From fed3c8b9ba6cfcebd8545d0b4d13eca41056ade5 Mon Sep 17 00:00:00 2001 From: Dotta Date: Fri, 2 Oct 2026 04:23:49 -0500 Subject: [PATCH] ci: time retained Pi13 Intel startup phases Co-authored-by: Paperclip --- .github/workflows/docker-runner-check.yml | 14 ++--- .../ci/pi-intel/rebind-diagnostic-pack.mjs | 7 ++- .../pi-intel/startup-diagnostic-inputs.json | 58 ++++++++++--------- scripts/ci/pi-intel/startup_diagnostic.py | 6 +- scripts/ci/pi-intel/startup_timing_patch.py | 10 +++- .../ci/pi-intel/test_startup_diagnostic.py | 25 +++++--- 6 files changed, 72 insertions(+), 48 deletions(-) diff --git a/.github/workflows/docker-runner-check.yml b/.github/workflows/docker-runner-check.yml index 9b1a1e75e3..e217c84bb1 100644 --- a/.github/workflows/docker-runner-check.yml +++ b/.github/workflows/docker-runner-check.yml @@ -205,7 +205,7 @@ jobs: test "$SOURCE_E2E_SUPPORT_ONLY" != true test "$DIAGNOSE_AJV" != true test "$IMAGE_MODE" != true - test "$EXPECTED_SOURCE_SHA" = b9e5d6ecdb05ab7244c90976e07c950f8d09b15b + test "$EXPECTED_SOURCE_SHA" = f5c5fde380f60937ef26cc5a92e1d6a043e9cddc test "$EXPECTED_LOCK_SHA256" = 38338a6867358440c5ab5993eaeb85fb501bc7df65d24acf52fbd63c880ee4ba test "$(gh api "repos/$REPOSITORY" --jq '.visibility')" = public fi @@ -300,7 +300,7 @@ jobs: if-no-files-found: error manual_pi_startup_diagnostic: - name: Retained B9 profile12 native Intel startup timing diagnostic (not qualification) + name: Retained f5 profile13 native Intel startup timing diagnostic (not qualification) if: github.event_name == 'workflow_dispatch' && inputs.diagnose_pi_startup needs: authorize_manual runs-on: macos-15-intel @@ -321,16 +321,16 @@ jobs: GH_TOKEN: ${{ github.token }} run: | set -euo pipefail - gh api repos/paperclipai/paperclip/actions/artifacts/11208570718/zip \ - > "$RUNNER_TEMP/pi-startup-36959948724.zip" - printf '%s %s\n' b82cf6c843006781e2e6d5f0a06e0ff39497ffc457b94a511f8bdda66628aa43 \ - "$RUNNER_TEMP/pi-startup-36959948724.zip" | shasum -a 256 --check + gh api repos/paperclipai/paperclip/actions/artifacts/11218057612/zip \ + > "$RUNNER_TEMP/pi-startup-36984851998.zip" + printf '%s %s\n' 5159dcb57b380648679d441a73b87d50334dcca969adc95150e8429a71cbdfeb \ + "$RUNNER_TEMP/pi-startup-36984851998.zip" | shasum -a 256 --check - name: Run one instrumented startup with original assertions and deadlines timeout-minutes: 18 run: | set -euo pipefail python3 -B trusted-ci/scripts/ci/pi-intel/startup_diagnostic.py \ - --archive "$RUNNER_TEMP/pi-startup-36959948724.zip" \ + --archive "$RUNNER_TEMP/pi-startup-36984851998.zip" \ --output "$GITHUB_WORKSPACE/pi-startup-diagnostic-evidence" - name: Admit complete diagnostic evidence within the storage bound if: always() diff --git a/scripts/ci/pi-intel/rebind-diagnostic-pack.mjs b/scripts/ci/pi-intel/rebind-diagnostic-pack.mjs index d0e4801380..43565dd23d 100644 --- a/scripts/ci/pi-intel/rebind-diagnostic-pack.mjs +++ b/scripts/ci/pi-intel/rebind-diagnostic-pack.mjs @@ -3,7 +3,10 @@ import {readFileSync,writeFileSync} from 'node:fs'; import {createHash} from 'node:crypto'; import {join} from 'node:path'; import {canonicalJson,sha256Tree,sha256File,requireTrue,verifyPack} from './verify-pack.mjs'; -const [pack,originalSidecar,source] = process.argv.slice(2); +import {verifyProfile13Selection} from './verify-pack-profile13.mjs'; +const [pack,originalSidecar,source,profileMode] = process.argv.slice(2); +requireTrue(profileMode === undefined || profileMode === 'profile13', 'Unexpected diagnostic profile mode'); +requireTrue(process.argv.length === (profileMode ? 