docs: a green release does not verify the buildcache fix, an overlap does #9

Merged

jlxq0 merged 2 commits from docs/overlap-is-what-verifies into main

2026-08-27 02:48:52 +00:00

jlxq0 commented

2026-08-27 02:07:28 +00:00

Owner

v0.4.0 came out green on all four jobs and proves nothing about the buildcache fix in #3. Recording that, because a green release is exactly what someone will later cite as verification.

17586  cargo   main     02:00:23Z -> 02:01:22Z   success
17592  cargo   v0.4.0   02:02:01Z -> 02:03:03Z   success
17594  docker  main     02:03:05Z -> 02:04:15Z   success
17604  docker  v0.4.0   02:05:39Z -> 02:06:06Z   success

The two docker jobs never ran at once. main finished at 02:04:15Z and the tag started at 02:05:39Z, 84 seconds later, because the runner has capacity 1 and serialised them. There were never two writers to :buildcache, whatever the workflow said.

The two pairs that failed overlapped for most of a minute:

v0.2.0   tag 01:57:35Z, main 01:57:49Z    14s apart, main FAILED
v0.3.0   tag 04:47:27Z, main 04:47:41Z    14s apart, main FAILED

So an unpatched workflow would have passed this release. The verification condition is an overlap, not a colour, and it cannot be arranged by pushing the tag faster since the queue decides when a job starts.

Documentation only.

`v0.4.0` came out green on all four jobs and proves nothing about the buildcache fix in #3. Recording that, because a green release is exactly what someone will later cite as verification. ``` 17586 cargo main 02:00:23Z -> 02:01:22Z success 17592 cargo v0.4.0 02:02:01Z -> 02:03:03Z success 17594 docker main 02:03:05Z -> 02:04:15Z success 17604 docker v0.4.0 02:05:39Z -> 02:06:06Z success ``` The two `docker` jobs never ran at once. `main` finished at 02:04:15Z and the tag started at 02:05:39Z, 84 seconds later, because the runner has capacity 1 and serialised them. There were never two writers to `:buildcache`, whatever the workflow said. The two pairs that failed overlapped for most of a minute: ``` v0.2.0 tag 01:57:35Z, main 01:57:49Z 14s apart, main FAILED v0.3.0 tag 04:47:27Z, main 04:47:41Z 14s apart, main FAILED ``` So an unpatched workflow would have passed this release. **The verification condition is an overlap, not a colour**, and it cannot be arranged by pushing the tag faster since the queue decides when a job starts. Documentation only.

jlxq0 added 1 commit

2026-08-27 02:07:28 +00:00

docs: a green release does not verify the buildcache fix, an overlap does

CI / cargo (pull_request) Successful in 1m54s

Details

CI / docker (pull_request) Successful in 11s

Details

442ab9d27a

v0.4.0 came out green on all four jobs and proves nothing about PR 3.
The two docker jobs never ran at once: main finished 02:04:15Z and the
tag started 02:05:39Z, serialised by a capacity-1 runner. The v0.2.0 and
v0.3.0 pairs that failed overlapped for most of a minute.

An unpatched workflow would have passed this release, so reading the
green as verification is the mistake this note exists to stop.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NCiHcHN6LrhiuLXbG9SBYG

jlxq0 added 1 commit

2026-08-27 02:28:26 +00:00

docs: the negative control for the host check runs inside the cluster

CI / cargo (pull_request) Successful in 44s

Details

CI / docker (pull_request) Successful in 28s

Details

9d6449c1b4

The bearer probe proves an origin is allowed and cannot, from outside,
prove anything is rejected: a wrong Host returns 200 because SNI still
names the right one, so the Gateway never matches the HTTPRoute and the
request never reaches the process.

Port-forwarded to the pod, where there is no SNI, v0.4.0 answers 200 for
hevy-mcp.oddie.app and 403 for localhost, wrong.example and
hevy-mcp.kampong.social.

localhost returning 403 is the row that matters. It is in
DEFAULT_ALLOWED_HOSTS, so rejecting it is only possible if the
environment variable replaced the default rather than extending it.
Under v0.3.0 that row would have been 200.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NCiHcHN6LrhiuLXbG9SBYG

jlxq0 referenced this pull request

2026-08-27 02:28:43 +00:00

fix: take the public origin out of the published default host list #5

jlxq0 merged commit 8a9d518d83 into main

2026-08-27 02:48:52 +00:00

jlxq0 deleted branch docs/overlap-is-what-verifies

2026-08-27 02:48:52 +00:00

jlxq0 referenced this pull request from a commit

2026-08-27 02:48:53 +00:00

Merge pull request 'docs: a green release does not verify the buildcache fix, an overlap does' (#9) from docs/overlap-is-what-verifies into main