From a60b6badb8a1b9a281eb89e5953eb8e748cd8010 Mon Sep 17 00:00:00 2001 From: Dotta Date: Thu, 8 Oct 2026 04:17:29 -0500 Subject: [PATCH] ci(hermes): retain rejected Mac closure manifest for byte comparison Preserve file-level provisioning evidence before cleanup without weakening reviewed closure admission. Record the original cloud failure and the passing current-source native fixtures on macOS 26.5.2. Co-Authored-By: Paperclip --- .github/workflows/runner-hermes-native.yml | 23 ++++++++++++++++++-- doc/plans/2026-10-06-hermes-native-runner.md | 21 ++++++++++++++++++ tests/runner-e2e/workflow-security.test.ts | 6 +++++ 3 files changed, 48 insertions(+), 2 deletions(-) diff --git a/.github/workflows/runner-hermes-native.yml b/.github/workflows/runner-hermes-native.yml index a13813a6e3..5059957aa6 100644 --- a/.github/workflows/runner-hermes-native.yml +++ b/.github/workflows/runner-hermes-native.yml @@ -117,8 +117,27 @@ jobs: trap 'rm -rf "$hermes_build_root"' EXIT python3 -m venv "$hermes_build_root" "$hermes_build_root/bin/pip" install --disable-pip-version-check --no-input uv==0.12.17 - PATH="$hermes_build_root/bin:$PATH" node packages/paperclip-runner/scripts/provision-hermes.mjs \ - "$GITHUB_WORKSPACE/packages/paperclip-runner/provider-assets/hermes/darwin-arm64" + PATH="$hermes_build_root/bin:$PATH" node --input-type=module <<'NODE' + import { mkdir, writeFile } from 'node:fs/promises'; + import { join, resolve } from 'node:path'; + import { materializePinnedHermesDistribution } from './packages/paperclip-runner/scripts/provision-hermes.mjs'; + const root = resolve('packages/paperclip-runner'); + const evidence = join(process.env.RUNNER_TEMP, 'hermes-native-evidence'); + await mkdir(evidence, { recursive: true, mode: 0o700 }); + const diagnosticMaterializer = join(process.env.RUNNER_TEMP, 'hermes-materializer-with-manifest.py'); + // Retain only the file manifest before rejected setup removes its + // temporary distribution. The original materializer and pin admission + // still run unchanged; this does not publish an unverified runtime. + await writeFile(diagnosticMaterializer, + 'import runpy, shutil, sys\nfrom pathlib import Path\n' + + 'runpy.run_path(' + JSON.stringify(join(root, 'scripts/materialize-hermes.py')) + ", run_name='__main__')\n" + + "shutil.copyfile(Path(sys.argv[2]) / 'manifest.json', " + JSON.stringify(join(evidence, 'candidate-manifest.json')) + ')\n', + { flag: 'wx', mode: 0o600 }); + console.log(JSON.stringify(await materializePinnedHermesDistribution({ + destination: join(root, 'provider-assets/hermes/darwin-arm64'), + provider: join(root, 'src/providers/hermes'), materializer: diagnosticMaterializer, + }))); + NODE fi - name: Run native fixtures against a deterministic loopback model diff --git a/doc/plans/2026-10-06-hermes-native-runner.md b/doc/plans/2026-10-06-hermes-native-runner.md index 689b3f3fa2..7fa9579b78 100644 --- a/doc/plans/2026-10-06-hermes-native-runner.md +++ b/doc/plans/2026-10-06-hermes-native-runner.md @@ -1151,3 +1151,24 @@ prerequisite for current-source local browser qualification, not a substitute for the live provider, published installation, or actual Daytona release gates. Local workflow lint and all 44 focused source/security tests pass. Cloud execution of the new Mac job remains required; this configuration is not a passing result. + +The first `f129601d4` cloud Mac job compiles and stages the release daemon, then +fails cold Python provisioning before credentials or fixtures. Its candidate +closure is `253eaee233bd6fa1f5c5209084213e25a2da81b6cff5163f09eedcb15b1a93e2` +with 19,249 files and 445,500,822 bytes, differing from the reviewed Mac pin. +The original failure remains retained. General CI has 54 successful checks and +two skips; the sole failing check is this new Mac qualification job. Fresh review +is 5/5 with no open threads. + +The downloaded daemon passes GitHub archive-digest, binary-checksum, architecture, +source-tree and signature admission. Its hash is +`fef7167af720db91537bbc066e3b8129a15d59bb6425dd95efa2b8a1a00b4980`. +On macOS 26.5.2 it passes all six native fixtures in 131.116 seconds, including +38 pinned Python checks against the fully verified existing Mac closure. This +is current-source transport proof with the cloud-built daemon and no local Rust +compilation. It does not make the failed cold installation or live matrix pass. + +Cloud diagnostics now retain the candidate file manifest before rejected setup +removes its temporary distribution. The original materializer and closure pin +checks remain unchanged. Exact differing files must be identified and explained +before changing any reviewed runtime pin. diff --git a/tests/runner-e2e/workflow-security.test.ts b/tests/runner-e2e/workflow-security.test.ts index c132d9093e..ebfa82d642 100644 --- a/tests/runner-e2e/workflow-security.test.ts +++ b/tests/runner-e2e/workflow-security.test.ts @@ -70,6 +70,12 @@ describe("public repository paid workflow security", () => { expect(provision).toContain('test "$(uname -m)" = arm64'); expect(provision).toContain("uv==0.12.17"); expect(provision).toContain("provider-assets/hermes/darwin-arm64"); + expect(provision).toContain("materializePinnedHermesDistribution"); + expect(provision).toContain("runpy.run_path("); + expect(provision).toContain("scripts/materialize-hermes.py"); + expect(provision).toContain("shutil.copyfile(Path(sys.argv[2]) / 'manifest.json'"); + expect(provision).toContain("candidate-manifest.json"); + expect(provision).not.toContain("HERMES_CLOSURES["); const fixtures = workflow.slice(workflow.indexOf(" - name: Run native fixtures"), workflow.indexOf(" - name: Record source")); expect(fixtures).toContain('PAPERCLIP_RUNNER_BINARY="$PWD/dist/bin/paperclip-runnerd"'); expect(fixtures).toContain('TMPDIR="$RUNNER_TEMP"');