Act/docker runners commonly block non-privileged user namespaces, so
setpriv+CapEff=0 cannot run bwrap. Gate the proof on `unshare --user`
and keep unit + remaining integration tests as the default CI net.
agent-sandbox-linux requires uid>0, CapEff=0, and NoNewPrivs=1. Act runners
often execute as root with residual caps; create cphci and drop privileges
via setpriv before vitest.
hub build runs admin:build; fleet deploy already npm ci --prefix admin-web
but hub-check only installed hub/. Without that, vite fails on @sveltejs/kit.
Concurrent hub-check jobs on the shared runner fought over published
host ports (5432 then 15432). Drop host port mapping and connect to the
service container as postgres:5432 on the job network.
Runner host 5432 is already allocated (leftover containers), causing
hub-check service Postgres to fail start. Map service DB to 15432 and
point wait/integration DATABASE_URL at that port.
The spec/ Lean semantic master had no conformance gate, no codegen, and
no CI tie to implementations — alignment was carried entirely by human
review, the same mechanism that carries the ADRs. In practice the ADRs
plus greppable code comments were already the load-bearing artifacts,
so spec/ was the most expensive kind of stale documentation.
- delete spec/ and the spec-check CI workflow
- README: constitution rewritten around ADRs as decision truth
- AGENTS.md/CLAUDE.md: discipline re-anchored (new decisions -> new ADR,
never rewrite ADR history; supersede instead)
- code comments: re-anchor 'Mirrors Spec.X' invariants to ADR numbers
(cph-diag, cph-check, cph-model, hub runner/capacity/org, prisma)
- leave ADR bodies and .scratch audit snapshots untouched (history);
fix live references in open readiness tickets
Add deploy_fleet_release.sh and a workflow that rolls immutable Hub
releases (including admin-web) to educraft-dev on push/PR and educraft
on main/tags, selecting silos by HUB_PUBLIC_BASE_URL middle domain.
Mirrors spec-check's framing: an internal health gate on the implementation
(build/test/lint), not a spec→impl conformance gate (alignment is by review).
Installs fonts-noto-cjk ahead of the typst-compiling crates (WU-4+), since the
engineering files are CJK-heavy.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
hongjr03
sjfhsjfh
