From e5dfffaaa2df55b221c5ee30699ff8fe814b91aa Mon Sep 17 00:00:00 2001 From: Jinwoo-H Date: Wed, 15 Jul 2026 10:03:18 -0400 Subject: [PATCH] docs: record Linux relay finalization CI proof Co-authored-by: Orca --- ...elease-implementation-checklist-summary.md | 11 +- ...github-release-implementation-checklist.md | 127 +++++++++++++++--- 2 files changed, 118 insertions(+), 20 deletions(-) diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md index 8ad68dab3f9..68edae4cb89 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md @@ -234,11 +234,12 @@ complete a box. `E-M4-NATIVE-SIGNING-REHEARSAL-CI-001`; PR Checks and Golden E2E are green. The artifact run is red only for the retained Windows arm64 build-26100 floor mismatch. - [ ] Add a fail-closed aggregate and immutable manifest-signing job. - First emit the missing aggregate-ready Linux hash-only tuple descriptors; macOS/Windows - already emit equivalent post-sign descriptors. This prerequisite is in progress and remains - artifact-only; its missing-module RED and local GREEN are - `E-M4-LINUX-FINALIZATION-LOCAL-RED-001` and `E-M4-LINUX-FINALIZATION-LOCAL-001`. Exact-head - Linux runner proof remains open. + The missing Linux aggregate-ready prerequisite is closed by + `E-M4-LINUX-FINALIZATION-LOCAL-RED-001`, `E-M4-LINUX-FINALIZATION-LOCAL-001`, and + `E-M4-LINUX-FINALIZATION-CI-001`: both native Linux architectures emitted inspected, + hash-bound descriptors/receipts. The active slice is the callable, disconnected aggregate and + protected Ed25519-signing workflow contract. The environment/seed are not provisioned, so live + signing remains blocked and no release, desktop, publication, or tuple consumer is connected. - [ ] Embed the exact signed manifest and accepted keys in each desktop build. - [ ] Upload to a draft release, read back, re-hash, and execute the downloaded archives. - [ ] Test timeouts, retries, approval denial, signing failure, partial output, and draft recovery. diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md index 1ad2c5ecbcc..351efdd6526 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md @@ -8,8 +8,8 @@ work; keep exact commands, runner identities, hashes, metrics, and residual gaps Date created: 2026-07-14
Last updated: 2026-07-15
-Current phase: Milestone 4 / Work Package 3 Linux aggregate-ready hash-only finalization — **In progress — 2026-07-15, Codex implementation owner**. Exact-head signing-workflow and manual-caller capabilities are closed, while live credentialed dispatch remains blocked by GitHub's default-branch rule under E-M4-NATIVE-SIGNING-REHEARSAL-DISPATCH-BLOCKED-001. Aggregate design inspection found that macOS/Windows finalization emits verified four-file tuple inputs but Linux build artifacts stop before the same tuple-descriptor boundary. The active narrow package adds Linux-only full archive/tree/Node/PTY/watcher verification, derives the complete hash-only native report, re-verifies tree/assets, and emits the aggregate descriptor/receipt. It must fail closed on non-Linux, stale identity, mutation, smoke failure, or partial output. The fail-closed aggregate/manifest-signing job remains next. Release-cut, desktop builds, publication, and every tuple stay disconnected; production/default behavior is unchanged.
-Session checkpoint: **In progress — 2026-07-15, Codex implementation owner** — Linux aggregate-ready finalization is locally green under `E-M4-LINUX-FINALIZATION-LOCAL-RED-001` and `E-M4-LINUX-FINALIZATION-LOCAL-001`. The Linux-only module copies the three stable build assets into exclusive output, verifies archive/full tree and bundled Node/PTY/watcher, derives every native hash from the validated signing plan, then invokes the existing tuple producer to re-verify tree/archive/SBOM/provenance before emitting the descriptor and bound receipt. Any failure removes the entire candidate. Both Linux native build jobs invoke it before upload, and both POSIX/Windows contract families execute its tests. Focused 3 files / 18 tests, broad 48 files / 246 tests, desktop parity 3 files / 48 tests, typecheck, full lint/reliability/localization/max-lines, focused syntax/lint/format, and `git diff --check` pass. Exact-head native runner execution remains required. No aggregate workflow, credential, release consumer, publication path, desktop consumer, tuple enablement, or production/default change is connected. Legacy remains the production default, and merge to `main` remains prohibited.
