Repository navigation
ci: update from the real published alpha.6 to each PR build, then Undo with --rollback-to (#89, #109) - #259
Merged
Merged
Conversation
andersalm
force-pushed
the
ci/89-cross-version-undo
branch
from
October 6, 2026 15:32
e9337e8 to
268582e
Compare
15 of 18 tasks
…me journey (#89) The journey built old and new from the same commit, so no check updated a real older release to new code (alpha.6's provider refusal #245, alpha.3's fresh install #238). Old is now the newest published release, pinned by release CID and SHA-256 in scripts/update-hop-previous-release.json: its Runtime, Home support and source installer, fetched by signed hash and cached by the pin in CI. The fixture republishes them under its disposable key, so the hop proves the published code and data layout, not the maintainer key. Home installs old, updates through System to this build, then this build refuses a tampered later release. Data is written after the update; a plain update to old is refused; `elastos update --rollback-to <old head>` restores old; Home starts again with the same account, preference and data. Refusal seeds install new, so this source's update code refuses every case. check-result is the CI verdict on result.json. VERSIONING.md moves the pin after each publish.
…5 minutes (#89) Each action names its commit with the version as a comment; the release policy test refuses a tag or a second commit under one version. The toolchain check reads the Rust version from that comment. The update journey's caps add up to 38 minutes, so the step allows 45 (about 15 expected) and the Mac job 120.
…ease (#89) On the Linux source gate the host reads as x86_64, and the pinned release has no x86_64-darwin build, so the low-reserve test failed with a KeyError before its refusal. The reserve now comes first, a release without this Mac's build is refused plainly, and the pin-mismatch test fixes the host and disk.
…fails (#89) result.json keeps only hashes of private output, so alpha.6's 'could not start' on the System update gave no cause. On a rehearsal failure the observer writes results/diagnostics: controller status.json, the Home start, System, Undo and apply output, the last 400 lines of every Runtime log in each Home, and a listing of bin/ and installation/. Secrets, tokens, tickets, passkey material and bearer values are redacted; CI uploads the directory with the receipt.
andersalm
force-pushed
the
ci/89-cross-version-undo
branch
from
October 6, 2026 16:59
268582e to
f6a7a6a
Compare
…es, then System (#89) alpha.6's System applies a release only offline with unchanged support, and a new release always changes support, so CI saw its plain 'could not start'. The journey now records that limit: alpha.6's System refuses the new release, restores and keeps Home on alpha.6. Then alpha.6's own `elastos update` installs this build over Carrier and Home restarts ready with the same account and data. This build's System refuses a tampered offer and applies the release after it, compiled again from this source, then Undo returns to alpha.6 as before. check-result requires the recorded limit and the CLI update; the hop builds this source twice, and the journey step allows 75 minutes (59 at its caps).
…lines with a Home's secrets (#89) The CI stderr in result.json failure text now passes the same redactor as the diagnostics. Controller status is copied as an allowlist (phase, message, versions, id, generation, host_pid). Any copied line that contains a secret value the run's Homes hold in their JSON records (attach secrets, tokens) is dropped, named or not.
…n-undo # Conflicts: # scripts/update-hop-compare-test.py # scripts/update-hop-compare.py
Contributor
Author
|
Verdict record: candidate 129a861 (head). Review by GPT-6 Sol of 7d3139d + e79d035: journey PASS. Its MODIFY (redact all copied diagnostics, allowlist status fields) is fixed in e79d035. |
…Home gets a controller (#89) #234 dropped the percentage floor from this harness, so prepare-ci-disk now reclaims only to 20 GiB free. The pinned 0.8.0-alpha.6 still keeps 15% of the volume free before it creates its update controller; below that its Home opens without one ('Free disk space before updating'), and the journey waited for a controller that never came. prepare-ci-disk now reclaims to 20 GiB plus that reserve, and the journey refuses plainly before starting the published Home when the runner is below it.
…GB rule (#234), installer steps (#253) alpha.7 is built from develop after #259 merges, which now includes #234 and #253. alpha.6's System update refuses any release whose support changed (update.rs@252166bc:1687-1691); its Terminal update accepts it. (cherry picked from commit 40dde8604026369bfb796db9cef9bed55ee7479f)
Contributor
Author
|
Verdict record: candidate 2235ee4. Delta since 129a861:
GPT-6 Sol: the journey assertions are unchanged and the notes are true. One boundary nit: alpha.6 also adds 256 KiB to its reserve. That affects only this early diagnostic, not the proof, and the fix lands in the CI follow-up so this run is not restarted. |
… map (#89) The fixture listed home, home-gui and system in components.json's capsules map, as a source Home does. Releases publish that map empty (release-platform-input.py). With entries there, `elastos update` refreshes capsules/home and capsules/system from the new archives and then evicts every changed capsules entry (evict_changed_capsule_cache), deleting the Home and System it just installed; the journey then found capsules/home/README.md missing. The fixture now publishes an empty map and keeps the qualified entries in an inventoried record that admission reads; cache identity follows what Runtime writes for an external archive; a missing support file is reported as such.
Contributor
Author
|
Verdict record: candidate 942c0eb. Delta since 2235ee4: a4077fe (Claude Opus). The fixture's published components.json listed home/system in its |
This was referenced Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What. The macOS installed-Home journey now starts from the real published 0.8.0-alpha.6:
scripts/update-hop-previous-release.jsonby release CID and SHA-256, and verified against the maintainer signature.elastos update --rollback-to <alpha.6 head CID>restores alpha.6. Home becomes ready, and the same account still sees the preference.Why. Two bugs reached users because no check updated from a real older release to new code: the alpha.6 provider refusal (#245) and the alpha.3 fresh-install failure (#238). A manifest-compatibility break in #170 was found today by review, not by CI. This check catches all three.
Also.
ci.ymlis pinned by full commit SHA.ci-release-policy-test.pyrefuses an unpinneduses:.Does not prove. The maintainer-key path; byte-identical archives (the fixture rebuilds them from the real files).
Tests.
update-hop-compare-test.py: 117 pass.ci-release-policy-test.py: 17 pass.Written by Claude Opus. Reviewed by GPT-6 Sol: PASS on supply chain, trust and Undo; one change requested (pin all actions, timeout), done.