6 : 5), 'Unexpected diagnostic arguments'); const file=join(pack,'provider-pack.json'); const manifest=JSON.parse(readFileSync(file)); requireTrue(manifest.payload.runnerSourceRevision===source,'Original source mismatch'); requireTrue(manifest.payload.artifacts.acpxSidecar.path==='dist/cli/acpx-runtime-sidecar.cjs','Sidecar path mismatch'); @@ -14,4 +17,4 @@ p.distDigest=sha256Tree(join(pack,'dist')); p.bridgeDigest='sha256:'+createHash('sha256').update(p.artifacts.opencodeProxy.sha256).update('\n').update(p.artifacts.acpxSidecar.sha256).update('\n').update(p.distDigest).digest('hex'); manifest.digest='sha256:'+createHash('sha256').update(canonicalJson(p)).digest('hex'); writeFileSync(file,JSON.stringify(manifest,null,2)+'\n'); -console.log(JSON.stringify(verifyPack(pack,source,'darwin','x64'))); +console.log(JSON.stringify(verifyPack(pack,source,'darwin','x64',profileMode === 'profile13' ? verifyProfile13Selection : undefined))); diff --git a/scripts/ci/pi-intel/startup-diagnostic-inputs.json b/scripts/ci/pi-intel/startup-diagnostic-inputs.json index 8ba1f5128c..e564eb6e82 100644 --- a/scripts/ci/pi-intel/startup-diagnostic-inputs.json +++ b/scripts/ci/pi-intel/startup-diagnostic-inputs.json @@ -1,60 +1,62 @@ { "schema": "paperclip.native-intel-startup-diagnostic-input/v1", - "sourceRevision": "b9e5d6ecdb05ab7244c90976e07c950f8d09b15b", + "sourceRevision": "f5c5fde380f60937ef26cc5a92e1d6a043e9cddc", "resolvedLockSha256": "38338a6867358440c5ab5993eaeb85fb501bc7df65d24acf52fbd63c880ee4ba", - "artifactRunId": "36959948724", - "artifactId": "11208570718", - "artifactWorkflowRevision": "9541eb18789bac35242eeea3e569b77fa90d1818", - "artifactZipBytes": 1076365959, - "artifactZipSha256": "b82cf6c843006781e2e6d5f0a06e0ff39497ffc457b94a511f8bdda66628aa43", + "artifactRunId": "36984851998", + "artifactId": "11218057612", + "artifactWorkflowRevision": "94848f04150ed4f5de7762ff4687c633c7c9cc1a", + "artifactZipBytes": 699248654, + "artifactZipSha256": "5159dcb57b380648679d441a73b87d50334dcca969adc95150e8429a71cbdfeb", "selectedFiles": { "receipt.json": { - "bytes": 32763, - "sha256": "47ef1f494c59c1249ac42f08308a2fb83edcb0759890960059cc367ebdf12bf0" + "bytes": 31957, + "sha256": "28a572c4278ddbf99219dc720f78debc93dc442114478abf39a561390a8c3a7e" }, "provider-pack.tar.gz": { - "bytes": 1029214229, - "sha256": "5a550004ca982c49a2d86b3196676f3ce1877b6655ec730d1971b4cec2ba547d" + "bytes": 648246195, + "sha256": "cc4de9c130102fdb94f57556bac8efa225b2ee9035e72661d6b68a254799f8e9" }, "provider-pack.json": { - "bytes": 3629, - "sha256": "db5b1d7d825a0533a6506755c6209ccc4d45776c3abbf6c87ff845d1d47e99b2" + "bytes": 