+Current phase: Milestone 4 / Work Package 3 disconnected aggregate and protected manifest-signing workflow contract — **In progress — 2026-07-15, Codex implementation owner**. Linux aggregate-ready finalization is closed locally and on exact-head native x64/arm64 runners under E-M4-LINUX-FINALIZATION-LOCAL-RED-001, E-M4-LINUX-FINALIZATION-LOCAL-001, and E-M4-LINUX-FINALIZATION-CI-001. The active package must consume only the six exact aggregate-ready outputs, prepare canonical bytes credential-free, expose only those bytes to the tag-restricted `relay-runtime-manifest-signing` environment, accept only key ID plus Ed25519 signature, reconstruct and verify before final output, and fail closed on missing/extra/mutated inputs, approval/secret/signing failure, timeout, or partial output. It remains callable and disconnected. Release-cut, desktop builds, publication, and every tuple stay disconnected; production/default behavior is unchanged.
+Session checkpoint: **In progress — 2026-07-15, Codex implementation owner** — exact-head run 29419759256 at `91f59d19e5251fb7b6c9f6d397cd9cd82b43cbdf` passes all six native builds, both Linux userland supplements, and Windows x64 baseline. Windows arm64 fails only the retained build-floor gate after successful runtime verification (hosted 26200 versus required 26100). Downloaded artifacts 8344803641 and 8344824674 contain the expected Linux x64/arm64 descriptors and finalization receipts, whose tuple/content/archive/metadata bindings and smoke/resource metrics were inspected under E-M4-LINUX-FINALIZATION-CI-001. Golden E2E passes. PR Checks attempt 1 exposed one unrelated terminal-routing assertion after 29,944 tests passed; the focused test passes locally and exact-head attempt 2 passes all 29,945 tests, unpacked build, and packaged CLI smoke under E-M4-LINUX-FINALIZATION-PR-CHECKS-RED-001 and E-M4-LINUX-FINALIZATION-PR-CHECKS-001. No signing credential, aggregate workflow, release consumer, publication path, desktop consumer, tuple enablement, or production/default change is connected. Legacy remains the production default, and merge to `main` remains prohibited.
Primary design: [SSH relay GitHub Release plan](./2026-07-14-ssh-relay-github-release-plan.html)
Motivating issues: [#8450](https://github.com/stablyai/orca/issues/8450), [#1693](https://github.com/stablyai/orca/issues/1693) @@ -100,10 +100,12 @@ same change as the work it records. native CI pass under E-M4-BUILD-PREREQUISITE-LOCAL-RED-001, E-M4-BUILD-PREREQUISITE-LOCAL-001, and E-M4-BUILD-PREREQUISITE-CI-001. Release workflows remain disconnected. -- Active package: Work Package 3 platform-native signing-job workflow contract. Begin with a - purpose-named RED for exact native build-input consumption, immutable returned signed bytes, - post-return hashing, bounded failure behavior, and release-consumer disconnection. Credential-free - tests do not count as real Apple/SignPath signing or native-trust evidence; keep those gates open. +- Active package: Work Package 3 callable, disconnected aggregate/manifest-signing workflow + contract. Begin with a purpose-named RED for all-six exact aggregate input consumption, + credential-free canonical preparation, protected environment isolation, seed decoding and + signature-only return, reconstruction/verification, bounded failure cleanup, and complete + release/desktop/publication disconnection. The environment and seed are unprovisioned; static and + test-key proof do not count as live protected signing evidence. - Completed Work Package 2 gate: target-native Windows source-signature reports from exact-head artifact jobs 87267322867 and 87267322870 were independently downloaded and matched to their identities and signing-stage reports under E-M3-WINDOWS-SOURCE-SIGNATURE-CI-001. PR Checks @@ -10607,6 +10609,101 @@ ssh-relay-runtime-native-signing-rehearsal.yml not found on the default branch`. - Follow-up: commit/push and require both Linux native jobs plus all-six contract families to pass at the exact head. Inspect the emitted descriptor/receipt before starting aggregate job wiring. +### E-M4-LINUX-FINALIZATION-CI-001 — Native Linux finalization emits inspected aggregate inputs + +- Date: 2026-07-15 +- Owner: Codex implementation owner +- Source: exact pushed head `91f59d19e5251fb7b6c9f6d397cd9cd82b43cbdf`; draft PR #8741. +- Workflow: [SSH Relay Runtime Artifacts run 29419759256](https://github.com/stablyai/orca/actions/runs/29419759256), + 13:34:30Z–13:50:21Z. The