From 1e3356cc6fa4e4090935184879b5a77db94ad2e5 Mon Sep 17 00:00:00 2001 From: Jinwoo-H Date: Wed, 15 Jul 2026 15:27:22 -0400 Subject: [PATCH] docs: record relay selector native CI Co-authored-by: Orca --- ...elease-implementation-checklist-summary.md | 28 ++++----- ...github-release-implementation-checklist.md | 61 ++++++++++++++++--- 2 files changed, 66 insertions(+), 23 deletions(-) diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md index 691787705f1..83bc0cc61c4 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md @@ -9,18 +9,18 @@ keeps commands, hashes, runner identities, timings, and failure details. A checked box means the work has evidence in the detailed ledger. Design approval alone does not complete a box. -Active checkpoint: **Milestone 5 / Work Package 4 offline artifact selection — -native CI wiring correction locally GREEN; replacement exact-head CI pending, 2026-07-15, Codex -implementation owner.** The verified immutable selector is pushed at `5ae2a505c`, but a post-push -audit proved the native artifact jobs did not invoke its portable source suites. The workflow now -pins artifact schema, signature, release asset, selector, and runtime identity tests in both POSIX -and Windows job families under `E-M5-OFFLINE-SELECTION-CI-WIRING-RED-001` and -`E-M5-OFFLINE-SELECTION-CI-WIRING-LOCAL-001`. Runs started for `5ae2a505c` are intermediate only. -Next, push this test-wiring correction and require replacement all-six native Node 24 jobs, PR -Checks, and Golden E2E at one exact head. Download, cache, desktop consumers, SSH transfer/install, -mode wiring, tuple enablement, publication, production keys/environment/seed, and merge to `main` -remain disconnected. The implementation owner is authorized to drive commits, pushes, CI, and -PR-contained rehearsals end to end without merging. +Active checkpoint: **Milestone 5 / Work Package 4 desktop download boundary — offline selection +closed; begin disconnected bounded-download RED, 2026-07-15, Codex implementation owner.** Exact +head `3be4e6867` passes verified immutable tuple/content/archive/URL selection and full runtime +construction on all six native Node 24 jobs in +[run 29443291349](https://github.com/stablyai/orca/actions/runs/29443291349) under +`E-M5-OFFLINE-SELECTION-CI-001`. PR Checks and both Golden E2E jobs are green. The artifact run is +red only after Windows arm64 successfully smokes the runtime and rejects hosted build 26200 against +the retained 26100 floor. Next, implement only a relay-specific bounded Electron download contract; +cache publication/extraction, desktop consumers, SSH transfer/install, mode wiring, tuple enablement, +publication, production keys/environment/seed, and merge to `main` remain disconnected. The +implementation owner is authorized to drive commits, pushes, CI, and PR-contained rehearsals end to +end without merging. ## Safety status @@ -298,8 +298,8 @@ PR-contained rehearsals end to end without merging. The verified immutable selection and URL boundary is locally green under `E-M5-OFFLINE-SELECTION-LOCAL-001`. The first post-push audit found that native jobs omitted these source suites; both job families are now locally pinned under - `E-M5-OFFLINE-SELECTION-CI-WIRING-LOCAL-001`. Replacement exact-head all-six native CI and the - actual packaged embedded-manifest loader remain open. + `E-M5-OFFLINE-SELECTION-CI-WIRING-LOCAL-001`, and exact-head all-six native proof is closed by + `E-M5-OFFLINE-SELECTION-CI-001`. The actual packaged embedded-manifest loader remains open. - [ ] Stream bounded downloads; verify signature, size, archive hash, and extracted tree. - [ ] Add exclusive staging, atomic publication, quarantine, locking, and the 2 GiB cache policy. - [ ] Prove verified cached bytes can be transferred while the client is offline. diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md index 83795a4d3e2..bf2af1eefae 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md @@ -8,8 +8,8 @@ work; keep exact commands, runner identities, hashes, metrics, and residual gaps Date created: 2026-07-14
Last updated: 2026-07-15
-Current phase: Milestone 5 / Work Package 4 offline artifact selection — **Native CI wiring correction locally GREEN; replacement exact-head CI pending — 2026-07-15, Codex implementation owner**. The selector implementation is pushed at `5ae2a505c`, but audit E-M5-OFFLINE-SELECTION-CI-WIRING-RED-001 proved the native workflow did not invoke its portable source suites. E-M5-OFFLINE-SELECTION-CI-WIRING-LOCAL-001 now pins all five artifact/manifest/selector suites in both POSIX and Windows job families. Commit and push the correction, then require replacement all-six exact-head Node 24 evidence; runs already started for `5ae2a505c` are intermediate only. No networking, cache, desktop consumer, SSH transfer, tuple enablement, mode wiring, or default behavior is connected.
-Session checkpoint: **In progress — 2026-07-15, Codex implementation owner** — exact pushed head `8c925c24990ac93f6d2dd8de2081a50a74f30d97` passes the 10-test draft-release composition suite and full runtime construction/execution on all six target-native jobs in run 29440806947 under E-M4-DRAFT-RELEASE-COMPOSITION-CI-001. PR Checks 29440804969 and both Golden E2E jobs in 29440804978 are green. Both Linux supplements and Windows x64 floor pass. Windows arm64 floor smoke passes in 6,178.8338ms with 49,881,088-byte RSS; the floor gate then correctly rejects hosted build 26200 versus required 26100. The user authorizes end-to-end commits, pushes, draft-PR updates, CI runs/reruns, and PR-contained rehearsals, but not merging to `main`. There is no real release write, publication caller, desktop consumer, SSH transfer/install, tuple enablement, or production/default behavior change. No accepted production key, protected environment/seed, native-signing trust proof, publication path, or tuple enablement is connected. Legacy remains the production default.
+Current phase: Milestone 5 / Work Package 4 desktop download boundary — **Offline selection closed; begin disconnected bounded-download RED — 2026-07-15, Codex implementation owner**. The verified immutable offline tuple/content/archive/URL selector is closed locally and on all six exact-head native Node 24 jobs under E-M5-OFFLINE-SELECTION-LOCAL-001 and E-M5-OFFLINE-SELECTION-CI-001. Begin only relay-specific Electron download contracts for bounded streaming, cancellation, exact size/hash, approved GitHub redirects, and credential/header stripping. Do not add cache publication/extraction, desktop call sites, SSH transfer/install, tuple enablement, mode wiring, or default behavior.
+Session checkpoint: **In progress — 2026-07-15, Codex implementation owner** — exact pushed head `3be4e68679f6f235165c8784eca61576dc2fd828` passes the portable artifact/manifest/selector suites and full runtime construction/execution on all six target-native jobs in run 29443291349 under E-M5-OFFLINE-SELECTION-CI-001. PR Checks 29443290994 and both Golden E2E jobs in 29443291091 are green. Both Linux supplements and Windows x64 floor pass. Windows arm64 floor smoke passes in 5,982.393ms with 48,451,584-byte RSS; the floor gate then correctly rejects hosted build 26200 versus required 26100. The user authorizes end-to-end commits, pushes, draft-PR updates, CI runs/reruns, and PR-contained rehearsals, but not merging to `main`. There is no real release write, publication caller, desktop consumer, SSH transfer/install, tuple enablement, or production/default behavior change. No accepted production key, protected environment/seed, native-signing trust proof, publication path, or tuple enablement is connected. Legacy remains the production default.
Primary design: [SSH relay GitHub Release plan](./2026-07-14-ssh-relay-github-release-plan.html)
Motivating issues: [#8450](https://github.com/stablyai/orca/issues/8450), [#1693](https://github.com/stablyai/orca/issues/1693) @@ -12021,6 +12021,55 @@ config/vitest.config.ts config/scripts/ssh-relay-runtime-draft-release-verificat - Follow-up: commit and push the workflow/test/evidence correction, then collect replacement all-six native Node 24 jobs plus PR Checks and Golden E2E. +### E-M5-OFFLINE-SELECTION-CI-001 — Verified offline selection passes all six native Node 24 jobs + +- Date: 2026-07-15 +- Owner: Codex implementation owner +- Source: exact pushed head `3be4e68679f6f235165c8784eca61576dc2fd828`; selector + implementation commit `7b8c7669a`, native test wiring commit `d1dda17c8`; draft PR #8741. +- Workflow: [SSH Relay Runtime Artifacts run 29443291349](https://github.com/stablyai/orca/actions/runs/29443291349), + 19:07:08Z–19:24:08Z. The aggregate conclusion is the expected failure only because the separate + Windows arm64 floor job rejects hosted build 26200 after successful runtime verification/smoke. +- Native jobs and combined portable/release contract suites: + - Linux x64 job 87447445800, runner label/image `ubuntu-24.04`, image version + `20260705.232.1`, PASS in 4m06s; 60 files / 377 tests in 9.63s. + - Linux arm64 job 87447445787, `ubuntu-24.04-arm`, image version `20260706.52.2`, PASS in + 4m19s; 60 files / 377 tests in 7.32s. + - Darwin x64 job 87447445754, runner label `macos-15-intel`, image `macos-15` version + `20260629.0276.1`, PASS in 7m16s; 60 files / 377 tests in 32.57s. + - Darwin arm64 job 87447445790, runner label `macos-15`, image `macos-15-arm64` version + `20260706.0213.1`, PASS in 3m32s; 60 files / 377 tests in 14.35s. + - Windows x64 job 87447445786, `windows-2022`, image version `20260714.244.1`, PASS in + 6m47s; 61 files / 371 passed + 10 platform skips of 381 in 22.26s. + - Windows arm64 job 87447445745, `windows-11-arm`, image version `20260714.109.1`, PASS in + 10m48s; 61 files / 371 passed + 10 platform skips of 381 in 18.67s. +- Downstream/adjacent evidence: Linux x64 supplement job 87449112159 and Linux arm64 supplement + job 87449112031 pass. Windows x64 floor job 87449773555 passes. Windows arm64 floor job + 87449773588 uses image `windows-11-arm64` `20260706.102.1`; the 60-entry/42-file/85,213,511-byte + runtime passes Node v24.18.0, PTY, watcher, resource-settlement, full-tree verification, and smoke + in 5,982.393ms with 48,451,584-byte RSS; the complete verifier takes 8,030.9838ms before the gate + rejects observed build 26200 versus required build 26100. +- PR Checks [run 29443290994](https://github.com/stablyai/orca/actions/runs/29443290994), job + 87447364904, passes in 10m10s. Golden E2E + [run 29443291091](https://github.com/stablyai/orca/actions/runs/29443291091) passes Linux job + 87447365115 in 4m27s and macOS job 87447365196 in 5m38s. +- Oracle proved: artifact schema, accepted-key signature verification/recursive immutability, exact + release-asset identity, offline compatibility selection, and runtime identity contracts execute + consistently under Node 24 on Linux, macOS, and Windows x64/arm64. Every job returns the exact + authenticated tuple/content/archive/tag-qualified URL or a classified unavailable result, without + API/latest/freshness input. Full artifact build, native smoke, equality, and adjacent product gates + remain green. +- Consumer-disconnection oracle: there is no production accepted key, embedded-manifest loader, + Electron network call, redirect/download/cache/extraction, desktop consumer, SSH transfer/install, + mode, tuple enablement, or default behavior. No runtime artifact is published. Legacy remains the + only production path. +- Does not prove: production manifest keys/packaged embedding, live direct-URL/redirect/proxy/ + certificate behavior, download/cache, oldest Windows arm64/macOS/Linux-kernel floors, native + signing/trust, live SSH hosts, performance against legacy, or any enabled tuple. +- Follow-up: checkpoint this evidence, update PR/worktree status, then begin only the disconnected + bounded relay-download RED. Preserve every cache, consumer, SSH, tuple, publication, and default + disconnection. + ## Accepted Gaps No product gap is accepted merely because it appears in this list. Each entry requires explicit @@ -12079,13 +12128,7 @@ The project is not complete until every applicable item below is checked with ev ## Next Required Action -Commit and push the native CI wiring correction and its evidence checkpoint. Require the five -portable artifact/manifest/selector suites to pass inside the Linux x64/arm64, macOS x64/arm64, and -Windows x64/arm64 artifact jobs at the replacement exact head, plus normal PR Checks and Golden E2E. -Runs for `5ae2a505c` are intermediate only. Record replacement job IDs, runner images, timings, -results, and the separately gated Windows arm64 floor outcome before closing the package. - -Only after that evidence is complete, begin a purpose-named disconnected download-boundary RED for +Begin a purpose-named disconnected download-boundary RED for bounded streaming, cancellation, archive hash/size, approved GitHub redirect origins, and credential/ header stripping. Do not add a desktop call site, cache publication, extraction, SSH transfer/install, mode wiring, tuple enablement, or default behavior. Keep `ORCA_RELAY_PATH`, existing desktop required-