diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md index 5a40324b38c..8fbc377e255 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md @@ -1,171 +1,131 @@ -# SSH Relay Runtime Distribution — Implementation Checklist +# SSH Relay Runtime Distribution — Short Implementation Checklist Last updated: 2026-07-14 -This is the human-readable project tracker. The +Use this file to track the project. The [detailed evidence ledger](./2026-07-14-ssh-relay-github-release-implementation-checklist.md) -contains exact commands, runner identities, artifact hashes, metrics, and residual gaps. +keeps commands, hashes, runner identities, timings, and failure details. -A checked box here means the implementation or validation has exact evidence in that ledger. -Approved design decisions are listed separately and are not presented as implemented work. +A checked box means the work has evidence in the detailed ledger. Design approval alone does not +complete a box. -## Current state +## Safety status -- Existing SSH relay behavior remains the default for every target. -- The bundled runtime path is not connected to production and no tuple is enabled. -- The future bundled path is a per-SSH-target Beta option, off by default. -- No runtime artifact has been published to a GitHub Release. -- Latest native proof: [GitHub Actions run 29367559831](https://github.com/stablyai/orca/actions/runs/29367559831) - passed clean-build equality and runtime smoke on Linux x64/arm64, macOS x64/arm64, and Windows - x64/arm64. -- Active work package: exact runtime closure is green on all six native runner families. The first - metadata run failed closed before Windows build/upload because its linker-version probe was - silent and direct inspection found versionless Linux strip records. The bounded probe and reviewed - Windows 19045/26100 build-floor corrections fixed Linux, but linker help remained silent on both - Windows runners. Reading the hashed linker's PE file version is locally green and awaits a fresh - all-six native proof. Archive safety, oldest-baseline execution, and native trust remain open. +- [x] Existing SSH relay installation remains the default for every target. +- [x] The future bundled runtime is a per-target Beta option, off by default. +- [x] Missing, old, imported, unknown, or malformed settings select legacy behavior. +- [x] No bundled tuple is enabled and no runtime artifact is published. +- [x] Integrity, security, and corruption failures are designed to fail closed, not fall back. +- [x] Legacy removal or a default-on change requires a separate reviewed decision. -## Locked rollout decisions +## Active work -- Legacy behavior remains the persisted and effective default. -- The Beta choice is per SSH target, off by default, and shown on target add/edit surfaces. -- Missing, old, imported, unknown, or malformed settings resolve to legacy. -- A mode change applies only on the next connection or explicit reconnect. -- Legacy remains available; removal or narrowing requires a separate review. -- Only availability/compatibility failures may fall back automatically. Integrity, security, and - corruption failures fail closed. +- [ ] **WP2 — Finish target-native artifact metadata and provenance.** + - Four POSIX GitHub runner cells pass build, smoke, equality, and metadata upload. + - Windows x64/arm64 currently fail closed while reading the linker PE file version in + [run 29369925932](https://github.com/stablyai/orca/actions/runs/29369925932). + - Local commit `714308114` isolates the linker path through a child environment variable and is + green across 20 test files / 98 tests plus typecheck, lint, formatting, and diff checks. + - Next gate: push that exact correction, rerun all six native jobs, then inspect every uploaded + artifact before completing the metadata/provenance box. -## Rollout implementation remaining +## Work packages, in required order -- [ ] Implement the per-target configuration field and migration tests. -- [ ] Add the off-by-default Beta-tagged option to SSH target add/edit