mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
The onion glyph alone left a job name ambiguous: no glyph meant either 'clearnet' or 'this mode has no tor axis'. Swarm and compose entries now open with the onion or the globe, so the name states which of the two networks the job tested. Host keeps neither — it shares the matrix builder but has no onion, and a glyph there would claim something the job never did. 'enabled' becomes 'enforced' so the manual selector says what it does: tor on every role that can take one, not tor on everything. 'exclusive' is the new mode. keep_tor_variants runs before assign_tor and cuts each entry down to its tor-capable variants, dropping entries left with none, so a run tests the onion and nothing else. A bundle can come out with a hole in it — variants 0 and 2 capable, 1 not, yields '0,2' — which filter_plan_to_variants already handles by set membership; both shapes are now pinned by tests. Note the word is overloaded: services.tor.exclusive drops a deployed app's clearnet vhost, while this mode only narrows what CI runs. The docstring says so where a maintainer will look. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>