Repository navigation
NODEOS-001: reproducible Haswell/Pascal appliance bootstrap - #1
Merged
Merged
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The current payload verification and evidence-generation scripts have concrete correctness/security/performance issues (unmanifested payload files can slip through, large artifacts are hashed via full reads, and CUDA probe/version parsing can fail in non-actionable ways).
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (4)
What changed in this PR
This PR establishes the first reproducible NodeOS “appliance bootstrap” path for the NODEOS-001 Haswell (i7‑4770K) + Pascal (GTX 1070 Ti) target, including a pinned Buildroot-based image build, a fail-closed CUDA readiness boundary, and CI contract checks to keep the substrate reproducible.
Changes:
- Adds a pinned Buildroot 2026.08-based build workflow (defconfig + build script) that emits evidence-hashed artifacts.
- Introduces a vendor-payload boundary for proprietary NVIDIA bits, plus a CUDA smoke probe and verification scripts.
- Adds a NODEOS-001 bring-up runbook and a CI workflow gate validating layout/contracts and defconfig invariants.
| File | Description |
|---|---|
vendor/nvidia/README.md |
Documents the proprietary NVIDIA payload boundary and expected overlay layout. |
vendor/nvidia/manifest.example.json |
Example manifest format for digest-binding vendor payload contents. |
tools/cuda/nodeos_cuda_probe.cu |
CUDA smoke probe source emitting JSON PASS/FAIL evidence. |
scripts/verify-nvidia-payload.py |
Verifies payload manifest schema/CC binding and file digests before overlaying. |
scripts/verify-layout.py |
CI gate ensuring required NODEOS-001 files exist and basic invariants hold. |
scripts/hash-artifacts.py |
Generates SHA-256 evidence JSON for produced build artifacts. |
scripts/build-nodeos.sh |
Builds the pinned Buildroot profile and emits artifacts/evidence. |
scripts/build-cuda-probe.sh |
Offline-build helper for the sm_61 CUDA probe binary. |
README.md |
Updates top-level documentation to NODEOS-001 target + build instructions + CUDA boundary. |
docs/NODEOS-001-bringup.md |
NODEOS-001 acceptance/runbook checklist and direct-LAN baseline. |
contracts/nodeos-001-evidence-v1.schema.json |
Schema for build evidence JSON emitted by the build pipeline. |
buildroot/package/nodeos-agent/src/nodeos-agent |
Minimal inventory/readiness agent emitting /run/nodeos/capability.json and /run/nodeos/ready. |
buildroot/package/nodeos-agent/nodeos-agent.mk |
Buildroot package definition for installing nodeos-agent. |
buildroot/package/nodeos-agent/Config.in |
Buildroot Kconfig entry for enabling nodeos-agent. |
buildroot/external.mk |
Includes external package .mk files for the BR2_EXTERNAL tree. |
buildroot/external.desc |
Declares the BR2_EXTERNAL tree name/description. |
buildroot/configs/resonarch_haswell_gtx1070ti_defconfig |
Buildroot defconfig for the x86_64 EFI/GRUB2 disk image profile and required packages. |
buildroot/Config.in |
Top-level external-tree menu hooking in NodeOS package configs. |
buildroot/board/resonarch/haswell-gtx1070ti/rootfs-overlay/usr/sbin/nodeos-cuda-smoke |
Runtime CUDA readiness gate wrapper that records JSON output under /run/nodeos/. |
buildroot/board/resonarch/haswell-gtx1070ti/rootfs-overlay/etc/nodeos/nodeos.conf |
Default NodeOS config (static IP baseline, agent interval). |
buildroot/board/resonarch/haswell-gtx1070ti/rootfs-overlay/etc/issue |
Appliance login banner text. |
buildroot/board/resonarch/haswell-gtx1070ti/rootfs-overlay/etc/init.d/S90nodeos-agent |
SysV init script launching the agent and maintaining a PID file. |
buildroot/board/resonarch/haswell-gtx1070ti/rootfs-overlay/etc/init.d/S20nodeos-net |
SysV init script configuring static IP or DHCP on first non-loopback interface. |
buildroot/board/resonarch/haswell-gtx1070ti/post-build.sh |
Post-build hook that overlays vendor payload rootfs (if verified) and records manifest state. |
buildroot/board/resonarch/haswell-gtx1070ti/linux-nodeos.fragment |
Kernel fragment enabling required modules/NICs and disabling nouveau. |
.github/workflows/nodeos-001-contract.yml |
CI workflow validating repo layout/contracts, shell parsing, and defconfig olddefconfig gate. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+14
to
+23
| for entry in manifest.get("files", []): | ||
| path = root / entry["path"] | ||
| if not path.is_file(): | ||
| raise SystemExit(f"payload file missing: {entry['path']}") | ||
| digest = hashlib.sha256(path.read_bytes()).hexdigest() | ||
| if digest != entry["sha256"]: | ||
| raise SystemExit(f"payload digest mismatch: {entry['path']}") | ||
| if not (root / "rootfs/usr/libexec/nodeos-cuda-probe").is_file(): | ||
| raise SystemExit("payload must include rootfs/usr/libexec/nodeos-cuda-probe") | ||
| print("NODEOS NVIDIA payload: PASS") |
Comment on lines
+6
to
+11
| version_line="$(nvcc --version | grep 'release ' | tail -n1)" | ||
| major="$(printf '%s' "$version_line" | sed -n 's/.*release \([0-9][0-9]*\)\..*/\1/p')" | ||
| if [[ -z "$major" || "$major" -ge 13 ]]; then | ||
| echo "sm_61 offline compilation requires CUDA 12.x-or-older; found: $version_line" >&2 | ||
| exit 1 | ||
| fi |
Comment on lines
+9
to
+17
| artifact_dir = Path(sys.argv[1]).resolve() | ||
| artifacts = [] | ||
| for name in ("disk.img", "bzImage", "rootfs.ext2"): | ||
| path = artifact_dir / name | ||
| artifacts.append({ | ||
| "name": name, | ||
| "bytes": path.stat().st_size, | ||
| "sha256": hashlib.sha256(path.read_bytes()).hexdigest(), | ||
| }) |
Comment on lines
+35
to
+40
| const bool pass = host == 0x4e4f4445u; | ||
| std::printf( | ||
| "{\"schema\":\"resonarch.nodeos.cuda-smoke.v1\",\"status\":\"%s\"," | ||
| "\"device\":\"%s\",\"compute_capability\":\"%d.%d\",\"word\":\"0x%08x\"}\n", | ||
| pass ? "PASS" : "FAIL", prop.name, prop.major, prop.minor, host); | ||
| return pass ? 0 : 1; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NODEOS-001
Implements the first reproducible NodeOS appliance path for the i7-4770K + GTX 1070 Ti target.
Included
Claim boundary
This establishes a reproducible boot/build/control substrate. A physical NODEOS-001 PASS still requires booting the generated image on the Haswell/GTX 1070 Ti machine and supplying a verified proprietary NVIDIA driver/runtime payload so the sm_61 CUDA smoke gate can pass.
CI for the current head is green.