chore: retire the canary managed runner label - #157
Merged
Conversation
The melodic-canary-ubuntu-24.04-x64 scale set is decommissioned along with the ci-runner canary release process (releases now roll out one host at a time under production traffic; see melodic-software/provisioning#145). The managed-namespace pattern still forbids every owner-prefixed label generically; only the retired label's enumerated coverage entry and the prose mention are removed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TPPLWAtX5BWyEmghrKkYYF
|
Claude finished @kyle-sexton's task in 59s —— View job PR Review
The two changes are minimal, correct, and internally consistent.
The PR description correctly notes that:
No issues found. The change is safe to merge. |
kyle-sexton
added a commit
to melodic-software/ci-runner
that referenced
this pull request
Jul 16, 2026
## Summary Part of the CI-runner canary decommission (companion to melodic-software/provisioning#145, melodic-software/ci-workflows#125, melodic-software/standards#157). No functional change — prose and one Detail string only. - `docs/roadmap.md`: deferred-capability admission now requires "a first rolling-host rollout under production traffic with the documented health checklist" instead of a canary. - `docs/worker-image.md`: runtime isolation is observed live during each release's first rolling-host rollout; the zstd origin story is marked as the *retired* canary process (historical record kept). - `internal/app/doctor_inspector.go` + `doctor_test.go`: `github-jit-proof` skip rationale updated together — the first enable on a rolling-host rollout performs the JIT proof under real traffic. - `.github/workflows/dependency-drift.yml`: PR-body guidance now says "CI, a rolling-host rollout, and independent review". - `README.md`: drops "isolated canary" from the acceptance-gate sentence. ## Verification - `go test ./...` locally: all pass except `TestCurrentUserNamedPipeRoundTrip`, which fails identically on an unmodified tree because this machine's live production controller owns the control pipe — environmental, not related; hosted CI has no live controller. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01TPPLWAtX5BWyEmghrKkYYF Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
kyle-sexton
added a commit
that referenced
this pull request
Jul 18, 2026
…#184) No linked issue. The Wave 4/5 enum tighten (melodic-software/github-iac#157) removes `privileged-control-plane`, but the validator's category rule required exactly that reason for ANY write-scoped token — leaving a hosted `packages: write` publication job homeless: its only admissible post-tighten path would move the registry token onto fleet containers, trading hosted artifact provenance for no security gain. - **Rule**: `permissionHostedRequirement` now maps a write map whose only writable scope is `packages` to the durable `publication` category. Any additional write scope keeps `privileged-control-plane`. README documents the boundary. - **First consumer, same change**: `publish-packages.yml#publish` re-reasons `privileged-control-plane` → `publication` and stays hosted. `sync.yml#sync` remains the sole privileged exception here, converting later in the standards-sync runner-input lane. - Deviation from the #157 plan comment recorded there next: publish-packages converts by re-reason, not grant. ## Verification - `npm run test:runner-policy` — 210/210 (added: publication-category pass, wrong-reason fail with the new message, mixed packages+issues stays privileged) - `GITHUB_REPOSITORY=melodic-software/standards npm run lint:runner-policy` — passes re-reasoned; the old reason now fails `hosted-exception-category` - `npm run lint:md` — 0 errors ## Related - melodic-software/github-iac#157 (conversion plan), melodic-software/github-iac#78 (epic) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of the CI-runner canary decommission (companion to melodic-software/provisioning#145 and melodic-software/ci-workflows#125). The
melodic-canary-ubuntu-24.04-x64scale set is being removed via github-iac, so its enumerated coverage entry in the managed-namespace test and the "and canary forms" prose mention are retired. The managed-namespace pattern itself is untouched and still generically forbids every owner-prefixed scale-set label.Deliberately left alone: the generic "reviewed canary contract" test fixture string (unrelated to the CI-runner canary) and
policy.json/schemas (the canary label was matched by pattern, never listed).Verification
node --test components/runner-policy/runner-policy.test.mjs: 145/145 passing locally.🤖 Generated with Claude Code
https://claude.ai/code/session_01TPPLWAtX5BWyEmghrKkYYF