jobtrackingapp/docs/redesign/phase-9/p9-requal-01/CI_FINDINGS.md

P9-REQUAL-01 hosted CI findings

Observed 2026-10-24 06:49 UTC. Verdict: BLOCKED (runner isolation and hosted database execution). This is an infrastructure prerequisite, not evidence of a MariaDB product regression or a production qualification.

Current evidence

Evidence	Verified result	Limit
Gitea /api/v1/version	1.26.0	Server version does not identify the runner binary.
Repository metadata	Existing Git credential can read Actions and reports repository admin/push/pull permissions.	/user and /admin/actions/runners return 403. Repository permission does not establish instance administration.
Repository runner listing	Runner 3 pi-runner-1, offline; ubuntu-latest, ubuntu-22.04; no version returned.	This is not the runner that ran the database lane.
Baseline run 844, job 1734	SHA 549b2cba5a791862ba3f854312ea819a86dc42a0; job API identifies runner 5 Live-Runner, label ubuntu-latest; failure.	Instance-wide identity/configuration unavailable through the permitted API.
Run 844 raw log, lines 1, 12, 17	Runner reports v0.4.1; node:20-bookworm; merged job HostConfig has NetworkMode:host, /var/run/docker.sock:/var/run/docker.sock, Privileged:false, no published ports.	An earlier reading of custom HostConfig Binds:[] was incomplete. Effective merged configuration includes the host socket. Socket daemon ownership and production separation are unverified.
Run 844 raw log, lines 130-151	SDK 9.0.317 installed; five Python guard tests pass; docker: command not found, exit 127.	These are guard/unit tests, not the 32 MariaDB integration tests. Printed cleanup-failure/exit17/exit1 samples are mocked test cases; they do not show real database cleanup.
Run 844 raw log, line 152	No integration artifact files available for upload.	Hosted MariaDB tests did not run. Job API marks all steps failure despite the raw five-test OK; use the raw log for step outcomes.

Run 843 is historical corroboration of the same merged socket/host-network configuration. Run 844 is the baseline-SHA observation. No new hosted job, Docker command, database, or service was started in this investigation.

Version-specific native service research

The official act_runner source URL redirects to gitea/runner. The official v0.4.1 tag API resolves to 9aafec169b7ebf3d71df2b06780868fb552b435e. Read these pinned sources, not runner 2.x documentation:

• Configuration example: an empty container network delegates network creation; docker_host: "-" prevents the Docker host mount in job and service containers. These are operator configuration choices, not settings changed here.
• Runner implementation: passes network/socket/privilege configuration to its execution engine, sets ReuseContainers:false, AutoRemove:true.
• go.mod: selects gitea.com/gitea/act v0.261.10.
• Execution engine: networkNameForGitea reuses configured networks (including host); only an empty configured network generates a job network. Native service containers share that network, receive service aliases, and have explicit port bindings only from declared service ports. Normal cleanup attempts service and generated-network removal, logging cleanup errors. Services start before job steps, so a step preflight cannot make an unsafe services: declaration safe.

This establishes source capability only. The installed binary has not been matched to these source bytes, and normal-cleanup code does not prove cleanup after cancellation, runner crash or daemon loss. Nothing proves the effective Live-Runner uses an empty network or socket suppression; the observed job does the opposite. Private native services therefore remain NOT ENABLED.

Bounded workflow change

Retain the existing push branch and add fix/p9-ci-and-requalification. Add an unconditional failing isolation preflight before all workflow Docker/Compose/database commands. It reports this handoff and requires a later reviewed workflow change after operator evidence; no self-attested repository variable bypass exists. Existing checkout, SDK, five guard tests, integration command and artifact action remain. No services, socket mount, privileges, Docker CLI installation, deployment workflow or runner configuration was added.

Do not remove the blocker merely because Docker becomes available. Under the observed configuration that could grant the job control of an unidentified host daemon. The desired future native service must use mariadb:12.2.2@sha256:42a27baaba3e8f3f0159d16381d5a7156661aa91dcc65f663cabb6a6f9503c00 on the already documented linux/amd64 platform, no published service ports, private job networking and verified disposable storage. No version upgrade is proposed.

The current fixture and --existing-server runner deliberately allow only explicit loopback TCP. A later private service transport must preserve those defaults and receive separately reviewed narrow endpoint validation; no fixture bypass is included here.

Sanitized API metadata, source/log hashes, precise blockers and next actions are in ci-findings.json and CI_OPERATOR_HANDOFF.md. Ignored raw files remain local; no credentials or full environment/configuration are copied into these tracked reports.