Repository navigation
ci: run release and notify-hub hosted and compare glibc with the v1.10.0 archive - #768
Conversation
…0.0 archive release and notify-hub move to ubuntu-24.04 and keep their release environment. The x86_64 prebuilt cell stays on its protected scale set and still builds inside the pinned Bookworm image; the arm64 cell keeps ubuntu-22.04-arm. The prebuilt glibc gate now also compares the highest numeric GLIBC_ tag of the staged libraries with the same triple's v1.10.0 release archive. The workflow downloads that archive, checks its sha256 and unpacks it, and check_prebuilt_glibc.py --baseline-root reads both trees with the same strict inspection: equal or lower passes, higher fails. The fixed 2.36 ceiling and the __isoc23_* rule still apply to the staged tree; the baseline is read, not judged, because the released x86_64 archive predates both. Preflight pins the new step and the hosted pins, still refuses removing the release environment from either job, and now also refuses a job container or services on the environment-gated release jobs, which the protected scale-set route refused before. The runner sentences in docs/ci.md (introduced by bd1fa2f) and in docs/reference/ci-runner-routing.md (introduced by e7fa559) follow the move. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.
Not checked: tests were not run; formal verification proved 0 of 4 changed function(s) (1 sampled, not proven, 3 not verified).
Formal verification. PR-changed functions: 1/4 verified (0 proven, 1 may-equivalent, 0 distinguished) · 3 not verified (3 vacuous).
Not verified on this run: inspect\_target (vacuous: never exercised), main (vacuous: never exercised), runner\_findings (vacuous: never exercised).
Graphify review — findings
Moves the release and notify-hub jobs onto hosted ubuntu-24.04 (keeping the release environment) and leaves only the x86_64 prebuilt cell on a protected gkp-od-* runner, with actionlint.yaml and the runner-routing docs updated to match. Adds a release step that downloads the v1.10.0 archive for the triple, verifies its pinned sha256, unpacks it, and passes it to check_prebuilt_glibc.py --baseline-root, which fails if the staged libraries' highest glibc tag exceeds the baseline's; the baseline is read only, never judged against the fixed ceiling, and a missing, empty or overlapping baseline fails closed, though the overlap check is lexical and does not resolve symlink aliases. Extends the preflight native-workflow findings and the release-gate and preflight tests to pin the new runner routing, shard-matrix and action-pin rules.
Worth a look
- Baseline/staging overlap check is lexical and misses symlink aliases —
scripts/check_prebuilt_glibc.py:333· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
Review partial — this diff was larger than one review pass covers, so later files were not reviewed; some findings may be missing.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 1666 functions depend on the 1494 functions this change touches.
Health — this change adds coupling hotspots:
- worse:
ci_workflow_findings()— 82 callers, 24 callees - worse:
main()— 1 callers, 9 callees - new:
inspect_tree()— 1 callers, 8 callees
Verification — 1666 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 1649 function(s) in the blast radius were not formally verified this run
Docs that may be stale (advisory)
AGENTS.md§ Build (lines 12-25): references changed symbolsbuildAGENTS.md§ What CI runs, per trigger (lines 46-69): references changed symbolsbuildAGENTS.md§ Local-only tests (no CI job runs them) (lines 70-82): references changed symbolsbuildAGENTS.md§ While developing: run only what touches your change (lines 83-90): references changed symbolsbuildAGENTS.md§ Rules for tests (lines 91-98): references changed symbolsbuildAGENTS.md§ Safety rules (lines 117-127): references changed symbolsbuildCHANGELOG.md§ Native live report checkpoints (lines 378-409): references changed symbolsbuildCHANGELOG.md§ 1.6.1 — 2026-10-18 (lines 1685-1750): references changed symbolsbuildCHANGELOG.md§ 1.6.1-rc.1 — 2026-10-17 (lines 1751-1804): references changed symbolsbuildCHANGELOG.md§ 1.6.0 — 2026-10-17 (lines 1805-1970): references changed symbolsbuild
…and 10 more.
Formal verification
No difference found (not proven): No behavior difference found in emit (not a proof).
The verifier ran both versions of emit on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.
Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.
Note: An input the sampler did not try could still differ.
Could not verify: Could not verify inspect\_target.
The verifier did not have enough to check inspect\_target, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: not verifiable: all 242 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly KeyError — names the real obstacle, not a sampling gap)
Could not verify: Could not verify main.
The verifier did not have enough to check main, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: non-vacuity: domain too small (only 1 distinct inputs exercised, need 3) — 'no divergence' would be near-vacuous
Could not verify: Could not verify runner\_findings.
The verifier did not have enough to check runner\_findings, so it is saying so rather than guessing. No false assurance is the whole point.
Guarantee: No guarantee either way, this is an honest abstention, not a pass.
Note: Reason: non-vacuity: domain too small (only 2 distinct inputs exercised, need 3) — 'no divergence' would be near-vacuous
· 2 grounded finding(s) anchored inline below; 1 more finding(s) on lines outside this diff (see the check run).
| parser.add_argument("staging_root", type=Path, help="explicit installed prebuilt staging root") | ||
| args = parser.parse_args(argv) | ||
| issues = [] | ||
| def inspect_tree(root: Path, issues: list[dict], policy: bool) -> tuple[list[dict], list[dict]]: |
There was a problem hiding this comment.
inspect_tree()
fans out to 8 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
| return targets, results | ||
|
|
||
|
|
||
| def main(argv: list[str] | None = None) -> int: |
There was a problem hiding this comment.
main()
fans out to 9 callees (efferent coupling).
Grounded coupling-delta finding (deterministic), not an LLM guess.
Keep the admitted legacy and hosted release contracts from main while retaining the reviewed workflow, archive checker and documentation changes. Resolve the two preflight script conflicts in favor of main's rules; the targeted guard and test adaptations are prepared in a following edit.
Reject containers and services on protected release jobs and adapt the preflight tests to the hosted release workflow. Keep legacy admission coverage and repair the actionlint label mutation fixtures.
Plain merge of main into this branch, with no conflicts. Main now has the hosted release and notify-hub jobs and the glibc comparison with the v1.10.0 archive (#768), which edit the release workflow, the CI documents and the preflight and glibc scripts; this branch changes none of those files. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Release and notification jobs use ubuntu-24.04 while retaining their protected release environment. The x86_64 prebuilt route keeps the pinned Bookworm image, and aarch64 keeps ubuntu-22.04-arm.
The GLIBC check compares staged libraries with the matching v1.10.0 archive after verifying its published SHA256. A higher requirement fails; the fixed ceiling and _isoc23* rejection also remain active. Admission retains both legacy and hosted release contracts and rejects containers or services on protected release jobs.
The preflight fixtures cover both forms, keep malformed actionlint configurations refused, and register all 43 GLIBC tests. Validation on the updated branch includes the complete 515-test preflight module, main-checker negative controls and real-workflow admission. Hosted CI and parity evidence remain required before merge.