test(cli): qualify released Runtime Host State Roots

[me2seeks]

Summary

• add an external Linux qualification harness for immutable CLI tarballs and persisted State Roots
• create a Session, durable message, and future Scheduled Task through the exact source package closure
• prove source self-reopen, the single-writer fence, target Runtime Host Ready, and exact semantic fact preservation
• gate CLI package validation on real same-epoch, cross-epoch, and registry-selected current-Nightly-to-candidate transitions
• preserve a bounded JSON evidence report for each matrix cell

The harness installs source and target independently with empty offline npm caches, runs the whole scenario in one Bubblewrap OS-account sandbox, and restores each scenario into the original State Root directory identity from an untouched golden copy.

Evidence boundaries

• rollback is not claimed
• downgrade remains unsupported
• this harness does not claim to exercise the external npm-reconciliation transaction itself
• Linux is the first bounded platform; remote/operator-managed Hosts, direct npx, and presentation remain out of scope

Dual audit

Correctness and lifecycle

GO, with no remaining finding.

• exact SHA-256 and a 64 MiB artifact bound are checked before installation
• expected same/different compatibility epochs are fenced
• every artifact interprets the root through its own installed package closure
• a second closure cannot acquire the source-held writer
• source and target Hosts must publish exact Ready evidence and exit cleanly after SIGINT
• Session identity, message content, Scheduled Task identity, schedule, effect, and status must remain equal
• pipeline failures cannot be masked by tee

Architecture, ownership, and simplification

GO, with no P0-P3 simplification candidate.

The change adds no production protocol, migration entry point, owner record, journal, lock, scheduler, or rollback authority. The qualification adapter owns only release evidence; Runtime Host and Storage retain their existing authority. Artifact identity, sandbox/account isolation, fixture authority, writer fencing, Host activation, and CI evidence were all reviewed.

Validation

• full repository build
• npm run check:release: 152/152
• scoped Biome and git diff --check
• focused predecessor/workflow/qualification tests: 33/33
• real public cross-epoch transition:
  • 0.2.0-dev.3.20260830, epoch 74, SHA-256 66b1ce…f414
  • 0.2.0-dev.4.20260830, epoch 76, SHA-256 b7d48a…fc0
• real public same-epoch transition:
  • 0.2.0-dev.4.20260830, epoch 76
  • 0.2.0-dev.5.20260830, epoch 76, SHA-256 e7a682…989f
• hosted registry-selected current Nightly to exact-head CI candidate:
  • 0.2.0-dev.10.20260831, epoch 79, SHA-256 5b225f…7df
  • 0.2.0, epoch 79, SHA-256 3ae1f0…454
  • canonical npm tarball URL and SHA-512 integrity remained current after qualification

Refs #3243
Refs #3231

中文说明

本 PR 增加真实发布物的持久 State Root qualification。source 发布包自身创建 Session、消息和未来 Scheduled Task；先证明 source 可重新打开，再证明 target closure 无法抢占仍被持有的 writer；之后启动 target 发布包自己的 Runtime Host 到 Ready，并验证全部持久事实保持一致。

CI 固定验证两份同 epoch 发布物、两份跨 epoch 发布物；动态场景在 validation 开始时从 npm registry 固化当前 nightly 的 version、规范 tarball URL 与 SHA-512 integrity，资格测试后以及真正发布/暂存前都会重新确认该 identity。整个场景位于同一个 Bubblewrap OS-account sandbox，避免触碰 runner 的真实本地 authority；golden root 从不直接打开，恢复时保留原 State Root 目录 identity。

实现后正确性/生命周期与架构/owner 双重审查均为 GO。没有新增生产 protocol、owner、journal、lock、scheduler、migration API 或 rollback 权限。报告明确不声称验证 downgrade、external npm reconciliation transaction 本身或非 Linux 平台。

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex assisted with architecture analysis, implementation, released-artifact experiments, tests, and local dual review.

[jackwener]

I found one release-gate issue at exact head c54b7c4327c83b6ba93b71ab87f59b9bda210f05.

[P1] The “latest published to candidate” qualification is already testing an obsolete predecessor. The matrix entry in .github/workflows/cli-package-validation.yml pins 0.2.0-dev.8.20260830. The live npm nightly tag is now 0.2.0-dev.10.20260831; versions dev.9 and dev.10 were published after this exact-head check began, and neither publication invalidated or reran the green qualification. Therefore a candidate can retain a successful “latest published to candidate” check without ever opening the State Root produced by the release that users will actually upgrade from. The policy test only checks that some SHA-256 is present, so it cannot detect this drift.

Please bind this matrix cell to the immutable predecessor selected at release-validation time and make a newer nightly publication invalidate or rerun that evidence. For example, the release workflow can pass the exact nightly version and digest into qualification, with a policy check that the selected identity still matches the release predecessor. Keep the older same-epoch and cross-epoch fixtures as fixed historical baselines.

