docs: verify PDF baseline and hosted runner isolation blocker
This commit is contained in:
cesnimda
@@ -0,0 +1,54 @@
|
||||
# P9-REMED-02 hosted runner isolation — 24 October 2026
|
||||
|
||||
**Hosted MariaDB CI: BLOCKED.** Fresh read-only evidence reproduces the isolation prerequisite at the accepted `3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28` baseline. No job was dispatched, workflow modified, Docker command run against the hosted runner, or infrastructure changed by this investigation.
|
||||
|
||||
## Current verified evidence
|
||||
|
||||
API observation: **2026-10-24T16:58:58.951740Z**, using the existing Git credential in memory for GET requests only. No credential value, Authorization header or credential-helper output is copied into reports.
|
||||
|
||||
| Question | Verified result | Boundary |
|
||||
| --- | --- | --- |
|
||||
| CI provider | Gitea1.26.0, `/api/v1/version` HTTP200 | Version is not an isolation guarantee |
|
||||
| Actual runner | Baseline [run853](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/853), job1743: runner5 `Live-Runner`; raw log reports v0.4.1 | Host OS, daemon owner, installed binary hash and registration scope unavailable |
|
||||
| Job execution | `ubuntu-latest` resolves to Docker `node:20-bookworm`, observed image digest `sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5` | Label does not mean an Ubuntu VM; digest is this job-image observation |
|
||||
| Effective host boundary | **Merged** HostConfig: `NetworkMode:host`, bind `/var/run/docker.sock:/var/run/docker.sock`, `Privileged:false`, empty PortBindings | Custom pre-merge `Binds:[]` is not the effective configuration. No socket was used by this investigation |
|
||||
| Runner listing | Repository endpoint HTTP200: runner3 `pi-runner-1`, offline, non-ephemeral, labels `ubuntu-latest` and `ubuntu-22.04` | This is not runner5; instance-runner endpoint and `/user` still HTTP403 despite repository admin/push/pull permissions |
|
||||
| Secret boundary | MariaDB workflow references no production secret. Deployment/backup/maintenance workflows reference production SSH credentials and all use `ubuntu-latest` | Shared routing label is verified; actual host co-location, secret values/scopes, fork/PR token policy and availability to this job are **not established** |
|
||||
| Persistent state | Job mounts `act-toolcache` at `/opt/hostedtoolcache`, plus generated workspace/env volumes | Shared cache isolation and runner host/config state not proven disposable. There is no MariaDB data volume in this run because no service started |
|
||||
| Runtime result | First guard exits1 at16:33:21UTC; raw log confirms checkout/setup main steps skipped and integration artifacts absent | API marks downstream steps failed; raw log distinguishes nonexecution. No MariaDB readiness, migrations, test or teardown occurred |
|
||||
| Cleanup | Raw log removes job container and attempts generated workspace/env volume removal | No service/private-network lifecycle, cancel/interruption recovery or cross-job leakage test exists |
|
||||
|
||||
The guard remains an unconditional first-step failure. Runner-owned preparation still pulls/creates the host-network/socket job container and prefetches actions before that guard. A workflow step cannot remove the preparation exposure. Current workflow push filters do not include `fix/p9-pdf-security-requalification`; no new branch trigger is added merely to repeat unsafe preparation. The database lane remains blocked until operator evidence and a reviewed enabling change exist.
|
||||
|
||||
The original run843/844 failures were `docker: command not found` after five mocked runner guards; installing a CLI would not prove a safe daemon. Run853 deliberately does not reach that command. Neither guard tests nor local Docker qualification count as hosted MariaDB execution.
|
||||
|
||||
## Version-specific supported capability
|
||||
|
||||
The official [Gitea1.26 runner documentation](https://docs.gitea.com/1.26/usage/actions/act-runner/) explains registration scope/label routing and warns that job access to a host Docker socket can expose runner registration credentials. The documentation does not certify this deployment. Its general DinD examples are **not** an approved workaround here.
