[ZacxDev]

Problem

A shipping officer whose CI runs as Tekton PipelineRuns in a cluster sees only "red": the commit statuses carry no target_url, the instance has no cluster access and no toolchain. So it escalates, even when one error line in the failed step's log gives the cause.

What this adds

officer_ci_logs{pr} is a read-only tool. It is offered only to a shipping officer that has a new ci_logs block, and muster-server answers it:

"ci_logs": {"namespace": "example-ci", "pipeline": "example-pr-check",
            "service_account": "muster-ci-logs"}

(commit_label defaults to pipeline.jquad.rocks/pr.branch.commit, pr_param to PR_NUMBER, max_bytes to 16384, with a range of 2048–65536.)

1. Ownership uses feat(officership): officer_mark_ready — an officer converts its own draft PR to ready #389's single own-PR rule, owner.headAndAuthor (the same as owner.ownPR minus the base check): the head is a <prefix>… branch of repo and the author is the officer App's bot. An identity read failure fails closed through failClosed, which Gates.ownPR also uses now. There is no second copy of the rule. A refusal names head_branch or author, and happens before any cluster read.
2. Match: it lists PipelineRuns with tekton.dev/pipeline=<pipeline>,<commit_label>=<the head GitHub reports now>. It re-checks those labels on each result, then keeps only runs whose pr_param equals the PR number. The newest of those is used, and older retries are counted.
3. Failures: TaskRuns with Succeeded=False. For each one it reads only the failed step-* containers (every step on a timeout, never a sidecar), each as the tail of the log.
4. Excerpt: it keeps --- FAIL, FAIL …, ✘, N failed, ERROR, SQLSTATE, panic:, Error:, x_test.go:N: and file.go:N:M: lines, deduplicated with a repeat count, then the last 15 lines. ANSI codes are stripped, each line is capped at 400 bytes, and all excerpts together stay within max_bytes, cut on character boundaries.
5. It never returns an empty answer. state is one of no_run, running, succeeded ("no failure found") or failed, and there is always a note.

Secret safety. A PEM block is withheld whole, every line from BEGIN through END (to the end of the log if END is missing). A bare line of 40+ base64 characters is withheld too. Any other line that looks like it carries a credential (GitHub/AWS/Slack/sk- tokens, JWTs, PEM blocks, Authorization/Bearer headers, password=/token: assignments), and any env-dump NAME=value line, is withheld whole. URL user:pass@ is masked. This is a pattern filter, not a guarantee; the byte cap limits what a miss can carry. Only failed step containers are read, never sidecars.

Cluster access goes through the in-cluster API. Each call, muster's own identity mints a TokenRequest for service_account (600 s, default audience), and a client is built fresh from the API server, the CA and that token alone. muster's own token, and its token file, never reach the reads. The token is minted only after the ownership gates pass, once per call; a failed mint is a ci_runs refusal. RBAC: list on pipelineruns and taskruns and get on pods/log in the CI namespace; for muster's SA, create on serviceaccounts/token limited to that SA by resourceNames. If the source can't be built (not in a cluster), it is logged and the tool answers "unavailable". It does not refuse the boot.

The kickoff tells the officer to call officer_ci_logs before escalating a red check. docs/officers.md documents the block, the match rule, the excerpt and the RBAC.

Update after round 0

commit	what	targeted tests at it
1121311e	test: a PEM block is withheld whole, in 5 shapes (block at the end with BEGIN outside the tail, no END, mid-log, log read starting mid-block, encrypted key's headers)	officership red (5/5 subtests)
2513774d	fix: RedactLines keeps BEGIN…END state; also withholds bare base64 lines	green
de181720	test: TokenRequest minting (SA name and namespace, 600 s, default audience, empty token is an error), reader config carries only the minted token, no open on a refused call, mint failure is a refusal, token_file is an unknown field	build fails in all 3 packages
b73b9833	feat: ci_logs.service_account and a per-call TokenRequest replace token_file; the duplicate ci_config gate is dropped	green: officership 25, officers 13, api 1

Mutation checks, each killed by a named test: removing the BEGIN…END state (killed by the "encrypted key's headers" case); removing the base64 rule (killed by "log read starts mid-block"); copying muster's token file into the reader config; a 3600 s token; accepting an empty token; minting before the ownership check. The pr_param filter stays. The ownership helper is unchanged until #389 merges, then this branch is rebased onto it.

