fix(orch): choose the chrony time source at boot instead of at build time

[tomassrnka]

provision.sh probed /dev/ptp0 at build time and baked either the PHC refclock or the NTP pool into chrony.conf, assuming provisioning and runtime share a host — build and sandbox nodes are separate pools, so that probe doesn't belong in a durable template artifact (codex P1 on #3411). The source line is now written on every boot by e2b-chrony-source (systemd oneshot; OpenRC boot service on Alpine) and pulled in with an include, mirroring what the NixOS base image already does.

Rebased over #3453, whose seccomp workaround keys off exactly the build-time PHC verdict this PR deletes — left alone it never fires, and under set -eu the now-unset var breaks every distro's build. Alpine's -F 0 is therefore unconditional in the OpenRC init setup, which is free: on the pool line chronyd runs fine under the filter, while against a real PHC (an igc NIC clock) -F 1 gives "Loaded seccomp filter (level 1)" then "Bad system call", and -F 1 -F 0 selects PHC0 at ±55ns. Alpine and ubuntu re-verified on real KVM — 7/7 each, plus 7/7 seccomp checks. Cold boots only: memory-resumed sandboxes keep their snapshot's chronyd. Rollout needs a build-provision-version bump.

[cursor]

PR Summary

Medium Risk
Changes affect time sync on every cold-boot sandbox; mis-ordering or a missing include could leave chronyd without a source or crash on wrong PHC config, though behavior is heavily test-guarded.

Overview
Provisioning no longer bakes PHC vs NTP into chrony.conf from a build-time /dev/ptp0 check. Every cold boot runs e2b-chrony-source, which writes /run/chrony-e2b/source.conf and is wired in before chrony starts on both systemd (drop-in on the distro timesync unit) and Alpine OpenRC. Alpine’s chronyd seccomp workaround is always applied (-F 0) because the time source is only known at boot, not during provisioning. Tests assert the baked rootfs, init setup, and provision script keep that contract.

^{Reviewed by Cursor Bugbot for commit 9fd0b83. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[claude]

No bugs found. This is a solid, well-tested fix (per-distro real-KVM verification, plus new tests asserting the old build-time probe is gone and the new selector is wired in for both systemd and OpenRC), but it changes boot-time chrony startup ordering across every supported guest init system, which is boot-critical for all sandboxes. Given that scope, I'd like a human to also look this over before it merges.

Extended reasoning...

Overview

The PR removes a build-time /dev/ptp0 probe from provision.sh and replaces it with a boot-time selector (e2b-chrony-source) that writes the chrony source line into /run/chrony-e2b/source.conf, included by chrony.conf. It adds a systemd oneshot unit + drop-in wiring (Requires=/After= on the family's timesync unit) and an OpenRC boot-runlevel service for Alpine. Tests were added/extended in rootfs_test.go, distro_test.go, and a new provision_test.go asserting both that the old probe is gone and that the new wiring exists per init family.

Security risks

None identified — no new external input, no privilege changes, no network-facing surface. The chrony source file lives on tmpfs and is written by root during boot, same trust level as the rest of provisioning.

Level of scrutiny

This touches the guest boot sequence baked into every template's rootfs (systemd unit ordering and OpenRC runlevel wiring), which is boot-critical: a wiring mistake could leave chronyd dead on cold boot across an entire distro family. The PR's own description frames it as fixing exactly that kind of bug in a prior PR. Even though the change is narrow and unusually well-tested (real KVM verification per family, targeted regression tests), the blast radius (all cold-booting sandboxes, all supported distros) puts it above the bar for full bot approval.

Other factors

No bugs were found by the automated bug hunt, and my own read of the systemd ordering (Requires+After on the dynamically-named timesync unit, avoiding a static enablement symlink that RHEL's preset policy would delete) and the OpenRC boot-runlevel placement (which runs before the default runlevel where chronyd is enabled) looks correct. The description also notes a required build-provision-version LaunchDarkly bump for prod rollout, which is an operational step outside this diff.