fix(935): script-tests jq tripwire accepts {1.6, 1.7} until server-management#1080 #938

Merged

timothy merged 4 commits from 935-jq-repin-17 into main 2026-10-30 00:03:08 +01:00

Conversation 1 Commits 4 Files Changed 16

+230 -73

timothy commented 2026-10-29 23:38:51 +01:00

Owner

Copy Link

Copy Source

fixes #935

Root cause

The script-tests jq preflight pinned a single version (1.6), but the runner hosts now ship 1.7 (both hosts measured 1.7 on 2026-10-28), so the tripwire went red on a healthy fleet. The preflight now accepts exactly {1.6, 1.7} (an out-of-set version is witnessed red in the tests) until server-management#1080 pins the runner fleet. review-verdict.yml stays floor-only. New record ci.jq-accepted-version-set supersedes ci.jq-version-contract (archived, catalog regenerated); docs/ci-cd.md, the preflight comments and dependent scripts state the dated invariant; no claim that runners ship 1.6 remains.

Measured

• Full PYTHONPATH=. python3 -m pytest scripts/tests -q at 403bf011c: 1615 passed, 3 skipped, rc=0 (run by the orchestrator).
• Re-run on the pushed head: test_jq_preflight.py + test_pr_changed_files.py 353 passed.
• ruff check/format clean, bash -n clean on the 4 touched scripts, check-doc-narrative 0 warnings, catalog regen no diff.

Review history

<<REVIEW HISTORY
round 1: 3 lens(es); 0 blocking, 0 should-fix, 9 nit; clean — loop ended
REVIEW HISTORY>>

No fix commit exists from the review because round one was clean (the earlier commits are the resume work round).

Cross-family review status: codex could not run in round 1 (no VERDICT line); substituted a cold same-family review-only agent per process.independent-review-rubric — retry cross-family next window

Deliberately left: none beyond the 9 nits, which carry no issue number.

🤖 Generated with Claude Code

fixes #935 ## Root cause The script-tests jq preflight pinned a single version (1.6), but the runner hosts now ship 1.7 (both hosts measured 1.7 on 2026-10-28), so the tripwire went red on a healthy fleet. The preflight now accepts exactly {1.6, 1.7} (an out-of-set version is witnessed red in the tests) until server-management#1080 pins the runner fleet. `review-verdict.yml` stays floor-only. New record `ci.jq-accepted-version-set` supersedes `ci.jq-version-contract` (archived, catalog regenerated); `docs/ci-cd.md`, the preflight comments and dependent scripts state the dated invariant; no claim that runners ship 1.6 remains. ## Measured - Full `PYTHONPATH=. python3 -m pytest scripts/tests -q` at 403bf011c: 1615 passed, 3 skipped, rc=0 (run by the orchestrator). - Re-run on the pushed head: test_jq_preflight.py + test_pr_changed_files.py 353 passed. - ruff check/format clean, `bash -n` clean on the 4 touched scripts, check-doc-narrative 0 warnings, catalog regen no diff. ## Review history <<REVIEW HISTORY round 1: 3 lens(es); 0 blocking, 0 should-fix, 9 nit; clean — loop ended REVIEW HISTORY>> No fix commit exists from the review because round one was clean (the earlier commits are the resume work round). Cross-family review status: codex could not run in round 1 (no VERDICT line); substituted a cold same-family review-only agent per process.independent-review-rubric — retry cross-family next window Deliberately left: none beyond the 9 nits, which carry no issue number. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

timothy added 4 commits 2026-10-29 23:38:52 +01:00

fix(935): script-tests jq tripwire accepts exactly {1.6, 1.7} until server-management#1080 pins the fleet ... 41d604f0ae

jq-preflight.sh --expect takes a comma-separated set (validated whole, exact
major.minor membership); pr-checks.yml passes 1.6,1.7. Both small runners float
on runner-images:ubuntu-latest, so the fleet's jq is a function of pull history
(1.7 measured on PR #933 job 12347 and PR #934 job 12360, 2026-10-29).

