Complete signed owned-CI reporting path

[hyperpolymath]

What changed

• carry each frozen CI-check Baton envelope through CiSweep;
• thaw and verify the signed envelope before a pass can reach the GitHub bridge;
• preserve the fail-closed rule that only mode=prod plus verified Ed25519 can post green;
• add an explicit absolute workdir so Bag can run another repository’s own command surface;
• route ordinary sweeps deterministically to the lowest-money-cost capable node instead of an unordered first match;
• add idris2 and just capabilities consistently across Idris2, Zig, Elixir, and the Guix estate mirror;
• add end-to-end regression coverage for signed sweep-to-green reporting and external target workdirs;
• update the owned-CI documentation to match the implementation and current toolchain gaps.

Why

CiSweep previously discarded the frozen-envelope path and attestation. As a result, mix bag.report correctly refused every real green status even though unit tests passed with manually injected attestations. The simple sweep route could also select the logical paid GitHub runner because node-map order, rather than cost, decided the winner.

This patch closes the bounded execution-to-reporting gap without claiming that webhook intake, durable queueing, or real distributed transport already exist.

Validation

• mix compile --warnings-as-errors — pass
• focused Elixir regression suite — 19 tests, 0 failures
• Zig 0.15.2 zig build test — pass
• Idris2 idris2 --typecheck bag.ipkg — pass
• just estate-sync — pass
• touched-file mix format --check-formatted — pass
• git diff --check — pass

The repository’s unbounded zig = "latest" currently resolves to incompatible Zig 0.16, and the complete dogfood manifest also requires unavailable wasmtime. Those existing reproducibility gaps are tracked in the product roadmap rather than hidden by this PR.

Roadmap

The private project board “Bag of Actions — Zero-cost CI Product Roadmap” contains 11 scoped issues covering webhook intake, persistence, transport, manifest security, Guix toolchains, Stapeln/Wolfi packaging, GitHub hardening, operations, the Sim Insolvency pilot, estate-wide adoption, and v1 assurance.

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 2 resolved / 2 findings

Completes the signed owned-CI reporting path with frozen Baton envelope transport, deterministic node-cost routing, and absolute workdir support. Consider addressing the shared tmp_dir freeze path collision and the invalid workdir subprocess invocation finding.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

✅ 2 resolved

✅ Edge Case: Freeze path derived from check_id in shared tmp_dir can collide

📄 bag/lib/bag/mesh.ex:115-116 📄 bag/lib/bag/mesh.ex:161 📄 bag/lib/bag/ci_sweep.ex:46-60
Both submit_check and submit_planned default the freeze envelope to Path.join(System.tmp_dir!(), "#{check_id}.baton"), a deterministic path keyed only on check_id. Two concurrent mix bag.report runs (or a manifest reusing an id) write and thaw the same file, so one sweep can thaw an envelope another just overwrote and mark a legitimate result :tampered (spurious red). This is fail-safe (never a false green) but flaky. Namespace the default path with a unique token, e.g. "#{check_id}-#{System.unique_integer([:positive])}.baton", or place it under a per-run subdirectory.

✅ Quality: Invalid workdir yields :error but still triggers a thaw subprocess

📄 bag/lib/bag/executor.ex:75-89 📄 bag/lib/bag/ci_sweep.ex:46-48
When workdir is not an existing absolute directory, run_check short-circuits with exit code 126 (:error) without ever invoking the Zig host, yet it still returns a baton with freeze_path set. CiSweep.verified_result/4 then matches the is_binary(freeze_path) clause and shells out thaw against a file the host never wrote (or a stale leftover), wasting a subprocess and producing confusing output. Consider skipping the thaw when the execution verdict is :error, or not setting freeze_path on the baton when the host was not run.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)