From d1fddd008d3845335cd6c91d7551d0395c6f9acf Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:42:27 -0500 Subject: [PATCH 01/10] test(DEN-2038): add independent checkout-lock release canary --- .../checkout-operation-lock-canary.yml | 219 ++++++++++++++++++ 1 file changed, 219 insertions(+) create mode 100644 .github/workflows/checkout-operation-lock-canary.yml diff --git a/.github/workflows/checkout-operation-lock-canary.yml b/.github/workflows/checkout-operation-lock-canary.yml new file mode 100644 index 0000000..4a1cc97 --- /dev/null +++ b/.github/workflows/checkout-operation-lock-canary.yml @@ -0,0 +1,219 @@ +name: Checkout-local mutation ownership release canary + +on: + pull_request: + paths: + - '.github/workflows/checkout-operation-lock-canary.yml' + - 'docs/checkout-operation-lock-canary.md' + push: + branches: [main] + paths: + - '.github/workflows/checkout-operation-lock-canary.yml' + - 'docs/checkout-operation-lock-canary.md' + schedule: + - cron: '23 6 * * 4' + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: checkout-operation-lock-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +env: + ZED_CLI_REF: 1c74efd0bc137ef9905428a85aabe1fb1a0d2d05 + ZED_E2E_REF: 5577b311308523f79be0f99a986553934eac6514 + ZED_INTERFACES_REF: d1bf8ef7c88a75292cbe8d697bfd269f30d62e2b + ZED_LOCK_REF: a0dc78d385bc3ab553d3027b427f5f1428239c9c + CARGO_TERM_COLOR: always + RUST_BACKTRACE: '1' + PYTHONDONTWRITEBYTECODE: '1' + +jobs: + certify: + name: ${{ matrix.os }} checkout authority + runs-on: ${{ matrix.os }} + timeout-minutes: 55 + strategy: + fail-fast: false + matrix: + os: [ubuntu-24.04, macos-15] + + steps: + - name: Require immutable source pins + shell: bash + run: | + set -euo pipefail + [[ "$ZED_CLI_REF" =~ ^[0-9a-f]{40}$ ]] + [[ "$ZED_E2E_REF" =~ ^[0-9a-f]{40}$ ]] + [[ "$ZED_INTERFACES_REF" =~ ^[0-9a-f]{40}$ ]] + [[ "$ZED_LOCK_REF" =~ ^[0-9a-f]{40}$ ]] + + - name: Check out release canary + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + path: canary + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Check out exact independent harness + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: zed-pkg-test/zed-pkg-e2e + ref: ${{ env.ZED_E2E_REF }} + path: harness + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Check out exact product candidate + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: zed-pkg/zed-cli + ref: ${{ env.ZED_CLI_REF }} + path: zed-cli + fetch-depth: 1 + persist-credentials: false + show-progress: false + + - name: Install stable Rust + uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 + with: + toolchain: stable + components: rustfmt, clippy + + - name: Verify exact source graph + shell: bash + run: | + set -euo pipefail + test "$(git -C harness rev-parse HEAD)" = "$ZED_E2E_REF" + test "$(git -C zed-cli rev-parse HEAD)" = "$ZED_CLI_REF" + grep -F "rev = \"$ZED_INTERFACES_REF\"" zed-cli/Cargo.toml + grep -F "rev = \"$ZED_LOCK_REF\"" zed-cli/Cargo.toml + for path in \ + scripts/git_submodule_overtake_lock.py \ + scripts/git_submodule_overtake_nested_lock.py \ + scripts/project_recovery_operation_lock.py; do + test -f "harness/$path" + done + + - name: Validate source and focused contracts + shell: bash + run: | + set -euo pipefail + PYTHONPYCACHEPREFIX="$RUNNER_TEMP/python-cache" \ + python3 -m py_compile \ + harness/scripts/git_submodule_overtake_lock.py \ + harness/scripts/git_submodule_overtake_nested_lock.py \ + harness/scripts/project_recovery_operation_lock.py + git -C canary diff --check + git -C harness diff --check + git -C zed-cli diff --check + cargo fmt --all --check --manifest-path zed-cli/Cargo.toml + cargo test --locked --manifest-path zed-cli/Cargo.toml --lib project_lock + cargo test --locked --manifest-path zed-cli/Cargo.toml --lib git_submodules + cargo test --locked --manifest-path zed-cli/Cargo.toml --doc project_lock + + - name: Run strict Clippy + if: runner.os == 'Linux' + shell: bash + run: | + set -euo pipefail + cargo clippy --locked --manifest-path zed-cli/Cargo.toml \ + --lib --bin zed -- -D warnings + + - name: Build exact release executable + shell: bash + run: | + set -euo pipefail + cargo build --locked --release --manifest-path zed-cli/Cargo.toml --bin zed + mkdir -p "$RUNNER_TEMP/zed-bin" + cp zed-cli/target/release/zed "$RUNNER_TEMP/zed-bin/zed" + chmod 0755 "$RUNNER_TEMP/zed-bin/zed" + test "$("$RUNNER_TEMP/zed-bin/zed" --version)" = 'zed 0.1.0' + + - name: Certify takeover, termination, and alias serialization + shell: bash + env: + WORK_ROOT: ${{ runner.temp }}/zed-checkout-lock-root + run: | + set -euo pipefail + python3 harness/scripts/git_submodule_overtake_lock.py \ + --zed "$RUNNER_TEMP/zed-bin/zed" \ + --work-root "$WORK_ROOT" + python3 - "$WORK_ROOT/evidence/evidence.json" <<'PY' + import json, pathlib, sys + evidence = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8')) + assert evidence['schema'] == 'zed.git-submodule-overtake-operation-lock/v1' + assert len(evidence['checks']) == 6 + assert evidence['normal_completion']['observed_block_seconds'] >= 0.7 + assert evidence['owner_termination']['observed_block_seconds'] >= 0.7 + assert evidence['network_credentials'] is False + assert evidence['public_registry_mutation'] is False + PY + + - name: Certify nested superproject ownership + shell: bash + env: + WORK_ROOT: ${{ runner.temp }}/zed-checkout-lock-nested + run: | + set -euo pipefail + python3 harness/scripts/git_submodule_overtake_nested_lock.py \ + --zed "$RUNNER_TEMP/zed-bin/zed" \ + --work-root "$WORK_ROOT" + python3 - "$WORK_ROOT/evidence/nested-evidence.json" <<'PY' + import json, pathlib, sys + evidence = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8')) + assert evidence['schema'] == 'zed.git-submodule-nested-overtake-lock/v1' + assert len(evidence['checks']) == 3 + assert evidence['observed_block_seconds'] >= 0.7 + assert evidence['network_credentials'] is False + assert evidence['public_registry_mutation'] is False + PY + + - name: Certify different-home and pre-Git recovery ordering + shell: bash + env: + WORK_ROOT: ${{ runner.temp }}/zed-checkout-lock-recovery + run: | + set -euo pipefail + python3 harness/scripts/project_recovery_operation_lock.py \ + --zed "$RUNNER_TEMP/zed-bin/zed" \ + --work-root "$WORK_ROOT" + python3 - "$WORK_ROOT/evidence/recovery-evidence.json" <<'PY' + import json, pathlib, sys + evidence = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8')) + assert evidence['schema'] == 'zed.project-recovery-operation-lock/v1' + assert len(evidence['checks']) == 6 + assert evidence['different_home_waiter']['observed_block_seconds'] >= 0.7 + assert evidence['network_credentials'] is False + assert evidence['public_registry_mutation'] is False + PY + + - name: Prove every source checkout remained clean + if: always() + shell: bash + run: | + set -euo pipefail + for repository in canary harness zed-cli; do + status="$(git -C "$repository" status --porcelain=v1 --untracked-files=all)" + if [[ -n "$status" ]]; then + printf 'dirty %s checkout:\n%s\n' "$repository" "$status" >&2 + fi + test -z "$status" + done + + - name: Upload bounded checkout-lock evidence + if: always() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: checkout-operation-lock-${{ matrix.os }}-${{ github.run_id }}-${{ github.run_attempt }} + path: | + ${{ runner.temp }}/zed-checkout-lock-root/evidence + ${{ runner.temp }}/zed-checkout-lock-nested/evidence + ${{ runner.temp }}/zed-checkout-lock-recovery/evidence + if-no-files-found: warn + retention-days: 14 + include-hidden-files: false From 376e9cc26c21d0ba5a823a68f507597c68b7e828 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:42:52 -0500 Subject: [PATCH 02/10] docs(DEN-2038): define checkout-lock release canary --- docs/checkout-operation-lock-canary.md | 71 ++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 docs/checkout-operation-lock-canary.md diff --git a/docs/checkout-operation-lock-canary.md b/docs/checkout-operation-lock-canary.md new file mode 100644 