Skip to content

The sandbox toggle pair

rig-conductor#2279.

Why a pair, and why a sandbox

The first template, reward-e-website-link-v1, proved the loop once on the real homepage (task ff18ab60). It cannot be repeated. Putting the App Store link back would make the probe read a page that no longer satisfies that task, so a run already reported verified would re-read as failed (rc#2271). A loop you can only run once cannot be iterated on.

dashe-website#209 (PR #210) shipped https://dashecorp.com/rig-sandbox/: unlinked, noindex, and holding two toggle links. This pair flips the first one:

id from to
sandbox-toggle-one-b-v1 #toggle-one-a #toggle-one-b
sandbox-toggle-one-a-v1 #toggle-one-b #toggle-one-a

The operator asks for a state ("point toggle one at b"). Rig-E cannot read the page, so it cannot pick the direction for him. If he asks for the state the page is already in, the propose route's pre-state gate answers intent_already_satisfied, an informative terminal state, and nothing is filed.

How the pieces line up

  • Anchor = the whole trimmed line. OperatorTaskDiffPolicy compares whole changed lines, so each anchor is the full <li><a href="…#toggle-one-x" class="rig-toggle toggle-one">Toggle one</a></li>. It is copied byte for byte from the merged file, line 14. IssueCopy.Indent is the file's six spaces.
  • Page = derived from website/rig-sandbox/index.html, giving https://dashecorp.com/rig-sandbox/ (#2274).
  • Issue copy = the template's own (#2270). It never mentions another template's target, and the registry test enforces that, except that a reversible pair's from is its inverse's to by construction.
  • Canonical intents are pinned in OperatorTaskTemplateTests. The Cockpit Worker's TASK_TEMPLATES copies them byte for byte (rig-cockpit-worker#229), because the Worker signs the digest and the conductor refuses one it did not derive.

The walk that proves the whole de-pin

CockpitTaskLifecycleWalkE2eTests.A_sandbox_toggle_task_walks_its_own_page_to_verified_and_the_reverse_can_follow runs a sandbox task through the real routes, MergeGate and the real probe, over a faked GitHub and site:

  1. The propose reads dashecorp.com/rig-sandbox/, never the homepage.
  2. Confirm files the sandbox issue, whose marker names sandbox-toggle-one-b-v1.
  3. MergeGate holds the PR and the release merges it.
  4. The probe reads /rig-sandbox/, and the task reaches verified.
  5. Then the forward flip is refused (intent_already_satisfied) and the reverse is proposable.

It is the proof #2280 had to defer, because the endpoint's wiring cannot be told apart while only v1 is registered.

Proved by mutation

Mutation Result
A sandbox issue copy quotes v1's target anchor 1 fails: every registered template's words describe its own change
The pair's line drifts by one trailing byte from the merged file 2 fail: the inverse test and the direction test
The propose endpoint stores v1 regardless of the body (#2280's wiring) the sandbox walk fails
The propose endpoint reads v1's page for the pre-state (#2280's wiring) the sandbox walk fails

Still needed before the operator can ask

  1. The Cockpit Worker registers both canonical intents (after rig-cockpit-worker#230).
  2. Rig-E's persona (rig-gitops apps/dashecorp/rig-e-helmrelease.yaml, checked by scripts/check-rig-e-persona.py) names the two ids and the marker line for each.