workflow conclusion is the expected failure solely because the separately + declared Windows arm64 oldest-build gate rejects hosted 26200 versus required 26100 after runtime + verification. It is not reported as an all-green aggregate. +- Native build jobs: all six succeed — Linux arm64 87366900226 on `ubuntu-24.04-arm` in 4m50s; + Windows x64 87366900246 in 6m14s; macOS x64 87366900262 in 6m55s; macOS arm64 87366900276 in + 4m59s; Windows arm64 87366900296 in 11m59s; and Linux x64 87366900347 on `ubuntu-24.04` in + 4m10s. Each exact native family runs the purpose suite including Linux-finalization syntax and + tests; both Linux jobs report 47 files / 242 tests passed under Node 24.18.0. +- Supplemental gates: Linux x64 job 87368626081 and Linux arm64 job 87368626106 pass the + digest-pinned Rocky Linux glibc 2.28/libstdc++ 6.0.25 userland proof; the explicit kernel 4.18 gap + remains because hosted kernels are newer. Windows x64 baseline job 87369854311 passes. Windows + arm64 job 87369854133 authenticates and executes the runtime, records 6,242.0644 ms smoke, + 48,771,072-byte RSS, and 10,149.9713 ms total verification, then fails only the exact OS-build + check (`10.0.26200` versus required 26100). +- Downloaded proof: `gh run download 29419759256 --repo stablyai/orca -n +ssh-relay-runtime-linux-x64-glibc -n ssh-relay-runtime-linux-arm64-glibc`. Artifact + [8344803641](https://github.com/stablyai/orca/actions/runs/29419759256/artifacts/8344803641) + is 29,292,240 bytes and artifact + [8344824674](https://github.com/stablyai/orca/actions/runs/29419759256/artifacts/8344824674) + is 28,222,689 bytes. Each contains exactly the runtime archive, identity, SBOM, provenance, + signing-stage evidence, `.manifest-tuple.json`, and `.linux-finalization.json` receipt expected by + the unpublished evidence contract. +- x64 receipt: tuple `linux-x64-glibc`, content + `sha256:fc63ca342a5990f460ec6d72262a8542173dab20ce03c9b9cfb755b1c6057e6d`, archive + `sha256:8b9e77fe5f33acbee4a2d532f0be564d8eceb36acaf22deec08cccdd14834d78`, descriptor + `sha256:855d83a9f0b0bb5878de335703c4398dc72420b220b31efb5786af59da0587ec`, 49 tree + entries / 34 files / 124,846,430 expanded bytes, 159.336194 ms smoke, 56,758,272-byte RSS, and + 1,749.137209 ms final verification. +- arm64 receipt: tuple `linux-arm64-glibc`, content + `sha256:96f07f62af9b35304bb8ca0870ca4d8095e059bfa61dd1bc57e81b20f3fbca67`, archive + `sha256:f2bfe798097a24a113abd37d32008d542c1ed0772ed8ccce53fb51c807d84c3f`, descriptor + `sha256:253dac72cb97e32c6fa68f886ac7c73cf00b7a03b1e87d189c490559bf1c071e`, 49 tree + entries / 34 files / 122,865,324 expanded bytes, 188.430108 ms smoke, 52,727,808-byte RSS, and + 1,700.548606 ms final verification. +- Adjacent regressions: [Golden E2E 29419759379](https://github.com/stablyai/orca/actions/runs/29419759379) + passes its macOS and Linux jobs at the exact head. PR Checks attempt 1 has the separately recorded + unrelated suite-order RED `E-M4-LINUX-FINALIZATION-PR-CHECKS-RED-001`; attempt 2 passes under + `E-M4-LINUX-FINALIZATION-PR-CHECKS-001`. +- Oracle proved: both real native Linux architectures execute the new verify-before-descriptor path, + preserve exact archive/tree/native hashes, run bundled Node/PTY/watcher smoke, emit the complete + hash-only native report, and upload receipts that bind exact aggregate inputs. The inspected + receipts agree with their descriptors, assets, tuple IDs, and content IDs. +- Does not prove: Linux kernel 4.18, native Apple/SignPath signing or trust, protected manifest + signing, aggregate workflow execution, publication/read-back, desktop embedding, SSH behavior, + performance parity, or any enabled tuple. +- Checklist items satisfied: Linux aggregate-ready prerequisite for the Work Package 3 aggregate + workflow. The broader aggregate/manifest-signing item remains open. +- Follow-up: implement the purpose-named callable/disconnected aggregate and protected signing + workflow contract. Do not connect release, desktop, publication, or tuple consumers. + +### E-M4-LINUX-FINALIZATION-PR-CHECKS-RED-001 — Adjacent full suite exposes unrelated routing flake + +- Date: 2026-07-15 +- Owner: Codex implementation owner +- Source: exact pushed head `91f59d19e5251fb7b6c9f6d397cd9cd82b43cbdf`; draft PR #8741. +- Workflow: [PR Checks run 29419759287 attempt 1](https://github.com/stablyai/orca/actions/runs/29419759287), + job 87366900240. Lint, typecheck, Git compatibility, and every pre-test gate