index 0000000..b4cdac4 --- /dev/null +++ b/docs/checkout-operation-lock-canary.md @@ -0,0 +1,71 @@ +# Checkout-local mutation ownership release canary + +This repository provides an independent locking-focused release gate for the +remaining DEN-2038 product candidate. It imports the exact black-box harness from +`zed-pkg-test/zed-pkg-e2e` and executes it against a semantically current-main- +integrated `zed-pkg/zed-cli` commit. + +## Immutable source graph + +```text +zed-cli 1c74efd0bc137ef9905428a85aabe1fb1a0d2d05 +zed-pkg-e2e 5577b311308523f79be0f99a986553934eac6514 +zed-interfaces d1bf8ef7c88a75292cbe8d697bfd269f30d62e2b +zed-lock a0dc78d385bc3ab553d3027b427f5f1428239c9c +``` + +The product commit is a true two-parent semantic merge. It preserves the full +DEN-2038 checkout-lock/recovery implementation and current main's complete +DEN-3018 publish-ignore diagnostics and documentation. The file sets are +disjoint; neither history was selected wholesale. + +## Product boundary + +All checkout-tree mutations use one canonical `.zed/operation.lock` identity. +The reviewed product provides: + +- Git-submodule takeover ownership shared with install/add/remove/uninstall; +- superproject discovery before nested takeover lock acquisition; +- same-thread RAII reentrancy through shared `Rc` descriptor + ownership; +- a weak thread-local lookup that never extends lock lifetime; +- a naturally `!Send + !Sync` public guard; +- descriptor ownership that survives outer-before-inner guard drops; +- ordinary transaction recovery serialized across different Zed homes; and +- modular takeover recovery before any `.gitmodules` read or Git transport. + +## Fifteen process assertions + +The imported harness proves: + +1. takeover owns the project lock before Git transport; +2. a symlink-alias frozen install blocks; +3. normal release publishes complete adopted state before the waiter succeeds; +4. an ordinary install blocks behind a second takeover; +5. owner-process termination releases the descriptor lock; +6. pre-mutation termination preserves manifest bytes and leaves no staging; +7. nested takeover owns the superproject lock; +8. no nested lock identity is created; +9. a root frozen install serializes behind nested takeover; +10. different-home recovery blocks behind checkout ownership; +11. destination and backup bytes remain exact while blocked; +12. release restores exact bytes and removes staging; +13. the recovered process completes frozen installation; +14. modular takeover recovers before `git submodule sync`; and +15. exact backup bytes are restored before verification, transport, or adoption. + +## Workflow policy + +The Ubuntu 24.04 and macOS 15 matrix uses only public, immutable sources and +commit-pinned Actions. It has `contents: read`, does not persist checkout +credentials, disables Python bytecode writes, keeps compilation caches in runner +temporary storage, denies Clippy warnings on Linux, builds the exact release +binary, rejects dirty source trees without cleanup/reset, and retains only +bounded process evidence for 14 days. + +No user PAT, GitHub App secret, Linear token, Cloudflare token, R2 credential, +public package registry, Docker daemon, or persistent namespace participates. + +The primary promotion gate remains `zed-pkg-test/zed-pkg-e2e#139`. This canary is +additive evidence and cannot turn a failing primary gate into a passing release. +Linear: DEN-2038. From d018f83faef23a62bb815d7189eab0373ffc5b05 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:47:18 -0500 Subject: [PATCH 03/10] ci(DEN-2038): certify cooperative install ownership --- .../checkout-operation-lock-canary.yml | 28 +++++++++++++++++-- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/.github/workflows/checkout-operation-lock-canary.yml b/.github/workflows/checkout-operation-lock-canary.yml index 4a1cc97..41cbf64 100644 --- a/.github/workflows/checkout-operation-lock-canary.yml +++ b/.github/workflows/checkout-operation-lock-canary.yml @@ -22,8 +22,8 @@ concurrency: cancel-in-progress: true env: - ZED_CLI_REF: 1c74efd0bc137ef9905428a85aabe1fb1a0d2d05 - ZED_E2E_REF: 5577b311308523f79be0f99a986553934eac6514 + ZED_CLI_REF: 2b5897f6a5b5cf33fee7a5934a60d7aa3e70e0a0 + ZED_E2E_REF: 4be9cfc93805ab7a6d9ac2e8e2ccefd1d6ee5f29 ZED_INTERFACES_REF: d1bf8ef7c88a75292cbe8d697bfd269f30d62e2b ZED_LOCK_REF: a0dc78d385bc3ab553d3027b427f5f1428239c9c CARGO_TERM_COLOR: always @@ -34,7 +34,7 @@ jobs: certify: name: ${{ matrix.os }} checkout authority runs-on: ${{ matrix.os }} - timeout-minutes: 55 + timeout-minutes: 60 strategy: fail-fast: false matrix: @@ -95,6 +95,7 @@ jobs: for path in \ scripts/git_submodule_overtake_lock.py \ scripts/git_submodule_overtake_nested_lock.py \ + scripts/git_submodule_install_operation_lock.py \ scripts/project_recovery_operation_lock.py; do test -f "harness/$path" done @@ -107,6 +108,7 @@ jobs: python3 -m py_compile \ harness/scripts/git_submodule_overtake_lock.py \ harness/scripts/git_submodule_overtake_nested_lock.py \ + harness/scripts/git_submodule_install_operation_lock.py \ harness/scripts/project_recovery_operation_lock.py git -C canary diff --check git -C harness diff --check @@ -173,6 +175,25 @@ jobs: assert evidence['public_registry_mutation'] is False PY + - name: Certify cooperative Git-submodule installation ownership + shell: bash + env: + WORK_ROOT: ${{ runner.temp }}/zed-checkout-lock-install + run: | + set -euo pipefail + python3 harness/scripts/git_submodule_install_operation_lock.py \ + --zed "$RUNNER_TEMP/zed-bin/zed" \ + --work-root "$WORK_ROOT" + python3 - "$WORK_ROOT/evidence/install-evidence.json" <<'PY' + import json, pathlib, sys + evidence = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8')) + assert evidence['schema'] == 'zed.git-submodule-install-operation-lock/v1' + assert len(evidence['checks']) == 3 + assert evidence['observed_block_seconds'] >= 0.7 + assert evidence['network_credentials'] is False + assert evidence['public_registry_mutation'] is False + PY + - name: Certify different-home and pre-Git recovery ordering shell: bash env: @@ -213,6 +234,7 @@ jobs: path: | ${{ runner.temp }}/zed-checkout-lock-root/evidence ${{ runner.temp }}/zed-checkout-lock-nested/evidence + ${{ runner.temp }}/zed-checkout-lock-install/evidence ${{ runner.temp }}/zed-checkout-lock-recovery/evidence if-no-files-found: warn retention-days: 14 From 775cbbabdbcb394091c3de295c3da338d1bc8372 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 12:47:43 -0500 Subject: [PATCH 04/10] docs(DEN-2038): include cooperative install ownership --- docs/checkout-operation-lock-canary.md | 49 ++++++++++++++++---------- 1 file changed, 30 insertions(+), 19 deletions(-) diff --git a/docs/checkout-operation-lock-canary.md b/docs/checkout-operation-lock-canary.md index b4cdac4..0f8df3f 100644 --- a/docs/checkout-operation-lock-canary.md +++ b/docs/checkout-operation-lock-canary.md @@ -1,40 +1,48 @@ # Checkout-local mutation ownership release canary This repository provides an independent locking-focused release gate for the -remaining DEN-2038 product candidate. It imports the exact black-box harness from -`zed-pkg-test/zed-pkg-e2e` and executes it against a semantically current-main- -integrated `zed-pkg/zed-cli` commit. +complete remaining DEN-2038 product candidate. It imports the exact black-box +harness from `zed-pkg-test/zed-pkg-e2e` and executes it against a +current-main-integrated `zed-pkg/zed-cli` commit. ## Immutable source graph ```text -zed-cli 1c74efd0bc137ef9905428a85aabe1fb1a0d2d05 -zed-pkg-e2e 5577b311308523f79be0f99a986553934eac6514 +zed-cli 2b5897f6a5b5cf33fee7a5934a60d7aa3e70e0a0 +zed-pkg-e2e 4be9cfc93805ab7a6d9ac2e8e2ccefd1d6ee5f29 zed-interfaces d1bf8ef7c88a75292cbe8d697bfd269f30d62e2b zed-lock a0dc78d385bc3ab553d3027b427f5f1428239c9c ``` -The product commit is a true two-parent semantic merge. It preserves the full -DEN-2038 checkout-lock/recovery implementation and current main's complete -DEN-3018 publish-ignore