UI. -- [ ] Implement `bundled-auto` selection for explicitly opted-in targets. -- [ ] Implement automatic legacy fallback only for classified availability/compatibility failures. -- [ ] Fail closed for signature, hash, archive, tree, native-trust, bundled-Node, and cache-corruption - failures. -- [ ] Add the explicit “disable Beta and reconnect” recovery action for fail-closed Beta errors. -- [ ] Collect privacy-safe Beta success, latency, failure-stage, and fallback-reason telemetry. -- [ ] Require a separate reviewed decision before changing any tuple to default-on. +### WP0 — Existing Node/npm resolver correction -## Work packages +- [x] Implement and unit-test coherent remote Node/npm selection. +- [x] Prove live Linux arm64 SSH/PTY behavior. +- [x] Keep the fix independently reviewable from runtime distribution. +- [ ] Merge draft PR [#8724](https://github.com/stablyai/orca/pull/8724). -### 0 — Existing Node/npm resolver correction +### WP1 — Contracts only -- [x] Implement coherent remote Node/npm selection. -- [x] Add focused unit/static proof. -- [x] Prove live Linux arm64 SSH behavior. -- [x] Keep this separate from artifact distribution. -- [ ] Merge the independently reviewable fix from draft PR - [#8724](https://github.com/stablyai/orca/pull/8724). - -### 1 — Manifest, identity, and platform contracts - -- [x] Define signed immutable manifest and canonical content identity. -- [x] Define exact release tag/asset URL rules without mutable `latest` lookup. -- [x] Define conservative OS/architecture/libc selection. -- [x] Add hostile manifest/path/schema tests. +- [x] Define immutable signed manifests, content identity, exact asset URLs, and conservative tuple + selection. +- [x] Add hostile manifest, schema, signature, and path tests. - [ ] Finish archive-safety implementation and hostile archive tests. - [ ] Update mode-qualified remote directory parsing and GC compatibility. -- [ ] Merge the contract package from draft PR - [#8728](https://github.com/stablyai/orca/pull/8728). +- [ ] Merge draft PR [#8728](https://github.com/stablyai/orca/pull/8728). -### 2 — Target-native runtime artifacts +### WP2 — Target-native runtime artifacts -- [x] Pin and verify Node v24.18.0 release inputs and signatures. -- [x] Produce and smoke-test candidate runtimes with patched `node-pty` and the matching - `@parcel/watcher` native package on all six runner families. -- [x] Prove bundled Node, real PTY input/resize/exit, watcher events, and Windows resource settlement. -- [x] Prove two clean builds compare exactly on all six native GitHub runner families. -- [x] Keep `/guard:cf`; fix Windows arm64 drift with copied-artifact-only `/INCREMENTAL:NO`. -- [x] Enforce and prove an exact 34/35/42-file per-tuple closure that rejects undeclared package - managers, sources, maps, build outputs, package drift, and missing licenses on all six native - runner families. -- [x] Define and locally test file-to-package SPDX ownership, immutable archive-scoped SBOM identity, - exact-commit builder identity, runner identity, and bounded SHA-256 toolchain records. -- [ ] Complete the runtime closure, license, SBOM, provenance, and prohibited-content allowlist audit. +- [x] Pin and verify Node v24.18.0 inputs and signatures. +- [x] Build and smoke-test Node, patched `node-pty`, and `@parcel/watcher` on GitHub runners for + Linux, macOS, and Windows on x64 and arm64. +- [x] Prove exact clean-build equality and exact runtime-tree closure on all six runner families. +- [ ] Complete the all-six SBOM, license, provenance, toolchain, and prohibited-content audit. - [ ] Prove each candidate on its oldest supported OS/libc/kernel baseline. -- [ ] Sign macOS and Windows native bytes and verify target-native trust policy. -- [ ] Record complete compiler/toolchain provenance for release promotion. +- [ ] Sign macOS and Windows bytes and verify native trust on the target OS. - [ ] Merge draft PR [#8741](https://github.com/stablyai/orca/pull/8741). -### 3 — Release build, signing, and publication +### WP3 — Release build and