Repository navigation
fix(sdk): bind installed tools and published image identities - #60
Conversation
|
@codex review Please review exact current source head |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
## Summary Switch supported Classic builds to LLVM 23.1.3 on Linux and native macOS, and LLVM-MinGW 20261006 UCRT on Windows. Preserve dependency features and optimization behavior with LTO and PGO disabled. ## Implementation / behavior Use Clang, LLD, LLVM utilities, compiler-rt and libunwind with compatible platform libraries. Support monorepo, scoped archive and installed-consumer builds; preserve profiling identities and strict native LCOV export. Pin current Linux, Windows and release compilers to verified immutable SDK 1.18 images. Bind Windows package helpers and CMake discovery to the selected host Python, independently of target Windows Python. Authenticate current recipes, including both shared libatrinik CMake inputs and the integrated protocol 1084 CMake changes; retain all six original historical release producers. Run historical GCC and current LLVM server benchmark revisions in separate authenticated containers and caches, preserving strict current LLVM builds and recording the compiler difference. Changes to the benchmark runner and its tests select the requested server benchmark and applicable native checks. Avoid draining unrelated primary-map work when allocating the minimap's first instance buffer. Preserve completion waits before replacing existing resources. Add deterministic coverage for both cases. Keep the 30-second Windows close deadline and bounded owned-thread stack diagnostics. Record a query-only per-thread CPU baseline before close; after timeout rank matching live thread generations by CPU delta and capture at most two bounded module-relative stacks. Bound sampling and observers, retain owned handles, and resume each thread before unwind. Compile the observer before application startup. Missing, new or exited threads remain unavailable rather than inferred. Add child-scoped dual-opt-in presentation diagnostics, capped at one bounded identity and 64 paired map-bearing frame records. Record observed resource retirements separately from submissions without new GPU queries or waits. Fence bounded process CPU snapshots by owned handle and process generation; preserve presentation order and the 30-second close deadline. Authenticate 15 selected compiler/version/runtime/sound/dependency policy inputs and reject ten preferred local shadow paths. Document that this policy-routing drift guard does not attest the entire executable source graph or compiler origin; exact-source review and actual build evidence remain required. Route the shared toolkit-interface test through both native client and server jobs. Isolate temporary benchmark repositories from inherited Git maintenance, hooks and templates. Apply the same fixture-only policy to clone, commit and worktree operations; retain strict cleanup and actual historical-contract and offline routing assertions. A hostile-policy regression covers successful comparison and candidate failure. Production benchmark execution is unchanged. Keep the complete 13,146-tick long freeze regression in a separate Check case with a finite 30-second budget and identical fixtures; other Core tests retain their default budget. Integrate Classic main `2654b1bef9573f3e167d470a3cb9c72acd04819c`, including matching protocol 1084 sources and the native changes required by content 1.12. ## Validation Current head: `9f2e4321a8176a0687b85cb6f6b222f88f91d820`. - Integrated tooling: 819 tests run, with 770 passing and 49 prerequisite skips. Client tooling: 221 tests run, with 219 passing and two prerequisite skips. Import history, compilation, ShellCheck, actionlint and whitespace checks pass. - [Actual current-head macOS ARM64 LLVM qualification](https://github.com/atrinik/classic/actions/runs/38197941900/job/114644993220) at `9f2e4321` passes all 93 selected CPU tests without failures or skips, including 24 HTTPS transport cases in 12.9097 seconds. LLVM/LLD 23.1.3, compiler-rt, native C/C++ SDK probes and the production Release client/shared-library graph are verified. Independent evidence review authenticates the artifact and exact source. The fixture avoids numeric-loopback reverse DNS while preserving TLS checks and deadlines; its focused independent review passes 15 tests without skips. GPU, Intel macOS and packaging are outside this receipt. - Independent source reviews clear GPU resource/fence ordering, historical benchmark compiler selection, Windows host-Python propagation and current/historical recipe authentication. Actual clean new-main baseline selection retains GCC 15.2 / SDK 1.16; current selection uses LLVM 23.1.3 / SDK 1.18. - Isolated client LLVM Release and coverage builds each pass 74 tests with 24 GPU prerequisite skips. Required software Vulkan conformance and ASAN/UBSAN conformance pass separately. Native LLVM LCOV measures all 59 objects; restoring the old guard fails the new checkpoint as expected. The diagnostic candidate also compiles production Release with BUILD_TESTING=OFF; required default/dual-opt-in software Vulkan and ASAN/UBSAN runs pass. Default emits zero progress records; opt-in hits exactly 129 lines. Native LCOV measures all59 objects. ASan leak detection was disabled. Fresh exact-head hosted checks and Codex reviews remain required. - Isolated server LLVM coverage passes all 74 tests without skips. Native LCOV exports; restoring the unsnapped implementation fails the original numerical assertion without timing out. [Preceding a269 hosted validation](https://github.com/atrinik/classic/actions/runs/38186893910) passes server validation, all applicable native