The deep probe pass runs in CI, not on an operator's machine

---

rank: decision outranks: []

The deep probe pass runs in CI, not on an operator’s machine

Date: 2026-10-01 Status: closed Supersedes: none Superseded-by: none — current MR-compliance: MR-7

Context

probe_history in state/<slug>.yaml is written only by petrova doctor --commit-state, invoked fleet-wide by scripts/doctor-all.sh. That script has no schedule. docs/findings/20260925-0555-deep-probe-pass-has-no-cron-fleet-wide-obs-clock-stale.md filed the gap and left the structural question open. 2888e88b then chose to make the gap loud rather than close it: scripts/check-probe-staleness.mjs fails the State sweep once the newest probe is 48h old.

The record since then is a sawtooth that only an operator’s hand resets:

window	sweep	reset by
2026-09-25 07:23Z → 09-28 15:47Z	red, 19 runs	b50b2c1e, 93ef08b8 — manual doctor-all.sh
2026-09-28 21:42Z → 09-30 11:00Z	green	—
2026-09-30 16:56Z → now	red	nothing yet

Until #497, every red run also skipped the state commit, so current_phase and contract_drift froze with it. That part is fixed; the sawtooth is not.

The only reset available contradicts a closed decision. 2026-08-25-local-runs-may-not-write-state.md (PTV-DEC-0022) rules that a local run may not write the sweep-owned state/<slug>.yaml, because a locally computed verdict depends on a base it does not name. Both manual resets above were local runs writing exactly those files. Today the alarm tells the operator to do the one thing the decision forbids.

Coverage is also partial. doctor-all.sh probes only slugs with a clone under the operator’s workspace: on 2026-10-01, 23 of 42 state files have no probe_history at all.

What the probe actually needs

The finding and check-probe-staleness.mjs both describe a CI deep probe as “running 44 cross-org repos’ local tooling in shared CI”. Read against the code on main at 1b3cc843, the probes do not run consumer tooling:

• cli/src/probes/ares.ts, crumb.ts, rocky.ts — GitHub/HTTP reads via the injected gh runner (gh-executor.ts), no filesystem.
• cli/src/probes/traceo.ts:78-79 — reads vtm_path from the consumer checkout.
• cli/src/probes/eva.ts:43 — git cat-file -e against an eva-hq tree.
• cli/src/verbs/doctor.ts:71 — reads .petrova/contract.yaml; :195 derives the phase from the checkout’s decision docs.

Two side effects exist, and both are inert in an ephemeral CI checkout: doctor.ts:83-88 flushes the consumer’s untracked cairnet outbox (absent in a fresh clone; also needs PETROVA_PEBBLE_TOKEN), and doctor.ts:207-212 rewrites the checkout’s contract.yaml mirror only when EVA_HQ_ROOT is set — the checkout is discarded.

The cross-org read credential already exists. state-sweep.yml reads every registered repo through the petrova GitHub App (PETROVA_APP_ID / PETROVA_APP_PRIVATE_KEY, multi-installation discovery in cli/src/remote-walker.ts).

Decision

Run the deep probe pass in GitHub Actions on a schedule, and keep local runs forbidden from writing sweep-owned state.

A new deep-probe.yml workflow, on the same self-hosted ci-shared runner as the sweep, every 8 hours plus workflow_dispatch:

1. Mint an App installation token per owner (the sweep’s existing path) and shallow-clone each registered repo that has a .petrova/contract.yaml, read-only, into a job-scoped workspace. Clone eva-hq alongside for the eva probe.
2. Run scripts/doctor-all.sh <workspace> with no Pebble token set.
3. Commit state/ through the sweep’s own commit step (petrova-bot, rebase-and-retry), with the petrova-codes and per-repo HEAD shas in the commit body. That names the base a verdict was computed against, which is the precise defect PTV-DEC-0022 objected to.

8 hours keeps the newest probe under the 12h warn line in steady state and gives five missed runs of slack before the 48h error.

Until the workflow lands, nobody runs doctor-all.sh locally against sweep-owned files. The red staleness step is the honest signal in the meantime, and since #497 it no longer costs the phase grid anything.

Alternatives considered

• Carve an operator exception into PTV-DEC-0022 — rejected: it keeps the sawtooth (freshness still depends on someone remembering), keeps coverage at whatever is cloned locally (19 of 42), and re-admits the unnamed-base verdict that decision exists to prevent.
• Move probe_history out of the sweep-owned files (a local-named, gitignored path, per PTV-DEC-0022’s carve-out) — rejected: jzero.run and the host read probe_history from state/<slug>.yaml, so the data would stop reaching every consumer, and the staleness would be invisible rather than fixed.
• Lengthen or drop the 48h threshold — rejected: it hides the gap without closing it, the outcome 2888e88b was written to avoid.

Consequences

For code:

• New .github/workflows/deep-probe.yml as described; a --from-checkouts style input or PETROVA_WORKSPACE_DIR is enough for doctor-all.sh, which already accepts a workspace path.
• The App needs contents: read on every registered repo it does not already cover; the sweep’s discovery reports which owners lack an installation.

For docs:

• Close the 2026-09-25 finding by reference to this record once the first scheduled run commits.
• check-probe-staleness.mjs and state-sweep.yml comments stop describing doctor-all as a manual operator step.

For in-flight phases:

• None gated. Restores the OBS/AGE clock that jzero.run reads.

For invariants:

• None added or repealed. PTV-DEC-0022 stands unamended.

References

• docs/findings/20260925-0555-deep-probe-pass-has-no-cron-fleet-wide-obs-clock-stale.md
• docs/decisions/2026-08-25-local-runs-may-not-write-state.md (PTV-DEC-0022)
• 2888e88b — staleness surfaced instead of scheduled
• #497 — state commit no longer gated on probe staleness (State sweep run 36834595976)

Sign-off

• Subagent: Claude Opus 5.5, 2026-10-01 (drafted; evidence above read at 1b3cc843)
• Human: flight@arno.host — that the deep probe pass moves to a scheduled CI workflow, and that no local run writes sweep-owned state in the meantime.

Countersigned by human:flight@arno.host on 2026-10-01 — box ticked in commit c48d60b0, authored by the human. Status flipped open→closed on 2026-10-01 by an agent as scribe (MR-7).