The harness itself is bounded and the exact-head unit/policy tests passed 14/14; the hosted State Root cells are green. The finding is that the central “latest predecessor” premise can become false while those checks stay green.

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.

[me2seeks]

Confirmed and fixed at exact head ff0b2cafff99e6ac3faab508bea44704c9cca2c6.

The static dev.8 cell is gone. The release-validation workflow now:

• resolves the live npm nightly tag into one immutable version, canonical registry tarball URL, and npm SHA-512 integrity;
• downloads the source tarball once, verifies those exact bytes against the selected integrity, then derives the SHA-256 consumed by the existing qualification harness;
• revalidates the selected predecessor after State Root qualification;
• exports the same immutable identity to the reusable workflow callers;
• revalidates it again immediately before either npm Nightly publication or formal npm staging.

If the tag, URL, or integrity advances after qualification, the release mutation fails and requires a fresh validation run. The fixed historical same-epoch and cross-epoch baselines remain unchanged. The predecessor parser also accepts a valid Nightly from a previous product core, so a 0.2 nightly -> 0.3 candidate transition is not incorrectly blocked.

Local evidence on the rebased exact head:

• full repository rebuild
• npm run check:release: 152/152
• focused predecessor/workflow/qualification tests: 33/33
• scoped Biome and git diff --check
• live npm predecessor resolution: 0.2.0-dev.10.20260831
• downloaded public tarball: 32,444,808 bytes; npm SHA-512 integrity and derived SHA-256 verified

Hosted exact-head checks are now running.

中文说明

已确认并修复该 P1。动态 qualification 不再固定 dev.8，而是在 validation 开始时从 npm registry 解析当前 nightly，固化为 version、规范 tarball URL 与 SHA-512 integrity。下载后验证真实 bytes，再派生现有 harness 使用的 SHA-256。

State Root qualification 结束时会重新确认 predecessor；真正执行 npm Nightly publish 或 formal staging 前还会再次确认。如果期间出现新 nightly，旧证据会失效并要求 fresh run。历史同 epoch/跨 epoch 固定基线保持不变。

[me2seeks]

Hosted validation is complete at exact head 6e4b4790ee766e599030aa359b009b754e6721b9.

• all required checks pass;
• the registry-selected cell qualified 0.2.0-dev.10.20260831 (epoch 79, SHA-256 5b225f05b588fe89ea3a65561e44557bd4f4dc74ba557ae10352a534327067df) against the exact candidate 0.2.0 (epoch 79, SHA-256 3ae1f0d9edc7d638e6cd2b7020b619afa6d0c305519b0ffaa69700f977c28454);
• the canonical npm URL and SHA-512 identity still matched after qualification;
• the fixed same-epoch and cross-epoch cells also pass;
• the first rerun exposed the repository-wide 45-minute runner policy on the new resolver lane; the lane now uses that policy, and the exact-head CI planner plus full CI pass.

The PR description now records the dynamic predecessor contract and the hosted evidence. The P1 is addressed; re-review remains the only review gate.

中文说明

新 head 的完整 CI 已通过。动态场景真实验证了当前 npm Nightly dev.10 到候选包，并在资格测试结束后再次确认 version、规范 tarball URL 与 SHA-512 integrity 未漂移。新增 resolver job 的统一 45 分钟 runner policy 也已修复并由托管 CI 验证。P1 已处理，当前只剩重新 review。

[jackwener]

The previous P1 is closed at exact head 6e4b4790ee766e599030aa359b009b754e6721b9, and I found no remaining P0-P2 issue.

The static dev.8 predecessor is gone. Validation now resolves npm's live nightly tag into one immutable version, canonical registry tarball URL, and SHA-512 integrity; verifies the downloaded bytes against that identity; and derives the SHA-256 consumed by the qualification harness. It then revalidates the same predecessor after qualification and again immediately before either npm Nightly publication or formal staging. A newly published Nightly therefore invalidates the old evidence instead of leaving a stale green gate.

The exact-head hosted run selected 0.2.0-dev.10.20260831, verified the public tarball's npm integrity, qualified its epoch-79 State Root against the exact epoch-79 candidate, and confirmed that the registry identity remained current afterward. The fixed historical same-epoch and cross-epoch cells also passed. I independently confirmed that npm still resolves the same version, URL, and SHA-512 identity.

The original five commits are range-diff identical after the rebase; the two new commits contain the predecessor binding and the repository-standard runner timeout. A full rebuild, npm run check:release (152/152), the focused predecessor/workflow/qualification tests (33/33), and all exact-head hosted checks passed. Current main produces a clean synthetic merge; its only changed-file overlap is an independent root-package script edit.

---

Automated review notice: This comment was posted by an automated review agent operated by WAWQAQ. It is not an independent human review and does not replace one.