diagnostics and documentation. The file sets are -disjoint; neither history was selected wholesale. +The product branch is zero commits behind the reviewed current `main`. Earlier +integration used true merge commits to preserve both the complete DEN-2038 +checkout-lock/recovery changes and current main's independent GitOps and +DEN-3018 publish-ignore work. The final feature delta remains limited to three +product files. + +The exact E2E commit includes the primary DEN-2038 harness plus disjoint current- +main test-org integrations. The six certification files are the only PR-visible +feature delta. ## Product boundary All checkout-tree mutations use one canonical `.zed/operation.lock` identity. The reviewed product provides: -- Git-submodule takeover ownership shared with install/add/remove/uninstall; +- Git-submodule takeover ownership shared with ordinary lifecycle facades; - superproject discovery before nested takeover lock acquisition; - same-thread RAII reentrancy through shared `Rc` descriptor ownership; - a weak thread-local lookup that never extends lock lifetime; - a naturally `!Send + !Sync` public guard; - descriptor ownership that survives outer-before-inner guard drops; -- ordinary transaction recovery serialized across different Zed homes; and -- modular takeover recovery before any `.gitmodules` read or Git transport. +- ordinary transaction recovery serialized across different Zed homes; +- modular takeover recovery before any `.gitmodules` read or Git transport; and +- one superproject guard spanning cooperative `install --git-submodules`, from + recovery and Git sync through dependency resolution, materialization, adapter + wiring, and final lock publication. -## Fifteen process assertions +## Eighteen process assertions The imported harness proves: @@ -47,12 +55,15 @@ The imported harness proves: 7. nested takeover owns the superproject lock; 8. no nested lock identity is created; 9. a root frozen install serializes behind nested takeover; -10. different-home recovery blocks behind checkout ownership; -11. destination and backup bytes remain exact while blocked; -12. release restores exact bytes and removes staging; -13. the recovered process completes frozen installation; -14. modular takeover recovers before `git submodule sync`; and -15. exact backup bytes are restored before verification, transport, or adoption. +10. cooperative `install --git-submodules` owns the lock before Git sync; +11. a different-home frozen install blocks through Git sync and installation; +12. the waiter succeeds only after complete lockfile and child state publication; +13. different-home recovery blocks behind checkout ownership; +14. destination and backup bytes remain exact while blocked; +15. release restores exact bytes and removes staging; +16. the recovered process completes frozen installation; +17. modular takeover recovers before `git submodule sync`; and +18. exact backup bytes are restored before verification, transport, or adoption. ## Workflow policy From 64825ed8b6ebf3adaa80db45784bd140892b13f5 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 13:07:37 -0500 Subject: [PATCH 05/10] ci(DEN-2038): pin the selected-superproject contract --- .../checkout-operation-lock-canary.yml | 23 +++++++++++++++---- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/.github/workflows/checkout-operation-lock-canary.yml b/.github/workflows/checkout-operation-lock-canary.yml index 41cbf64..7d8a8fa 100644 --- a/.github/workflows/checkout-operation-lock-canary.yml +++ b/.github/workflows/checkout-operation-lock-canary.yml @@ -22,8 +22,8 @@ concurrency: cancel-in-progress: true env: - ZED_CLI_REF: 2b5897f6a5b5cf33fee7a5934a60d7aa3e70e0a0 - ZED_E2E_REF: 4be9cfc93805ab7a6d9ac2e8e2ccefd1d6ee5f29 + ZED_CLI_REF: 28c68124e87301f562a8d423410943cf2de61064 + ZED_E2E_REF: 09fe56b65e77f9bcb6c07bab5717aa3bcd0a86c5 ZED_INTERFACES_REF: d1bf8ef7c88a75292cbe8d697bfd269f30d62e2b ZED_LOCK_REF: a0dc78d385bc3ab553d3027b427f5f1428239c9c