From fea8e4ad1247bb4c895d7928ace255d75f36b02f Mon Sep 17 00:00:00 2001 From: Jinwoo-H Date: Thu, 16 Jul 2026 08:09:18 -0400 Subject: [PATCH] docs: record source tree contract CI Co-authored-by: Orca --- ...elease-implementation-checklist-summary.md | 11 ++- ...github-release-implementation-checklist.md | 83 +++++++++++++++---- 2 files changed, 77 insertions(+), 17 deletions(-) diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md index d4dd156931f..e4de050b23f 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist-summary.md @@ -10,14 +10,21 @@ A checked box means the work has evidence in the detailed ledger. Design approva complete a box. Active checkpoint: **Milestone 6 / Work Package 5 bounded runtime transfer — disconnected -transport-neutral source-tree contract is locally green; exact-head native proof next, 2026-07-15, -Codex implementation owner.** +transport-neutral source-tree contract CI is closed; audit only the full-tree source pre-scan next, +2026-07-15, Codex implementation owner.** `E-M6-SOURCE-TREE-CONTRACT-AUDIT-001` fixes a pure ready-acquisition → immutable descriptor boundary: exact verified manifest/cache identity and signed limits, deterministic ASCII ordering, client-native paths, borrowed live-lease assertion, and later shared use by pre-scan plus SFTP, POSIX tar/no-tar, and Windows PowerShell/.NET transfer. It performs no I/O and owns no cleanup; filesystem enumeration, streaming, SSH, remote writes/install, product/mode/fallback/default wiring, publication, and SignPath remain absent. +`E-M6-SOURCE-TREE-CONTRACT-CI-001` closes exact implementation commit `2f38700b9`: all six primary +native Node 24 clients, both Linux supplements, Windows x64 baseline, PR Checks, Golden E2E, and +computer-use pass. Windows arm64 retains only the declared hosted build-26200 rejection against +26100 after complete Node/PTY/watcher/tree proof. Every client passes the ten-case source-tree suite; +Windows totals are 87 files / 680 passed / 14 skipped and POSIX totals are 86 files / 689 passed / one +skip. Full-size extraction/cache metrics remain in budget. Filesystem pre-scan/mutation proof, SSH, +remote writes/install, product/mode/fallback/default wiring, publication, and SignPath remain absent. `E-M6-SOURCE-TREE-CONTRACT-LOCAL-RED-001` records the expected missing-module failure for ten purpose cases and the native-workflow oracle's six-pass/one-fail result: the suite occurs only in the oracle, not either runner command. `E-M6-SOURCE-TREE-CONTRACT-LOCAL-CONTENTION-001` rejects an overlapping diff --git a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md index e577c4bcd58..6fd978b643c 100644 --- a/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md +++ b/docs/reference/plans/2026-07-14-ssh-relay-github-release-implementation-checklist.md @@ -8,8 +8,8 @@ work; keep exact commands, runner identities, hashes, metrics, and residual gaps Date created: 2026-07-14
Last updated: 2026-07-15
-Current phase: Milestone 6 / Work Package 5 bounded runtime transfer — **In progress — 2026-07-15, Codex implementation owner: exact-head native proof for the locally green disconnected transport-neutral verified source-tree contract**. Keep every capability disconnected from every production/default SSH path. Real Apple/SignPath rehearsals remain an explicit late gate and are not on this package's critical path.
-Session checkpoint: **SOURCE-TREE CONTRACT LOCAL GREEN / EXACT-HEAD CI NEXT — 2026-07-15, Codex implementation owner** — `E-M6-SOURCE-TREE-CONTRACT-LOCAL-001` passes purpose, workflow, focused, broad relay, release-script, typecheck, lint, format, max-lines, diff, protected-resolver, and no-product-caller gates after separately rerunning two contention-invalidated broad commands. Commit and push the isolated package, then require exact-head all-six native proof before checking the Milestone 6 item or advancing to pre-scan. Do not enumerate the filesystem, open SSH channels, transfer/install bytes, add a product caller, settings/fallback wiring, tuple enablement, publication, or default behavior. Merging to `main` remains prohibited, SignPath is deferred, and legacy remains the production default.
+Current phase: Milestone 6 / Work Package 5 bounded runtime transfer — **In progress — 2026-07-15, Codex implementation owner: audit only the smallest disconnected full-tree source pre-scan after source-tree CI closure**. Keep every capability disconnected from every production/default SSH path. Real Apple/SignPath rehearsals remain an explicit late gate and are not on this package's critical path.
