starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-10-18 08:03:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: record SSH relay source pre-scan CI

Browse Source 
Co-authored-by: Orca <help@stably.ai>
This commit is contained in:
Jinwoo-H
2026-07-16 08:53:44 -04:00
co-authored by Orca
parent 724ed62955
commit 16a58a2345
2 changed files with 82 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md
+11 -3
View File
@@ -9,9 +9,9 @@ keeps commands, hashes, runner identities, timings, and failure details.
A checked box means the work has evidence in the detailed ledger. Design approval alone does not
complete a box.
Active checkpoint: **Milestone 6 / Work Package 5 bounded runtime transfer — order-independent
case-collision correction is locally green; commit and fresh exact-head all-six proof are next,
2026-07-15, Codex implementation owner.**
Active checkpoint: **Milestone 6 / Work Package 5 bounded runtime transfer — disconnected source
pre-scan CI is closed; audit only the bounded client streaming boundary next, 2026-07-15, Codex
implementation owner.**
`E-M6-SOURCE-PRESCAN-AUDIT-001` fixes the next local-only boundary: consume only the accepted source
tree plus one exact signal; assert its borrowed lease; boundedly enumerate and hash every real entry;
reject mutation, symlink/junction, special, missing/extra/colliding, mode/size/hash/aggregate drift;
@@ -34,6 +34,14 @@ must become order-independent and receive fresh all-six native/full-size proof.
order and adds a platform-neutral case proving rejection before child metadata access. It passes 17
purpose cases with one Linux-only local skip, 80 focused cases, 539 broad relay cases, typecheck,
full lint, and diff gates. Fresh exact-head Linux and all-six full-size proof remain required.
`E-M6-SOURCE-PRESCAN-CI-001` closes exact correction commit `724ed6295`: all six primary native jobs,
both Linux supplements, Windows x64 baseline, PR Checks, Golden E2E, and computer-use pass. Every
Linux client passes all 18 pre-scan cases; macOS/Windows retain only declared platform skips. Exact
full-size scans cover 34–42 files and 85,213,511–124,846,430 bytes in 145.534–724.753 ms with
81,920–3,239,936 incremental RSS bytes, all within budget. Windows arm64 retains only the declared
hosted build-26200 rejection against 26100 after full Node/PTY/watcher/tree proof. Live SSH,
streaming, remote staging/install, product/mode/fallback/default wiring, publication, and SignPath
remain absent.
`E-M6-SOURCE-TREE-CONTRACT-AUDIT-001` fixes a pure ready-acquisition → immutable descriptor
boundary: exact verified manifest/cache identity and signed limits, deterministic ASCII ordering,
client-native paths, borrowed live-lease assertion, and later shared use by pre-scan plus SFTP,
docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md
+71 -6
View File
@@ -8,8 +8,8 @@ work; keep exact commands, runner identities, hashes, metrics, and residual gaps
Date created: 2026-07-14<br>
Last updated: 2026-07-15<br>
Current phase: Milestone 6 / Work Package 5 bounded runtime transfer — **In progress — 2026-07-15, Codex implementation owner: order-independent collision correction is locally green; fresh exact-head native/full-size CI is next**. Keep every capability disconnected from every production/default SSH path. Real Apple/SignPath rehearsals remain an explicit late gate and are not on this package's critical path.<br>
Session checkpoint: **SOURCE PRE-SCAN COLLISION FIX LOCAL GREEN / COMMIT AND CI NEXT — 2026-07-15, Codex implementation owner** — `E-M6-SOURCE-PRESCAN-COLLISION-FIX-LOCAL-001` proves the Linux finding is corrected independently of filesystem enumeration order and without child metadata access. Commit and push the narrow correction, then require a fresh exact-head all-six native/full-size run. Do not open SSH channels, transfer/install bytes, add a product caller, settings/fallback wiring, tuple enablement, publication, or default behavior. Merging to `main` remains prohibited, SignPath is deferred, and legacy remains the production default.<br>