|
||||
|
||||
Fresh direct HTTPS retrieval of the official v0.4.1 tag resolves to commit `9aafec169b7ebf3d71df2b06780868fb552b435e`; the source bytes match the prior qualification's hashes:
|
||||
|
||||
- [Pinned config example](https://gitea.com/gitea/runner/src/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/pkg/config/config.example.yaml), lines86–115: empty `container.network` permits automatic network creation; `docker_host: "-"` suppresses daemon mounting into job and service containers; `privileged:false` and `valid_volumes:[]` are separate controls.
|
||||
- [Pinned runner](https://gitea.com/gitea/runner/src/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/app/run/runner.go), lines220–248: passes task secrets, network/socket/options/privilege/volume controls to the engine, disables reuse and requests automatic removal.
|
||||
- [Pinned act execution engine](https://gitea.com/gitea/act/src/tag/v0.261.10/pkg/runner/run_context.go), lines116–121 and309–401: a configured network is reused; otherwise services receive a generated job network and DNS aliases. Declared ports produce bindings. Normal cleanup attempts service/network removal and logs errors.
|
||||
|
||||
Native services are therefore a supported source capability, **not a verified runtime capability of the installed binary/configuration**. Services start before job steps. Cleanup source/AutoRemove does not prove recovery after crashes or cancellations. A private Docker network also does not itself block host/LAN egress; host/network policy must establish production separation.
|
||||
|
||||
## Exact operator implementation and verification handoff
|
||||
|
||||
The infrastructure owner must perform this work on a **new, dedicated nonproduction CI host/VM/daemon**. Do not repurpose, restart or reconfigure the unknown Live-Runner host under this development task.
|
||||
|
||||
1. Supply sanitized host/daemon ownership, runner registration scope, binary version/hash and image/OS identities. Prove no production workloads, credentials, data mounts or management endpoints are present/reachable. Give the dedicated runner a unique routing label, for example `jobtracker-mariadb-isolated`, unavailable on production/deployment runners. Pin its job image version/digest after compatibility validation; `ubuntu-latest` is insufficient.
|
||||
2. On that dedicated host, generate configuration for the exact chosen supported runner binary. For the reviewed v0.4.1 capability, use `container.network: ""`, `container.docker_host: "-"`, `container.privileged:false`, `container.valid_volumes:[]`, and no `container.options` that reintroduce mounts, host networking, privilege or device access. Limit capacity to1 for the first proof, disable shared caches until qualified, and prefer disposable per-job runner/VM state. The runner controller may manage its dedicated daemon; **job and service containers must not receive a daemon socket/remote Docker endpoint or registration/configuration credentials**. These proposed settings are not applied or certified here.
|
||||
3. Establish host firewall/egress policy: allow only needed source/package/artifact retrieval, deny production/private management/database access, and prevent cross-job access. Record the effective **merged** job and service HostConfig, mounts, capabilities, network attachments, port bindings and resource limits. Show no published MariaDB port, host network, privileged mode, persistent DB mount or job-accessible daemon. Review repository/fork/PR trust and least-privilege job-token/secret policy; make no production secrets available to this test lane. Do not dump full environments or secret values into proof.
|
||||
4. Create a runner-managed native service named `mariadb` with exact `mariadb:12.2.2@sha256:42a27baaba3e8f3f0159d16381d5a7156661aa91dcc65f663cabb6a6f9503c00`, recorded linux/amd64 identity, development-only credentials and disposable storage. Declare **no service ports or persistent volumes**. Require an image-supported health check plus bounded authenticated readiness/version queries. Prove job DNS `mariadb:3306` and generated-schema ownership. Isolated Docker services need no Docker CLI inside the job.
|
||||
5. After infrastructure proof, request repository review of the enabling workflow and narrow transport change together. Replace the Compose path with native service use, route only to the unique runner label, preserve default loopback guards, and allow CI-service transport only for actual CI, service name `mariadb`, TCP3306. Do not allow arbitrary remote endpoints or a self-attested bypass variable. Keep actual startup migrations, independent persisted-state assertions, cleanup checks, source/image/version identities, native TRX and useful sanitized failure/server logs. Current provider inventory is35 cases; future changes must use exact discovery, zero hidden retries/skips, and never a hard-coded historical32-case pass.