New record ci.jq-accepted-version-set supersedes ci.jq-version-contract
(archived); docs/ci-cd.md, the script header and runner-ships-1.6 comments now
state the dated invariant. review-verdict.yml stays floor-only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1

fix(935): state the measured fact (both hosts 1.7 on 2026-10-28), not an unmeasured mixed fleet ... 8acba80a1a

The fleet is uniform on jq 1.7 per the job logs; 1.6 stays in the set only because the
image tag is unpinned. Real-jq 1.6 coverage is currently absent, and the shims cover only
the empty-input -e quirk, not the NUL or parse-error ones. Measurement dated by the job
date. Remaining "runner's jq 1.6" comments reworded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1

fix(935): pin the run: key in the wiring test, drop a dangling record key, reword a stale runner claim ... 00424bf090

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1

fix(935): repoint the superseded jq key, re-wrap the preflight header, reword the floor note ... 403bf011c1

ci.jq-version-contract is archived; verdict-write-retarget-fence.md and
defect-shapes-773.md now name its successor ci.jq-accepted-version-set.
jq-preflight.sh: the two ragged header paragraphs are re-wrapped, and the
MIN_VERSION note names the runner fleet and server-management#1080 instead
of a single CI runner.

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: f9ce6bc6-5b36-491a-8d72-89c1f70dd3e1

timothy referenced this pull request 2026-10-29 23:39:22 +01:00

script-tests jq tripwire: runner fleet now ships jq 1.7; re-pin --expect and update the jq contract #935

timothy commented 2026-10-30 00:02:52 +01:00

Author

Owner

Copy Link

Copy Source

Review-verdict: MERGEABLE @ 403bf01

Orchestrator verdict at 403bf011c: 3 independent reviews (one cross-family attempt fell back to a cold same-family review) all merge, nits only. Own CI green: script-tests job 12374 on jazz-small-runner reports jq 1.7, a member of {1.6,1.7}. Out-of-set witnessed red (local jq 1.8.2 exits 1). pytest 1615 passed. Nits deferred: tripwire message wording, review-verdict.yml L186 '--expect pins an exact version' comment, wiring test does not assert a single --expect invocation.

Review-verdict: MERGEABLE @ 403bf01 Orchestrator verdict at 403bf011c: 3 independent reviews (one cross-family attempt fell back to a cold same-family review) all merge, nits only. Own CI green: script-tests job 12374 on jazz-small-runner reports jq 1.7, a member of {1.6,1.7}. Out-of-set witnessed red (local jq 1.8.2 exits 1). pytest 1615 passed. Nits deferred: tripwire message wording, review-verdict.yml L186 '--expect pins an exact version' comment, wiring test does not assert a single --expect invocation.

timothy merged commit bcf6f7e04d into main 2026-10-30 00:03:08 +01:00

timothy deleted branch 935-jq-repin-17 2026-10-30 00:03:09 +01:00

timothy referenced this pull request 2026-10-30 00:52:31 +01:00

fix(931): a missing semgrep fails the security-scan release gate #933

timothy referenced this pull request 2026-10-30 00:52:33 +01:00

fix(929): pin Pkcs 9.0.21; hold ImageSharp 3.1.12 with TIFF decoding disabled #934

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

ad-hoc

One-off / ad-hoc work not tracked by a dedicated issue

api

REST API / HTTP endpoints

bug

Something isn't working

ci-cd

Build, test, deploy pipeline

content

Channel content / schedules / playlists

dependencies

Dependency updates (Renovate)

enhancement

New feature or improvement

frontend

ChicoryTV React SPA frontend

in-progress

Claimed by an active session — do not pick up

jellyfin

Jellyfin tuner / IPTV integration

parked

Excluded from automatic queue pickup; work only when explicitly selected

priority: high

priority: low

priority: medium

review

Adversarial review finding

security

Security / vulnerability fix

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

renovate timothy (Timothy)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: timothy/ersatztv#938