agent phase1-reviewer, glm-5.3-flash — architecture-layering (completed, effort high); agent phase1-reviewer
• Phase 1 model: glm-5.3-flash — zai quota: 5h 99% left, weekly 90% left; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 13% left, 5h 100% left)
• Fresh final gate: an independent Phase-2 review ran after iterative findings were reconciled
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort medium); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort medium); agent phase2-reviewer, gpt-6-astra — general (completed, effort medium); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort medium); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify the current code and confirm that no unresolved issues remain.

No unresolved findings remain from the prior review on this head.

[infraclaw-dash]

@coderabbitai review

Ordinary included review request for exact head 44384d7136b1b9bd5328476300d2903152aa06a6, after the previously reported included-review window and a fresh check for newer quota receipts. Please review the correction to the live AMD64/ARM64 manifest consistency regression; both new adversarial cases failed before the fix, and 43 focused CI tests pass with both legacy and staged manifests. Thepastaclaw has completed review of this exact head. This is not a priority or premium request. Independent owner approval, compatible ordinary capacity, downstream adoption and actual candidate execution remain separate required gates.

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[github-actions]

Ready for review — needs QuantumExplorer or shumkov.
Full checklist in the description.