Repository navigation
M2 State
Last reconciled: 2026-09-07T13:48:00Z. Team: RUNNING. Milestone.
Operator-directed one-week delivery reset, Sep 7: first real one-hour Amaru run by Sep 9 14:00 UTC; daily scheduling and failure handling by Sep 11; verified unattended delivery by Sep 14 14:00 UTC. These are deadlines, not achieved outcomes: M2 remains 0/7. Reuse the existing path and connect its smallest missing pieces; comprehensive frameworks and unrelated Cardano-node work are deferred. The chart below retains the full M2 assurance scope, NOT the critical path for this week's reduced delivery. The governing recovery plan is https://github.com/cardano-foundation/cardano-node-antithesis/blob/milestones/.milestones/2/delivery-plan.md . Product observations below were checked earlier on Sep 7; this update changes priority, not run evidence.
Stories describe outcomes; tickets are delivery containers. The mapping is many-to-many. Unticketed work, decisions and standing obligations are named explicitly. A landed enabler does not mean the product outcome is delivered.
Dependency-stage Gantt — not a calendar forecast. Each equal-width bar occupies one dependency stage; positions are calculated from the prerequisites below. Synthetic dates are rendering coordinates only. Widths are not effort, duration or completion percentages. Standing obligations are checkpoints. Same-stage rows may be independent, but this chart grants no dispatch authority.
Labels report delivery state; only in-progress rows use active colouring.
%%{init: {"gantt": {"leftPadding": 380, "sectionFontSize": 12, "fontSize": 12}}}%%
gantt
title M2 — Amaru tested routinely under fault injection - dependency stages
dateFormat YYYY-MM-DD
axisFormat Stage %j
tickInterval 1day
todayMarker off
section Unattended daily path
M2-S01 Detect and process an upstream Amaru change each UTC day [in-progress] :active, M2-S01, 2025-01-01, 1d
M2-S02 Publish a validated Amaru image handoff [in-progress] :active, M2-S02, 2025-01-02, 1d
M2-S03 Alarm when the harness no longer matches Amaru [planned] :M2-S03, 2025-01-03, 1d
M2-S04 Repin the validated image and launch one hour of fault injection [planned] :M2-S04, 2025-01-04, 1d
section Signal and verdict integrity
M2-S05 Report every controller and Antithesis terminal honestly [in-progress] :active, M2-S05, 2025-01-02, 1d
M2-S06 Keep a successful no-op distinguishable from a failed attempt [in-progress] :active, M2-S06, 2025-01-02, 1d
M2-S07 Make fork-depth failures mean producer divergence [planned] :M2-S07, 2025-01-01, 1d
M2-S08 Keep the cardano-node testnet software image recent [decision] :crit, M2-S08, 2025-01-01, 1d
section Outcome and operational assurance
M2-S09 Sustain seven unattended successful daily observations [blocked] :crit, M2-S09, 2025-01-05, 1d
M2-S10 Observe the next scheduled Daily Amaru run without fishing for green [standing] :milestone, M2-S10, 2025-01-02, 0d
M2-S11 Prepare operator-ready evidence and preserve declared reds [standing] :milestone, M2-S11, 2025-01-01, 0d
State key: landed/delivered = evidence linked; review/ready = not landed; blocked/decision = unresolved prerequisite; planned = not commissioned; standing = continuing obligation.
| Story | Kind | Tracking | State | Owner |
|---|---|---|---|---|
| M2-S01 Detect and process an upstream Amaru change each UTC day | enabler | Ticketed — cna#205, cna#210 | in-progress | cna#205 epic owner |
| M2-S02 Publish a validated Amaru image handoff | product | Ticketed — amaru-bootstrap#75, amaru-bootstrap PR #76, amaru-bootstrap#79 | in-progress | cna#205 epic owner through a fresh amaru-bootstrap ticket owner |
| M2-S03 Alarm when the harness no longer matches Amaru | enabler | Ticketed — cna#208, amaru-bootstrap#110 | planned | cna#205 epic owner |
| M2-S04 Repin the validated image and launch one hour of fault injection | product | Ticketed — cna#207 | planned | cna#205 epic owner |
As the test operator, I want the controller to notice a changed Amaru main and start the governed candidate path without human intervention, so that upstream changes are exercised promptly instead of waiting for manual coordination.
