Repair v17 registry binding and bound CI observer installation

.github/workflows/slopsearx-pilot.yml

@@ -122,10 +122,10 @@ jobs:
       checks: read
       pull-requests: read
       actions: read
-    uses: groktopus/codereview/.github/workflows/pr-analysis.yml@dd01a24976631c957a34f3ecc80dcb097948e450
+    uses: groktopus/codereview/.github/workflows/pr-analysis.yml@b075e50db01154cbd996a5549afef62f065df2d9
     with:
       harness_repository: groktopus/codereview
-      harness_sha: dd01a24976631c957a34f3ecc80dcb097948e450
+      harness_sha: b075e50db01154cbd996a5549afef62f065df2d9
       target_repository: magnus919/SlopSearX
       pull_request_number: ${{ fromJSON(inputs.pull_request_number) }}
       base_ref: ${{ needs.resolve-target.outputs.base_ref }}

.github/workflows/test.yml

@@ -184,10 +184,10 @@ jobs:
         with:
           python-version: '3.13'
       - name: Install the Linux syscall observer
+        timeout-minutes: 3
         run: |
           set -euo pipefail
-          sudo apt-get update
-          sudo apt-get install --yes strace
+          bash scripts/install_ci_strace.sh
       - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
         with:
           name: pr-review-distributions

docs/V17-HOSTED-SELECTOR.md

@@ -22,7 +22,9 @@ byte-identical (8,087 bytes, SHA-256
 `004df69e267e61f3457099ef2febcadee7bf2378e6f1cc0507f19881adc4e129`).
 
 The selected reusable workflow is pinned to the qualified v17-capable runtime
-at `dd01a24976631c957a34f3ecc80dcb097948e450`. This makes the v17 input
+at `b075e50db01154cbd996a5549afef62f065df2d9`. That commit contains both the manifest engine and the closed contract registry.
+Contract resolution runs from the pinned checkout, so qualification must exercise
+that exact resolver as well as CLI preparation. This makes the v17 input
 available to the caller; it does not validate the profile's review quality or
 establish production behavior. The provider wire quote uses adapter 0.2 and
 continues to use the same quote/ledger checks before dispatch. Publication

scripts/central_pilot_admission.py

@@ -37,7 +37,7 @@
 TARGET = "magnus919/SlopSearX"
 BASE_REF = "main"
 REUSABLE_PATH = ".github/workflows/pr-analysis.yml"
-REUSABLE_SHA = "dd01a24976631c957a34f3ecc80dcb097948e450"
+REUSABLE_SHA = "b075e50db01154cbd996a5549afef62f065df2d9"
 MAX_EVENT_BYTES = 64 * 1024
 SHA1 = re.compile(r"^[0-9a-f]{40}$")
 RUN_ID = re.compile(r"^[1-9][0-9]{0,19}$")

scripts/install_ci_strace.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if command -v strace >/dev/null 2>&1; then
+  printf 'Using existing strace: %s\n' "$(command -v strace)"
+  exit 0
+fi
+
+for command_name in timeout sudo apt-get; do
+  if ! command -v "$command_name" >/dev/null 2>&1; then
+    printf 'Required observer installer command is unavailable: %s\n' "$command_name" >&2
+    exit 127
+  fi
+done
+
+for attempt in 1 2; do
+  if timeout --kill-after=5s 60s bash -c '
+    set -euo pipefail
+    sudo apt-get \
+      -o Acquire::http::Timeout=15 \
+      -o Acquire::https::Timeout=15 \
+      -o Acquire::Retries=0 \
+      update
+    sudo apt-get \
+      -o Acquire::http::Timeout=15 \
+      -o Acquire::https::Timeout=15 \
+      -o Acquire::Retries=0 \
+      install --yes --no-install-recommends strace
+  '; then
+    if command -v strace >/dev/null 2>&1; then
+      printf 'Installed strace: %s\n' "$(command -v strace)"
+      exit 0
+    fi
+    printf 'apt completed but strace is not available on PATH\n' >&2
+  else
+    status=$?
+    printf 'strace installation attempt %s failed (status %s)\n' "$attempt" "$status" >&2
+  fi
+  if [[ "$attempt" -eq 1 ]]; then
+    sleep 1
+  fi
+done
+
+printf 'Unable to install the required Linux syscall observer after two bounded attempts\n' >&2
+exit 1