|
||||
6. Execute operator-observed success, deliberate test failure, cancellation and interrupted-runner recovery cases. Retain job-scoped before/after resource inventories; prove service/container/network/schema/data removal, no cross-job access and no stale cache/credentials. Identify how leaked resources are reclaimed after daemon/runner failure without broad prune commands or production effects. Only then run and publish the actual hosted RD21/MariaDB lane.
|
||||
|
||||
Hosted PASS requires executed real MariaDB cases and verified lifecycle evidence. Operator configuration/source examples, guarded exit1, local tests and eventual CLI availability cannot satisfy it. The unmet condition is operator-controlled isolation and recovery evidence, followed by the reviewed workflow/transport change and actual hosted execution.
|
||||
|
||||
## Evidence retention and limitations
|
||||
|
||||
[ci-isolation.json](ci-isolation.json) records sanitized fields and SHA-256 identities. Raw GET responses/logs and fetched sources remain local under `.artifacts/p9-remed-02/ci/`. An initial collector attempt saved its responses, then failed parsing a text log as JSON; its bytes are preserved. The successor correctly distinguishes text logs. Its convenience `mergedHostNetwork:false` substring field expected JSON formatting, while the log is Go-formatted; it is **not used as evidence**. The published interpretation is the actual merged log's `NetworkMode:host`, and `ci-isolation.json` records that explicitly. No failed collector is relabelled hosted test execution.
|
||||
|
||||
No new hosted job, live infrastructure inspection, secret-value access, socket use, privileged change, production access or deployment was performed. Current CI status remains BLOCKED; its infrastructure prerequisites are independent from local RD21 provider closure and production release approval.
|
||||
@@ -0,0 +1,53 @@
|
||||
# PDF pipeline and preservation investigation
|
||||
|
||||
Read-only source/raw-evidence assessment, 24 October 2026, baseline3727a72.
|
||||
This is a root-cause hypothesis and architecture map, not a claim that a repair or new runtime qualification passed.
|
||||
|
||||
## Actual owners
|
||||
|
||||
1. `CvVariantService.RenderAsync` reads the owner-scoped saved variant settings and current canonical Career Profile. `RenderSettingsAsync` renders unsaved settings against the same profile; `RenderPublicAsync` reads only a public slug and its owner's profile. All three call `RenderInternal`, then `CvVariantResolver.Build`, `CvThemeCatalog.Resolve` and the same `IThemedCvRenderer.Render`.
|
||||
2. `CvVariantResolver` produces the model from canonical profile plus variant lens: section order/visibility, language labels and presentation remain variant concerns. Rendering is not a canonical write. Save/restore revision checks and history persistence are separate owners and should remain unchanged.
|
||||
3. `ThemedCvRenderer.Render` normalizes settings, inherits theme values for null overrides and builds one self-contained HTML/CSS document. Nine themes are data in `CvThemeCatalog`, not separate renderer implementations. The renderer chooses single/sidebar/header layouts, fixed A4/Letter geometry, margins/density and flow classifications for long entries/items. Existing frozen PDF bytes are stored artifacts; rerendering HTML must not rewrite those historical bytes.
|
||||
4. `CvVariantController` exposes saved preview, live unsaved preview and saved export. The export wraps the same render HTML in `TailoredCvRenderResult`; `PublicCvController` uses the same exporter. Template thumbnails also use `ThemedCvRenderer`. A fix at this shared HTML owner reaches all these flows, so any intended font change needs thumbnail/public/export checks too.
|
||||
5. `cvPreview.ts:previewDocumentHtml` inserts a pagination script into the HTML. It already awaits `document.fonts.ready` and image decoding, copies the renderer's print rules into screen media, and uses columns as screen fragmentainers. It converts avoid-page to avoid-column and publishes readiness, physical dimensions, page count and overflow state. `CvBuilderEditor` waits for that state and displays individual iframe pages. A font-loading race is therefore not established by simply observing different fonts.
