From 55f7137c6e065481d2f58fed1353df9a75914fc8 Mon Sep 17 00:00:00 2001 From: Jinwoo-H Date: Tue, 14 Jul 2026 10:07:55 -0400 Subject: [PATCH] test(ssh): make relay tar fixture portable Co-authored-by: Orca --- .../ssh-relay-node-tar-inspection.test.mjs | 17 +++++- ...github-release-implementation-checklist.md | 61 +++++++++++++++++-- 2 files changed, 70 insertions(+), 8 deletions(-) diff --git a/config/scripts/ssh-relay-node-tar-inspection.test.mjs b/config/scripts/ssh-relay-node-tar-inspection.test.mjs index 389bcfb9a53..1a8aaca240d 100644 --- a/config/scripts/ssh-relay-node-tar-inspection.test.mjs +++ b/config/scripts/ssh-relay-node-tar-inspection.test.mjs @@ -1,4 +1,4 @@ -import { chmod, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises' +import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises' import { tmpdir } from 'node:os' import { join } from 'node:path' import { Readable } from 'node:stream' @@ -87,8 +87,19 @@ async function validTarStream() { writeFile(join(directory, root, 'LICENSE'), 'Node license'), writeFile(join(directory, root, 'include', 'node', 'node.h'), 'Node header') ]) - await chmod(join(directory, root, 'bin', 'node'), 0o755) - return create({ cwd: directory, portable: true }, [root]) + return create( + { + cwd: directory, + portable: true, + // Why: NTFS cannot express POSIX execute bits, so the archive fixture must declare its mode. + onWriteEntry: (entry) => { + if (entry.path.replaceAll('\\', '/') === `${root}/bin/node` && entry.stat) { + entry.stat.mode = (entry.stat.mode & ~0o777) | 0o755 + } + } + }, + [root] + ) } function rawTar(entries) { diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md index b2cd77b26af..21993023e25 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md @@ -82,6 +82,10 @@ same change as the work it records. and therefore exercised a weaker system-ConPTY smoke. E-M3-WINDOWS-LOCAL-002 proves the corrected local tree-closure and smoke configuration contracts; native execution remains open and no Windows executable cell is complete. +- First Windows native run: E-M3-WINDOWS-CI-RED-002 failed before download/build on both Windows + architectures. One failure is a confirmed NTFS fixture-mode assumption; two import-time + `SyntaxError` failures remain unexplained until the corrected exact-head rerun. No Windows + executable evidence is claimed from the run. - Production behavior: unchanged; Orca embeds relay JavaScript and installs `node-pty` plus `@parcel/watcher` with remote npm. - New runtime assets published: none. @@ -95,11 +99,12 @@ same change as the work it records. runtime is an explicit per-target Beta opt-in under E-M1-ROLLOUT-DECISION-001. - Legacy fallback removal: not authorized. - Next required action: finish the final local audit of the bounded Windows runtime/ZIP builder and - verifier, commit the artifact-only implementation, and collect exact Windows x64/arm64 plus POSIX - regression evidence from draft-PR CI. A same-head/same-runner clean-rebuild identity oracle for - native build reproducibility remains a separate open gate. Keep cross-family remote - infrastructure, signing/trust, and measured legacy baseline gates open; do not introduce - publication, resolver, transfer, rollout, tuple enablement, or default behavior. + verifier, correct the Windows-only test failures from E-M3-WINDOWS-CI-RED-002, and collect exact + Windows x64/arm64 plus POSIX regression evidence from the corrected draft-PR head. A + same-head/same-runner clean-rebuild identity oracle for native build reproducibility remains a + separate open gate. Keep cross-family remote infrastructure, signing/trust, and measured legacy + baseline gates open; do not introduce publication, resolver, transfer, rollout, tuple enablement, + or default behavior. ## Non-Negotiable Invariants @@ -2520,6 +2525,52 @@ fragmentLinks=9`. - Follow-up: push this exact implementation head and record exact Windows x64/arm64 jobs, images, artifact IDs/hashes/sizes, build/verify/smoke durations, RSS, and any discriminating failure. +### E-M3-WINDOWS-CI-RED-002 — First Windows native jobs stopped at contract tests + +- Date: 2026-07-14 +- Commit SHA / PR: exact workflow head `539cd060e74386ba33bf1291c940b68fba9af13b` containing + implementation commit `922edb6ff28199b394f508731fd18a635bec49a0`; draft PR + [#8741](https://github.com/stablyai/orca/pull/8741) +- Run: [SSH Relay Runtime Artifacts 29338911990](https://github.com/stablyai/orca/actions/runs/29338911990) +- Native jobs: + - x64 job `87105197603`: requested `windows-2022`; resolved `win22` image + `20260706.237.1`, GitHub-hosted X64, Windows Server 2022 Datacenter build 20348, Node v24.18.0; + failed after 1m17s. + - arm64 job `87105197605`: requested `windows-11-arm`; resolved `win11-arm64` image + `20260706.102.1`, GitHub-hosted ARM64, Windows 10 Enterprise build 26200, Node v24.18.0; failed + after 3m37s. +- Remote and transport: none. Both jobs stopped before Node input download, native build, runtime + smoke, or artifact upload. +- Exact commands: + + ```sh + gh api repos/stablyai/orca/actions/jobs/87105197603/logs > /tmp/orca-win-x64-red.log + gh api repos/stablyai/orca/actions/jobs/87105197605/logs > /tmp/orca-win-arm64-red.log + rg -n "requested_runner=|resolved_image_os=|resolved_image_version=|runner_arch=|WindowsProductName|WindowsVersion|OsBuildNumber|source_commit=|FAIL|SyntaxError|Node archive is missing" \ + /tmp/orca-win-x64-red.log /tmp/orca-win-arm64-red.log + ``` + +- Result: FAIL as a discriminating pre-build gate on both architectures. Each run reported three + failed and four passed suites, with one failed and ten passed collected tests. The x64 test phase + took 1.26s; arm64 took 1.33s. `ssh-relay-node-tar-inspection.test.mjs` created its POSIX tar + fixture from an NTFS file and therefore lost the declared `bin/node` execute bit; the production + inspector correctly rejected it. `ssh-relay-node-release-verification.test.mjs` and + `ssh-relay-runtime-artifact.test.mjs` separately failed at import with only `SyntaxError: Invalid +or unexpected token`; the first logs did not identify a source location. +- Oracle proved: both requested hosted runner labels resolve to native Node 24 environments, MSVC + setup succeeds, Git for Windows supplies both required GPG tools, frozen source installation + succeeds, and the test command stops the artifact build before any download or upload. It also + discriminated one cross-platform fixture assumption. +- Does not prove: that the explicit-mode fixture correction is green on Windows; the cause of the + two import-time syntax errors; Node input download/signature verification; native compilation; + offline `node-gyp`; bundled Node/ConPTY/watcher execution; ZIP output; native trust; SSH; or any + enabled tuple. +- Checklist items satisfied: exact Windows runner-label resolution only. No Windows build, + executable, archive, or artifact cell is checked. +- Follow-up: declare `0o755` in the tar fixture's archive metadata instead of relying on NTFS, + rerun the same seven suites on both native architectures, and diagnose the two import failures if + they recur before allowing either job to download inputs. + ### E-M3-RUNTIME-LOCAL-001 — First target-native Linux arm64 runtime artifact - Date: 2026-07-14