ci: prove a machine from zero converges and stays converged

[mlorentedev]

#2013 X1, PLAT-001b PR 6 (specs/PLAT-001b-one-entrypoint). Draft: the first runs decide what else goes into this PR.

What

.github/workflows/from-zero.yml, run on macos-latest and ubuntu-latest:

1. The PR's dotf source build goes on PATH. install.sh keeps a dev build, so the job tests this tree's converge.
2. ./install.sh runs the first converge.
3. last.json is asserted result == ok with no failed entry, so a converged first run is checked before idempotence (lesson 328).
4. dotf doctor --scope machine runs. A runner has no identity and none is fabricated for it: the identity checks print a SKIP naming their restore step (PLAT-001: [EPIC] OS-agnostic from-zero bootstrap — macOS bring-up as the forcing function #2013 D10, feat(doctor): scope the sweep to machine checks with --scope machine #2337).
5. A second dotf converge must report changed == 0.

The trigger is the owner's (2026-10-10): pull requests that touch the install path, and every push to main. The check is not required. Nothing uses continue-on-error: a red run that names its cause is the design. Every cause from the first runs becomes a #2013 ledger row, or gets fixed here if it is the job's own.

Order note: the owner placed P5c (agents through mise; first labelled P5b) before X1. PR-B is waiting on release 0.68.0 (#2329, then #2314), so X1 goes first. The agent-presence assertion is recorded in tasks.md as the line PR-B adds.

Doctor gate

Doctor on a fresh runner still FAILs on findings #2013 already owns (kubectl on darwin, the hive daemon, .profile/.inputrc on darwin, ~/Applications and *_HOME on linux). .github/scripts/from-zero-doctor-gate.sh gates the step on from-zero-known-failures.txt, as test-windows' doctor-gate.ps1 does: a listed FAIL passes, an unlisted FAIL fails, and a listed entry no FAIL matches fails as stale, so the list only shrinks. Each entry names its owner. Replayed on run 38115559203: 4 known on darwin, 8 on linux, 0 new, 0 stale. tests/from-zero-doctor-gate.bats covers the verdicts under bash and zsh.

Knowledge

• Lesson: none: first runs pending
• ADR: none: no decision beyond the owner's trigger, recorded on PLAT-001: [EPIC] OS-agnostic from-zero bootstrap — macOS bring-up as the forcing function #2013
• Runbook: docs/runbooks/guide-new-machine.md: its CI line now names this job's dotf doctor --scope machine (the runbook itself landed in feat(doctor): scope the sweep to machine checks with --scope machine #2337)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: mlorentedev/dotfiles/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: f1647ab7-e01a-4a80-906a-ff67189a1752

📥 Commits

Reviewing files that changed from the base of the PR and between 007c92f and e85bda3.

📒 Files selected for processing (9)

• .github/scripts/from-zero-doctor-gate.sh
• .github/scripts/from-zero-known-failures.txt
• .github/workflows/from-zero.yml
• docs/runbooks/guide-new-machine.md
• specs/PLAT-001b-one-entrypoint/features.json
• specs/PLAT-001b-one-entrypoint/proposal.md
• specs/PLAT-001b-one-entrypoint/tasks.md
• specs/PLAT-001b-one-entrypoint/verification.md
• tests/from-zero-doctor-gate.bats

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 2013 - Partially compliant Compliant requirements: Workflow runs install.sh, asserts first converge via last.json, runs doctor --scope machine, then asserts second converge changed == 0 First-run convergence asserted before idempotence (lesson 328) macos-latest and ubuntu-latest matrix Non-required check, documented with the owner's trigger and the CI-004 caveat about dropping the paths filter before making it required No continue-on-error anywhere; failures emit ::error:: naming the cause Ledger disposition of first-run causes recorded as an open task in tasks.md Non-compliant requirements: (pending by design, draft PR) the first green runs and the ledger triage have not happened yet Requires further human verification: Whether the first real runs on both runners go green and what findings they produce Whether doctor's identity checks actually print SKIP (not FAIL) on a runner with no identity

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

---

⚙️ Agent run details

• Model: openai/glm5.3-flash
• Tokens: 20,289 in / 1,863 out / 22,152 total
• Time cost: 46.2s
• AI calls: 1

[mlorentedev]

Review triage

Reviewed by PR-Agent at a9d9937: no major issues, no security concerns, no inline findings. CodeRabbit did not review: rate-limited.

#	Finding	Disposition
1	Ticket compliance: "the first green runs and the ledger triage have not happened yet"	Partly applied. The ledger triage happened: run 38115559203 is classified on #2013 (every red cause has an owner row; the new ones became #2340, #2336 and the X4 row), and 8585aeb ticks the task. The green run has not: the check is non-required and stays red until S2, P7 and T3 land, as the proposal says. AC9 stays open.
2	Human verification: do identity checks print SKIP, not FAIL, with no identity?	Verified. Run 38115559203's doctor output shows no identity FAIL on either runner; every FAIL listed on #2013 is a machine check.