Repository navigation
UP-00: Record the current update behavior #106
Description
Part of #89.
Owner: Anders (@andersalm).
Depends on LA-00 (#94) and an approved isolated fixture with two distinctly versioned binaries.
Use one native-Mac fixture set and local test publisher. Keep existing user Homes outside the experiment.
Done means
Release acceptance: Each exposed feature works clearly from start to end, including recovery. Keep unfinished or confusing features hidden until their complete journey passes. Hiding a feature does not complete its task; source checks alone do not establish installed acceptance.
- Run one real CLI apply and one real operator apply from the same starting state.
- Record versions, hashes, health, process exit, host lock and fixture-data preservation with passed, failed or unavailable results.
- Determine whether the live operator update is interrupted by its own host exit; distinguish this from an earlier validation failure.
- Preserve useful evidence after a failed new binary or interrupted harness, and clean up fixture processes.
- A machine-readable receipt binds artifacts and explains each result. Stage, Restart and Undo are recorded as unsupported where absent.
Completed: PR #79 merged as ea670e27 after the reviewed 76994bd4 correction passed all eight required checks. Final proof and diagnostic limits. Product corrections continue in #107.
Activity
andersalm commentedon Sep 29, 2026
UP-00 current-head proof, 29 September 2026
Candidate: draft PR #79, head
a38015e43b2531bff8c27b35c315b03d21dbbb31, treec219db3324c93230dfe86f59508c58fd3b17ee51, againstfeat/0.7.1-models. The test binaries came from source commitecda431dd194ce073072031a027cdf5b233d56ba. The old binary SHA-256 was1ac4376423b9c288d7a4caf7d2c6ad1bf940903c3f774e7d97e5bd5d16fd410b; the new binary SHA-256 was8f7ee99e17cca52d22e2b054d7ba7e97cda223464df2a6df4286bfdc360ecc7b.Observed behavior: the CLI installed rc2 from rc1 and advanced its source version. The operator fixture passed kind, health and Carrier preflight, then installed the same new binary and component content. Its host exited 75, the controller timed out, and
sources.jsonstayed at rc1. The corrected observer reports G6 failed. Both paths preserved fixture identity, chat, draft, Library and model marker hashes. The old signed model catalogue remained installed. Runtime serialized the new component JSON into different bytes; its content matched the publication, while its raw hash differed. The trace has no direct marker for the internal wait call.Proof: current-head CI run 36573146691 passed all required jobs. Local diff, entropy, Rust formatting, Python syntax and focused observer checks passed. Independent read-only review recomputed the operator checks from retained evidence and accepted the exact head with no actionable finding. All owned fixture processes stopped, host locks released and task ports became free. The machine-readable raw and derived receipts remain in the private task record.
Stage, Restart, Undo and Home UI were unavailable in this experiment. UP-01 owns catalogue installation, component byte identity and host activation and response settlement. This UP-00 proof is an observation of current behavior; it does not establish an end-to-end update journey.
andersalm commentedon Sep 29, 2026
Fixture preparation retained from the removed work notes: Anders approved the isolated CLI/operator experiment and disposable fixture keys on 29 September. Both native Mac inputs use accepted LA-00 source ecda431; only the embedded test version differs. Each binary is 89,267,600 bytes. rc.1 SHA-256: 1ac4376423b9c288d7a4caf7d2c6ad1bf940903c3f774e7d97e5bd5d16fd410b. rc.2 SHA-256: 8f7ee99e17cca52d22e2b054d7ba7e97cda223464df2a6df4286bfdc360ecc7b.
The fixture keeps four disposable identities and a separate release/catalogue trust store. Its machine-readable receipts bind the retained inputs, fixture files, actual runs and cleanup. The pair tests updater mechanics; supported cross-version data migration needs later proof. Prepared markers are not acquired model/inference evidence. The current results and observer correction belong here and in PR #79, replacing references to a private Markdown handoff.
andersalm commentedon Sep 29, 2026
Signed update now proceeds from this issue, the lowest-numbered open task in the lane. PR #79 and the real CLI/operator receipts are recorded above. Reconcile each Done means with those receipts and complete the current-candidate review and checks. Close this observation task when those criteria are proven, then select the next unblocked Signed update issue. Product update repairs remain with their owning issues.
andersalm commentedon Sep 29, 2026
UP-00 Done means reconciliation at PR #79 head
a38015e43b2531bff8c27b35c315b03d21dbbb31(treec219db3324c93230dfe86f59508c58fd3b17ee51):serve; its old component manifest therefore differed from the CLI Home. Both runs used isolated Mac Homes and the local test publisher.sources.jsonat rc1 while the controller timed out. G6 is failed for the observed exit and lost response. The trace does not identify the internal wait call.d2da773a248138d2ccb790a5629cc85f75398c353fc83f02a38961bf8b9481e4; corrected operator comparison4407502c24d801eecb1d670c6a163eaf5806e01ec0f427e736f1ef9fc7e91cd4; raw operator result6845b5b27e149718050f729b4b6d1ef0a80e2f72a05e0bc40a0221dc84e312e8. Stage, Restart and Undo are marked unavailable because the current updater has no operation for them.All required checks passed in CI run 36573146691, and independent read-only review accepted the exact observer head. The diagnostic work for this issue is proven. UP-01 and later issues own the product repairs and the complete user journey. PR #79 remains open for human review and integration.