CARGO_TERM_COLOR: always @@ -84,7 +84,7 @@ jobs: toolchain: stable components: rustfmt, clippy - - name: Verify exact source graph + - name: Verify exact source graph and authority root shell: bash run: | set -euo pipefail @@ -99,6 +99,19 @@ jobs: scripts/project_recovery_operation_lock.py; do test -f "harness/$path" done + python3 - <<'PY' + from pathlib import Path + + source = Path("zed-cli/src/main.rs").read_text(encoding="utf-8") + selected = """submodules::sync(&project)?; + managed_install::install( + &project,""" + nested = """submodules::sync(&project)?; + managed_install::install( + &cwd,""" + assert source.count(selected) == 1, "cooperative install must use the selected superproject" + assert nested not in source, "cooperative install regressed to the nested invocation cwd" + PY - name: Validate source and focused contracts shell: bash @@ -175,7 +188,7 @@ jobs: assert evidence['public_registry_mutation'] is False PY - - name: Certify cooperative Git-submodule installation ownership + - name: Certify nested cooperative installation ownership shell: bash env: WORK_ROOT: ${{ runner.temp }}/zed-checkout-lock-install @@ -188,7 +201,7 @@ jobs: import json, pathlib, sys evidence = json.loads(pathlib.Path(sys.argv[1]).read_text(encoding='utf-8')) assert evidence['schema'] == 'zed.git-submodule-install-operation-lock/v1' - assert len(evidence['checks']) == 3 + assert len(evidence['checks']) == 4 assert evidence['observed_block_seconds'] >= 0.7 assert evidence['network_credentials'] is False assert evidence['public_registry_mutation'] is False From d2c179b9e0def2c606b613d78b68eec68de30442 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 13:08:09 -0500 Subject: [PATCH 06/10] docs(DEN-2038): pin the selected-superproject contract --- docs/checkout-operation-lock-canary.md | 65 ++++++++++++++------------ 1 file changed, 35 insertions(+), 30 deletions(-) diff --git a/docs/checkout-operation-lock-canary.md b/docs/checkout-operation-lock-canary.md index 0f8df3f..d3fe7b4 100644 --- a/docs/checkout-operation-lock-canary.md +++ b/docs/checkout-operation-lock-canary.md @@ -2,27 +2,27 @@ This repository provides an independent locking-focused release gate for the complete remaining DEN-2038 product candidate. It imports the exact black-box -harness from `zed-pkg-test/zed-pkg-e2e` and executes it against a -current-main-integrated `zed-pkg/zed-cli` commit. +harness from `zed-pkg-test/zed-pkg-e2e` and executes it against the exact +three-file `zed-pkg/zed-cli` candidate. ## Immutable source graph ```text -zed-cli 2b5897f6a5b5cf33fee7a5934a60d7aa3e70e0a0 -zed-pkg-e2e 4be9cfc93805ab7a6d9ac2e8e2ccefd1d6ee5f29 +zed-cli 28c68124e87301f562a8d423410943cf2de61064 +zed-pkg-e2e 09fe56b65e77f9bcb6c07bab5717aa3bcd0a86c5 zed-interfaces d1bf8ef7c88a75292cbe8d697bfd269f30d62e2b zed-lock a0dc78d385bc3ab553d3027b427f5f1428239c9c ``` -The product branch is zero commits behind the reviewed current `main`. Earlier -integration used true merge commits to preserve both the complete DEN-2038 -checkout-lock/recovery changes and current main's independent GitOps and -DEN-3018 publish-ignore work. The final feature delta remains limited to three -product files. +The product branch was semantically composed with reviewed `main` through true +merge commits, preserving independent GitOps and DEN-3018 publish-ignore work. +The final feature delta is limited to `src/project_lock.rs`, +`src/git_submodules/cli.rs`, and `src/main.rs`; temporary finalizer artifacts +were removed before certification. -The exact E2E commit includes the primary DEN-2038 harness plus disjoint current- -main test-org integrations. The six certification files are the only PR-visible -feature delta. +The exact E2E commit includes the primary DEN-2038 harness and a static source +ratchet requiring cooperative installation to call +`managed_install::install(&project, ...)