[aitrawog]

Summary

charly pinned github.com/opencharly/plugin-check/candy/plugin-check v0.2026293.1223, which predates two merged producer fixes: opencharly/plugin-check#128 (a nested child's deploy key built from its root) and opencharly/plugin-check#130 (a kind:local bed torn down in place, never with the container verb). Without #130 a host: local bed's cleanup calls charly remove --purge, so a local bed on a venue without a container engine fails its LAST step after every authored assertion passed (opencharly/plugin-check#129).

This change is the pin bump to v0.2026295.2128 (tag v2026.295.2128, squash 37f4fe6) and its two go.sum hash lines. Two files, no Go source change. One bump closes #128 and #130 for this pin; in the new module bedRootTeardownArgs (bed_run.go:335) is the one predicate behind both cleanup switches (bed_run.go:760, bed_run.go:988).

Head fa0382b5e18c89dc4b5f8bd2283cd046ae4d35d2, tree ca520dc07e75460cee69723299c85ebf8706e162; base origin/main 9fd74793, tree be0eb882e33a481f2ed1f660abfdfea2d41439e5.

$ git rev-parse HEAD
fa0382b5e18c89dc4b5f8bd2283cd046ae4d35d2
$ git diff --numstat origin/main...HEAD
1	1	charly/go.mod
2	2	charly/go.sum

How tested

Every command below ran on the worktree .worktrees/containerd-crabbox-program/charlypin/charly, head fa0382b5, tree ca520dc07e75460cee69723299c85ebf8706e162.

The repository's own CI gate (.github/workflows/ci.yml, the go job)

charly/go.mod declares go 1.26.8, which is the toolchain CI's setup-go installs from go-version-file. The host's Go is 1.27.3, and running golangci-lint under it produced export-data typecheck errors in every module including untouched tools/*; re-running under the pinned GOTOOLCHAIN=go1.26.8 is the faithful reproduction and is what is pasted here.

$ git rev-parse HEAD
fa0382b5e18c89dc4b5f8bd2283cd046ae4d35d2
$ mkdir -p /tmp/charly-ci && TMPDIR=/tmp/charly-ci GOTMPDIR=/tmp/charly-ci go test ./charly/...
ok  	github.com/opencharly/charly/charly	481.711s
ok  	github.com/opencharly/charly/charly/internal/pluginsgen	131.100s
# exit 0

$ for d in tools/*/; do [ -f "$d/go.mod" ] || continue; ( cd "$d" && GOWORK=off go test -count=1 ./... ); done
ok  	github.com/opencharly/charly/tools/gomod-canonical	0.009s
ok  	github.com/opencharly/charly/tools/ledger-validate	0.009s
# exit 0

$ gofmt -l charly tools
# no output, exit 0

$ cd charly && GOTOOLCHAIN=go1.26.8 /tmp/lint1268/golangci-lint run ./...
0 issues.
# exit 0 (then each tools/* module, GOWORK=off: 0 issues. in every module)

The core gate (charly/AGENTS.md R9)

$ cd charly && go build ./... ; echo "build_exit=$?"
build_exit=0
$ cd charly && go vet ./... ; echo "vet_exit=$?"
vet_exit=0

$ ./scripts/bootstrap-charly.sh
bootstrap-charly: regenerating compiled-in plugin wiring
bootstrap-charly: building bin/charly
bootstrap-charly: built ./bin/charly (2026.295.2200)
$ ./bin/charly version
2026.295.2200

The pin at the artifact boundary

Before = a binary rebuilt from origin/main 9fd74793 (pin v0.2026293.1223, version 2026.295.1709), tree be0eb882e33a481f2ed1f660abfdfea2d41439e5. After = the worktree binary above (pin v0.2026295.2128, version 2026.295.2200), tree ca520dc07e75460cee69723299c85ebf8706e162.

$ strings <before-worktree>/bin/charly | grep -c bedRootTeardownArgs
0
$ strings <this-worktree>/bin/charly | grep -c bedRootTeardownArgs
1

The module source agrees: grep -rl bedRootTeardownArgs returns 0 files under plugin-check@v0.2026293.1223 and 3 files under plugin-check@v0.2026295.2128.

The live R10 bed (the changed path)

check-commands-local is a host: local, disposable: true bed in this repo's charly.yml — the exact shape #130 fixes. It ran on the rebuilt worktree binary (driver_version: 2026.295.2200).