Tracking: Ticketed. The walking skeleton and daily trigger are landed, while the full governed path is still being hardened under the epic. cna#205, cna#210.
Now — in-progress: The controller runs on schedule and produced the validated Amaru candidate behind bootstrap PR #113. The last five scheduled controller runs are red; PR #239 removed the observation-window false negative and moved cna main to 6711c4ab8fe02f6418897b73bf42ca41e6efa697.
Acceptance: On an Amaru-main change, one scheduled daily run enters the candidate path unattended; unchanged days are observably safe no-ops and failed attempts remain loud red.
Dependencies: No prerequisite story recorded; this is not dispatch authority.
Next: Recover the actual executable sequence and connect the smallest missing joins now; also read the Sep 8 schedule. Do not wait for the schedule as the sole workstream or force a rerun.
Evidence: PR #239, Latest scheduled controller run 34083416756
As the downstream harness, I want a validated image tag, digest and provenance handoff from each accepted Amaru bump, so that the fault-injection configuration consumes the exact artifact that passed bootstrap validation.
Tracking: Ticketed. PR #76 contains partial accepted work, but the App probe, publication leg and finalization remain; #79 owns the first real handoff exercise. amaru-bootstrap#75, amaru-bootstrap PR #76, amaru-bootstrap#79.
Now — in-progress: Bootstrap PR #113 head 0fa91d18e98e6593079012135df8b72e61a337eb is open with Build Gate, Live Bootstrap Producer and deploy all green. The reusable image-handoff product contract itself is still unpublished because PR #76 remains draft.
Acceptance: A consumer-visible handoff binds tag, digest, source provenance and successful bootstrap checks, and its real publication boundary is exercised.
Dependencies: M2-S01: Detect and process an upstream Amaru change each UTC day
Next: Complete the minimum exact-digest handoff consumed by the real Amaru harness; reuse #75/#79 work without making full-ticket closure a prerequisite for an integrated run.
Evidence: Bootstrap PR #113
As the test operator, I want interface drift between current Amaru and its mocks, compose wiring and sidecars to stop the daily path loudly, so that a vacuous green cannot be mistaken for coverage of current upstream behavior.
Tracking: Ticketed. #208 owns the cross-repository interface guard; #110 is the open mutation-harness adequacy gap disclosed by the daily lane. cna#208, amaru-bootstrap#110.
Now — planned: Several seam checks are landed, but the complete current-main coverage alarm remains unenforced and #208 has not started.
Acceptance: A discoverable interface census is non-empty, crosses the real boundary, and seeded drift plus mutation controls make the guard fail for the intended reason.
Dependencies: M2-S02: Publish a validated Amaru image handoff
Next: This week retain a concrete real-image compatibility and progress check. Defer the comprehensive interface-census/mutation framework; this full-assurance story remains open and must not prevent a narrower honestly labelled run.
Evidence: No completion evidence claimed.
As the test operator, I want the daily controller to repin the validated image digest and launch Antithesis automatically, so that the new Amaru artifact is tested under faults rather than merely built.
Tracking: Ticketed. Repin-and-launch is the immediate recovery objective. The dependencies below describe full M2 assurance, not a requirement to finish comprehensive frameworks before the week's concrete, honestly labelled real-image run. cna#207.
Now — planned: No M2 Amaru Antithesis launch has occurred yet, so the milestone streak remains 0/7.
Acceptance: The exact validated digest is pinned in the harness and a one-hour fault-enabled Antithesis run is launched unattended with its run identity retained.
Dependencies: M2-S02: Publish a validated Amaru image handoff; M2-S03: Alarm when the harness no longer matches Amaru
Next: Immediate first-run objective: integrate the validated digest and existing Amaru harness, with concrete compatibility/progress checks, for the Sep 9 checkpoint. Full framework closure is not this week's prerequisite; launch/spend approvals remain required.
