Repository navigation
0.7: Reconcile 0.7 and qualify the runtime independently #299
Description
Activity
Reconciliation is committed locally as
5ea270d4eon isolatedintegration/0.7-clients-inspect, merging main175982d11intoorigin/0.7while preserving 0.7.0 and its dependency lock identity. It carries the release-download retry and channel snapshot fixes; main and other sessions' branches are untouched.Source proof: 1,374 Citadel checks pass, 81 focused source contracts pass with warnings treated as errors, focused Ruff and workspace format checks pass. The incoming main commit also passed its complete exact-head local candidate (
20261005-134016-e24e09, 146 steps).The integration-specific Rust check and reference-image build are queued behind the active binary release's kernel machine lock. Native qualification needs both
devandcapsem-debuglinux/amd64 layouts and pins; the handoff names only the missingdevpin. KVM, installed, and exact-head runtime proof are still outstanding. Dependent client/Inspect implementation has not started and this issue remains open.Sprinty records the thirteen-boundary dependency graph, local commit, evidence and pending commands in the isolated worktree.
Independent runtime qualification has reached a verified native milestone on the isolated 0.7 integration source
bfaa87764fa223d9dc469f11dae8d361a1f4b342.- The official amd64
devimage, digestsha256:aa823bfde4361684dc3f496bd591b2d10c64f8a2c2654204b98f57d479786b3d, passed its repository-ownedimage-qualifygate: 13 passed, zero skipped, one capability-based deselection. The tests took 534.67 seconds; the overall gate includes runtime rebuild and machine-lease wait. - Real workload checks covered toolchain compile/execute, Ollama loopback service, stop/resume with workspace and home-layer preservation, fork with the same image and retained files, MCP transport with ledger attribution, the image's own command, explicit/default exec target, image user and working directory, and workspace ownership/permissions.
- Runtime assets and initrd were rebuilt through the owning gate, followed by native host binaries. Candidate OCI manifest/config/layer hashes were verified before qualification.
- Debug-image qualification is now started on the same frozen source and will reuse the prepared runtime.
This does not close #299: image admission, the file API and cleanup black-box suite, installed Linux proof, and the exact-head whole-source gate are still pending. Native pins and artifact publication wait for the applicable qualification; dependent schema/service/client/Inspect implementation remains gated by the foundation proof.
Sprinty holds the command journals and proof matrix in the isolated worktree. Main and other sessions' branches remain untouched; machine leases govern the runtime runs.
- The official amd64
Runtime preparation has advanced on local integration HEAD
c57a42952e876ffe610187ea3ddc1e79238229b4.Six reviewed phase-1 fixes are integrated separately: release-proof guidance and its guard, abandoned-prefix journal retention, completed-preflight-failure reporting, the qualified dev image's Linux/amd64 pin, and exact-PID companion cleanup guidance.
Source verification on that clean head passed:
- 290 focused tests with warnings treated as errors.
- All 1,385 Citadel guards, with no skipped or deselected guards.
- Configured Ruff and the whole-builder strict Ty rail.
- Actual dev OCI manifest, config and every layer hash/size, plus Linux/amd64 platform, through the updated pin loader and existing verifier.
The dev image's 13 selected native KVM qualification tests passed on source
bfaa87764fa223d9dc469f11dae8d361a1f4b342. The existing debug qualifier still owns an unchanged independent snapshot of that source; its Git head and complete source digest were verified equal before and after these carries. Its pending result is not whole-source proof of the newer integration head.This issue remains open. Debug qualification and its native pin, actual history/digest repair after the old qualifier exports, Kingslanding admission/file-access/cleanup acceptance, installed Linux acceptance, and the final exact-head full gate are still required. No main merge or artifact publication is claimed.
The native amd64 debug-image qualification is complete through the owning
image-qualifygate.- Run
20261005-222801-ca844a-image-qualify, local source609f7ee2c535bd0b12e39a8b75c3e10d965247bd, native exit 0, exported terminal journalok, all 15 plan steps passed. - Exact image digest:
sha256:5cd02c592445a0223a1284b9b3f96c3ab94ae4842ddb7e5fc2882b0304834a2b. - 11 selected tests passed in 709.54 seconds, zero skipped; three capability cases were deselected. The selected total comprises four candidate-parser controls and seven runtime cases, rather than eleven distinct VM scenarios.
- Actual native runtime cases exercised stop/resume with workspace preservation, same-image fork with files, MCP transport and process-ledger attribution, image command startup, and explicit/default execution user, working directory and workspace permissions.
Only after the gate completed, the qualified amd64 debug fixture pin was committed locally as
b7eff7528936983e33ab336095f0731ef92e59b6. The updated loader independently verified complete OCI hashes, blob sizes and platform; 49 fixture/source checks passed. Existing ARM and dev pins and historical macOS evidence were preserved.The previous two-hour lease failure remains recorded as a preflight failure with no image tests executed. The new success does not erase it or count it as an image failure.
This issue and the runtime phase remain open. Kingslanding admission/create/exec/file/restart/fork/cleanup acceptance and the final exact-head full gate, including installed Linux, Winterfell and transition proof, are still required. Reviewed internal gate fixes are being carried before the next owning run. No registry publication, main merge, release or dependent-phase completion is claimed.
- Run
Parent: #289. Inspect source: #291.
Work boundary 1/13 from the approved 0.7 → clients → Inspect sequence.
Dependencies: Existing implementation in #289.
Merge current main into an isolated 0.7 branch without rewriting other sessions. Preserve 0.7 identities and existing service resolver/admission ownership.
Acceptance criteria:
Planned PR boundaries: Integration merge and Linux runtime qualification fixes, separately reviewable.
Implementation progress and evidence: Sprinty in the isolated
integration/0.7-clients-inspectworktree. Focused tests during development; fast checks/Citadel per PR; relevant black-box proof for runtime, credential or image boundaries. Respect the active release and machine locks.