ci-combo-unverified: the fleet's rolls are not combo-verified

[github-actions]

main of Systemorph/MeshWeaver is red. This issue is the ledger: every red run on main appends a dated entry below, and the run that goes green again closes it. A red within 7 days of the close REOPENS this issue rather than filing a second one, so one outage is one story.

Each entry is also POSTed, signed, to the control portal's triage inbox (Hosting/PlatformBuilds on memex.systemorph.com), whose triage agent opens a thread on it. Read the newest entry first — the failed jobs link straight to their logs.

Ledger

16 older entries trimmed — the run list on the Actions tab keeps them.

2026-09-15T20:29:43Z — failure — run 35019936250

commit	7fc9f9cd8a0f8d8ba1f316054a5d0f8b33a6b11a
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-15T20:48:54Z — failure — run 35021886778

commit	7fc9f9cd8a0f8d8ba1f316054a5d0f8b33a6b11a
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-15T21:27:39Z — failure — run 35025711355

commit	7fc9f9cd8a0f8d8ba1f316054a5d0f8b33a6b11a
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-15T21:47:56Z — failure — run 35027584084

commit	7fc9f9cd8a0f8d8ba1f316054a5d0f8b33a6b11a
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-15T22:29:11Z — failure — run 35031167842

commit	afde4eabe0740ff658f3dae8a3073c33a2b3ea02
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-15T23:01:28Z — failure — run 35033745414

commit	afde4eabe0740ff658f3dae8a3073c33a2b3ea02
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-15T23:31:03Z — failure — run 35035994579

commit	afde4eabe0740ff658f3dae8a3073c33a2b3ea02
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T00:42:58Z — failure — run 35041090763

commit	afde4eabe0740ff658f3dae8a3073c33a2b3ea02
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T02:06:07Z — failure — run 35046653058

commit	afde4eabe0740ff658f3dae8a3073c33a2b3ea02
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T02:41:22Z — failure — run 35048928958

commit	afde4eabe0740ff658f3dae8a3073c33a2b3ea02
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T03:38:54Z — failure — run 35052569634

commit	afde4eabe0740ff658f3dae8a3073c33a2b3ea02
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T04:38:27Z — failure — run 35056363842

commit	afde4eabe0740ff658f3dae8a3073c33a2b3ea02
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T05:34:41Z — failure — run 35060044403

commit	5ee3ef56fe5e460ff62c5b445a0bf5465e9daff0
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T06:30:00Z — failure — run 35063961420

commit	141e5fdc919045cef3b934fe9ec189069660229f
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T06:46:53Z — failure — run 35065274775

commit	141e5fdc919045cef3b934fe9ec189069660229f
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T07:02:04Z — failure — run 35066481255

commit	ea35bbe1a0daafd5919ed3afb5fe53b1cadff1e1
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T08:07:29Z — failure — run 35072049847

commit	3385e18fb7cbd001662dae4cb4e4753cb5ce271a
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T08:32:33Z — failure — run 35074317361

commit	3385e18fb7cbd001662dae4cb4e4753cb5ce271a
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T08:39:14Z — failure — run 35074927709

commit	3385e18fb7cbd001662dae4cb4e4753cb5ce271a
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T09:09:58Z — failure — run 35077820001

commit	678d9744d33eb3f7771528d4bbbc9d324aeca7f8
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T09:32:54Z — failure — run 35080010599

commit	5453f8cb42e2f4d9df8cd85b2bbfa24ec0318ef9
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T10:10:43Z — failure — run 35083530839

commit	f0ea2ceb312c672cc093fe8c41bb6a5f3a6e8151
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T10:31:30Z — failure — run 35085423053

commit	9f42fe4f3b531e99f20df7b92b641248e3bd8cdd
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T11:05:34Z — failure — run 35088432986

commit	28166328c5f0224574fb367c58cb47374b2fd018
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T11:30:05Z — failure — run 35090615308

commit	7a59015d717e46e93fe94ce87ecb87950dd4b347
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T12:00:09Z — failure — run 35093317212

commit	401a4bdb1f769b563fd080c6c66a40aa71f690b6
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T12:42:21Z — failure — run 35097346167

commit	401a4bdb1f769b563fd080c6c66a40aa71f690b6
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T13:03:15Z — failure — run 35099449998

commit	401a4bdb1f769b563fd080c6c66a40aa71f690b6
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T14:26:46Z — failure — run 35108539287