+Session checkpoint: **SOURCE-TREE CONTRACT CI CLOSED / PRE-SCAN AUDIT NEXT — 2026-07-15, Codex implementation owner** — `E-M6-SOURCE-TREE-CONTRACT-CI-001` closes exact-head all-six native client proof, both Linux supplements, Windows x64 baseline, PR Checks, Golden E2E, and computer-use; Windows arm64 retains only the declared build-26200/26100 runner mismatch after full runtime proof. Audit only a disconnected filesystem pre-scan that consumes the accepted source-tree contract and creates no remote files. Do not open SSH channels, transfer/install bytes, add a product caller, settings/fallback wiring, tuple enablement, publication, or default behavior. Merging to `main` remains prohibited, SignPath is deferred, and legacy remains the production default.
Primary design: [SSH relay GitHub Release plan](./2026-07-14-ssh-relay-github-release-plan.html)
Motivating issues: [#8450](https://github.com/stablyai/orca/issues/8450), [#1693](https://github.com/stablyai/orca/issues/1693) @@ -150,10 +150,10 @@ same change as the work it records. - Completed package: disconnected full host-evidence composition is green locally and on every primary native client under E-M5-HOST-EVIDENCE-COMPOSITION-LOCAL-001 and E-M5-HOST-EVIDENCE-COMPOSITION-CI-001. It has no product caller. -- Active package: **In progress — 2026-07-15, Codex implementation owner** — exact-head native proof - for Milestone 6's locally green pure transport-neutral verified source-tree contract. Do not - enumerate the filesystem, open SSH channels, transfer or install bytes, or add product/settings/ - fallback/tuple/publication/default behavior. +- Active package: **In progress — 2026-07-15, Codex implementation owner** — audit only Milestone + 6's smallest disconnected full-tree source pre-scan after source-tree CI closure. Do not open SSH + channels, transfer or install bytes, or add product/settings/fallback/tuple/publication/default + behavior. - Completed Work Package 2 gate: target-native Windows source-signature reports from exact-head artifact jobs 87267322867 and 87267322870 were independently downloaded and matched to their identities and signing-stage reports under E-M3-WINDOWS-SOURCE-SIGNATURE-CI-001. PR Checks @@ -1154,13 +1154,12 @@ Current behavior must not be assumed adequate for a much larger runtime: ### Shared transfer contract -- [ ] Define one transport-neutral source-tree contract based on the verified manifest. **In - progress — 2026-07-15, Codex implementation owner; audit complete under - E-M6-SOURCE-TREE-CONTRACT-AUDIT-001; RED and local green proof recorded under - E-M6-SOURCE-TREE-CONTRACT-LOCAL-RED-001 and E-M6-SOURCE-TREE-CONTRACT-LOCAL-001; exact-head - native proof required before completion.** +- [x] Define one transport-neutral source-tree contract based on the verified manifest. Completed by + E-M6-SOURCE-TREE-CONTRACT-AUDIT-001, E-M6-SOURCE-TREE-CONTRACT-LOCAL-RED-001, + E-M6-SOURCE-TREE-CONTRACT-LOCAL-001, and E-M6-SOURCE-TREE-CONTRACT-CI-001. - [ ] Pre-scan and reject local source mutation, symlinks, special files, extra files, and path - collisions before creating remote files. + collisions before creating remote files. **In progress — 2026-07-15, Codex implementation + owner: audit only; no tests or implementation yet.** - [ ] Stream files with bounded buffers; prohibit whole-tree memory materialization. - [ ] Pass one AbortSignal through enumeration, channel creation, reads, writes, permission repair, and remote cleanup. @@ -16205,6 +16204,58 @@ config/vitest.config.ts --maxWorkers=1 --silent=true config/scripts/ssh-relay-ru product/startup/settings/fallback/tuple/publication/default path remains absent; legacy remains the sole production/default path, every tuple stays disabled, and SignPath stays deferred. +### E-M6-SOURCE-TREE-CONTRACT-CI-001 — all six native clients accept the source-tree contract + +- Date/owner/source: 2026-07-15, Codex implementation owner; exact implementation commit + `2f38700b9844a5e8fd1afa6750d7793bcd57e69c` on draft PR + [#8741](https://github.com/stablyai/orca/pull/8741). SSH Relay Runtime Artifacts run + [29496035270](https://github.com/stablyai/orca/actions/runs/29496035270) checks out that exact SHA + and uses Node 24.18.0. +- All six primary native jobs pass: Windows x64 + [87613081678](https://github.com/stablyai/orca/actions/runs/29496035270/job/87613081678), Windows + arm64 [87613081711](https://github.com/stablyai/orca/actions/runs/29496035270/job/87613081711), + Darwin arm64 [87613081693](https://github.com/stablyai/orca/actions/runs/29496035270/job/87613081693), + Darwin x64 [87613081698](https://github.com/stablyai/orca/actions/runs/29496035270/job/87613081698), + Linux