pass. The test step + reports 2,850 files / 29,944 tests passed, nine files / 55 tests skipped, and one failure after + 421.95 seconds. +- Failure: untouched + `src/renderer/src/components/terminal-pane/pty-connection.test.ts` case `keeps Droid routing visible +through command-finished foreground confirmation` receives `csi-u` instead of `alt-enter` at line 5284. Neither the Linux finalizer nor its workflow edits touch that production/test domain. +- Focused command: + `pnpm exec vitest run --config config/vitest.config.ts src/renderer/src/components/terminal-pane/pty-connection.test.ts -t 'keeps Droid routing visible through command-finished foreground confirmation'` + — PASS locally, 1 file / 1 test with 423 skipped in 1.22 seconds. +- Oracle proved: the exact failure is identified and is not hidden by a blind retry; it is not a + Linux finalizer assertion. Exact-head attempt 2 was explicitly requested only after log inspection. +- Does not prove: that the unrelated test has no latent ordering defect. +- Follow-up: replacement attempt 2 passes under E-M4-LINUX-FINALIZATION-PR-CHECKS-001. Retain this + RED rather than erasing the observed suite-order failure. + +### E-M4-LINUX-FINALIZATION-PR-CHECKS-001 — Exact-head full-suite replacement passes + +- Date: 2026-07-15 +- Owner: Codex implementation owner +- Source: exact pushed head `91f59d19e5251fb7b6c9f6d397cd9cd82b43cbdf`; draft PR #8741. +- Workflow: [PR Checks run 29419759287 attempt 2](https://github.com/stablyai/orca/actions/runs/29419759287), + job 87369995158, 13:47:10Z–14:01:35Z — PASS. +- Result: lint, reliability, max-lines, localization, typecheck, Git 2.25 compatibility, and all + other pre-test gates pass. The full suite passes 2,851 files / 29,945 tests with nine files / 55 + tests skipped in 537.22 seconds. The unpacked Linux app builds, packaged daemon entry loads under + plain Node, and the packaged CLI `--help` smoke succeeds outside the repository. +- Oracle proved: the exact-head replacement is green, including the assertion that failed in + attempt 1, without any code or test change and without weakening the Linux finalizer contract. +- Does not prove: real Linux kernel 4.18, signing, publication, desktop embedding, SSH behavior, or + an enabled tuple. +- Follow-up: checkpoint the Linux finalization evidence and start the disconnected aggregate and + protected manifest-signing workflow RED. + ## Accepted Gaps No product gap is accepted merely because it appears in this list. Each entry requires explicit @@ -10665,15 +10762,15 @@ The project is not complete until every applicable item below is checked with ev ## Next Required Action -Commit and push the locally proven manual rehearsal caller under -E-M4-NATIVE-SIGNING-REHEARSAL-LOCAL-001, then require its purpose-named contracts to pass on both -native test families at the exact head. Record GitHub's expected default-branch dispatch refusal; -do not route secrets through an existing routine workflow as a workaround. Real Apple/SignPath -request, approval/return, changed-byte identity, and native-trust evidence remain gated until a -separately authorized merge makes the reviewed caller dispatchable. While blocked, begin the next -purpose-named disconnected aggregate/immutable-manifest job package. Keep Windows arm64 build 26100, -macOS 13.5, Linux kernel 4.18, release-cut, desktop builds, publication, and every tuple separately -gated. Do not merge to `main`; retain every production/default gate. +Checkpoint E-M4-LINUX-FINALIZATION-CI-001 and the green PR Checks replacement. Then begin a +purpose-named RED for the callable, disconnected aggregate/immutable-manifest workflow: consume all +six exact aggregate-ready artifacts, prepare canonical bytes without credentials, isolate the +base64 32-byte seed in the tag-restricted `relay-runtime-manifest-signing` environment, return only +key ID plus signature, reconstruct and verify before emitting final output, and remove partial +output on every failure. The environment and secret remain unprovisioned, so live signing evidence +must stay BLOCKED. Keep Windows arm64 build 26100, macOS 13.5, Linux kernel 4.18, release-cut, +desktop builds, publication, and every tuple separately gated. Do not merge to `main`; retain every +production/default gate. Cross-family Layer B targets, the protected manifest-signing environment, oldest-baseline/native- trust cells, and the paired legacy performance baseline remain release/default-path blockers. No