fix: reject undecodable images, let zero-budget keys shadow wildcards 🐛

.github/workflows/branch_fast_forward_command.yaml

@@ -0,0 +1,68 @@
+name: branch / fast-forward command
+
+# `/genvm-fast-forward` lands a PR by moving its base branch to the PR head,
+# without a merge or squash commit. The tool gates on approvals, required checks
+# and E2E, since the deploy key it pushes with bypasses the base's rulesets.
+# The resulting push triggers the usual executor branch sync
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions: {}
+
+# One request per PR at a time; across PRs the non-force push keeps landings safe
+concurrency:
+  group: fast-forward-command-${{ github.event.issue.number }}
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash -exo pipefail {0}
+
+jobs:
+  fast-forward:
+    # The association only spares strangers the deploy key; the tool authorizes
+    if: >-
+      github.event.issue.pull_request &&
+      github.event.comment.body == '/genvm-fast-forward' &&
+      contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      checks: read
+      contents: read
+      issues: write
+      pull-requests: write
+      statuses: read
+    steps:
+      # issue_comment workflows run from the default branch. Keep that trusted
+      # checkout: the deploy key is in scope, so no PR code may run here.
+      # Full history, so git can show the push builds on the base
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up manager push access
+        env:
+          MANAGER_DEPLOY_KEY: ${{ secrets.GENVM_CI_PRIVATE_KEY }}
+        run: |
+          install -m700 -d ~/.ssh
+          key="${RUNNER_TEMP}/manager_push_key"
+          set +x
+          printf '%s\n' "$MANAGER_DEPLOY_KEY" > "$key"
+          set -x
+          chmod 600 "$key"
+          git config --global url."git@github.com:".insteadOf "https://github.com/"
+          echo "GIT_SSH_COMMAND=ssh -i $key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new" >> "$GITHUB_ENV"
+
+      - name: Verify and fast-forward
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+          SENDER: ${{ github.event.sender.login }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: ./support/ci/run.sh tool fast-forward-command

docs/contributing/howto/pr.md

@@ -30,6 +30,21 @@ reading the diff
 With `ci-safe` and write access, `/genvm-run-tests` links one run and reacts
 👀 → 🚀/😕 without changing the sticky `run-full-tests` label
 
+## Fast-Forward
+
+`/genvm-fast-forward` lands a PR without the App: it moves the base branch to
+the PR head with a non-force push, so the PR's commits land as they are. It
+refuses, listing every unmet gate, unless:
+
+1. The commenter is an admin, or a writer and the PR head carries an approval
+   from a writer who is neither the author nor the commenter, with no writer's
+   change request
+2. The base is `v<X>-dev`, or `v<X>` for an admin; the PR is not from a fork
+3. `E2E Tests` and every check the base requires succeeded on the head
+4. The head is strictly ahead of the base and has no merge commits
+
+The push then syncs executor branches as any manager push does
+
 ## Gates
 
 `queue.yaml` always runs the pre-commit hooks. On a `pull_request` event it also
@@ -50,7 +65,8 @@ rerun manually against the live manager branch
 
 ## Authority
 
-Needs a maintainer: merging, `--admin`, cross-repo E2E runs, and anything
+Needs a maintainer: merging (a writer may `/genvm-fast-forward` an approved
+PR), `--admin`, cross-repo E2E runs, and anything
 irreversible outside the PR — releases, deploys, messages to other teams. Never
 force-push a shared branch (`v<X>`, `v<X>-dev`); branch protection refuses it
 anyway. Force-pushing your own PR branch is routine and needs no one, and so

docs/website/src/impl-spec/04-fees.rst

@@ -299,15 +299,16 @@ The default v0.3 fee expressions reject external reservations and receipts with
 external messages without a matching allocation
 
 Chain entries, those with a concrete ``recipient``, carry the budget stored on
-chain. Consensus resolves only keys with a nonzero budget, so a chain entry whose
-``budget`` is zero is absent: the message falls through to the per-recipient
-``call_key`` wildcard, and with no wildcard left an internal message fails with
-``fee no_matching_allocation`` while an external one takes the unallocated path.
-Synthetic recipient wildcards match independently of ``budget``; zero there means
-an exhausted allocation. ``null`` removes the per-allocation cap while keeping the
-execution's fee buckets. Local consumption is tracked separately: an internal key
-exhausted by this execution's own emissions still wins and fails its budget check;
-it never falls through.
+chain. For internal messages, presence alone resolves a key: an entry whose
+``budget`` is zero still shadows broader keys and, when its phase matches, fails
+emission with ``out_of message_fee allocation_budget internal``, as does a key
+exhausted by this execution's own emissions, tracked separately; neither falls
+through. For external messages, consensus resolves only chain keys with a nonzero
+budget, so a zero-budget entry is absent: the message falls through to the
+per-recipient ``call_key`` wildcard, and with no wildcard left takes the
+unallocated path. Synthetic recipient wildcards match independently of ``budget``;
+zero there means an exhausted allocation. ``null`` removes the per-allocation cap
+while keeping the execution's fee buckets.
 
 The host must preserve every existing pinned key and must not add recipient
 wildcards to a pinned tree. An empty list restricts internal

docs/website/src/impl-spec/appendix/manager-api.yaml

@@ -889,7 +889,7 @@ components:
                 description: Call key bytes, or null for a wildcard.
               budget:
                 nullable: true
-                description: Stored chain budget, or the allowance of a synthetic recipient wildcard; null is uncapped. A zero-budget entry with a recipient is absent, as on chain.
+                description: Stored chain budget, or the allowance of a synthetic recipient wildcard; null is uncapped. A zero-budget entry with a recipient still matches internal messages and is absent for external ones, as on chain.
               on:
                 type: string
                 enum: [decided, finalized]

docs/website/src/spec/appendix/internal-constants.rst

@@ -134,6 +134,13 @@ web_render_min_space
 
 Value: ``134217728``
 
+.. _gvm-def-consts-value-top-limits-exec-prompt-min-space:
+
+exec_prompt_min_space
+~~~~~~~~~~~~~~~~~~~~~
+
+Value: ``134217728``
+
 .. _gvm-def-consts-value-top-limits-max-fds:
 
 max_fds