Rebased onto #389 (382194c5)

The commits were replayed, and the shas changed:

commit	what	targeted tests at it
9df7f4c1	tests first	build fails
84ec8b65	feature	green
74a588ad	PEM test	officership red (TestCILogsWithholdsAWholePEMBlock)
248a2bb8	PEM fix	green
a37fa51f	TokenRequest tests	build fails
b3a78138	TokenRequest feature	green: officership 25, officers 13, api 1

At b3a78138, the full officership and officers packages pass, and so do the api officer, ship, mark-ready and merge tests. vet is clean.

Conflicts, both features kept:

• gates.go: took main's as-is, and deleted my refuseForeignHead/refuseForeignAuthor. MergePR uses Gates.ownPR again. I added failClosed, the fail-closed wrapper that Gates.ownPR now delegates to.
• officer_ship.go: the header lists the four tools and then officer_ci_logs as the fifth. isShipTool includes both ToolMarkReady and ToolCILogs.
• kickoff.go: both constants. shipNote keeps the ToolMarkReady arg and appends ciLogsNote(o).
• docs/officers.md: the tools-table row with officer_mark_ready, plus the officer_ci_logs row.

Ownership mutation against the shared helper:

• Disabling the whole author check in owner.headAndAuthor turns these red: TestCILogsRefusesAPullRequestThatIsNotTheOfficersOwn/{a_human's,another_bot's}_pull_request, TestEveryMergeGateRefusesItsOwnFailure, TestMarkReadyRefusesEverythingButOwnDraftToReady and TestThePushGateUsesTheGatesOwnPRRule.
• Disabling only the login half fails only the "another bot" case, as expected, since AuthorType != "Bot" still refuses the human.

The message of 84ec8b65 still mentions the retired refuseForeignHead/refuseForeignAuthor. Its code doesn't use them.

Tests (red-first)

• e3870cb9 contains only the tests. At that commit, internal/officership, internal/officers and internal/api fail to build because the tool doesn't exist yet.
• At ee723cfd (the implementation), all three packages pass: 17 / 13 / 1 passing cases, run with -run 'CILogs|ParsePipelineRun'. The rest of internal/officership also passes, including the merge-gate tests that cover the ownership refactor.

What's covered: refusal of another author's PR, another bot's PR, a human branch and a fork (with zero cluster reads); picking the current head's run over an old head, the same head under another PR, another pipeline and an older retry (the fake reader ignores the selector, and the selector is pinned as a literal); following the head after a push; FAIL + SQLSTATE lines read only from the failed step; the byte cap across tasks plus valid UTF-8 at every cut; clear no-failure answers; credential lines withheld (with a positive control); config defaults and refusals; MCP offer and dispatch.

Mutation check. Each guard was disabled on purpose and a named test went red:

guard disabled	killed by
author ownership check	…RefusesAPullRequestThatIsNotTheOfficersOwn/{a_human's,another_bot's}_pull_request
pr_param filter	…PicksTheRunForTheCurrentHead (it picked run-other-pr)
label re-check	…PicksTheRunForTheCurrentHead, …FollowsTheHeadNotTheNewestRun (it picked other-pipeline-run)
byte cap	…RespectsTheByteCap (695539 bytes against a cap of 4096)
redaction	…WithholdsCredentialLines
failed-step filter	…ExcerptCarriesTheFailAndErrorLines (it read step-provision)

Per the repo convention, CI runs the full suite; locally I ran only the new tests plus the officership package.

