Skip to content

feat(cli): install verified prebuilt releases - #11

Merged
aliasfoxkde merged 7 commits into
mainfrom
codex/prebuilt-release-installer-20261029
Nov 1, 2026
Merged

aliasfoxkde merged 7 commits into
mainfrom
codex/prebuilt-release-installer-20261029

Conversation

@aliasfoxkde

Copy link
Copy Markdown
Owner

Summary

  • Add a prebuilt CLI installer for Linux x86_64/aarch64 and macOS x86_64/arm64. It verifies the adjacent OpenCodifier attestation and version before atomic user-local installation; target machines need curl and Python 3, not Rust/Cargo.
  • Add attestation and installer contract tests to just ci, GitForge CI, and the GitHub mirror.
  • Add release-set verification for exact tag/commit, clean source, complete target matrix, consistent toolchain/dependency provenance, generated notes, and checksum coverage.
  • Document the release audit, provenance findings, target support, release procedure, rollback, and Amortyx-Stack integration phases.
  • Bump the workspace to 0.6.2 for the pending clean-source binary release.

Validation so far

  • 11 installer/attestation tests pass, including install-without-Cargo, checksum tampering, version mismatch, unsupported host, dirty provenance, wrong target, wrong size, and unknown schema.
  • sh -n scripts/install-prebuilt.sh, ShellCheck, Python byte-compilation, cargo metadata --locked, and git diff --check pass.
  • cargo check --workspace passed on Fedora 44 after the version bump.
  • Existing v0.6.1 Linux x86_64 binary matched its published hash and passed 30/30 E2E checks on Fedora. Its attestation reports 29 dirty paths, so it is not accepted by the new release verifier.
  • Full just ci, the GitForge pipeline receipt, complete release matrix, and v0.6.2 download/install/E2E remain pending.

Release boundary

This PR prepares a clean v0.6.2 release. It does not claim the new release is published. The full GitForge gate and release artifact validation are required before publishing.

@coderabbitai

coderabbitai Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 909a6523-89d0-4fda-a665-fc4c255a7ec4
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@aliasfoxkde

Copy link
Copy Markdown
Owner Author

Validation update (2026-10-29): the new dependency constraint fix makes cargo deny check pass on Fedora and addresses the failure from the first mirror run. The updated GitHub run has passed lint, docs, workspace tests, and E2E; the supply-chain and Rust analysis jobs are still running.

The Fedora just ci run passed formatting, clippy, workspace tests, docs, cargo-deny, and cargo-audit, then failed at Aegis. This is a pre-existing baseline/tool drift: the cached Aegis 0.6.3 image reports 20,832 unmatched findings with zero baseline suppressions on origin/main itself. The host Aegis 0.6.1 is also not the gate-image version. I have not regenerated the large security baseline to mask this. The canonical GitForge gate receipt remains pending.

Release matrix preflight on Fedora found the native Linux, macOS/Windows Zig, and iOS targets ready; Android NDK and wasm-pack are not installed yet. No release was published. A clean v0.6.2 release still requires the complete release matrix and a no-Rust download/install/E2E check.

@aliasfoxkde

Copy link
Copy Markdown
Owner Author

Validation update (2026-10-29): latest PR head ffb3beb62da62ffd7b5ee017bc34e6c884dcf216 passes GitHub lint, unit tests, docs, E2E, supply-chain, CodeQL, and all analysis jobs. The 20 contract tests pass locally. On Fedora 44, the candidate x86_64 musl binary installed through the Amortyx-Stack wrapper in a fresh python:3.12-slim consumer container with no Rust/Cargo; attestation validation and all 30 E2E checks passed, with the user service left disabled. This candidate was built from 9fc6e64, not the final tag commit, so it is validation evidence only. No v0.6.2 release is published. The exact-PR GitForge receipt and complete cross-platform release-set gate are still required before tagging/publishing.

@aliasfoxkde
aliasfoxkde merged commit 74413cb into main Nov 1, 2026
11 checks passed
@aliasfoxkde
aliasfoxkde deleted the codex/prebuilt-release-installer-20261029 branch November 1, 2026 04:33
aliasfoxkde added a commit that referenced this pull request Nov 1, 2026
…11 integration (#13)

* docs(planning): burst-compute queue — T5500 down, T3.4 fired

T5500 powered off (idle, no training). Burst queue: T3.4 4B arm on
Kaggle (trigger fired: 2B plateaued at 0.6840 < 0.75), JEV-27B probe
on Modal or 30 min at next T5500 boot; consensus pass resolved as
already-done on fedora 5060 Ti. Timeframes per item.