signing -- [ ] Add target-native build jobs as release prerequisites. -- [ ] Add native signing jobs and return signed bytes before final hashing. -- [ ] Add the fail-closed aggregate and manifest-signing job. -- [ ] Embed the exact signed manifest and accepted keys into every desktop build. -- [ ] Upload the exact prebuilt runtime bytes to the matching draft release. -- [ ] Verify draft read-back hashes and execute downloaded archives. -- [ ] Test timeout, retry exhaustion, approval denial/timeout, signing failure, partial output, and - recovered-draft behavior. -- [ ] Block publication whenever any required runtime/signing/manifest gate fails. +- [ ] Add target-native runtime jobs as desktop release prerequisites. +- [ ] Add native signing jobs; hash only the returned signed bytes. +- [ ] Add a fail-closed aggregate and immutable manifest-signing job. +- [ ] Embed the exact signed manifest and accepted keys in each desktop build. +- [ ] Upload to a draft release, read back, re-hash, and execute the downloaded archives. +- [ ] Test timeouts, retries, approval denial, signing failure, partial output, and draft recovery. -### 4 — Desktop resolver, verification, extraction, and cache +### WP4 — Desktop resolver and verified cache -- [ ] Implement offline tuple selection from the embedded signed manifest. -- [ ] Implement exact direct release URL resolution and safe redirect handling. -- [ ] Stream download with size/time bounds and archive SHA-256 verification. -- [ ] Extract into exclusive staging with full hostile-archive defenses. -- [ ] Verify the complete extracted tree before atomic cache publication. -- [ ] Implement the 2 GiB bounded cache, locking, concurrency, quarantine, and eviction rules. -- [ ] Prove verified client-cache transfer works with the client offline. +- [ ] Select tuples offline from the embedded manifest and resolve immutable direct asset URLs. +- [ ] Stream bounded downloads; verify signature, size, archive hash, and extracted tree. +- [ ] Add exclusive staging, atomic publication, quarantine, locking, and the 2 GiB cache policy. +- [ ] Prove verified cached bytes can be transferred while the client is offline. - [ ] Preserve `ORCA_RELAY_PATH` behind the official-build trust boundary. -### 5 — Bounded SSH transfer and remote installation +### WP5 — SSH transfer and remote install -- [ ] Implement bounded/cancellable SFTP transfer with executable-mode restoration. -- [ ] Keep compatible POSIX tar streaming as an optional fast path. -- [ ] Implement POSIX no-tar transfer using only the declared shell/file primitives. +- [ ] Implement bounded, cancellable SFTP transfer. +- [ ] Implement POSIX system-SSH transfer with optional tar and mandatory no-tar support. - [ ] Implement bounded binary PowerShell/.NET transfer for Windows system SSH. -- [ ] Transfer only locally verified bytes into exclusive remote staging. -- [ ] Use bundled Node to hash the complete staged tree before any native probe. -- [ ] Run native probes, PTY/watcher smoke, structured sentinel, atomic publish, and launch in order. -- [ ] Trust the initial-install proof on warm launch under the immutable-directory assumption. -- [ ] Quarantine detected mutation and recover only from freshly verified bundled bytes. -- [ ] Preserve SSH authentication, connection, and relay RPC transport behavior. +- [ ] Transfer verified bytes into exclusive staging and hash the complete staged tree with bundled + Node before native probes. +- [ ] Prove probe → PTY/watcher smoke → sentinel → atomic publish → launch ordering. +- [ ] Trust warm installs under the immutable-directory rule; quarantine detected mutation. +- [ ] Keep SSH authentication, connection, and relay RPC transport unchanged. -### 6 — Modes, fallback, diagnostics, and concurrency +### WP6 — Modes, fallback, diagnostics, and races - [ ] Implement internal `legacy`, `auto`, and forced diagnostic `bundled` modes. -- [ ] Abort and await all bundled work before eligible legacy fallback starts. -- [ ] Keep bundled and legacy identities, locks, partials, sentinels, and