feat(canary,ha-proof): adopt liveness selector revision

[kyle-sexton]

Summary

Internal-consumer follow-through for the liveness selector (ci-workflows#86, merged at 3415de3):

• local-runner-canary.yml + production-ha-proof.yml: selector pin 66e3e97 → 3415de3ff2fafee40e4d087eb6073d2f6952b595; direct-output assertions adapted from idle semantics (reason=idle, idle-runner-count) to liveness semantics (reason=online, online-runner-count). Topology proofs keep their own REST-derived idle counts — only the selector contract changes.
• production-ha-proof.cjs drain-hold: SELECTED_IDLE_COUNT → SELECTED_ONLINE_COUNT, reason gate idle → online; generated workflow blocks re-rendered (--check clean).
• Canary preflight rerun-guard message updated — reruns no longer route hosted; the guard stays because proof evidence wants a fresh dispatch.
• Private-caller templates repinned to the new implementation commit 169e3a4 (two-commit flow: implementation first, then repin referencing its SHA, matching the existing pin-fetch pattern in ci.yml).

Test plan

• node --test .github/scripts/*.test.cjs: 169 pass, 0 fail (includes pinned-revision contract tests via git show 169e3a4).
• render-production-ha-proof-workflow.cjs --check: clean.
• Live canary/HA-proof dispatches happen under github-iac#79 acceptance (fleet online/offline routing evidence).

Part of melodic-software/github-iac#79, epic melodic-software/github-iac#78.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EPDbXgonTuFwFwdTtHaCmw

---

Note

Medium Risk
Changes pinned self-hosted routing contracts for acceptance workflows; misalignment with fleet or selector behavior could block canary/HA proof until live acceptance runs.

Overview
Adopts the liveness select-runner revision (3415de3) in local-runner-canary.yml and production-ha-proof.yml, replacing the prior pin. Canary and production validation now require selector outputs with reason=online and online-runner-count instead of idle semantics; REST topology inventory in HA proof still uses its own idle/online counts from the API.

production-ha-proof.cjs and the generated workflow embeds use SELECTED_ONLINE_COUNT and the same reason gate; private seed templates and contract tests repin the reviewed implementation commit 169e3a4, with ci.yml fetching that SHA for pinned-revision tests. Canary preflight copy clarifies that attempt 1 is still required for evidence quality, not because reruns force hosted routing.

^{Reviewed by Cursor Bugbot for commit e7376e3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_15f32e0d-994d-415f-a341-1e0b468ee92e)

[claude]

Claude finished @kyle-sexton's task in 1m 59s —— View job

---

PR Review: feat(canary,ha-proof): adopt liveness selector revision

• Gather PR diff and changed files
• Review workflow YAML changes (canary + HA-proof)
• Review CJS script changes (production-ha-proof.cjs)
• Review test changes
• Review template repins
• Review README changes
• Post findings

---

This is a clean mechanical follow-through of the idle→online semantic rename introduced in #86. No correctness issues found. Notes below.

SHA pinning

The two-layer pin strategy holds throughout:

• Selector pin advanced correctly: 66e3e97→3415de3ff2 in both local-runner-canary.yml and production-ha-proof.yml.
• Template caller pins advanced to 169e3a4 — same SHA for both canary and HA-proof, which is correct since 169e3a4 (the implementation commit) is what the templates reference.
• Old SHAs correctly retired to supersededSelectorShas / supersededCanaryShas in the test files.

ci.yml fetch consolidation

The two-line fetch collapsed to one:

# before: two separate SHAs
git fetch … ca3c19c fdf0e6e
# after: single combined implementation SHA
git fetch … 169e3a4

ci.yml L352 — This is correct and cleaner: both workflows now share the same pinned implementation commit, so one fetch suffices. The tests' git show 169e3a4 calls verify the contract at that SHA.

Idle→online rename completeness

Verified with a grep across .github/: zero residual references to SELECTED_IDLE_COUNT, IDLE_RUNNER_COUNT, idle-runner-count, or reason=idle remain. All renamed consistently:

Old	New
idle-runner-count output	online-runner-count
IDLE_RUNNER_COUNT env	ONLINE_RUNNER_COUNT env
SELECTED_IDLE_COUNT env	SELECTED_ONLINE_COUNT env
idleRunnerCount property	onlineRunnerCount property
reason=idle gate	reason=online gate

Dual drain-hold in production-ha-proof.yml

The workflow contains two inline drain-hold script blocks (at lines ~704 and ~1465), both generated from production-ha-proof.cjs. Both are updated identically — and --check passing clean confirms the CJS source and rendered YAML are in sync. No concern.

Intentionally retained idle references

The remaining idle occurrences in production-ha-proof.cjs — idleCount, desktop-idle/laptop-idle outputs, and the summary line "Laptop retained at least one online idle runner." — are correct. These belong to the REST-based topology proof, which separately validates idle capacity at the group level. The PR description makes this explicit ("Topology proofs keep their own REST-derived idle counts"). The mixed phrasing "online idle runner" in that summary line accurately describes the laptop group invariant (must have at least one runner that is both online and idle per the REST query).

Rerun guard message

local-runner-canary.yml L109:

-  [[ "$RUN_ATTEMPT" = 1 ]] || fail "reruns must route hosted; start a new dispatch"
+  [[ "$RUN_ATTEMPT" = 1 ]] || fail "canary evidence needs a fresh dispatch, not a rerun"

Good improvement. The old message was inaccurate post-rename (reruns no longer guarantee a hosted route under the online selector) and the new message correctly explains why the guard exists (fresh evidence), not just what happens.

Test coverage

Both test files properly reflect the new contracts:

• local-runner-canary.test.cjs: doesNotMatch regex updated from idle-runner-count to online-runner-count, and the two assertion regexes updated for SELECTED_REASON=online and ONLINE_RUNNER_COUNT.
• production-ha-proof.test.cjs: implementationSha updated; both select-runner.yml@… assertions updated to the new selector SHA.

Overall: LGTM. The rename is complete and consistent, pin hygiene is maintained, the test suite covers the contracts, and the fetch consolidation is a clean improvement.

[cursor]

Risk: medium. Cursor Bugbot was skipped (usage limit reached), so automated review did not complete. Human review is needed before merge; no reviewers were assigned because no non-author maintainers are visible for this repo.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}