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(bench): jev27 contamination-audit arm + Modal burst (B2 staged)

autotrust/JEV-27B on JevBench public 231 through their own
serve_decide.py POST /v1/decide (thinking off = pure System-1 audit).
Runner gains --arm jev27 (native probabilities, never renormalized,
noul false/true -> no/yes, failures score incorrect). Modal H100 burst
app with weights volume + in-process replay is staged but blocked: the
workspace spend limit refused the first launch (no cost incurred);
raising the cap is operator action.

Also: trainer v6 (in-loop HF resume-state upload after every ckpt +
val-plateau early stop) uploaded to the t34 corpus repo; queue doc B1
session log records the session-1 12 h kill, the output-harvest
recovery, and the v6 rollout plan.

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(bench): d1-2B survey arm — JevBench-231 0.7489 via /v1/systemone

LiquidAI/d1-2B (lfm1.0, extraction-teacher-only) through llama.cpp
v0.8.0's native decision wire: 0.749 acc / 0.762 macro / ECE 0.065 /
Brier 0.279, 231/231 valid, 0 failures, p50 5.9 s. Second-best 2B-class
row (decider-2b 0.7576), best ECE of any 2B arm. Arm `d1` added to the
runner (noul/choice/score native rendering, probabilities never
renormalized); JEVBENCH.md arm 8 + results/anchor rows; B6 recorded in
the burst queue doc.

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(calib): per-kind T beats global 2x on E1-E board

perkind_holdout_fit --probs on e1e-slot-231: board ECE 0.1305 (global
T=3.362) -> 0.0678, auto@5% 0.039 -> 0.208. In-sample sizing probe;
holdout-side exact fit is the ship step. Fixes ref path (datasets/public).

* docs(oper): T3.4 session-3 record — cap kill at 4300, ckpt@4000 safe

v6 upload path validated under a real 12 h kill. Next session blocked
on Kaggle weekly quota reset; resume from step 4000 is automatic.

* docs(calib): out-of-sample correction retracts per-kind claim

Suite-fitted choice T (6.144) lands board ECE 0.1511, worse than the
shipped global 3.362. Per-kind 0.0678 was mostly in-sample. Per-kind
shape and fit-per-surface rules survive; cross-surface transfer does not.

* feat(bench): trainer v6 partial manifest + T3.4 session-3 verify

The manifest previously existed only after the training loop, so a
cap-killed session lost its data-quality counts (loud over-max-len
skips, bad slotprobs) and val history — fields recorded nowhere else.
build_manifest() is now shared; save_resume_state writes a
manifest_version *-partial copy at every checkpoint and uploads it
to ckpt/train-manifest.json beside the resume state.

Also: session-3 output verified (resume-state step=4000
byte-identical to the HF copy, val 0.0260->0.0119 still improving);
the v6 trainer committed to the repo for the first time (was only in
/var/tmp + HF); quota re-probe still blocked (30 h cap, resets after
the Fri/Sat midnight-UTC boundary per community reports).

Co-Authored-By: Claude <noreply@anthropic.com>

* docs(research): §33 jevgrep re-read + Tev1-4B audit; d1 teacher runner

Both production decision models ship uncalibrated (raw prob at fixed
0.5); Tev1 letter-only SFT loses to Jev on their own honest rerun —
recorded as D15 evidence. Also commits d1_teacher_pass.py runner for
the merged-v4 quarantine-pool teacher pass.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(bench): teacher pass survives transient server failures

HTTP 5xx/timeouts were recorded as completed rows, so resume permanently
skipped never-voted items (162 poisoned in the first run). Transient
failures now stay pending for the next resume; permanent parse failures
are still recorded so a malformed item cannot loop forever. Adds
--retry-failed to strip failed rows from an existing output file.

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(bench): 4-worker concurrent teacher pass

Single-stream voting left 3 of 4 llama-server slots idle;
workers fill them. Resume semantics unchanged (append-only,
completed-id snapshot). Smoke: 16/16 ok on 4 workers.

