seanfarm33 train: VERSION bumps + forensics gate/kargs/watchdog (recut off trunk) #92

Merged

pipeline-bot merged 9 commits from seanfarm33-train into trunk 2026-08-15 10:42:21 +00:00

Conversation 0 Commits 9 Files changed 14 +54 -14

sean commented 2026-08-15 10:30:16 +00:00

Owner

Copy link

Recut of PRs #89 + #90 as ONE branch based exactly on the trunk tip — the train could not merge the main-based pair over the unreleased trunk docs commit (the mergeability-stale wedge; cure per runbook: recut off fresh trunk, new name). Conflicts were comment-wording only; resolved keeping the ASD phrasing plus the seanfarm33 notes.

DELIBERATELY EXCLUDES #91 (k3s v1.35.7): its own header mandates master-first rollout (kubelet never newer than apiserver) — it must not ride a workers-first kernel roll train. It stays open for its own choreography.

Supersedes #89/#90 (closed with pointers).

Recut of PRs #89 + #90 as ONE branch based exactly on the trunk tip — the train could not merge the main-based pair over the unreleased trunk docs commit (the mergeability-stale wedge; cure per runbook: recut off fresh trunk, new name). Conflicts were comment-wording only; resolved keeping the ASD phrasing plus the seanfarm33 notes. DELIBERATELY EXCLUDES #91 (k3s v1.35.7): its own header mandates master-first rollout (kubelet never newer than apiserver) — it must not ride a workers-first kernel roll train. It stays open for its own choreography. Supersedes #89/#90 (closed with pointers).

sean added 9 commits 2026-08-15 10:30:16 +00:00

feat(seanfarm33): gate the forensics symbols, add ramoops/watchdog/lockdown kargs ... 39e7a8f23a

Companions to sean/linux PR #19 (the seanfarm33 config audit).

linux-kernel: the defconfig hard gate grows a second row —
SECURITY_LOCKDOWN_LSM, PSTORE_RAM, PSI, LRU_GEN, SOFTLOCKUP_DETECTOR.
The drift trap silently drops dep-unsatisfied options; a kernel that
ships without pstore or the lockup detectors defeats the
panic-and-self-heal posture while looking green.

node-bootc: kargs gain reserve_mem=2M:4096:oops + ramoops.mem_name
(the kernel places the region itself — no hand-picked memmap address
to collide with the initrd), delayacct, and lockdown=integrity. New
systemd drop-in pets /dev/watchdog0 (softdog): a wedge that stops the
pets hard-resets the node. Every arg is inert on an older kernel, so
karg and kernel changes need no ordering.

chore(images): bump ten VERSIONs for the ASD-STE100 Dockerfile comment rewrite ... 3fa57edb81

The 2026-08-07 docs rewrite (fc693e6, unreleased on trunk since) edited
comments inside ten onboarded Dockerfiles without VERSION bumps. The
:vN discipline gate has failed every release attempt since — comment
changes still change the image digest, so the gate is right and the
bumps are owed. Old :vN pins stay valid (tags are immutable); consumers
adopt vN+1 when they choose.

chore: retrigger CI — codeberg quota cleared for the image pushes 66c48c63ec

fix(pipelines-ci): repoint the pipeline-tools base off the deleted v6 digest ... b6e39ba0a7

The registry-package-prune policy defect (sha CI tags crowd :vN tags
out of keep-2) deleted pipeline-tools v6 from codeberg, and v6 was
never in zot — the digest is unrestorable. v8 is restored to codeberg
from zot's cache (6560ba95, the original v8 push; the fleet's
d5eb0e51 re-push lives only in node containerd stores and gets
re-pinned to this round's v9 in the follow-up). The prune policy fix
itself lands in seanfarm before the cron's next 05:17 run.

fix(pipelines-ci): resolve the pipeline-tools base from zot, not codeberg ... 9197ee03b8

In-cluster first (Sean, repeatedly): builds resolve from
registry.sean.farm; codeberg is a passive backup that nothing in the
executing path depends on. Same digest (6560ba95), served by zot.

fix(lint): recognize registry.sean.farm as the in-house image host ... dcbc672f90

In-cluster first: FROMs resolve from zot now. codeberg.org stays
recognized for refs that predate the retarget.

chore: retrigger CI on the zot-publishing template (the prior run raced the cutover) 53ea8f1461

Merge remote-tracking branch 'forgejo/feat/seanfarm33-companions' into seanfarm33-train ... 66d9c0f276

# Conflicts:
#	images/linux-kernel/Containerfile
#	images/node-bootc/Containerfile

Merge remote-tracking branch 'forgejo/fix/version-bumps-asd' into seanfarm33-train ... 9cff4bdb19

# Conflicts:
#	images/pipelines-ci/Dockerfile

pipeline-bot merged commit 9cff4bdb19 into trunk 2026-08-15 10:42:21 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/builder-images!92

No description provided.