feat(svos): [tasks].judge = app-judge after Prime's grants; card audio verified (3/3 in 4.5-5.5 s)

2026-10-18 16:42:06 -07:00
parent 4f5c01390d
commit 9c9d6a777a
3 changed files with 61 additions and 1 deletions
@@ -0,0 +1,36 @@
+# nh3-svos: [tasks].judge = "app-judge" (U19 step 4), after Prime's three owner grants landed (1641 2026-10-18:
+# app-judge -> app:app-interface read, app-judge -> app:app-terminal read, prime -> app:app-judge read).
+# From now every root task's approval runs the judge's admit before any seat exists. judge_timeout_seconds stays at its
+# default 10 (the app's admit_seconds 8 sits inside). Revert = instance.toml.pre-tasks-judge + reload.
+steps:
+  - name: back up instance.toml
+    sudo: true
+    shell: runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml /var/lib/svos/config/instance.toml.pre-tasks-judge
+    creates: /var/lib/svos/config/instance.toml.pre-tasks-judge
+  - name: add judge = "app-judge" under [tasks]
+    sudo: true
+    shell: |
+      runuser -u svc-svos -- python3 - <<'PY'
+      import os
+      p = "/var/lib/svos/config/instance.toml"; s = open(p).read()
+      anchor = '[tasks]\nscratch_root = "/var/lib/svos/apps/terminal/tasks"\n'
+      assert s.count(anchor) == 1, s.count(anchor)
+      tail = s[s.index(anchor):]; nxt = tail.find("\n[", len(anchor) - 1)
+      assert "judge =" not in (tail if nxt < 0 else tail[:nxt])
+      s = s.replace(anchor, anchor + 'judge = "app-judge"                  # U19 (v0.0.16, 2026-10-18): admission + routing; judge_timeout_seconds default 10\n')
+      t = p + ".tmp"; fd = os.open(t, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+      with os.fdopen(fd, "w") as f: f.write(s)
+      os.replace(t, p); print("edited")
+      PY
+  - name: the kernel accepts it (else restore)
+    sudo: true
+    shell: |
+      if runuser -u svc-svos -- /opt/svos/current/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos; then exit 0; fi
+      runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml.pre-tasks-judge /var/lib/svos/config/instance.toml; echo RESTORED; exit 1
+  - name: reload
+    sudo: true
+    shell: systemctl reload svos-kernel; sleep 3; curl -s http://127.0.0.1:8400/health
+verify:
+  - name: health ok, nothing down, new generation
+    shell: h=$(curl -s http://127.0.0.1:8400/health); echo "$h"; echo "$h" | grep -q '"status":"ok"' && echo "$h" | grep -q '"down":0' && ! echo "$h" | grep -q f5330a9978aedc48
+    changed_when: "false"