commit	401a4bdb1f769b563fd080c6c66a40aa71f690b6
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T15:27:45Z — failure — run 35115454370

commit	f21092b9518e4f8eeb9e757bfdd232bdc2d2f1ba
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T15:29:50Z — failure — run 35115694806

commit	f21092b9518e4f8eeb9e757bfdd232bdc2d2f1ba
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T16:18:51Z — failure — run 35121047670

commit	28abc50c13f6ccb86e50217b6c9c4785cb6cb317
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T16:32:29Z — failure — run 35122520636

commit	28abc50c13f6ccb86e50217b6c9c4785cb6cb317
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T17:12:27Z — failure — run 35126695575

commit	b1641a56c6227fad15bcdaf1410be63dee363c6a
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T17:28:30Z — failure — run 35128376068

commit	b1641a56c6227fad15bcdaf1410be63dee363c6a
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T18:07:58Z — failure — run 35132450436

commit	5d5fe82c3caf39d8f212dca172ad21a593e9c894
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T19:02:13Z — failure — run 35138065086

commit	836d4472b27dfd605a796830958ce9549797dfe6
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T19:28:12Z — failure — run 35140714396

commit	836d4472b27dfd605a796830958ce9549797dfe6
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T21:30:50Z — failure — run 35152770100

commit	eb5ee75b7d23c9854d770961c62a0d0fe6c3838c
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

2026-09-16T21:36:27Z — failure — run 35153287035

commit	eb5ee75b7d23c9854d770961c62a0d0fe6c3838c
trigger	workflow_run
platform set	(none)
failed jobs	Assert the inputs exist — step Every external input, or a red build naming what to provision Combo verification ran, or said why not — step The verdict, and it can fail

[rbuergi]

Folded in from #4431, a second ledger for this same check opened at 14:32Z while this one was open (this ledger kept receiving entries before and after it): 2026-09-15T14:32:20Z — failure — run https://github.com/Systemorph/MeshWeaver/actions/runs/34982217598 (trigger workflow_run).

[systemorph-com]

Triage verdict: content (repo configuration gap).

Run 35041090763 failed in the preflight job Assert the inputs exist: three external inputs are unset/empty (blank in the job's env dump) —

• vars.COMBO_VERIFY_SOURCES
• secrets.COMBO_VERIFY_KEYS
• secrets.COMBO_VERIFY_TOKENS

(Azure tenant/subscription and the FLEET_READER_* secrets are all present, so this is not a wholesale secret-store problem.) The second job, Combo verification ran, or said why not, is only the relay: it red with PREFLIGHT=failure, VERIFY=skipped, COUNT=0, exactly as designed.

The commit's code did not break against a platform change, and nothing points at runner/network/registry — the gate is correctly red because the inputs it requires to produce a verdict were never provisioned. Not transient; not re-run. Per its own message, until these are set every self-update in the fleet rolls UNVERIFIED (#3544).

Action for a repo admin: set COMBO_VERIFY_SOURCES (repo variable) and COMBO_VERIFY_KEYS / COMBO_VERIFY_TOKENS (secrets, one entry per declared instance), then re-run this workflow. The preflight's error output names the exact expected format for each.

Filed by the triage agent via systemorph-com.

[systemorph-com]

Triage verdict: content (repo configuration gap).

Run 35041090763 failed in the preflight job Assert the inputs exist: three external inputs are unset/empty (blank in the job's env dump) —

• vars.COMBO_VERIFY_SOURCES
• secrets.COMBO_VERIFY_KEYS
• secrets.COMBO_VERIFY_TOKENS

(Azure tenant/subscription and the FLEET_READER_* secrets are all present, so this is not a wholesale secret-store problem.) The second job, Combo verification ran, or said why not, is only the relay: it red with PREFLIGHT=failure, VERIFY=skipped, COUNT=0, exactly as designed.

The commit's code did not break against a platform change, and nothing points at runner/network/registry — the gate is correctly red because the inputs it requires to produce a verdict were never provisioned. Not transient; not re-run. Per its own message, until these are set every self-update in the fleet rolls UNVERIFIED (#3544).

Action for a repo admin: set COMBO_VERIFY_SOURCES (repo variable) and COMBO_VERIFY_KEYS / COMBO_VERIFY_TOKENS (secrets, one entry per declared instance), then re-run this workflow. The preflight's error output names the exact expected format for each.

Filed by the triage agent via systemorph-com.