jobs, trusted GPU coverage and the Classic aggregate; the long freeze case completes in 5.46 seconds. - [Preceding manual Check at `665b4c0`](https://github.com/atrinik/classic/actions/runs/38192939780) passes every applicable job and the aggregate, including native Windows and macOS. The [preceding PR Check](https://github.com/atrinik/classic/actions/runs/38192845442) fails during temporary historical Git-clone cleanup. Trace evidence confirms fixture maintenance can write after commit returns; attribution of that exact hosted cleanup error remains unproven. The fixture-only repair passes 69 focused tests and independent review, including a reproduced inherited-hook control on both clone and comparison worktree paths. At preceding `31585a03`, all 819 integrated tooling tests pass locally. Current `9f2e4321` runs 820 integrated tooling tests: 771 pass and 49 prerequisite-dependent cases skip. The initial native run inherited umask 077 and failed an existing 0755 fixture; the unchanged suite passes with required umask 022. Independent source review verifies the final integrated tree and unchanged validated diagnostic bytes. Current `31585a03` Core and server checks pass, and Codex code review is clear. [Current manual Check](https://github.com/atrinik/classic/actions/runs/38195355359) passes all applicable jobs and the aggregate. [Current PR Check](https://github.com/atrinik/classic/actions/runs/38195204260) fails native Windows close acceptance and therefore the aggregate. CodeQL and server benchmark checks pass. The separate private Security Report is unavailable; older summaries are not represented as fresh. - [Hosted validation at preceding 24f6ecb](https://github.com/atrinik/classic/actions/runs/38188937290) passes every applicable PR job and the aggregate; both current-source Codex code reviews are clear. The subsequent actual macOS receipt verifies the repaired fixture. Those receipts retain their exact source/environment scope. - Requested server benchmarking on preceding `b327` successfully builds and executes the genuine GCC15.2/SDK1.16 base and Clang23.1.3/SDK1.18 head. Small informational samples do not establish a reliable speedup or regression; client performance is qualification-skipped. - The preceding [992 native Windows failure](https://github.com/atrinik/classic/actions/runs/38183085286/job/114601040626) captured the unnecessary first-minimap wait. Subsequent [b327 Windows validation](https://github.com/atrinik/classic/actions/runs/38185624774/job/114608676629) presents its first gameplay frame but then stalls in SDL D3D12 swapchain acquisition; subsequent a269 and [24f6ecb native Windows validation](https://github.com/atrinik/classic/actions/runs/38188937290/job/114618790758) pass. The latter observes successful close within 19.407 seconds of close acceptance on the hosted Microsoft Basic Render Driver, inside the unchanged 30-second deadline. The earlier stall remains intermittent and unresolved. Current `31585a03` [native Windows PR validation](https://github.com/atrinik/classic/actions/runs/38195204260/job/114637655549) times out at the unchanged 30-second close deadline during frame 2 presentation. Process CPU advances 29.968 seconds over 30.016 wall seconds; this does not identify the busy thread or prove GPU work is responsible. The [same-head manual validation](https://github.com/atrinik/classic/actions/runs/38195355359/job/114638346378) passes, with frame 2 presentation taking 22.228 seconds on the same reported software adapter and driver version. The last observed map retirement count does not establish continuous fence state during blocked presentation. The current source adds independently reviewed bounded CPU-ranked thread diagnostics. Local actual PowerShell/C# fixtures and 31 focused Python cases pass. [Current `9f2e4321` PR validation](https://github.com/atrinik/classic/actions/runs/38197868994) passes all applicable jobs and the aggregate, and exact-head Codex review is clear. The native Windows fixture successfully identifies and captures the CPU-busy worker with bounded top-two output and natural child exit. Actual real-client close succeeds inside 30 seconds. Independent current macOS and Windows evidence reviews are clear. [Current manual Check](https://github.com/atrinik/classic/actions/runs/38197941900) also passes every applicable job and the aggregate, including both actual native qualification paths and trusted software GPU coverage. All fresh required/applicable checks pass; no unresolved current review findings remain. This preceding failure is still unresolved; no rendering fix is claimed. Earlier native macOS and server qualification receipts retain their exact source/environment scope. - Released SDK 1.18 identities and native Windows producer artifacts are independently verified. Classic #586 and SDK #55/#56 are merged; SDK [#59](atrinik/devcontainer#59) is merged after full CI and exact-head reviews; SDK [#60](atrinik/devcontainer#60) prepares final portable receipts/inventories and workspace [#647](atrinik/atrinik#647) retain separate gates. ## Limitations / follow-up Removing the unnecessary wait does not establish timely underlying GPU completion or complete Windows stall recovery; fresh native Windows acceptance remains required. Physical GPU qualification, audible playback and human-approved goldens remain outstanding. After current checks/reviews pass, merge Classic and run the main-only nonpublishing release rehearsal. Qualify a portable producer bound to merged Classic revision M, verify its genuine release, complete workspace build/export/relocation acceptance, and synchronize provider guidance and pins. Released portable SDK 1.18 remains preliminary. No live deployment is included.
