Repository navigation
Closed
Conversation
…coherence-0.7.1-models
…1-models Model screens, chat Enter to send, centred windows and Reconnecting (desktop part of #116)
# Conflicts: # .github/workflows/ci.yml # scripts/home-entropy-check.mjs
The Carrier update fixture installs provider capsule metadata for a component without provider_runtime. Setup now treats such components as passive content and refuses provider metadata for them, as intended. Real provider entries in components.json all declare provider_runtime, so the fixture now does too.
…release Assistant now obtains llama-server only when a model is prepared. The engine must have a signed release_path; it is fetched over Carrier under the installation writer, checked against its signed checksum and size, and the installed signed pair and components.json are re-read before extraction. URL-only engines, unbound components.json, pending update recovery and tampered bundles are refused before anything is activated. Model capsules stay on the bounded preparation path and are refused by the legacy archive downloader. Bonsai Q1_0 GGUF is admitted. Work started by the operator's astra agent, finished by the operator.
test: run behavior suites and enforce local push checks (#194 Part 1)
…229-takeover # Conflicts: # capsules/home/browser/home-shell-host.js # capsules/system/browser/index.html # scripts/home-entropy-check.mjs
…/217-refuse-url-only
… op/230-union # Conflicts: # scripts/home-entropy-check.mjs
…dline The event poll aborts a request that gets no answer within its deadline with a TimeoutError. home-link-status only counted TypeError and 502-504 as an unreachable gateway, so a hanging gateway never showed the Reconnecting banner. A TimeoutError now counts; a cancelled request (AbortError) still does not. Found by the astra review of 850d77f.
Home no longer installs llama-server or model capsules; Assistant fetches them from the signed release on demand. Kubo, llama-server and models now need a release_path like every first-party entry; only the Linux browser VM parts (crosvm, vmlinux) and cloudflared keep their current sources until they move to the signed release.
A source-checkout Home builds llama-server during setup only when SETUP_SOURCE_HOME_INSTALL_LLAMA_SERVER=1. Assistant now says so instead of refusing with a generic prebuilt-bundle error. Signed releases carry the prebuilt bundle with no build strategy, so the installed path is unchanged. Also point source-home-capsule-inventory-smoke at the current Kubo install steps (seed-kubo-cache.sh replaced setup --with kubo), so just verify runs. Both from the Opus review of PR230 at 3c145c0.
…d release The local-carrier setup smoke writes an unsigned trusted source. With an install_path, setup now treats it as an installed signed release and refuses it for lacking the private signed pair, which is correct. The fixture has no signed release, so it sets no install_path; setup still fetches every component over Carrier from the local publisher.
…eader test clippy::drop_non_drop fails the all-target pre-push gate. The reader holds only a borrow and has no Drop; its borrow ends at its last use.
…gine without the writer Adds the positive test the Opus review asked for: Assistant's engine is fetched once over Carrier from the signed release, checksum-verified, extracted with its library, its receipt verified, and then reused on the next call without another fetch. An installed engine is now verified and used before the installation writer is taken, so a running update does not block model offers (Opus non-blocking note on e2d0b8b).
The #89 journey (install, Home, account, System update) needs no model, and the default home profile installs none. Packaging four GGUFs made every release 10.6 GB and pulled them from Hugging Face during the build. Remove the model components, their profile references, upstream recipes and provenance notes. The engine (llama-server) and model-provider stay; models return later as a separate signed publication.
Only the archive receipt accepts the older sha256: prefix; a changed or prefixed .elastos-cid is refused.
publication_file_import_accepts_the_provider_cid_and_pinned_request and publication_files_and_raw_blocks_share_one_owned_provider failed with ETXTBSY starting their fixture provider: publish.rs wrote the script with fs::write in the test process, a concurrent fork in another test thread copied that writer fd until its exec, and the kernel refused to exec the fresh script. 14a7681 fixed the same race for protected_content_runtime/tests.rs with a local write_mock_script. That helper is now test_support::write_from_child, shared by the library and binary test targets, and every test that writes an executable and then runs it uses it; the per-file copy is gone.
Home status hashed the binary extracted from an archive (kubo, cloudflared) against the signed archive checksum, so a fresh install always read as stale. Archive-delivered components now check capsules/<name>'s artifact receipt against the signed checksum and require an executable extracted binary; direct binaries keep the byte check. Fixes #280.
…mid-scan group_descendants lists /proc and then reads each stat. A process that exits in between makes open report ENOENT or ESRCH, read report ESRCH, or the stat of a dead task report process group -1; only ENOENT was tolerated, so any unrelated process exiting during the scan failed OwnedChild::stop and made the gateway child guard give up reaping. Those reads now count as a vanished process (also in process_identity) and the group parses as pid_t. This was the cause of the stop_reaps_helpers_with_inherited_output_and_preserves_ another_group (ESRCH, "invalid process group in proc stat") and cancelled_start_reaps_group_and_other_gateway_generation_is_preserved flakes.
…scape repair path (#279)
Review of 27b2f66: status trusted the archive receipt without reading the installed binary, and it loosened verify_installed_component_binary, which launch and admission callers use. verify_installed_component_binary is strict again and refuses a binary extracted from an archive. Setup now records the sha256 of the executable it extracts from the verified archive next to the capsule metadata receipt, and a missing record marks the metadata stale so setup writes it. Home status uses verify_installed_component: plain binaries by their bytes, archive binaries by the archive receipt plus the recorded executable hash, refusing symlinks. Refs #280.
…le-path # Conflicts: # README.md # docs/INSTALL.md # elastos/CHANGELOG.md
…y to a head that keeps it
…changed support (#89) The pin moves to the newest published release, 0.8.0-alpha.8 (release CID QmWMfyHQ3iFKtc2ERUCmhQ8DnWcxQKK7SzME1U2mqQJuYh, SHA-256 f4744775...d04b, as the signed release head names), written by pin-previous-release. From alpha.7 on, System installs a release whose support changed (#246), so the journey no longer waits for the published System to refuse and no longer runs its CLI update: the published System installs this build, Home restarts once and the page reconnects the same account; the runner checks the controller status, the installed release and its support. check-result derives this from the pin: a pin before 0.8.0-alpha.7 (CLI_SYSTEM_INSTALLS_CHANGED_SUPPORT, by version precedence) fails, and an alpha.6-style refusal is a failure. The published release's free-space model is now alpha.8's: its Runtime copy and receipt plus a fixed 2 GiB reserve, no 15% of the volume.
An update with an unchanged manifest left existing Homes without the executable record, so status kept reporting kubo stale. The shared update planner now refreshes an archive component's capsule metadata once when the record is missing, so the Terminal and System update paths both write it. Refs #280.
Remap repo root, CARGO_HOME and rustc sysroot via --remap-path-prefix so the cargo wasm (and the stamp) are identical across checkouts and machines.
All checks green on 8e4b3b9; every part reviewed cross-family (GPT-6 Astra), each reviewed head is an ancestor of this head.
Contributor
Author
|
Closed: not needed now; main stays the release line and changes only at a tagged release. |
8 of 21 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub shows main by default, and main still says capsules run sandboxed with zero ambient authority (SECURITY.md, docs/GLOSSARY.md) and points readers to state.md, TASKS.md and the old long ROADMAP. develop (514 commits ahead, 0 behind) has the published alpha.8 source plus #199's honest isolation status, and GitHub issues as the one status record. Merging keeps main = the latest reviewed, CI-green line until stable releases come from main tags (#93). Also brings main's release capacity script in line with #234 (no percentage reserve).
Merge with a merge commit; main and tags stay with Anders.