feat(delivery): kernel auto-approve + visible approval wait + VAP-conformant runtime probe #2054

Merged

pipeline-bot merged 2 commits from feat/kernel-env-auto-approve into trunk 2026-08-15 14:30:28 +00:00

Conversation 0 Commits 2 Files changed 6 +48 -8

sean commented 2026-08-15 14:23:51 +00:00

Owner

Copy link

Three fixes from the seanfarm33 roll:

1. kernel-production approvalMode manual->automatic (Sean: auto-approve for the dev cluster; the 2026-07-18 stability hold was already lifted). The automated guard (canary-first + cosign-signature/canary-smoke/fleet-health) is unchanged; deploy-pins re-pins the NEW decision incl. policy-disabled.

2. Operator: a Pending deploy blocked on the manual approval gate sets awaitingGate=approval — the 55-minute invisible wait on today s roll becomes a visible chip.

3. The green gate s runtime probe was denied by the kernel-deploy-guard VAP on every attempt (hostNetwork missing) with its stderr swallowed — the canary sat healthy while the gate could never pass. hostNetwork added, stderr surfaced, and the safety envelope pins every VAP-asserted probe field.

129/129 guards, controller suite green.

Three fixes from the seanfarm33 roll: 1. kernel-production approvalMode manual->automatic (Sean: auto-approve for the dev cluster; the 2026-07-18 stability hold was already lifted). The automated guard (canary-first + cosign-signature/canary-smoke/fleet-health) is unchanged; deploy-pins re-pins the NEW decision incl. policy-disabled. 2. Operator: a Pending deploy blocked on the manual approval gate sets awaitingGate=approval — the 55-minute invisible wait on today s roll becomes a visible chip. 3. The green gate s runtime probe was denied by the kernel-deploy-guard VAP on every attempt (hostNetwork missing) with its stderr swallowed — the canary sat healthy while the gate could never pass. hostNetwork added, stderr surfaced, and the safety envelope pins every VAP-asserted probe field. 129/129 guards, controller suite green.

sean added 2 commits 2026-08-15 14:23:51 +00:00

feat(delivery): kernel environment goes auto-approve; the pre-run approval wait becomes visible ... dbebe32c0c

Sean, 2026-08-15: 'we're supposed to be in auto-approve mode for this
dev cluster.' The manual mode encoded the 2026-07-18 stability-review
hold, which was already lifted. kernel-production flips to automatic;
the AUTOMATED guard is unchanged and now pinned harder — the canary
still rolls first, cosign-signature/canary-smoke/fleet-health still
block a bad kernel, the delivery policy stays disabled (declared
deploys only, no unattended cadence), and seanfarm33's
panic-and-self-heal posture bounds a slipped regression to a reboot.

Also: a Pending deploy blocked on the manual approval gate now sets
awaitingGate=approval, so the fold, dashboard chip, and pipectl say
what is being waited on — today that wait was invisible (three gate
buttons, no 'waiting on'), which is dead time by definition.

deploy-pins guard re-pins the NEW decision: automatic + the full
required-check set + policy disabled.

fix(kernel-roll): the runtime probe must satisfy the kernel-deploy VAP ... 186b84cebd

The probe's first live execution (seanfarm33 canary, 2026-08-15) was
denied by admission on every attempt: the kernel-deploy-guard VAP
requires hostNetwork=true on every pod in the namespace and the probe
spec omitted it. Its swallowed stderr reported the denial as 'runtime
or API refused' and the green gate could never pass — on a canary whose
runtime was verifiably healthy.

hostNetwork joins the probe spec; the create's stderr is captured and
quoted in the failure line; the safety envelope now pins every
VAP-asserted field in the probe spec plus the stderr surfacing, so an
admission-shape drift fails the suite instead of the first live roll.

pipeline-bot force-pushed feat/kernel-env-auto-approve from 186b84cebd to f2c06c7f28 2026-08-15 14:28:14 +00:00 Compare

pipeline-bot merged commit f2c06c7f28 into trunk 2026-08-15 14:30:28 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/pipelines!2054

No description provided.