generations separate. -- [ ] Add stable stage/failure codes and privacy-safe diagnostics. -- [ ] Prove fallback races, reconnect/reattach, concurrent clients, GC, upgrade, and downgrade. -- [ ] Prove every integrity/security/corruption class fails closed in `auto`. -- [ ] Prove eligible legacy fallback begins within the documented delay budget. +- [ ] Fall back automatically only for classified availability/compatibility failures. +- [ ] Fail closed for signature, hash, archive/tree, native-trust, bundled-Node, and cache-corruption + failures. +- [ ] Abort and await bundled work before eligible legacy fallback begins. +- [ ] Separate bundled/legacy identities, locks, staging, sentinels, and generations. +- [ ] Test reconnect, reattach, concurrent clients, cancellation, GC, upgrades, and downgrades. -### 7 — Validation and Beta rollout +### WP7 — Per-target Beta and validation -- [ ] Name and pin representative POSIX and Windows remote snapshots for Layer B. -- [ ] For every enabled remote tuple, pass built-in SFTP and system SSH. -- [ ] For every supported client OS/architecture, pass both transfer families against representative - POSIX and Windows remotes. -- [ ] Prove remote GitHub egress is never required. -- [ ] Prove no-tar/no-Node/no-Python/no-Perl/no-hash-tool bootstrap cases. -- [ ] Run full-size, slow-link, cancellation, concurrency, and failure-injection tests. +- [ ] Add the per-target mode field with safe migration/default tests. +- [ ] Add the Beta-tagged option to SSH target add/edit UI, off by default. +- [ ] Apply a mode change only on next connection or explicit reconnect. +- [ ] Add actionable fail-closed recovery and privacy-safe Beta telemetry. +- [ ] Run every enabled remote tuple through built-in SFTP and system SSH. +- [ ] Run every supported client OS/architecture against representative POSIX and Windows remotes. +- [ ] Prove no remote GitHub egress, no-tar bootstrap, full-size transfer, slow-link cancellation, + concurrency, RPC, and failure-injection behavior. - [ ] Measure cold/warm latency, memory, channels/files, cancellation settlement, and fallback delay - against legacy baselines. -- [ ] Pass security review, SBOM/provenance, signing, key lifecycle, CVE, and emergency-refresh gates. -- [ ] Ship the per-target Beta with every target still defaulting to legacy. -- [ ] Accumulate approved real-host Beta evidence before any default-on proposal. -- [ ] Require three qualifying RCs plus rollback proof before default-on review. + against legacy. +- [ ] Ship only as per-target, off-by-default Beta; gather real-host evidence before default-on review. +- [ ] Require three qualifying RCs and rollback proof before any default-on proposal. ## External blockers -- [ ] Repository release administrator: approve the representative Layer B remote provider, - snapshots, credentials, egress policy, teardown SLA, and cost/capacity owner. -- [ ] Repository release administrator: provision the protected manifest/native-signing environment, - reviewers, test keys/certificates, and access audit. +- [ ] Release administrator chooses and provisions representative SSH remote snapshots, credentials, + egress rules, teardown SLA, and cost/capacity ownership. +- [ ] Release administrator provisions protected manifest/native-signing environments, reviewers, + test keys/certificates, and access auditing. -Safe behavior while either blocker remains: no bundled tuple is enabled or published; legacy remains -the default, and independent local/native-runner contract work may continue. +While blocked, artifact-only and test work may continue. No tuple may be enabled or published. -## Definition of done +## Final go/no-go gates -- [ ] Every item above that applies to an enabled tuple has exact evidence in the detailed ledger. -- [ ] Every enabled tuple has target-native build, oldest-baseline, native-trust, SFTP, system-SSH, - RPC, security, and performance proof. -- [ ] Every packaged desktop embeds the exact signed manifest for the published immutable assets. -- [ ] The Beta ships