diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 741efaf..c0a5010 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,8 +14,8 @@ updates: - minor - patch ignore: - # Canvas 1.0.12/1.0.13 SIGSEGV under Electron 41 on Linux; see #29. - # Keep 1.0.11 until a newer release passes the native verification gate. + # Canvas 1.0.12/1.0.13 SIGSEGV'd under Electron 41 on Linux (#29, closed). main is on 1.1.0 + # with Electron 45; this ignore only keeps those two builds from ever coming back. - dependency-name: '@napi-rs/canvas' versions: ['1.0.12', '1.0.13'] diff --git a/CLAUDE.md b/CLAUDE.md index a7eb877..7c10d88 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -118,24 +118,31 @@ These are tracked gaps that the project slash commands help address: dark/light themes with `critical+serious` hard-fail. The graph-canvas keyboard path closed 2026-07-03 (U-T14: React Flow node focus + selection toolbars, pinned by oracles). Remaining for a formal AA claim: a manual screen-reader pass (NVDA) only. -2. **SW-40 packaged verification: Windows x64 done, rest outstanding** — `asarUnpack` unpacks only - the eight worker entry bundles (`dist/{…,oramaRestoreWorker}.js`) plus the packages they require - at runtime (the pino, sharp and tesseract.js dependency closures), so main/preload/renderer stay - inside the integrity-validated asar. `verify:electron-fuses-config` fails if a pattern unpacks - `dist/main.js` again; `verify-packaged-artifacts` fails if a worker's externals do not resolve - inside `app.asar.unpacked`. On 2026-11-08/09 a Windows x64 build of main (installer + zip) passed - in Windows Sandbox (clean Windows 11, networking off): fuses match config, the renderer loads - from `app.asar`, a tampered asar header stops the app ("Integrity check failed for asar archive - entry"), silent install and first/second launch work, the zip launches and its updater skips with - the zip reason, the bundled VC++ runtime installs, local AI initializes, the OCR, - image-preprocess and embedding worker pools run, and four synthetic files analyze. The same test - on the published v5.1.2 (latest release, 2026-11-01) found local AI broken on clean PCs (missing - VC++ runtime, `NoBinaryFoundError`) and those workers crashing (`pino-std-serializers`); both are - fixed on main but **not yet released**. Not yet verified: Defender real-time-protection timing - (Sandbox disables Defender), the interactive UAC/decline path, the zip's **Install now** - click-through, whether an Azure-signed build keeps Microsoft's signature on `vc_redist`, the - vision model (timed out in the memory-limited sandbox), and macOS, Linux and Windows-arm64 - packaged builds. The checklist lives in +2. **SW-40 packaged verification: all four platforms smoke-tested; a few manual checks remain** — + `asarUnpack` unpacks only the eight worker entry bundles (`dist/{…,oramaRestoreWorker}.js`) plus + the packages they require at runtime (the pino, sharp and tesseract.js dependency closures), so + main/preload/renderer stay inside the integrity-validated asar. `verify:electron-fuses-config` + fails if a pattern unpacks `dist/main.js` again; `verify-packaged-artifacts` fails if a worker's + externals do not resolve inside `app.asar.unpacked`. On 2026-11-08/09 a Windows x64 build of main + (installer + zip) passed in Windows Sandbox (clean Windows 11, networking off): fuses match + config, the renderer loads from `app.asar`, a tampered asar header stops the app ("Integrity + check failed for asar archive entry"), silent install and first/second launch work, the zip + launches and its updater skips with the zip reason, the bundled VC++ runtime installs, local AI + initializes, the OCR, image-preprocess and embedding worker pools run, and four synthetic files + analyze. The same test on the published v5.1.2 (latest release, 2026-11-01) found local AI broken + on clean PCs (missing VC++ runtime, `NoBinaryFoundError`) and those workers crashing + (`pino-std-serializers`); both are fixed on main but **not yet released**. On 2026-11-09 the + dispatch-only `.github/workflows/packaged-smoke.yml` (run 42649893628) built, installed and + launched all four packages with a throwaway profile and `scripts/packaged-launch-smoke.js`: + Windows x64 and arm64 Azure-signed (silent NSIS install; our files carry the Kennedy Applied + Sciences signature and `vc_redist..exe` keeps Microsoft's, in the installer and the + installed copy), macOS arm64 (unsigned, Metal) and Linux x64 (xvfb, CPU). Each reached + coordinated startup, loaded the native AI engine (Windows x64 on a Hyper-V GPU falls back from + Vulkan to CPU, which the check reports but allows) and ran the packaged OCR worker on a synthetic + image. Still not verified: Defender real-time-protection timing (Sandbox disables Defender), the + interactive UAC/decline path, the zip's **Install now** click-through, the vision model (timed + out in the memory-limited sandbox), the Atlas, log-export, settings-import and large-library + restore workers, and a signed and notarized macOS build. The checklist lives in [`docs/RELEASING.md` § Packaged-integrity checks](docs/RELEASING.md#packaged-integrity-checks) — keep that the single source and do not re-fork it here. diff --git a/docs/RELEASING.md b/docs/RELEASING.md index a7136ed..cb3d737 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -412,6 +412,33 @@ feature on). through no UAC prompt and no **Install now**, and the memory-limited sandbox can time out the vision model. +### Packaged smoke workflow (all platforms) + +`.github/workflows/packaged-smoke.yml` is dispatch-only and publishes nothing. Run it on the release +branch before tagging (Actions → **Packaged Smoke** → **Run workflow**, or +`gh workflow run packaged-smoke.yml --ref `). Each leg can be switched off with its input. + +- **Windows x64 and arm64** use the same Azure Trusted Signing steps as `release.yml`. With + `require_signing` on (the default), the leg fails unless our installer and app carry the Kennedy + Applied Sciences signature and `vc_redist..exe` keeps Microsoft's, in the built package and + in the silently installed copy. That answers the Visual C++ item's signature check above. +- **macOS arm64** builds unsigned (`CSC_IDENTITY_AUTO_DISCOVERY=false`), so it does not replace the + signed and notarized check in `mac-release.yml` and `verify-mac-signing.yml`. +- **Linux x64** launches `release/build/linux-unpacked` (the files the AppImage wraps) under `xvfb` + with `--no-sandbox`. +- **Every leg** launches the app with a throwaway profile through `scripts/packaged-launch-smoke.js` + (no model downloads, updater off). It passes only if coordinated startup completes, the native AI + engine loads, and the packaged OCR worker reads a synthetic image, with no `Cannot find module`, + worker error, `ERR_DLOPEN_FAILED`, integrity failure or failed startup in the log. A GPU backend + that fails and falls back to the CPU (Vulkan on the runner's Hyper-V GPU) is recorded under + `gpuFallbacks` and allowed; `NoBinaryFoundError` on the CPU backend fails the run. Logs, the + verdict and the Windows signature table are uploaded as + `packaged-smoke---`. +- **Still manual.** The runners have no models and click nothing, so the vision model, Atlas, log + export, settings import, a large-library restore, the UAC and **Install now** paths, Defender + timing, the tamper test and the updater live smoke stay with the checklist and the Windows Sandbox + run above. + ### Windows zip (no-install build) `StratoSortStack--win-x64.zip` is electron-builder's `zip` target (`win.target` in