From 4aebb015b0677fb2b4cd1bc220ab38b8eea9467d Mon Sep 17 00:00:00 2001 From: KeyffMS <124252104+KeyffMS@users.noreply.github.com> Date: Fri, 4 Sep 2026 09:41:22 +0200 Subject: [PATCH 1/3] Route runner diagnostics through approved qualification workflow --- .../plananvil-codex-qualification.yml | 91 +++++++++++++++++++ 1 file changed, 91 insertions(+) diff --git a/.github/workflows/plananvil-codex-qualification.yml b/.github/workflows/plananvil-codex-qualification.yml index 8ff0f94..5917af9 100644 --- a/.github/workflows/plananvil-codex-qualification.yml +++ b/.github/workflows/plananvil-codex-qualification.yml @@ -11,6 +11,7 @@ on: options: - smoke - c13 + - diagnostics - full permissions: @@ -60,6 +61,96 @@ jobs: after="$(git status --porcelain=v1 --untracked-files=all)" test "${before}" = "${after}" + diagnostics: + name: Codex runner variant matrix + if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && inputs.mode == 'diagnostics' + environment: plananvil-codex + runs-on: + - self-hosted + - linux + - x64 + - plananvil + - codex + timeout-minutes: 120 + steps: + - name: Validate controlled runner + shell: bash + run: | + set -euo pipefail + test "${GITHUB_REF}" = "refs/heads/main" + command -v plananvil-qualification-workspace + command -v codex + command -v git + command -v python3 + codex --version + git --version + python3 --version + + - name: Validate Linux Codex sandbox prerequisites + shell: bash + run: | + set -euo pipefail + command -v bwrap + bwrap --version + bwrap --unshare-user --uid 0 --gid 0 --ro-bind / / /bin/true + + - name: Create diagnostic workspace + shell: bash + run: | + set -euo pipefail + workspace="$(plananvil-qualification-workspace)" + test -n "${workspace}" + test -d "${workspace}" + root="${workspace}/runner-diagnostics-${GITHUB_RUN_ID}" + repo="${root}/source" + fixtures="${root}/fixtures" + artifact="${root}/artifact" + mkdir -p "${repo}" "${fixtures}" "${artifact}" + + git -C "${repo}" init -q + git -C "${repo}" remote add origin "https://github.com/${GITHUB_REPOSITORY}.git" + git -C "${repo}" fetch --depth=1 origin "${GITHUB_SHA}" + git -C "${repo}" checkout --detach -q "${GITHUB_SHA}" + test "$(git -C "${repo}" rev-parse HEAD)" = "${GITHUB_SHA}" + + echo "DIAGNOSTIC_SOURCE=${repo}" >> "${GITHUB_ENV}" + echo "DIAGNOSTIC_FIXTURES=${fixtures}" >> "${GITHUB_ENV}" + echo "DIAGNOSTIC_ARTIFACT=${artifact}" >> "${GITHUB_ENV}" + + - name: Run diagnostic variant matrix + id: diagnose + shell: bash + run: | + set -euo pipefail + cd "${DIAGNOSTIC_SOURCE}" + set +e + python3 tools/codex_runner_variant_matrix.py \ + --root "${DIAGNOSTIC_FIXTURES}" \ + --output "${DIAGNOSTIC_ARTIFACT}" + rc=$? + set -e + echo "exit_code=${rc}" >> "${GITHUB_OUTPUT}" + exit 0 + + - name: Upload sanitized diagnostic matrix + if: always() + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + with: + name: plananvil-codex-runner-diagnostics-${{ github.run_id }} + path: ${{ env.DIAGNOSTIC_ARTIFACT }} + if-no-files-found: error + retention-days: 14 + + - name: Enforce diagnostic harness execution only + if: always() + shell: bash + run: | + set -euo pipefail + test "${{ steps.diagnose.outputs.exit_code }}" = "0" + test -f "${DIAGNOSTIC_ARTIFACT}/matrix-summary.json" + # Variant observations are intentionally non-gating. This step checks + # only that the diagnostic harness itself completed and produced evidence. + full: name: live capability qualification if: >- From 699cc75a68cab117b2d8720ad39246fc39c5a15b Mon Sep 17 00:00:00 2001 From: KeyffMS <124252104+KeyffMS@users.noreply.github.com> Date: Fri, 4 Sep 2026 09:41:43 +0200 Subject: [PATCH 2/3] Test diagnostics mode in approved qualification workflow --- tests/test_codex_runner_variant_matrix.py | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/tests/test_codex_runner_variant_matrix.py b/tests/test_codex_runner_variant_matrix.py index de46900..2f79d24 100644 --- a/tests/test_codex_runner_variant_matrix.py +++ b/tests/test_codex_runner_variant_matrix.py @@ -11,7 +11,8 @@ import codex_runner_variant_matrix as matrix -WORKFLOW = ROOT / ".github" / "workflows" / "plananvil-codex-runner-diagnostics.yml" +WORKFLOW = ROOT / ".github" / "workflows" / "plananvil-codex-qualification.yml" +STANDALONE_WORKFLOW = ROOT / ".github" / "workflows" / "plananvil-codex-runner-diagnostics.yml" SOURCE = ROOT / "tools" / "codex_runner_variant_matrix.py" @@ -104,17 +105,21 @@ def test_subagent_matrix_varies_runtime_and_agent_type(self) -> None: self.assertIn("_prepare_isolated_codex_home", source) self.assertIn("_cleanup_isolated_codex_home", source) - def test_workflow_is_main_only_self_hosted_and_diagnostic_only(self) -> None: + def test_diagnostics_route_through_existing_runner_allowed_workflow(self) -> None: workflow = WORKFLOW.read_text(encoding="utf-8") + self.assertFalse(STANDALONE_WORKFLOW.exists()) self.assertIn("workflow_dispatch", workflow) + self.assertIn("- diagnostics", workflow) + self.assertIn("inputs.mode == 'diagnostics'", workflow) self.assertIn("github.ref == 'refs/heads/main'", workflow) + diagnostics = workflow[workflow.index(" diagnostics:"):workflow.index(" full:")] for label in ("self-hosted", "linux", "x64", "plananvil", "codex"): - self.assertIn(f"- {label}", workflow) - self.assertIn("codex_runner_variant_matrix.py", workflow) - self.assertIn("plananvil-codex-runner-diagnostics-${{ github.run_id }}", workflow) - self.assertIn("Variant observations are intentionally non-gating", workflow) - self.assertNotIn("release_gate_passed", workflow) - self.assertNotIn("live_codex_qualification_harness_v6.py", workflow) + self.assertIn(f"- {label}", diagnostics) + self.assertIn("codex_runner_variant_matrix.py", diagnostics) + self.assertIn("plananvil-codex-runner-diagnostics-${{ github.run_id }}", diagnostics) + self.assertIn("Variant observations are intentionally non-gating", diagnostics) + self.assertNotIn("release_gate_passed", diagnostics) + self.assertNotIn("live_codex_qualification_harness_v6.py", diagnostics) def test_diagnostic_output_does_not_persist_raw_transcripts(self) -> None: source = SOURCE.read_text(encoding="utf-8") From eaa096de8a4d01b94ed3c66c617d6e7c14bf9e48 Mon Sep 17 00:00:00 2001 From: KeyffMS <124252104+KeyffMS@users.noreply.github.com> Date: Fri, 4 Sep 2026 09:41:54 +0200 Subject: [PATCH 3/3] Remove standalone diagnostics workflow blocked by runner policy --- .../plananvil-codex-runner-diagnostics.yml | 102 ------------------ 1 file changed, 102 deletions(-) delete mode 100644 .github/workflows/plananvil-codex-runner-diagnostics.yml diff --git a/.github/workflows/plananvil-codex-runner-diagnostics.yml b/.github/workflows/plananvil-codex-runner-diagnostics.yml deleted file mode 100644 index f642353..0000000 --- a/.github/workflows/plananvil-codex-runner-diagnostics.yml +++ /dev/null @@ -1,102 +0,0 @@ -name: PlanAnvil Codex runner diagnostics - -on: - workflow_dispatch: - -permissions: - contents: read - -concurrency: - group: plananvil-codex-runner-diagnostics - cancel-in-progress: false - -jobs: - diagnostics: - name: Codex runner variant matrix - if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' - environment: plananvil-codex - runs-on: - - self-hosted - - linux - - x64 - - plananvil - - codex - timeout-minutes: 120 - steps: - - name: Validate controlled runner - shell: bash - run: | - set -euo pipefail - test "${GITHUB_REF}" = "refs/heads/main" - command -v plananvil-qualification-workspace - command -v codex - command -v git - command -v python3 - codex --version - git --version - python3 --version - - - name: Validate Linux Codex sandbox prerequisites - shell: bash - run: | - set -euo pipefail - command -v bwrap - bwrap --version - bwrap --unshare-user --uid 0 --gid 0 --ro-bind / / /bin/true - - - name: Create diagnostic workspace - shell: bash - run: | - set -euo pipefail - workspace="$(plananvil-qualification-workspace)" - test -n "${workspace}" - test -d "${workspace}" - root="${workspace}/runner-diagnostics-${GITHUB_RUN_ID}" - repo="${root}/source" - fixtures="${root}/fixtures" - artifact="${root}/artifact" - mkdir -p "${repo}" "${fixtures}" "${artifact}" - - git -C "${repo}" init -q - git -C "${repo}" remote add origin "https://github.com/${GITHUB_REPOSITORY}.git" - git -C "${repo}" fetch --depth=1 origin "${GITHUB_SHA}" - git -C "${repo}" checkout --detach -q "${GITHUB_SHA}" - test "$(git -C "${repo}" rev-parse HEAD)" = "${GITHUB_SHA}" - - echo "DIAGNOSTIC_SOURCE=${repo}" >> "${GITHUB_ENV}" - echo "DIAGNOSTIC_FIXTURES=${fixtures}" >> "${GITHUB_ENV}" - echo "DIAGNOSTIC_ARTIFACT=${artifact}" >> "${GITHUB_ENV}" - - - name: Run diagnostic variant matrix - id: diagnose - shell: bash - run: | - set -euo pipefail - cd "${DIAGNOSTIC_SOURCE}" - set +e - python3 tools/codex_runner_variant_matrix.py \ - --root "${DIAGNOSTIC_FIXTURES}" \ - --output "${DIAGNOSTIC_ARTIFACT}" - rc=$? - set -e - echo "exit_code=${rc}" >> "${GITHUB_OUTPUT}" - exit 0 - - - name: Upload sanitized diagnostic matrix - if: always() - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 - with: - name: plananvil-codex-runner-diagnostics-${{ github.run_id }} - path: ${{ env.DIAGNOSTIC_ARTIFACT }} - if-no-files-found: error - retention-days: 14 - - - name: Enforce diagnostic harness execution only - if: always() - shell: bash - run: | - set -euo pipefail - test "${{ steps.diagnose.outputs.exit_code }}" = "0" - test -f "${DIAGNOSTIC_ARTIFACT}/matrix-summary.json" - # Variant observations are intentionally non-gating. This step checks - # only that the diagnostic harness itself completed and produced evidence.