Repository navigation
Prepare v0.1.1 release evidence without publishing - #277
Conversation
joshyorko
changed the title
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Raise the Tokio minimum to the advisory-patched version and document the legacy constructor limitation.
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Isolated candidate acceptance receipts (not final release evidence)The following is the raw machine-readable report for isolated candidate The raw report SHA-256 was {
"operator_dogfood_included": true,
"status": "pass",
"steps": [
{
"label": "child-reaper-tests",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/child-reaper-tests.log",
"status": "pass"
},
{
"label": "dogfood-compose-project-tests",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/dogfood-compose-project-tests.log",
"status": "pass"
},
{
"label": "release-evidence-tests",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/release-evidence-tests.log",
"status": "pass"
},
{
"label": "native-mismatch-diagnostic-tests",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/native-mismatch-diagnostic-tests.log",
"status": "pass"
},
{
"label": "native-release-build-env-tests",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/native-release-build-env-tests.log",
"status": "pass"
},
{
"label": "release-publisher-tests",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/release-publisher-tests.log",
"status": "pass"
},
{
"label": "oci-layer-evidence-tests",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/oci-layer-evidence-tests.log",
"status": "pass"
},
{
"label": "cargo-fmt",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/cargo-fmt.log",
"status": "pass"
},
{
"label": "git-diff-check",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/git-diff-check.log",
"status": "pass"
},
{
"label": "cargo-test",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/cargo-test.log",
"status": "pass"
},
{
"label": "doctor-json",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/doctor-json.log",
"output": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/doctor.json",
"status": "pass"
},
{
"label": "eval-substrate-compare-json",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/eval-substrate-compare-json.log",
"output": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/eval-substrate-compare.json",
"status": "pass"
},
{
"label": "eval-procedures-json",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/eval-procedures-json.log",
"output": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/eval-procedures.json",
"status": "pass"
},
{
"label": "perf-json",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/perf-json.log",
"output": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/perf.json",
"status": "pass"
},
{
"label": "demo-substrate-dry-run",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/demo-substrate-dry-run.log",
"status": "pass"
},
{
"label": "dogfood-write-sandbox-dry-run",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/dogfood-write-sandbox-dry-run.log",
"status": "pass"
},
{
"label": "release-required-files",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/release-required-files.log",
"status": "pass"
},
{
"label": "dogfood-compose-heartbeat",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/dogfood-compose-heartbeat.log",
"status": "pass"
},
{
"label": "dogfood-compose-down-before-native",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/dogfood-compose-down-before-native.log",
"status": "pass"
},
{
"label": "native-runtime-start",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/native-runtime-start.log",
"status": "pass"
},
{
"label": "native-runtime-status",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/native-runtime-status.log",
"status": "pass"
},
{
"label": "native-runtime-smoke",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/native-runtime-smoke.log",
"status": "pass"
},
{
"label": "native-runtime-restart-survival",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/native-runtime-restart-survival.log",
"status": "pass"
},
{
"label": "native-runtime-stop",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/native-runtime-stop.log",
"status": "pass"
},
{
"label": "dogfood-write-sandbox-run",
"log": "/workspace/scratch/issue-269/acceptance-3cebac0-gate/logs/dogfood-write-sandbox-run.log",
"status": "pass"
}
],
"suite": "v0.1-release-gate",
"tag_caveat": null
}The cloud network requires a proxy CA. The Dockerfile overlay used SHA-256 --- Dockerfile
+++ acceptance-Dockerfile
@@ -12,10 +12,10 @@
COPY migrations ./migrations
# Create a stub lib/bin so `cargo build` can resolve+compile dependencies and
# cache them in a separate layer before the real sources are copied.
-RUN mkdir -p src \
+RUN --mount=type=secret,id=proxy_ca,required=true mkdir -p src \
&& echo "fn main() {}" > src/main.rs \
&& echo "" > src/lib.rs \
- && cargo build --release --locked --quiet
+ && CARGO_HTTP_CAINFO=/run/secrets/proxy_ca cargo build --release --locked --quiet