off by default per target and rollback to legacy is proven in the same build. -- [ ] No default-on rollout occurs without a separate reviewed decision and completed soak evidence. -- [ ] Legacy remains available until a separately reviewed removal decision. +- [ ] Every enabled tuple has native build, oldest-baseline, native-trust, SFTP, system-SSH, RPC, + security, and performance evidence. +- [ ] Every desktop build embeds the signed manifest for the exact immutable assets it ships. +- [ ] Beta rollback to the existing legacy mechanism is proven in the same build. +- [ ] All required matrix cells have evidence IDs in the detailed ledger. +- [ ] Default-on receives a separate review after the Beta soak; legacy remains available until a + separately reviewed removal decision. diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md index e1acae31a28..49003dc7734 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md @@ -8,7 +8,7 @@ work; keep exact commands, runner identities, hashes, metrics, and residual gaps Date created: 2026-07-14
Last updated: 2026-07-14
-Current phase: Milestone 3 / Work Package 2 SBOM/provenance closure — **In progress — 2026-07-14, Codex implementation owner**; exact-head run [29369350259](https://github.com/stablyai/orca/actions/runs/29369350259) proves corrected GNU strip versions, exact metadata/build equality, and upload on all four POSIX cells but shows `link.exe /?` is also silent when piped on both Windows architectures, which fail closed before build or upload (E-M3-METADATA-CI-RED-002); exact implementation commit `e85f0c700` retains SHA-256 of the resolved linker and reads its authenticated PE `FileVersion` through non-interactive PowerShell with the path passed as a positional argument, and passes 20 files / 97 tests plus static gates under E-M3-WINDOWS-LINKER-FILE-VERSION-LOCAL-001; the next exact-head run must pass all six native cells and direct metadata inspection before any remaining SBOM/provenance/toolchain box is checked; oldest-baseline, native-trust, cross-family remote, and measured-baseline gates remain open; production/default behavior and every tuple state remain unchanged; no bundled-runtime path is enabled
+Current phase: Milestone 3 / Work Package 2 SBOM/provenance closure — **In progress — 2026-07-14, Codex implementation owner**; exact-head run [29369925932](https://github.com/stablyai/orca/actions/runs/29369925932) and direct payload audit keep Linux x64/arm64 and macOS x64/arm64 green but both Windows cells fail closed before build/upload while selecting the authenticated linker's PE file version (E-M3-METADATA-CI-RED-003); local commit `714308114` passes that linker path through a dedicated child environment variable, accepts only a bounded valid file-version form, preserves bounded failure diagnostics, and passes 20 files / 98 tests plus typecheck, full lint, formatting, max-lines, and diff gates (E-M3-WINDOWS-LINKER-ENV-LOCAL-001); the correction still requires an exact-head all-six native run and direct artifact inspection before any remaining SBOM/provenance/toolchain box is checked; oldest-baseline, native-trust, cross-family remote, and measured-baseline gates remain open; production/default behavior and every tuple state remain unchanged; no bundled-runtime path is enabled
Primary design: [SSH relay GitHub Release plan](./2026-07-14-ssh-relay-github-release-plan.html)
Motivating issues: [#8450](https://github.com/stablyai/orca/issues/8450), [#1693](https://github.com/stablyai/orca/issues/1693) @@ -175,12 +175,12 @@ same change as the work it records. per-target opt-in selects bundled-preferred behavior, and implementing the setting does not authorize default-on rollout or legacy removal (E-M1-ROLLOUT-DECISION-001). - Legacy fallback removal: not authorized. -- Next required action: push exact correction commit `e85f0c700` plus its evidence-ledger head and - rerun all six target-native cells. Require exact SPDX ownership, archive-scoped document identity, - commit-pinned builder identity, resolved runner identity, complete