* docs(oper): record teacher-runner concurrency scope decision

* docs(oper): d1 teacher-pass throughput finding — full stream host-blocked

* docs(oper): GitForge CI trigger retry-storm diagnosis

Orphaned local-only commits retried at checkout (retryable=false) left
pending trigger rows that starved the pipeline queue; engine redrive via
fresh push recovers. Permanent-fail on object-missing checkout remains
an open ci-service defect.

* fix(engine): rename betacf bindings for clippy similar-names

qab/qap/qam trip clippy::similar_names under -D pedantic; renamed to
sum_ab/a_plus_one/a_minus_one. No behavior change (251 lib tests pass).

(cherry picked from commit ca8d64bae68240dad11bfdcdbb931edb7d8c231f)

* fix(deps): pin internal config-crate path deps

opencodifier-config was the only crate with bare path deps on core and
engine; cargo-deny wildcard gate fails supply-chain. Pin to 0.6.0 to
match every other crate.

* chore(ci): redrive stalled pipeline triggers for e77105f/c6b3b1a

* docs(oper): CI lane green on 03ed530 + lock-storm defects

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(ci): redrive stalled pipeline triggers (e77105f/c6b3b1a/03ed530/e28f2b2)

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(aegis): regenerate baseline for line shifts since 9cc08e0

The supply-chain gate reported 753 stale-fingerprint findings on
70f8d6f: files shifted after the last regen (which predated 9cc08e0),
so every fingerprint went line-anchored stale. Fresh in-tree regen
(default profile matching the gate), inspection_ledger trimmed before
commit. Gate now reports 0 new findings.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(engine): cover rotation combine and numeric edge branches

The coverage floor fell to 96.28% on 70f8d6f because the rotation
readout landed with the ArithmeticMean combine path, the incomplete-
beta reflection branches, the ln_gamma x<0.5 branch, the binomial CDF
saturation returns, and normalize's collapse refusal all unexercised.
Four tests pin each branch to a known value or a cross-branch identity.

Co-Authored-By: Claude <noreply@anthropic.com>

* test(cli,engine): lift coverage floor over 97.5 in-image

Init-doctor probes read hardcoded host paths inside the decision, so
their missed branches were untestable; extract the cores to take their
environment as data (probe_cpu_from, probe_ram_from, gpu_finding,
server_finding, artifacts_finding, doctor_report) and cover all
branches with deterministic tests. Add the over-ceiling image branch
in decide, the local-2b lane proposal branch, boolean/score escalation
partial answers, plus rotation/lane tests. Aegis baseline regenerated
in the same commit (fingerprints are line-anchored), ledger trimmed.

In-image floor check: 22032/22584 = 97.56% (floor 97.5).

Co-Authored-By: Claude <noreply@anthropic.com>

* docs(oper): CI triage runbook, in-image coverage rule, lane-fix debt

Record the REST route that actually lists pipeline runs
(GET /api/pipeline-runs?repo_id=) after the obvious guesses
404/405, and land scripts/ci-run-lookup.sh so the lookup is a
single curl+jq command instead of rediscovered each session.

Document the in-image coverage measurement recipe: the floor is
measured in opencodifier-ci-rust:2, and a local rustc run reads
~8 points lower on the same tree, so test targets must be chosen
from an in-image measurement.

Cross-ref the GitForge per-ref trigger lane fix (14de7171):
committed to gitforge-ci/main but not deployed -- the running
release 69245e2b predates it. The retry-backoff and republish
attempt-reset defects remain unfixed and are recorded here with
the owner and what "fixed" means.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(aegis): regenerate baseline for docs line shifts in 6471ad7

The CI triage runbook and coverage-rule doc edits added fenced code
blocks to docs/COVERAGE.md and OPERATOR_ACTIONS.md, shifting
line-anchored fingerprints. Ledger units[] trimmed per the standing
regen rule. Gate re-verified rc=0 locally.

* chore(aegis): regenerate baseline for AEGIS_AUDIT doc section shifts

The appended baseline-regeneration section in AEGIS_AUDIT.md shifted
line-anchored fingerprints and its own prose matched 5 patterns
(markdown-code-fence, eval-usage, trivy-config, missing-limit).
Regenerated with the gate's flags; inspection_ledger units trimmed
before commit (138 MB -> 30 MB). Gate re-verified rc=0.

---------

Co-authored-by: Michael Kinney <aliasfoxkde@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant