From f2c60e189df9852baa1d24bb6f1aad89d747b8a1 Mon Sep 17 00:00:00 2001 From: Levy Tate <78818969+iLevyTate@users.noreply.github.com> Date: Mon, 9 Nov 2026 12:13:23 -0500 Subject: [PATCH] docs: record the four-platform packaged smoke results and how to run it CLAUDE.md's SW-40 entry now reflects run 42649893628: signed Windows x64 and arm64 (vc_redist keeps Microsoft's signature after Azure signing, in the package and the installed copy), unsigned macOS arm64 and Linux x64 all built, launched, loaded the native AI engine and ran the packaged OCR worker. It lists what still needs a person. RELEASING.md gains a section on the dispatch-only Packaged Smoke workflow. The Dependabot canvas comment no longer says to keep 1.0.11; main is on 1.1.0 with Electron 45 and #29 is closed. --- .github/dependabot.yml | 4 ++-- CLAUDE.md | 43 ++++++++++++++++++++++++------------------ docs/RELEASING.md | 27 ++++++++++++++++++++++++++ 3 files changed, 54 insertions(+), 20 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 741efaf..c0a5010 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,8 +14,8 @@ updates: - minor - patch ignore: - # Canvas 1.0.12/1.0.13 SIGSEGV under Electron 41 on Linux; see #29. - # Keep 1.0.11 until a newer release passes the native verification gate. + # Canvas 1.0.12/1.0.13 SIGSEGV'd under Electron 41 on Linux (#29, closed). main is on 1.1.0 + # with Electron 45; this ignore only keeps those two builds from ever coming back. - dependency-name: '@napi-rs/canvas' versions: ['1.0.12', '1.0.13'] diff --git a/CLAUDE.md b/CLAUDE.md index a7eb877..7c10d88 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -118,24 +118,31 @@ These are tracked gaps that the project slash commands help address: dark/light themes with `critical+serious` hard-fail. The graph-canvas keyboard path closed 2026-07-03 (U-T14: React Flow node focus + selection toolbars, pinned by oracles). Remaining for a formal AA claim: a manual screen-reader pass (NVDA) only. -2. **SW-40 packaged verification: Windows x64 done, rest outstanding** — `asarUnpack` unpacks only - the eight worker entry bundles (`dist/{…,oramaRestoreWorker}.js`) plus the packages they require - at runtime (the pino, sharp and tesseract.js dependency closures), so main/preload/renderer stay - inside the integrity-validated asar. `verify:electron-fuses-config` fails if a pattern unpacks - `dist/main.js` again; `verify-packaged-artifacts` fails if a worker's externals do not resolve - inside `app.asar.unpacked`. On 2026-11-08/09 a Windows x64 build of main (installer + zip) passed - in Windows Sandbox (clean Windows 11, networking off): fuses match config, the renderer loads - from `app.asar`, a tampered asar header stops the app ("Integrity check failed for asar archive - entry"), silent install and first/second launch work, the zip launches and its updater skips with - the zip reason, the bundled VC++ runtime installs, local AI initializes, the OCR, - image-preprocess and embedding worker pools run, and four synthetic files analyze. The same test - on the published v5.1.2 (latest release, 2026-11-01) found local AI broken on clean PCs (missing - VC++ runtime, `NoBinaryFoundError`) and those workers crashing (`pino-std-serializers`); both are - fixed on main but **not yet released**. Not yet verified: Defender real-time-protection timing - (Sandbox disables Defender), the interactive UAC/decline path, the zip's **Install now** - click-through, whether an Azure-signed build keeps Microsoft's signature on `vc_redist`, the - vision model (timed out in the memory-limited sandbox), and macOS, Linux and Windows-arm64 - packaged builds. The checklist lives in +2. **SW-40 packaged verification: all four platforms smoke-tested; a few manual checks remain** — + `asarUnpack` unpacks only the eight worker entry bundles (`dist/{…,oramaRestoreWorker}.js`) plus + the packages they require at runtime (the pino, sharp and tesseract.js dependency closures), so + main/preload/renderer stay inside the integrity-validated asar. `verify:electron-fuses-config` + fails if a pattern unpacks `dist/main.js` again; `verify-packaged-artifacts` fails if a worker's + externals do not resolve inside `app.asar.unpacked`. On 2026-11-08/09 a Windows x64 build of main + (installer + zip) passed in Windows Sandbox (clean Windows 11, networking off): fuses match + config, the renderer loads from `app.asar`, a tampered asar header stops the app ("Integrity + check failed for asar archive entry"), silent install and first/second launch work, the zip + launches and its updater skips with the zip reason, the bundled VC++ runtime installs, local AI + initializes, the OCR, image-preprocess and embedding worker pools run, and four synthetic files + analyze. The same test on the published v5.1.2 (latest release, 2026-11-01) found local AI broken + on clean PCs (missing VC++ runtime, `NoBinaryFoundError`) and those workers crashing + (`pino-std-serializers`); both are fixed on main but **not yet released**. On 2026-11-09 the + dispatch-only `.github/workflows/packaged-smoke.yml` (run 42649893628) built, installed and + launched all four packages with a throwaway profile and `scripts/packaged-launch-smoke.js`: + Windows x64 and arm64 Azure-signed (silent NSIS install; our files carry the Kennedy Applied + Sciences signature and `vc_redist..exe` keeps Microsoft's, in the installer and the + installed copy), macOS arm64 (unsigned, Metal) and Linux x64 (xvfb, CPU). Each reached + coordinated startup, loaded the native AI engine (Windows x64 on a Hyper-V GPU falls back from + Vulkan to CPU, which the check reports but allows) and ran the packaged OCR worker on a synthetic + image. Still not verified: Defender real-time-protection timing (Sandbox disables Defender), the + interactive UAC/decline path, the zip's **Install now** click-through, the vision model (timed + out in the memory-limited sandbox), the Atlas, log-export, settings-import and large-library + restore workers, and a signed and notarized macOS build. The checklist lives in [`docs/RELEASING.md` § Packaged-integrity checks](docs/RELEASING.md#packaged-integrity-checks) — keep that the single source and do not re-fork it here. diff --git a/docs/RELEASING.md b/docs/RELEASING.md index a7136ed..cb3d737 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -412,6 +412,33 @@ feature on). through no UAC prompt and no **Install now**, and the memory-limited sandbox can time out the vision model. +### Packaged smoke workflow (all platforms) + +`.github/workflows/packaged-smoke.yml` is dispatch-only and publishes nothing. Run it on the release +branch before tagging (Actions → **Packaged Smoke** → **Run workflow**, or +`gh workflow run packaged-smoke.yml --ref `). Each leg can be switched off with its input. + +- **Windows x64 and arm64** use the same Azure Trusted Signing steps as `release.yml`. With + `require_signing` on (the default), the leg fails unless our installer and app carry the Kennedy + Applied Sciences signature and `vc_redist..exe` keeps Microsoft's, in the built package and + in the silently installed copy. That answers the Visual C++ item's signature check above. +- **macOS arm64** builds unsigned (`CSC_IDENTITY_AUTO_DISCOVERY=false`), so it does not replace the + signed and notarized check in `mac-release.yml` and `verify-mac-signing.yml`. +- **Linux x64** launches `release/build/linux-unpacked` (the files the AppImage wraps) under `xvfb` + with `--no-sandbox`. +- **Every leg** launches the app with a throwaway profile through `scripts/packaged-launch-smoke.js` + (no model downloads, updater off). It passes only if coordinated startup completes, the native AI + engine loads, and the packaged OCR worker reads a synthetic image, with no `Cannot find module`, + worker error, `ERR_DLOPEN_FAILED`, integrity failure or failed startup in the log. A GPU backend + that fails and falls back to the CPU (Vulkan on the runner's Hyper-V GPU) is recorded under + `gpuFallbacks` and allowed; `NoBinaryFoundError` on the CPU backend fails the run. Logs, the + verdict and the Windows signature table are uploaded as + `packaged-smoke---`. +- **Still manual.** The runners have no models and click nothing, so the vision model, Atlas, log + export, settings import, a large-library restore, the UAC and **Install now** paths, Defender + timing, the tamper test and the updater live smoke stay with the checklist and the Windows Sandbox + run above. + ### Windows zip (no-install build) `StratoSortStack--win-x64.zip` is electron-builder's `zip` target (`win.target` in