bounded tool records with - SHA-256, clean-build metadata equality, smoke, upload, and regenerated Windows identities before - checking the remaining Milestone 3 metadata/toolchain claims. Preserve the artifact-only boundary, - legacy/default path, and every other release gate. +- Next required action: finish the direct audit and ledger entry for run 29369925932, record local + proof for commit `714308114`, then push that exact correction plus the ledger head and rerun all + six target-native cells. Require exact SPDX ownership, archive-scoped document identity, + commit-pinned builder identity, resolved runner identity, complete bounded tool records, + regenerated Windows content identities, smoke, exact clean-build equality, and upload. Preserve + the artifact-only boundary, legacy/default path, and every other release gate. ## Non-Negotiable Invariants @@ -6380,6 +6380,158 @@ the bounded depth` before opening or parsing a candidate. Starting at the comple - Follow-up: push this exact implementation plus the ledger head and require all six native jobs and direct inspection of every uploaded metadata document before closing the metadata/toolchain gate. +### E-M3-METADATA-CI-RED-003 — Positional PE-version lookup remains empty on Windows + +- Date: 2026-07-14 +- Commit SHA / PR: exact tested head `01acba8608e3446bb921cfb812a7026817a53032`; + stacked draft PR [#8741](https://github.com/stablyai/orca/pull/8741) +- Runner: [GitHub Actions run 29369925932](https://github.com/stablyai/orca/actions/runs/29369925932), + final conclusion `failure` after 7m05s. Native job IDs and wall durations: Linux x64 + `87210560419` / 3m03s, Linux arm64 `87210560395` / 3m21s, macOS x64 `87210560388` / + 6m59s, macOS arm64 `87210560695` / 3m18s, Windows x64 `87210560429` / 1m24s, and + Windows arm64 `87210560403` / 4m49s. +- Remote and transport: none; target-native artifact-only build workflow +- Exact evidence commands: + + ```sh + gh run view 29369925932 --repo stablyai/orca \ + --json status,conclusion,headSha,createdAt,updatedAt,url,jobs + gh api repos/stablyai/orca/actions/runs/29369925932/artifacts + gh api repos/stablyai/orca/actions/jobs/87210560429/logs + gh api repos/stablyai/orca/actions/jobs/87210560403/logs + gh run download 29369925932 --repo stablyai/orca \ + --dir /tmp/orca-8450-metadata-red-29369925932 + find /tmp/orca-8450-metadata-red-29369925932 -maxdepth 3 -type f -print + bash -eu -o pipefail <<'SH' + evidence=/tmp/orca-8450-metadata-red-29369925932 + commit=01acba8608e3446bb921cfb812a7026817a53032 + run_id=29369925932 + find "$evidence" -type f \( -name '*.tar.xz' -o -name '*.zip' \) \ + -exec shasum -a 256 {} + + for directory in "$evidence"/*; do + identity=$(find "$directory" -type f -name '*.identity.json') + provenance=$(find "$directory" -type f -name '*.provenance.json') + spdx=$(find "$directory" -type f -name '*.spdx.json') + archive=$(find "$directory" -type f \( -name '*.tar.xz' -o -name '*.zip' \)) + archive_sha=$(shasum -a 256 "$archive" | cut -d ' ' -f 1) + jq -e --arg sha "$archive_sha" --arg commit "$commit" --arg run "$run_id" \ + --slurpfile provenance "$provenance" --slurpfile spdx "$spdx" ' + ($spdx[0].relationships | map(select(.relationshipType == "CONTAINS")) | + group_by(.relatedSpdxElement) | + map({key: .[0].relatedSpdxElement, value: length}) | from_entries) as $owners | + .archive.sha256 == ("sha256:" + $sha) and + .fileCount == ($spdx[0].files | length) and + ([.entries[] | select(.type == "file")] | length) == ($spdx[0].files | length) and + all($spdx[0].files[]; $owners[.SPDXID] == 1) and + ($spdx[0].relationships | map(select(.relationshipType == "DEPENDS_ON")) | length) == 8 and + $spdx[0].documentNamespace == + ("https://github.com/stablyai/orca/ssh-relay-runtime/spdx/" + $sha) and + $provenance[0].subject[0].digest.sha256 == $sha and + $provenance[0].predicate.runDetails.metadata.invocationId == $run and + $provenance[0].predicate.runDetails.builder.id == + ("https://github.com/stablyai/orca/blob/" + $commit + + "/.github/workflows/ssh-relay-runtime-artifacts.yml") and + ($provenance[0].predicate.buildDefinition.resolvedDependencies | + any(.digest.gitCommit == $commit and (.uri | endswith("@" + $commit)))) and + ($provenance[0].predicate.runDetails.metadata.runner | + .os != "" and .architecture != "" and .environment == "github-hosted" and + .requestedLabel != "" and .image.os != "" and .image.version != "") and + ($provenance[0].predicate.buildDefinition.internalParameters.toolchain | to_entries | + all(.