fix(hotpatch): resolve bucket-D prod/repo divergences - #4
Open
alpha1122x wants to merge 7 commits into
Open
Conversation
… delete Prod bucket-D shapes/lifecycle/phala fixes: stage disk bounds, eval tdx.xlarge default, disk-aware budget, and PhalaCloudClient.delete_cvm so validators can tear down without a phala binary.
…nstalls Prefer env/manifest and /app|/opt golden layouts over Path(__file__).parents[3] so eval/prepare no longer 503s when the package is installed under site-packages.
…d compose envs Land miner n_concurrent plan binding, optional hydration_digest, mid-run progress validators, and EVAL_PROGRESS/DSTACK_DOCKER allowed envs. Keep guest_artifact_proof, RA-TLS KR authority checks, dual residual review gate, and raw-weight-push settings from the repo side.
…handoff Provision disk_size without re-pinning app_id or reintroducing nonce. CLI gains HTTP teardown, disk flags, and eval run-token handoff while keeping multi-account discovery and artifact grant minting.
… prompt Land prod tool-call contract wording so Grok tool_choice=auto emits a closed submit_verdict call. Keep the joinbase REVIEW_API_BASE_URL pin.
When worker_plane is enabled the master queue no longer claims GPU work. Borderline/attach plagiarism pairs go through the OpenRouter adjudicator instead of terminal-rejecting the quarantine band.
…tures Add behavioral tests for digest path, n_concurrent, progress wire, disk guards, and dual residual signature. Update compose pin hash and lifecycle/disk/teardown expectations for the landed product changes.
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fix/prod-hotpatch-reconciliation; does not reuse PR feat(agent-challenge): AC attestation provenance + Phala multi-account (+ prism/lium) #1/test(agent-challenge): lock review ack on discovered Phala app_id #2/fix(prod): reconcile master hotpatch drift into monorepo #3.Per-file resolution table
ac_selfdeploy_bundle/shapes.pytdx.xlargedefault, disk cost helpersac_selfdeploy_bundle/lifecycle.pyac_selfdeploy_bundle/phala.pydelete_cvmHTTP DELETE + unique app_id teardown resolveac_benchmarks.pyresolve_dataset_digest_pathfor site-packages //app/goldenac_eval_wire.pyn_concurrent, progress validators, optionalhydration_digest. Keepguest_artifact_proof+ fail-closedmatch is not True, optionalapp_identity, RA-TLS KR authority validationac_authorization.pyresolve_plan_n_concurrent, plan field, active/terminal prepare recovery, digest path helper. Keep dual residual / settings-gatedadmit_eval_cvm_launch_from_assignment(prod tried to drop it — attestation risk)ac_sdk_config.pyeval_max_attempts1–256. Keep raw_weight_push settings +internal_token()+ AliasChoicesac_canonical_compose.pyEVAL_PROGRESS_*+DSTACK_DOCKER_*allowed envs. Keep artifact URL/token envs + key_release_endpoint module integration. Compose hash changed → pin constant updated; ops must re-measure live tee-pin-packac_selfdeploy_bundle/eval.pydisk_size_gbon discovery path only. Keep multi-account discovery, no nonce, artifact grant minting (repo is correct vs prod pin/nonce)ac_selfdeploy_bundle/review.pydisk_size_gbon discovery path. Keep discovery / no nonceac_selfdeploy_bundle/cli.pyac_review_runtime.pyREVIEW_API_BASE_URLpin (prod weakened it — not landed)prism_plagiarism_llm/queue.pyProd-only drift intentionally not committed
REVIEW_API_BASE_URLoverride (weakens pin) — remains prod-only if still mounted.Still unresolved / residual risk
04011776…; generator is now9a550b2d…. Ops must re-measure eval compose pin before next production pin cut (test skips stale pack when present).ac_authorizationresidual-gate removal was rejected as attestation weakening; if prod mount still has the weak path, keep the mount until this lands and image rebuilds.compose_hashbyte equality, measurement allowlist, KMS digest, signature verification) were not loosened.Eval path callouts
Touched directly:
eval_wire.py,authorization.py,benchmarks.py,selfdeploy/eval.py,canonical/compose.py(allowed envs / measured compose). Guest artifact proof and dual residual AGATE gate preserved.Test plan
UV_CACHE_DIR=/var/tmp/uv-cache uv run pytest -q -p no:randomlyfrompackages/challenges/agent-challengetests/test_product_blackbox_attestation_chain.py: 17 failed / 19 passedtests/test_bucket_d_hotpatch_resolution.pybehavioral coverage (RED→GREEN for n_concurrent, digest path, disk, progress, dual residual signature)phak_,sk-, Bearer, private-key headers, mnemonicsCI
Notes
86.38.238.235(no restarts, mount changes, or deploys).fix/prod-hotpatch-reconciliation(not main).