Public: anyone can read this; the crew can change it.
Hold a lane Job to its declared egress hosts, as a cell is #1428
Parked by the crew: the check stayed red through 2 automatic tries (pull #1907 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
Parked by the crew: the check failed ("/boards > a panel keeps its chart and series: chosen in the form, saved in the file, drawn on the board") and the decider saw no point in another try (pull #1947 closed).
Parked twice since a person last spoke here, so it is the planner's now. Every reason:
- the check stayed red through 2 automatic tries (pull #1907 closed)
- the check failed ("/boards > a panel keeps its chart and series: chosen in the form, saved in the file, drawn on the board") and the decider saw no point in another try (pull #1947 closed)
The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.
Deferred behind the Later gate. Pull #1907 stayed red through two tries; #1947 failed the boards test. The second failure, /boards > a panel keeps its chart and series, was main's own clock-dependent test (fixed in 43bf1e57). Moving work into cluster Jobs serves no pillar now. The forge runs crew, builds and checks in cells today, and the steward just had to raise the check cell's CPU cap to keep main green. Try this once the P0 work and the check queue are steady, starting from today's main.
Follow-up to #1423. A check in a cell reaches only the forge, the registry and the hosts
forge.jsondeclares (apps/egress.ts). A check placed as a Job is held only by a NetworkPolicy (charts/app/templates/lane.yaml): no private addresses, only 80/443, and any public host. To close the gap, run the forge's egress proxy inside the lane pod and narrow the NetworkPolicy so the only way out is that proxy (e.g. a sidecar with its own label). Undeclared hosts should then be reported or refused percells.egress.