[]; (.value.version | length) > 0 and + (.value.version | test("usage:"; "i") | not) and + (.value.sha256 | test("^sha256:[0-9a-f]{64}$")))) and + all(.entries[]; + (.path | test( + "(^|/)(npm|npx|corepack)([.](cmd|exe))?$|[.](map|cc|cpp|h|hpp|o|obj|pdb|lib)$"; + "i" + ) | not)) + ' "$identity" >/dev/null + jq -c '{tupleId, contentId, fileCount, archive}' "$identity" + done + SH + ``` + +- Result: EXPECTED RED. All four POSIX cells passed native contracts, built twice, inspected and + smoked both outputs, compared runtime/archive/identity/SPDX/provenance bytes exactly, and uploaded. + Windows x64 and arm64 each failed in `ssh-relay-runtime-toolchain.test.mjs` with `Runtime build +tool did not report a bounded version line`; input download, build, smoke, comparison, and upload + were skipped. The two Windows failures occurred after target-native MSVC setup and dependency + install, so the x64 `windows-2022` and arm64 `windows-11-arm` environments independently disprove + the positional PowerShell path transport. No Windows artifact exists for this run. +- Downloaded-artifact audit: + + | Tuple | Artifact ID | Archive SHA-256 | Content ID prefix | Files | Runner image | + | ----------------- | ------------ | ------------------------------------------------------------------ | ----------------- | ----- | ------------------------------ | + | linux-x64-glibc | `8325687973` | `c71778c6ea716eb694b8d961b6bcf0c2a379761a535fa069434a7e755903b06a` | `960546cd…` | 34 | `ubuntu24` 20260705.232.1 | + | linux-arm64-glibc | `8325696189` | `6dc95917b828675a4700444378b96c89ff5b538e1848b3a167cc10c4702794d7` | `aa3aa8ae…` | 34 | `ubuntu24-arm64` 20260706.52.2 | + | darwin-x64 | `8325779710` | `332510ffba04959fbc16fdce54334fc9cca55f7b87fb19d78f1e4ce570c5b388` | `585ea603…` | 35 | `macos15` 20260629.0276.1 | + | darwin-arm64 | `8325693875` | `1474f808f8d1e5668060468284236ba4c81e395931fa1bf5d3dcbfed4b45a994` | `40ff5d20…` | 35 | `macos15` 20260706.0213.1 | + + Every archive hash matches its identity and provenance subject. Every SPDX namespace ends in the + exact archive hash; every file has exactly one package owner; each document has nine packages and + eight dependency relationships. Builder and source identities pin exact commit `01acba860`; the + invocation is `29369925932`; requested runner labels, native architectures, environment, and image + versions are present. Linux records GCC 13.3.0, GNU Make 4.3, Python 3.12.3, XZ 5.4.5, and GNU + strip 2.42. macOS records Apple clang 17.0.0, GNU Make 3.81, Python 3.14.6, XZ 5.8.3, and Xcode + 16.4. Every tool record carries a SHA-256 and no version contains a usage line. + +- Oracle proved: all four POSIX metadata payloads remain semantically complete after the PE-version + change; direct audit agrees with workflow equality; both target-native Windows architectures + reject an empty PE-version result before unverified/incompletely described bytes can be built or + uploaded. +- Does not prove: a working native Windows PE-version lookup, Windows build/metadata/equality/upload, + regenerated Windows content IDs for the 19045/26100 floors, oldest baselines, native trust/signing, + SSH, publication, or an enabled tuple. +- Checklist items satisfied: no new completion box; the all-six SBOM/provenance/toolchain item + remains in progress. +- Follow-up: transport the resolved linker path outside PowerShell argument parsing, retain exact + linker-byte hashing and bounded output validation, then rerun and directly audit all six cells. + +### E-M3-WINDOWS-LINKER-ENV-LOCAL-001 — Environment-isolated linker path