`, never the caller's nested `&cwd`. ## Product boundary @@ -38,11 +38,11 @@ The reviewed product provides: - descriptor ownership that survives outer-before-inner guard drops; - ordinary transaction recovery serialized across different Zed homes; - modular takeover recovery before any `.gitmodules` read or Git transport; and -- one superproject guard spanning cooperative `install --git-submodules`, from - recovery and Git sync through dependency resolution, materialization, adapter - wiring, and final lock publication. +- one selected-superproject guard spanning nested cooperative + `install --git-submodules`, from recovery and Git sync through dependency + resolution, materialization, adapter wiring, and final lock publication. -## Eighteen process assertions +## Nineteen process assertions The imported harness proves: @@ -53,26 +53,31 @@ The imported harness proves: 5. owner-process termination releases the descriptor lock; 6. pre-mutation termination preserves manifest bytes and leaves no staging; 7. nested takeover owns the superproject lock; -8. no nested lock identity is created; +8. no nested takeover lock identity is created; 9. a root frozen install serializes behind nested takeover; -10. cooperative `install --git-submodules` owns the lock before Git sync; -11. a different-home frozen install blocks through Git sync and installation; -12. the waiter succeeds only after complete lockfile and child state publication; -13. different-home recovery blocks behind checkout ownership; -14. destination and backup bytes remain exact while blocked; -15. release restores exact bytes and removes staging; -16. the recovered process completes frozen installation; -17. modular takeover recovers before `git submodule sync`; and -18. exact backup bytes are restored before verification, transport, or adoption. +10. cooperative install launched from `packages/client/src` owns the root lock + before Git sync; +11. nested cooperative invocation creates no nested lock, manifest, lockfile, or + staging identity; +12. a different-home root frozen install blocks through Git sync and the full + install/finalizer lifecycle; +13. the waiter succeeds only after complete root lockfile and child state + publication; +14. different-home recovery blocks behind checkout ownership; +15. destination and backup bytes remain exact while blocked; +16. release restores exact bytes and removes staging; +17. the recovered process completes frozen installation; +18. modular takeover recovers before `git submodule sync`; and +19. exact backup bytes are restored before verification, transport, or adoption. ## Workflow policy The Ubuntu 24.04 and macOS 15 matrix uses only public, immutable sources and commit-pinned Actions. It has `contents: read`, does not persist checkout -credentials, disables Python bytecode writes, keeps compilation caches in runner -temporary storage, denies Clippy warnings on Linux, builds the exact release -binary, rejects dirty source trees without cleanup/reset, and retains only -bounded process evidence for 14 days. +credentials, statically rejects cooperative `&cwd`, disables Python bytecode +writes, keeps compilation caches in runner temporary storage, denies Clippy +warnings on Linux, builds the exact release binary, rejects dirty source trees +without cleanup/reset, and retains only bounded process evidence for 14 days. No user PAT, GitHub App secret, Linear token, Cloudflare token, R2 credential, public package registry, Docker daemon, or persistent namespace participates. From 26039e350f5c459730f45ae033d334b138058c9e Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 13:17:02 -0500 Subject: [PATCH 07/10] ci(DEN-2038): pin the exact reviewed product head --- .github/workflows/checkout-operation-lock-canary.