Every per-repo behaviour this dispatcher has lives in CONFIG_KV, and nothing anywhere asserts that what is in KV matches what anyone believes is in KV.
The shape of it
A consumer's gate is defined by keys like offload-test.command:<repo>, offload-test.stages:<repo>, offload-test.timeoutSec:<repo>:<label>, and now sandbox.transport:<repo>. They are applied by an operator running wrangler kv key put against this account. Consumer repos hold no Cloudflare credential — the one that motivated this issue has exactly one secret, FLAREDISPATCH_HMAC, which only lets it ask for a run — so a consumer cannot apply, verify, or even read the configuration that decides how its own CI behaves.
The failure mode is silence in both directions:
- Drift. A fresh deployment, an account migration, or an operator omission puts a repo back on a default while its README still documents the value. Nothing goes red; runs just get slower or differently-shaped.
- Description without enforcement.
infra/flare-dispatch/README.md in a consumer repo describes the keys accurately today and has no mechanism to stay accurate. That file already carries this warning about offload-test.command, which is where a disk-budget.sh step was documented for months while the live value had never contained it.
What would close it
Either direction works; the second is stronger:
- A post-deploy assertion. After the dispatcher deploys, read the keys it expects to exist and fail the deploy on a mismatch. Catches drift at the moment it is introduced rather than in whichever consumer's run next pays for it.
- Declarative config applied by the release. The desired KV state lives in this repo as data, and the deploy applies it. Then "what is configured" is a diff and a review, which is the same argument
infra/ci/gate.sh already won against an &&-chain stored in a KV value.
Consumer-side, for reference
A consumer can sometimes observe the effect even when it cannot read the config. Example landed in the repo that raised this: its gate now reports whether the cargo registry was restored from the archive or downloaded by cargo fetch, by measuring what the two leave behind (registry/src empty vs ~893 MB). That makes a silent transport revert visible in the run that pays for it.
That is a workaround, not a fix — it only exists where the config has a measurable in-container consequence, and it reports rather than gates.
Every per-repo behaviour this dispatcher has lives in CONFIG_KV, and nothing anywhere asserts that what is in KV matches what anyone believes is in KV.
The shape of it
A consumer's gate is defined by keys like
offload-test.command:<repo>,offload-test.stages:<repo>,offload-test.timeoutSec:<repo>:<label>, and nowsandbox.transport:<repo>. They are applied by an operator runningwrangler kv key putagainst this account. Consumer repos hold no Cloudflare credential — the one that motivated this issue has exactly one secret,FLAREDISPATCH_HMAC, which only lets it ask for a run — so a consumer cannot apply, verify, or even read the configuration that decides how its own CI behaves.The failure mode is silence in both directions:
infra/flare-dispatch/README.mdin a consumer repo describes the keys accurately today and has no mechanism to stay accurate. That file already carries this warning aboutoffload-test.command, which is where adisk-budget.shstep was documented for months while the live value had never contained it.What would close it
Either direction works; the second is stronger:
infra/ci/gate.shalready won against an&&-chain stored in a KV value.Consumer-side, for reference
A consumer can sometimes observe the effect even when it cannot read the config. Example landed in the repo that raised this: its gate now reports whether the cargo registry was restored from the archive or downloaded by
cargo fetch, by measuring what the two leave behind (registry/srcempty vs ~893 MB). That makes a silent transport revert visible in the run that pays for it.That is a workaround, not a fix — it only exists where the config has a measurable in-container consequence, and it reports rather than gates.