transport + +- Date: 2026-07-14 +- Commit SHA / PR: exact implementation commit + `714308114dee85a6f241a43b75c6ac9122769c3e`; stacked draft PR + [#8741](https://github.com/stablyai/orca/pull/8741) +- Runner: local macOS 26.2 build 25C56, Darwin 25.2.0 arm64 on Apple Silicon; Node v26.0.0 and + pnpm 10.24.0 for pure invocation/metadata tests +- Remote and transport: none; artifact-only local contracts +- Exact evidence commands: + + ```sh + pnpm exec vitest run --config config/vitest.config.ts \ + config/scripts/ssh-relay-*.test.mjs \ + src/main/ssh/ssh-relay-artifact-selector.test.ts + pnpm run typecheck + pnpm run lint + pnpm run check:max-lines-ratchet + pnpm exec oxfmt --check \ + config/scripts/ssh-relay-runtime-toolchain.mjs \ + config/scripts/ssh-relay-runtime-toolchain.test.mjs \ + docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md \ + docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md + git diff --check + ``` + +- Result: PASS. Twenty focused test files passed 98 tests in 5.90s. Typecheck passed all three + TypeScript projects. Full lint passed oxlint, switch exhaustiveness, styled-scrollbar, + reliability-gate, max-lines, bundled-skill, localization-catalog, and localization-coverage gates; + its diagnostics remain pre-existing unrelated warnings. The independent max-lines ratchet, + focused formatting, and diff checks passed. +- Oracle proved: the PowerShell expression no longer relies on `$args` parsing and never + interpolates the linker path into executable script text; the exact resolved path is supplied in + a dedicated child-only environment value; the child inherits the required native build + environment; three- and four-component PE file versions with bounded release suffixes are + accepted; missing, malformed, oversized, or unrelated output remains rejected with at most 512 + diagnostic bytes; and the resolved linker executable remains SHA-256 authenticated. +- Does not prove: the environment-value lookup on either native Windows architecture, the actual + linker version, regenerated Windows metadata/content IDs, build/smoke/equality/upload, oldest + Windows execution, native trust/signing, SSH, publication, or an enabled tuple. +- Checklist items satisfied: local correction only; the all-six compiler/toolchain item remains + unchecked. +- Follow-up: push this exact implementation and ledger head, then require all six native jobs and + direct inspection of every uploaded artifact before closing any metadata/provenance claim. + ## Accepted Gaps No product gap is accepted merely because it appears in this list. Each entry requires explicit @@ -6437,12 +6589,13 @@ The project is not complete until every applicable item below is checked with ev ## Next Required Action -Push exact correction commit `e85f0c700` plus this evidence-ledger head and rerun all six -target-native cells. Require exact SPDX ownership, archive-scoped document identity, commit-pinned -builder identity, resolved runner identity, complete bounded tool records with SHA-256, clean-build -metadata equality, smoke, upload, and regenerated Windows content identities before checking the -remaining Milestone 3 metadata/toolchain claims. Then proceed to oldest-baseline and native-trust -proof. +Finish the direct artifact audit and evidence entry for exact-head run 29369925932, record local +proof for correction commit `714308114`, then push that exact correction plus this ledger head and +rerun all six target-native cells. Require exact SPDX ownership, archive-scoped document identity, +commit-pinned builder identity, resolved runner identity, complete bounded tool records with +SHA-256, clean-build metadata equality, smoke, upload, and regenerated Windows content identities +before checking the remaining Milestone 3 metadata/toolchain claims. Then proceed to oldest-baseline +and native-trust proof. Cross-family Layer B targets, the protected manifest-signing environment, oldest-baseline/native- trust cells, and the paired legacy performance baseline remain release/default-path blockers. No