Evidence: No completion evidence claimed.
| Story | Kind | Tracking | State | Owner |
|---|---|---|---|---|
| M2-S05 Report every controller and Antithesis terminal honestly | product | Ticketed — cna#206, cna#232, cna PR #233, cna PR #239 | in-progress | cna#205 epic owner |
| M2-S06 Keep a successful no-op distinguishable from a failed attempt | enabler | Unticketed work | in-progress | cna#205 epic owner |
| M2-S07 Make fork-depth failures mean producer divergence | product | Ticketed — cna#140 | planned | M2 owner; standalone lane not commissioned |
| M2-S08 Keep the cardano-node testnet software image recent | enabler | Decision — cna#236, cna PR #238 | decision | Operator decision; M2 records the evidence |
As the operator reading the daily signal, I want missing, pending, failed and partial runs to have distinct loud verdicts and durable per-property receipts, so that a red night says what failed and a dead schedule cannot look healthy.
Tracking: Ticketed. #234/#235/#239 improved observation and classification; the external absence watchdog, per-property publication and general run-level loudness remain open. cna#206, cna#232, cna PR #233, cna PR #239.
Now — in-progress: PR #239 is merged, but the latest scheduled run predates it and failed. PR #233 is still draft, so a dead daily schedule is not yet independently alarmed, and the structural slice-fence defect still makes unrelated PR #238 red.
Acceptance: Every terminal path emits a caller-visible cause, a missing schedule is detected externally, per-property results are published, and each detector has a negative control that proves it can fail.
Dependencies: M2-S01: Detect and process an upstream Amaru change each UTC day
Next: Deliver minimal durable per-property results and loud missing/failed/partial terminals as part of the daily path. Reuse an adequate alarm; no new general monitoring platform.
Evidence: PR #239 merged, PR #238 structural dry-run failure
As the daily controller operator, I want every successful outcome to leave the next night distinguishable from failure while genuine failed attempts stay red, so that normal awaiting or unchanged states do not create false incidents.
Tracking: Unticketed work. A governed cna#205 slice is active without a GitHub issue by design; its output is a draft PR and no upstream comment or issue is authorised.
Now — in-progress: The active t-unchanged-head slice starts from 6711c4ab8fe02f6418897b73bf42ca41e6efa697. It must preserve asymmetry for failed attempts and quantify over all discovered exit-zero outcomes rather than special-case AWAITING.
Acceptance: A can-fail executable control discovers every exit-zero outcome, proves each records enough state for the next run, and separately proves a failed attempt remains red.
Dependencies: M2-S01: Detect and process an upstream Amaru change each UTC day
Next: Keep only the repair needed for daily correctness, with prior failures still red. Epic owner checkpoints the active slice safely and preserves frozen evidence before any re-scope.
Evidence: No completion evidence claimed.
As a protocol engineer reading fault-injection findings, I want the cluster fork-depth property to exclude stale relay lag and normalize host identities, so that a critical fork finding proves producer divergence instead of an unrelated relay-liveness condition.
Tracking: Ticketed. This open issue is explicitly assigned to milestone 2 and was absent from the old M2 control ledger. cna#140.
Now — planned: The current property can include a stale relay in the common-ancestor calculation and overstate the evidence. No active owner or accepted repair is recorded.
Acceptance: Tests keep stale relay lag out of producer fork depth, normalize equivalent host labels, retain a separate relay signal, fail for a real producer divergence at depth k or greater, and bind k to generated genesis.
Dependencies: No prerequisite story recorded; this is not dispatch authority.
Next: Deferred from this week's delivery; keep OPEN for full M2. Re-enter the critical path only on concrete evidence it blocks the real Amaru run.
Evidence: Issue #140 evidence
As the operator interpreting scheduled Antithesis runs, I want the testnet configuration to exercise a recent intended cardano-node image, so that the freshness property reflects maintained test inputs instead of failing every otherwise healthy run.
Tracking: Decision. The operator owns whether to dispose, re-cut or resume this lane; PR #238 is specs-only and red, so it must not be merged as an implementation. cna#236, cna PR #238.
Now — decision: Scheduled run 34095717978 completed 180 minutes with 68/69 properties passing. Its only failure was Recent software version provided with 12 concrete stale-image counterexamples. PR #238 head b931bd429af37716419f76f8fadcfed9759f3824 is open draft, contains planning work rather than the intended rotation, and its Daily Amaru dry run is red on a structural foreign-slice fence.
Acceptance: A freshly governed candidate updates the intended image identity, the real scheduled testnet run passes the freshness property, and functional properties remain assessed rather than suppressed.
Dependencies: No prerequisite story recorded; this is not dispatch authority.
Next: Separate operator decision, deferred from the Amaru delivery week. Keep PR #238 unmerged; no implicit restart or closure.
Evidence: Scheduled run 34095717978, PR #238
| Story | Kind | Tracking | State | Owner |
|---|---|---|---|---|
| M2-S09 Sustain seven unattended successful daily observations | outcome | Ticketed — cna#205 | blocked | M2 owner |
| M2-S10 Observe the next scheduled Daily Amaru run without fishing for green | operation | Standing obligation | standing | cna#205 epic owner |
| M2-S11 Prepare operator-ready evidence and preserve declared reds | operation | Standing obligation | standing | M2 owner and cna#205 epic owner at their respective altitudes |
As the milestone stakeholder, I want the full changed-Amaru-to-fault-injection path to succeed for seven consecutive UTC days, so that routine operation is demonstrated as an outcome rather than inferred from merged enablers.
Tracking: Ticketed. The frozen milestone outcome remains 0/7; no lower-level green may substitute for the streak and published-artifact audit. cna#205.
Now — blocked: No M2 Amaru Antithesis launch has occurred. The streak cannot start until the image handoff, interface guard, launch, verdict and open signal-integrity contracts are operating together.
Acceptance: Seven consecutive unattended successful daily observations, followed by an independent outcome audit against the published artifact and the complete contract registry.
Dependencies: M2-S04: Repin the validated image and launch one hour of fault injection; M2-S05: Report every controller and Antithesis terminal honestly; M2-S06: Keep a successful no-op distinguishable from a failed attempt; M2-S07: Make fork-depth failures mean producer divergence; M2-S08: Keep the cardano-node testnet software image recent
Next: First deliver the reduced daily capability by Sep 14. The seven-successful-day streak and full independent assurance remain separate and unsatisfied; no MILESTONE-COMPLETE claim from the week's delivery.
Evidence: No completion evidence claimed.
As the milestone operator, I want the first schedule carrying PR #239 to be read once it completes and journaled with exact identity, so that the next verdict is independent scheduled evidence rather than a manually induced proxy.
Tracking: Standing obligation. The cna#205 epic owner owns the read duty for the 2026-09-08 cron; the redundant lane-operations role was retired.
Now — standing: The cron is 04:17Z and recent GitHub schedules have landed around 04:27–04:31Z. cna main moved from fe039ac5582081297b38709a6862083cc2fb6c00 to 6711c4ab8fe02f6418897b73bf42ca41e6efa697 after PR #239, so a fresh attempt is expected but not claimed.
Acceptance: Read the completed schedule event, record its run ID, exact head SHA, terminal and material contract evidence, and perform no rerun or manual dispatch.
Dependencies: M2-S01: Detect and process an upstream Amaru change each UTC day
Next: Read Sep 8's scheduled outcome without forcing it, while the integrated implementation proceeds. Escalate any launch or merge authority gap in the first delivery handback.
Evidence: PR #239 merge
As the human operator, I want each new red to arrive as a bounded evidence packet and remain declared until its fix is verified while external publication stays exclusively human, so that incidents remain actionable and visible without agents speaking to third parties in the operator's name.
Tracking: Standing obligation. This is a standing milestone obligation from the ratified outcome and the 2026-08-06 publication ruling.
Now — standing: No upstream issue, PR comment or human-facing publication is authorised for agents. Evidence and open decisions stay in governed journals, handoffs, the home repository milestone branch and this public milestone view. The permanent declared-red registry mechanism is still unenforced and must remain visible as a scheduled gap.
Acceptance: Every new red is classified and packaged for the operator within 24 hours; no agent posts externally; unknowns remain explicit; and a declared red can be cleared only by a recorded decision bound to verified fix evidence.
Dependencies: No prerequisite story recorded; this is not dispatch authority.
Next: Keep failures visible and evidence operator-ready; defer the general registry mechanism, not honest reporting or preservation of reds.
Evidence: No completion evidence claimed.
This page and its Gantt are generated from the adjacent story register. The milestone owner must reconcile it on material state changes and before handoff. Updating the timestamp alone is not reconciliation. A normal debrief reads this page; an authorised state sweep updates and publishes it. If publication is blocked, the desk must name the stale publication and pending changes.
Register schema: milestone-stories/v1. Parsed-register SHA-256: e9999651eaee9522888c32f122dc6218655eed7717d82dfc6786ed847fa98cb4.