Not in this PR

Deploying it needs a pin bump plus the ci_logs block in the deployment's MUSTER_OFFICERS, along with the RBAC. A build without this change refuses the unknown ci_logs field at boot.

🤖 Generated with Claude Code

[ZacxDev]

Round 0 (requirements & deletion) at ee723cf — verdict: requirement questioned (ownership refactor overlaps #389) + deletion candidates; no open premises. Requirements 11 (unattributed 5). Correction to the report: Tekton CI does run on draft PRs in the target repo (measured 2026-11-01); only the hosted review skips drafts. Round-1 pointer: line-wise redaction lets a PEM block's base64 body through while the docs say the block is withheld whole.

D1 — the ownership refactor (refuseForeignHead/refuseForeignAuthor) duplicates #389's Gates.ownPR and textually conflicts with it in gates.go, officer_ship.go, kickoff.go, docs/officers.md; keep one helper and rebase the second-merged PR onto it
D2 — the pr_param (PR_NUMBER) run filter and its config knob: a run for the same head sha under another PR has the same code and explains the same failure, so it guards nothing material
D3 — the ci_config gate inside CILogsReader.Read repeats the dispatcher's own rt.ci / rt.ciErr checks, which always run first

[ZacxDev]

Round 1 (full checklist) at b3a7813: 🔴 1 · 🟡 1 · 🟢 3 — fixes in progress; a delta round 2 follows.

• 🔴 R1 flake.nix:206: goVendorHash stale after the new k8s imports ("nix outputs" CI red).
• 🟡 Y1 internal/officership/cilogs.go:330,334: the secret filter misses keywords after _ (_PASSWORD, _TOKEN, …), set -x prefixed env lines, \r-separated lines, lowercase names and empty URL usernames — measured verbatim leaks in error lines.
• 🟢 G1 PipelineRun message not redacted · G2 tail drops the log end on long lines, Truncated misses some cuts · G3 TaskRuns not re-checked against the selector.

Security questions checked and held: ownership (shared #389 helper, fail-closed), scoping, token never logged/returned, muster's own credential never used for reads, memory bounded, PEM withheld whole, RBAC/admission in civitai/agent-cluster#78bf61b04 match the calls exactly.

[ZacxDev]

Round 1 fixes landed (b3a7813..fca4e09); full CI green on fca4e09 incl. nix outputs and test (postgres). A delta round 2 follows.

1. flake.nix goVendorHash updated for the new k8s imports; nix outputs builds
2. the excerpt filter withholds credential-word keys anywhere in the key (incl. after `_`), JSON "KEY":"value", set -x prefixed and lowercase env assignments, lines split at a lone \r, and masks empty-username URLs; ordinary FAIL/ERROR lines that only name a secret still pass
3. the PipelineRun message is redacted
4. the log tail keeps the END (last 20000 lines, last 8 MiB at a line boundary) and `truncated` reflects every cut
5. listed TaskRuns are re-checked against their pipelineRun label
6. the byte-cap test no longer runs a 5000-line excerpt 200 times (CI timeout)

[ZacxDev]

Round 2 (delta) at fca4e09: 🔴 0 · 🟡 3 · 🟢 3 — ladder ends. All fixed un-re-audited in 7dc9483..7513263 (tests first; 13 mutants killed); full CI green on 7513263.

1. credential keys must end the identifier; short words count only as a whole segment or the key start; path values are not secrets — file_path/output_path/tokenizer/Secret:<ns/name>/pwd lines pass
2. lowercase key=value at line start counts only after export, so logfmt/slog lines pass
3. set -x trace lines, login -p/-pVALUE, --password/--token VALUE, {"auth":…}, Cookie/Set-Cookie, sig=/signature=, DB_PASS:, credentials:, basic auth: are withheld
4. readTail keeps the byte before the window, never empties an over-cap last line, starts on a UTF-8 boundary, counts a last line without trailing newline
5. the tail test pins which end is kept; each clipped-line check has its own case
6. redactText shares the lone-\r line split