Pages: Prepare runtime from sealed inputs - #1258
Open
brandonpayton wants to merge 2 commits into
Open
Conversation
The protected Pages canary built its browser runtime before the canonical shell and support programs existed in its isolated package cache. Vite therefore fell back to missing source-worktree program paths on clean hosted runners. Materialize the exact current product inputs first, require the runtime preparer to receive that explicit real cache root through both clean environment boundaries, and fail closed on relative, symlinked, or source-contained cache paths. Bind the behavior in request policy version 12 and add executable workflow mutations for the ordering and cache handoff.
brandonpayton
added
ready-to-ship
Exact merge preparation can materialize more than seventy immutable GitHub Release assets. The existing three fixed retries covered only ten seconds of content-delivery-network failure and twice stranded an otherwise-green synthetic merge. Give archive bodies eight attempts with capped exponential backoff while preserving the existing one-hour download deadline, digest checks, provenance validation, resumable transfer, and short retry budget for metadata documents. Cover recovery after four transient failures and bind the 155-second maximum wait in tests and documentation.
brandonpayton
added
the
ready-to-ship
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The protected Pages canary builds an exact browser runtime from the
current protected
maincommit. That build imports the canonical shelland support programs, but the workflow attempted it before those sealed
inputs existed in its isolated package cache. Clean hosted runners
therefore failed on missing
shell.vfs.zstandcurl.wasmpaths beforethey could prove the assembled Pages site.
This blocks the protected hosted canary required before activating ABI
staging and testing the ABI 43 batch. The runtime must consume the same
exact inputs that later product recomposition uses, without falling back
to ambient files or exposing write credentials.
Protected merge rehearsal also revealed that reading more than seventy
immutable GitHub Release assets can outlast the resolver's old ten-second
retry window during a content-delivery-network outage. Those failures
must remain bounded and retryable without weakening byte or provenance
validation.
What changed
boundaries.
and reject symlinked ancestors.
handoff edges.
while keeping metadata reads on their smaller retry budget.
checks, provenance validation, and fail-closed protocol handling.
Validation
scripts/dev-shell.sh bash scripts/test-abi-staging-prepare-runtime.shscripts/dev-shell.sh bash scripts/test-pages-deployment-contract.shremote_fetchRust testsEight unrelated check-projection fixtures use a pre-existing empty
component inventory, and one product-manifest test needs the absent
local musl submodule file.
rustfmt --edition 2024 --check tools/xtask/src/remote_fetch.rsgit diff --checkHosted staging for exact head
b5c4fb7e9c393463e9de1dd18128fe33559b105eis running. Its firstpreflight attempt failed before compiling xtask because GitHub returned
503 for Nix's pinned
flake-utilstarball across every built-in andworkflow retry. Independent test jobs continue, and the failed job will
be rerun on this same immutable head after the upstream endpoint
recovers.
Rollout
This remains an inert, read-only protected-main canary. It does not
deploy Pages, publish packages, mutate the tap, or enable ABI staging.
After merge, the protected-main canary will supply the hosted evidence
needed for the separate activation step.