|
||||
6. `PlaywrightCvPdfExporter` writes rendered HTML to an owned temporary local file and launches a configured/native Chromium CLI. It sets headless, no PDF browser header/footer and print-to-PDF, drains diagnostics, bounds execution/admission and verifies process termination. It does not embed fonts, choose a fixed font package or pin Chromium itself. Existing process/admission/security behavior is independent of a typography repair.
|
||||
|
||||
## Font and geometry evidence
|
||||
|
||||
`CvThemeCatalog` uses operating-system font stacks: Segoe UI/Roboto/Arial; Helvetica Neue/Arial; Georgia/Times New Roman; Roboto/Arial; Poppins/Segoe UI/Arial; and utility Roboto Mono/Consolas/Courier New. The six allowed custom font stack strings are normalized by `CvVariantSettingsJson`; persisted strings/null-as-inherit must remain compatible.
|
||||
|
||||
There is no `@font-face` in baseline `ThemedCvRenderer`. CSS family names are requests, not proof of the actual face used. The baseline Linux image installs Chromium but no corresponding document-font package. The recorded Linux environment has DejaVu Sans/Serif/Mono regular/bold; exported PDF font names confirm these substitutions. Windows reference PDFs use different families. Root independently inventories the actual Linux image/runtime/locale in the reproduction record.
|
||||
|
||||
The original raw oracle shows seven fidelity and four settings failures. Their shared pattern is accumulating vertical drift over long prose, including line/page reflow. This strongly supports font metric/wrapping differences as the first controlled hypothesis. It does not yet establish that every failing fixture has only that cause. Browser versions differ too; screen-column versus print fragmentation remains a distinct possibility if equal embedded fonts do not clear a fixture.
|
||||
|
||||
| Baseline failing fixture | Observed consequence |
|
||||
| --- | --- |
|
||||
| long-en-minimal | Accumulating5–85mm marker shifts; markers cross page boundaries |
|
||||
| long-nb-code | Accumulating shifts and different page membership |
|
||||
| compact-8mm-letter | Accumulating shifts despite Letter dimensions being accepted |
|
||||
| roomy-28mm-nb | Preview5 versusPDF6 pages; large cumulative shifts |
|
||||
| grid-and-bubbles | Roughly5mm marker displacement after wrapping/layout |
|
||||
| long-sidebar-nb | Cumulative wrapping/page membership drift in a narrower column |
|
||||
| unbreakable-and-boundary | Long-content/page membership drift, including boundary paragraphs |
|
||||
| light-en-after / light-nb-after | Preview3 versusPDF4 pages; cumulative shifts |
|
||||
| dark-en-after / dark-nb-after | Same geometry consequence in independent theme/language settings cases |
|
||||
|
||||
In these retained eleven failure arrays there are no missing/extra marker, blank-page, physical-page-dimension, font-size, RGB or vertical-safe-area findings. That does not prove complete arbitrary text/glyph fidelity: the oracle checks designated text markers, page text and safe bounds rather than every source character. Raw comparisons/PDF page images remain available for visual review. Missing-content, clipping, colour and nondeterminism must not be invented as established causes.
|
||||
|
||||
## Minimal controlled repair strategy
|
||||
|
||||
First test identical retained HTML with an embedded, licensed font face in both preview and Linux export. Hold fixture text/settings, layout CSS, browser versions and oracle constant. Compare line/page markers before making application changes. A same-font residual must be investigated independently for print/column fragmentation, weights, fallback glyphs, browser version and timing.
|
||||
|
||||
If the experiment confirms missing-font metrics, package exact legally distributable font bytes with version/source/license/hash, embed the required font data into the shared render HTML, and resolve effective font choices consistently. This avoids network dependencies for srcDoc previews, exported local files and public documents. Support normal/bold/italic/bold-italic where content/weights require them; Markdown italics are actually supported. Assert Norwegian glyphs and no unintended fallback. Preserve six supported custom choices and utility mono meaning rather than silently collapsing every setting to one sans face. Avoid fake claims that a substituted face is the proprietary original.
