Repository navigation
Isolate opt-in Ubuntu package installation from unrelated runner repositories #73
Description
Failure
Logismos PR193's full gate and GPU-denied boundary stop before compilation because unscoped apt-get update refreshes the preinstalled Google Chrome repository, whose package index disagrees with its advertised SHA-256. The jobs require Ubuntu packages, not Chrome. A direct upstream recheck reproduced the same mismatch.
The shared owner is .github/workflows/hybrid-gate.yml's system dependency installation; the second consumer is Logismos's boundary job.
Accepted repair
The operator approved a CI-only repair on 2026-09-09: one reusable Ubuntu package installer, an explicit shared-gate opt-in preserving current behavior for other callers, and adoption by both Logismos jobs. No Menos packages, GPU access, host/service changes, gate bypass or numerical/test-policy changes.
Acceptance
- One original installer owns the source policy; both refresh and install use only its trusted Ubuntu sources and isolated package lists/cache, not inherited third-party source or cache state.
- Ubuntu signing keys and signature/hash/date checks remain enforced; invalid package/host inputs fail before apt mutation; refresh failure prevents installation.
- Fixture tests falsify input/option injection, unintended sources/cache use, failure propagation and cleanup errors. Hosted CI proves actual package installation despite an unrelated broken repository.
- Shared gate exposes a typed opt-in; existing callers keep the existing package-source behavior. Both Logismos jobs use the same published installer revision.
- Required source checks and the repaired Logismos gates run normally on the exact candidate before merge. No self-authored gate trailer or admin bypass.
- Exact action publication/adoption references and rollback are recorded. Reverting opt-in/consumer commits restores previous CI setup; there is no persistent machine migration.
The larger reusable-workflow publication programme remains #19. This issue does not close it or Logismos's separately tracked test-coverage and hardware-qualification gaps.
Activity
fix(ci): preserve APT sandbox access and cleanup failures
fix(ci): propagate package policy to APT child processes
fix(ci): publish isolated Ubuntu package installer (#74)
forkwright commentedon Sep 9, 2026
Completed through shared installer PR74, shared opt-in PR75, and Logismos adoption/source PR193.
Publication: installer
637f0e9d1b795e455d1dea96824ad7322002019f; shared opt-in main4569711aee0fd6854f6a07278888cb94094d53bc. Both Logismos paths use that same immutable installer revision. Logismos merge51b965dde7e06170cf02c142540a31867a560a7chas exactly the tested candidate's tree9317ca6ffed4fb8ffb79b21466fd6728d720c987.All 11 final-candidate checks passed: full gate, CPU boundary and HIP compile-only witnesses, security. The full gate ran 824 workspace tests and 157 release-kernel tests (27/13 documented skips). Shared hosted fixtures also pass after merge, including a real absent-package install with an unrelated malformed repository present. Independent completion audit checked source on both repositories' actual main and all acceptance clauses.
The original runner source mismatch is no longer consulted by these installations; APT signature/hash/date validation and normal failure behavior remain enforced. Other callers retain the default package-source behavior. No local Cargo/compiler/GPU/model/host-service operation, gate trailer, or admin bypass was used.
Rollback is source-only: first revert the two Logismos workflow adoption edits through a normal PR (the narrow diff is commit
1eeccfd, retained in PR193 history), then revert the shared opt-in if no caller uses it. Do not revert the whole runtime-boundary batch merely to change CI package policy. This restores previous configuration, not a promise that the unrelated upstream Chrome index is healthy; the published action can remain. There is no persistent machine migration.This closes only the package-source repair. Shared #19 and forkwright/logismos#169, forkwright/logismos#170, forkwright/logismos#171 and forkwright/logismos#177, release-profile/real-artifact proof and physical qualification are not closed by it.