fix(python-ml): advance the layer-cuda pin past the Arch gpgcheck fix

[aitrawog]

Summary

One link of a transitive pin cascade, and the last of the six GPU-candy repos that carry the old cuda pin — with this merge, the cause of the transitive pre-#12 nvidia pin is cleared across the candy layer.

charly.yml pinned layer-cuda:v2026.274.0643. That cuda candy in turn pins layer-nvidia:v2026.271.1817 — the pre-#12 tag whose gpgcheck step asserts stdout: gpgcheck=1 against /etc/dnf/repos.override.d/99-config_manager.repo, which cannot exist on an Arch-family arm. layer-nvidia#12 moved that assertion into the command so the Arch arm skips honestly, so a consumer must pin a layer-cuda whose own nvidia pin is that fix.

Because a candy check runs in the check-image phase of every box that composes it, this one stale transitive pin fails every bed in the tree. Measured on the GPU-free bed check-strata-pod: 39 of 40 steps pass, and the single failure is this probe.

This advances layer-cuda to v2026.290.1513 (layer-cuda#16's merge tag; its own nvidia pin is 054aa7702ebe, layer-nvidia#12).

How tested

On the committed tree, exit code captured separately from the shell's:

$ charly box validate
charly box validate: OK — checked 9 candies, 7 distros, 7 builders; 0 warnings, 0 errors
validate rc=0

Zero warnings, zero errors. That is the only honest scope for this change: this repo is internally consistent now, but the multi-version diagnostic fires across a scope, so the remaining producers — the core charly box tree, the distros, the marketplaces, and the two vendored copies — must advance before any consuming bed can go green.

Not claimed: a green CachyOS bed. That is the program, tracked on opencharly/charly#974.

Rulebook compliance

• R0 — this repo's own AGENTS.md read first.
• R1 — fresh RCA with the missed control named: the build reported the multi-version condition as an allowlisted Notice and I read past it, while validate treats it as a hard error. A warning that says two versions is never noise. Blast radius and the priced owner list are on Pin currency is a graph property: a candy's version: is its cache identity, and reconcile cannot see pins inside fetched refs charly#974.
• R2 — no duplication introduced; one pin, one place.
• R5 — the old ref is gone from this repo.
• R6 — clean tree before and after; own worktree, own branch off fresh origin/main; PR-only, no force-push.
• R7/R10 — gate green on the committed tree with output and exit code pasted; no runtime bed applies to a pure pin advance.

Change classification

Pinning / Policy B: a pin advance to a merged, tagged ref, PR-only. Producer-first holds — layer-cuda#16 merged and tagged before this consumer pins it.

Filed issues

• Pin currency is a graph property: a candy's version: is its cache identity, and reconcile cannot see pins inside fetched refs charly#974 — the program this PR is one leg of, with the priced owner list and ordering.
• The nvidia-container-toolkit gpgcheck probe asserts a Fedora fact on the Arch arm, so every Arch GPU image reports a red check layer-nvidia#11 / #12 and layer-cuda#14 / #16 — the probe and its fix.
• candy/cachyos-*-skills: every skill routing node fails validate — #SkillInput requires non-empty description AND content distro-cachyos#135 / #137 — a repo-wide resolution blocker found along the way.

Assisted-by: DeepSeek Harness deepseek-v4.1-flash (analysed on a live system)

[github-actions]

Review — BLOCK

Head SHA: 594011adcd8a0ce5fc7902512e40a81e9d9618b7 (branch: fix/advance-the-cuda-pin)

Change class: config / pin advance — a single-line change in charly.yml (+1/-1). No code, no docs.

Comment thread: empty (0 comments) — nothing to disposition.

Blocks

1. R5 (grep self-test) / CONC(d) — unexecuted sweep claim. The diff changes exactly one line (charly.yml:14), and the body asserts under R5: "the old ref is gone from this repo." That is a sweep claim about files the diff does not show, and no grep command or its output appears anywhere in the body. CONC(d) makes an unexecuted sweep claim a FRAUD-class blocking finding, and R5 requires the grep self-test to land with the same commit. Fix: paste the real command and its real output, e.g. grep -rn 'layer-cuda:v2026.274.0643\|layer-nvidia:v2026.271.1817' . — the body itself names a second stale transitive ref (layer-nvidia:v2026.271.1817), so the sweep is not trivially answered by the one-line diff.

2. A1/A2/R10 — gate does not match the change class; How-tested is internally inconsistent. The How-tested block supplies only charly box validate and declines a bed with "no runtime bed applies to a pure pin advance," yet the same body states the pinned candy "runs in the check-image phase of every box that composes it" and reports a bed measurement (check-strata-pod, 39/40). A change the body says is exercised by every composing box is runtime-affecting; the How-tested block must name the change-class bed, the disposable: true target, and the fresh-rebuild confirmation (or state N/A — <reason> for each), and must make unambiguous whether the 39/40 result is pre- or post-change. Fix: either paste the post-change bed result on a named disposable: true target, or reconcile the "no bed applies" claim with the body's own "check-image phase of every box" statement.

Verdict: BLOCK

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run

[aitrawog]

RESOLVED — withdrawn. This change is being folded into the consuming box repo that composes this candy and has a real disposable bed.

Why. The validator BLOCKed on A2/R10, correctly: a pin that alters composition must be evidenced by a bed that would fail without it, on the new pin — and a static charly box validate cannot fail on the gpgcheck path this pin exists to fix. That evidence does not exist inside this repo: it ships no disposable: true target and no plan: bed of its own, and the bed that composes this candy lives in another repo (for example distro-cachyos's versa box composes pod-marimo). Citing that other repo bed here would repeat the exact category error the first BLOCK caught: evidence about a different tree standing in for this diff.

Where it goes instead. The pin advance rides in the box repo whose bed actually composes this candy, where the R10 can be run and its output pasted against the change under test. The repository is left at its current state, unmodified by this session.

No code is lost: the diff is a single pin, and it is carried in the folded change.

Tracked as opencharly/charly#974.