docs(handoff): civitai-app-fleet close-out — #1393 merged after a clean round 6, and the CI gate was proven IMPURE

[ZacxDev]

Close-out for the civitai-app-fleet arc. #1393 is merged (a30a587c) after the audit ladder closed clean at round 6.

The finding worth carrying forward

devrc's CI runs the nix build unsandboxed, so the gate can report a red on a change it cannot distinguish from a green one.

Same derivation hash on both sides — /nix/store/5ymf49nizdr4vaqr75avxcci8iha7qnm-devrc-pytests.drv. Dev host: collected=21161 … failed=0, RESULT: PASS. CI on the same sha: collected=21161 … failed=1, a TimeoutExpired/-9 on git clone of an empty local bare repo against a 120s budget, in a file #1393 never touches. CI's build ran in /tmp/nix-build-devrc-pytests.drv-0, not /build — the tekton skill's documented tell that nix silently fell back to unsandboxed. A re-run of the same sha on a quieter cluster returned BOTH TIERS PASS.

Byte-identical inputs cannot legitimately produce different outputs. Measured from outside my own pushes: #1417 and #1408 failed the same unrelated test as each other in the same hour, and #1419 also failed, while four other PRs passed.

The cheap proof is one command — nix path-info --derivation <worktree>#checks.x86_64-linux.pytests. If it matches the .drv in the CI log and the verdicts differ, the build is impure and reading your diff will never explain it. That settled in seconds what two wrong attributions cost an hour.

Two corrections recorded against myself

I attributed the red gate wrongly twice before measuring it — first to main's pre-existing red tests (main was green), then to the branch being 18 commits behind (it stayed red after catching up). Both were coherent and both had a plausible mechanism. A theory that explains a failure is not evidence for it. The error under both was reading only the dev tier while the merge gates on the sandbox tier.

I also told the operator that merging would require lifting branch protection and would affect every open PR. That was wrong — enforce_admins: false, required_status_checks: null. I carried it from the tekton skill, which flags its own note as having moved twice in one day and says to re-measure.

Also in here

• main's "7 pre-existing red tests" investigation is resolved and closed — gone at current main, fixed upstream. The age/age-keygen hypothesis was never needed; the block says so explicitly so nobody re-derives it.
• 🔴 The skill is merged and NOT installed. readlink -f lands in /nix/store, so these are home.file copies — rank 1 is the home-manager switch that makes six audit rounds usable.
• Round 6's four 🟢s are filed as rank 3 rather than fixed, because fixing them would have created an unaudited delta on a PR whose ladder had just closed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EbT8tDRPQpgPw14qUH6tnU