From c68a99039e4633d41e21fb30afdfeaa06f776369 Mon Sep 17 00:00:00 2001 From: Jinwoo-H Date: Wed, 15 Jul 2026 02:01:27 -0400 Subject: [PATCH] docs(ssh): anchor Windows manifest parity proof Co-authored-by: Orca --- ...relay-github-release-implementation-checklist-summary.md | 3 ++- ...-14-ssh-relay-github-release-implementation-checklist.md | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md index 4092150bd6b..2227082b19c 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md @@ -108,7 +108,8 @@ complete a box. - [ ] **In progress — 2026-07-15, Codex implementation owner:** correct the Windows runtime compatibility discriminator from `win32` to the manifest-contract `windows`, prove both Windows tuples and full regressions, then resume disconnected canonical manifest/signing handoff. Local - proof passes under `E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-001`; exact-head native CI is next. + proof passes at `707a9da23` under `E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-001`; exact-head native CI + is next. - [ ] Add target-native runtime jobs as desktop release prerequisites. - [ ] Add native signing jobs; hash only the returned signed bytes. - [ ] Add a fail-closed aggregate and immutable manifest-signing job. diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md index ef1c0f1318b..c622fc52306 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md @@ -9,7 +9,7 @@ work; keep exact commands, runner identities, hashes, metrics, and residual gaps Date created: 2026-07-14
Last updated: 2026-07-15
Current phase: Milestone 4 / Work Package 3 Windows compatibility-kind parity prerequisite — **In progress — 2026-07-15, Codex implementation owner**. The disconnected release-DAG and aggregate/read-back byte boundaries are closed locally and on all six native build jobs under E-M4-RELEASE-DAG-LOCAL-001, E-M4-RELEASE-DAG-CI-001, E-M4-AGGREGATE-READBACK-LOCAL-001, and E-M4-AGGREGATE-READBACK-CI-001. Pre-assembly inspection found that target-native Windows build identities use compatibility `kind: "win32"` while the reviewed manifest schema and desktop consistency verifier require `kind: "windows"`. The active package is limited to a RED/GREEN parity correction and exact regressions before canonical manifest/signature-handoff work resumes; it may not publish, connect desktop consumers, use signing credentials, or enable a tuple. Production/default behavior is unchanged, no bundled-runtime path is enabled, and no artifact is published.
-Session checkpoint: **In progress — 2026-07-15, Codex implementation owner** — exact-head artifact run [29391666358](https://github.com/stablyai/orca/actions/runs/29391666358) executes aggregate-input and authenticated draft read-back suites under Node 24 on all six target-native build jobs at `87a8e4dc3`; every native build and both Linux supplemental userland jobs pass under E-M4-AGGREGATE-READBACK-CI-001. The run remains red only because Windows arm64 runner build 26200 is not the required build 26100, after archive/tree/Node/PTY/watcher smoke settles in 8,032.7284 ms with 49,922,048-byte RSS. Golden E2E [29391666362](https://github.com/stablyai/orca/actions/runs/29391666362) and PR Checks [29391666360](https://github.com/stablyai/orca/actions/runs/29391666360) are green. Inspection for the next manifest slice exposed the unpublished Windows `win32`/`windows` compatibility-kind and root-`node.exe`/`bin/node.exe` verifier mismatches. The narrow correction now passes local RED/GREEN, purpose-named workflow wiring, 36-file/203-test full SSH-relay, type, lint, line-budget, formatting, and diff gates under E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-RED-001 and E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-001; exact-head native CI is next. Real Apple/SignPath signing, returned production signatures, Gatekeeper/notarization, Defender/WDAC, missing exact-floor snapshots, protected manifest signing, and native trust remain separately gated. Nothing is published or enabled, and legacy remains the production default.
+Session checkpoint: **In progress — 2026-07-15, Codex implementation owner** — exact-head artifact run [29391666358](https://github.com/stablyai/orca/actions/runs/29391666358) executes aggregate-input and authenticated draft read-back suites under Node 24 on all six target-native build jobs at `87a8e4dc3`; every native build and both Linux supplemental userland jobs pass under E-M4-AGGREGATE-READBACK-CI-001. The run remains red only because Windows arm64 runner build 26200 is not the required build 26100, after archive/tree/Node/PTY/watcher smoke settles in 8,032.7284 ms with 49,922,048-byte RSS. Golden E2E [29391666362](https://github.com/stablyai/orca/actions/runs/29391666362) and PR Checks [29391666360](https://github.com/stablyai/orca/actions/runs/29391666360) are green. Inspection for the next manifest slice exposed the unpublished Windows `win32`/`windows` compatibility-kind and root-`node.exe`/`bin/node.exe` verifier mismatches. The narrow correction is committed at `707a9da23e3955bed6ed00ad3afc24b5ab808243` and passes local RED/GREEN, purpose-named workflow wiring, 36-file/203-test full SSH-relay, type, lint, line-budget, formatting, and diff gates under E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-RED-001 and E-M4-WINDOWS-MANIFEST-PARITY-LOCAL-001; push and exact-head native CI are next. Real Apple/SignPath signing, returned production signatures, Gatekeeper/notarization, Defender/WDAC, missing exact-floor snapshots, protected manifest signing, and native trust remain separately gated. Nothing is published or enabled, and legacy remains the production default.
Primary design: [SSH relay GitHub Release plan](./2026-07-14-ssh-relay-github-release-plan.html)
Motivating issues: [#8450](https://github.com/stablyai/orca/issues/8450), [#1693](https://github.com/stablyai/orca/issues/1693) @@ -9096,8 +9096,8 @@ diff --check`. - Date: 2026-07-15 - Owner: Codex implementation owner -- Source: uncommitted correction based on exact head `90da7e14b`; draft PR - [#8741](https://github.com/stablyai/orca/pull/8741). +- Source: implementation commit `707a9da23e3955bed6ed00ad3afc24b5ab808243`, based on exact prior + head `90da7e14b`; draft PR [#8741](https://github.com/stablyai/orca/pull/8741). - Runner/network: local macOS 26.2 build 25C56 arm64, Node v26.0.0 and pnpm 10.24.0; no network, native runner, signing, release, SSH, publication, desktop consumer, or production call. The repository emits its expected Node-24 engine warning.