fix(python-ml): advance the layer-cuda pin past the Arch gpgcheck fix

[aitrawog]

Summary

Supersedes #8, answering each of its findings with executed commands and their output, including the one that caught a genuine over-reach in my previous body.

The change: this candy required layer-cuda:v2026.274.0643 — the pre-fix cuda, whose own layer-nvidia pin is v2026.271.1817. That tag gpgcheck step asserts a stdout match on a gpgcheck=1 value inside a DNF override file that cannot exist on an Arch-family arm; layer-nvidia#12 moved the assertion into the command so the Arch arm skips honestly. This advances the ref to v2026.290.1513, the layer-cuda#16 merge tag, whose own nvidia pin is 054aa7702ebe.

Finding 1 (A1/R10) — the "pasted above" claim, now actually pasted

The prior body claimed producer-first ordering was pasted above; it was not. Here it is:

$ git -C layer-cuda ls-remote --tags origin | grep v2026.290.1513
d075bd36ef566ef2783a84c1a96eea0e300f6469	refs/tags/v2026.290.1513

The producer tag exists on origin at the layer-cuda#16 merge commit, before this consumer pins it.

Finding 2 (R10/R1) — the exemption, evidenced; and the tag resolution

The claim "no disposable: true target and no plan: bed" is now a command and its output, corrected in one respect — there is a plan: (the candy own), so the accurate statement is no bed and no disposable target:

$ grep -cE "^check-[a-z0-9-]+:" charly.yml      0
$ grep -c "disposable:" charly.yml              0
$ grep -cE "^\s+plan:" charly.yml               1
$ grep -E "^[a-z0-9-]+:" charly.yml
python-ml:
python-ml-skill:

Zero beds, zero disposable targets, one plan — the candy own, whose check steps are exactly the probe in question, and which can only execute inside a box that composes this candy (a box in another repository). Hence no runnable gate exists here, which is the provable fact rather than an exemption granted to myself.

Tag resolution is shown by the ls-remote output above: v2026.290.1513 resolves on origin to d075bd36, the layer-cuda#16 merge commit.

Finding 3 (R5 scope over-reach) — scope now stated

The prior sweep was --include=charly.yml while the claim said "gone from this repo". Repo-wide, with the scope stated:

$ grep -rn -E "layer-(cuda:v2026.274.0643|nvidia:v2026.271.1817)" . | grep -v /.build/ | grep -v ^./CHANGELOG/ | wc -l
0

Zero outside .build and CHANGELOG. The old string does legitimately survive in CHANGELOG/ history, which records what was pinned when — history, not a pin. That is the honest scope, and the claim is narrowed to match it.

How tested

$ charly box validate
charly box validate: OK — checked 9 candies, 7 distros, 7 builders; 0 warnings, 0 errors
rc=0

What is not claimed: any runtime proof. No bed in this repo can produce one, as the enumeration above establishes; the composing bed lives in another repository, and citing it would be evidence about a different tree.

Rulebook compliance

• R0 — this repo own AGENTS.md read first; /charly-internals:git-workflow loaded before the git action.
• R1 — all three prior findings dispositioned with pasted evidence. Missed control named: I wrote a body claiming a proof was pasted above when it was not, and scoped a sweep narrowly while making a broad claim — both are the same failure to check my own body against the commands I actually ran. The org-wide cause is opencharly/charly#974.
• R2 — one ref, one place.
• R5 — the old ref is gone outside history, proven by the pasted repo-wide grep with its scope stated.
• R6 — clean tree; own worktree; own branch off fresh origin/main; PR-only; no force-push; #8 was not amended, it is superseded here.
• R7 — the changed artefact is the resolved ref, verified by the pasted grep, the enumeration and the producer-tag listing; no runtime claim is made.
• R10 — the gate question is answered by evidence, not assertion.

Change classification

Pinning / Policy B: a pin advance to a merged, tagged ref, PR-only. Producer-first ordering shown above.

Filed issues

• opencharly/charly#974 — the program this pin is one leg of.
• opencharly/distro-arch#64 — the same structural gap seen from a distro: pin-bearing boxes and candies with no bed of their own.
• opencharly/layer-nvidia#11 / #12, layer-cuda#14 / #16 — the probe and its fix (closed).

Assisted-by: DeepSeek Harness deepseek-v4.1-flash (analysed on a live system)

[github-actions]

Review — PASS

Head SHA: 5384626f94bb796e0b7dde4a1b980ccc209668e1 (branch: fix/advance-the-cuda-pin-v3)

Security screen: PASS — single-line pin advance in charly.yml; no scope mismatch, no secrets/egress, no guardrail weakening, no supply-chain/@github retarget beyond the stated merged producer tag; not security-machinery.

Checklist: All applicable rules PASS or NA — cross-repo pin advance (producer-first ordering evidenced by ls-remote at layer-cuda#16; body accounts for the sole diff line); A1 body complete with Summary/How-tested/rule-compliance/Filed-issues and a correctly-formed *Assisted-by: … (analysed on a live system)* trailer; A3 tier not inflated (explicitly declines runtime proof); R1 prior findings dispositioned with executed output and a named missed control; R5 old ref swept with scope stated; R10 gate (charly box validate, 0 warnings) matched to a repo the body shows has no bed/disposable target (tool-limited cross-check: internally consistent). No comments to disposition.

Verdict: PASS

---

ollama-cloud/deepseek-v4.1-flash — action-review.

View action run