From 56819f5560e07fa73b82c46b15e9ded4511ce540 Mon Sep 17 00:00:00 2001 From: REPPL <77722411+REPPL@users.noreply.github.com> Date: Wed, 11 Nov 2026 05:28:24 +0000 Subject: [PATCH 1/3] fix: a drive's start says which settings it reads once A drive reads the machine's runner and provider settings once, at its start; the class map alone is read again as each run starts. Nothing said so, so a change made to unblock a running drive had no effect and gave no reason. The start text now carries one line on it, and the drain command page and the drain brief page state the same. Resolves: iss-2611110527425474 Assisted-by: Claude:claude-fable-5-2 --- .abcd/development/brief/04-surfaces/35-drain.md | 4 +++- ...74-a-drive-reads-the-machine-s-runner-and.md | 17 +++++++++++++++++ commands/drain.md | 5 ++++- internal/surface/cli/drain_drive.go | 4 ++++ internal/surface/cli/drain_drive_update_test.go | 5 +++++ 5 files changed, 33 insertions(+), 2 deletions(-) create mode 100644 .abcd/work/issues/resolved/iss-2611110527425474-a-drive-reads-the-machine-s-runner-and.md diff --git a/.abcd/development/brief/04-surfaces/35-drain.md b/.abcd/development/brief/04-surfaces/35-drain.md index 4d564c8fef..adc4fde7f7 100644 --- a/.abcd/development/brief/04-surfaces/35-drain.md +++ b/.abcd/development/brief/04-surfaces/35-drain.md @@ -197,7 +197,9 @@ with no provider block, when it is one the machine's class map resolves (iss-2611080057001367); everything else keeps the provider allowlist. The map is read at the drive's start and again as each run starts; a run in progress whose model no map read during the drive names is refused at its next reviewer, naming -the model and the class map. The start refuses, before anything is reserved, a review set +the model and the class map. The runner settings, the provider blocks and the +denylist are read once, at the start, and hold until the drive ends; the start's +text says so (iss-2611110527425474). The start refuses, before anything is reserved, a review set with a reviewer no route on the machine can launch, naming the role, the model and the configuration to set (`runner.Config.CanLaunch`, the admission the dispatch makes, asked of the configuration the drive's lanes launch on). diff --git a/.abcd/work/issues/resolved/iss-2611110527425474-a-drive-reads-the-machine-s-runner-and.md b/.abcd/work/issues/resolved/iss-2611110527425474-a-drive-reads-the-machine-s-runner-and.md new file mode 100644 index 0000000000..181155932f --- /dev/null +++ b/.abcd/work/issues/resolved/iss-2611110527425474-a-drive-reads-the-machine-s-runner-and.md @@ -0,0 +1,17 @@ +--- +schema_version: 1 +id: "iss-2611110527425474" +slug: "a-drive-reads-the-machine-s-runner-and" +severity: "minor" +category: "bug" +source: "user-observation" +found_during: "autonomous run, live drive" +origin: researcher-authored +production_mode: hand-written +found_at: "internal/surface/cli/drain_drive.go" +remedy: "Say it where the person looks: one line in the drive's start text and one passage in the drain command page and the drain brief page, naming what is read once and that the class map alone is read again per run. Re-reading provider settings mid-drive is not proposed: it would move a trust decision the start's refusal now makes before anything is reserved." +resolution: "The drive's start text now says which settings are read once and that the class map alone is read again as each run starts; the drain command page and the drain brief page say the same." +impact: fix +--- + +A drive reads the machine's runner and provider settings once, at its start, and nothing says so. A provider block or a denylist entry changed in the machine's configuration while a drive runs takes effect only at the next start; the class map is the one part read again as each run starts. A person who changes the file to unblock a running drive sees no effect and no reason: on 10 Nov 2026 a live drive kept refusing its reviewers after the configuration had been corrected, until it was started again. Neither the start's text nor the drain page states which settings are read once. diff --git a/commands/drain.md b/commands/drain.md index f17c6ff66f..922612946d 100644 --- a/commands/drain.md +++ b/commands/drain.md @@ -61,7 +61,10 @@ other vendor's model, and every launch outside a drive keep the provider allowli reads the class map at its start and again as each run starts, so a run started after the map changed runs at the new routes. A run keeps the models it started with: one already in progress whose model no map read during the drive names is refused at its next reviewer, -naming the model. Map a class to it in `models.classes` and start the drive again. A review set with a reviewer +naming the model. Map a class to it in `models.classes` and start the drive again. Everything +else in that file that decides a launch (the runner settings, an `oracle.api.` block +and the `oracle.denylist`) is read once, at the drive's start, and holds until the drive ends: +a change to one of those takes effect at the next start, and the start says so. A review set with a reviewer no route on this machine can launch refuses the start, before anything is reserved, naming the role, the model and what to set: the denylist entry or `models.classes` for a model an entry refuses, `oracle.api.` otherwise. diff --git a/internal/surface/cli/drain_drive.go b/internal/surface/cli/drain_drive.go index 1408d6cfab..204d2fd283 100644 --- a/internal/surface/cli/drain_drive.go +++ b/internal/surface/cli/drain_drive.go @@ -410,6 +410,10 @@ func driveConsent(cmd *cobra.Command, w io.Writer, f driveFlags, lanes, runs int fmt.Fprintf(w, " profile: %s, a separate login and settings on this one account; a stage's shell reads what this account can\n", name) fmt.Fprintln(w, " gates: a change to the Makefile, scripts/ or the hooks is not a drive's: it needs a person's own session") fmt.Fprintln(w, " first: one short live launch checks the tools, the guard and the shell, on the same subscription") + // What a change to the machine's configuration reaches during the drive + // (iss-2611110527425474): the runner and provider settings are read once, before + // this text, and the class map alone is read again as each run starts. + fmt.Fprintln(w, " settings: this machine's runner and provider settings are read now and hold until the drive ends; the class map alone is read again as each run starts") fmt.Fprintln(w, " updates: a harness update during the run carries on only where the new file has the same signing team and passes one more such launch; elsewhere the run stops") fmt.Fprintln(w, " releases: "+fsutil.RedactHome(driveReleaseLine(f))) if !f.noSelfUpdate && f.self.Refusal == nil { diff --git a/internal/surface/cli/drain_drive_update_test.go b/internal/surface/cli/drain_drive_update_test.go index e7b37092b3..1cf2f025cc 100644 --- a/internal/surface/cli/drain_drive_update_test.go +++ b/internal/surface/cli/drain_drive_update_test.go @@ -230,6 +230,11 @@ func TestNoSelfUpdateMakesNoRequest(t *testing.T) { if !strings.Contains(out.String(), "releases: none (--no-self-update)") { t.Fatalf("the consent line says none:\n%s", out.String()) } + // The start says what a later change to the machine's configuration + // reaches (iss-2611110527425474). + if !strings.Contains(out.String(), "settings: this machine's runner and provider settings are read now and hold until the drive ends; the class map alone is read again as each run starts") { + t.Fatalf("the start does not say when the settings are read:\n%s", out.String()) + } if w.terminalCalls != 1 { t.Fatalf("the loop runs: %d", w.terminalCalls) } From cc8c93244e5790c24b1270e2d0bc0b7e50c6cc79 Mon Sep 17 00:00:00 2001 From: REPPL <77722411+REPPL@users.noreply.github.com> Date: Wed, 11 Nov 2026 05:31:21 +0000 Subject: [PATCH 2/3] fix: the start names the review set among what is read again The start line and the drain command page said the class map alone is read again as each run starts; the review set is too. Both now name the three things read once and the two read per run. Refs: iss-2611110527425474 Assisted-by: Claude:claude-fable-5-2 --- .abcd/development/brief/04-surfaces/35-drain.md | 9 +++++---- commands/drain.md | 9 +++++---- internal/surface/cli/drain_drive.go | 7 ++++--- internal/surface/cli/drain_drive_update_test.go | 2 +- 4 files changed, 15 insertions(+), 12 deletions(-) diff --git a/.abcd/development/brief/04-surfaces/35-drain.md b/.abcd/development/brief/04-surfaces/35-drain.md index adc4fde7f7..b195a727ae 100644 --- a/.abcd/development/brief/04-surfaces/35-drain.md +++ b/.abcd/development/brief/04-surfaces/35-drain.md @@ -198,10 +198,11 @@ with no provider block, when it is one the machine's class map resolves read at the drive's start and again as each run starts; a run in progress whose model no map read during the drive names is refused at its next reviewer, naming the model and the class map. The runner settings, the provider blocks and the -denylist are read once, at the start, and hold until the drive ends; the start's -text says so (iss-2611110527425474). The start refuses, before anything is reserved, a review set -with a reviewer no route on the machine can launch, naming the role, the model -and the configuration to set (`runner.Config.CanLaunch`, the admission the +denylist are read once, at the start, and hold until the drive ends; the review +set is read again as each run starts, as the class map is; the start's text says +so (iss-2611110527425474). The start refuses, before anything is reserved, a +review set with a reviewer no route on the machine can launch, naming the role, +the model and the configuration to set (`runner.Config.CanLaunch`, the admission the dispatch makes, asked of the configuration the drive's lanes launch on). Each iteration is one move under the drain's lock for that move alone; a lane is driven in-process through `loop.Drive` and `DriveReview`, every role on the diff --git a/commands/drain.md b/commands/drain.md index 922612946d..a85b6df2fb 100644 --- a/commands/drain.md +++ b/commands/drain.md @@ -61,10 +61,11 @@ other vendor's model, and every launch outside a drive keep the provider allowli reads the class map at its start and again as each run starts, so a run started after the map changed runs at the new routes. A run keeps the models it started with: one already in progress whose model no map read during the drive names is refused at its next reviewer, -naming the model. Map a class to it in `models.classes` and start the drive again. Everything -else in that file that decides a launch (the runner settings, an `oracle.api.` block -and the `oracle.denylist`) is read once, at the drive's start, and holds until the drive ends: -a change to one of those takes effect at the next start, and the start says so. A review set with a reviewer +naming the model. Map a class to it in `models.classes` and start the drive again. The +runner settings, each `oracle.api.` block and the `oracle.denylist` are read once, at +the drive's start, and hold until the drive ends: a change to one of those takes effect at the +next start, and the start says so. The review set (`review.*` and `models.effort`) is read +again as each run starts, as the class map is. A review set with a reviewer no route on this machine can launch refuses the start, before anything is reserved, naming the role, the model and what to set: the denylist entry or `models.classes` for a model an entry refuses, `oracle.api.` otherwise. diff --git a/internal/surface/cli/drain_drive.go b/internal/surface/cli/drain_drive.go index 204d2fd283..520281547c 100644 --- a/internal/surface/cli/drain_drive.go +++ b/internal/surface/cli/drain_drive.go @@ -411,9 +411,10 @@ func driveConsent(cmd *cobra.Command, w io.Writer, f driveFlags, lanes, runs int fmt.Fprintln(w, " gates: a change to the Makefile, scripts/ or the hooks is not a drive's: it needs a person's own session") fmt.Fprintln(w, " first: one short live launch checks the tools, the guard and the shell, on the same subscription") // What a change to the machine's configuration reaches during the drive - // (iss-2611110527425474): the runner and provider settings are read once, before - // this text, and the class map alone is read again as each run starts. - fmt.Fprintln(w, " settings: this machine's runner and provider settings are read now and hold until the drive ends; the class map alone is read again as each run starts") + // (iss-2611110527425474): the runner settings, the provider blocks and the + // denylist are read once, before this text; the class map and the review + // set are read again as each run starts. + fmt.Fprintln(w, " settings: this machine's runner settings, provider blocks and denylist are read now and hold until the drive ends; the class map and the review set are read again as each run starts") fmt.Fprintln(w, " updates: a harness update during the run carries on only where the new file has the same signing team and passes one more such launch; elsewhere the run stops") fmt.Fprintln(w, " releases: "+fsutil.RedactHome(driveReleaseLine(f))) if !f.noSelfUpdate && f.self.Refusal == nil { diff --git a/internal/surface/cli/drain_drive_update_test.go