$ ./bin/charly check run check-commands-local
charly check run check-commands-local: [deploy-add] PASS after 9m25.944s [allowlisted=1]
charly check run check-commands-local: [bring-up-members] PASS after 3ms
charly check run check-commands-local: [check-live] PASS after 7m30.511s [allowlisted=1]
charly check run check-commands-local: [update] PASS after 4m10.04s [allowlisted=1]
charly check run check-commands-local: [cleanup] START (charly deploy del; log: .check/check-commands-local/2026.295.2211/cleanup.log)
charly check run check-commands-local: [cleanup] PASS after 2m48.996s [allowlisted=1]
charly check run check-commands-local: [cleanup-members] PASS after 0s
charly check run check-commands-local: PASS (steps=6)
# exit 0

The bed's summary.yml rolls up 6 steps, 6 ok, 0 failed, 0 skipped, and the nested check-live leg reports 10 steps: 10 passed, 0 failed, 0 skipped. cleanup.log ends with Removed external deploy a7e4d6f0029f360d (local) — the teardown now uses the deploy verb (charly deploy del), not charly remove.

The -race result, reported in full

go test -race ./ on the root package is RED on TestConnectPluginReady_HonorsACallerCancellation (about 32 s against its 10 s bound) — on this head AND on origin/main 9fd74793 with the old pin, whose Go source is byte-identical to this head's. The per_attempt handshake fallback is 120 s, so the ~32 s tracks the test's own 30 s ReadyTimeout; the same test passes without -race (4.46 s) and CI's configured suite above is green. It is a pre-existing defect in the connect-cancellation path, not this change, and it is filed as opencharly/charly#1028. No production connect site passes a cancellable context today (plugin_connect_deadline.go uses context.Background()), so the shipped path is unaffected.

$ TMPDIR=/tmp/charly-ci GOTMPDIR=/tmp/charly-ci go test -count=1 -run 'TestConnectPluginReady_HonorsACallerCancellation' ./
--- PASS: TestConnectPluginReady_HonorsACallerCancellation (4.46s)
ok  	github.com/opencharly/charly/charly	8.596s
# exit 0

Rulebook compliance

• R0 — Loaded the umbrella AGENTS.md, charly/AGENTS.md, and the /charly-internals:{git-workflow,go,strict-policy,root-cause-analyzer} skills before any git action.
• R1 — Every failure and warning was RCA'd. The -race failure is non-blocking and separable (identical source fails on origin/main) and is filed as opencharly/charly#1028. The local golangci-lint export-data failure was an instrument/toolchain error, reproduced on untouched modules and cleared under the pinned 1.26.8 toolchain. The change-class gate above carries zero warnings.
• R2 — The diff is one require line and its two sum lines; no duplicated implementation or rule is introduced.
• R3 — No sleep, retry, suppression, or ad-hoc podman/systemctl command; the bed was driven only through charly check run.
• R4 — No documented command or doc text changes; the product and the prose are untouched.
• R5 — The old pin string is deleted from the tree in this same commit, with no alias:

$ git grep -n 'v0.2026293.1223' -- . ':!CHANGELOG'; echo "exit=$?"
exit=1

• R6 — git status was run before any action; all work is in the session worktree .worktrees/containerd-crabbox-program/charlypin/charly; no force-push, no direct push to main, no hook bypass, and no other session's branch, PR, or file was touched.
• R7 — The coverage that fails without the change is the artifact A/B (0 before, 1 after) and the module-source scan (0 vs 3 files); the emitted binary is validated at its boundary, and the changed path executed live in the bed above.
• R8 — No live service was mocked: the producer tag and module were resolved live from GitHub and the module proxy, and the bed loaded its out-of-tree plugins from their real builds.
• R9 — The worktree-local CalVer build (scripts/bootstrap-charly.sh) produced 2026.295.2200, the binary the bed ran; no new runtime OS dependency, so packaging: is unchanged.
• R10 — A fresh rebuild on the final tree plus a live run on the affected disposable: true target (check-commands-local, host: local): PASS, 6 of 6 steps, cleanup through charly deploy del.
• HC — One cutover, one pin bump, one commit, one PR; no shim and no second version spelling (charly/charly.yml names the plugin without a version, so go.mod is its only version declaration).

Change classification

• Class: charly Go code — a compiled-in plugin's dependency pin. Not documentation-only: no .md, comment-only, or documentation-submodule path is in the diff.
• Tier: fully tested and validated — the class's gate (CI's configured Go job, the core go build/go vet, the R9 build) passed on this tree, and the changed runtime path ran live on a disposable target.
• Divergence stated (per charly/946): the extra -race instrument is red on a PRE-EXISTING, filed test (opencharly/charly#1028) that fails identically on origin/main with identical source; it is not part of the change-class gate and does not affect the shipped path.

Filed issues

• TestConnectPluginReady_HonorsACallerCancellation is RED under -race: a caller cancel waits out the 30s ReadyTimeout, and CI runs no race gate #1028 — TestConnectPluginReady_HonorsACallerCancellation is RED under -race (pre-existing; reproduces on origin/main with identical source); non-blocking for this pin bump.

Closes #1026

Agent: containerd-crabbox-program/charlypin · session 8b1c01cf-7f79-4a75-bff8-240415a06208
Assisted-by: Claude Code deepseek-v4.1-flash:cloud (fully tested and validated)

[github-actions]

Review — PASS

What the diff does

The change is exactly what the body claims: one require line in charly/go.mod bumped from plugin-check v0.2026293.1223 to v0.2026295.2128, and the two corresponding charly/go.sum lines (module h1: hash replaced, go.mod h1: hash retained). No Go source, no docs, no config touched. The --numstat quoted in the body (1/1 go.mod, 2/2 go.sum) is reproduced by the diffs, and the "2 changed files" count matches.

Consistency checks I could re-derive

• File count / shape — body says two files, no Go source change; the diff shows precisely that. ✅
• go.sum coherence — the h1: (module zip) hash changes while the /go.mod h1: hash stays identical. That is the expected signature of a producer release whose source changed but whose dependency set did not, which matches the body's description (two internal producer fixes, refactor(charly): vmshared→spec envelope-route repoint — all 23 passthrough symbols (task #16) #128 and fix: align Codex validator permissions #130, no new deps). Internally consistent. ✅
• Old pin removal (R5) — the only occurrence of v0.2026293.1223 in the diff is deleted in the same commit; no alias/second spelling is introduced. ✅
• Claimed new-symbol evidence — the body's bedRootTeardownArgs A/B (0 before, 1 after at the binary boundary; 0 vs 3 files at module source) is a plausible, falsifiable artifact-boundary check appropriate to a pin bump; nothing in the diff contradicts it. Unverifiable from here, but it is the right kind of evidence and is stated with concrete commands. ✅
• Disclosed red instrument — the -race failure on TestConnectPluginReady_HonorsACallerCancellation is reported in full, attributed to pre-existing source (identical on origin/main), shown green without -race (4.46 s), and filed as TestConnectPluginReady_HonorsACallerCancellation is RED under -race: a caller cancel waits out the 30s ReadyTimeout, and CI runs no race gate #1028. This is honest divergence disclosure, not a hidden failure; the shipped connect path is stated to use context.Background(). Not caused by, and not gating, this bump. ✅

Tests

A dependency pin bump cannot ship new in-repo tests; the appropriate gate is the existing suite plus an artifact-level and live-path check, which the body documents (CI go job green, go build/go vet exit 0, tools/* modules green, gofmt clean, golangci-lint 0 issues under the pinned 1.26.8 toolchain, and a live check-commands-local run whose cleanup now logs Removed external deploy … (local) via charly deploy del). That is proportionate coverage for a two-line change.

Security / scope

No secrets, no injection surface, no privilege change, no new dependency beyond the bumped module. Scope is coherent and minimal — no leftover legacy pin, no duplicated implementation, no dead code.

Comments

There are zero comments, so there is no sign-off to weigh and no third-party claim to re-derive. The change stands on its own evidence.

Minor notes (non-blocking)

• The body is far more elaborate than a two-line bump strictly requires, and several verification claims (live bed timings, strings counts, module-source file counts) are not independently checkable from the supplied context; they are, however, internally consistent and do not contradict the diff.
• The pre-existing -race red is correctly separated from this change; confirming TestConnectPluginReady_HonorsACallerCancellation is RED under -race: a caller cancel waits out the 30s ReadyTimeout, and CI runs no race gate #1028 independently is a follow-up, not a gate on this PR.

Everything required for a dependency-pin adoption is present and consistent with the diff; nothing in the current state justifies a block.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run