Skip to content

secret_setup: a one-shot names python3 as its entrypoint (CI for alpha/rc2, not for merge) - #136

Merged
rappdw merged 1 commit into
alpha/rc2from
ci/m1a-f1-oneshot-entrypoint
Nov 8, 2026
Merged

rappdw merged 1 commit into
alpha/rc2from
ci/m1a-f1-oneshot-entrypoint

Conversation

@rappdw

@rappdw rappdw commented Nov 8, 2026

Copy link
Copy Markdown
Member

Draft, for CI only. This pull request exists so that the required checks, suite (3.9) and suite (3.13), run on
c0113f3 before alpha/rc2 is fast-forwarded to it. It is not merged: alpha/rc2 moves by a reviewed fast-forward push of
the same commit, and this pull request is then closed. Its branch is deleted only on the operator's word.

The writer's one-shot ran <image> python3 -I -S /w/host_steps.py ..., which hands "python3" to the image's ENTRYPOINT
as its first argument. The hub-link router's image declares a mode dispatcher as its entrypoint, which refuses an
unknown mode, so the one-shot root step of the rendered host plan stopped there. The stat one-shot (verify's volume
check) and the B5 writer route use the same argv shape.

oneshot() now passes --entrypoint python3 before the image and only python3's arguments after it, as
router_fingerprint and partition_probe already do. The probe and the runtime still run through the image's own
entrypoint and mode. host_steps.py is unchanged.

Tests: tests/test_secret_setup.py asserts the plan's root line, the live stat argv, and every one-shot role (root,
writer, stat) name python3 as the entrypoint, with the image followed by python3's arguments only.

🤖 Generated with Claude Code

The writer's one-shot ran `<image> python3 -I -S /w/host_steps.py ...`,
which hands "python3" to the image's ENTRYPOINT as its first argument.
The hub-link router's image declares /app/docker/entrypoint.sh, a mode
dispatcher, and refused it on the alpha VM ("entrypoint: unknown mode
'python3'") at host-setup plan line 42, the volume root step. The same
argv shape is used by verify's stat-secret one-shot and by the B5
writer route, so each would refuse the same way.

oneshot() now passes `--entrypoint python3` before the image and only
python3's arguments after it, as router_fingerprint and partition_probe
already do. The probe and the runtime itself still run through the
image's own entrypoint and mode.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rappdw
rappdw merged commit c0113f3 into alpha/rc2 Nov 8, 2026
3 checks passed
@rappdw
rappdw deleted the ci/m1a-f1-oneshot-entrypoint branch November 8, 2026 20:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant