From 5ae2a505cbb0d9744ebd4232cfc131747fdead54 Mon Sep 17 00:00:00 2001 From: Jinwoo-H Date: Wed, 15 Jul 2026 15:02:36 -0400 Subject: [PATCH] docs: checkpoint relay offline artifact selection Co-authored-by: Orca --- ...elease-implementation-checklist-summary.md | 26 +++-- ...github-release-implementation-checklist.md | 108 +++++++++++++++--- 2 files changed, 105 insertions(+), 29 deletions(-) diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md index 2dc16010375..f24739ef940 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md @@ -10,18 +10,17 @@ A checked box means the work has evidence in the detailed ledger. Design approva complete a box. Active checkpoint: **Milestone 5 / Work Package 4 offline artifact selection — -in progress, 2026-07-15, Codex implementation owner.** Exact-head run -[29440806947](https://github.com/stablyai/orca/actions/runs/29440806947) at `8c925c249` passes the -10-test draft-release composition contract and full runtime construction/execution on all six -target-native Node 24 jobs under `E-M4-DRAFT-RELEASE-COMPOSITION-CI-001`. PR Checks and Golden E2E -are green; the artifact workflow is red only for the retained Windows ARM build-26200-versus-26100 -floor mismatch after successful runtime smoke. A real draft release write/read-back remains blocked -because it is not PR-contained and the production signer/environment are unprovisioned; the safe -default is no write. Next, begin the purpose-named offline tuple/content/immutable-URL selector RED -without download, cache, desktop consumer, or mode wiring. Production keys/environment/seed, -publication, desktop/default consumers, SSH transfer/install, tuple enablement, and merge to `main` -remain disconnected. Current pushed branch head is `8c925c249`; the implementation owner is authorized to drive -commits, pushes, CI, and PR-contained rehearsals end to end without merging. +local GREEN; exact-head native CI pending, 2026-07-15, Codex implementation owner.** The selector +now accepts only a signature-verified recursively immutable manifest and returns its exact offline +tuple, content ID, archive metadata, and tag-qualified direct URL. Focused 27-test, adjacent 91-test, +broad 307-test, typecheck, lint, formatting, and scope gates pass under +`E-M5-OFFLINE-SELECTION-LOCAL-RED-001` and `E-M5-OFFLINE-SELECTION-LOCAL-001`. Next, commit and push +this isolated package with the pending Milestone 4 evidence checkpoint, then require all six native +Node 24 jobs, PR Checks, and Golden E2E at one exact head. Download, cache, desktop consumers, SSH +transfer/install, mode wiring, tuple enablement, publication, production keys/environment/seed, and +merge to `main` remain disconnected. Current pushed branch head is `8c925c249`; the implementation +owner is authorized to drive commits, pushes, CI, and PR-contained rehearsals end to end without +merging. ## Safety status @@ -296,6 +295,9 @@ commits, pushes, CI, and PR-contained rehearsals end to end without merging. ### WP4 — Desktop resolver and verified cache - [ ] Select tuples offline from the embedded manifest and resolve immutable direct asset URLs. + The verified immutable selection and URL boundary is locally green under + `E-M5-OFFLINE-SELECTION-LOCAL-001`; exact-head all-six native CI and the actual packaged + embedded-manifest loader remain open. - [ ] Stream bounded downloads; verify signature, size, archive hash, and extracted tree. - [ ] Add exclusive staging, atomic publication, quarantine, locking, and the 2 GiB cache policy. - [ ] Prove verified cached bytes can be transferred while the client is offline. diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md index de8661d346b..ccfc4a9d7b9 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md @@ -8,7 +8,7 @@ work; keep exact commands, runner identities, hashes, metrics, and residual gaps Date created: 2026-07-14
Last updated: 2026-07-15
-Current phase: Milestone 5 / Work Package 4 offline artifact selection — **In progress — 2026-07-15, Codex implementation owner**. Milestone 4 disconnected upload/recovery/materialization/execution composition is closed locally and on all six exact-head native Node 24 jobs under E-M4-DRAFT-RELEASE-COMPOSITION-LOCAL-RED-001, E-M4-DRAFT-RELEASE-COMPOSITION-LOCAL-001, and E-M4-DRAFT-RELEASE-COMPOSITION-CI-001. A real draft release write/read-back is not PR-contained and remains blocked by the unprovisioned production signer/environment; safe default is no write. Begin only offline tuple/content/immutable-URL selection contracts; do not add download, cache, desktop consumer, SSH transfer, tuple enablement, mode wiring, or default behavior.
+Current phase: Milestone 5 / Work Package 4 offline artifact selection — **Local GREEN; exact-head native CI pending — 2026-07-15, Codex implementation owner**. The signature-verified immutable-manifest boundary and exact offline tuple/content/archive/URL result pass local focused, adjacent, broad, static, and scope gates under E-M5-OFFLINE-SELECTION-LOCAL-RED-001 and E-M5-OFFLINE-SELECTION-LOCAL-001. No networking, cache, desktop consumer, SSH transfer, tuple enablement, mode wiring, or default behavior is connected. Commit and push the isolated package with the pending Milestone 4 evidence checkpoint, then require all-six exact-head native Node 24 CI before starting download/cache work.
Session checkpoint: **In progress — 2026-07-15, Codex implementation owner** — exact pushed head `8c925c24990ac93f6d2dd8de2081a50a74f30d97` passes the 10-test draft-release composition suite and full runtime construction/execution on all six target-native jobs in run 29440806947 under E-M4-DRAFT-RELEASE-COMPOSITION-CI-001. PR Checks 29440804969 and both Golden E2E jobs in 29440804978 are green. Both Linux supplements and Windows x64 floor pass. Windows arm64 floor smoke passes in 6,178.8338ms with 49,881,088-byte RSS; the floor gate then correctly rejects hosted build 26200 versus required 26100. The user authorizes end-to-end commits, pushes, draft-PR updates, CI runs/reruns, and PR-contained rehearsals, but not merging to `main`. There is no real release write, publication caller, desktop consumer, SSH transfer/install, tuple enablement, or production/default behavior change. No accepted production key, protected environment/seed, native-signing trust proof, publication path, or tuple enablement is connected. Legacy remains the production default.
Primary design: [SSH relay GitHub Release plan](./2026-07-14-ssh-relay-github-release-plan.html)
Motivating issues: [#8450](https://github.com/stablyai/orca/issues/8450), [#1693](https://github.com/stablyai/orca/issues/1693) @@ -1035,9 +1035,13 @@ Suggested concrete modules: - [ ] Prefer `getconf GNU_LIBC_VERSION` when present; parse only output following Orca’s marker. - [ ] Detect musl through marked `ldd --version` output and known loader paths without treating arbitrary startup text as evidence. -- [ ] Validate required libc/libstdc++/kernel/OS versions against manifest constraints. -- [ ] Treat absent, ambiguous, conflicting, or unparseable results as unknown and choose proven +- [x] Validate required libc/libstdc++/kernel/OS versions against manifest constraints. + E-M5-OFFLINE-SELECTION-LOCAL-001 validates Linux kernel/glibc/libstdc++/GLIBCXX, macOS, and + Windows build/OpenSSH/PowerShell/.NET exact minima from a signature-verified manifest. +- [x] Treat absent, ambiguous, conflicting, or unparseable results as unknown and choose proven legacy behavior in `auto` mode. + E-M5-OFFLINE-SELECTION-LOCAL-001 pins classified unavailable results without connecting a + consumer or changing the legacy default. - [ ] Cover GNU coreutils, BusyBox, Alpine, containers, old glibc, Rosetta, Windows, macOS, startup noise, missing commands, localization, cancellation, and `MaxSessions=1`. @@ -1046,8 +1050,12 @@ Suggested concrete modules: - [ ] Load the embedded manifest for official builds and verify its signature before trusting fields. - [ ] Verify the manifest-authenticated target-native attestation and exact byte hashes portably; do not assume a macOS client can run Authenticode tooling or a Windows client can run `codesign`. -- [ ] Resolve the expected tuple and content ID while fully offline. -- [ ] Construct the exact `/releases/download//` URL without an API lookup. +- [x] Resolve the expected tuple and content ID while fully offline. + E-M5-OFFLINE-SELECTION-LOCAL-001 accepts only the branded immutable result of accepted-key + signature verification and returns its exact tuple/content/archive identity. +- [x] Construct the exact `/releases/download//` URL without an API lookup. + E-M5-OFFLINE-SELECTION-LOCAL-001 derives the tag-qualified direct URL from authenticated + fields and proves that no `latest` lookup is present. - [ ] Reject redirects that violate the approved GitHub release-asset origin policy. - [ ] Ensure authorization, cookies, proxy credentials, and custom headers do not leak across redirect origins. @@ -11904,6 +11912,72 @@ config/vitest.config.ts config/scripts/ssh-relay-runtime-draft-release-verificat - Follow-up: checkpoint this evidence. A real release write is not PR-contained and remains blocked; retain no-write as the safe default and begin the independent Milestone 5 offline selector RED. +### E-M5-OFFLINE-SELECTION-LOCAL-RED-001 — Verified offline selection boundary was incomplete + +- Date: 2026-07-15 +- Owner: Codex implementation owner +- Source: uncommitted RED atop local evidence commit `2097a40dd`; exact pushed base + `8c925c24990ac93f6d2dd8de2081a50a74f30d97`; draft PR #8741. Local runner is macOS 26.2 build + 25C56 arm64, Node v26.0.0, and pnpm 10.24.0. No network request or external write occurred. +- Command: `/usr/bin/time -l pnpm exec vitest run src/main/ssh/ssh-relay-artifact-selector.test.ts + src/main/ssh/ssh-relay-manifest-signature.test.ts` — expected FAIL, 2 files / 26 tests, 7 failed + and 19 passed in 430ms Vitest / 1.31s wall, maximum RSS 136,265,728 bytes, zero swaps. +- Contract failures: a compatible selection returned only tuple ID/tuple and omitted the exact + content ID, release tag, authenticated archive metadata, and direct release URL. A verified + manifest remained mutable after signature acceptance. Requiring verification also rejected five + old Windows/macOS selector shortcuts because they did not represent schema-consistent native + closures; these were test-fixture defects, not product compatibility failures. +- Contract pinned by the RED: accept only the signature verifier's branded result; make that parsed + result recursively immutable; select an exact tuple/content/archive from authenticated fields; + construct only the exact tag-qualified GitHub release URL; retain classified unavailable results + for unknown/incompatible evidence. Use complete internally consistent signed Windows and macOS + fixtures rather than bypassing the schema. +- Does not prove: implementation, GREEN, production keys, embedded desktop loading, networking, + redirect policy, download/cache/extraction, SSH behavior, live hosts, performance, or any enabled + tuple. + +### E-M5-OFFLINE-SELECTION-LOCAL-001 — Verified immutable offline selection passes locally + +- Date: 2026-07-15 +- Owner: Codex implementation owner +- Source: uncommitted implementation atop local evidence commit `2097a40dd`; exact pushed base + `8c925c24990ac93f6d2dd8de2081a50a74f30d97`; draft PR #8741. Local runner is macOS 26.2 build + 25C56 arm64, Node v26.0.0, and pnpm 10.24.0. All accepted keys and manifests are deterministic + test fixtures; no GitHub request or external write occurs. +- Focused command: `/usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts + --maxWorkers=1 src/main/ssh/ssh-relay-artifact-selector.test.ts + src/main/ssh/ssh-relay-manifest-signature.test.ts` — PASS, 2 files / 27 tests in 1.42s Vitest / + 3.04s wall; maximum RSS 131,923,968 bytes and zero swaps. +- Adjacent command: `/usr/bin/time -l pnpm exec vitest run --config config/vitest.config.ts + --maxWorkers=1` with artifact schema, signature, release asset, selector, runtime identity, manifest + aggregate, aggregate command, and signing-handoff suites — PASS, 8 files / 91 tests in 3.60s + Vitest / 4.47s wall; maximum RSS 189,333,504 bytes and zero swaps. +- Broad command: `/usr/bin/time -l sh -c "rg --files config/scripts | rg + '/ssh-relay.*[.]test[.]mjs$' | xargs pnpm exec vitest run --config config/vitest.config.ts + --maxWorkers=1"` — PASS, 56 files / 307 tests in 16.83s Vitest / 17.93s wall; maximum RSS + 189,857,792 bytes and zero swaps. +- Static gates: `/usr/bin/time -l pnpm typecheck` passes in 2.46s wall with 1,252,245,504-byte + maximum RSS. `/usr/bin/time -l pnpm lint` passes in 26.98s wall with 2,021,146,624-byte maximum + RSS; all 41 reliability gates and the 355-entry max-lines ratchet pass with the existing 26 + unrelated warnings. Focused `oxfmt --check`, localization checks, `git diff --check`, and protected + resolver/required-asset zero-diff checks pass. +- Oracle proved: only `verifySshRelayArtifactManifest` can construct the branded selector input; + accepted-key signature verification returns a recursively frozen parsed manifest. Selection uses + authenticated build tag, exact tuple/content ID, archive size/hash/count identity, and constructs + `https://github.com/stablyai/orca/releases/download//` without `latest`, API, or + freshness input. Exact Linux, Windows, and macOS minima plus classified unknown/incompatible/ + translated/ambiguous behavior remain pinned. Complete schema-valid signed native fixtures replace + the old selector-only shortcuts. +- Consumer-disconnection oracle: no embedded-manifest loader, accepted production key, Electron + networking, redirect, download/cache/extraction, desktop consumer, SSH transfer/install, mode, + tuple enablement, or default behavior is added. Legacy remains the only production behavior. +- Does not prove: Node 24/native-runner portability, real production manifest keys or packaged + embedding, direct-URL network behavior, proxy/certificate/redirect safety, download/cache, live + SSH hosts, performance against legacy, or any enabled tuple. +- Follow-up: commit and push this isolated package together with evidence commit `2097a40dd`, then + require focused and adjacent contracts on all six exact-head native Node 24 jobs plus normal PR + checks before starting the disconnected download boundary. + ## Accepted Gaps No product gap is accepted merely because it appears in this list. Each entry requires explicit @@ -11962,18 +12036,18 @@ The project is not complete until every applicable item below is checked with ev ## Next Required Action -Begin a purpose-named Milestone 5 offline artifact-selection RED. It must accept only an already- -verified immutable embedded manifest, map the existing detected relay OS/architecture plus explicit -libc classification to one exact tuple/content ID, and construct the exact immutable -`/releases/download//` URL without an API/latest/freshness lookup. Unknown, ambiguous, -unsupported, musl, or inconsistent inputs must return a classified unavailable result suitable for -the still-disconnected legacy path; manifest/identity drift must fail closed. Do not add signature -key policy, networking, redirect handling, download/cache, desktop call sites, SSH transfer/install, -mode wiring, tuple enablement, or default behavior in this package. Keep `ORCA_RELAY_PATH`, existing -desktop required-assets behavior, and detached-signature byte encoding unchanged. -Keep Windows arm64 build 26100, macOS 13.5, Linux kernel 4.18, release-cut, desktop builds, -publication, and every tuple separately gated. Do not merge to `main`; retain every -production/default gate. +Commit and push the isolated Milestone 5 offline-selection package together with local evidence +commit `2097a40dd`. Require the focused selector/signature contract and adjacent manifest consumers +to pass on Linux x64/arm64, macOS x64/arm64, and Windows x64/arm64 at the exact pushed head, plus +normal PR Checks and Golden E2E. Record job IDs, runner images, timings, results, and the separately +gated Windows arm64 floor outcome before closing the package. + +Only after that evidence is complete, begin a purpose-named disconnected download-boundary RED for +bounded streaming, cancellation, archive hash/size, approved GitHub redirect origins, and credential/ +header stripping. Do not add a desktop call site, cache publication, extraction, SSH transfer/install, +mode wiring, tuple enablement, or default behavior. Keep `ORCA_RELAY_PATH`, existing desktop required- +assets behavior, detached-signature byte encoding, Windows arm64 build 26100, macOS 13.5, Linux +kernel 4.18, release-cut, desktop builds, publication, and every tuple separately gated. Cross-family Layer B targets, the protected manifest-signing environment, oldest-baseline/native- trust cells, and the paired legacy performance baseline remain release/default-path blockers. No