tests/test_ci_strace_install.py

@@ -0,0 +1,139 @@
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+INSTALLER = ROOT / "scripts/install_ci_strace.sh"
+
+
+def _fake_command(path: Path, name: str, body: str) -> None:
+    executable = path / name
+    executable.write_text("#!/bin/bash\nset -euo pipefail\n" + body, encoding="utf-8")
+    executable.chmod(0o755)
+
+
+def _fixture(tmp_path: Path, *, fail_first_update: bool = False, always_fail: bool = False,
+             install_strace: bool = True, existing_strace: bool = False,
+             host_strace_canary: bool = False) -> tuple[Path, dict[str, str], Path]:
+    bin_dir = tmp_path / "bin"
+    bin_dir.mkdir()
+    for name in ("bash", "cat", "chmod", "sleep"):
+        trusted_tool = shutil.which(name, path=os.defpath)
+        if trusted_tool is None:
+            raise RuntimeError(f"required test utility is unavailable: {name}")
+        (bin_dir / name).symlink_to(trusted_tool)
+    host_bin = tmp_path / "host-bin"
+    host_bin.mkdir()
+    if host_strace_canary:
+        _fake_command(host_bin, "strace", "printf 'host strace canary\\n'\n")
+    log = tmp_path / "commands.log"
+    env = {
+        **os.environ,
+        "PATH": str(bin_dir),
+        "HOST_STRACE_CANARY": str(host_bin / "strace"),
+        "FAKE_BIN": str(bin_dir),
+        "FAKE_LOG": str(log),
+        "FAKE_FAIL_FIRST_UPDATE": "1" if fail_first_update else "0",
+        "FAKE_ALWAYS_FAIL": "1" if always_fail else "0",
+        "FAKE_INSTALL_STRACE": "1" if install_strace else "0",
+    }
+    _fake_command(
+        bin_dir,
+        "timeout",
+        'printf "timeout %s\\n" "$*" >> "$FAKE_LOG"\n'
+        '[[ "$1" == "--kill-after=5s" ]] && shift\n'
+        '[[ "$1" == "60s" ]] && shift\n'
+        'exec "$@"\n',
+    )
+    _fake_command(
+        bin_dir,
+        "sudo",
+        'printf "sudo %s\\n" "$*" >> "$FAKE_LOG"\nexec "$@"\n',
+    )
+    _fake_command(
+        bin_dir,
+        "apt-get",
+        'printf "apt-get %s\\n" "$*" >> "$FAKE_LOG"\n'
+        'action="${!#}"\n'
+        'if [[ "$FAKE_ALWAYS_FAIL" == "1" ]]; then exit 41; fi\n'
+        'if [[ "$action" == "update" ]]; then\n'
+        '  count=0; [[ -f "$FAKE_LOG.update-count" ]] && count="$(cat "$FAKE_LOG.update-count")"\n'
+        '  count=$((count + 1)); printf "%s" "$count" > "$FAKE_LOG.update-count"\n'
+        '  if [[ "$FAKE_FAIL_FIRST_UPDATE" == "1" && "$count" == "1" ]]; then exit 42; fi\n'
+        'elif [[ "$action" == "strace" && "$FAKE_INSTALL_STRACE" == "1" ]]; then\n'
+        '  printf "#!/bin/sh\\nexit 0\\n" > "$FAKE_BIN/strace"; chmod +x "$FAKE_BIN/strace"\n'
+        'fi\n',
+    )
+    if existing_strace:
+        _fake_command(bin_dir, "strace", "exit 0\n")
+    return bin_dir, env, log
+
+
+def _run(env: dict[str, str]) -> subprocess.CompletedProcess[str]:
+    trusted_bash = shutil.which("bash", path=os.defpath)
+    if trusted_bash is None:
+        raise RuntimeError("required test utility is unavailable: bash")
+    return subprocess.run(
+        [trusted_bash, str(INSTALLER)], env=env, capture_output=True, text=True, timeout=10, check=False
+    )
+
+
+def test_installer_uses_existing_strace_without_apt_or_sudo(tmp_path: Path):
+    _, env, log = _fixture(tmp_path, existing_strace=True)
+
+    completed = _run(env)
+
+    assert completed.returncode == 0
+    assert "Using existing strace:" in completed.stdout
+    assert not log.exists()
+
+
+def test_installer_retries_once_with_bounded_apt_options_and_requires_strace(tmp_path: Path):
+    _, env, log = _fixture(tmp_path, fail_first_update=True, host_strace_canary=True)
+    assert Path(env["HOST_STRACE_CANARY"]).is_file()
+    assert str(Path(env["HOST_STRACE_CANARY"]).parent) not in env["PATH"].split(os.pathsep)
+
+    completed = _run(env)
+
+    assert completed.returncode == 0
+    assert "attempt 1 failed" in completed.stderr
+    assert "Installed strace:" in completed.stdout
+    lines = log.read_text(encoding="utf-8").splitlines()
+    assert sum(line.startswith("timeout ") for line in lines) == 2
+    apt_lines = [line for line in lines if line.startswith("apt-get ")]
+    assert len(apt_lines) == 3
+    assert sum(line.endswith(" update") for line in apt_lines) == 2
+    assert sum(" install --yes --no-install-recommends strace" in line for line in apt_lines) == 1
+    assert all("Acquire::http::Timeout=15" in line for line in apt_lines)
+    assert all("Acquire::https::Timeout=15" in line for line in apt_lines)
+    assert all("Acquire::Retries=0" in line for line in apt_lines)
+    assert all("--kill-after=5s 60s" in line for line in lines if line.startswith("timeout "))
+
+
+def test_installer_fails_after_two_attempts_when_apt_cannot_complete(tmp_path: Path):
+    _, env, log = _fixture(tmp_path, always_fail=True)
+
+    completed = _run(env)
+
+    assert completed.returncode != 0
+    assert "after two bounded attempts" in completed.stderr
+    lines = log.read_text(encoding="utf-8").splitlines()
+    assert sum(line.startswith("timeout ") for line in lines) == 2
+    assert sum(line.startswith("apt-get ") and line.endswith(" update") for line in lines) == 2
+
+
+def test_installer_does_not_succeed_when_apt_returns_without_strace(tmp_path: Path):
+    _, env, log = _fixture(tmp_path, install_strace=False)
+
+    completed = _run(env)
+
+    assert completed.returncode != 0
+    assert "apt completed but strace is not available" in completed.stderr
+    assert "after two bounded attempts" in completed.stderr
+    lines = log.read_text(encoding="utf-8").splitlines()
+    assert sum(line.startswith("timeout ") for line in lines) == 2
+    apt_lines = [line for line in lines if line.startswith("apt-get ")]
+    assert sum(" install --yes --no-install-recommends strace" in line for line in apt_lines) == 2