arm64 [87613081803](https://github.com/stablyai/orca/actions/runs/29496035270/job/87613081803), + and Linux x64 [87613081783](https://github.com/stablyai/orca/actions/runs/29496035270/job/87613081783). +- Native contract proof: every client passes all ten purpose cases in 104–442 ms. Both Windows jobs + pass 87 files / 680 tests with 14 declared skips; all four POSIX jobs pass 86 files / 689 tests + with one declared native-Windows skip. This executes signed Linux/Windows descriptor projection, + deterministic ordering, native paths, deep freezing, borrowed lease semantics, and all fail-closed + identity/aggregate/root cases on every supported client OS/architecture. +- Both Linux oldest-userland supplements pass: x64 + [87614003979](https://github.com/stablyai/orca/actions/runs/29496035270/job/87614003979) and arm64 + [87614004039](https://github.com/stablyai/orca/actions/runs/29496035270/job/87614004039). The Windows + x64 oldest-baseline job + [87615011157](https://github.com/stablyai/orca/actions/runs/29496035270/job/87615011157) passes. +- The Windows arm64 oldest-baseline job + [87615011206](https://github.com/stablyai/orca/actions/runs/29496035270/job/87615011206) verifies + the 60-entry / 42-file / 85,213,511-expanded-byte tree and content identity, Node v24.18.0 ABI 137, + PTY exit 23 and 37x101 resize, five watcher events, and two-second resource settlement. Smoke takes + 6,063.5099 ms at 48,398,336-byte RSS and full verification takes 8,392.7748 ms. Its only rejection + is observed Windows build 26200 against required 26100; platform/arm64 checks pass and residual + gaps are empty. The aggregate run conclusion is failure only because this declared runner mismatch + remains intentionally fail-closed. +- Full-size extraction remains within budgets at 1,162.28–5,633.09 ms and + 33,939,456–46,018,560 incremental RSS bytes. Cold immutable-cache publication stays at + 1,384.24–7,156.65 ms and 39,288,832–60,940,288 incremental RSS bytes; warm lookup stays at + 167.72–1,193.01 ms and 0–6,414,336 incremental RSS bytes. Retention stays at 10.56–126.99 ms and + eviction at 19.54–100.30 ms. Every measurement passes its existing budget. +- Adjacent exact-head checks pass: PR Checks run + [29496035043](https://github.com/stablyai/orca/actions/runs/29496035043), job + [87613080471](https://github.com/stablyai/orca/actions/runs/29496035043/job/87613080471); Golden E2E + run [29496036617](https://github.com/stablyai/orca/actions/runs/29496036617), macOS job + [87613085499](https://github.com/stablyai/orca/actions/runs/29496036617/job/87613085499) and Linux + job [87613085648](https://github.com/stablyai/orca/actions/runs/29496036617/job/87613085648); + computer-use run [29496035157](https://github.com/stablyai/orca/actions/runs/29496035157), Windows + job [87613080650](https://github.com/stablyai/orca/actions/runs/29496035157/job/87613080650) and + Ubuntu job [87613080659](https://github.com/stablyai/orca/actions/runs/29496035157/job/87613080659). +- Boundary/residual gaps: the accepted source-tree module still has no other `src/main` importer and + performs no I/O. GitHub client runners do not prove filesystem mutation races, live SSH, SFTP or + system-SSH channel behavior, remote staging/install, or full-size transfer. Pre-scan, streaming, + every product/settings/fallback/tuple/publication/default path, and SignPath remain open. Legacy + remains the sole production/default path and every tuple stays disabled. + ## Accepted Gaps No product gap is accepted merely because it appears in this list. Each entry requires explicit @@ -16263,9 +16314,11 @@ The project is not complete until every applicable item below is checked with ev ## Next Required Action -Commit and push the locally green Milestone 6 disconnected transport-neutral verified source-tree -contract, then require exact-head all-six native client proof plus adjacent PR checks before accepting -the item or advancing to the filesystem pre-scan package. +Audit only Milestone 6's smallest disconnected full-tree source pre-scan. Determine the exact +source-tree and lease inputs; bounded traversal and file-state snapshots; before/after mutation, +symlink/special/extra/missing/collision rejection; cancellation and resource ownership; and the +immutable output consumed by later transfer families before adding tests or implementation. The +pre-scan must create no remote files or open SSH channels. Do not enumerate the filesystem, open an SSH channel, transfer or install bytes, modify platform detection/selectors, add an Electron/startup consumer, mode wiring, fallback, tuple enablement, release publication, or default behavior.