diff --git a/40-quality/ci-cd.md b/40-quality/ci-cd.md index 4418fee..3e418d9 100644 --- a/40-quality/ci-cd.md +++ b/40-quality/ci-cd.md @@ -52,9 +52,13 @@ tag push │ signed by the identity expected, carrying nothing it must │ not, named by the manifest written beside it │ + │ and, on Linux and Windows, launched and asked for the + │ health endpoint, with the answer compared to the tag + │ │ one self-host smoke test, beside them │ launch the shipped self-host recipe, ask its health - │ endpoint — a hosted runner cannot launch the other four + │ endpoint — macOS and Android are interrogated only, and + │ a person installs a release on a real machine ▼ 3 publish — only when all five succeeded generate the update manifests with binary hashes diff --git a/70-operations/releasing.md b/70-operations/releasing.md index a13e829..825577d 100644 --- a/70-operations/releasing.md +++ b/70-operations/releasing.md @@ -98,10 +98,34 @@ there is nothing to move by hand. each interrogating the artifact it produced rather than trusting the build's exit code: that it is signed by the identity expected, that it carries nothing it must not, and that the update manifest written beside it names it. -3. **One self-host smoke test**, launching the shipped self-host recipe and - asking its health endpoint. A hosted runner cannot launch the other four — an - Electron bundle needs a session and a display, and the Android package needs - a device — so this is the one shape CI can start and probe end to end. +3. **Smoke tests, on the shapes a runner can start.** The Linux and Windows + bundles are launched and asked for their health endpoint before they are + uploaded, and the shipped self-host recipe is launched and probed beside them. + The answer is compared against the tag, so a bundle that runs but reports + another version fails too. + + This page previously said a hosted runner could not launch any of the four. + That was written from the probes removed in May 2026, and it was right about + the outcome and wrong about the reason, which mattered because each recorded + cause had an escape nobody had tried. The Linux runner has no display, so + `xvfb-run` supplies one. `open -a` on macOS goes through Gatekeeper, so the + bundle's own binary is executed instead, named by `CFBundleExecutable`. The + Windows installer-to-launch race is avoided by launching the unpacked tree + rather than installing it. Two of the three then worked. + + **macOS and Android are not launched, and the reasons are different.** An + `.apk` is installed onto a device or an emulator and has no process a runner + can ask — that was always true. macOS was tried and measured: on + `v2.0.0-rc.3` the bundle's binary executed and cleared every signing gate, + and Electron died with `Fatal process out of memory: Failed to reserve + virtual memory for CodeRange`. V8 cannot reserve its code range on a + `macos-14` runner. That is a property of the runner, not the bundle, and the + signing friction this page used to blame was never reached. + + **What covers those two is a person.** Installing a release on a real machine + and using it is manual, local, and owed before a stable tag. A runner proves + a bundle starts and answers; it does not prove the application works, and it + never did. 4. **Publish**, only if all five succeeded: generate the release notes from the commits since the previous tag, generate the update manifests with binary hashes, sign each manifest, and create the release with every binary diff --git a/70-operations/versions/2.0.0.toml b/70-operations/versions/2.0.0.toml index 21ad4a8..71aa2f3 100644 --- a/70-operations/versions/2.0.0.toml +++ b/70-operations/versions/2.0.0.toml @@ -28,6 +28,13 @@ # is the status that carries unmet goals and `releasable` is the one that does # not (OPS-R16). No goal was added or removed here — only the claims about them. # +# RELEASABLE as of 2026-09-15. The last block standing was F8's app-store +# distribution, and what it waited on was never code: four console records and +# two Apple portal artefacts, closed where they are noted below. Every goal in +# the list is satisfied, which is what this status asserts and the only thing it +# asserts. The entries below stay as they are — a version that reaches +# `releasable` by deleting the record of what was once unmet has not reached it. +# # NOT SATISFIED — or, for two of them, withdrawn. What the re-audit below left standing: # E4-R23 WITHDRAWN 2026-09-05. The requirement documented an absence that # has gone: custody is wired on both shells. The residual it leaves @@ -279,7 +286,8 @@ # reads every node back, and re-asserts on backgrounding for the one case an # excluded ancestor does not cover. # -# OUTSTANDING — scoped work, not yet on the development line: +# WAS OUTSTANDING — scoped work, closed 2026-09-15. Kept in place rather than +# rewritten, because the reasoning is what makes the closure checkable: # F8-R1 .. F8-R28 — app-store distribution, scoped in F8 and a goal of # this release. Scope is ALL FOUR stores, with # direct download retained wherever it remains @@ -330,10 +338,19 @@ # and the keyring with it, and says a paired device # keeps its own copy). # -# Four neither repository can decide, unchanged: -# R4, R15, R16 and R26 are console records and -# listing copy, settled in App Store Connect, the -# Play Console and Partner Centre. +# Four neither repository can decide: R4, R15, R16 +# and R26 are console records and listing copy, +# settled in App Store Connect, the Play Console and +# Partner Centre. +# +# CLOSED 2026-09-15 on the maintainer's confirmation +# that all four are entered. Recorded on that basis +# and no other, because there is no artefact in +# either repository a check could read: a console +# record exists in a portal, and the only evidence of +# it is the person who entered it. That is the same +# reason they were carved out of the audit in the +# first place rather than counted as unread. # # TWO WERE OPEN. Both are engineering-complete as # of 2026-09-07; what each waits on is an account or @@ -368,12 +385,27 @@ # the interpreter is statically linked, which is # what library validation checks. # -# What remains for the Mac App Store is not code: a -# provisioning profile and a Mac Installer +# What remained for the Mac App Store was not code: +# a provisioning profile and a Mac Installer # Distribution certificate, both artefacts of the # Apple Developer portal. The lane refuses to build # without them, which is the correct failure. # +# CLOSED 2026-09-15. The provisioning profile is in +# the register as MAS_PROVISIONING_PROFILE_BASE64, +# which is checkable; the installer certificate is +# held in the portal and recorded on the maintainer's +# confirmation, the same basis as the console records +# above. +# +# Neither was ever a bar to THIS release. R27 is +# satisfied by the lane existing and R28 by the build +# mapping its interpreter under the sandbox — both +# true since 2026-09-07. The artefacts are what +# SUBMITTING needs, and the lane is dispatch-only on +# purpose so that portal paperwork cannot stop a +# direct-download release. +# # THE FINDING IS CLOSED. It was a Microsoft Store # certification prerequisite the runbook listed and # nothing checked: signature verification reads the @@ -528,7 +560,7 @@ # F3-R37 and C1-R18 — and all five hold. version = "2.0.0" -status = "staged" +status = "releasable" repos = ["beatrax"] goals = [