[ABI] Route staged ABIs through candidate bottles - #1250
Merged
Conversation
This reverts commit f3f1625.
MariaDB now declares the normal automatic fork-instrumentation policy when it publishes both server and mysqltest artifacts into a sealed resolver output. This preserves the artifact guard instead of bypassing it after the hosted builds complete. The msmtpd source now comes from an immutable Debian snapshot of the byte-identical upstream archive and honors resolver-provided source metadata. This avoids depending on the currently unreachable upstream download host. Regenerate the affected package identities and ABI staging request-policy digest, and cover both boundaries in the isolated-output contract test.
…tic/kandelo into abi-staging-exact-route # Conflicts: # abi/staging/request-policy.generated.json
The ordinary browser suite discovered the assembled-site proof without the sealed producer tree that test requires, so the staging aggregate failed after every package and product build had passed. Exclude that proof unless its exact site-root authority is present. The dedicated atomic Pages gate still supplies the root and runs all five Chromium cases. Regenerate the protected browser evidence and request-policy identities for the selection change.
…' into abi-staging-exact-route # Conflicts: # abi/staging/request-policy.generated.json
Hosted ABI staging reached the browser gate after every package and non-browser test passed, then rejected the valid 546 MiB LAMP image because its conservative per-block zstd bound exceeded the 1 GiB lifecycle ceiling. The broad Playwright suite also discovered the protected product-evidence spec without its runner-owned handoff. Use an exact declared zstd content size when present while retaining the conservative bound for frames that omit it and the post-decompression byte check. Exclude protected product evidence from ordinary discovery unless both handoff paths exist, while keeping explicit direct invocations fail-closed. Refresh the protected evidence and request-policy identities.
…' into abi-staging-exact-route # Conflicts: # abi/staging/request-policy.generated.json
…' into abi-staging-exact-route # Conflicts: # abi/staging/request-policy.generated.json
…' into abi-staging-exact-route
# Conflicts: # .github/actions/detect-change-scope/ci-scope-paths.sh # .github/scripts/test-merge-candidate-workflows.sh # abi/staging/request-policy.generated.json # abi/staging/request-policy.toml # docs/superpowers/plans/2026-08-11-abi-bottle-staging-cutover.md # tools/xtask/src/abi_staging/check_projection.rs # tools/xtask/src/abi_staging/mini_lifecycle.rs # tools/xtask/src/abi_staging/mod.rs
brandonpayton
changed the base branch from
emdash/homebrew-pr-staging-1q1w6
to
main
August 12, 2026 14:40
brandonpayton
added a commit
that referenced
this pull request
Aug 12, 2026
## Why Protected ABI staging currently fails before it can evaluate candidate artifacts on a cold hosted Linux runner for two independent reasons. First, the Pages runtime builder lets Nix and `tsx` create an inter-process communication socket below the long artifact output path. The resulting Unix-domain socket path can exceed Linux's 108-byte limit, preventing the inert Pages canary from reaching the candidate runtime. Second, protected request derivation reads repository-owned product inputs from the exact candidate checkout, but hosted shallow checkouts leave the musl gitlink uninitialized. The developer SDK product therefore cannot read `libc/musl/COPYRIGHT`, and request derivation fails before classification. The related Rust target parsing failure was fixed independently by #1255 and #1256. ## What changed - Put transient runtime IPC in a private, bounded `/tmp` directory while keeping the candidate home and all durable artifacts under the sealed runtime output root. - Delete that transient directory after both successful and failed runtime preparation. - Materialize the candidate's exact musl gitlink through protected code from one fixed public mirror, without consulting candidate `.gitmodules` data or exposing GitHub credentials. - Test hostile musl remotes, wrong commits, symlinks, unavailable objects, Linux socket-length limits, and cleanup boundaries. - Advance the protected request policy exactly once, from version 10 to 11, and regenerate its implementation projection. ## Validation The exact current head is `ce46414d374782a8fed29fec7f8c29ded410c16e`. Fresh local validation through `scripts/dev-shell.sh`: - Exact runtime preparation suite: passed twice, including cleanup after a rejected artifact. - Exact anonymous candidate checkout, fixed-mirror musl materialization, classification, and request requirements: passed for all 33 Formulae. - Request-policy tests: 7/7; generated policy freshness: passed. - Request-feed tests: 23/23 and all shell contracts passed. - PR-check, request-feed, and merge-gate workflow mutation contracts: passed. - Pages deployment contract: passed and rejected all hostile mutations. - Actionlint, shell syntax, and Git diff whitespace checks: passed. Fresh hosted staging for this exact head is the remaining pre-merge gate. ## Bootstrap boundary The two protected `pull_request_target` workflows execute their definitions and helper code from protected `main`. They therefore cannot consume this workflow repair while it is still only in the pull request. They are expected to remain red until the protected helper lands. The rollout uses the uncredentialed exact-head staging workflow plus the local protected mutation gates as bootstrap evidence, then reruns request derivation, the PR check, and the Pages canary from protected `main` immediately after the merge. ## Rollout boundary This pull request does not publish packages, deploy Pages, promote bottles, or change the Kandelo ABI. It repairs protected read-only preparation paths so hosted staging and the Pages canary can produce trustworthy evidence before #1250 is merged.
# Conflicts: # abi/staging/request-policy.generated.json
Preserve the exact ABI route while merging the protected Pages runtime and archive retry boundary from main. Regenerate request-policy version 13 from the combined implementation identity, and make the exact-evidence hostile mutation portable so the workflow contract cannot false-pass on BSD sed.
Accept the exact Linux compatibility lock retained by the protected CI run after the signed Homebrew formula API advanced binaryen to 132 and gdk-pixbuf to 2.44.8. The artifact changes only the mirrored internal/public versions, source and bottle checksums, and source URLs for those two formulae.
brandonpayton
added
the
ready-to-ship
Contributor
|
prepare-merge: runtime/materialization tests passed against the synthetic PR merge; package staging and durable package publishing were skipped. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
ABI-changing pull requests still run Kandelo's legacy package-build matrix,
even though the Formula outputs that matter are now built as candidate bottles
in
kandelo-dev/homebrew-tap-coreand checked by protected product evidence.That makes the ABI 43 work wait on release-package rebuilds whose bytes the
bottle-first path will not consume.
This pull request adds the protected routing needed to stop paying that cost on
the first later ABI pull request. The exact candidate and evidence contracts
from #1247 are now on
main. The rollout remains inert: the checked-inactivation mode is still
observe.What changed
typed activation record.
cells for both pull-request heads and synthesized merge commits.
writes, and package publication jobs when the exact route is enforced.
source/prepared classification drift before tests run.
jobs, reject symlinked workspace inputs, and keep Automattic GHCR outside the
route entirely.
Validation
Homebrew closure gates passed through
scripts/dev-shell.sh.actionlintpassed for staging, prepare-merge, and protected merge-gateworkflows.
policy freshness checks passed; the miniature ABI lifecycle passed.
vitest exact-abi-sourcelane passed 126 files and 1,692 tests,with two files and three tests intentionally skipped by their declarations.
Rollout boundary
This pull request does not activate the route and does not publish or deploy
anything. A later change must switch the protected activation to
enforce,then run the real ABI 43 pull request as the hosted cutover canary. The full
libc, POSIX, and Sortix exact-route matrix was not run locally; that hosted
canary is the evidence boundary for those cells and for proving the legacy
package matrix is actually skipped.