|
||||
|
||||
No proprietary system font copying is justified. Candidate replacement provenance must be verified against the actual distributed files: [Gelasio upstream](https://github.com/SorkinType/Gelasio) states Georgia metric compatibility; [Google Fonts metadata](https://github.com/google/fonts/blob/main/ofl/gelasio/METADATA.pb) declares OFL and records source commit9228e69b160d79f33950e026293f6e13ba9780d0. [Carlito upstream](https://github.com/googlefonts/carlito/blob/main/README.md) targets Calibri metrics, not Segoe UI. Neither an upstream compatibility statement nor an OFL declaration substitutes for the actual fixture measurements, retained license and bundled-byte hash.
|
||||
|
||||
Any new deterministic open-font choice is an intentional visual change for environments previously using another native font. Record original and new images/page counts and explain that change; do not claim identical historical typography or rewrite stored PDFs. Keep profile/settings/revision/API contracts unchanged.
|
||||
|
||||
## Original oracle versus supplemental historical totals
|
||||
|
||||
`scripts/verify-cv-fidelity.py` compares each exported PDF's page count to that fixture's **live previewPages**. It checks A4/Letter dimensions, marker membership and page/position/font-size/colour agreement, hidden text, blank pages and vertical safe bounds, then renders actual PDF bytes independently with PDFium and writes comparison images. Tolerances are2mm position,0.5mm dimensions,0.5pt font size and1/255 RGB.
|
||||
|
||||
It does **not** hardcode36/24 corpus page totals. Those totals were an extra `p9-requal-01/pdf-proof.py` collection assertion for that historical font environment. If an authorized deterministic-font change alters both preview and PDF pagination, preserve historical results and explicitly reconcile the intended new totals while keeping the original oracle and fixture membership/tolerances unchanged. A changed total is not automatically a defect or automatically acceptable: content, layout intent and actual page images still need evidence. Do not weaken the oracle or replace reference images to conceal a mismatch.
|
||||
|
||||
No tests, services, browsers or rendering commands were run by this read-only investigator. Root owns reproduction, visual inspection, implementation and final qualification.
|
||||
@@ -0,0 +1,187 @@
|
||||
{
|
||||
"schemaVersion": 1,
|
||||
"observedUtc": "2026-10-24T16:58:58.951740+00:00",
|
||||
"baselineCommit": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
|
||||
"verdict": "BLOCKED",
|
||||
"giteaVersion": "1.26.0",
|
||||
"apiHttpStatuses": {
|
||||
"version": 200,
|
||||
"repository": 200,
|
||||
"repositoryRunners": 200,
|
||||
"instanceRunners": 403,
|
||||
"user": 403,
|
||||
"runs": 200
|
||||
},
|
||||
"repositoryPermissions": {
|
||||
"admin": true,
|
||||
"push": true,
|
||||
"pull": true
|
||||
},
|
||||
"repositoryRunner": {
|
||||
"id": 3,
|
||||
"name": "pi-runner-1",
|
||||
"status": "offline",
|
||||
"ephemeral": false
|
||||
},
|
||||
"actualRun": {
|
||||
"id": 853,
|
||||
"jobId": 1743,
|
||||
"runnerId": 5,
|
||||
"runnerName": "Live-Runner",
|
||||
"reportedRunnerVersion": "v0.4.1",
|
||||
"jobImage": "node:20-bookworm",
|
||||
"jobImageObservedDigest": "sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5",
|
||||
"mergedHostNetwork": true,
|
||||
"mergedDockerSocketBind": true,
|
||||
"mergedPrivileged": false,