2743, + "sha256": "11f4dba65bb8d144898b5879271d72ff19920785c294ea32b22510c4442d2537" }, "pack-inventory.json": { - "bytes": 10633748, - "sha256": "172f0f4f2319f3716cca656cdeafd03b4f0db652def53101dfbf148850a20eaa" + "bytes": 10353069, + "sha256": "8de75e0f0185cbe0d9dfafefa417632e185ed3421fed85469ba20792f7fa8f69" }, "paperclip-runnerd": { - "bytes": 32035568, - "sha256": "29d5b0fc2ae2a552b89a107e3777e2c8ee356ebdbb13a14ceab8865e1cea1d45" + "bytes": 32036944, + "sha256": "cc9dcfb006e78d5808f642152c24304a84d84b80dc33ea352ddbc5ad2e216713" }, "source.tar": { - "bytes": 141742080, - "sha256": "b32d8e32639e6527804fe11bfa1aaefcefa87fca31e9155499e6b9a28f69dbd4" + "bytes": 141987840, + "sha256": "374600761ad9e0268f6e323bc9eb16aff800106d8baf886e39063ebc52d42e8a" }, "source-input-inventory.json": { - "bytes": 1033702, - "sha256": "7c160bb1fc4d049378004d014e398d42dabf12e8a73ec9cdda7679113aaa6949" + "bytes": 1035823, + "sha256": "849fc4f538e592c892c9e5b4eae9d37a606ffca301227d8649a5a6eff9c13edc" }, "resolved-pnpm-lock.yaml": { "bytes": 607788, "sha256": "38338a6867358440c5ab5993eaeb85fb501bc7df65d24acf52fbd63c880ee4ba" } }, - "originalSidecarSha256": "7462825f4b82bce8e2a69425eafe4ca8b2c8812df345269c82fb75aa21f3043c", - "originalPackDigest": "sha256:9cf4f88d9fcf63746f7716f773cb8d062544c19e0a78e111e60f659a3596b13f", - "daemonSha256": "29d5b0fc2ae2a552b89a107e3777e2c8ee356ebdbb13a14ceab8865e1cea1d45", + "originalSidecarSha256": "ce987993ffb92f449ef0432dee6cd7eb90ea19521ce3d7b51a185fed16ed8c47", + "originalPackDigest": "sha256:183e5a337dbf0edd9a3c210b2f539443996cf70ed35b77d281ae0e49d8eeb974", + "daemonSha256": "cc9dcfb006e78d5808f642152c24304a84d84b80dc33ea352ddbc5ad2e216713", "nodeSha256": "7abcf39bd37ab251015337ff75304d7555f0d8e88c6e0fbf04bce8ce34636f49", "testPath": "packages/paperclip-runner/test/pi-closed-startup.test.mjs", - "testSha256": "8967cf9c8cd130b68bf9d64abef8cb8d352af00646e2288b341d8c6ae758b47a", + "testSha256": "32bb057e1505082c0ed6b1d71cdd8cdb3271d920c2bea9cdc1ebddedf568c0c4", "observerSha256": "1fcf353beb90722f90401a7792a5853bf0807d964a1065e3f55b76a63bc4b4cc", - "profileDigest": "sha256:47306e6d2a9b59e8f9189f725ebb7a0a7f91826044d1739e1a35ab31f228ba1f", - "closureDigest": "sha256:03351f4a250a8db0e79411a9079b43a0ff05f72a2aff41fae17f1fc2de24bd41", + "profileDigest": "sha256:fe1e6da01b2a9e4c691ca27cf689d2d6de846a93be6b23fc1e103c9addd7b177", + "closureDigest": "sha256:4728e5a4e7fc1ba602c3e219824fb84884b05a06cdd19dd3e521ee312e1b373a", "model": "openrouter/deepseek/deepseek-v4-flash-0731", - "originalFailure": "Original 30s session.open timeout; settled35032ms; runner exit0 and owned cleanup verified;48SDK contracts passed; fresh Rust daemon and complete pack passed.", + "originalFailure": "Durable session.open command timed out at original30s; close drain barrier failed secondarily.61 SDK contracts passed; fresh Rust and full normal Pi13 pack verified; cleanup certain.", "executionCount": 1, "providerCalls": 0, "timeoutChanges": false, "archiveBytesMaximum": 268435456, - "retentionDays": 7 + "retentionDays": 7, + "profileVersion": 13, + "phaseLimit": "Native get_state is internal to unchanged wrapper; ACP new/set spans include it but do not identify its internal duration." } diff --git a/scripts/ci/pi-intel/startup_diagnostic.py b/scripts/ci/pi-intel/startup_diagnostic.py index 58d9e036c8..cf1888a97b 100644 --- a/scripts/ci/pi-intel/startup_diagnostic.py +++ b/scripts/ci/pi-intel/startup_diagnostic.py @@ -132,7 +132,7 @@ def execute(args): require(sha(node)==PIN['nodeSha256'] and sha(daemon)==PIN['daemonSha256'],'Native executable changed') require(json.loads(command('node-identity',[node,'-p','JSON.stringify([process.platform,process.arch,process.version])']))==['darwin','x64','v24.21.0'],'Node platform mismatch') command('daemon-signature',['/usr/bin/codesign','--verify','--strict',daemon]);require('Mach-O 64-bit executable x86_64' in command('daemon-architecture',['/usr/bin/file',daemon]),'Daemon architecture mismatch') - proof['originalPackVerification']=json.loads(command('original-pack-verify',[node,HERE/'verify-pack.mjs',pack,PIN['sourceRevision'],'darwin','x64'],180)) + proof['originalPackVerification']=json.loads(command('original-pack-verify',[node,HERE/('verify-pack-profile13.mjs' if PIN.get('profileVersion')==13 else 'verify-pack.mjs'),pack,PIN['sourceRevision'],'darwin','x64'],180)) require(proof['originalPackVerification']['manifestDigest']==PIN['originalPackDigest'],'Original pack identity mismatch') before_manifest=json.loads((pack/'provider-pack.json').read_text()) sink=scratch/'startup-timings.jsonl';fd=os.open(sink,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600);st=os.fstat(fd);os.close(fd) @@ -140,9 +140,9 @@ def execute(args): sidecar=pack/'dist/cli/acpx-runtime-sidecar.cjs';original_sidecar=sidecar.read_bytes();patched,patch=patch_sidecar(original_sidecar,identity) # Preserve original file mode; this one private copy now has an explicit diagnostic identity. sidecar.write_bytes(patched);atomic_json(out/'sidecar-patch.json',patch) - (out/'sidecar.diff').write_text(''.join(difflib.unified_diff(original_sidecar.decode().splitlines(True),patched.decode().splitlines(True),fromfile='original-B9-sidecar',tofile='diagnostic-sidecar'))) + (out/'sidecar.diff').write_text(''.join(difflib.unified_diff(original_sidecar.decode().splitlines(True),patched.decode().splitlines(True),fromfile='original-f5-profile13-sidecar',tofile='diagnostic-sidecar'))) command('diagnostic-sidecar-syntax',[node,'--check',sidecar]) - proof['diagnosticPackVerification']=json.loads(command('diagnostic-pack-rebind',[node,HERE/'rebind-diagnostic-pack.mjs',pack,PIN['originalSidecarSha256'],PIN['sourceRevision']],180)) + proof['diagnosticPackVerification']=json.loads(command('diagnostic-pack-rebind',[node,HERE/'rebind-diagnostic-pack.mjs',pack,PIN['originalSidecarSha256'],PIN['sourceRevision'],*(['profile13'] if PIN.get('profileVersion')==13 else [])],180)) after_manifest=json.loads((pack/'provider-pack.json').read_text());expected=copy.deepcopy(before_manifest) expected['payload']['artifacts']['acpxSidecar']['sha256']=after_manifest['payload']['artifacts']['acpxSidecar']['sha256'] for key in ['distDigest','bridgeDigest']:expected['payload'][key]=after_manifest['payload'][key] diff --git a/scripts/ci/pi-intel/startup_timing_patch.py