andersalm commentedon Sep 29, 2026
UP-00 same-start clarification for the first Done means item:
The two applies started from the same release state for the updater comparison: each had the rc1 binary with SHA-256
1ac4376423b9c288d7a4caf7d2c6ad1bf940903c3f774e7d97e5bd5d16fd410b,installed_version=0.7.1-rc.1, sourcefixture, channelcanary, the same trusted publisher and signed rc2 release, the same old catalogue hash, and matching chat, draft, Library and model-marker hashes. Each Home had its own disposable identity, as the CLI and operator roles require.The installed old component manifests were different. The CLI fixture had an empty external map. The approved operator extension added only
localhost-providersoservecould pass operator-kind and health preflight. This role prerequisite is part of the starting state and remains a limit on any claim of byte-identical Homes. Both applies fetched the same signed new component manifest, whose external and capsule maps were empty. The updater refresh path iterates the new external map, and capsule cache comparison uses capsule entries. The operator log reportsInstalled support assets unchangedandCapsule cache unchangedbefore the host reports exit after its installed binary changed. The provider difference enabled the operator path; the retained trace gives no sign that it changed artifact selection or the observed post-replacement exit. It remains a fixture difference rather than a controlled byte-for-byte CLI/operator comparison.The criterion is satisfied as a same-rc1, same-signed-release comparison of the two real apply paths with a documented role prerequisite. The issue closure records that bounded meaning. It does not prove behavior for every installed component set or a complete user update journey.
andersalm commentedon Sep 29, 2026
Reopened as QA / Review. The recorded proof is retained. This issue closes only after its Done means remains proven and PR #79 has the required review and is merged. Irzhy is already requested on #79. The earlier closure was premature under the corrected completion rule.
andersalm commentedon Sep 30, 2026
Anders approved applying Irzhy's F1 and F2 to PR #79, then merging after the corrected candidate passes review and checks.
F1 binds the operator bootstrap DID to the fixture's local identity before peer admission.
F2 matches the updater's exact expected-version stage lines and records the host exit code with response loss.
Irzhy's review supplies the findings; its F3 is now an explicit requirement in #107.
The accepted isolated runs remain evidence for their original candidate. This correction uses focused observer tests; existing Homes stay outside it.
UP-00 stays open until the corrected PR is reviewed and merged.
andersalm commentedon Sep 30, 2026
Pushed 76994bd4 to
origin/feat/0.7.1-update-hopfor PR #79, tree69bedf6816db97b6637044710d0143adff7655bd.F1 binds the operator bootstrap to the local fixture DID read before gateway startup; mismatch stops before peer admission. F2 matches exact expected-version/cache lines, uses the expected new binary hash, and requires host exit 75 for response-loss evidence.
Seven mocked/pure observer tests pass, including spoofed identity, missing identity, unrelated log text, wrong/missing hashes, timeout without exit 75, and raw manifest hash failure despite matching JSON. The spoofed-target test fails on the prior observer and passes here.
The four AGENTS source gates, CI YAML parsing, and shell syntax pass. Independent review passed the exact correction and reran all seven tests. These tests now run in the CI source gate and local pre-push script.
The task worktree is clean and even with its remote. Merge-tree compatibility with current models base
0df365e2passes; CI run 36715934684 is the corrected-head run; its result remains pending.The previous isolated runs retain their original candidate receipts. This correction used mocked observer tests and source checks; F3 manifest-byte preservation remains required in #107.
#106 stays in QA / Review until PR #79 merges. The coordinator owns the final checks and merge; #107 implementation follows that integration.
andersalm commentedon Sep 30, 2026
Candidate 76994bd4 passes all eight required checks in run 36715934684.
Irzhy approved the observer; F1/F2 are fixed and independently reviewed. The seven focused regressions and required local gates pass.
The task worktree is clean and matches its remote. Merge-tree compatibility with models
0df365e2passes.Proceeding with the authorized normal merge of #79, then closing this diagnostic task. #107 owns the product update fixes, including F3.
andersalm commentedon Sep 30, 2026
UP-00 is complete. #79 merged into
feat/0.7.1-modelsas ea670e27, from reviewed head76994bd4.Eight required checks passed; Irzhy’s review findings and independent verification are resolved in the correction.
The diagnostic criteria are proven. The reproduced product failures remain with #107 and the later signed-update tasks.
Next: #107 / #132, preserving signed artifact bytes and proving the CLI/operator journey.