ci: add sealed Rust 1.93 runner leaf #19

Merged

noel merged 3 commits from fix/runner-rust193-2320 into main

2026-10-05 22:09:35 +00:00

noel commented

2026-10-01 18:28:27 +00:00

Owner

Outcome

Deliver the sealed Rust 1.93 runner leaf and the already-tested installed-image guest/host verification entrypoints for Codewire #2320, coordinated by Program #2255.

Source candidate: 44d85fd7b8392060c9075ce11960d7b72bf7f3f9; canonical base: c6fd767b34212806f35f93a39a923fd69deaecff.

Contracts and dependencies

The leaf inherits registry.noel.sh/oci-approved/act-node-docker@sha256:3208f9a7519e62db918d0bf4a9ae0b4403bff8ce655333c7ef682fbf1f72ea62. Five checksum-sealed official archives supply Rust 1.93.0, the GNU host bundle, static musl, ARM GNU and both Darwin standard libraries. The installer runs without networking and reads sealed inputs. Inherited provider/scanner/tool bytes remain required acceptance inputs; toolchain mutation exits64.

This source candidate adds the recipe/input manifest, synthetic/source tests, installed guest verifier and its tests, and installed host controller and its tests. The host boundary binds the exact local image/parent/config/labels, sealed consumer inventory and complete disposable container configuration; runs UID/GID1000 with read-only root, no network/credentials/socket mount; and joins its process family and container cleanup.

Image publication and shared runner adoption remain separate operational effects. This PR carries source only. Infra#2353's protected Dev-cache surface remains separately owned.

Accepted evidence

Original source proof exited0: 17 static tests, 28 rejected source mutations, 30 rejected input mutations, five official archives/targets and checksum-bound channel manifest. Receipt: runner-rust193-source-test-62.json in the Program ledger.
Actual installed-image acceptance completed all33 required guest checks with exit0, normal host ECHILD, closed private PID1 namespace and exact owned-container cleanup. It exercised the genuine compilers, five libraries, fmt/Clippy, immutable rustup refusals, inherited offline scanners/consumer revisions and all11 real OpenTofu mock plans. Proof SHA 45a0d9762765ac8bce4cbf96807a7a302481e92c8fca26c991f7a05ac1be371f; root admission runner-installed-admission-186.json.
That acceptance retains original image manifest sha256:37f659e62c61fbc8234db6cb508d91fa06c71243684c2265020a0337f50596a2, source 4ca3f3452dd2a3ae92ec1b91940807dde42387d0, tree 8122bad828a58e019a9d365389645bfac49e0a0a. Adding host files does not relabel the image. All six frozen image/guest source inputs were freshly checked unchanged at44d85fd; the delivered controller exactly matches the one in that actual proof.
Delivered host controller SHA 7c1b48cacd01a87df819861535173d413904e6c13db642aa23121c70177661cb; test SHA 5207e4e5993b044283d952a2762e7b86d58b55f95785fa13a7d664b11795fb9c. Normal commit and push exited0; staged diff check exited0.

The accepted local image will be reused for a separately authorized digest-preserving registry copy. No rebuild or repeated installed33 qualification is required while its owning inputs match. No image was published or adopted by this source delivery.

## Outcome Deliver the sealed Rust 1.93 runner leaf and the already-tested installed-image guest/host verification entrypoints for [Codewire #2320](https://git.noel.sh/codewire/codewire/issues/2320), coordinated by [Program #2255](https://git.noel.sh/codewire/codewire/issues/2255). Source candidate: `44d85fd7b8392060c9075ce11960d7b72bf7f3f9`; canonical base: `c6fd767b34212806f35f93a39a923fd69deaecff`. ## Contracts and dependencies The leaf inherits `registry.noel.sh/oci-approved/act-node-docker@sha256:3208f9a7519e62db918d0bf4a9ae0b4403bff8ce655333c7ef682fbf1f72ea62`. Five checksum-sealed official archives supply Rust 1.93.0, the GNU host bundle, static musl, ARM GNU and both Darwin standard libraries. The installer runs without networking and reads sealed inputs. Inherited provider/scanner/tool bytes remain required acceptance inputs; toolchain mutation exits64. This source candidate adds the recipe/input manifest, synthetic/source tests, installed guest verifier and its tests, and installed host controller and its tests. The host boundary binds the exact local image/parent/config/labels, sealed consumer inventory and complete disposable container configuration; runs UID/GID1000 with read-only root, no network/credentials/socket mount; and joins its process family and container cleanup. Image publication and shared runner adoption remain separate operational effects. This PR carries source only. Infra#2353's protected Dev-cache surface remains separately owned. ## Accepted evidence - Original source proof exited0: 17 static tests, 28 rejected source mutations, 30 rejected input mutations, five official archives/targets and checksum-bound channel manifest. Receipt: `runner-rust193-source-test-62.json` in the Program ledger. - Actual installed-image acceptance completed all33 required guest checks with exit0, normal host ECHILD, closed private PID1 namespace and exact owned-container cleanup. It exercised the genuine compilers, five libraries, fmt/Clippy, immutable rustup refusals, inherited offline scanners/consumer revisions and all11 real OpenTofu mock plans. Proof SHA `45a0d9762765ac8bce4cbf96807a7a302481e92c8fca26c991f7a05ac1be371f`; root admission `runner-installed-admission-186.json`. - That acceptance retains original image manifest `sha256:37f659e62c61fbc8234db6cb508d91fa06c71243684c2265020a0337f50596a2`, source `4ca3f3452dd2a3ae92ec1b91940807dde42387d0`, tree `8122bad828a58e019a9d365389645bfac49e0a0a`. Adding host files does not relabel the image. All six frozen image/guest source inputs were freshly checked unchanged at44d85fd; the delivered controller exactly matches the one in that actual proof. - Delivered host controller SHA `7c1b48cacd01a87df819861535173d413904e6c13db642aa23121c70177661cb`; test SHA `5207e4e5993b044283d952a2762e7b86d58b55f95785fa13a7d664b11795fb9c`. Normal commit and push exited0; staged diff check exited0. The accepted local image will be reused for a separately authorized digest-preserving registry copy. No rebuild or repeated installed33 qualification is required while its owning inputs match. No image was published or adopted by this source delivery.

noel added 1 commit

2026-10-01 18:28:27 +00:00

ci: add sealed Rust 1.93 runner leaf source 8a3a6efe70

Preserve the admitted provider and offline OSV parent; install only the
checksum-bound Rust bundle and four cross-target standard libraries into
a fresh immutable prefix. Bind official archive inputs and static
negative fixtures. Image qualification, publication and runner adoption
remain pending separate exact-source acceptance.

Codewire Program: codewire/codewire#2255
Dependency repair: codewire/codewire#2320

noel added 2 commits

2026-10-05 22:06:53 +00:00

test(runner): verify installed Rust and retained offline consumers 4ca3f3452d

test(runner): deliver accepted installed-image host controller 44d85fd7b8