b/scripts/ci/pi-intel/startup_timing_patch.py index 418cc825ce..9119efb52c 100644 --- a/scripts/ci/pi-intel/startup_timing_patch.py +++ b/scripts/ci/pi-intel/startup_timing_patch.py @@ -1,7 +1,7 @@ """Sparse additive instrumentation of one pinned bundle; never edits vendor closure bytes.""" import hashlib,json from source_guard import require -ORIGINAL_SHA='7462825f4b82bce8e2a69425eafe4ca8b2c8812df345269c82fb75aa21f3043c' +ORIGINAL_SHA='ce987993ffb92f449ef0432dee6cd7eb90ea19521ce3d7b51a185fed16ed8c47' PREFIX='__pcStartupDiagnostic' def patch_sidecar(original,sink): @@ -56,6 +56,14 @@ def patch_sidecar(original,sink): mark('// src/drivers/acpx/codex-runtime-adapter.ts',' commandLaunches.count += 1;','runtime.spawn.callback') mark('// src/drivers/acpx/codex-runtime-adapter.ts',' const ensuredSession = Promise.resolve().then(','runtime.ensure.begin') mark('// src/drivers/acpx/codex-runtime-adapter.ts',' cursorInstructions?.assertReady();','runtime.ensure.settled') + # Native RPC internals remain in the unchanged closure; these are ACP boundaries only. + mark('', ' async initializeProtocolConnection(connection, launch) {', 'acp.initialize.begin', True) + mark('', ' await this.authenticateIfRequired(connection, initialized.authMethods ?? []);', 'acp.initialize.response') + mark('// src/drivers/acpx/pi-thinking.ts', ' if (method === "session/new" || method === "session/load") {', 'pi.acp.session.request', True) + mark('// src/drivers/acpx/pi-thinking.ts', ' const result = object(message.result);', 'pi.acp.correlated.response') + mark('// src/drivers/acpx/pi-thinking.ts', ' state.mode = mode;', 'pi.acp.mode.verified', True) + mark('// src/drivers/acpx/codex-runtime-adapter.ts', ' await runtime.setConfigOption({ handle: ensuredHandle, key: "thought_level", value: selectedPiThinkingLevel });', 'pi.acp.thought_level.begin') + mark('// src/drivers/acpx/codex-runtime-adapter.ts', ' piThinking.assertReady();', 'pi.acp.thought_level.verified', True) # Catch-all standalone function boundaries relevant to verified-runtime preparation. for name in ['verifyAcpxProfileInstallation','verifyQualifiedRuntimeExecutable','openVerifiedRuntimeExecutable','openVerifiedCommandDirectory','createAcpxPrivateSnapshot','acquireAcpxProviderLifetimeLease']: anchor='async function '+name+'(' diff --git a/scripts/ci/pi-intel/test_startup_diagnostic.py b/scripts/ci/pi-intel/test_startup_diagnostic.py index d309e9ab9e..a332cabc1b 100644 --- a/scripts/ci/pi-intel/test_startup_diagnostic.py +++ b/scripts/ci/pi-intel/test_startup_diagnostic.py @@ -37,20 +37,20 @@ class DiagnosticTests(unittest.TestCase): for change in reversed(proof['insertions']): shift-=len(change['inserted']);at=change['offset']+shift;text=text[:at]+text[at+len(change['inserted']):] self.assertEqual(text.encode(),self.original);self.assertEqual(hashlib.sha256(text.encode()).hexdigest(),ORIGINAL_SHA) - self.assertEqual(len(proof['phases']),47) + self.assertEqual(len(proof['phases']),54) def test_wrong_original_rejected(self): with self.assertRaises(RuntimeError):patch_sidecar(self.original+b' ',{'path':'unused','dev':'1','ino':'2','uid':'3'}) - def