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/checkout-operation-lock-canary.yml b/.github/workflows/checkout-operation-lock-canary.yml index 7d8a8fa..14c4eea 100644 --- a/.github/workflows/checkout-operation-lock-canary.yml +++ b/.github/workflows/checkout-operation-lock-canary.yml @@ -22,7 +22,7 @@ concurrency: cancel-in-progress: true env: - ZED_CLI_REF: 28c68124e87301f562a8d423410943cf2de61064 + ZED_CLI_REF: 591b40846da73f7540bd36add33645d11cd33ab0 ZED_E2E_REF: 09fe56b65e77f9bcb6c07bab5717aa3bcd0a86c5 ZED_INTERFACES_REF: d1bf8ef7c88a75292cbe8d697bfd269f30d62e2b ZED_LOCK_REF: a0dc78d385bc3ab553d3027b427f5f1428239c9c @@ -251,4 +251,4 @@ jobs: ${{ runner.temp }}/zed-checkout-lock-recovery/evidence if-no-files-found: warn retention-days: 14 - include-hidden-files: false + include-hidden-files: false \ No newline at end of file From 30f1ccd113090a0a82e222ee12226624531f3a56 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 13:17:45 -0500 Subject: [PATCH 08/10] docs(DEN-2038): pin the exact reviewed product head --- docs/checkout-operation-lock-canary.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/checkout-operation-lock-canary.md b/docs/checkout-operation-lock-canary.md index d3fe7b4..77f28af 100644 --- a/docs/checkout-operation-lock-canary.md +++ b/docs/checkout-operation-lock-canary.md @@ -8,7 +8,7 @@ three-file `zed-pkg/zed-cli` candidate. ## Immutable source graph ```text -zed-cli 28c68124e87301f562a8d423410943cf2de61064 +zed-cli 591b40846da73f7540bd36add33645d11cd33ab0 zed-pkg-e2e 09fe56b65e77f9bcb6c07bab5717aa3bcd0a86c5 zed-interfaces d1bf8ef7c88a75292cbe8d697bfd269f30d62e2b zed-lock a0dc78d385bc3ab553d3027b427f5f1428239c9c @@ -18,7 +18,9 @@ The product branch was semantically composed with reviewed `main` through true merge commits, preserving independent GitOps and DEN-3018 publish-ignore work. The final feature delta is limited to `src/project_lock.rs`, `src/git_submodules/cli.rs`, and `src/main.rs`; temporary finalizer artifacts -were removed before certification. +were removed before certification. The last product commit adds only a rustdoc +clarification that Git synchronization, installer finalization, and transaction +recovery share the same authority root. The exact E2E commit includes the primary DEN-2038 harness and a static source ratchet requiring cooperative installation to call From ce693fa5608d496c38307ed564e4b8b22056f378 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 13:22:21 -0500 Subject: [PATCH 09/10] ci(DEN-2038): use alternate explicit hosted runner pools --- .github/workflows/checkout-operation-lock-canary.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/checkout-operation-lock-canary.yml b/.github/workflows/checkout-operation-lock-canary.yml index 14c4eea..9be40fc 100644 --- a/.github/workflows/checkout-operation-lock-canary.yml +++ b/.github/workflows/checkout-operation-lock-canary.yml @@ -38,7 +38,7 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-24.04, macos-15] + os: [ubuntu-22.04, macos-14] steps: - name: Require immutable source pins From 20883a237799d3e3370ed099bac87f17d6b1ff24 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 8 Aug 2026 15:58:46 -0500 Subject: [PATCH 10/10] test(DEN-2038): pin Python 3.11 for checkout canary --- .../checkout-operation-lock-canary.yml | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/workflows/checkout-operation-lock-canary.yml b/.github/workflows/checkout-operation-lock-canary.yml index 9be40fc..d89cf78 100644 --- a/.github/workflows/checkout-operation-lock-canary.yml +++ b/.github/workflows/checkout-operation-lock-canary.yml @@ -78,6 +78,21 @@ jobs: persist-credentials: false show-progress: false + - name: Install Python 3.11 harness runtime + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + with: + python-version: '3.11' + + - name: Verify Python harness runtime + shell: bash + run: | + set -euo pipefail + python3 --version + python3 - <<'PY' + import tomllib + print(f'tomllib available from {tomllib.__file__}') + PY + - name: Install stable Rust uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 with: @@ -251,4 +266,4 @@ jobs: ${{ runner.temp }}/zed-checkout-lock-recovery/evidence if-no-files-found: warn retention-days: 14 - include-hidden-files: false \ No newline at end of file + include-hidden-files: false