|
||||
"persistentToolcacheMounted": true,
|
||||
"guardExitCode": 1,
|
||||
"guardUtc": "2026-10-24T16:33:21Z",
|
||||
"checkoutAndSdkMainSkipped": true,
|
||||
"mariaDbStarted": false,
|
||||
"mariaDbTestsExecuted": false,
|
||||
"jobContainerRemovalLogged": true,
|
||||
"generatedWorkspaceVolumeRemovalAttemptLogged": true,
|
||||
"privateServiceLifecycleProven": false
|
||||
},
|
||||
"unverified": [
|
||||
"Host/daemon ownership and production separation",
|
||||
"Installed binary source identity and actual effective private service configuration",
|
||||
"Repository/instance secret and PR/fork token policies",
|
||||
"Persistent cache and cross-job isolation",
|
||||
"Success/failure/cancel/crash database-service cleanup"
|
||||
],
|
||||
"sourceCapability": {
|
||||
"runnerTag": "v0.4.1",
|
||||
"runnerCommit": "9aafec169b7ebf3d71df2b06780868fb552b435e",
|
||||
"actVersion": "v0.261.10",
|
||||
"nativePrivateServicesSupportedInSource": true,
|
||||
"installedBinaryMatched": false,
|
||||
"freshSourceManifest": [
|
||||
{
|
||||
"name": "tag",
|
||||
"url": "https://gitea.com/api/v1/repos/gitea/runner/git/refs/tags/v0.4.1",
|
||||
"sha256": "0f6c54a16c6761e8e5393b68bfd227162f919142a75ba050f0fbbc8de308166b"
|
||||
},
|
||||
{
|
||||
"name": "config",
|
||||
"url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/pkg/config/config.example.yaml",
|
||||
"sha256": "e47d046dc368eb85b35665b4a5dba57ce0be4053c665ff737916a7561f7337fa"
|
||||
},
|
||||
{
|
||||
"name": "runner",
|
||||
"url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/app/run/runner.go",
|
||||
"sha256": "857b163f42aeb350aa32fbdc884e8d2ceb738d77e8a25504ac38c3e0035ab590"
|
||||
},
|
||||
{
|
||||
"name": "engine",
|
||||
"url": "https://gitea.com/gitea/act/raw/tag/v0.261.10/pkg/runner/run_context.go",
|
||||
"sha256": "45aea88466bc40c1cddad7ee6cfe98444ffd225a719683ee319c909075466c2c"
|
||||
}
|
||||
]
|
||||
},
|
||||
"workflowChanged": false,
|
||||
"hostedJobsDispatched": false,
|
||||
"runnerChanged": false,
|
||||
"productionAccess": false,
|
||||
"ciGuardBypass": false,
|
||||
"documentation": "CI_ISOLATION.md",
|
||||
"rawEvidence": [
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/instanceRunners.json",
|
||||
"bytes": 164,
|
||||
"sha256": "5aea25deaabb1778f0f4d023fb4529d5161efab460ed6028a27711004e1030d1"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/jobs-853.json",
|
||||
"bytes": 1867,
|
||||
"sha256": "d3aa3ca89944f436bbae0042b685072cd9f2b7b615eaadf545e9135ded2a6486"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/log-1743.raw",
|
||||
"bytes": 10209,
|
||||
"sha256": "448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/repository.json",
|
||||
"bytes": 2315,
|
||||
"sha256": "1cc33f21848fb0223e415a5cf5a936467ade9ac9a3f166895ba2332e16282d1d"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/repositoryRunners.json",
|
||||
"bytes": 232,
|
||||
"sha256": "f66190023c670ce75b068c0e8b394a1589c28bbd5842686e9904b7cca07b5a45"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/runs.json",
|
||||
"bytes": 81697,
|
||||
"sha256": "baeaf9ec220ef238cc37a9c67ed6902569a764c577104cb3682e5ef2832c99fe"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/sources/manifest.json",
|
||||
"bytes": 894,
|
||||
"sha256": "ef5b108a2871cb35efed3592801cb2b66eaf73fb5f8075adf4afca768fddf59e"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/successor/inspection.json",
|
||||
"bytes": 5324,
|
||||
"sha256": "f9850385ba22487bbe942fa34dd334655c32398db1b3ac110ffa5d2d7310e71c"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/successor/instanceRunners.json",
|
||||
"bytes": 164,
|
||||
"sha256": "5aea25deaabb1778f0f4d023fb4529d5161efab460ed6028a27711004e1030d1"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/successor/job-1743.log",
|
||||
"bytes": 10209,
|
||||
"sha256": "448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/successor/jobs-853.json",
|
||||
"bytes": 1867,
|
||||
"sha256": "d3aa3ca89944f436bbae0042b685072cd9f2b7b615eaadf545e9135ded2a6486"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/successor/log-1743.raw",
|
||||
"bytes": 10209,
|
||||
"sha256": "448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/successor/repository.json",
|
||||
"bytes": 2315,
|
||||
"sha256": "1cc33f21848fb0223e415a5cf5a936467ade9ac9a3f166895ba2332e16282d1d"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/successor/repositoryRunners.json",
|
||||
"bytes": 232,
|
||||
"sha256": "f66190023c670ce75b068c0e8b394a1589c28bbd5842686e9904b7cca07b5a45"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/successor/runs.json",
|
||||
"bytes": 81697,
|
||||
"sha256": "baeaf9ec220ef238cc37a9c67ed6902569a764c577104cb3682e5ef2832c99fe"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/successor/user.json",
|
||||
"bytes": 163,
|
||||
"sha256": "f9e323bca7fe906d1fbb8a15b90d3f3553b23da32bec8a2c3c959795eae9305b"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/successor/version.json",
|
||||
"bytes": 20,
|
||||
"sha256": "64030fee3ab1730681c4567c01d1b30087578ef8bec61e6b0ab6c02842f3303e"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/user.json",
|
||||
"bytes": 163,
|
||||
"sha256": "f9e323bca7fe906d1fbb8a15b90d3f3553b23da32bec8a2c3c959795eae9305b"
|
||||
},
|
||||
{
|
||||
"path": ".artifacts/p9-remed-02/ci/version.json",
|
||||
"bytes": 20,
|
||||
"sha256": "64030fee3ab1730681c4567c01d1b30087578ef8bec61e6b0ab6c02842f3303e"
|
||||
}
|
||||
],
|
||||
"collectorCaveat": "Initial text-log-as-JSON failure retained. Successor convenience mergedHostNetwork:false used a JSON substring against a Go-formatted log; published actualRun reads the merged Go field NetworkMode:host directly."
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
{
|
||||
"status": "FAIL",
|
||||
"baseline": "3727a72",
|
||||
"producerPassed": 5,
|
||||
"fidelity": {
|
||||
"passed": 9,
|
||||
"total": 16,
|
||||
"pdfPages": 37,
|
||||
"previewPages": 36
|
||||
},
|
||||
"settings": {
|
||||
"passed": 4,
|
||||
"total": 8,
|
||||
"pdfPages": 28,
|
||||
"previewPages": 24
|
||||
},
|
||||
"failedFixtures": [
|
||||
"long-en-minimal",
|
||||
"long-nb-code",
|
||||
"compact-8mm-letter",
|
||||
"roomy-28mm-nb",
|
||||
"grid-and-bubbles",
|
||||
"long-sidebar-nb",
|
||||
"unbreakable-and-boundary",
|
||||
"light-en-after",
|
||||
"light-nb-after",
|
||||
"dark-en-after",
|
||||
"dark-nb-after"
|
||||
],
|
||||
"raw": ".artifacts/p9-remed-02/baseline",
|
||||
"runtime": "Debian12/Chromium156.0.8078.47/.NET9.0.21",
|
||||
"baselineImageId": "sha256:5a1c1e8d08007083ce8ca65f9ded9d7c56c4c84c9f4259cd97df8135b510d0e0",
|
||||
"fontOnlyExperiment": {
|
||||
"fixture": "long-en-minimal",
|
||||
"sameText": true,
|
||||
"samePages": 4,
|
||||
"maximumWordDeltaMm": 0.022914953003621008,
|
||||
"limits": "Native print comparison, not live preview/full24 proof"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user