test_retained_b9_pack_identity_and_original_test_contract(self): - self.assertEqual(PIN['sourceRevision'],'b9e5d6ecdb05ab7244c90976e07c950f8d09b15b') - self.assertEqual(PIN['artifactRunId'],'36959948724') - self.assertEqual(PIN['artifactId'],'11208570718') + def test_retained_f5_pack_identity_and_original_test_contract(self): + self.assertEqual(PIN['sourceRevision'],'f5c5fde380f60937ef26cc5a92e1d6a043e9cddc') + self.assertEqual(PIN['artifactRunId'],'36984851998') + self.assertEqual(PIN['artifactId'],'11218057612') self.assertEqual(PIN['originalSidecarSha256'],ORIGINAL_SHA) self.assertEqual(PIN['selectedFiles']['paperclip-runnerd']['sha256'],PIN['daemonSha256']) self.assertEqual(PIN['selectedFiles']['resolved-pnpm-lock.yaml']['sha256'],PIN['resolvedLockSha256']) - self.assertEqual(PIN['testSha256'],'8967cf9c8cd130b68bf9d64abef8cb8d352af00646e2288b341d8c6ae758b47a') + self.assertEqual(PIN['testSha256'],'32bb057e1505082c0ed6b1d71cdd8cdb3271d920c2bea9cdc1ebddedf568c0c4') self.assertEqual((PIN['executionCount'],PIN['providerCalls'],PIN['timeoutChanges']),(1,0,False)) self.assertEqual((PIN['archiveBytesMaximum'],PIN['retentionDays']),(268435456,7)) - def test_b9_markers_follow_outer_layout_and_snapshot_boundaries(self): + def test_f5_markers_follow_outer_layout_and_snapshot_boundaries(self): _,proof=patch_sidecar(self.original,{'path':'/private/tmp/pc-intel-diagnostic-fixture/startup-timings.jsonl','dev':'1','ino':'2','uid':'501'}) phases=proof['phases'] self.assertFalse(any(p.startswith('pi.hash.') for p in phases)) @@ -62,6 +62,17 @@ class DiagnosticTests(unittest.TestCase): start=source.index(begin);finish=source.index(end,start) interior=[x for x in proof['insertions'] if start < x['offset'] < finish] self.assertEqual(interior,[]) + def test_pi_acp_markers_preserve_actual_admission_and_no_native_rpc_claim(self): + _,proof=patch_sidecar(self.original,{'path':'/private/tmp/pc-intel-diagnostic-fixture/startup-timings.jsonl','dev':'1','ino':'2','uid':'501'}) + for phase in ['acp.initialize.begin','acp.initialize.response','pi.acp.session.request','pi.acp.correlated.response','pi.acp.mode.verified','pi.acp.thought_level.begin','pi.acp.thought_level.verified']: + self.assertEqual(proof['phases'].count(phase),1) + self.assertFalse(any('get_state' in phase for phase in proof['phases'])) + source=self.original.decode() + selected=next(x for x in proof['insertions'] if 'Mark("pi.acp.thought_level.verified")' in x['inserted']) + self.assertTrue(source[:selected['offset']].endswith(' piThinking.assertReady();')) + def test_unknown_rebind_profile_rejects_before_any_pack_access(self): + result=subprocess.run([os.environ['PI_DIAGNOSTIC_TEST_NODE'],str(Path(__file__).parent/'rebind-diagnostic-pack.mjs'),'/nonexistent-pack','0'*64,'0'*40,'unknown'],capture_output=True,text=True,timeout=5) + self.assertNotEqual(result.returncode,0);self.assertIn('Unexpected diagnostic profile mode',result.stderr);self.assertNotIn('ENOENT',result.stderr) def test_missing_terminal_retains_incomplete_classification(self): with tempfile.TemporaryDirectory() as tmp: p,b=self.binding(Path(tmp))