Current phase: Milestone 6 / Work Package 5 bounded runtime transfer — **In progress — 2026-07-15, Codex implementation owner: disconnected source pre-scan CI is closed; audit only the bounded client streaming boundary next**. Keep every capability disconnected from every production/default SSH path. Real Apple/SignPath rehearsals remain an explicit late gate and are not on this package's critical path.<br>
Session checkpoint: **SOURCE PRE-SCAN CLOSED / BOUNDED STREAM AUDIT NEXT — 2026-07-15, Codex implementation owner** — `E-M6-SOURCE-PRESCAN-CI-001` proves the corrected complete local scan on all six native clients and every exact full-size artifact. Audit the next transport-neutral bounded read/hash/progress boundary and record RED before implementation; do not open SSH channels or create remote staging in that package. Do not add a product caller, settings/fallback wiring, tuple enablement, publication, or default behavior. Merging to `main` remains prohibited, SignPath is deferred, and legacy remains the production default.<br>
Primary design: [SSH relay GitHub Release plan](./2026-07-14-ssh-relay-github-release-plan.html)<br>
Motivating issues: [#8450](https://github.com/stablyai/orca/issues/8450), [#1693](https://github.com/stablyai/orca/issues/1693)
@@ -1157,10 +1157,11 @@ Current behavior must not be assumed adequate for a much larger runtime:
- [x] Define one transport-neutral source-tree contract based on the verified manifest. Completed by
E-M6-SOURCE-TREE-CONTRACT-AUDIT-001, E-M6-SOURCE-TREE-CONTRACT-LOCAL-RED-001,
E-M6-SOURCE-TREE-CONTRACT-LOCAL-001, and E-M6-SOURCE-TREE-CONTRACT-CI-001.
- [ ] Pre-scan and reject local source mutation, symlinks, special files, extra files, and path
collisions before creating remote files. **In progress — 2026-07-15, Codex implementation
owner: audit complete under E-M6-SOURCE-PRESCAN-AUDIT-001; RED proof recorded under
E-M6-SOURCE-PRESCAN-LOCAL-RED-001.**
- [x] Pre-scan and reject local source mutation, symlinks, special files, extra files, and path
collisions before creating remote files. Completed by E-M6-SOURCE-PRESCAN-AUDIT-001,
E-M6-SOURCE-PRESCAN-LOCAL-RED-001, E-M6-SOURCE-PRESCAN-LOCAL-001,
E-M6-SOURCE-PRESCAN-CI-RED-001, E-M6-SOURCE-PRESCAN-COLLISION-FIX-LOCAL-001, and
E-M6-SOURCE-PRESCAN-CI-001.
- [ ] Stream files with bounded buffers; prohibit whole-tree memory materialization.
- [ ] Pass one AbortSignal through enumeration, channel creation, reads, writes, permission repair,
and remote cleanup.
@@ -16419,6 +16420,70 @@ src/main/ssh/ssh-relay-*.test.ts` — PASS, exit 0: 41 files passed, three skipp
every other native client, and require the complete exact-artifact scan metrics before closing the
package. The failed/cancelled run supplies no green cell.
### E-M6-SOURCE-PRESCAN-CI-001 — all-six native and exact full-size pre-scan gates pass
- Date/owner/head: 2026-07-15, Codex implementation owner; exact correction commit
`724ed6295551a63cd710b4da3749548ac787a0ad` on draft PR
[#8741](https://github.com/stablyai/orca/pull/8741).
- Native workflow: SSH Relay Runtime Artifacts run
[29498740510](https://github.com/stablyai/orca/actions/runs/29498740510). All six primary Node
24.18.0 jobs pass their contract, deterministic-build/smoke, full-size extraction/cache/pre-scan,
and evidence-upload steps: win32 x64
[87621972614](https://github.com/stablyai/orca/actions/runs/29498740510/job/87621972614),
win32 arm64
[87621972692](https://github.com/stablyai/orca/actions/runs/29498740510/job/87621972692),
Darwin x64
[87621972687](https://github.com/stablyai/orca/actions/runs/29498740510/job/87621972687),
Darwin arm64
[87621972703](https://github.com/stablyai/orca/actions/runs/29498740510/job/87621972703),
Linux x64
[87621972727](https://github.com/stablyai/orca/actions/runs/29498740510/job/87621972727), and
Linux arm64
[87621972772](https://github.com/stablyai/orca/actions/runs/29498740510/job/87621972772).
- Purpose suite: both Linux jobs pass all 18 source pre-scan cases, including the real
case-sensitive collision; each macOS job passes 17 with the Linux-only case skipped; each Windows
job passes 15 with three declared POSIX/Linux-only skips. Overall native contract totals are
707 passed / one skipped on Linux, 706 passed / two skipped on macOS, and 695 passed / 17 skipped
on Windows. The suite takes 1.415–7.117 seconds across the six clients.
- Exact full-size metrics, reported by the cache measurement JSON after hashing the complete signed
tree while its lease is held:
- Linux x64: 34 files / 124,846,430 bytes; scan 145.534 ms / 131,072 incremental RSS bytes.
- Linux arm64: 34 files / 122,865,324 bytes; scan 155.329 ms / 262,144 incremental RSS bytes.
- Darwin x64: 35 files / 124,316,655 bytes; scan 724.753 ms / 139,264 incremental RSS bytes.
- Darwin arm64: 35 files / 122,027,869 bytes; scan 161.363 ms / 81,920 incremental RSS bytes.
- Windows x64: 42 files / 96,527,161 bytes; scan 194.877 ms / 3,239,936 incremental RSS bytes.
- Windows arm64: 42 files / 85,213,511 bytes; scan 375.761 ms / 2,289,664 incremental RSS bytes.
Every cell is below the 120-second and 80-MiB scan budgets; observed ranges are 145.534–724.753
ms and 81,920–3,239,936 incremental RSS bytes. Cold/warm cache, extraction, retention, and eviction
also remain within their existing budgets.
- Baselines: Linux x64 supplement
[87623008534](https://github.com/stablyai/orca/actions/runs/29498740510/job/87623008534) and Linux
arm64 supplement
[87623008618](https://github.com/stablyai/orca/actions/runs/29498740510/job/87623008618) pass.
Windows x64 oldest baseline
[87624256480](https://github.com/stablyai/orca/actions/runs/29498740510/job/87624256480) passes.
Windows arm64 oldest baseline
[87624256574](https://github.com/stablyai/orca/actions/runs/29498740510/job/87624256574) has only
the declared hosted-image build rejection: observed 26200 versus required 26100. Before that
rejection it verifies the complete 60-entry / 42-file / 85,213,511-byte tree, Node 24.18.0 ABI
137, PTY exit 23 and resize 37x101, five watcher events, two-second resource settlement, and smoke
5,898.6823 ms / 49,664,000 RSS; complete verification is 8,024.2681 ms. The workflow is therefore
red only by the already-declared runner-floor evidence gap, not the source pre-scan package.
- Adjacent exact-head workflows pass: PR Checks run
[29498740486](https://github.com/stablyai/orca/actions/runs/29498740486), verify job
[87621971980](https://github.com/stablyai/orca/actions/runs/29498740486/job/87621971980); Golden E2E
run [29498740519](https://github.com/stablyai/orca/actions/runs/29498740519), Linux job
[87621971899](https://github.com/stablyai/orca/actions/runs/29498740519/job/87621971899) and macOS job
[87621971841](https://github.com/stablyai/orca/actions/runs/29498740519/job/87621971841);
computer-use run [29498740483](https://github.com/stablyai/orca/actions/runs/29498740483), Windows
job [87621971772](https://github.com/stablyai/orca/actions/runs/29498740483/job/87621971772) and
Ubuntu job [87621971790](https://github.com/stablyai/orca/actions/runs/29498740483/job/87621971790).
- Boundary/residual gaps: GitHub clients prove native filesystem and artifact contracts, not live
SSH, SFTP or system-SSH channel behavior, remote staging/install, or post-scan transfer races. The
scanned-tree type still has no non-test `src/main` importer. Bounded client streaming, every remote
transport, product/settings/fallback/tuple/publication/default path, and SignPath remain open.
Legacy remains the sole production/default path and every tuple remains disabled.
## Accepted Gaps
No product gap is accepted merely because it appears in this list. Each entry requires explicit