b/internal/surface/cli/drain_drive_update_test.go index 1cf2f025cc..948c12cebb 100644 --- a/internal/surface/cli/drain_drive_update_test.go +++ b/internal/surface/cli/drain_drive_update_test.go @@ -232,7 +232,7 @@ func TestNoSelfUpdateMakesNoRequest(t *testing.T) { } // The start says what a later change to the machine's configuration // reaches (iss-2611110527425474). - if !strings.Contains(out.String(), "settings: this machine's runner and provider settings are read now and hold until the drive ends; the class map alone is read again as each run starts") { + if !strings.Contains(out.String(), "settings: this machine's runner settings, provider blocks and denylist are read now and hold until the drive ends; the class map and the review set are read again as each run starts") { t.Fatalf("the start does not say when the settings are read:\n%s", out.String()) } if w.terminalCalls != 1 { From 78034bd26025153a843c9f0433c7c4b259ec6f4f Mon Sep 17 00:00:00 2001 From: REPPL <77722411+REPPL@users.noreply.github.com> Date: Wed, 11 Nov 2026 05:32:24 +0000 Subject: [PATCH 3/3] fix: the resolved record matches the text that shipped The record's remedy, resolution and finding said the class map alone is read again per run; the review set is too, as the start now says. Refs: iss-2611110527425474 Assisted-by: Claude:claude-fable-5-2 --- ...11110527425474-a-drive-reads-the-machine-s-runner-and.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.abcd/work/issues/resolved/iss-2611110527425474-a-drive-reads-the-machine-s-runner-and.md b/.abcd/work/issues/resolved/iss-2611110527425474-a-drive-reads-the-machine-s-runner-and.md index 181155932f..5cd5582292 100644 --- a/.abcd/work/issues/resolved/iss-2611110527425474-a-drive-reads-the-machine-s-runner-and.md +++ b/.abcd/work/issues/resolved/iss-2611110527425474-a-drive-reads-the-machine-s-runner-and.md @@ -9,9 +9,9 @@ found_during: "autonomous run, live drive" origin: researcher-authored production_mode: hand-written found_at: "internal/surface/cli/drain_drive.go" -remedy: "Say it where the person looks: one line in the drive's start text and one passage in the drain command page and the drain brief page, naming what is read once and that the class map alone is read again per run. Re-reading provider settings mid-drive is not proposed: it would move a trust decision the start's refusal now makes before anything is reserved." -resolution: "The drive's start text now says which settings are read once and that the class map alone is read again as each run starts; the drain command page and the drain brief page say the same." +remedy: "Say it where the person looks: one line in the drive's start text and one passage in the drain command page and the drain brief page, naming what is read once and that the class map and the review set are read again per run. Re-reading provider settings mid-drive is not proposed: it would move a trust decision the start's refusal now makes before anything is reserved." +resolution: "The drive's start text now says which settings are read once and that the class map and the review set are read again as each run starts; the drain command page and the drain brief page say the same." impact: fix --- -A drive reads the machine's runner and provider settings once, at its start, and nothing says so. A provider block or a denylist entry changed in the machine's configuration while a drive runs takes effect only at the next start; the class map is the one part read again as each run starts. A person who changes the file to unblock a running drive sees no effect and no reason: on 10 Nov 2026 a live drive kept refusing its reviewers after the configuration had been corrected, until it was started again. Neither the start's text nor the drain page states which settings are read once. +A drive reads the machine's runner and provider settings once, at its start, and nothing says so. A provider block or a denylist entry changed in the machine's configuration while a drive runs takes effect only at the next start; the class map and the review set are the parts read again as each run starts. A person who changes the file to unblock a running drive sees no effect and no reason: on 10 Nov 2026 a live drive kept refusing its reviewers after the configuration had been corrected, until it was started again. Neither the start's text nor the drain page states which settings are read once.