# Now copy the real source and build for real.
COPY src ./src
@@ -25,8 +25,8 @@
# not the .rs test files, so the container build matches a host build exactly.
COPY tests/fixtures ./tests/fixtures
# Touch sources so cargo rebuilds them (stub timestamps are older).
-RUN touch src/main.rs src/lib.rs \
- && cargo build --release --locked \
+RUN --mount=type=secret,id=proxy_ca,required=true touch src/main.rs src/lib.rs \
+ && CARGO_HTTP_CAINFO=/run/secrets/proxy_ca cargo build --release --locked \
&& strip target/release/codex-memoryd
# ---- Runtime ----------------------------------------------------------------Compose override SHA-256 services:
codex-memoryd:
build:
dockerfile: /workspace/scratch/issue-269/acceptance-Dockerfile
secrets:
- source: proxy_ca
target: proxy_ca
secrets:
proxy_ca:
file: ${CODEX_PROXY_CERT}Build output recorded the overlay and the image ID below; the source build step was cached. This is a local fixture image ID, not an OCI registry digest or release artifact. The local Compose container was stopped and the fixture image removed after testing. The report intentionally excludes fixture memory contents and raw logs. A final merged-source acceptance and actual release artifact/provenance verification remain pending. |
Isolated acceptance for corrected head
|
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Final merged-source isolated acceptanceAll 25 steps passed in an isolated cloud fixture at merged source commit The checkout built The run used Raw report SHA-256: {
"operator_dogfood_included": true,
"status": "pass",
"steps": [
{
"label": "child-reaper-tests",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/child-reaper-tests.log",
"status": "pass"
},
{
"label": "dogfood-compose-project-tests",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/dogfood-compose-project-tests.log",
"status": "pass"
},
{
"label": "release-evidence-tests",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/release-evidence-tests.log",
"status": "pass"
},
{
"label": "native-mismatch-diagnostic-tests",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/native-mismatch-diagnostic-tests.log",
"status": "pass"
},
{
"label": "native-release-build-env-tests",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/native-release-build-env-tests.log",
"status": "pass"
},
{
"label": "release-publisher-tests",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/release-publisher-tests.log",
"status": "pass"
},
{
"label": "oci-layer-evidence-tests",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/oci-layer-evidence-tests.log",
"status": "pass"
},
{
"label": "cargo-fmt",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/cargo-fmt.log",
"status": "pass"
},
{
"label": "git-diff-check",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/git-diff-check.log",
"status": "pass"
},
{
"label": "cargo-test",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/cargo-test.log",
"status": "pass"
},
{
"label": "doctor-json",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/doctor-json.log",
"output": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/doctor.json",
"status": "pass"
},
{
"label": "eval-substrate-compare-json",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/eval-substrate-compare-json.log",
"output": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/eval-substrate-compare.json",
"status": "pass"
},
{
"label": "eval-procedures-json",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/eval-procedures-json.log",
"output": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/eval-procedures.json",
"status": "pass"
},
{
"label": "perf-json",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/perf-json.log",
"output": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/perf.json",
"status": "pass"
},
{
"label": "demo-substrate-dry-run",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/demo-substrate-dry-run.log",
"status": "pass"
},
{
"label": "dogfood-write-sandbox-dry-run",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/dogfood-write-sandbox-dry-run.log",
"status": "pass"
},
{
"label": "release-required-files",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/release-required-files.log",
"status": "pass"
},
{
"label": "dogfood-compose-heartbeat",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/dogfood-compose-heartbeat.log",
"status": "pass"
},
{
"label": "dogfood-compose-down-before-native",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/dogfood-compose-down-before-native.log",
"status": "pass"
},
{
"label": "native-runtime-start",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/native-runtime-start.log",
"status": "pass"
},
{
"label": "native-runtime-status",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/native-runtime-status.log",
"status": "pass"
},
{
"label": "native-runtime-smoke",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/native-runtime-smoke.log",
"status": "pass"
},
{
"label": "native-runtime-restart-survival",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/native-runtime-restart-survival.log",
"status": "pass"
},
{
"label": "native-runtime-stop",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/native-runtime-stop.log",
"status": "pass"
},
{
"label": "dogfood-write-sandbox-run",
"log": "/workspace/scratch/issue-269/acceptance-c28ace6-gate/logs/dogfood-write-sandbox-run.log",
"status": "pass"
}
],
"suite": "v0.1-release-gate",
"tag_caveat": null
}Afterward the daemon had no containers, port 8787 had no listener, and the fixture image was removed after its ID matched the build log. This evidence exercises the tag-required lane in a synthetic isolated environment; it does not establish deployment acceptance or identify a released artifact. Final published hashes, attestations, Homebrew version and GHCR digest remain pending. |
Latest head:
81068a4fb0aa0e657f755a98a5bc8132d0e76fcc. Sol found that a tag could move during release publication after the last pre-publication source check. The publisher now checks that the newly immutable release's frozen tag still resolves to the approved commit before verifying its release and assets. A disposable Git/fake-GitHub regression reproduces the move during PATCH, failed on the prior workflow and passes on this head. The 20 publisher tests, 30 release tests, OCI tests and actionlint passed; the full synthetic gate also passed locally on exact head81068a4fb0aa0e657f755a98a5bc8132d0e76fcc, using a temporary target-directory symlink to the worker's build cache (removed after the run). Its operator dogfood lane was skipped. PR CI and all 19 jobs of the reproducibility preflight passed on GitHub synthetic mergef6f1b7421f621599796bb695da0ca8b0eab2c9bf, whose tree is identical to this head and whose parents are current master and this head. All four native and both OCI pairs matched. The focused release/OCI tests and actionlint also passed in a checkout of the exact head. The earlier intermittent macOS ARM mismatch remains unexplained; these candidate comparisons do not establish reproducibility for the eventual release commit. Sol independently re-reviewed this exact head and the unchanged Homebrew head9475ba7fe01d526e68e6fabb11576bb4d124aa79, verified the tag-movement fix with a separate race probe, and reported no remaining safety findings in scope. This is not a GitHub approval; the exact-head connector review is still pending. Isolated acceptance receipts for this exact head include the raw 25-step passing report and build identity. The fixture used the temporary proxy-CA overlay. These are candidate results, not final merged-source or published-artifact evidence.The PID-safety fix was merged in #275. This draft prepares the v0.1.1 source and a manually invoked publisher. No release, image, tap update, or deployment has been made.
rustls-webpkito 0.103.16 for RUSTSEC-2026-0382, and raise the direct Tokio minimum and lock to 1.53.3 for RUSTSEC-2026-0386. Tokio's deprecated legacyAsyncFdconstructors remain callable and are not made sound by a version update; a static search found no use outside Tokio in the production graphs for the four release targets.latestis not moved.4dbfceb35494af71ca286dbd3fd8a1bf62d2dd02found that an OCI version tag could move between platform validation and selection of the attestation subject. The publisher now resolves one index digest, validates the platform list through that digest, and attests the same digest. A later check rejects a tag that no longer points to the subject. Regression tests execute the workflow shell with a disposable fake registry, including movement between reads, movement after selection, an invalid selected index, and an unchanged tag. The movement-between-reads regression failed on the prior workflow and passes on this candidate. Registry publication and attestation remain untested.3cebac0f2d3de9f7530feb61254594e6d2bd8dfe, with a temporary proxy-CA Dockerfile overlay. Final merged-source acceptance remains pending; fixed container/image names, port, host-memory mount, database writes, and Dreamer apply require separate isolation and authorization.Validation of earlier head
3cebac0f2d3de9f7530feb61254594e6d2bd8dfe: its tree exactly matches locally tested commit4e4dd2db16a053f2b66c54e0dec9785281643d4e. The 19 focused publisher tests passed, including actual workflow-shell tests for mutable publication and changed downloaded assets. The full synthetic gate and isolated dogfood gate passed locally; the latter used a temporary proxy-CA Dockerfile overlay. The exact-head PR gate passed. The release preflight failed the macOS ARM binary comparison (17 jobs passed, one failed, one skipped); independent review remains pending. Diagnostic output found differences in unwind metadata, UUID and code signature, while executable code sections matched. The runners reported different macOS versions, but an earlier failure occurred with matching runner images, so a root cause has not been established. Reproducibility has not been waived.Earlier validation of candidate head
1aa0e3e0115bcd71a48b391807a57ffb966e8426:cargo check --locked --all-targets, 11 HTTP tests, 14 native PID-safety tests, the MCP interoperability test, five native process-handle tests, and 16 publisher tests passed. The scoped publisher workflow passed actionlint. The earlier actionlint run on the unchanged preflight reported its old runner-label list did not recognize GitHub'smacos-15-intel; the preflight lint passed with only that known-label diagnostic excluded.6715b2007a46cb32c0c0af10bc4267bfbeeaf46c6b722ffef20ba0d3e367fcba) and each passed a disposable lifecycle smoke. These are experimental candidate binaries, not published artifacts.5dc587e95fd62a6ad049539e4c12d54fb002ea89; those results are not evidence for the eventual release commit.269d640eea05a3f7aec0f21f000d0ff4f0dc29db, finding no unresolved safety issues in the reviewed scope. Sol reproduced the old OCI race and tested the corrected digest binding, 34 upstream Python checks, 32 tap checks, 24 Rust provider/native checks, and an isolated lifecycle smoke. This is review evidence, not a GitHub approval. The connector review of this head completed without findings.Publication of v0.1.1 is conditionally authorized only after required acceptance, review, and provenance gates pass. The publisher verifies immutability after publishing rather than requiring an Administration:read secret. No credentials were created. Publication may leave a draft or public release or versioned image on failure, so inspect state before retry. Deployment remains separately controlled.
PRE_RELEASE_ACCEPTANCE: PENDING
This is a pre-release handoff, not deployment authorization. The candidate branch head is
81068a4fb0aa0e657f755a98a5bc8132d0e76fcc; the final merged release commit, tag, published checksums, Homebrew version, GHCR digest and attestations are pending. Earlier GitHub synthetic merge5dc587e95fd62a6ad049539e4c12d54fb002ea89tested the previous head, not this one. The prior isolated candidate acceptance debug binary SHA-256 was0214224857cca6058a9998abe12d272dcbf81c1b5aeeb14fcc71bd6a674697a1; the matching Linux release candidates are recorded above. These are experimental builds, not published artifacts or expected cross-machine hashes.The coordinator must establish an explicitly authorized isolated environment with its own Docker daemon, container/image namespace, loopback port, checkout, HOME/memory mount, runtime directory, and databases. Do not run this lane on the live host merely by changing the Compose project name: it uses a fixed container name, image and port, mounts host memories, applies sync to
.dogfood/memory.db, enables Dreamer automatic apply, and refreshes sandbox databases. The coordinator must determine whether a safely isolated copy provides the required operator evidence; synthetic evidence alone is not assumed to satisfy the dogfood gate.After the final release source settles, use a fresh checkout, verify its full commit SHA and clean tracked state, and ensure copied Docker build-context paths contain no extra files. Build
target/debug/codex-memorydwithcargo build --locked --bin codex-memoryd, record its SHA-256, and confirmnative-lifecycle-protocolprintsmemoryd-pidfd-v1. Ensure gate, native-helper and sandbox binary overrides select that build. Only within the approved isolated environment, runscripts/v0.1-release-gate.sh --include-dogfood --artifact-dir <new-empty-report-directory>without the child-reaper launcher.The report must say
status: pass,operator_dogfood_included: true, and have no skipped or failed steps; verify the required labels with the jq command in the linked handoff. The report does not itself prove source identity, so supply a separate content-free source/build receipt. Do not share memory contents or raw logs. Never use the vulnerable v0.1.0 nativedownorrestartbased on a PID file; use the verified original supervisor or terminal and preserve the database and backups.DEPLOYMENT_READYremains BLOCKED / NOT_READY until acceptance, publication and verification of actual artifacts and provenance are complete. Deployment remains a separate coordinator action.