Drill run needed for 0.3.1 — both gates cleared this morning; #107 now waits only on an operator afternoon

[dan-claude-bot]

@danmt — this is the operator ask #107 promised to open "when #125 merges". It merged this morning, and so did the other half. rig#107 now waits on exactly one thing: an afternoon on a throwaway machine.

What cleared

Both gates the 0.3.0 waiver named are gone, 67 seconds apart:

• The harness — #105 closed by PR #125 at 07:00:08Z (3698eb5). drill/drill.sh exists, four legs, with drill/README.md as the written procedure.
• The pinning — #103 closed by PR #122 at 07:01:15Z (8dcf529). This is what makes a run worth doing rather than merely possible: The next release must carry a real drill record, not a waiver #107's fourth acceptance criterion is "the refs the drill pinned are the refs the release ships", and until this morning a green drill against unpinned main proved a combination that drifted the moment box's main moved.

The waiver's own stated reason was "the drill harness is not in a state to produce a trustworthy run." That sentence is no longer true.

The ask

One four-leg run, unattended after launch. From drill/README.md:

TS_AUTHKEY=tskey-... bash drill/drill.sh \
  --rig-ref release/0.3.1 --box-ref <the box that ships with it> \
  --users ./drill-users --run-id drill-2026-07-24-a \
  --coolify-version <pin> --runner-repo <you>/rig --yes

What it needs, each item load-bearing:

• A throwaway Debian 13 machine, root. It gets its sshd hardened, renamed, joined to a tailnet, and Incus/Coolify/a runner installed. It is not coming back — the machine is its own teardown.
• Both refs, stated. The harness refuses to run unpinned and aborts if INSTALLED_FROM disagrees with what was asked.
• A single-use tailscale pre-auth key, tag:local for the default staging-server role (bootstrap refuses tag:server outside the control-plane shapes).
• A users file — leg 1 asserts the operators' accounts and keys actually converged.
• A fork with a drill.yml (workflow_dispatch, job runs-on: [self-hosted, drill], body echo drilled) for leg 3. Without it the leg skips loudly into the record rather than silently passing.
• A Coolify version pin for leg 4. No pin, no leg, recorded as a skip.

One thing to get right, or the record lands where the gate cannot see it

drill.sh names the record from the installed tree's own VERSION (drill.sh L378–380), and the drill-recorded guard reads drills/<released version>.md and nothing else. main is 0.3.1-dev today — so a run against main writes drills/0.3.1-dev.md, which the gate will not accept for 0.3.1.

Run against the release branch once VERSION reads 0.3.1, or pass --record drills/0.3.1.md explicitly. Either is fine; picking neither produces a real drill whose record the release refuses.

What comes back

The run writes drills/0.3.1.md and ends by telling you to commit it on the release branch. Post the result here (or just say it ran) and #107 flips blocked → ready; landing the record is then an ordinary build task any builder can claim.

A failed drill closes this just as well as a green one. Every acceptance criterion on #107 is satisfied by a failure honestly recorded — the gate wants evidence, not success. Skipped legs are named as not-run so a record can never read as a clean sweep. What 0.3.1 must not ship is a second waiver.

Why this is a discussion and not a comment on the issue

#107 stays blocked because no builder can perform this, and an operator act with no door is how a blocked issue goes quiet for days while the board reads as converged. This repo has already had one of those — #110 sat stranded 2026-07-22 → 2026-07-24 waiting on a repo only you can create. This thread is #107's door.

[dan-claude-bot]

Duplicate — closing in favour of #132, which is the canonical run request. @danmt: read that one, not this one.

Two triage sessions swept rig concurrently this morning and both honoured #107's "opens the run request on Discussions when #125 merges" commitment, two seconds apart — #131 at 07:05:19Z, #132 at 07:05:21Z. Same facts, same ask, no disagreement between them.

#132 wins on substance, not on timestamp: it names the refs to actually pin (--rig-ref release/0.3.1, --box-ref 0.9.0 — the tag BOX_RELEASE now pins, rather than the release/… branch this thread's example carried over from drill/README.md), it says to cut the release branch first, and #133 already cites it.

The one thing this thread had that #132 lacked — the record filename coming from the installed tree's VERSION, so a pre-stamp run writes drills/0.3.1-dev.md where the gate cannot read it — is ported there. Nothing else here is unique, and nothing is owed on this thread.

#107 is unchanged by this: still blocked, still on the operator run, its body and comment now pointing at #132.