Fix packed golden recovery and live debug socket routing

Merged
BN
3mo ago
+558-28

Summary

  • fall back to direct packed-artifact runner creation when the default packed golden cannot fork
  • expose only worker-authenticated live-debug routes through the VM control socket
  • retain controller and agent API isolation, plus environment-specific image fidelity

Verification

  • just test-ci
  • forced all-forks-fail concurrent smoke: both jobs succeeded via direct packed creation
  • PTY failing workflow: debug-worker token issued, session opened, and the interactive debug prompt displayed

Summary by cubic

Recovers packed-golden runner forks by falling back to direct creation, hardens base installs against apt drift, restricts the control socket to worker-only live debug, completes cancellation bookkeeping, and preserves action refs across restarts. Adds an opt-out for GitHub-owned workflows in webhook processing.

  • Bug Fixes
    • preloop-orchestrator: On default packed-golden fork failure, clean up any clone and create from the pack; environment-specific goldens still error. Base install falls back when exact apt pins or compiler packages are missing.
    • preloop-runner-server: Control socket admits only worker debug routes (token exchange, open, verdict poll, close); controller/agent debug and other APIs stay denied.
    • preloop-runner-server: Run cancellation sets terminal status and completed_at, completes GitHub Checks as “cancelled,” and refreshes scheduler (queue depth + next-job labels).
    • preloop-runner-server: Webhook dispatcher can skip GitHub-owned workflows via PRELOOP_GITHUB_SKIP_WORKFLOWS (by filename or .github/workflows/... path).
    • preloop-gha-protocol: Preserve action ref across wire roundtrips; encode with canonical ref and accept it when decoding.