|
@codex review Please review current commit |
|
@codex security review Please review current commit |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 46f3961a97
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
(cherry picked from commit dc0b45707fdc6e96b3484ea182602d2d7d821456)
(cherry picked from commit 288a5137c2ac00d0fdb5979ec556d6a279cbd667)
(cherry picked from commit a960d517e5908280b72373a25972ef9f21d1e8e8)
|
@codex review Please review current signed head d18a2de, including both repaired P2 findings and the cumulative producer/collector trust boundaries. All 200 SDK tooling tests and 66 portable tests pass; independent integrated source/security review is clear. Candidate image publication remains blocked pending fresh current-head CI and reviews. |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d18a2de5da
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex review Please review current commit |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
@codex security review Please review current commit |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
@codex review |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
@codex review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0a971445fe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
(cherry picked from commit ace7f90ef52eb232c8d3c00d856e1015f006aeb6)
|
@codex review |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: abcbc50af6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
(cherry picked from commit 0885eadcb937221f3e793ed0cb498ce188f27e31)
(cherry picked from commit 42d56ad8e2430dabbaef66d3b5ee7430e8f4fdbd)
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
🎉 This PR is included in version 1.22.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
Summary
Complete the Classic LLVM SDK's protected tool inventory and bind published Linux images to the exact images exercised by runtime tests. Pin the portable consumer to merged Classic revision
bd5317a03cdc82f029105c5dc26428b09fcd54b3. Install the pinned gh-stack asset without anonymous release-API discovery.Implementation / behavior
Retain and authenticate CMake, Ninja and pkgconf alongside the twelve LLVM tools. Validate the required LLVM, audio, curl and c-ares manifests and declared archives. Read actual libcurl and libcares bytes through the same authenticated image reader; require protected provider/tool files and their ancestors to be root-owned, with existing path, mode, symlink and hash checks.
Capture each loaded broad, slim Classic and portable image's immutable Docker ID before its runtime checks. After pushing SHA candidates, verify actual OCI index, platform manifest and config digests and compare ordered rootfs layers and complete execution config with the captured image. Allow only named publication metadata and explicit Docker defaults. Retain the raw metadata and hashed reports as mandatory artifacts before promoting any rolling, platform or release aliases. Candidate-only dispatches publish candidate SHA tags without moving aliases.
Normalize the nine Docker API 1.49 empty-string and false config fields that raw OCI configs omit. Retain complete type-sensitive execution-config comparison: non-default values, wrong types and unknown-field differences still fail.
Fetch gh-stack's exact
v0.1.0Linux asset directly and verify its existing checksum before installation and again afterward. Reproduce GitHub CLI 2.97.0's six-field binary-extension manifest and preserve Ubuntu-owned extension directories, existing license and source pins, runtime checks and release-attestation verification. This removes the latest-release API lookup that failed with an anonymous HTTP 403 despite--pin.Register the publication verifier, its imported collector and both test files in portable, broad Linux and slim Classic image-change selection. Follow-up changes to any of these inputs retain image validation; existing Windows selection remains intact. Regression tests execute the real workflow selector against isolated Git histories.
Preserve historical released-image targets and final-cohort admission. Capture runner-masked dependency-review summaries in head/run/attempt artifacts; existing advisory and provenance policy remains applicable.
Validation
0de3f509c9cf4d47252d44ef15d13c35fd8244db: 245 tooling and 66 portable tests passed, including provider/ownership controls, OCI descriptor and runtime-config mutations, workflow ordering and candidate alias isolation.bd5317a03cdc82f029105c5dc26428b09fcd54b3passed main Check, CodeQL and actual package release validation. Self-review and independent review verified native Windows/font evidence, all 779 extracted AppImage payload hashes, 69 library records and 365 released sound files; the hosted package passed three clean runtime platforms and a software Vulkan/virtual-audio fixture. Qualification remains scoped to that exact source and those checks.0de3f509c9cf4d47252d44ef15d13c35fd8244db; the actual current dependency summary was read and assessed. Fresh automatic reviews after the ready transition remain required before candidate publication and merge.--checkvalidation with no warnings. These configuration checks executed no DockerfileRUN, image build, export or push.Limitations / follow-up
The passed consumer qualification, current SDK CI and configuration checks do not qualify the eventual released SDK image. Actual hosted candidate publication must prove the loaded-to-pushed image binding. SDK merge/release, final released metadata collection and wrapper adoption require their own current-revision acceptance.
These checks do not establish physical GPU performance, audible playback, human-approved golden images or final exported-package qualification. The maintainer owns physical Linux GPU qualification.