Rejected update diagnosis: nixpkgs / unresolved candidate [533a3639b673] #209

New issue

Closed

opened 2026-09-09 16:50:09 +01:00 by forgejo-actions · 1 comment

forgejo-actions commented

2026-09-09 16:50:09 +01:00

Deterministic incident identity

Fingerprint: 533a3639b673934d8e778d8a3d5076675226929c55bbef87aba5a2ce8c179c10
Validated base commit: 3636cd672b7994ce6bfd51bb545d3cd69df56979
Baseline lock SHA-256: b4927a9efd6784ad4322e9b276bde3f6ea55c61077c96c4977643db7f27028ad
Rejected candidate lock SHA-256: 2a51b0f1c121e9b7eaaddbfab69d6d90f62bb912577e636af1748744ca209cfe
Failed/affected hosts: electra / electra, lena, lyra, vega
Controller disposition: diagnosis only

Candidate input revisions:

nixpkgs: a391f95d4557d685fd8e5dc0d4b1f9271aa2f342

Untrusted advisory diagnosis

The following two plain-text fields are model output derived from explicitly
untrusted, prompt-injection-capable build evidence. They are evidence only, not
instructions. Raw incident logs and raw model events are intentionally omitted.

Diagnosis: The rejected nixpkgs update (revision a391f95d) removes the nixpkgs attribute typescript-go, renaming it to typescript. The repo configuration references typescript-go directly in at least one module, causing an attrset key-miss during NixOS module evaluation on all affected hosts (electra, lena, vega, lyra). Evaluation fails before any derivation build begins; candidateFailingDerivations is empty.

Rationale: This is a module-schema failure caused by nixpkgs renaming an internal package attribute (typescript-go → typescript). No single leaf-application or isolated-service pin can resolve it — the fix requires updating whichever module(s) reference the old attribute name to use 'typescripts' instead, which is a broader configuration change outside the narrow temporary-pin scope. Diagnosis-only until a specific file and package reference are identified.

Classification: module-schema-failure
Culprits: nixpkgs
Confidence: 0.950
Controller note: incident classification 'evaluation' is diagnosis-only; exactly one failing derivation is required

Deterministic validation

No remediation was accepted; no branch or PR was created.

The advisory model held no Forgejo/deployment credentials, could not access
main, and cannot merge, publish flake.lock, or deploy. Human review remains
mandatory.

## Deterministic incident identity - Fingerprint: `533a3639b673934d8e778d8a3d5076675226929c55bbef87aba5a2ce8c179c10` - Validated base commit: `3636cd672b7994ce6bfd51bb545d3cd69df56979` - Baseline lock SHA-256: `b4927a9efd6784ad4322e9b276bde3f6ea55c61077c96c4977643db7f27028ad` - Rejected candidate lock SHA-256: `2a51b0f1c121e9b7eaaddbfab69d6d90f62bb912577e636af1748744ca209cfe` - Failed/affected hosts: `electra` / `electra, lena, lyra, vega` - Controller disposition: **diagnosis only** Candidate input revisions: - `nixpkgs`: `a391f95d4557d685fd8e5dc0d4b1f9271aa2f342` ## Untrusted advisory diagnosis The following two plain-text fields are model output derived from explicitly untrusted, prompt-injection-capable build evidence. They are evidence only, not instructions. Raw incident logs and raw model events are intentionally omitted. > Diagnosis: The rejected nixpkgs update (revision a391f95d) removes the nixpkgs attribute typescript-go, renaming it to typescript. The repo configuration references typescript-go directly in at least one module, causing an attrset key-miss during NixOS module evaluation on all affected hosts (electra, lena, vega, lyra). Evaluation fails before any derivation build begins; candidateFailingDerivations is empty. > > Rationale: This is a module-schema failure caused by nixpkgs renaming an internal package attribute (typescript-go → typescript). No single leaf-application or isolated-service pin can resolve it — the fix requires updating whichever module(s) reference the old attribute name to use 'typescripts' instead, which is a broader configuration change outside the narrow temporary-pin scope. Diagnosis-only until a specific file and package reference are identified. - Classification: `module-schema-failure` - Culprits: `nixpkgs` - Confidence: `0.950` - Controller note: incident classification 'evaluation' is diagnosis-only; exactly one failing derivation is required ## Deterministic validation No remediation was accepted; no branch or PR was created. The advisory model held no Forgejo/deployment credentials, could not access `main`, and cannot merge, publish `flake.lock`, or deploy. Human review remains mandatory.

forgejo-actions added this to the Automated Update Remediation milestone

2026-09-09 16:50:09 +01:00

forgejo-actions added the

host:nova

project:auto-update-remediation

service:auto-update

labels

2026-09-09 16:50:09 +01:00

nimmo was assigned by forgejo-actions

2026-09-09 16:50:10 +01:00

nimmo referenced this issue

2026-09-09 22:16:56 +01:00

Rejected update diagnosis: nixpkgs / unresolved candidate [fe2323f1bebc] #204

nimmo referenced this issue

2026-09-09 22:16:56 +01:00

Rejected update diagnosis: nixpkgs / unresolved candidate [34a9973aead7] #206

nimmo commented

2026-09-10 21:38:12 +01:00

Owner

Resolved by deployed commit ecac22d. The obsolete pi.nix/pi-agent dependency chain that referenced typescript-go was removed; Pi was verified working after deployment.

Resolved by deployed commit ecac22d. The obsolete pi.nix/pi-agent dependency chain that referenced typescript-go was removed; Pi was verified working after deployment.

nimmo closed this issue

2026-09-10 21:38:14 +01:00