tests/test_pilot_workflow.py

@@ -9,7 +9,7 @@
 import pytest
 
 WORKFLOW = Path(__file__).parents[1] / ".github/workflows/slopsearx-pilot.yml"
-PIN = "dd01a24976631c957a34f3ecc80dcb097948e450"
+PIN = "b075e50db01154cbd996a5549afef62f065df2d9"
 SECRETS = (
     "LLM_BASE_URL",
     "LLM_MODEL",

tests/test_selected_control_transport_receipt.py

@@ -755,7 +755,9 @@ def test_secretless_ci_runs_opt_in_roundtrip_against_the_built_wheel():
     job = workflow.split("  transport-receipt-roundtrip:", 1)[1]
     assert "needs: build" in job
     assert "runs-on: ubuntu-latest" in job
-    assert "sudo apt-get install --yes strace" in job
+    assert "- name: Install the Linux syscall observer\n        timeout-minutes: 3" in job
+    assert "bash scripts/install_ci_strace.sh" in job
+    assert "continue-on-error" not in job
     assert "actions/download-artifact" in job and "pr-review-distributions" in job
     assert 'pip install "$ROUNDTRIP_DIST"/*.whl pytest' in job
     assert "RUN_INSTALLED_LOOPBACK_TRANSPORT_VALIDATOR_TEST: '1'" in job